diff --git a/.cursor/rules/ui-ux-design-guidelines.mdc b/.cursor/rules/ui-ux-design-guidelines.mdc
index 12b9a7ee3..125fc744a 100644
--- a/.cursor/rules/ui-ux-design-guidelines.mdc
+++ b/.cursor/rules/ui-ux-design-guidelines.mdc
@@ -11,13 +11,13 @@ Use the rules below when:
 
 ## Rules for AI (mandatory)
 
-The codebase uses TailwindCSS v4.x (the newest version) with a custom design system defined in [maybe-design-system.css](mdc:app/assets/tailwind/maybe-design-system.css)
+The codebase uses TailwindCSS v4.x (the newest version) with a custom design system defined in [sure-design-system.css](mdc:app/assets/tailwind/sure-design-system.css)
 
-- Always start by referencing [maybe-design-system.css](mdc:app/assets/tailwind/maybe-design-system.css) to see the base primitives, functional tokens, and component tokens we use in the codebase
-- Always prefer using the functional "tokens" defined in @maybe-design-system.css when possible.
+- Always start by referencing [sure-design-system.css](mdc:app/assets/tailwind/sure-design-system.css) to see the base primitives, functional tokens, and component tokens we use in the codebase
+- Always prefer using the functional "tokens" defined in @sure-design-system.css when possible.
   - Example 1: use `text-primary` rather than `text-white`
   - Example 2: use `bg-container` rather than `bg-white`
   - Example 3: use `border border-primary` rather than `border border-gray-200`
-- Never create new styles in [maybe-design-system.css](mdc:app/assets/tailwind/maybe-design-system.css) or [application.css](mdc:app/assets/tailwind/application.css) without explicitly receiving permission to do so
+- Never create new styles in [sure-design-system.css](mdc:app/assets/tailwind/sure-design-system.css) or [application.css](mdc:app/assets/tailwind/application.css) without explicitly receiving permission to do so
 - Always generate semantic HTML
 
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index b871287d4..119f883aa 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -3,6 +3,9 @@ FROM ruby:${RUBY_VERSION}-slim-bookworm
 
 ENV DEBIAN_FRONTEND=noninteractive
 
+# libvips42 supports ActiveStorage image variants through image_processing/ruby-vips
+# for existing profile/avatar images. AccountStatement.original_file only stores
+# PDF/CSV/XLSX originals, but the devcontainer needs this broader image stack.
 RUN apt-get update -qq \
   && apt-get -y install --no-install-recommends \
     apt-utils \
@@ -11,6 +14,7 @@ RUN apt-get update -qq \
     git \
     imagemagick \
     iproute2 \
+    libvips42 \
     libpq-dev \
     libyaml-dev \
     libyaml-0-2 \
diff --git a/.devcontainer/docker-compose.yml b/.devcontainer/docker-compose.yml
index f622e3686..12b837168 100644
--- a/.devcontainer/docker-compose.yml
+++ b/.devcontainer/docker-compose.yml
@@ -5,7 +5,9 @@ x-db-env: &db_env
 
 x-rails-env: &rails_env
   DB_HOST: db
-  HOST: "0.0.0.0"
+  # Bind the dev server to all interfaces inside the container so Docker's
+  # published port reaches it from the host. Rails reads BINDING natively.
+  BINDING: "0.0.0.0"
   POSTGRES_USER: postgres
   POSTGRES_PASSWORD: postgres
   BUNDLE_PATH: /bundle
@@ -68,6 +70,9 @@ services:
       - "7900:7900"
     shm_size: 2gb
     restart: unless-stopped
+    environment:
+      SE_NODE_MAX_SESSIONS: 4
+      SE_NODE_OVERRIDE_MAX_SESSIONS: "true"
 
 volumes:
   postgres-data:
diff --git a/.env.example b/.env.example
index f5e98e7a4..e0bc454b1 100644
--- a/.env.example
+++ b/.env.example
@@ -25,19 +25,34 @@ OPENAI_ACCESS_TOKEN=
 OPENAI_MODEL=
 OPENAI_URI_BASE=
 
+# Optional: LLM token budget (applies to chat, auto-categorize, merchant detection, PDF processing).
+# Lower these for small-context local models (Ollama, LM Studio, LocalAI).
+# Defaults work for modern cloud OpenAI models without configuration.
+# LLM_CONTEXT_WINDOW=2048
+# LLM_MAX_RESPONSE_TOKENS=512
+# LLM_MAX_HISTORY_TOKENS=
+# LLM_SYSTEM_PROMPT_RESERVE=256
+# LLM_MAX_ITEMS_PER_CALL=25
+
+# Optional: OpenAI-compatible capability flags
+# OPENAI_REQUEST_TIMEOUT=60                  # HTTP timeout in seconds; raise for slow local models
+# OPENAI_SUPPORTS_PDF_PROCESSING=true        # Set to false for endpoints without vision support
+# OPENAI_SUPPORTS_RESPONSES_ENDPOINT=        # Override Responses-API vs chat.completions routing
+# LLM_JSON_MODE=                             # auto | strict | json_object | none
+
 # Optional: External AI Assistant — delegates chat to a remote AI agent
 # instead of calling LLMs directly. The agent calls back to Sure's /mcp endpoint.
 # See docs/hosting/ai.md for full details.
 # ASSISTANT_TYPE=external
 # EXTERNAL_ASSISTANT_URL=https://your-agent-host/v1/chat/completions
-# EXTERNAL_ASSISTANT_TOKEN=your-api-token
+# EXTERNAL_ASSISTANT_TOKEN=your-api-token # pipelock:ignore
 # EXTERNAL_ASSISTANT_AGENT_ID=main
 # EXTERNAL_ASSISTANT_SESSION_KEY=agent:main:main
 # EXTERNAL_ASSISTANT_ALLOWED_EMAILS=user@example.com
 
 # Optional: MCP server endpoint — enables /mcp for external AI assistants.
 # Both values are required. MCP_USER_EMAIL must match an existing user's email.
-# MCP_API_TOKEN=your-random-bearer-token
+# MCP_API_TOKEN=your-random-bearer-token # pipelock:ignore
 # MCP_USER_EMAIL=user@example.com
 
 # Optional: Langfuse config
@@ -82,7 +97,7 @@ EMAIL_SENDER=
 # Database Configuration
 DB_HOST=localhost # May need to be changed to `DB_HOST=db` if using devcontainer
 DB_PORT=5432
-POSTGRES_PASSWORD=postgres
+POSTGRES_PASSWORD=postgres # pipelock:ignore
 POSTGRES_USER=postgres
 
 # Redis configuration
@@ -94,12 +109,18 @@ REDIS_URL=redis://localhost:6379/1
 # REDIS_SENTINEL_HOSTS=sentinel1:26379,sentinel2:26379,sentinel3:26379
 # REDIS_SENTINEL_MASTER=mymaster
 # REDIS_SENTINEL_USERNAME=default
-# REDIS_PASSWORD=your-redis-password
+# REDIS_PASSWORD=your-redis-password # pipelock:ignore
 
 # App Domain
 # This is the domain that your Sure instance will be hosted at. It is used to generate links in emails and other places.
 APP_DOMAIN=
 
+# WebAuthn / passkey MFA configuration
+# RP ID is usually the registrable domain (example.com), not a full URL.
+# Allowed origins are full HTTPS origins where users access Sure.
+WEBAUTHN_RP_ID=
+WEBAUTHN_ALLOWED_ORIGINS=
+
 # OpenID Connect configuration
 OIDC_CLIENT_ID=
 OIDC_CLIENT_SECRET=
@@ -130,7 +151,7 @@ POSTHOG_HOST=
 # Active Storage Configuration - responsible for storing file uploads
 # ======================================================================================================
 #
-# * Defaults to disk storage but you can also use Amazon S3 or Cloudflare R2
+# * Defaults to disk storage but you can also use Amazon S3, Cloudflare R2, or Google Cloud Storage
 # * Set the appropriate environment variables to use these services.
 # * Ensure libvips is installed on your system for image processing - https://github.com/libvips/libvips
 #
@@ -159,3 +180,11 @@ POSTHOG_HOST=
 # GENERIC_S3_BUCKET=
 # GENERIC_S3_ENDPOINT=
 # GENERIC_S3_FORCE_PATH_STYLE= <- defaults to false
+#
+# Google Cloud Storage
+# ====================
+# ACTIVE_STORAGE_SERVICE=google <- Enables Google Cloud Storage
+# GCS_PROJECT=
+# GCS_BUCKET=
+# GCS_KEYFILE_JSON= <- JSON content of service account key (preferred)
+# GCS_KEYFILE= <- path to service account JSON key file
diff --git a/.env.local.example b/.env.local.example
index 75a8de778..cbe138774 100644
--- a/.env.local.example
+++ b/.env.local.example
@@ -28,8 +28,22 @@ TWELVE_DATA_API_KEY =
 OPENAI_ACCESS_TOKEN =
 OPENAI_URI_BASE =
 OPENAI_MODEL =
-# OPENAI_REQUEST_TIMEOUT: Request timeout in seconds (default: 60)
-# OPENAI_SUPPORTS_PDF_PROCESSING: Set to false for endpoints without vision support (default: true)
+
+# LLM token budget. Applies to ALL outbound LLM calls: chat history,
+# auto-categorize, merchant detection, provider enhancer, PDF processing.
+# Defaults to Ollama's historical 2048-token baseline so small local models
+# work out of the box — raise explicitly for cloud or larger-context models.
+# LLM_CONTEXT_WINDOW = 2048          # Total tokens the model will accept
+# LLM_MAX_RESPONSE_TOKENS = 512      # Reserved for the model's reply
+# LLM_MAX_HISTORY_TOKENS =           # Derived if unset (context - response - system_reserve)
+# LLM_SYSTEM_PROMPT_RESERVE = 256    # Tokens reserved for the system prompt
+# LLM_MAX_ITEMS_PER_CALL = 25        # Upper bound on auto-categorize / merchant batches
+
+# OpenAI-compatible capability flags (custom/self-hosted providers)
+# OPENAI_REQUEST_TIMEOUT = 60                # HTTP timeout in seconds; raise for slow local models
+# OPENAI_SUPPORTS_PDF_PROCESSING = true      # Set to false for endpoints without vision support
+# OPENAI_SUPPORTS_RESPONSES_ENDPOINT =       # true to force Responses API on custom providers
+# LLM_JSON_MODE =                            # auto | strict | json_object | none
 
 # (example: LM Studio/Docker config) OpenAI-compatible API endpoint config
 # OPENAI_URI_BASE = http://host.docker.internal:1234/
@@ -41,6 +55,11 @@ OIDC_CLIENT_SECRET=
 OIDC_ISSUER=
 OIDC_REDIRECT_URI=http://localhost:3000/auth/openid_connect/callback
 
+# WebAuthn / passkey MFA development defaults
+# RP ID must match the domain where credentials are registered.
+WEBAUTHN_RP_ID=localhost
+WEBAUTHN_ALLOWED_ORIGINS=http://localhost:3000
+
 # Langfuse config
 LANGFUSE_PUBLIC_KEY =
 LANGFUSE_SECRET_KEY =
@@ -81,3 +100,10 @@ AI_DEBUG_MODE =
 #         SSL_DEBUG: "true"
 #       volumes:
 #         - ./my-ca.crt:/certs/my-ca.crt:ro
+
+# Active Storage Configuration
+# ACTIVE_STORAGE_SERVICE=google
+# GCS_PROJECT=
+# GCS_BUCKET=
+# GCS_KEYFILE_JSON=
+# GCS_KEYFILE=
diff --git a/.env.test.example b/.env.test.example
index 9b0fbb62b..02d7fea24 100644
--- a/.env.test.example
+++ b/.env.test.example
@@ -26,6 +26,10 @@ OIDC_CLIENT_ID=
 OIDC_CLIENT_SECRET=
 OIDC_REDIRECT_URI=http://localhost:3000/auth/openid_connect/callback
 
+# WebAuthn / passkey MFA test defaults
+WEBAUTHN_RP_ID=www.example.com
+WEBAUTHN_ALLOWED_ORIGINS=http://www.example.com
+
 # ================
 # Data Providers
 # ---------------------------------------------------------------------------------
diff --git a/.erb_lint.yml b/.erb_lint.yml
index 5b4eaa6b3..d9521ca07 100644
--- a/.erb_lint.yml
+++ b/.erb_lint.yml
@@ -6,4 +6,72 @@ linters:
     rubocop_config:
       Style/StringLiterals:
         Enabled: true
-        EnforcedStyle: double_quotes
\ No newline at end of file
+        EnforcedStyle: double_quotes
+  DeprecatedClasses:
+    enabled: true
+    addendum: "Design tokens live in design/tokens/sure.tokens.json; semantic utilities are documented in app/assets/tailwind/sure-design-system.css."
+    rule_set:
+      - suggestion: "Use text-primary, text-secondary, text-subdued, text-inverse, text-link, or a semantic color token (text-success, text-warning, text-destructive)."
+        deprecated:
+          - 'text-gray-50'
+          - 'text-gray-100'
+          - 'text-gray-200'
+          - 'text-gray-500'
+          - 'text-gray-600'
+          - 'text-gray-700'
+          - 'text-gray-800'
+          - 'text-gray-900'
+          - 'text-white'
+      - suggestion: "Use bg-container, bg-container-inset, bg-surface, bg-surface-inset, bg-inverse, button-bg-primary, button-bg-secondary, or one of their hover variants."
+        deprecated:
+          - 'bg-gray-50'
+          - 'bg-gray-100'
+          - 'bg-gray-200'
+          - 'bg-gray-500'
+          - 'bg-gray-600'
+          - 'bg-gray-700'
+          - 'bg-gray-800'
+          - 'bg-gray-900'
+          - 'bg-white'
+      - suggestion: "Use border-primary, border-secondary, border-tertiary, border-subdued, border-inverse, or border-destructive."
+        deprecated:
+          - 'border-gray-200'
+          - 'border-gray-300'
+          - 'border-gray-500'
+          - 'border-gray-700'
+          - 'border-gray-900'
+          - 'border-white'
+      # Custom @utility tokens (bg-inverse, text-inverse, text-primary, etc.) do
+      # NOT support Tailwind's `/N` opacity modifier syntax — modifiers like
+      # `text-inverse/70` silently compile to nothing. Use `opacity-N` on the
+      # parent element, or migrate the token to `@theme --color-X` in
+      # design/tokens/sure.tokens.json so Tailwind auto-generates the
+      # color-mix pipeline. See #1653.
+      - suggestion: "Custom @utility tokens drop `/N` opacity modifiers silently. Use `opacity-N` instead, or migrate the token to @theme in design/tokens/sure.tokens.json (see #1653)."
+        deprecated:
+          - 'text-inverse\/\d+'
+          - 'bg-inverse\/\d+'
+          - 'bg-inverse-hover\/\d+'
+          - 'border-inverse\/\d+'
+          - 'text-primary\/\d+'
+          - 'text-secondary\/\d+'
+          - 'text-subdued\/\d+'
+          - 'border-primary\/\d+'
+          - 'border-secondary\/\d+'
+          - 'border-subdued\/\d+'
+          - 'border-destructive\/\d+'
+          - 'border-solid\/\d+'
+          - 'button-bg-primary\/\d+'
+          - 'button-bg-primary-hover\/\d+'
+          - 'button-bg-secondary\/\d+'
+          - 'button-bg-secondary-hover\/\d+'
+          - 'button-bg-secondary-strong\/\d+'
+          - 'button-bg-secondary-strong-hover\/\d+'
+          - 'button-bg-disabled\/\d+'
+          - 'button-bg-destructive\/\d+'
+          - 'button-bg-destructive-hover\/\d+'
+          - 'button-bg-ghost-hover\/\d+'
+          - 'button-bg-outline-hover\/\d+'
+          - 'tab-item-active\/\d+'
+          - 'tab-item-hover\/\d+'
+          - 'tab-bg-group\/\d+'
diff --git a/.gitattributes b/.gitattributes
index 767c681d5..b387bb10a 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -3,6 +3,9 @@
 # Mark the database schema as having been generated.
 db/schema.rb linguist-generated
 
+# Mark generated design system CSS (built from tokens/sure.tokens.json).
+app/assets/tailwind/sure-design-system/_generated.css linguist-generated
+
 # Mark any vendored files as having been vendored.
 vendor/* linguist-vendored
 config/credentials/*.yml.enc diff=rails_credentials
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 1c098fd39..87726005e 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -86,7 +86,7 @@ Sidekiq handles asynchronous tasks:
 - **Stimulus Controllers**: Handle interactivity, organized alongside components
 - **Charts**: D3.js for financial visualizations (time series, donut, sankey)
 - **Styling**: Tailwind CSS v4.x with custom design system
-  - Design system defined in `app/assets/tailwind/maybe-design-system.css`
+  - Design system defined in `app/assets/tailwind/sure-design-system.css`
   - Always use functional tokens (e.g., `text-primary` not `text-white`)
   - Prefer semantic HTML elements over JS components
   - Use `icon` helper for icons, never `lucide_icon` directly
@@ -261,7 +261,7 @@ end
 ## TailwindCSS Design System
 
 ### Design System Rules
-- **Always reference `app/assets/tailwind/maybe-design-system.css`** for primitives and tokens
+- **Always reference `app/assets/tailwind/sure-design-system.css`** for primitives and tokens
 - **Use functional tokens** defined in design system:
   - `text-primary` instead of `text-white`
   - `bg-container` instead of `bg-white`
diff --git a/.github/workflows/chart-ci.yml b/.github/workflows/chart-ci.yml
index d5ce7c532..9f3b25958 100644
--- a/.github/workflows/chart-ci.yml
+++ b/.github/workflows/chart-ci.yml
@@ -4,14 +4,14 @@ on:
   pull_request:
     paths:
       - 'charts/**'
-      - 'config/initializers/version.rb'
+      - '.sure-version'
       - '.github/workflows/chart-ci.yml'
   push:
     branches:
       - main
     paths:
       - 'charts/**'
-      - 'config/initializers/version.rb'
+      - '.sure-version'
       - '.github/workflows/chart-ci.yml'
 
 jobs:
@@ -20,22 +20,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Check version alignment
         shell: bash
         run: |
           set -euo pipefail
 
-          RAILS_VERSION=$(grep -oP '"\K[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?' config/initializers/version.rb | head -n 1 || true)
+          RAILS_VERSION=$(cat .sure-version | tr -d '[:space:]')
           if [ -z "$RAILS_VERSION" ]; then
-            echo "::error::Could not extract a version string from config/initializers/version.rb — ensure it contains a quoted semver like VERSION = \"1.2.3\""
+            echo "::error::Could not read version from .sure-version"
             exit 1
           fi
           CHART_VERSION=$(sed -n 's/^version: //p' charts/sure/Chart.yaml | head -n 1)
           APP_VERSION=$(sed -n 's/^appVersion: "\{0,1\}\([^"]*\)"\{0,1\}/\1/p' charts/sure/Chart.yaml | head -n 1)
 
-          echo "Rails version (version.rb):     $RAILS_VERSION"
+          echo "App version (.sure-version):     $RAILS_VERSION"
           echo "Helm chart version (Chart.yaml): $CHART_VERSION"
           echo "Helm appVersion (Chart.yaml):    $APP_VERSION"
 
@@ -53,7 +53,7 @@ jobs:
 
           if [ "$ERRORS" -gt 0 ]; then
             echo ""
-            echo "To fix: ensure version in config/initializers/version.rb matches"
+            echo "To fix: ensure version in .sure-version matches"
             echo "both 'version' and 'appVersion' in charts/sure/Chart.yaml"
             exit 1
           fi
@@ -64,10 +64,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Helm
-        uses: azure/setup-helm@v4.3.1
+        uses: azure/setup-helm@v5
 
       - name: Add chart dependencies repositories
         run: |
diff --git a/.github/workflows/chart-release.yml b/.github/workflows/chart-release.yml
index 23fac9b88..e09bd9483 100644
--- a/.github/workflows/chart-release.yml
+++ b/.github/workflows/chart-release.yml
@@ -18,7 +18,7 @@ jobs:
       app_version: ${{ steps.tag.outputs.app_version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -28,20 +28,20 @@ jobs:
         run: |
           set -euo pipefail
 
-          # Read the canonical version from the Rails app (single source of truth)
-          APP_SEMVER=$(grep -oP '"\K[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?' config/initializers/version.rb | head -n 1 || true)
+          # Read the canonical version from .sure-version (single source of truth)
+          APP_SEMVER=$(cat .sure-version | tr -d '[:space:]')
           if [ -z "$APP_SEMVER" ]; then
-            echo "::error::Could not extract version from config/initializers/version.rb"
+            echo "::error::Could not read version from .sure-version"
             exit 1
           fi
-          echo "App version from version.rb: $APP_SEMVER"
+          echo "App version from .sure-version: $APP_SEMVER"
 
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             # Use the app version as the chart version (monorepo: versions stay in sync)
             TAG_NAME="chart-v${APP_SEMVER}"
 
             if git rev-parse "refs/tags/${TAG_NAME}" >/dev/null 2>&1; then
-              echo "::error::Tag ${TAG_NAME} already exists. Bump the version in config/initializers/version.rb and charts/sure/Chart.yaml first."
+              echo "::error::Tag ${TAG_NAME} already exists. Bump the version in .sure-version and charts/sure/Chart.yaml first."
               exit 1
             fi
 
@@ -79,13 +79,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download Helm chart artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: helm-chart-package
           path: ${{ runner.temp }}/helm-artifacts
 
       - name: Create chart GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ needs.prepare_release.outputs.tag_name }}
           name: ${{ needs.prepare_release.outputs.tag_name }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eae6bb5e3..0859eca33 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
@@ -25,7 +25,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
@@ -41,7 +41,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
@@ -57,12 +57,12 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
-          node-version: "20"
+          node-version: "24"
           cache: "npm"
 
       - name: Install dependencies
@@ -72,7 +72,7 @@ jobs:
       - name: Lint/Format js code
         run: npm run lint
 
-  test:
+  test_unit:
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
@@ -104,7 +104,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install --no-install-recommends -y google-chrome-stable curl libvips postgresql-client libpq-dev
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
@@ -121,11 +121,57 @@ jobs:
       - name: Unit and integration tests
         run: bin/rails test
 
+  test_system:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    env:
+      PLAID_CLIENT_ID: foo
+      PLAID_SECRET: bar
+      DATABASE_URL: postgres://postgres:postgres@localhost:5432
+      REDIS_URL: redis://localhost:6379
+      RAILS_ENV: test
+
+    services:
+      postgres:
+        image: postgres
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: --health-cmd="pg_isready" --health-interval=10s --health-timeout=5s --health-retries=3
+
+      redis:
+        image: redis
+        ports:
+          - 6379:6379
+        options: --health-cmd="redis-cli ping" --health-interval=10s --health-timeout=5s --health-retries=3
+
+    steps:
+      - name: Install packages
+        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y google-chrome-stable curl libvips postgresql-client libpq-dev
+
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: .ruby-version
+          bundler-cache: true
+
+      - name: DB setup and smoke test
+        run: |
+          bin/rails db:create
+          bin/rails db:schema:load
+          bin/rails db:seed
+
       - name: System tests
         run: DISABLE_PARALLELIZATION=true bin/rails test:system
 
       - name: Keep screenshots from failed system tests
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: failure()
         with:
           name: screenshots
diff --git a/.github/workflows/flutter-build.yml b/.github/workflows/flutter-build.yml
index 198a2ea41..696a8e9f7 100644
--- a/.github/workflows/flutter-build.yml
+++ b/.github/workflows/flutter-build.yml
@@ -2,6 +2,10 @@ name: Flutter Mobile Build
 
 on:
   workflow_call:
+    outputs:
+      has_app_release_aab:
+        description: "Whether a signed release AAB artifact was produced"
+        value: ${{ jobs.build-android.outputs.has_app_release_aab }}
   workflow_dispatch:
 
 permissions:
@@ -12,13 +16,15 @@ jobs:
     name: Build Android APK
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    outputs:
+      has_app_release_aab: ${{ steps.check_secrets.outputs.has_keystore }}
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -87,7 +93,7 @@ jobs:
           fi
 
       - name: Upload APK artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: app-release-apk
           path: |
@@ -103,7 +109,7 @@ jobs:
 
       - name: Upload AAB artifact
         if: steps.check_secrets.outputs.has_keystore == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: app-release-aab
           path: mobile/build/app/outputs/bundle/release/app-release.aab
@@ -116,7 +122,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
@@ -161,7 +167,7 @@ jobs:
           echo "For distribution, you need to configure code signing with Apple certificates" >> build/ios-build-info.txt
 
       - name: Upload iOS build artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: ios-build-unsigned
           path: |
diff --git a/.github/workflows/google-play-upload.yml b/.github/workflows/google-play-upload.yml
new file mode 100644
index 000000000..efb762e02
--- /dev/null
+++ b/.github/workflows/google-play-upload.yml
@@ -0,0 +1,108 @@
+name: Google Play Upload
+
+on:
+  workflow_call:
+    inputs:
+      notes:
+        description: "Google Play release notes"
+        required: false
+        type: string
+      track:
+        description: "Google Play track (internal, alpha, beta, production)"
+        required: false
+        default: "internal"
+        type: string
+    secrets:
+      GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64:
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  upload:
+    name: Upload Android AAB to Google Play
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Check Google Play credentials
+        id: check_prereqs
+        env:
+          GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64 }}
+        run: |
+          set -eu
+
+          missing=()
+          if [ -z "${GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64-}" ]; then
+            missing+=("GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64")
+          fi
+
+          if [ "${#missing[@]}" -eq 0 ]; then
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "enabled=false" >> "$GITHUB_OUTPUT"
+          {
+            echo "Missing required Google Play secrets:"
+            printf " - %s\n" "${missing[@]}"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Skip Google Play upload
+        if: ${{ steps.check_prereqs.outputs.enabled != 'true' }}
+        run: |
+          echo "Skipping Google Play upload because required credentials are not configured."
+
+      - name: Download Android AAB artifact
+        if: ${{ steps.check_prereqs.outputs.enabled == 'true' }}
+        uses: actions/download-artifact@v7
+        with:
+          name: app-release-aab
+          path: ${{ runner.temp }}/android-aab
+
+      - name: Prepare Google Play credentials
+        id: play_creds
+        if: ${{ steps.check_prereqs.outputs.enabled == 'true' }}
+        env:
+          GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64 }}
+        run: |
+          set -euo pipefail
+          CREDENTIALS_PATH="$RUNNER_TEMP/google-play-service-account.json"
+          echo "$GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64" | base64 --decode > "$CREDENTIALS_PATH"
+          echo "credentials-path=$CREDENTIALS_PATH" >> "$GITHUB_OUTPUT"
+
+      - name: Resolve AAB path
+        id: aab
+        if: ${{ steps.check_prereqs.outputs.enabled == 'true' }}
+        run: |
+          set -euo pipefail
+          AAB_PATH="$(find "${{ runner.temp }}/android-aab" -name '*.aab' | head -n 1)"
+          if [ -z "$AAB_PATH" ]; then
+            echo "::error::No Android App Bundle (.aab) found in downloaded artifacts"
+            exit 1
+          fi
+          echo "aab-path=$AAB_PATH" >> "$GITHUB_OUTPUT"
+
+      - name: Create release notes file
+        id: notes
+        if: ${{ steps.check_prereqs.outputs.enabled == 'true' && inputs.notes != '' }}
+        env:
+          NOTES: ${{ inputs.notes }}
+        run: |
+          set -euo pipefail
+          NOTES_DIR="$RUNNER_TEMP/google-play-whatsnew"
+          mkdir -p "$NOTES_DIR"
+          printf '%s\n' "$NOTES" > "$NOTES_DIR/whatsnew-en-US"
+          echo "notes-dir=$NOTES_DIR" >> "$GITHUB_OUTPUT"
+
+      - name: Upload to Google Play
+        if: ${{ steps.check_prereqs.outputs.enabled == 'true' }}
+        uses: r0adkll/upload-google-play@v1
+        with:
+          serviceAccountJson: ${{ steps.play_creds.outputs.credentials-path }}
+          packageName: am.sure.mobile
+          releaseFiles: ${{ steps.aab.outputs.aab-path }}
+          tracks: ${{ inputs.track }}
+          status: completed
+          whatsNewDirectory: ${{ steps.notes.outputs.notes-dir }}
diff --git a/.github/workflows/helm-publish.yml b/.github/workflows/helm-publish.yml
index f38a786da..9f6c6b3b6 100644
--- a/.github/workflows/helm-publish.yml
+++ b/.github/workflows/helm-publish.yml
@@ -29,12 +29,12 @@ jobs:
       app_version: ${{ steps.version.outputs.app_version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - name: Install Helm
-        uses: azure/setup-helm@v4.3.1
+        uses: azure/setup-helm@v5
 
       - name: Resolve chart and app versions
         id: version
@@ -88,7 +88,7 @@ jobs:
           helm package charts/sure -d .cr-release-packages
 
       - name: Upload packaged chart artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: helm-chart-package
           path: .cr-release-packages/*.tgz
@@ -98,7 +98,7 @@ jobs:
 
       - name: Checkout gh-pages
         if: ${{ inputs.update_gh_pages }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: gh-pages
           path: gh-pages
diff --git a/.github/workflows/ios-testflight.yml b/.github/workflows/ios-testflight.yml
index 1852a2c52..6e058642c 100644
--- a/.github/workflows/ios-testflight.yml
+++ b/.github/workflows/ios-testflight.yml
@@ -15,7 +15,7 @@ on:
         type: string
   push:
     tags:
-      - 'ios-v*'
+      - 'v*'
 
 permissions:
   contents: read
@@ -23,12 +23,12 @@ permissions:
 jobs:
   build-and-upload:
     name: Build signed IPA and upload to TestFlight
-    runs-on: macos-latest
+    runs-on: macos-26
     timeout-minutes: 120
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Check TestFlight credentials
         id: check_prereqs
@@ -82,6 +82,14 @@ jobs:
         run: |
           echo "Skipping TestFlight upload because required credentials are not configured."
 
+      - name: Select Xcode 26
+        if: ${{ steps.check_prereqs.outputs.enabled == 'true' }}
+        run: |
+          set -euo pipefail
+          sudo xcode-select -s /Applications/Xcode_26.4.app/Contents/Developer
+          xcodebuild -version
+          xcrun --sdk iphoneos --show-sdk-version
+
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
         if: ${{ steps.check_prereqs.outputs.enabled == 'true' }}
@@ -95,10 +103,6 @@ jobs:
         if: ${{ steps.check_prereqs.outputs.enabled == 'true' }}
         run: flutter pub get
 
-      - name: Copy app icon source
-        if: ${{ steps.check_prereqs.outputs.enabled == 'true' }}
-        run: cp public/android-chrome-512x512.png mobile/assets/icon/app_icon.png
-
       - name: Generate app icons
         working-directory: mobile
         if: ${{ steps.check_prereqs.outputs.enabled == 'true' }}
@@ -154,7 +158,44 @@ jobs:
         run: |
           set -euo pipefail
 
+          IOS_VERSION="$(tr -d '[:space:]' < ../.sure-version | sed 's/-.*$//')"
+          IOS_BUILD_NUMBER="$(date -u +%Y%m%d%H%M)"
+          ARCHIVE_PATH="$RUNNER_TEMP/Runner.xcarchive"
+          EXPORT_PATH="$PWD/build/ios/ipa"
           EXPORT_PLIST="$RUNNER_TEMP/ExportOptions.plist"
+          python3 <<'PY'
+          import os
+          import re
+          from pathlib import Path
+
+          path = Path("ios/Runner.xcodeproj/project.pbxproj")
+          text = path.read_text()
+
+          team = os.environ["IOS_TEAM_ID"]
+          profile = os.environ["PROFILE_NAME"]
+          identity = os.environ["IOS_DISTRIBUTION_CERT_NAME"]
+
+          def patch_block(match):
+              block = match.group(0)
+              if "PRODUCT_BUNDLE_IDENTIFIER = am.sure.mobile;" not in block:
+                  return block
+              if "CODE_SIGN_STYLE = Manual;" not in block:
+                  block = block.replace("CURRENT_PROJECT_VERSION = \"$(FLUTTER_BUILD_NUMBER)\";", "CURRENT_PROJECT_VERSION = \"$(FLUTTER_BUILD_NUMBER)\";\n\t\t\t\tCODE_SIGN_STYLE = Manual;")
+              if '"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "Apple Distribution";' not in block:
+                  block = re.sub(r'DEVELOPMENT_TEAM = .*?;', f'"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "{identity}";\n\t\t\t\tDEVELOPMENT_TEAM = {team};', block, count=1)
+              else:
+                  block = re.sub(r'"CODE_SIGN_IDENTITY\[sdk=iphoneos\*\]" = ".*?";', f'"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "{identity}";', block)
+                  block = re.sub(r'DEVELOPMENT_TEAM = .*?;', f'DEVELOPMENT_TEAM = {team};', block)
+              if "PROVISIONING_PROFILE_SPECIFIER = " in block:
+                  block = re.sub(r'PROVISIONING_PROFILE_SPECIFIER = .*?;', f'PROVISIONING_PROFILE_SPECIFIER = "{profile}";', block)
+              else:
+                  block = block.replace(f'DEVELOPMENT_TEAM = {team};', f'DEVELOPMENT_TEAM = {team};\n\t\t\t\tPROVISIONING_PROFILE_SPECIFIER = "{profile}";')
+              return block
+
+          text = re.sub(r'isa = XCBuildConfiguration;\n\s+baseConfigurationReference = .*?;\n\s+buildSettings = \{.*?\n\s+name = (?:Debug|Release|Profile);\n\s+\};', patch_block, text, flags=re.S)
+          path.write_text(text)
+          PY
+
           cat > "$EXPORT_PLIST" <<EOF
           <?xml version="1.0" encoding="UTF-8"?>
           <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -181,11 +222,37 @@ jobs:
           </plist>
           EOF
 
-          CODE_SIGN_IDENTITY="${IOS_DISTRIBUTION_CERT_NAME}" \
-          CODE_SIGN_STYLE=Manual \
-          DEVELOPMENT_TEAM="${IOS_TEAM_ID}" \
-          PROVISIONING_PROFILE_SPECIFIER="${PROFILE_NAME}" \
-          flutter build ipa --release --export-options-plist="$EXPORT_PLIST"
+          if [ -z "$IOS_VERSION" ]; then
+            echo "::error::.sure-version is empty or unreadable"
+            exit 1
+          fi
+
+          echo "Using iOS version: $IOS_VERSION"
+          echo "Using iOS build number: $IOS_BUILD_NUMBER"
+
+          flutter build ios \
+            --release \
+            --no-codesign \
+            --build-name="$IOS_VERSION" \
+            --build-number="$IOS_BUILD_NUMBER"
+
+          xcodebuild \
+            -workspace ios/Runner.xcworkspace \
+            -scheme Runner \
+            -configuration Release \
+            -archivePath "$ARCHIVE_PATH" \
+            -destination 'generic/platform=iOS' \
+            MARKETING_VERSION="$IOS_VERSION" \
+            CURRENT_PROJECT_VERSION="$IOS_BUILD_NUMBER" \
+            archive
+
+          mkdir -p "$EXPORT_PATH"
+
+          xcodebuild \
+            -exportArchive \
+            -archivePath "$ARCHIVE_PATH" \
+            -exportPath "$EXPORT_PATH" \
+            -exportOptionsPlist "$EXPORT_PLIST"
 
       - name: Prepare TestFlight auth key
         id: testflight_key
@@ -195,8 +262,11 @@ jobs:
           APP_STORE_CONNECT_API_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_KEY_BASE64 }}
         run: |
           set -euo pipefail
-          KEY_FILE="$RUNNER_TEMP/AuthKey_${APP_STORE_CONNECT_API_KEY_ID}.p8"
+          KEY_DIR="$HOME/.appstoreconnect/private_keys"
+          mkdir -p "$KEY_DIR"
+          KEY_FILE="$KEY_DIR/AuthKey_${APP_STORE_CONNECT_API_KEY_ID}.p8"
           echo "$APP_STORE_CONNECT_API_KEY_BASE64" | base64 --decode > "$KEY_FILE"
+          chmod 600 "$KEY_FILE"
           echo "key-file=$KEY_FILE" >> "$GITHUB_OUTPUT"
 
       - name: Upload IPA to TestFlight
@@ -219,12 +289,11 @@ jobs:
             --file "$IPA_PATH" \
             --type ios \
             --apiKey "$APP_STORE_CONNECT_API_KEY_ID" \
-            --apiIssuer "$APP_STORE_CONNECT_API_ISSUER_ID" \
-            --apiPrivateKey "$APP_STORE_CONNECT_API_KEY_FILE"
+            --apiIssuer "$APP_STORE_CONNECT_API_ISSUER_ID"
 
       - name: Upload build artifact
         if: ${{ steps.check_prereqs.outputs.enabled == 'true' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: ios-ipa-testflight
           path: mobile/build/ios/ipa/*.ipa
@@ -232,9 +301,14 @@ jobs:
 
       - name: Cleanup signing keychain
         if: ${{ always() && steps.check_prereqs.outputs.enabled == 'true' }}
+        env:
+          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
         run: |
           set -euo pipefail
           KEYCHAIN_PATH="${{ steps.signing.outputs.keychain-path }}"
           if [ -n "$KEYCHAIN_PATH" ] && [ -f "$KEYCHAIN_PATH" ]; then
             security delete-keychain "$KEYCHAIN_PATH"
           fi
+
+          KEY_FILE="$HOME/.appstoreconnect/private_keys/AuthKey_${APP_STORE_CONNECT_API_KEY_ID}.p8"
+          rm -f "$KEY_FILE"
diff --git a/.github/workflows/llm-evals.yml b/.github/workflows/llm-evals.yml
new file mode 100644
index 000000000..13b608336
--- /dev/null
+++ b/.github/workflows/llm-evals.yml
@@ -0,0 +1,457 @@
+name: LLM Evals
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+
+env:
+  EVAL_MODELS: gpt-4.1
+  RAILS_ENV: test
+  DATABASE_URL: postgres://postgres:postgres@localhost:5432
+  REDIS_URL: redis://localhost:6379
+  PLAID_CLIENT_ID: foo
+  PLAID_SECRET: bar
+
+jobs:
+  check_openai:
+    name: Check OpenAI credentials
+    runs-on: ubuntu-latest
+    outputs:
+      should_run: ${{ steps.gate.outputs.should_run }}
+      reason: ${{ steps.gate.outputs.reason }}
+
+    steps:
+      - name: Validate OpenAI token and quota
+        id: gate
+        env:
+          OPENAI_ACCESS_TOKEN: ${{ secrets.OPENAI_ACCESS_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [ -z "${OPENAI_ACCESS_TOKEN:-}" ]; then
+            echo "OpenAI token is not configured; skipping eval workflow."
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+            echo "reason=OPENAI_ACCESS_TOKEN secret is missing" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          TEST_MODEL=$(printf '%s' "$EVAL_MODELS" | cut -d',' -f1 | xargs)
+          if [ -z "$TEST_MODEL" ]; then
+            TEST_MODEL="gpt-4.1"
+          fi
+
+          echo "Checking API access with model: ${TEST_MODEL}"
+
+          RESPONSE_FILE="$(mktemp)"
+          STATUS_CODE=$(curl -sS -o "$RESPONSE_FILE" -w "%{http_code}" \
+            https://api.openai.com/v1/chat/completions \
+            -H "Authorization: Bearer ${OPENAI_ACCESS_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "{\"model\":\"${TEST_MODEL}\",\"messages\":[{\"role\":\"user\",\"content\":\"ping\"}],\"max_tokens\":1}")
+
+          if [ "$STATUS_CODE" = "200" ]; then
+            echo "OpenAI token check passed."
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+            echo "reason=ok" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          ERROR_MESSAGE=$(ruby -rjson -e '
+            body = File.read(ARGV[0]) rescue ""
+            data = JSON.parse(body) rescue {}
+            message = data.dig("error", "message") || data["message"] || "unknown error"
+            puts message.gsub(/\s+/, " ").strip
+          ' "$RESPONSE_FILE")
+
+          echo "OpenAI check failed (${STATUS_CODE}): ${ERROR_MESSAGE}"
+          echo "should_run=false" >> "$GITHUB_OUTPUT"
+          echo "reason=OpenAI token invalid or insufficient quota (${STATUS_CODE})" >> "$GITHUB_OUTPUT"
+          exit 0
+
+  discover_datasets:
+    name: Discover eval datasets
+    needs: check_openai
+    if: needs.check_openai.outputs.should_run == 'true'
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: --health-cmd="pg_isready" --health-interval=10s --health-timeout=5s --health-retries=3
+
+      redis:
+        image: redis:7.2
+        ports:
+          - 6379:6379
+        options: --health-cmd="redis-cli ping" --health-interval=10s --health-timeout=5s --health-retries=3
+
+    outputs:
+      datasets: ${{ steps.datasets.outputs.datasets }}
+      models: ${{ steps.models.outputs.models }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: .ruby-version
+          bundler-cache: true
+
+      - name: Prepare database
+        run: |
+          bin/rails db:create
+          bin/rails db:schema:load
+
+      - name: Import eval datasets
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          shopt -s nullglob
+          dataset_files=(db/eval_data/*.yml)
+
+          if [ ${#dataset_files[@]} -eq 0 ]; then
+            echo "::error::No eval dataset files found under db/eval_data/*.yml"
+            exit 1
+          fi
+
+          for dataset_file in "${dataset_files[@]}"; do
+            echo "Importing ${dataset_file}"
+            bundle exec rake "evals:import_dataset[${dataset_file}]"
+          done
+
+
+      - name: Resolve eval models
+        id: models
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          MODELS_JSON=$(bin/rails runner '
+            models = ENV.fetch("EVAL_MODELS", "").split(",").map(&:strip).reject(&:blank?)
+            puts models.to_json
+          ')
+
+          if [ "$MODELS_JSON" = "[]" ]; then
+            echo "::error::EVAL_MODELS is empty. Set at least one model, for example: EVAL_MODELS=gpt-4.1"
+            exit 1
+          fi
+
+          {
+            echo "models<<EOF"
+            echo "$MODELS_JSON"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Resolve available eval datasets
+        id: datasets
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          DATASETS_JSON=$(bin/rails runner 'puts Eval::Dataset.order(:name).pluck(:name).to_json')
+
+          if [ "$DATASETS_JSON" = "[]" ]; then
+            echo "::error::No eval datasets found. Import one first with: rake evals:import_dataset[path/to/file.yml]"
+            exit 1
+          fi
+
+          {
+            echo "datasets<<EOF"
+            echo "$DATASETS_JSON"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+  run_evals:
+    name: Run eval for ${{ matrix.dataset }} on ${{ matrix.model }}
+    needs: [check_openai, discover_datasets]
+    if: needs.check_openai.outputs.should_run == 'true'
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        dataset: ${{ fromJson(needs.discover_datasets.outputs.datasets) }}
+        model: ${{ fromJson(needs.discover_datasets.outputs.models) }}
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: --health-cmd="pg_isready" --health-interval=10s --health-timeout=5s --health-retries=3
+
+      redis:
+        image: redis:7.2
+        ports:
+          - 6379:6379
+        options: --health-cmd="redis-cli ping" --health-interval=10s --health-timeout=5s --health-retries=3
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: .ruby-version
+          bundler-cache: true
+
+      - name: Prepare database
+        run: |
+          bin/rails db:create
+          bin/rails db:schema:load
+
+      - name: Import eval datasets
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          shopt -s nullglob
+          dataset_files=(db/eval_data/*.yml)
+
+          if [ ${#dataset_files[@]} -eq 0 ]; then
+            echo "::error::No eval dataset files found under db/eval_data/*.yml"
+            exit 1
+          fi
+
+          for dataset_file in "${dataset_files[@]}"; do
+            echo "Importing ${dataset_file}"
+            bundle exec rake "evals:import_dataset[${dataset_file}]"
+          done
+
+      - name: Prepare dataset artifact names
+        id: dataset_slug
+        env:
+          DATASET: ${{ matrix.dataset }}
+          MODEL: ${{ matrix.model }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          slug=$(printf '%s' "$DATASET" \
+            | tr '[:upper:]' '[:lower:]' \
+            | sed -E 's/[^a-z0-9]+/-/g; s/^-+//; s/-+$//; s/-{2,}/-/g')
+
+          if [ -z "$slug" ]; then
+            echo "::error::Could not generate dataset slug from '$DATASET'"
+            exit 1
+          fi
+
+          echo "slug=$slug" >> "$GITHUB_OUTPUT"
+          model_slug=$(printf '%s' "$MODEL" \
+            | tr '[:upper:]' '[:lower:]' \
+            | sed -E 's/[^a-z0-9]+/-/g; s/^-+//; s/-+$//; s/-{2,}/-/g')
+
+          if [ -z "$model_slug" ]; then
+            echo "::error::Could not generate model slug from '$MODEL'"
+            exit 1
+          fi
+
+          echo "model_slug=$model_slug" >> "$GITHUB_OUTPUT"
+          echo "log_path=tmp/evals/${slug}-${model_slug}.log" >> "$GITHUB_OUTPUT"
+          echo "json_path=tmp/evals/${slug}-${model_slug}.json" >> "$GITHUB_OUTPUT"
+
+      - name: Verify dataset exists
+        env:
+          DATASET: ${{ matrix.dataset }}
+          MODEL: ${{ matrix.model }}
+        run: |
+          bin/rails runner 'dataset = Eval::Dataset.find_by(name: ENV.fetch("DATASET")); abort("Dataset not found: #{ENV.fetch("DATASET")}") if dataset.nil?'
+
+      - name: Run eval
+        env:
+          DATASET: ${{ matrix.dataset }}
+          MODEL: ${{ matrix.model }}
+          OPENAI_ACCESS_TOKEN: ${{ secrets.OPENAI_ACCESS_TOKEN }}
+        run: |
+          set -euo pipefail
+          mkdir -p tmp/evals
+          bundle exec rake "evals:run[${DATASET},${MODEL}]" | tee "${{ steps.dataset_slug.outputs.log_path }}"
+
+      - name: Export run summary
+        id: export_summary
+        env:
+          DATASET: ${{ matrix.dataset }}
+          MODEL: ${{ matrix.model }}
+          JSON_PATH: ${{ steps.dataset_slug.outputs.json_path }}
+        run: |
+          set -euo pipefail
+          mkdir -p "$(dirname "$JSON_PATH")"
+
+          bin/rails runner '
+            dataset = Eval::Dataset.find_by!(name: ENV.fetch("DATASET"))
+            run = Eval::Run.where(dataset: dataset, model: ENV.fetch("MODEL")).order(created_at: :desc).first
+            abort("No eval run found for dataset #{dataset.name} and model #{ENV.fetch("MODEL")}") if run.nil?
+            payload = {
+              dataset: dataset.name,
+              dataset_metadata: dataset.metadata,
+              model: ENV.fetch("MODEL"),
+              run_id: run.id,
+              status: run.status,
+              created_at: run.created_at,
+              completed_at: run.completed_at,
+              total_prompt_tokens: run.total_prompt_tokens,
+              total_completion_tokens: run.total_completion_tokens,
+              total_cost: run.total_cost,
+              metrics: run.metrics,
+              accuracy: run.accuracy || 0.0,
+              duration_seconds: run.duration_seconds
+            }
+            File.write(ENV.fetch("JSON_PATH"), JSON.pretty_generate(payload))
+          '
+
+          echo "accuracy=$(jq -r '.accuracy // 0' "$JSON_PATH")" >> "$GITHUB_OUTPUT"
+          echo "status=$(jq -r '.status' "$JSON_PATH")" >> "$GITHUB_OUTPUT"
+
+      - name: Upload eval artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: llm-evals-${{ steps.dataset_slug.outputs.slug }}-${{ steps.dataset_slug.outputs.model_slug }}
+          path: |
+            ${{ steps.dataset_slug.outputs.log_path }}
+            ${{ steps.dataset_slug.outputs.json_path }}
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Output eval result
+        shell: bash
+        run: |
+          echo "### Eval Result: ${{ matrix.dataset }} / ${{ matrix.model }}" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "- **Status**: ${{ steps.export_summary.outputs.status }}" >> "$GITHUB_STEP_SUMMARY"
+          echo "- **Accuracy**: ${{ steps.export_summary.outputs.accuracy }}%" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+
+  summarize_evals:
+    name: Summarize LLM Evals
+    needs: [check_openai, run_evals]
+    if: always() && needs.check_openai.outputs.should_run == 'true'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v7
+        with:
+          path: eval-artifacts
+          pattern: llm-evals-*
+
+      - name: Generate summary
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          echo "# 🧪 LLM Evals Results" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          printf "Triggered by: \`%s\`\n" "$GITHUB_REF" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "---" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+
+          # Find all JSON result files
+          shopt -s globstar nullglob
+          json_files=(eval-artifacts/**/*.json)
+
+          if [ ${#json_files[@]} -eq 0 ]; then
+            echo "⚠️ No eval results found." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          # Table header
+          echo "| Dataset | Model | Status | Accuracy | Cost | Duration |" >> "$GITHUB_STEP_SUMMARY"
+          echo "|---------|-------|--------|----------|------|----------|" >> "$GITHUB_STEP_SUMMARY"
+
+          all_passed=true
+          accuracy_threshold=70
+          for json_file in "${json_files[@]}"; do
+            dataset=$(jq -r '.dataset' "$json_file")
+            model=$(jq -r '.model' "$json_file")
+            status=$(jq -r '.status' "$json_file")
+            accuracy=$(jq -r '.accuracy // 0' "$json_file")
+            cost=$(jq -r '.total_cost // 0' "$json_file")
+            duration=$(jq -r '.duration_seconds // 0' "$json_file")
+
+            if [ "$status" = "completed" ] && awk -v accuracy="$accuracy" -v threshold="$accuracy_threshold" 'BEGIN { exit !((accuracy + 0) >= threshold) }'; then
+              icon="✅"
+            else
+              icon="❌"
+              all_passed=false
+            fi
+
+            printf '| %s | %s | %s %s | %s%% | \\$%s | %ss |\n' \
+              "$dataset" "$model" "$icon" "$status" "$accuracy" "$cost" "$duration" >> "$GITHUB_STEP_SUMMARY"
+          done
+
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "---" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+
+          if [ "$all_passed" = "true" ]; then
+            echo "✅ **All evals passed!**" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "❌ **Some evals failed. Check the details above.**" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "📦 Artifacts with full logs are available for download." >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Check eval thresholds
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          shopt -s globstar nullglob
+          json_files=(eval-artifacts/**/*.json)
+
+          failed=0
+          accuracy_threshold=70
+          for json_file in "${json_files[@]}"; do
+            status=$(jq -r '.status' "$json_file")
+            accuracy=$(jq -r '.accuracy // 0' "$json_file")
+            dataset=$(jq -r '.dataset' "$json_file")
+            model=$(jq -r '.model' "$json_file")
+
+            if [ "$status" != "completed" ]; then
+              echo "::error::Eval for $dataset / $model did not complete successfully"
+              failed=$((failed + 1))
+            fi
+
+            # Fail if accuracy is below 70%
+            if awk -v accuracy="$accuracy" -v threshold="$accuracy_threshold" 'BEGIN { exit !((accuracy + 0) < threshold) }'; then
+              echo "::error::Accuracy for $dataset / $model is below threshold: ${accuracy}%"
+              failed=$((failed + 1))
+            fi
+          done
+
+          if [ $failed -gt 0 ]; then
+            echo "::error::$failed eval(s) failed or below threshold"
+            exit 1
+          fi
+
+          echo "All evals passed with acceptable accuracy."
+
+  skip_evals:
+    name: Skip evals (no valid OpenAI token/quota)
+    needs: check_openai
+    if: needs.check_openai.outputs.should_run != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Report skip reason
+        run: |
+          echo "LLM evals were skipped gracefully."
+          echo "Reason: ${{ needs.check_openai.outputs.reason }}"
diff --git a/.github/workflows/mobile-build.yml b/.github/workflows/mobile-build.yml
index 38507c273..fe985bb01 100644
--- a/.github/workflows/mobile-build.yml
+++ b/.github/workflows/mobile-build.yml
@@ -64,21 +64,21 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
 
       - name: Download Android APK artifact
         continue-on-error: true
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@v7
         with:
           name: app-release-apk
           path: ${{ runner.temp }}/mobile-artifacts
 
       - name: Download iOS build artifact
         continue-on-error: true
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@v7
         with:
           name: ios-build-unsigned
           path: ${{ runner.temp }}/ios-build
@@ -170,7 +170,7 @@ jobs:
             ${{ runner.temp }}/release-assets/*
 
       - name: Checkout gh-pages branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: gh-pages
           path: gh-pages
diff --git a/.github/workflows/mobile-release.yml b/.github/workflows/mobile-release.yml
index 5de88a6d3..0852a7208 100644
--- a/.github/workflows/mobile-release.yml
+++ b/.github/workflows/mobile-release.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -71,12 +71,22 @@ jobs:
     uses: ./.github/workflows/flutter-build.yml
     secrets: inherit
 
+  play-store:
+    name: Upload Android to Google Play
+    if: ${{ needs.build.outputs.has_app_release_aab == 'true' }}
+    needs: [build, prepare_release]
+    uses: ./.github/workflows/google-play-upload.yml
+    with:
+      notes: "Mobile release ${{ needs.prepare_release.outputs.tag_name }}"
+      track: internal
+    secrets: inherit
+
   testflight:
     name: Upload iOS to TestFlight
-    needs: [build, release]
+    needs: [build, prepare_release]
     uses: ./.github/workflows/ios-testflight.yml
     with:
-      notes: "Mobile release ${{ needs.release.outputs.tag_name }}"
+      notes: "Mobile release ${{ needs.prepare_release.outputs.tag_name }}"
     secrets: inherit
 
   release:
@@ -102,13 +112,13 @@ jobs:
           echo "Extracted version: $VERSION"
 
       - name: Download Android APK artifact
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@v7
         with:
           name: app-release-apk
           path: ${{ runner.temp }}/mobile-artifacts
 
       - name: Download iOS build artifact
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@v7
         with:
           name: ios-build-unsigned
           path: ${{ runner.temp }}/ios-build
@@ -160,13 +170,23 @@ jobs:
             exit 1
           fi
 
-      - name: Create GitHub Release
+      - name: Create or update GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           VERSION="${{ steps.version.outputs.version }}"
           TAG="${{ steps.version.outputs.tag_name }}"
+          REPO="${{ github.repository }}"
+
+          mapfile -d '' -t RELEASE_ASSETS < <(
+            find "${{ runner.temp }}/release-assets" -maxdepth 1 -type f -print0
+          )
+
+          if [[ "${#RELEASE_ASSETS[@]}" -eq 0 ]]; then
+            echo "::error::No release assets were produced"
+            exit 1
+          fi
 
           cat > /tmp/release-notes.md <<NOTES
           ## Mobile-Only Release: ${VERSION}
@@ -184,20 +204,61 @@ jobs:
           # Strip heredoc indentation
           sed -i 's/^          //' /tmp/release-notes.md
 
-          PRERELEASE_FLAG=""
+          RELEASE_ARGS=(
+            "--repo"
+            "$REPO"
+            "--title"
+            "$TAG"
+            "--notes-file"
+            /tmp/release-notes.md
+          )
           if [[ "$TAG" == *"alpha"* ]] || [[ "$TAG" == *"beta"* ]] || [[ "$TAG" == *"rc"* ]]; then
-            PRERELEASE_FLAG="--prerelease"
+            RELEASE_ARGS+=("--prerelease")
           fi
 
-          gh release create "$TAG" \
-            --repo "${{ github.repository }}" \
-            --title "$TAG" \
-            --notes-file /tmp/release-notes.md \
-            $PRERELEASE_FLAG \
-            ${{ runner.temp }}/release-assets/*
+          if release_view_output="$(gh release view "$TAG" --repo "$REPO" 2>&1)"; then
+            is_immutable="$(gh release view "$TAG" --repo "$REPO" --json isImmutable --jq '.isImmutable')"
+            existing_assets="$(gh release view "$TAG" --repo "$REPO" --json assets --jq '.assets[].name')"
+            echo "Release ${TAG} already exists. Updating metadata."
+            gh release edit "$TAG" "${RELEASE_ARGS[@]}"
+
+            if [[ "$is_immutable" == "true" ]]; then
+              echo "Release is immutable. Verifying existing release assets are already present."
+              missing_assets=0
+              for asset in "${RELEASE_ASSETS[@]}"; do
+                asset_name="$(basename "$asset")"
+                if ! grep -Fxq "$asset_name" <<<"$existing_assets"; then
+                  echo "::error::Immutable release ${TAG} is missing asset: ${asset_name}"
+                  missing_assets=1
+                fi
+              done
+
+              if [[ "$missing_assets" != "0" ]]; then
+                echo "::error::Release assets cannot be changed on immutable releases. Recreate the release to update assets."
+                exit 1
+              fi
+
+              echo "Immutable release already has required assets. Skipping asset upload."
+              exit 0
+            fi
+          else
+            if ! echo "$release_view_output" | grep -Eiq "(not found|404)"; then
+              echo "::error::Failed to inspect existing release ${TAG}."
+              echo "$release_view_output"
+              exit 1
+            fi
+
+            echo "Creating release ${TAG} with attached assets."
+            gh release create "$TAG" "${RELEASE_ARGS[@]}" "${RELEASE_ASSETS[@]}"
+            exit 0
+          fi
+
+          for asset in "${RELEASE_ASSETS[@]}"; do
+            gh release upload "$TAG" "$asset" --repo "$REPO" --clobber
+          done
 
       - name: Checkout gh-pages branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: gh-pages
           path: gh-pages
diff --git a/.github/workflows/pipelock.yml b/.github/workflows/pipelock.yml
index deef6acd9..7b3b46af9 100644
--- a/.github/workflows/pipelock.yml
+++ b/.github/workflows/pipelock.yml
@@ -11,7 +11,7 @@ jobs:
   security-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -29,3 +29,4 @@ jobs:
             config/locales/views/reports/
             docs/hosting/ai.md
             app/models/provider/binance.rb
+            workers/preview/package-lock.json
diff --git a/.github/workflows/preview-cleanup.yml b/.github/workflows/preview-cleanup.yml
new file mode 100644
index 000000000..b36c2cba4
--- /dev/null
+++ b/.github/workflows/preview-cleanup.yml
@@ -0,0 +1,216 @@
+name: Cleanup PR Previews
+
+on:
+  # Run hourly to check for expired previews
+  schedule:
+    - cron: '0 * * * *'
+
+  # Immediately cleanup when PR is closed
+  pull_request:
+    types: [closed, unlabeled]
+
+  # Allow manual trigger
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to cleanup (optional, cleans all expired if empty)'
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  deployments: write
+
+jobs:
+  cleanup-on-close:
+    name: Cleanup closed PR preview
+    if: github.event_name == 'pull_request' && (github.event.action == 'closed' || (github.event.action == 'unlabeled' && github.event.label.name == 'preview-cf'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: "24"
+
+      - name: Install Wrangler
+        run: npm install -g wrangler
+
+      - name: Delete preview Worker
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          WORKER_NAME="sure-preview-${{ github.event.pull_request.number }}"
+          echo "Deleting Worker: $WORKER_NAME"
+
+          # Delete the worker (this also stops any running containers)
+          wrangler delete --name "$WORKER_NAME" --force || echo "Worker may not exist"
+
+      - name: Delete GitHub Deployment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const environment = `preview-pr-${{ github.event.pull_request.number }}`;
+            const description = context.payload.action === 'closed'
+              ? 'PR closed - preview deleted'
+              : 'preview-cf label removed - preview deleted';
+
+            try {
+              // Get deployments for this environment
+              const { data: deployments } = await github.rest.repos.listDeployments({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                environment: environment
+              });
+
+              // Mark all deployments as inactive
+              for (const deployment of deployments) {
+                await github.rest.repos.createDeploymentStatus({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  deployment_id: deployment.id,
+                  state: 'inactive',
+                  description
+                });
+              }
+
+              console.log(`Marked ${deployments.length} deployments as inactive`);
+            } catch (error) {
+              console.log('No deployments to cleanup or error:', error.message);
+            }
+
+  cleanup-expired:
+    name: Cleanup expired previews
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: "24"
+
+      - name: Install Wrangler
+        run: npm install -g wrangler
+
+      - name: Cleanup expired previews
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_INPUT: ${{ inputs.pr_number }}
+        run: |
+          # If specific PR number provided, only cleanup that one
+          if [ -n "$PR_INPUT" ]; then
+            if [[ "$PR_INPUT" =~ ^[1-9][0-9]*$ ]]; then
+              PR_NUM="$PR_INPUT"
+              WORKER_NAME="sure-preview-$PR_NUM"
+              echo "Manually deleting Worker: $WORKER_NAME"
+              wrangler delete --name "$WORKER_NAME" --force || echo "Worker may not exist"
+
+              # Cleanup GitHub deployment for this PR
+              echo "Cleaning up GitHub deployment for PR #$PR_NUM"
+              gh api \
+                -X GET "/repos/${{ github.repository }}/deployments?environment=preview-pr-$PR_NUM" \
+                --jq '.[].id' 2>/dev/null | while read -r DEPLOY_ID; do
+                  if [ -n "$DEPLOY_ID" ]; then
+                    gh api \
+                      -X POST "/repos/${{ github.repository }}/deployments/$DEPLOY_ID/statuses" \
+                      -f state=inactive \
+                      -f description="Preview manually deleted" || true
+                  fi
+                done || echo "No deployments to cleanup or error occurred"
+            else
+              echo "Invalid PR number input '$PR_INPUT'; skipping manual cleanup"
+            fi
+
+            exit 0
+          fi
+
+          # Get list of all preview workers
+          echo "Fetching list of preview workers..."
+
+          # Use Cloudflare API to list workers and read modified_on from the list response.
+          # The per-script endpoint returns raw script content, not JSON metadata.
+          WORKERS_RESPONSE=$(curl -fsS -X GET \
+            "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/workers/scripts" \
+            -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
+            -H "Content-Type: application/json") || {
+              echo "Failed to fetch preview worker list from Cloudflare"
+              exit 1
+            }
+
+          if ! echo "$WORKERS_RESPONSE" | jq -e '.success == true and (.result | type == "array")' >/dev/null 2>&1; then
+            echo "Cloudflare API returned an invalid worker list response"
+            echo "$WORKERS_RESPONSE" | jq -c '.errors // .'
+            exit 1
+          fi
+
+          WORKERS=$(echo "$WORKERS_RESPONSE" | jq -r '
+            .result[]
+            | select(.id | startswith("sure-preview-"))
+            | [.id, (.modified_on // "")]
+            | @tsv
+          ')
+
+          if [ -z "$WORKERS" ]; then
+            echo "No preview workers found"
+            exit 0
+          fi
+
+          echo "Found preview workers:"
+          echo "$WORKERS" | cut -f1
+
+          # Check each worker's deployment time
+          CUTOFF_TIME=$(date -d '24 hours ago' +%s)
+
+          while IFS=$'\t' read -r WORKER MODIFIED_ON; do
+            [ -n "$WORKER" ] || continue
+            echo "Checking $WORKER..."
+
+            if [ -z "$MODIFIED_ON" ]; then
+              echo "No modified_on timestamp for $WORKER; skipping"
+              continue
+            fi
+
+            if ! MODIFIED_TS=$(date -d "$MODIFIED_ON" +%s 2>/dev/null); then
+              echo "Invalid modified_on timestamp for $WORKER ($MODIFIED_ON); skipping"
+              continue
+            fi
+
+            if [ "$MODIFIED_TS" -lt "$CUTOFF_TIME" ]; then
+              echo "Worker $WORKER is older than 24 hours, deleting..."
+              if wrangler delete --name "$WORKER" --force; then
+                # Extract PR number and cleanup GitHub deployment
+                PR_NUM=$(echo "$WORKER" | sed 's/sure-preview-//')
+                if [[ "$PR_NUM" =~ ^[1-9][0-9]*$ ]]; then
+                  echo "Cleaning up GitHub deployment for PR #$PR_NUM"
+                  gh api \
+                    -X GET "/repos/${{ github.repository }}/deployments?environment=preview-pr-$PR_NUM" \
+                    --jq '.[].id' 2>/dev/null | while read -r DEPLOY_ID; do
+                      gh api \
+                        -X POST "/repos/${{ github.repository }}/deployments/$DEPLOY_ID/statuses" \
+                        -f state=inactive \
+                        -f description="Preview expired after 24 hours" || true
+                    done || echo "No deployments to cleanup or error occurred"
+                else
+                  echo "Could not extract a valid PR number from $WORKER; skipping deployment cleanup"
+                fi
+              else
+                echo "Failed to delete $WORKER; skipping deployment status update"
+              fi
+            else
+              echo "Worker $WORKER is still within 24-hour window, keeping..."
+            fi
+          done <<< "$WORKERS"
+
+          echo "Cleanup complete"
diff --git a/.github/workflows/preview-deploy.yml b/.github/workflows/preview-deploy.yml
new file mode 100644
index 000000000..eff9c847a
--- /dev/null
+++ b/.github/workflows/preview-deploy.yml
@@ -0,0 +1,189 @@
+name: Deploy PR Preview
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+    paths-ignore:
+      - 'charts/**'
+      - 'docs/**'
+      - '*.md'
+
+jobs:
+  deploy-preview:
+    if: contains(github.event.pull_request.labels.*.name, 'preview-cf')
+    name: Deploy to Cloudflare Containers
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: write
+      deployments: write
+
+    steps:
+      - name: Wait for PR CI to pass
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const headSha = context.payload.pull_request.head.sha;
+            const timeoutMs = 10 * 60 * 1000;
+            const pollMs = 15 * 1000;
+            const startedAt = Date.now();
+            let lastState = 'not found';
+
+            const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+            while (Date.now() - startedAt < timeoutMs) {
+              const { data } = await github.rest.actions.listWorkflowRunsForRepo({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                event: 'pull_request',
+                head_sha: headSha,
+                per_page: 20,
+              });
+
+              const prRun = data.workflow_runs.find((run) => run.name === 'Pull Request' && run.head_sha === headSha);
+
+              if (prRun) {
+                lastState = `${prRun.status}/${prRun.conclusion ?? 'pending'}`;
+                core.info(`Pull Request workflow ${prRun.id}: ${lastState}`);
+
+                if (prRun.status === 'completed') {
+                  if (prRun.conclusion === 'success') {
+                    return;
+                  }
+
+                  core.setFailed(`Pull Request workflow concluded with ${prRun.conclusion}`);
+                  return;
+                }
+              }
+
+              await sleep(pollMs);
+            }
+
+            core.setFailed(`Timed out waiting for Pull Request workflow for ${headSha}. Last state: ${lastState}`);
+
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+
+      - name: Install Wrangler dependencies
+        working-directory: workers/preview
+        run: npm install
+
+      - name: Configure preview files for this PR
+        working-directory: workers/preview
+        run: |
+          sed -i "s/\${PR_NUMBER}/${{ github.event.pull_request.number }}/g" wrangler.toml
+          sed -i "s/\${PR_NUMBER}/${{ github.event.pull_request.number }}/g" src/index.ts
+          cat wrangler.toml
+
+      - name: Create GitHub Deployment
+        id: deployment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const deployment = await github.rest.repos.createDeployment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              ref: context.payload.pull_request.head.sha,
+              environment: `preview-pr-${{ github.event.pull_request.number }}`,
+              auto_merge: false,
+              required_contexts: [],
+              description: 'PR Preview Deployment'
+            });
+            return deployment.data.id;
+          result-encoding: string
+
+      - name: Deploy to Cloudflare Containers
+        id: deploy
+        working-directory: workers/preview
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          npx wrangler deploy --var "PR_NUMBER:${{ github.event.pull_request.number }}"
+
+          # Get the deployment URL
+          PREVIEW_URL="https://sure-preview-${{ github.event.pull_request.number }}.${{ secrets.CLOUDFLARE_WORKERS_SUBDOMAIN }}.workers.dev"
+          echo "preview_url=${PREVIEW_URL}" >> "$GITHUB_OUTPUT"
+
+      - name: Warm preview container
+        env:
+          PREVIEW_URL: ${{ steps.deploy.outputs.preview_url }}
+        run: |
+          echo "Triggering preview wake-up..."
+          curl -fsS "$PREVIEW_URL/" >/dev/null || true
+
+      - name: Update Deployment Status
+        if: always() && steps.deployment.outputs.result
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const state = '${{ job.status }}' === 'success' ? 'success' : 'failure';
+            await github.rest.repos.createDeploymentStatus({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              deployment_id: ${{ steps.deployment.outputs.result }},
+              state: state,
+              environment_url: state === 'success' ? '${{ steps.deploy.outputs.preview_url }}' : undefined,
+              description: state === 'success' ? 'Preview deployed successfully' : 'Preview deployment failed'
+            });
+
+      - name: Comment on PR
+        if: success()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const previewUrl = '${{ steps.deploy.outputs.preview_url }}';
+            const commentBody = `## 🚀 Preview Deployment Ready
+
+            Your preview environment has been deployed to Cloudflare Containers with the PR's Docker image.
+
+            **Preview URL:** ${previewUrl}
+
+            > ⏰ This preview is intended to be cleaned up after **24 hours** of the last deployment once the cleanup workflow is live on the default branch.
+            > 💤 The container will sleep after 30 minutes of inactivity and wake on the next request.
+
+            ---
+            <sub>Deployed from commit ${{ github.event.pull_request.head.sha }}</sub>`;
+
+            // Find existing comment
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: ${{ github.event.pull_request.number }}
+            });
+
+            const botComment = comments.find(comment =>
+              comment.user.type === 'Bot' &&
+              comment.body.includes('Preview Deployment Ready')
+            );
+
+            if (botComment) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+                body: commentBody
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: ${{ github.event.pull_request.number }},
+                body: commentBody
+              });
+            }
+      - name: Store cleanup metadata
+        if: success()
+        uses: actions/upload-artifact@v6
+        with:
+          name: preview-cleanup-pr-${{ github.event.pull_request.number }}
+          path: |
+            workers/preview/wrangler.toml
+          retention-days: 2
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 12473d176..225886dea 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -55,9 +55,14 @@ jobs:
       fail-fast: false
       matrix:
         platform: [amd64, arm64]
+        include:
+          - platform: amd64
+            runs-on: ubuntu-24.04
+          - platform: arm64
+            runs-on: ubuntu-24.04-arm
 
     timeout-minutes: 60
-    runs-on: ${{ matrix.platform == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
+    runs-on: ${{ matrix.runs-on }}
 
     outputs:
       tags: ${{ steps.meta.outputs.tags }}
@@ -68,15 +73,15 @@ jobs:
 
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v4.2.0
+        uses: actions/checkout@v5
         with:
           ref: ${{ github.event.inputs.ref || github.ref }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.10.0
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to the container registry
-        uses: docker/login-action@v3.3.0
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -98,7 +103,6 @@ jobs:
                 BASE_CONFIG+=$'\n'"type=raw,value=latest"
               else
                 BASE_CONFIG+=$'\n'"type=raw,value=stable"
-                BASE_CONFIG+=$'\n'"type=raw,value=latest"
               fi
             fi
           fi
@@ -114,7 +118,7 @@ jobs:
 
       - name: Extract metadata for Docker
         id: meta
-        uses: docker/metadata-action@v5.6.0
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           flavor: latest=false
@@ -128,7 +132,7 @@ jobs:
             org.opencontainers.image.description=A multi-arch Docker image for the Sure Rails app
 
       - name: Publish 'linux/${{ matrix.platform }}' image by digest
-        uses: docker/build-push-action@v6.16.0
+        uses: docker/build-push-action@v7
         id: build
         with:
           context: .
@@ -154,7 +158,7 @@ jobs:
 
       - name: Upload the Docker image digest
         if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') || github.event_name == 'schedule' || github.event.inputs.push }}
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@v6
         with:
           name: digest-${{ matrix.platform }}
           path: ${{ runner.temp }}/digests/*
@@ -174,17 +178,17 @@ jobs:
 
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.10.0
+        uses: docker/setup-buildx-action@v4
 
       - name: Download Docker image digests
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@v7
         with:
           path: ${{ runner.temp }}/digests
           pattern: digest-*
           merge-multiple: true
 
       - name: Log in to the container registry
-        uses: docker/login-action@v3.3.0
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -271,19 +275,19 @@ jobs:
 
     steps:
       - name: Download Android APK artifact
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@v7
         with:
           name: app-release-apk
           path: ${{ runner.temp }}/mobile-artifacts
 
       - name: Download iOS build artifact
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@v7
         with:
           name: ios-build-unsigned
           path: ${{ runner.temp }}/ios-build
 
       - name: Download Helm chart artifact
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@v7
         with:
           name: helm-chart-package
           path: ${{ runner.temp }}/helm-artifacts
@@ -334,7 +338,7 @@ jobs:
           ls -la "${{ runner.temp }}/release-assets/"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ github.ref_name }}
           name: ${{ github.ref_name }}
@@ -421,14 +425,14 @@ jobs:
           echo "branch=$SOURCE_BRANCH" >> $GITHUB_OUTPUT
 
       - name: Check out source branch
-        uses: actions/checkout@v4.2.0
+        uses: actions/checkout@v5
         with:
           ref: ${{ steps.source_branch.outputs.branch }}
-          token: ${{ secrets.GH_PAT }}
+          token: ${{ github.token }}
 
       - name: Bump pre-release version
         run: |
-           VERSION_FILE="config/initializers/version.rb"
+           VERSION_FILE=".sure-version"
            CHART_FILE="charts/sure/Chart.yaml"
 
            # Ensure version file exists
@@ -444,7 +448,7 @@ jobs:
            fi
  
            # Extract current version
-           CURRENT_VERSION=$(grep -oP '"\K[0-9]+\.[0-9]+\.[0-9]+-(alpha|beta|rc)\.[0-9]+' "$VERSION_FILE")
+           CURRENT_VERSION=$(cat "$VERSION_FILE" | tr -d '[:space:]')
            if [ -z "$CURRENT_VERSION" ]; then
              echo "ERROR: Could not extract version from $VERSION_FILE"
              exit 1
@@ -475,11 +479,11 @@ jobs:
            echo "New version: $NEW_VERSION"
 
            # Update the version file
-           sed -i "s/\"$CURRENT_VERSION\"/\"$NEW_VERSION\"/" "$VERSION_FILE"
+           echo "$NEW_VERSION" > "$VERSION_FILE"
 
            # Verify the change
-           echo "Updated version.rb:"
-           grep "semver" "$VERSION_FILE"
+           echo "Updated .sure-version:"
+           cat "$VERSION_FILE"
 
            # Update Helm chart version and appVersion
            sed -i -E "s/^version: .*/version: ${NEW_VERSION}/" "$CHART_FILE"
@@ -496,7 +500,7 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
-          git add config/initializers/version.rb
+          git add .sure-version
           git add charts/sure/Chart.yaml
 
           # Check if there are changes to commit
diff --git a/.gitignore b/.gitignore
index 731dd2f9e..6a4d77fe0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -123,4 +123,4 @@ scripts/
 .auto-claude-status
 .claude_settings.json
 .security-key
-logs/security/
\ No newline at end of file
+logs/security/
diff --git a/.junie/guidelines.md b/.junie/guidelines.md
index 88c9eb4e9..2097634b8 100644
--- a/.junie/guidelines.md
+++ b/.junie/guidelines.md
@@ -470,14 +470,14 @@ Use the rules below when:
 
 ## Rules for AI (mandatory)
 
-The codebase uses TailwindCSS v4.x (the newest version) with a custom design system defined in [maybe-design-system.css](app/assets/tailwind/maybe-design-system.css)
+The codebase uses TailwindCSS v4.x (the newest version) with a custom design system defined in [sure-design-system.css](app/assets/tailwind/sure-design-system.css)
 
-- Always start by referencing [maybe-design-system.css](app/assets/tailwind/maybe-design-system.css) to see the base primitives, functional tokens, and component tokens we use in the codebase
-- Always prefer using the functional "tokens" defined in @maybe-design-system.css when possible.
+- Always start by referencing [sure-design-system.css](app/assets/tailwind/sure-design-system.css) to see the base primitives, functional tokens, and component tokens we use in the codebase
+- Always prefer using the functional "tokens" defined in @sure-design-system.css when possible.
   - Example 1: use `text-primary` rather than `text-white`
   - Example 2: use `bg-container` rather than `bg-white`
   - Example 3: use `border border-primary` rather than `border border-gray-200`
-- Never create new styles in [maybe-design-system.css](app/assets/tailwind/maybe-design-system.css) or [application.css](app/assets/tailwind/application.css) without explicitly receiving permission to do so
+- Never create new styles in [sure-design-system.css](app/assets/tailwind/sure-design-system.css) or [application.css](app/assets/tailwind/application.css) without explicitly receiving permission to do so
 - Always generate semantic HTML
 ```
 
diff --git a/.sure-version b/.sure-version
new file mode 100644
index 000000000..38d939e70
--- /dev/null
+++ b/.sure-version
@@ -0,0 +1 @@
+0.7.1-alpha.10
diff --git a/AGENTS.md b/AGENTS.md
index d3e52c168..c5359f025 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -48,6 +48,21 @@ When adding or modifying API endpoints in `app/controllers/api/v1/`, you **MUST*
 ### Post-commit API consistency (LLM checklist)
 After every API endpoint commit, ensure: (1) **Minitest** behavioral coverage in `test/controllers/api/v1/{resource}_controller_test.rb` (no behavioral assertions in rswag); (2) **rswag** remains docs-only (no `expect`/`assert_*` in `spec/requests/api/v1/`); (3) **rswag auth** uses the same API key pattern everywhere (`X-Api-Key`, not OAuth/Bearer). Full checklist: [.cursor/rules/api-endpoint-consistency.mdc](.cursor/rules/api-endpoint-consistency.mdc).
 
+## Design System Hygiene (UI PRs)
+
+When a PR touches `.erb`, view components, or `.css`:
+
+1. **Tokens, not palette.** Use functional tokens from `app/assets/tailwind/sure-design-system.css` (`bg-warning/10`, `text-destructive`, `bg-container`, `text-primary`, `border-primary`). No raw Tailwind palette (`bg-blue-50`, `text-red-500`, hex literals).
+2. **Reach for `DS::*` first.** Check `app/components/DS/` (`DS::Alert`, `DS::Button`, `DS::Disclosure`, `DS::Dialog`, `DS::Menu`, etc.) before writing an alert, badge, button, disclosure, dialog, or input shape.
+3. **Two copies → lift to DS.** Same hand-rolled shape ≥2× in a diff with no DS equivalent → propose a new `DS::*` primitive before the second copy lands.
+4. **Conventions.** Use the `icon` helper (never `lucide_icon` directly), no raw SVG outside DS primitives, user-facing strings via `t()`, avoid arbitrary `*-[Npx]` values when a scale token fits.
+
+Reviewers escalate violations of (2)–(3) to close/rewrite; (1) and (4) are request-changes.
+
+## Securities Providers
+
+If you need to add a new securities price provider (Tiingo, EODHD, Binance-style crypto, etc.), see [adding-a-securities-provider.md](./docs/llm-guides/adding-a-securities-provider.md) for the full walkthrough — provider class, registry wiring, MIC handling, settings UI, locales, and tests.
+
 ## Providers: Pending Transactions and FX Metadata (SimpleFIN/Plaid/Lunchflow)
 
 - Pending detection
diff --git a/CLAUDE.md b/CLAUDE.md
index ddd38afd0..4fc9fcf10 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -138,7 +138,7 @@ Sidekiq handles asynchronous tasks:
 - **Stimulus Controllers**: Handle interactivity, organized alongside components
 - **Charts**: D3.js for financial visualizations (time series, donut, sankey)
 - **Styling**: Tailwind CSS v4.x with custom design system
-  - Design system defined in `app/assets/tailwind/maybe-design-system.css`
+  - Design system defined in `app/assets/tailwind/sure-design-system.css`
   - Always use functional tokens (e.g., `text-primary` not `text-white`)
   - Prefer semantic HTML elements over JS components
   - Use `icon` helper for icons, never `lucide_icon` directly
@@ -222,7 +222,7 @@ Sidekiq handles asynchronous tasks:
 ## TailwindCSS Design System
 
 ### Design System Rules
-- **Always reference `app/assets/tailwind/maybe-design-system.css`** for primitives and tokens
+- **Always reference `app/assets/tailwind/sure-design-system.css`** for primitives and tokens
 - **Use functional tokens** defined in design system:
   - `text-primary` instead of `text-white`
   - `bg-container` instead of `bg-white`
diff --git a/Dockerfile.preview b/Dockerfile.preview
new file mode 100644
index 000000000..3b687b964
--- /dev/null
+++ b/Dockerfile.preview
@@ -0,0 +1,247 @@
+# syntax = docker/dockerfile:1
+
+# Preview Dockerfile for Cloudflare Containers
+# Includes PostgreSQL and Redis for self-contained development testing
+
+ARG RUBY_VERSION=3.4.7
+FROM registry.docker.com/library/ruby:$RUBY_VERSION-slim AS base
+
+WORKDIR /rails
+
+# Install base packages including PostgreSQL and Redis servers
+RUN apt-get update -qq \
+    && apt-get install --no-install-recommends -y \
+       curl libvips postgresql postgresql-client redis-server libyaml-0-2 procps sudo openssl strace \
+    && rm -rf /var/lib/apt/lists /var/cache/apt/archives
+
+# Set development environment
+ARG BUILD_COMMIT_SHA
+ENV RAILS_ENV="development" \
+    BUNDLE_PATH="/usr/local/bundle" \
+    BUILD_COMMIT_SHA=${BUILD_COMMIT_SHA}
+
+# Build stage
+FROM base AS build
+
+RUN apt-get update -qq \
+    && apt-get install --no-install-recommends -y build-essential libpq-dev git pkg-config libyaml-dev \
+    && rm -rf /var/lib/apt/lists /var/cache/apt/archives
+
+COPY .ruby-version Gemfile Gemfile.lock ./
+RUN bundle install \
+    && rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git \
+    && bundle exec bootsnap precompile --gemfile -j 0
+
+COPY . .
+
+RUN bundle exec bootsnap precompile -j 0 app/ lib/
+
+# Precompile assets
+RUN SECRET_KEY_BASE_DUMMY=1 ./bin/rails assets:precompile
+
+# Final stage
+FROM base
+
+# Create rails user and configure PostgreSQL/Redis permissions
+RUN groupadd --system --gid 1000 rails && \
+    useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash && \
+    echo "rails ALL=(ALL) NOPASSWD: /usr/bin/pg_ctlcluster, /usr/bin/redis-server" > /etc/sudoers.d/rails && \
+    chmod 0440 /etc/sudoers.d/rails
+
+# Configure PostgreSQL to allow local connections
+RUN PG_HBA=$(find /etc/postgresql -name pg_hba.conf 2>/dev/null | head -1) && \
+    if [ -n "$PG_HBA" ]; then \
+      echo "local all all trust" > "$PG_HBA" && \
+      echo "host all all 127.0.0.1/32 trust" >> "$PG_HBA" && \
+      echo "host all all ::1/128 trust" >> "$PG_HBA"; \
+    fi
+
+# Create database directory with correct permissions
+RUN mkdir -p /var/run/postgresql && \
+    chown -R postgres:postgres /var/run/postgresql && \
+    chmod 2775 /var/run/postgresql
+
+# Copy built artifacts
+COPY --chown=rails:rails --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}"
+COPY --chown=rails:rails --from=build /rails /rails
+
+# Create preview entrypoint script inline
+RUN cat > /rails/bin/preview-entrypoint << 'ENTRYPOINT_EOF'
+#!/bin/bash
+set -e
+
+cd /rails
+
+emit_status() {
+  if [ -n "$PREVIEW_ORIGIN" ]; then
+    local stage="$1"
+    local detail="$2"
+    local payload
+    payload=$(STAGE="$stage" DETAIL="$detail" ruby -rjson -e 'print JSON.generate({stage: ENV.fetch("STAGE"), detail: ENV.fetch("DETAIL", "")})' 2>/dev/null) || return 0
+    curl -fsS -X POST "$PREVIEW_ORIGIN/_container_event" \
+      -H 'content-type: application/json' \
+      --data "$payload" >/dev/null || true
+  fi
+}
+
+trap 'emit_status failed "preview-entrypoint failed on line ${LINENO}"' ERR
+emit_status boot "preview-entrypoint started"
+
+REDIS_READY=0
+POSTGRES_READY=0
+
+# Start Redis
+echo "Starting Redis..."
+emit_status redis-start "starting redis"
+sudo redis-server --daemonize yes --bind 127.0.0.1
+
+# Wait for Redis to be ready
+echo "Waiting for Redis to be ready..."
+for i in {1..10}; do
+  if redis-cli ping > /dev/null 2>&1; then
+    echo "Redis is ready"
+    emit_status redis-ready "redis is ready"
+    REDIS_READY=1
+    break
+  fi
+  sleep 1
+done
+
+if [ "$REDIS_READY" -ne 1 ]; then
+  echo "Redis did not become ready in time"
+  exit 1
+fi
+
+# Start PostgreSQL
+echo "Starting PostgreSQL..."
+emit_status postgres-start "starting postgres"
+PG_VERSION=$(ls /etc/postgresql/ | sort -V | tail -1)
+if [ -z "$PG_VERSION" ]; then
+  echo "Could not determine installed PostgreSQL version"
+  exit 1
+fi
+if sudo pg_ctlcluster --skip-systemctl-redirect "$PG_VERSION" main status > /dev/null 2>&1; then
+  emit_status postgres-already-running "postgres cluster already running"
+else
+  sudo pg_ctlcluster --skip-systemctl-redirect "$PG_VERSION" main start
+fi
+
+# Wait for PostgreSQL to be ready
+echo "Waiting for PostgreSQL to be ready..."
+for i in {1..30}; do
+  if pg_isready -h localhost -U postgres > /dev/null 2>&1; then
+    echo "PostgreSQL is ready"
+    emit_status postgres-ready "postgres is ready"
+    POSTGRES_READY=1
+    break
+  fi
+  sleep 1
+done
+
+if [ "$POSTGRES_READY" -ne 1 ]; then
+  echo "PostgreSQL did not become ready in time"
+  exit 1
+fi
+
+# Create database user and database if they don't exist
+echo "Setting up database..."
+emit_status db-setup "setting up database"
+psql -h localhost -U postgres -tc "SELECT 1 FROM pg_roles WHERE rolname='rails'" | grep -q 1 || \
+  psql -h localhost -U postgres -c "CREATE USER rails WITH SUPERUSER PASSWORD 'rails';"
+
+psql -h localhost -U postgres -tc "SELECT 1 FROM pg_database WHERE datname='sure_development'" | grep -q 1 || \
+  psql -h localhost -U postgres -c "CREATE DATABASE sure_development OWNER rails;"
+
+# Set DATABASE_URL if not already set
+export DATABASE_URL="${DATABASE_URL:-postgres://rails:rails@localhost:5432/sure_development}"
+
+# Set REDIS_URL if not already set
+export REDIS_URL="${REDIS_URL:-redis://localhost:6379/0}"
+
+# Generate SECRET_KEY_BASE if not set
+export SECRET_KEY_BASE="${SECRET_KEY_BASE:-$(openssl rand -hex 64)}"
+
+# Run database migrations
+echo "Running database migrations..."
+emit_status db-prepare "running rails db:prepare"
+/rails/bin/rails db:prepare
+emit_status db-prepare-done "rails db:prepare finished"
+
+# Defer all demo-data creation until after Rails is up so preview can boot first
+echo "Checking demo dataset..."
+emit_status demo-data-check "checking for default demo user"
+DEMO_EMAIL="${DEMO_USER_EMAIL:-user@example.com}"
+DEMO_EMAIL_SQL=${DEMO_EMAIL//\'/\'\'}
+DEMO_SEED="${DEMO_DATA_SEED:-880}"
+DEMO_HAS_USER=0
+DEMO_HAS_DATA=0
+
+if psql "$DATABASE_URL" -tAc "SELECT 1 FROM users WHERE email = '${DEMO_EMAIL_SQL}' LIMIT 1" | grep -q 1; then
+  DEMO_HAS_USER=1
+  emit_status demo-data-user-present "default demo user already exists"
+fi
+
+if psql "$DATABASE_URL" -tAc "SELECT 1 FROM accounts a JOIN users u ON u.family_id = a.family_id WHERE u.email = '${DEMO_EMAIL_SQL}' LIMIT 1" | grep -q 1; then
+  DEMO_HAS_DATA=1
+  emit_status demo-data-skip "demo financial data already exists"
+else
+  emit_status demo-data-deferred "deferring demo data creation until after rails boot"
+fi
+
+# Execute the main command with an internal readiness probe
+echo "Starting Rails server..."
+emit_status rails-start "starting rails server"
+"$@" > /tmp/rails.log 2>&1 &
+RAILS_PID=$!
+
+for i in {1..180}; do
+  if curl -fsS http://127.0.0.1:3000/up > /dev/null 2>&1; then
+    emit_status rails-up-ready "rails responded on localhost:3000/up"
+
+    if [ "$DEMO_HAS_USER" -ne 1 ] || [ "$DEMO_HAS_DATA" -ne 1 ]; then
+      emit_status demo-data-load "creating/backfilling demo dataset in background (seed=${DEMO_SEED})"
+      (
+        (
+          DEMO_USER_EMAIL="$DEMO_EMAIL" DEMO_DATA_SEED="$DEMO_SEED" /rails/bin/rails runner '
+            email = ENV.fetch("DEMO_USER_EMAIL")
+            generator = Demo::Generator.new(seed: ENV.fetch("DEMO_DATA_SEED"))
+            user = User.find_by(email: email)
+
+            unless user
+              generator.generate_empty_data!(skip_clear: true)
+              user = User.find_by!(email: email)
+            end
+
+            has_accounts = user.family.accounts.exists?
+            generator.generate_new_user_data_for!(user.family, email: user.email) unless has_accounts
+          '
+        ) > /tmp/demo-data.log 2>&1 && \
+          emit_status demo-data-ready "default demo dataset loaded in background" || \
+          emit_status demo-data-failed "background demo dataset load failed"
+      ) &
+    fi
+
+    break
+  fi
+  sleep 1
+done
+
+if ! curl -fsS http://127.0.0.1:3000/up > /dev/null 2>&1; then
+  emit_status rails-up-timeout "rails did not answer localhost:3000/up in time"
+  emit_status rails-process-status "$(ps -o pid=,ppid=,stat=,comm=,args= -p "$RAILS_PID" 2>/dev/null | tr -s ' ' | sed 's/^ //')"
+  emit_status rails-process-wchan "$(cat /proc/$RAILS_PID/wchan 2>/dev/null | tr '\n' ' ' | cut -c 1-200)"
+  emit_status rails-process-children "$(ps -o pid=,ppid=,stat=,comm=,args= --ppid "$RAILS_PID" 2>/dev/null | tail -n +2 | tr '\n' '|' | cut -c 1-600)"
+  emit_status rails-socket-state "$(ruby -e 'hex="0BB8"; rows=File.readlines("/proc/net/tcp")+File.readlines("/proc/net/tcp6"); hits=rows.select{|l| l.include?(":#{hex} ")}.map{|l| l.strip.split[3] rescue nil}.compact; puts(hits.empty? ? "no-listener" : hits.join(","))' 2>&1 | tr '\n' ' ' | cut -c 1-400)"
+  emit_status rails-log-tail "$(tail -n 40 /tmp/rails.log 2>&1 | sed 's/"/'"'"'/g' | tr '\n' ' ' | cut -c 1-1200)"
+fi
+
+wait "$RAILS_PID"
+ENTRYPOINT_EOF
+RUN chmod 755 /rails/bin/preview-entrypoint && chown rails:rails /rails/bin/preview-entrypoint
+
+USER 1000:1000
+
+ENTRYPOINT ["/rails/bin/preview-entrypoint"]
+
+EXPOSE 3000
+CMD ["bundle", "exec", "puma", "-C", "config/puma.rb"]
diff --git a/Gemfile b/Gemfile
index de23ef7d8..19fdf8a17 100644
--- a/Gemfile
+++ b/Gemfile
@@ -48,6 +48,7 @@ gem "skylight", groups: [ :production ]
 
 # Active Storage
 gem "aws-sdk-s3", "~> 1.208.0", require: false
+gem "google-cloud-storage", "~> 1.59", require: false
 gem "image_processing", ">= 1.2"
 
 # Other
@@ -81,6 +82,7 @@ gem "snaptrade", "~> 2.0"
 gem "httparty"
 gem "rotp", "~> 6.3"
 gem "rqrcode", "~> 3.0"
+gem "webauthn", "~> 3.4"
 gem "activerecord-import"
 gem "rubyzip", "~> 2.3"
 gem "pdf-reader", "~> 2.12"
diff --git a/Gemfile.lock b/Gemfile.lock
index a858755ec..2b3ab3c5f 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -86,6 +86,7 @@ GEM
     after_commit_everywhere (1.6.0)
       activerecord (>= 4.2)
       activesupport
+    android_key_attestation (0.3.0)
     ast (2.4.3)
     attr_required (1.0.2)
     aws-eventstream (1.4.0)
@@ -135,6 +136,7 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
+    cbor (0.5.10.2)
     cgi (0.5.1)
     childprocess (5.1.0)
       logger (~> 1.5)
@@ -142,6 +144,9 @@ GEM
     climate_control (1.2.0)
     concurrent-ruby (1.3.6)
     connection_pool (2.5.5)
+    cose (1.3.1)
+      cbor (~> 0.5.9)
+      openssl-signature_algorithm (~> 1.0)
     countries (8.0.3)
       unaccent (~> 0.3)
     crack (1.0.0)
@@ -158,6 +163,7 @@ GEM
     debug (1.11.0)
       irb (~> 1.10)
       reline (>= 0.3.8)
+    declarative (0.0.20)
     derailed_benchmarks (2.2.1)
       base64
       benchmark-ips (~> 2)
@@ -177,6 +183,8 @@ GEM
       ruby2_keywords
       thor (>= 0.19, < 2)
     diff-lcs (1.6.2)
+    digest-crc (0.7.0)
+      rake (>= 12.0.0, < 14.0.0)
     docile (1.4.1)
     doorkeeper (5.8.2)
       railties (>= 5)
@@ -231,6 +239,43 @@ GEM
       ffi (~> 1.0)
     globalid (1.3.0)
       activesupport (>= 6.1)
+    google-apis-core (1.0.2)
+      addressable (~> 2.8, >= 2.8.7)
+      faraday (~> 2.13)
+      faraday-follow_redirects (~> 0.3)
+      googleauth (~> 1.14)
+      mini_mime (~> 1.1)
+      representable (~> 3.0)
+      retriable (~> 3.1)
+    google-apis-iamcredentials_v1 (0.26.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-storage_v1 (0.61.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-cloud-core (1.8.0)
+      google-cloud-env (>= 1.0, < 3.a)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (2.3.1)
+      base64 (~> 0.2)
+      faraday (>= 1.0, < 3.a)
+    google-cloud-errors (1.6.0)
+    google-cloud-storage (1.59.0)
+      addressable (~> 2.8)
+      digest-crc (~> 0.4)
+      google-apis-core (>= 0.18, < 2)
+      google-apis-iamcredentials_v1 (~> 0.18)
+      google-apis-storage_v1 (>= 0.42)
+      google-cloud-core (~> 1.6)
+      googleauth (~> 1.9)
+      mini_mime (~> 1.0)
+    google-logging-utils (0.2.0)
+    googleauth (1.16.2)
+      faraday (>= 1.0, < 3.a)
+      google-cloud-env (~> 2.2)
+      google-logging-utils (~> 0.1)
+      jwt (>= 1.4, < 4.0)
+      multi_json (~> 1.11)
+      os (>= 0.9, < 2.0)
+      signet (>= 0.16, < 2.a)
     hashdiff (1.2.0)
     hashery (2.1.2)
     hashie (5.0.0)
@@ -361,6 +406,7 @@ GEM
     mocha (2.7.1)
       ruby2_keywords (>= 0.0.5)
     msgpack (1.8.0)
+    multi_json (1.20.1)
     multi_xml (0.8.0)
       bigdecimal (>= 3.1, < 5)
     multipart-post (2.4.1)
@@ -441,6 +487,10 @@ GEM
       tzinfo
       validate_url
       webfinger (~> 2.0)
+    openssl (4.0.1)
+    openssl-signature_algorithm (1.3.0)
+      openssl (> 2.0)
+    os (1.1.4)
     ostruct (0.6.2)
     pagy (9.3.5)
     parallel (1.27.0)
@@ -500,7 +550,7 @@ GEM
       base64 (>= 0.1.0)
       logger (>= 1.6.0)
       rack (>= 3.0.0, < 4)
-    rack-session (2.1.1)
+    rack-session (2.1.2)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
     rack-test (2.2.0)
@@ -563,6 +613,11 @@ GEM
     regexp_parser (2.10.0)
     reline (0.6.1)
       io-console (~> 0.5)
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.4.1)
     rexml (3.4.2)
     rotp (6.3.0)
     rouge (4.5.2)
@@ -647,6 +702,8 @@ GEM
       logger
     ruby2_keywords (0.0.5)
     rubyzip (2.4.1)
+    safety_net_attestation (0.5.0)
+      jwt (>= 2.0, < 4.0)
     sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
@@ -681,6 +738,11 @@ GEM
       concurrent-ruby (~> 1.0, >= 1.0.5)
       sidekiq (>= 7.0.0, < 9.0.0)
       thor (>= 1.0, < 3.0)
+    signet (0.21.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 4.0)
+      multi_json (~> 1.10)
     simplecov (0.22.0)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
@@ -720,6 +782,11 @@ GEM
       unicode-display_width (>= 1.1.1, < 4)
     thor (1.4.0)
     timeout (0.6.1)
+    tpm-key_attestation (0.14.1)
+      bindata (~> 2.4)
+      openssl (> 2.0)
+      openssl-signature_algorithm (~> 1.0)
+    trailblazer-option (0.1.2)
     tsort (0.2.0)
     ttfunk (1.8.0)
       bigdecimal (~> 3.1)
@@ -728,6 +795,7 @@ GEM
       railties (>= 7.1.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
+    uber (0.1.0)
     unaccent (0.4.0)
     unicode (0.4.4.5)
     unicode-display_width (3.1.4)
@@ -751,6 +819,14 @@ GEM
       activemodel (>= 6.0.0)
       bindex (>= 0.4.0)
       railties (>= 6.0.0)
+    webauthn (3.4.3)
+      android_key_attestation (~> 0.3.0)
+      bindata (~> 2.4)
+      cbor (~> 0.5.9)
+      cose (~> 1.1)
+      openssl (>= 2.2)
+      safety_net_attestation (~> 0.5.0)
+      tpm-key_attestation (~> 0.14.0)
     webfinger (2.1.3)
       activesupport
       faraday (~> 2.0)
@@ -804,6 +880,7 @@ DEPENDENCIES
   faraday-multipart
   faraday-retry
   foreman
+  google-cloud-storage (~> 1.59)
   hotwire-livereload
   hotwire_combobox
   httparty
@@ -874,6 +951,7 @@ DEPENDENCIES
   vernier
   view_component
   web-console
+  webauthn (~> 3.4)
   webmock
 
 RUBY VERSION
diff --git a/Procfile.dev b/Procfile.dev
index eb6eadebd..a868e97a4 100644
--- a/Procfile.dev
+++ b/Procfile.dev
@@ -1,3 +1,3 @@
-web: bundle exec ${DEBUG:+rdbg -O -n -c --} bin/rails server -b 0.0.0.0
+web: bundle exec ${DEBUG:+rdbg -O -n -c --} bin/rails server
 css: bundle exec bin/rails tailwindcss:watch 2>/dev/null
 worker: bundle exec sidekiq
diff --git a/README.md b/README.md
index fe45b8bbb..41c93b4c6 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,7 @@
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/we-promise/sure)
 [![View performance data on Skylight](https://badges.skylight.io/typical/s6PEZSKwcklL.svg)](https://oss.skylight.io/app/applications/s6PEZSKwcklL)
 [![Dosu](https://raw.githubusercontent.com/dosu-ai/assets/main/dosu-badge.svg)](https://app.dosu.dev/a72bdcfd-15f5-4edc-bd85-ea0daa6c3adc/ask)
+[![Pipelock Security Scan](https://github.com/we-promise/sure/actions/workflows/pipelock.yml/badge.svg)](https://github.com/we-promise/sure/actions/workflows/pipelock.yml)
 
 <img width="1270" height="1140" alt="sure_shot" src="https://github.com/user-attachments/assets/9c6e03cc-3490-40ab-9a68-52e042c51293" />
 
@@ -27,7 +28,7 @@ involved: [Discord](https://discord.gg/36ZGBsxYEK) • [Website](https://sure.am
 
 ## Backstory
 
-The Maybe Finance team spent most of 2021–2022 building a full-featured personal finance and wealth management app. It even included an “Ask an Advisor” feature that connected users with a real CFP/CFA — all included with your subscription.
+The [Maybe Finance](https://github.com/maybe-finance/maybe) (archived/abandoned repo) team spent most of 2021–2022 building a full-featured personal finance and wealth management app. It even included an “Ask an Advisor” feature that connected users with a real CFP/CFA — all included with your subscription.
 
 The business end of things didn't work out, and so they stopped developing the app in mid-2023.
 
@@ -100,12 +101,16 @@ For further instructions, see guides below.
 - [Windows dev setup](https://github.com/we-promise/sure/wiki/Windows-Dev-Setup-Guide)
 - Dev containers - visit [this guide](https://code.visualstudio.com/docs/devcontainers/containers)
 
-### One-click
+### One-click Install
 
 [![Run on PikaPods](https://www.pikapods.com/static/run-button.svg)](https://www.pikapods.com/pods?run=sure)
 
 [![Deploy on Railway](https://railway.com/button.svg)](https://railway.com/deploy/T_draF?referralCode=CW_fPQ)
 
+### Managed OpenClaw for Sure Finances
+
+<a href="https://kilocode.pxf.io/repo-readme"><img src="https://kilo.ai/kiloclaw/partner-resources/kiloclaw-logo-yellow-bg-typography.png" alt="Managed OpenClaw for Sure Finances" width="185"/></a>
+
 
 ## License and Trademarks
 
@@ -113,3 +118,5 @@ Maybe and Sure are both distributed under
 an [AGPLv3 license](https://github.com/we-promise/sure/blob/main/LICENSE).
 - "Maybe" is a trademark of Maybe Finance, Inc.
 - "Sure" is not, and refers to this community fork.
+
+![Alt](https://repobeats.axiom.co/api/embed/3a9753cff07501fba8a6749d0ebd567ff63848c8.svg "Repobeats analytics image")
diff --git a/app/assets/tailwind/application.css b/app/assets/tailwind/application.css
index 36b65b467..3d868c741 100644
--- a/app/assets/tailwind/application.css
+++ b/app/assets/tailwind/application.css
@@ -1,6 +1,6 @@
 @import 'tailwindcss';
 
-@import "./maybe-design-system.css";
+@import "./sure-design-system.css";
 
 @import "./geist-font.css";
 @import "./geist-mono-font.css";
@@ -56,7 +56,7 @@
   }
 
   .hw-combobox__label {
-    @apply block text-xs text-gray-500 peer-disabled:text-gray-400;
+    @apply block text-xs text-secondary peer-disabled:text-subdued;
   }
   
   .hw-combobox__option {
@@ -155,12 +155,12 @@
   }
 
   ::-webkit-scrollbar-thumb {
-    background: #d6d6d6;
+    background: var(--color-gray-300);
     border-radius: 10px;
   }
 
   ::-webkit-scrollbar-thumb:hover {
-    background: #a6a6a6;
+    background: var(--color-gray-400);
   }  
 }
 
@@ -170,12 +170,12 @@
   }
 
   &::-webkit-scrollbar-thumb {
-    background: #d6d6d6;
+    background: var(--color-gray-300);
     border-radius: 10px;
   }
 
   &::-webkit-scrollbar-thumb:hover {
-    background: #a6a6a6;
+    background: var(--color-gray-400);
   }
 }
 
@@ -203,3 +203,30 @@
 .turbo-progress-bar {
   margin-top: env(safe-area-inset-top);
 }
+
+.table-divider {
+  position: relative;
+}
+
+.table-divider {
+  background-image: linear-gradient(
+    to right,
+    transparent 1rem,
+    var(--color-alpha-black-100) 1rem,
+    var(--color-alpha-black-100) calc(100% - 1rem),
+    transparent calc(100% - 1rem)
+  );
+  background-repeat: no-repeat;
+  background-size: 100% 1px;
+  background-position: bottom;
+}
+
+[data-theme="dark"] .table-divider {
+  background-image: linear-gradient(
+    to right,
+    transparent 1rem,
+    var(--color-alpha-white-200) 1rem,
+    var(--color-alpha-white-200) calc(100% - 1rem),
+    transparent calc(100% - 1rem)
+  );
+}
\ No newline at end of file
diff --git a/app/assets/tailwind/maybe-design-system/background-utils.css b/app/assets/tailwind/maybe-design-system/background-utils.css
deleted file mode 100644
index f11a7621a..000000000
--- a/app/assets/tailwind/maybe-design-system/background-utils.css
+++ /dev/null
@@ -1,91 +0,0 @@
-@utility bg-surface {
-  @apply bg-gray-50;
-
-  @variant theme-dark {
-    @apply bg-black;
-  }
-}
-
-@utility bg-surface-hover {
-  @apply bg-gray-100;
-
-  @variant theme-dark {
-    @apply bg-gray-800;
-  }
-}
-
-@utility bg-surface-inset {
-  @apply bg-gray-100;
-
-  @variant theme-dark {
-    @apply bg-gray-800;
-  }
-}
-
-@utility bg-surface-inset-hover {
-  @apply bg-gray-200;
-
-  @variant theme-dark {
-    @apply bg-gray-800;
-  }
-}
-
-@utility bg-container {
-  @apply bg-white;
-
-  @variant theme-dark {
-    @apply bg-gray-900;
-  }
-}
-
-@utility bg-container-hover {
-  @apply bg-gray-50;
-
-  @variant theme-dark {
-    @apply bg-gray-800;
-  }
-}
-
-@utility bg-container-inset {
-  @apply bg-gray-50;
-
-  @variant theme-dark {
-    @apply bg-gray-800;
-  }
-}
-
-@utility bg-container-inset-hover {
-  @apply bg-gray-100;
-
-  @variant theme-dark {
-    @apply bg-gray-700;
-  }
-}
-
-@utility bg-inverse {
-  @apply bg-gray-800;
-
-  @variant theme-dark {
-    @apply bg-white;
-  }
-}
-
-@utility bg-inverse-hover {
-  @apply bg-gray-700;
-
-  @variant theme-dark {
-    @apply bg-gray-100;
-  }
-}
-
-@utility bg-overlay {
-  background-color: --alpha(var(--color-gray-100) / 50%);
-
-  @variant theme-dark {
-    background-color: var(--color-alpha-black-900);
-  }
-}
-
-@utility bg-loader {
-  @apply bg-surface-inset animate-pulse;
-}
diff --git a/app/assets/tailwind/maybe-design-system/border-utils.css b/app/assets/tailwind/maybe-design-system/border-utils.css
deleted file mode 100644
index 8fcc1c9cd..000000000
--- a/app/assets/tailwind/maybe-design-system/border-utils.css
+++ /dev/null
@@ -1,92 +0,0 @@
-/* Custom shadow borders used for surfaces / containers  */
-@utility shadow-border-xs {
-  box-shadow: var(--shadow-xs), 0px 0px 0px 1px var(--color-alpha-black-50);
-
-  @variant theme-dark {
-    box-shadow: var(--shadow-xs), 0px 0px 0px 1px var(--color-alpha-white-50);
-  }
-}
-
-@utility shadow-border-sm {
-  box-shadow: var(--shadow-sm), 0px 0px 0px 1px var(--color-alpha-black-50);
-
-  @variant theme-dark {
-    box-shadow: var(--shadow-sm), 0px 0px 0px 1px var(--color-alpha-white-50);
-  }
-}
-
-@utility shadow-border-md {
-  box-shadow: var(--shadow-md), 0px 0px 0px 1px var(--color-alpha-black-50);
-
-  @variant theme-dark {
-    box-shadow: var(--shadow-md), 0px 0px 0px 1px var(--color-alpha-white-50);
-  }
-}
-
-@utility shadow-border-lg {
-  box-shadow: var(--shadow-lg), 0px 0px 0px 1px var(--color-alpha-black-50);
-
-  @variant theme-dark {
-    box-shadow: var(--shadow-lg), 0px 0px 0px 1px var(--color-alpha-white-50);
-  }
-}
-
-@utility shadow-border-xl {
-  box-shadow: var(--shadow-xl), 0px 0px 0px 1px var(--color-alpha-black-50);
-
-  @variant theme-dark {
-    box-shadow: var(--shadow-xl), 0px 0px 0px 1px var(--color-alpha-white-50);
-  }
-}
-
-@utility border-primary {
-  @apply border-alpha-black-300;
-
-  @variant theme-dark {
-    @apply border-alpha-white-400;
-  }
-}
-
-@utility border-secondary {
-  @apply border-alpha-black-200;
-
-  @variant theme-dark {
-    @apply border-alpha-white-300;
-  }
-}
-
-@utility border-tertiary {
-  @apply border-alpha-black-100;
-
-  @variant theme-dark {
-    @apply border-alpha-white-200;
-  }
-}
-
-@utility border-divider {
-  @apply border-tertiary;
-}
-
-@utility border-subdued {
-  @apply border-alpha-black-50;
-
-  @variant theme-dark {
-    @apply border-alpha-white-100;
-  }
-}
-
-@utility border-solid {
-  @apply border-black;
-
-  @variant theme-dark {
-    @apply border-white;
-  }
-}
-
-@utility border-destructive {
-  @apply border-red-500;
-
-  @variant theme-dark {
-    @apply border-red-400;
-  }
-}
diff --git a/app/assets/tailwind/maybe-design-system/component-utils.css b/app/assets/tailwind/maybe-design-system/component-utils.css
deleted file mode 100644
index 597b50921..000000000
--- a/app/assets/tailwind/maybe-design-system/component-utils.css
+++ /dev/null
@@ -1,109 +0,0 @@
-/* Button Backgrounds */
-@utility button-bg-primary {
-  @apply bg-gray-900;
-  /* Maps to fg-primary light */
-
-  @variant theme-dark {
-    @apply bg-white;
-    /* Maps to fg-primary dark */
-  }
-}
-
-@utility button-bg-primary-hover {
-  @apply bg-gray-800;
-  /* Maps to fg-primary-variant light */
-
-  @variant theme-dark {
-    @apply bg-gray-50;
-    /* Maps to fg-primary-variant dark */
-  }
-}
-
-@utility button-bg-secondary {
-  @apply bg-gray-50; /* Maps to fg-secondary light */
-
-  @variant theme-dark {
-    @apply bg-gray-700; /* Maps to fg-secondary dark */
-  }
-}
-
-@utility button-bg-secondary-hover {
-  @apply bg-gray-100; /* Maps to fg-secondary-variant light */
-
-  @variant theme-dark {
-    @apply bg-gray-600; /* Maps to fg-secondary-variant dark */
-  }
-}
-
-@utility button-bg-disabled {
-  @apply bg-gray-50;
-
-  @variant theme-dark {
-    @apply bg-gray-700;
-  }
-}
-
-@utility button-bg-destructive {
-  @apply bg-red-500;
-
-  @variant theme-dark {
-    @apply bg-red-400;
-  }
-}
-
-@utility button-bg-destructive-hover {
-  @apply bg-red-600;
-
-  @variant theme-dark {
-    @apply bg-red-500;
-  }
-}
-
-@utility button-bg-ghost-hover {
-  @apply bg-gray-50;
-
-  @variant theme-dark {
-    @apply bg-gray-800 fg-inverse;
-  }
-}
-
-@utility button-bg-outline-hover {
-  @apply bg-gray-100;
-
-  @variant theme-dark {
-    @apply bg-gray-700;
-  }
-}
-
-/* Tab Styles */
-@utility tab-item-active {
-  @apply bg-white;
-
-  @variant theme-dark {
-    @apply bg-gray-700;
-  }
-}
-
-@utility tab-item-hover {
-  @apply bg-gray-200;
-
-  @variant theme-dark {
-    @apply bg-gray-800;
-  }
-}
-
-@utility tab-bg-group {
-  @apply bg-gray-50;
-
-  @variant theme-dark {
-    @apply bg-alpha-black-700;
-  }
-}
-
-@utility bg-nav-indicator {
-  @apply bg-black;
-
-  @variant theme-dark {
-    @apply bg-white;
-  }
-}
\ No newline at end of file
diff --git a/app/assets/tailwind/maybe-design-system/foreground-utils.css b/app/assets/tailwind/maybe-design-system/foreground-utils.css
deleted file mode 100644
index 5697d2e9a..000000000
--- a/app/assets/tailwind/maybe-design-system/foreground-utils.css
+++ /dev/null
@@ -1,63 +0,0 @@
-@utility fg-gray {
-  @apply text-gray-500;
-
-  @variant theme-dark {
-    @apply text-gray-400;
-  }
-}
-
-@utility fg-contrast {
-  @apply text-gray-400;
-
-  @variant theme-dark {
-    @apply text-gray-500;
-  }
-}
-
-@utility fg-inverse {
-  @apply text-white;
-
-  @variant theme-dark {
-    @apply text-gray-900;
-  }
-}
-
-@utility fg-primary {
-  @apply text-gray-900;
-
-  @variant theme-dark {
-    @apply text-white;
-  }
-}
-
-@utility fg-primary-variant {
-  @apply text-gray-800;
-
-  @variant theme-dark {
-    @apply text-gray-50;
-  }
-}
-
-@utility fg-secondary {
-  @apply text-gray-50;
-
-  @variant theme-dark {
-    @apply text-gray-400;
-  }
-}
-
-@utility fg-secondary-variant {
-  @apply text-gray-100;
-
-  @variant theme-dark {
-    @apply text-gray-500;
-  }
-}
-
-@utility fg-subdued {
-  @apply text-gray-400;
-
-  @variant theme-dark {
-    @apply text-gray-500;
-  }
-}
\ No newline at end of file
diff --git a/app/assets/tailwind/maybe-design-system/text-utils.css b/app/assets/tailwind/maybe-design-system/text-utils.css
deleted file mode 100644
index 7aa8f2e67..000000000
--- a/app/assets/tailwind/maybe-design-system/text-utils.css
+++ /dev/null
@@ -1,39 +0,0 @@
-@utility text-primary {
-  @apply text-gray-900;
-
-  @variant theme-dark {
-   @apply text-white;
-  }
-}
-
-@utility text-inverse {
-  @apply text-white;
-
-  @variant theme-dark {
-    @apply text-gray-900;
-  }
-}
-
-@utility text-secondary {
-  @apply text-gray-500;
-
-  @variant theme-dark {
-    @apply text-gray-300;
-  }
-}
-
-@utility text-subdued {
-  @apply text-gray-400;
-
-  @variant theme-dark {
-    @apply text-gray-500;
-  }
-}
-
-@utility text-link {
-  @apply text-blue-600;
-
-  @variant theme-dark {
-    @apply text-blue-500;
-  }
-}
\ No newline at end of file
diff --git a/app/assets/tailwind/privacy-mode.css b/app/assets/tailwind/privacy-mode.css
index e57eaa246..425bf6c0a 100644
--- a/app/assets/tailwind/privacy-mode.css
+++ b/app/assets/tailwind/privacy-mode.css
@@ -2,10 +2,13 @@
 html.privacy-mode .privacy-sensitive {
   filter: blur(8px);
   user-select: none;
-  pointer-events: none;
   transition: filter 0.2s ease;
 }
 
+html.privacy-mode .privacy-sensitive:not(.privacy-sensitive-interactive) {
+  pointer-events: none;
+}
+
 html:not(.privacy-mode) .privacy-sensitive {
   transition: filter 0.2s ease;
-}
\ No newline at end of file
+}
diff --git a/app/assets/tailwind/sure-design-system.css b/app/assets/tailwind/sure-design-system.css
new file mode 100644
index 000000000..53ad19e26
--- /dev/null
+++ b/app/assets/tailwind/sure-design-system.css
@@ -0,0 +1,12 @@
+/*
+ * Sure design system entry.
+ * Tokens (theme, dark overrides, utilities) are generated from design/tokens/sure.tokens.json: see _generated.css.
+ * Element resets, components, and prose overrides remain hand-written.
+ */
+
+@custom-variant theme-dark (&:where([data-theme=dark], [data-theme=dark] *));
+
+@import './sure-design-system/_generated.css';
+@import './sure-design-system/base.css';
+@import './sure-design-system/components.css';
+@import './sure-design-system/prose.css';
diff --git a/app/assets/tailwind/maybe-design-system.css b/app/assets/tailwind/sure-design-system/_generated.css
similarity index 53%
rename from app/assets/tailwind/maybe-design-system.css
rename to app/assets/tailwind/sure-design-system/_generated.css
index e4ff87051..79ae54d43 100644
--- a/app/assets/tailwind/maybe-design-system.css
+++ b/app/assets/tailwind/sure-design-system/_generated.css
@@ -1,37 +1,32 @@
-/* 
-  This file contains all of the Figma design tokens, components, etc. that 
-  are used globally across the app. 
-
-  One-off styling (3rd party overrides, etc.) should be done in the application.css file.
-*/
-
-@import './maybe-design-system/background-utils.css';
-@import './maybe-design-system/foreground-utils.css';
-@import './maybe-design-system/text-utils.css';
-@import './maybe-design-system/border-utils.css';
-@import './maybe-design-system/component-utils.css';
-
-@custom-variant theme-dark (&:where([data-theme=dark], [data-theme=dark] *));
+/*
+ * GENERATED — do not edit by hand.
+ * Source: design/tokens/sure.tokens.json
+ * Build:  npm run tokens:build
+ */
 
 @theme {
-  /* Font families */
   --font-sans: 'Geist', system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
   --font-mono: 'Geist Mono', ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
-
-  /* Base colors */
   --color-white: #ffffff;
   --color-black: #0B0B0B;
-  --color-success: var(--color-green-600);
+  --color-success: var(--color-green-700);
   --color-warning: var(--color-yellow-600);
   --color-destructive: var(--color-red-600);
+  --color-info: var(--color-blue-600);
   --color-shadow: --alpha(var(--color-black) / 6%);
-
-  /* Colors used in Stimulus controllers with SVGs (easier to define light/dark mode here than toggle within the controllers) */
-  /* See @layer base block below for dark mode overrides */
-  --budget-unused-fill: var(--color-gray-200);
-  --budget-unallocated-fill: var(--color-gray-50);
-
-  /* Gray scale */
+  --color-link: var(--color-blue-600);
+  --color-tertiary: var(--color-alpha-black-100);
+  --color-surface: var(--color-gray-50);
+  --color-surface-hover: var(--color-gray-100);
+  --color-surface-inset: var(--color-gray-100);
+  --color-surface-inset-hover: var(--color-gray-200);
+  --color-container: var(--color-white);
+  --color-container-hover: var(--color-gray-50);
+  --color-container-inset: var(--color-gray-50);
+  --color-container-inset-hover: var(--color-gray-100);
+  --color-nav-indicator: var(--color-black);
+  --color-toggle-track: var(--color-gray-100);
+  --color-destructive-subtle: var(--color-red-200);
   --color-gray-25: #FAFAFA;
   --color-gray-50: #F7F7F7;
   --color-gray-100: #F0F0F0;
@@ -46,8 +41,6 @@
   --color-gray: var(--color-gray-500);
   --color-gray-tint-5: --alpha(var(--color-gray-500) / 5%);
   --color-gray-tint-10: --alpha(var(--color-gray-500) / 10%);
-
-  /* Alpha colors */
   --color-alpha-white-25: --alpha(var(--color-white) / 3%);
   --color-alpha-white-50: --alpha(var(--color-white) / 5%);
   --color-alpha-white-100: --alpha(var(--color-white) / 8%);
@@ -59,7 +52,6 @@
   --color-alpha-white-700: --alpha(var(--color-white) / 50%);
   --color-alpha-white-800: --alpha(var(--color-white) / 70%);
   --color-alpha-white-900: --alpha(var(--color-white) / 85%);
-
   --color-alpha-black-25: --alpha(var(--color-black) / 3%);
   --color-alpha-black-50: --alpha(var(--color-black) / 5%);
   --color-alpha-black-100: --alpha(var(--color-black) / 8%);
@@ -71,8 +63,6 @@
   --color-alpha-black-700: --alpha(var(--color-black) / 50%);
   --color-alpha-black-800: --alpha(var(--color-black) / 70%);
   --color-alpha-black-900: --alpha(var(--color-black) / 85%);
-
-  /* Red scale */
   --color-red-25: #FFFBFB;
   --color-red-50: #FFF1F0;
   --color-red-100: #FFDEDB;
@@ -86,8 +76,6 @@
   --color-red-900: #7E0707;
   --color-red-tint-5: --alpha(var(--color-red-500) / 5%);
   --color-red-tint-10: --alpha(var(--color-red-500) / 10%);
-
-  /* Green scale */
   --color-green-25: #F6FEF9;
   --color-green-50: #ECFDF3;
   --color-green-100: #D1FADF;
@@ -101,8 +89,6 @@
   --color-green-900: #054F31;
   --color-green-tint-5: --alpha(var(--color-green-500) / 5%);
   --color-green-tint-10: --alpha(var(--color-green-500) / 10%);
-
-  /* Yellow scale */
   --color-yellow-25: #FFFCF5;
   --color-yellow-50: #FFFAEB;
   --color-yellow-100: #FEF0C7;
@@ -116,8 +102,6 @@
   --color-yellow-900: #7A2E0E;
   --color-yellow-tint-5: --alpha(var(--color-yellow-500) / 5%);
   --color-yellow-tint-10: --alpha(var(--color-yellow-500) / 10%);
-
-  /* Cyan scale */
   --color-cyan-25: #F5FEFF;
   --color-cyan-50: #ECFDFF;
   --color-cyan-100: #CFF9FE;
@@ -128,11 +112,9 @@
   --color-cyan-600: #088AB2;
   --color-cyan-700: #0E7090;
   --color-cyan-800: #155B75;
-  --color-cyan-900: #155B75;
+  --color-cyan-900: #164E63;
   --color-cyan-tint-5: --alpha(var(--color-cyan-500) / 5%);
   --color-cyan-tint-10: --alpha(var(--color-cyan-500) / 10%);
-
-  /* Blue scale */
   --color-blue-25: #F5FAFF;
   --color-blue-50: #EFF8FF;
   --color-blue-100: #D1E9FF;
@@ -146,8 +128,6 @@
   --color-blue-900: #194185;
   --color-blue-tint-5: --alpha(var(--color-blue-500) / 5%);
   --color-blue-tint-10: --alpha(var(--color-blue-500) / 10%);
-
-  /* Indigo scale */
   --color-indigo-25: #F5F8FF;
   --color-indigo-50: #EFF4FF;
   --color-indigo-100: #E0EAFF;
@@ -161,8 +141,6 @@
   --color-indigo-900: #2D3282;
   --color-indigo-tint-5: --alpha(var(--color-indigo-500) / 5%);
   --color-indigo-tint-10: --alpha(var(--color-indigo-500) / 10%);
-
-  /* Violet scale */
   --color-violet-25: #FBFAFF;
   --color-violet-50: #F5F3FF;
   --color-violet-100: #ECE9FE;
@@ -174,8 +152,6 @@
   --color-violet-700: #6927DA;
   --color-violet-tint-5: --alpha(var(--color-violet-500) / 5%);
   --color-violet-tint-10: --alpha(var(--color-violet-500) / 10%);
-
-  /* Fuchsia scale */
   --color-fuchsia-25: #FEFAFF;
   --color-fuchsia-50: #FDF4FF;
   --color-fuchsia-100: #FBE8FF;
@@ -189,8 +165,6 @@
   --color-fuchsia-900: #6F1877;
   --color-fuchsia-tint-5: --alpha(var(--color-fuchsia-500) / 5%);
   --color-fuchsia-tint-10: --alpha(var(--color-fuchsia-500) / 10%);
-
-  /* Pink scale */
   --color-pink-25: #FFFAFC;
   --color-pink-50: #FEF0F7;
   --color-pink-100: #FFD1E2;
@@ -204,8 +178,6 @@
   --color-pink-900: #840B45;
   --color-pink-tint-5: --alpha(var(--color-pink-500) / 5%);
   --color-pink-tint-10: --alpha(var(--color-pink-500) / 10%);
-
-  /* Orange scale */
   --color-orange-25: #FFF9F5;
   --color-orange-50: #FFF4ED;
   --color-orange-100: #FFE6D5;
@@ -219,243 +191,313 @@
   --color-orange-900: #771A0D;
   --color-orange-tint-5: --alpha(var(--color-orange-500) / 5%);
   --color-orange-tint-10: --alpha(var(--color-orange-500) / 10%);
-
-  /* Border radius overrides */
+  --budget-unused-fill: var(--color-gray-200);
+  --budget-unallocated-fill: var(--color-gray-50);
   --border-radius-md: 8px;
   --border-radius-lg: 10px;
-
   --shadow-xs: 0px 1px 2px 0px --alpha(var(--color-black) / 6%);
   --shadow-sm: 0px 1px 6px 0px --alpha(var(--color-black) / 6%);
   --shadow-md: 0px 4px 8px -2px --alpha(var(--color-black) / 6%);
   --shadow-lg: 0px 12px 16px -4px --alpha(var(--color-black) / 6%);
   --shadow-xl: 0px 20px 24px -4px --alpha(var(--color-black) / 6%);
-
   --animate-stroke-fill: stroke-fill 3s 300ms forwards;
 
   @keyframes stroke-fill {
-    0% {
-      stroke-dashoffset: 43.9822971503;
-    }
-
-    100% {
-      stroke-dashoffset: 0;
-    }
-  } 
-}
-
-/* Specific override for strong tags in prose under dark mode */
-.prose:where([data-theme=dark], [data-theme=dark] *) strong {
-  color: theme(colors.white) !important;
-}
-
-/* Specific override for headings in prose under dark mode */
-.prose:where([data-theme=dark], [data-theme=dark] *) h1,
-.prose:where([data-theme=dark], [data-theme=dark] *) h2,
-.prose:where([data-theme=dark], [data-theme=dark] *) h3,
-.prose:where([data-theme=dark], [data-theme=dark] *) h4,
-.prose:where([data-theme=dark], [data-theme=dark] *) h5,
-.prose:where([data-theme=dark], [data-theme=dark] *) h6,
-.prose:where([data-theme=dark], [data-theme=dark] *) blockquote,
-.prose:where([data-theme=dark], [data-theme=dark] *) thead th {
-  color: theme(colors.white) !important;
+    0% { stroke-dashoffset: 43.9822971503; }
+    100% { stroke-dashoffset: 0; }
+  }
 }
 
 @layer base {
-  [data-theme="dark"] { 
-    --color-success: var(--color-green-500);
+  [data-theme="dark"] {
+    --color-success: var(--color-green-400);
     --color-warning: var(--color-yellow-400);
     --color-destructive: var(--color-red-400);
+    --color-info: var(--color-blue-500);
     --color-shadow: --alpha(var(--color-white) / 8%);
-
-    /* Dark mode overrides for colors used in Stimulus controllers with SVGs */
+    --color-link: var(--color-blue-500);
+    --color-tertiary: var(--color-alpha-white-200);
+    --color-surface: var(--color-black);
+    --color-surface-hover: var(--color-gray-800);
+    --color-surface-inset: var(--color-gray-800);
+    --color-surface-inset-hover: var(--color-gray-800);
+    --color-container: var(--color-gray-900);
+    --color-container-hover: var(--color-gray-800);
+    --color-container-inset: var(--color-gray-800);
+    --color-container-inset-hover: var(--color-gray-700);
+    --color-nav-indicator: var(--color-white);
+    --color-toggle-track: var(--color-gray-700);
+    --color-destructive-subtle: var(--color-red-800);
     --budget-unused-fill: var(--color-gray-500);
     --budget-unallocated-fill: var(--color-gray-700);
-
     --shadow-xs: 0px 1px 2px 0px --alpha(var(--color-white) / 8%);
     --shadow-sm: 0px 1px 6px 0px --alpha(var(--color-white) / 8%);
     --shadow-md: 0px 4px 8px -2px --alpha(var(--color-white) / 8%);
     --shadow-lg: 0px 12px 16px -4px --alpha(var(--color-white) / 8%);
     --shadow-xl: 0px 20px 24px -4px --alpha(var(--color-white) / 8%);
   }
+}
 
-  button {
-    @apply cursor-pointer focus-visible:outline-gray-900;
-  }
+@utility bg-inverse {
+  @apply bg-gray-800;
 
-  hr {
-    @apply text-gray-200;
-  }
-
-  /* We control the sizing through DialogComponent, so reset this value */
-  dialog:modal {
-    max-width: 100dvw;
-    max-height: 100dvh;
-  }
-
-  details>summary::-webkit-details-marker {
-    @apply hidden;
-  }
-
-  details>summary {
-    @apply list-none;
-  }
-
-  input[type='radio'] {
-    @apply border-gray-300 text-indigo-600 focus:ring-indigo-600;
-    /* Default light mode */
-
-    @variant theme-dark {
-      /* Dark mode radio button base and checked styles */
-      @apply border-gray-600 bg-gray-700 checked:bg-blue-500 focus:ring-blue-500 focus:ring-offset-gray-800;
-    }
+  @variant theme-dark {
+    @apply bg-white;
   }
 }
 
-@layer components {
-  /* Forms */
-  .form-field {
-    @apply flex flex-col gap-1 relative px-3 py-2 rounded-md border bg-container border-secondary shadow-xs w-full;
-    @apply focus-within:border-secondary focus-within:shadow-none focus-within:ring-4 focus-within:ring-alpha-black-200;
-    @apply transition-all duration-300;
+@utility bg-inverse-hover {
+  @apply bg-gray-700;
 
-    @variant theme-dark {
-      @apply focus-within:ring-alpha-white-300;
-    }
-
-    /* Add styles for multiple select within form fields */
-    select[multiple] {
-      @apply py-2 pr-2 space-y-0.5 overflow-y-auto;
-
-      option {
-        @apply py-2 rounded-md;
-      }
-
-      option:checked {
-        @apply after:content-['\2713'] bg-container-inset after:text-gray-500 after:ml-2;
-      }
-
-      option:active,
-      option:focus {
-        @apply bg-container-inset;
-      }
-    }
+  @variant theme-dark {
+    @apply bg-gray-100;
   }
+}
 
-  /* New form field structure components */
-  .form-field__header {
-    @apply flex items-center justify-between gap-2;
+@utility bg-overlay {
+  background-color: --alpha(var(--color-gray-100) / 50%);
+
+  @variant theme-dark {
+    background-color: var(--color-alpha-black-900);
   }
+}
 
-  .form-field__body {
-    @apply flex flex-col gap-1;
+@utility bg-loader {
+  @apply bg-surface-inset animate-pulse;
+}
+
+@utility text-primary {
+  @apply text-gray-900;
+
+  @variant theme-dark {
+    @apply text-white;
   }
+}
 
-  .form-field__actions {
-    @apply flex items-center gap-1;
+@utility text-inverse {
+  @apply text-white;
+
+  @variant theme-dark {
+    @apply text-gray-900;
   }
+}
 
-  .form-field__label {
-    @apply block text-xs text-secondary peer-disabled:text-subdued;
+@utility text-secondary {
+  @apply text-gray-500;
+
+  @variant theme-dark {
+    @apply text-gray-300;
   }
+}
 
-  .form-field__input {
-    @apply text-primary border-none bg-container text-sm opacity-100 w-full p-0;
-    @apply focus:opacity-100 focus:outline-hidden focus:ring-0;
-    @apply placeholder-shown:opacity-50;
-    @apply disabled:text-subdued;
-    @apply text-ellipsis overflow-hidden whitespace-nowrap;
-    @apply transition-opacity duration-300;
-    @apply placeholder:text-subdued;
+@utility text-subdued {
+  @apply text-gray-400;
 
-    @variant theme-dark {
-      &::-webkit-calendar-picker-indicator {
-        filter: invert(1);
-        cursor: pointer;
-      }
-    }
+  @variant theme-dark {
+    @apply text-gray-500;
   }
+}
 
-  textarea.form-field__input {
-    @apply whitespace-normal overflow-auto;
-    text-overflow: clip;
+@utility shadow-border-xs {
+  box-shadow: var(--shadow-xs), 0px 0px 0px 1px var(--color-alpha-black-50);
+
+  @variant theme-dark {
+    box-shadow: var(--shadow-xs), 0px 0px 0px 1px var(--color-alpha-white-50);
   }
-  
-  select.form-field__input,
-  button.form-field__input  {
-    @apply pr-10 appearance-none;
-    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' fill='none' viewBox='0 0 20 20'%3e%3cpath stroke='%236b7280' stroke-linecap='round' stroke-linejoin='round' stroke-width='1.5' d='M6 8l4 4 4-4'/%3e%3c/svg%3e");
-    background-position: right -0.15rem center;
-    background-repeat: no-repeat;
-    background-size: 1.25rem 1.25rem;
-    text-align: left;
+}
+
+@utility shadow-border-sm {
+  box-shadow: var(--shadow-sm), 0px 0px 0px 1px var(--color-alpha-black-50);
+
+  @variant theme-dark {
+    box-shadow: var(--shadow-sm), 0px 0px 0px 1px var(--color-alpha-white-50);
   }
+}
 
-  .form-field__radio {
-    @apply text-primary;
+@utility shadow-border-md {
+  box-shadow: var(--shadow-md), 0px 0px 0px 1px var(--color-alpha-black-50);
+
+  @variant theme-dark {
+    box-shadow: var(--shadow-md), 0px 0px 0px 1px var(--color-alpha-white-50);
   }
+}
 
-  .form-field__submit {
-    @apply cursor-pointer rounded-lg bg-surface p-3 text-center text-white hover:bg-surface-hover;
+@utility shadow-border-lg {
+  box-shadow: var(--shadow-lg), 0px 0px 0px 1px var(--color-alpha-black-50);
+
+  @variant theme-dark {
+    box-shadow: var(--shadow-lg), 0px 0px 0px 1px var(--color-alpha-white-50);
   }
+}
 
-  /* Checkboxes */
-  .checkbox {
-    &[type='checkbox'] {
-      @apply rounded-sm;
-      @apply transition-colors duration-300;
-    }
+@utility shadow-border-xl {
+  box-shadow: var(--shadow-xl), 0px 0px 0px 1px var(--color-alpha-black-50);
+
+  @variant theme-dark {
+    box-shadow: var(--shadow-xl), 0px 0px 0px 1px var(--color-alpha-white-50);
   }
+}
 
-  .checkbox--light {
-    &[type='checkbox'] {
-      @apply border-alpha-black-200 checked:bg-gray-900 checked:ring-gray-900 focus:ring-gray-900 focus-visible:ring-gray-900 checked:hover:bg-gray-300 hover:bg-gray-300;
-    }
+@utility border-primary {
+  @apply border-alpha-black-300;
 
-    &[type='checkbox']:disabled {
-      @apply cursor-not-allowed opacity-80 bg-gray-50 border-gray-200 checked:bg-gray-400 checked:ring-gray-400;
-    }
-
-    @variant theme-dark {
-      &[type='checkbox'] {
-        @apply ring-gray-900 checked:text-white;
-        background-color: var(--color-gray-100);
-      }
-  
-      &[type='checkbox']:disabled {
-        @apply cursor-not-allowed opacity-80;
-        background-color: var(--color-gray-600);
-      }
-  
-      &[type='checkbox']:checked {
-        background-image: url("data:image/svg+xml,%3csvg viewBox='0 0 16 16' fill='%23808080' xmlns='http://www.w3.org/2000/svg'%3e%3cpath d='M12.207 4.793a1 1 0 010 1.414l-5 5a1 1 0 01-1.414 0l-2-2a1 1 0 011.414-1.414L6.5 9.086l4.293-4.293a1 1 0 011.414 0z'/%3e%3c/svg%3e");
-        background-color: var(--color-gray-100);
-      }
-    }
+  @variant theme-dark {
+    @apply border-alpha-white-400;
   }
+}
 
-  .checkbox--dark {
-    &[type='checkbox'] {
-      @apply ring-gray-900 checked:text-white;
-    }
+@utility border-secondary {
+  @apply border-alpha-black-200;
 
-    &[type='checkbox']:disabled {
-      @apply cursor-not-allowed opacity-80 ring-gray-600;
-    }
-
-    &[type='checkbox']:checked {
-      background-image: url("data:image/svg+xml,%3csvg viewBox='0 0 16 16' fill='%23111827' xmlns='http://www.w3.org/2000/svg'%3e%3cpath d='M12.207 4.793a1 1 0 010 1.414l-5 5a1 1 0 01-1.414 0l-2-2a1 1 0 011.414-1.414L6.5 9.086l4.293-4.293a1 1 0 011.414 0z'/%3e%3c/svg%3e");
-    }
+  @variant theme-dark {
+    @apply border-alpha-white-300;
   }
+}
 
-  /* Tooltips */
-  .tooltip {
-    @apply hidden absolute;
-  }
+@utility border-divider {
+  @apply border-tertiary;
+}
 
-  .qrcode svg path {
-    fill: var(--color-black);
-    @variant theme-dark {
-      fill: var(--color-white);
-    }
+@utility border-subdued {
+  @apply border-alpha-black-50;
+
+  @variant theme-dark {
+    @apply border-alpha-white-100;
   }
-}
\ No newline at end of file
+}
+
+@utility border-solid {
+  @apply border-black;
+
+  @variant theme-dark {
+    @apply border-white;
+  }
+}
+
+@utility border-destructive {
+  @apply border-red-500;
+
+  @variant theme-dark {
+    @apply border-red-400;
+  }
+}
+
+@utility border-inverse {
+  @apply border-alpha-white-200;
+
+  @variant theme-dark {
+    @apply border-alpha-black-300;
+  }
+}
+
+@utility button-bg-primary {
+  @apply bg-gray-900;
+
+  @variant theme-dark {
+    @apply bg-white;
+  }
+}
+
+@utility button-bg-primary-hover {
+  @apply bg-gray-800;
+
+  @variant theme-dark {
+    @apply bg-gray-50;
+  }
+}
+
+@utility button-bg-secondary {
+  @apply bg-gray-50;
+
+  @variant theme-dark {
+    @apply bg-gray-700;
+  }
+}
+
+@utility button-bg-secondary-hover {
+  @apply bg-gray-100;
+
+  @variant theme-dark {
+    @apply bg-gray-600;
+  }
+}
+
+@utility button-bg-secondary-strong {
+  @apply bg-gray-200;
+
+  @variant theme-dark {
+    @apply bg-gray-700;
+  }
+}
+
+@utility button-bg-secondary-strong-hover {
+  @apply bg-gray-300;
+
+  @variant theme-dark {
+    @apply bg-gray-600;
+  }
+}
+
+@utility button-bg-disabled {
+  @apply bg-gray-50;
+
+  @variant theme-dark {
+    @apply bg-gray-700;
+  }
+}
+
+@utility button-bg-destructive {
+  @apply bg-red-500;
+
+  @variant theme-dark {
+    @apply bg-red-400;
+  }
+}
+
+@utility button-bg-destructive-hover {
+  @apply bg-red-600;
+
+  @variant theme-dark {
+    @apply bg-red-500;
+  }
+}
+
+@utility button-bg-ghost-hover {
+  @apply bg-gray-50;
+
+  @variant theme-dark {
+    @apply bg-gray-800 text-inverse;
+  }
+}
+
+@utility button-bg-outline-hover {
+  @apply bg-gray-100;
+
+  @variant theme-dark {
+    @apply bg-gray-700;
+  }
+}
+
+@utility tab-item-active {
+  @apply bg-white;
+
+  @variant theme-dark {
+    @apply bg-gray-700;
+  }
+}
+
+@utility tab-item-hover {
+  @apply bg-gray-200;
+
+  @variant theme-dark {
+    @apply bg-gray-800;
+  }
+}
+
+@utility tab-bg-group {
+  @apply bg-gray-50;
+
+  @variant theme-dark {
+    @apply bg-alpha-black-700;
+  }
+}
diff --git a/app/assets/tailwind/sure-design-system/base.css b/app/assets/tailwind/sure-design-system/base.css
new file mode 100644
index 000000000..522cdcf37
--- /dev/null
+++ b/app/assets/tailwind/sure-design-system/base.css
@@ -0,0 +1,37 @@
+@layer base {
+  button {
+    @apply cursor-pointer focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-offset-2 focus-visible:ring-alpha-black-300;
+
+    @variant theme-dark {
+      @apply focus-visible:ring-alpha-white-300;
+    }
+  }
+
+  hr {
+    @apply text-gray-200;
+  }
+
+  /* We control the sizing through DialogComponent, so reset this value */
+  dialog:modal {
+    max-width: 100dvw;
+    max-height: 100dvh;
+  }
+
+  details>summary::-webkit-details-marker {
+    @apply hidden;
+  }
+
+  details>summary {
+    @apply list-none;
+  }
+
+  input[type='radio'] {
+    @apply border-gray-300 text-indigo-600 focus:ring-indigo-600;
+    /* Default light mode */
+
+    @variant theme-dark {
+      /* Dark mode radio button base and checked styles */
+      @apply border-gray-600 bg-gray-700 checked:bg-blue-500 focus:ring-blue-500 focus:ring-offset-gray-800;
+    }
+  }
+}
diff --git a/app/assets/tailwind/sure-design-system/components.css b/app/assets/tailwind/sure-design-system/components.css
new file mode 100644
index 000000000..8a4c08b98
--- /dev/null
+++ b/app/assets/tailwind/sure-design-system/components.css
@@ -0,0 +1,148 @@
+@layer components {
+  /* Forms */
+  .form-field {
+    @apply flex flex-col gap-1 relative px-3 py-2 rounded-md border bg-container border-secondary shadow-xs w-full;
+    @apply focus-within:border-secondary focus-within:shadow-none focus-within:ring-4 focus-within:ring-alpha-black-200;
+    @apply transition-all duration-300;
+
+    @variant theme-dark {
+      @apply focus-within:ring-alpha-white-300;
+    }
+
+    /* Add styles for multiple select within form fields */
+    select[multiple] {
+      @apply py-2 pr-2 space-y-0.5 overflow-y-auto;
+
+      option {
+        @apply py-2 rounded-md;
+      }
+
+      option:checked {
+        @apply after:content-['\2713'] bg-container-inset after:text-gray-500 after:ml-2;
+      }
+
+      option:active,
+      option:focus {
+        @apply bg-container-inset;
+      }
+    }
+  }
+
+  /* New form field structure components */
+  .form-field__header {
+    @apply flex items-center justify-between gap-2;
+  }
+
+  .form-field__body {
+    @apply flex flex-col gap-1;
+  }
+
+  .form-field__actions {
+    @apply flex items-center gap-1;
+  }
+
+  .form-field__label {
+    @apply block text-xs text-secondary peer-disabled:text-subdued;
+  }
+
+  .form-field__input {
+    @apply text-primary border-none bg-container text-sm opacity-100 w-full p-0;
+    @apply focus:opacity-100 focus:outline-hidden focus:ring-0;
+    @apply placeholder-shown:opacity-50;
+    @apply disabled:text-subdued;
+    @apply text-ellipsis overflow-hidden whitespace-nowrap;
+    @apply transition-opacity duration-300;
+    @apply placeholder:text-subdued;
+
+    @variant theme-dark {
+      &::-webkit-calendar-picker-indicator {
+        filter: invert(1);
+        cursor: pointer;
+      }
+    }
+  }
+
+  textarea.form-field__input {
+    @apply whitespace-normal overflow-auto;
+    text-overflow: clip;
+  }
+
+  select.form-field__input,
+  button.form-field__input  {
+    @apply pr-10 appearance-none;
+    background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' fill='none' viewBox='0 0 20 20'%3e%3cpath stroke='%236b7280' stroke-linecap='round' stroke-linejoin='round' stroke-width='1.5' d='M6 8l4 4 4-4'/%3e%3c/svg%3e");
+    background-position: right -0.15rem center;
+    background-repeat: no-repeat;
+    background-size: 1.25rem 1.25rem;
+    text-align: left;
+  }
+
+  .form-field__radio {
+    @apply text-primary;
+  }
+
+  .form-field__submit {
+    @apply cursor-pointer rounded-lg bg-surface p-3 text-center text-white hover:bg-surface-hover;
+  }
+
+  /* Checkboxes */
+  .checkbox {
+    &[type='checkbox'] {
+      @apply rounded-sm;
+      @apply transition-colors duration-300;
+    }
+  }
+
+  .checkbox--light {
+    &[type='checkbox'] {
+      @apply border-alpha-black-200 checked:bg-gray-900 checked:ring-gray-900 focus:ring-gray-900 focus-visible:ring-gray-900 checked:hover:bg-gray-300 hover:bg-gray-300;
+    }
+
+    &[type='checkbox']:disabled {
+      @apply cursor-not-allowed opacity-80 bg-gray-50 border-gray-200 checked:bg-gray-400 checked:ring-gray-400;
+    }
+
+    @variant theme-dark {
+      &[type='checkbox'] {
+        @apply ring-gray-900 checked:text-white;
+        background-color: var(--color-gray-100);
+      }
+
+      &[type='checkbox']:disabled {
+        @apply cursor-not-allowed opacity-80;
+        background-color: var(--color-gray-600);
+      }
+
+      &[type='checkbox']:checked {
+        background-image: url("data:image/svg+xml,%3csvg viewBox='0 0 16 16' fill='%23808080' xmlns='http://www.w3.org/2000/svg'%3e%3cpath d='M12.207 4.793a1 1 0 010 1.414l-5 5a1 1 0 01-1.414 0l-2-2a1 1 0 011.414-1.414L6.5 9.086l4.293-4.293a1 1 0 011.414 0z'/%3e%3c/svg%3e");
+        background-color: var(--color-gray-100);
+      }
+    }
+  }
+
+  .checkbox--dark {
+    &[type='checkbox'] {
+      @apply ring-gray-900 checked:text-white;
+    }
+
+    &[type='checkbox']:disabled {
+      @apply cursor-not-allowed opacity-80 ring-gray-600;
+    }
+
+    &[type='checkbox']:checked {
+      background-image: url("data:image/svg+xml,%3csvg viewBox='0 0 16 16' fill='%23111827' xmlns='http://www.w3.org/2000/svg'%3e%3cpath d='M12.207 4.793a1 1 0 010 1.414l-5 5a1 1 0 01-1.414 0l-2-2a1 1 0 011.414-1.414L6.5 9.086l4.293-4.293a1 1 0 011.414 0z'/%3e%3c/svg%3e");
+    }
+  }
+
+  /* Tooltips */
+  .tooltip {
+    @apply hidden absolute;
+  }
+
+  .qrcode svg path {
+    fill: var(--color-black);
+    @variant theme-dark {
+      fill: var(--color-white);
+    }
+  }
+}
diff --git a/app/assets/tailwind/sure-design-system/prose.css b/app/assets/tailwind/sure-design-system/prose.css
new file mode 100644
index 000000000..68f6ad482
--- /dev/null
+++ b/app/assets/tailwind/sure-design-system/prose.css
@@ -0,0 +1,24 @@
+/* Specific override for strong tags in prose under dark mode */
+.prose:where([data-theme=dark], [data-theme=dark] *) strong {
+  color: theme(colors.white) !important;
+}
+
+/* Specific override for headings in prose under dark mode */
+.prose:where([data-theme=dark], [data-theme=dark] *) h1,
+.prose:where([data-theme=dark], [data-theme=dark] *) h2,
+.prose:where([data-theme=dark], [data-theme=dark] *) h3,
+.prose:where([data-theme=dark], [data-theme=dark] *) h4,
+.prose:where([data-theme=dark], [data-theme=dark] *) h5,
+.prose:where([data-theme=dark], [data-theme=dark] *) h6,
+.prose:where([data-theme=dark], [data-theme=dark] *) blockquote,
+.prose:where([data-theme=dark], [data-theme=dark] *) thead th {
+  color: theme(colors.white) !important;
+}
+
+/* Inline code in prose under dark mode. Without this the Tailwind Typography
+   plugin's default near-black foreground falls through and disappears against
+   the dark page background. */
+.prose:where([data-theme=dark], [data-theme=dark] *) code {
+  color: theme(colors.white) !important;
+  background-color: theme(colors.gray.800) !important;
+}
diff --git a/app/components/DS/alert.html.erb b/app/components/DS/alert.html.erb
index e56c9fc40..efda08221 100644
--- a/app/components/DS/alert.html.erb
+++ b/app/components/DS/alert.html.erb
@@ -1,7 +1,37 @@
-<div class="<%= container_classes %>">
-  <%= helpers.icon icon_name, size: "sm", color: icon_color, class: "shrink-0" %>
+<%= tag.div(class: container_classes, role: aria_role, "aria-labelledby": (aria_role && title.present?) ? title_id : nil) do %>
+  <% if title.present? %>
+    <div class="flex items-center gap-3">
+      <%= helpers.icon icon_name, size: "sm", color: icon_color, class: "shrink-0 -mt-0.5" %>
+      <p id="<%= title_id %>" class="text-sm font-semibold text-primary flex-1 leading-5">
+        <span class="sr-only"><%= variant_label %>:</span>
+        <%= title %>
+      </p>
+    </div>
 
-  <div class="flex-1 text-sm">
-    <%= message %>
-  </div>
-</div>
+    <% if content.present? || message.present? %>
+      <div class="text-sm text-primary mt-2 pl-7 space-y-1">
+        <% if content.present? %>
+          <%= content %>
+        <% else %>
+          <%= message %>
+        <% end %>
+      </div>
+    <% end %>
+  <% elsif content.present? %>
+    <div class="flex items-start gap-3">
+      <%= helpers.icon icon_name, size: "sm", color: icon_color, class: "shrink-0" %>
+      <div class="flex-1 text-sm text-primary space-y-1">
+        <span class="sr-only"><%= variant_label %>:</span>
+        <%= content %>
+      </div>
+    </div>
+  <% elsif message.present? %>
+    <div class="flex items-center gap-3">
+      <%= helpers.icon icon_name, size: "sm", color: icon_color, class: "shrink-0 -mt-0.5" %>
+      <p class="text-sm text-primary flex-1 leading-5">
+        <span class="sr-only"><%= variant_label %>:</span>
+        <%= message %>
+      </p>
+    </div>
+  <% end %>
+<% end %>
diff --git a/app/components/DS/alert.rb b/app/components/DS/alert.rb
index 22241133f..18204cc5e 100644
--- a/app/components/DS/alert.rb
+++ b/app/components/DS/alert.rb
@@ -1,24 +1,44 @@
 class DS::Alert < DesignSystemComponent
-  def initialize(message:, variant: :info)
+  VARIANTS = %i[info success warning error destructive].freeze
+  LIVE_MODES = %i[none status alert].freeze
+
+  def initialize(message: nil, title: nil, variant: :info, live: :none)
     @message = message
-    @variant = variant
+    @title = title
+    @variant = normalize_variant(variant)
+    @live = normalize_live(live)
   end
 
   private
-    attr_reader :message, :variant
+    attr_reader :message, :title, :variant, :live
+
+    def normalize_variant(raw)
+      sym = raw.respond_to?(:to_sym) ? raw.to_sym : nil
+      VARIANTS.include?(sym) ? sym : :info
+    end
+
+    def normalize_live(raw)
+      sym = raw.respond_to?(:to_sym) ? raw.to_sym : nil
+      case sym
+      when :polite then :status
+      when :assertive then :alert
+      when *LIVE_MODES then sym
+      else :none
+      end
+    end
 
     def container_classes
-      base_classes = "flex items-start gap-3 p-4 rounded-lg border"
+      base_classes = "p-4 rounded-lg border"
 
       variant_classes = case variant
       when :info
-        "bg-blue-50 text-blue-700 border-blue-200 theme-dark:bg-blue-900/20 theme-dark:text-blue-400 theme-dark:border-blue-800"
+        "bg-info/10 border-info/20"
       when :success
-        "bg-green-50 text-green-700 border-green-200 theme-dark:bg-green-900/20 theme-dark:text-green-400 theme-dark:border-green-800"
+        "bg-success/10 border-success/20"
       when :warning
-        "bg-yellow-50 text-yellow-700 border-yellow-200 theme-dark:bg-yellow-900/20 theme-dark:text-yellow-400 theme-dark:border-yellow-800"
+        "bg-warning/10 border-warning/20"
       when :error, :destructive
-        "bg-red-50 text-red-700 border-red-200 theme-dark:bg-red-900/20 theme-dark:text-red-400 theme-dark:border-red-800"
+        "bg-destructive/10 border-destructive-subtle"
       end
 
       "#{base_classes} #{variant_classes}"
@@ -46,7 +66,22 @@ class DS::Alert < DesignSystemComponent
       when :error, :destructive
         "destructive"
       else
-        "blue-600"
+        "info"
       end
     end
+
+    def aria_role
+      case live
+      when :status then "status"
+      when :alert then "alert"
+      end
+    end
+
+    def variant_label
+      I18n.t("ds.alert.variants.#{variant}")
+    end
+
+    def title_id
+      @title_id ||= "DS-alert-title-#{SecureRandom.hex(4)}"
+    end
 end
diff --git a/app/components/DS/button.html.erb b/app/components/DS/button.html.erb
index 0b69c4649..557db0bd9 100644
--- a/app/components/DS/button.html.erb
+++ b/app/components/DS/button.html.erb
@@ -4,7 +4,7 @@
   <% end %>
 
   <% unless icon_only? %>
-    <%= text %>
+    <span class="min-w-0 truncate"><%= text %></span>
   <% end %>
 
   <% if icon && icon_position == :right %>
diff --git a/app/components/DS/button.rb b/app/components/DS/button.rb
index a253c04c7..ca5644225 100644
--- a/app/components/DS/button.rb
+++ b/app/components/DS/button.rb
@@ -22,7 +22,6 @@ class DS::Button < DS::Buttonish
     def merged_opts
       merged_opts = opts.dup || {}
       extra_classes = merged_opts.delete(:class)
-      href = merged_opts.delete(:href)
       data = merged_opts.delete(:data) || {}
 
       if confirm.present?
@@ -33,6 +32,28 @@ class DS::Button < DS::Buttonish
         data = data.merge(turbo_frame: frame)
       end
 
+      # `content_tag(:button, ...)` defaults to `type="submit"` per the HTML
+      # spec — meaning a DS::Button rendered inside a form will steal Enter-key
+      # submission from the first text input. Default to `type="button"` so
+      # callers must opt into submit behavior explicitly. `button_to` (href
+      # branch) wraps the button in its own form, so submit there is correct
+      # and we leave its default alone.
+      if href.blank?
+        merged_opts[:type] ||= "button"
+      end
+
+      # Icon-only buttons have no visible text node, so screen readers fall
+      # back to announcing "button" with no name. Derive a humanized fallback
+      # from the icon key so AT users hear *something* meaningful; explicit
+      # `aria: { label: }` on the caller still wins.
+      if icon_only? && icon.present?
+        aria = (merged_opts[:aria] || {}).symbolize_keys
+        if aria[:label].blank? && merged_opts[:"aria-label"].blank?
+          aria[:label] = icon.to_s.tr("-_", " ").capitalize
+          merged_opts[:aria] = aria
+        end
+      end
+
       merged_opts.merge(
         class: class_names(container_classes, extra_classes),
         data: data
diff --git a/app/components/DS/buttonish.rb b/app/components/DS/buttonish.rb
index 0c68d1dbe..f1e864511 100644
--- a/app/components/DS/buttonish.rb
+++ b/app/components/DS/buttonish.rb
@@ -2,35 +2,35 @@ class DS::Buttonish < DesignSystemComponent
   VARIANTS = {
     primary: {
       container_classes: "text-inverse bg-inverse hover:bg-inverse-hover disabled:bg-gray-500 theme-dark:disabled:bg-gray-400",
-      icon_classes: "fg-inverse"
+      icon_classes: "text-inverse"
     },
     secondary: {
       container_classes: "text-primary bg-gray-200 theme-dark:bg-gray-700 hover:bg-gray-300 theme-dark:hover:bg-gray-600 disabled:bg-gray-200 theme-dark:disabled:bg-gray-600",
-      icon_classes: "fg-primary"
+      icon_classes: "text-primary"
     },
     destructive: {
       container_classes: "text-inverse bg-red-500 theme-dark:bg-red-400 hover:bg-red-600 theme-dark:hover:bg-red-500 disabled:bg-red-200 theme-dark:disabled:bg-red-600",
-      icon_classes: "fg-white"
+      icon_classes: "text-inverse"
     },
     outline: {
       container_classes: "text-primary border border-secondary bg-transparent hover:bg-surface-hover",
-      icon_classes: "fg-gray"
+      icon_classes: "text-secondary"
     },
     outline_destructive: {
-      container_classes: "text-destructive border border-secondary bg-transparent hover:bg-gray-100 theme-dark:hover:bg-gray-700",
-      icon_classes: "fg-gray"
+      container_classes: "text-destructive border border-secondary bg-transparent hover:bg-container-inset-hover",
+      icon_classes: "text-secondary"
     },
     ghost: {
-      container_classes: "text-primary bg-transparent hover:bg-gray-100 theme-dark:hover:bg-gray-700",
-      icon_classes: "fg-gray"
+      container_classes: "text-primary bg-transparent hover:bg-container-inset-hover",
+      icon_classes: "text-secondary"
     },
     icon: {
-      container_classes: "hover:bg-gray-100 theme-dark:hover:bg-gray-700",
-      icon_classes: "fg-gray"
+      container_classes: "hover:bg-container-inset-hover",
+      icon_classes: "text-secondary"
     },
     icon_inverse: {
       container_classes: "bg-inverse hover:bg-inverse-hover",
-      icon_classes: "fg-inverse"
+      icon_classes: "text-inverse"
     }
   }.freeze
 
@@ -43,13 +43,13 @@ class DS::Buttonish < DesignSystemComponent
     },
     md: {
       container_classes: "px-3 py-2",
-      icon_container_classes: "inline-flex items-center justify-center w-9 h-9",
+      icon_container_classes: "inline-flex items-center justify-center w-11 h-11",
       radius_classes: "rounded-lg",
       text_classes: "text-sm"
     },
     lg: {
       container_classes: "px-4 py-3",
-      icon_container_classes: "inline-flex items-center justify-center w-10 h-10",
+      icon_container_classes: "inline-flex items-center justify-center w-12 h-12",
       radius_classes: "rounded-xl",
       text_classes: "text-base"
     }
diff --git a/app/components/DS/dialog.html.erb b/app/components/DS/dialog.html.erb
index 307303970..97bac18d6 100644
--- a/app/components/DS/dialog.html.erb
+++ b/app/components/DS/dialog.html.erb
@@ -1,5 +1,23 @@
 <%= wrapper_element do %>
-  <%= tag.dialog class: "w-full h-full bg-transparent theme-dark:backdrop:bg-alpha-black-900 backdrop:bg-overlay pt-[env(safe-area-inset-top)] pb-[env(safe-area-inset-bottom)] #{(drawer? || responsive?) ? "lg:p-3" : "lg:p-1"}", **merged_opts do %>
+  <%# `role="dialog"` + `aria-modal="true"` is redundant with `<dialog>`
+      in modern browsers, but Safari and screen readers older than the
+      2024 WAI-ARIA Mapping still benefit from the explicit role.
+      `aria-labelledby` is always emitted with the stable `title_id`. When
+      the header slot rendered an auto-title (the common case), AT
+      resolves the reference and announces the title. When no title is
+      rendered (`custom_header: true`, body-only dialogs), the dangling
+      reference is silently ignored per the WAI-ARIA spec, and callers
+      can supply `aria-label` / `aria-labelledby` via `**opts` (last-wins)
+      for an explicit accessible name. The conditional `if has_auto_title?`
+      gate was a no-op here: the `renders_one :header` slot lambda is
+      evaluated lazily at slot-render time (after the `<dialog>` opening
+      tag attributes are computed), so the flag was never `true` when
+      this attribute was read. %>
+  <%= tag.dialog class: "w-full h-full bg-transparent text-primary theme-dark:backdrop:bg-alpha-black-900 backdrop:bg-overlay pt-[env(safe-area-inset-top)] pb-[env(safe-area-inset-bottom)] #{(drawer? || responsive?) ? "lg:p-3" : "lg:p-1"}",
+              role: "dialog",
+              "aria-modal": "true",
+              "aria-labelledby": title_id,
+              **merged_opts do %>
     <%= tag.div class: dialog_outer_classes do %>
       <%= tag.div class: dialog_inner_classes, data: { DS__dialog_target: "content" } do %>
         <div class="grow py-4 space-y-4 flex flex-col <%= "overflow-auto" if scrollable %>">
diff --git a/app/components/DS/dialog.rb b/app/components/DS/dialog.rb
index e9c4eb3ae..fe2611339 100644
--- a/app/components/DS/dialog.rb
+++ b/app/components/DS/dialog.rb
@@ -2,7 +2,11 @@ class DS::Dialog < DesignSystemComponent
   renders_one :header, ->(title: nil, subtitle: nil, custom_header: false, **opts, &block) do
     content_tag(:header, class: "px-4 flex flex-col gap-2", **opts) do
       title_div = content_tag(:div, class: "flex items-center justify-between gap-2") do
-        title = content_tag(:h2, title, class: class_names("font-medium text-primary", drawer? ? "text-lg" : "")) if title
+        # `id: title_id` lets the host `<dialog>` reference the title via
+        # `aria-labelledby` so AT users hear the title when focus lands
+        # in the dialog. `content_tag("h#{heading_level}", ...)` builds an
+        # h2/h3/etc based on the caller's `heading_level:`.
+        title = content_tag("h#{heading_level}", title, id: title_id, class: class_names("font-medium text-primary", drawer? ? "text-lg" : "")) if title
         close_icon = close_button unless custom_header
         safe_join([ title, close_icon ].compact)
       end
@@ -33,7 +37,7 @@ class DS::Dialog < DesignSystemComponent
     end
   end
 
-  attr_reader :variant, :auto_open, :reload_on_close, :width, :disable_frame, :content_class, :disable_click_outside, :opts, :responsive, :scrollable
+  attr_reader :variant, :auto_open, :reload_on_close, :width, :disable_frame, :content_class, :disable_click_outside, :opts, :responsive, :scrollable, :heading_level, :title_id
 
   VARIANTS = %w[modal drawer].freeze
   WIDTHS = {
@@ -42,8 +46,13 @@ class DS::Dialog < DesignSystemComponent
     lg: "lg:max-w-[700px]",
     full: "lg:max-w-full"
   }.freeze
+  VALID_HEADING_LEVELS = (1..6).freeze
+
+  def initialize(variant: "modal", auto_open: true, reload_on_close: false, width: "md", frame: nil, disable_frame: false, content_class: nil, disable_click_outside: false, responsive: false, scrollable: true, heading_level: 2, **opts)
+    unless heading_level.is_a?(Integer) && VALID_HEADING_LEVELS.cover?(heading_level)
+      raise ArgumentError, "heading_level must be an Integer between 1 and 6, got: #{heading_level.inspect}"
+    end
 
-  def initialize(variant: "modal", auto_open: true, reload_on_close: false, width: "md", frame: nil, disable_frame: false, content_class: nil, disable_click_outside: false, responsive: false, scrollable: true, **opts)
     @variant = variant.to_sym
     @auto_open = auto_open
     @reload_on_close = reload_on_close
@@ -54,6 +63,8 @@ class DS::Dialog < DesignSystemComponent
     @disable_click_outside = disable_click_outside
     @responsive = responsive
     @scrollable = scrollable
+    @heading_level = heading_level
+    @title_id = "dialog-title-#{SecureRandom.hex(4)}"
     @opts = opts
   end
 
@@ -133,8 +144,8 @@ class DS::Dialog < DesignSystemComponent
       variant: "icon",
       class: classes,
       icon: "x",
-      title: I18n.t("common.close"),
-      aria_label: I18n.t("common.close"),
+      title: I18n.t("ds.dialog.close"),
+      aria_label: I18n.t("ds.dialog.close"),
       data: { action: "DS--dialog#close" }
     )
   end
diff --git a/app/components/DS/disclosure.html.erb b/app/components/DS/disclosure.html.erb
index bf6f61d1d..c323aa76c 100644
--- a/app/components/DS/disclosure.html.erb
+++ b/app/components/DS/disclosure.html.erb
@@ -1,13 +1,25 @@
-<details class="group" <%= "open" if open %>>
-  <%= tag.summary class: class_names(
-    "px-3 py-2 rounded-xl cursor-pointer flex items-center justify-between bg-surface"
-  ) do %>
+<%= tag.details class: details_classes, open: open, **details_opts do %>
+  <%= tag.summary class: summary_classes do %>
     <% if summary_content? %>
-      <%= summary_content %>
+      <% if variant == :default %>
+        <%# `:default` summary is already `flex justify-between`, so
+            caller-provided sibling divs get distributed directly.
+            Wrapping would collapse them into a single flex child and
+            kill the justify-between distribution. %>
+        <%= summary_content %>
+      <% else %>
+        <%# Non-default summaries are `list-item` (no flex), so a flex
+            caller div would shrink-wrap to content width and any
+            `justify-between` inside has nothing to distribute. Wrap
+            in `w-full` so caller flex rows stretch across the card. %>
+        <div class="w-full">
+          <%= summary_content %>
+        </div>
+      <% end %>
     <% else %>
       <div class="flex items-center gap-3">
         <% if align == :left %>
-          <%= helpers.icon "chevron-right", class: "group-open:transform group-open:rotate-90" %>
+          <%= helpers.icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
         <% end %>
 
         <%= tag.span class: class_names("font-medium", align == :left ? "text-sm text-primary" : "text-xs uppercase text-secondary") do %>
@@ -16,7 +28,7 @@
       </div>
 
       <% if align == :right %>
-        <%= helpers.icon "chevron-down", class: "group-open:transform group-open:rotate-180" %>
+        <%= helpers.icon "chevron-down", class: "group-open:rotate-180 motion-safe:transition-transform motion-safe:duration-150" %>
       <% end %>
     <% end %>
   <% end %>
@@ -24,4 +36,4 @@
   <div class="mt-2">
     <%= content %>
   </div>
-</details>
+<% end %>
diff --git a/app/components/DS/disclosure.rb b/app/components/DS/disclosure.rb
index d301d671e..5f993d6c1 100644
--- a/app/components/DS/disclosure.rb
+++ b/app/components/DS/disclosure.rb
@@ -1,12 +1,79 @@
 class DS::Disclosure < DesignSystemComponent
   renders_one :summary_content
 
-  attr_reader :title, :align, :open, :opts
+  VARIANTS = %i[default card card_inset inline].freeze
 
-  def initialize(title: nil, align: "right", open: false, **opts)
+  attr_reader :title, :align, :open, :variant, :opts
+
+  # `:default` — bg-surface summary, no chrome on the `<details>`. Use
+  # for inline expanders that sit inside a parent card (the summary
+  # itself reads as the surface).
+  #
+  # `:card` — `<details>` itself becomes a `bg-container shadow-border-xs
+  # rounded-xl` card; the summary inherits the container (no own bg).
+  # Use for provider-item rows (binance, lunchflow, plaid, etc.) where
+  # each card is the surface and the summary is custom rich content.
+  #
+  # `:card_inset` — `<details>` is `bg-surface-inset rounded-xl` (no
+  # shadow). Use for inset sub-panels inside a parent card surface
+  # (e.g. the IBKR flex-query "report details" panel embedded inside
+  # the IBKR settings flow). Same summary contract as `:card`.
+  #
+  # `:inline` — no surface, no padding, no shadow. The disclosure reads
+  # as a plain text-link-style toggle (e.g. "Alternative auth" inside
+  # a form, or a "Manage connections" lazy-load opener). Caller provides
+  # the summary text (and optional chevron) via the `summary_content`
+  # slot.
+  #
+  # In card / inline variants, callers should pass their own
+  # `summary_content` slot; the built-in title rendering assumes the
+  # `:default` shape.
+  def initialize(title: nil, align: "right", open: false, variant: :default, **opts)
     @title = title
     @align = align.to_sym
     @open = open
+    @variant = variant&.to_sym
     @opts = opts
+
+    raise ArgumentError, "Invalid variant: #{@variant.inspect}. Must be one of #{VARIANTS.inspect}" unless VARIANTS.include?(@variant)
+  end
+
+  def details_classes
+    base = case variant
+    when :card
+      "group bg-container p-4 shadow-border-xs rounded-xl"
+    when :card_inset
+      "group bg-surface-inset rounded-xl p-4"
+    else
+      "group"
+    end
+
+    class_names(base, opts[:class])
+  end
+
+  # `opts` minus the `:class` key, since `details_classes` merges that
+  # separately to avoid duplicate-keyword collisions when forwarding to
+  # `tag.details`.
+  def details_opts
+    opts.except(:class)
+  end
+
+  def summary_classes
+    case variant
+    when :card, :card_inset
+      # Card variants: no bg on summary — the parent details *is* the
+      # surface. Keep cursor + focus-visible ring + flex baseline.
+      # Ring token matches `settings/provider_card.html.erb` (the
+      # established focus pattern on container cards).
+      "list-none cursor-pointer focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-alpha-black-300 rounded-xl"
+    when :inline
+      # Inline variant: no surface, no padding — the summary reads as
+      # plain text-link copy. Caller markup (text + optional chevron)
+      # provides the visual. Keep cursor + focus-visible ring + matching
+      # alpha-black-300 token used by the card variants for consistency.
+      "list-none cursor-pointer focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-alpha-black-300 rounded-sm"
+    else
+      "px-3 py-2 rounded-xl cursor-pointer flex items-center justify-between bg-surface focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-alpha-black-300"
+    end
   end
 end
diff --git a/app/components/DS/filled_icon.html.erb b/app/components/DS/filled_icon.html.erb
index 49adba9e1..9721a26b6 100644
--- a/app/components/DS/filled_icon.html.erb
+++ b/app/components/DS/filled_icon.html.erb
@@ -1,5 +1,8 @@
 <%= tag.div style: transparent? ? container_styles : nil,
-            class: container_classes do %>
+            class: container_classes,
+            role: (!aria_hidden && description.present?) ? "img" : nil,
+            "aria-label": aria_hidden ? nil : description.presence,
+            "aria-hidden": aria_hidden ? "true" : nil do %>
   <% if icon %>
     <%= helpers.icon(icon, size: icon_size, color: "current") %>
   <% elsif text %>
diff --git a/app/components/DS/filled_icon.rb b/app/components/DS/filled_icon.rb
index 73113a0bc..19ed2e5fa 100644
--- a/app/components/DS/filled_icon.rb
+++ b/app/components/DS/filled_icon.rb
@@ -1,5 +1,5 @@
 class DS::FilledIcon < DesignSystemComponent
-  attr_reader :icon, :text, :hex_color, :size, :rounded, :variant
+  attr_reader :icon, :text, :hex_color, :size, :rounded, :variant, :description, :aria_hidden
 
   VARIANTS = %i[default text surface container inverse].freeze
 
@@ -24,13 +24,26 @@ class DS::FilledIcon < DesignSystemComponent
     }
   }.freeze
 
-  def initialize(variant: :default, icon: nil, text: nil, hex_color: nil, size: "md", rounded: false)
+  # `description:` makes the icon meaningful — emits `role="img"` +
+  # `aria-label=description` so AT users hear it. Without `description:`,
+  # the wrapper defaults to `aria-hidden="true"` (decorative) on the
+  # assumption that adjacent DOM carries the accessible name. Pass
+  # `aria_hidden: false` if you want the visual exposed but the name
+  # already lives in surrounding text (rare).
+  #
+  # NOTE on the `:text` variant: only `text.first` is rendered (e.g.
+  # "Apple" → "A"). The single letter is decorative — relying on AT
+  # users to infer "Apple" from "A" is broken. Use `description:` to
+  # surface the full label, or ensure the adjacent text node carries it.
+  def initialize(variant: :default, icon: nil, text: nil, hex_color: nil, size: "md", rounded: false, description: nil, aria_hidden: nil)
     @variant = variant.to_sym
     @icon = icon
     @text = text
     @hex_color = hex_color
     @size = size.to_sym
     @rounded = rounded
+    @description = description.presence
+    @aria_hidden = aria_hidden.nil? ? @description.blank? : aria_hidden
   end
 
   def container_classes
diff --git a/app/components/DS/link.html.erb b/app/components/DS/link.html.erb
index dae100eaa..f9c4cff5d 100644
--- a/app/components/DS/link.html.erb
+++ b/app/components/DS/link.html.erb
@@ -10,4 +10,8 @@
   <% if icon && icon_position == "right" %>
     <%= helpers.icon(icon, size: size, color: icon_color) %>
   <% end %>
+
+  <% if opens_in_new_tab? %>
+    <span class="sr-only"><%= t("ds.link.opens_in_new_tab", default: "(opens in new tab)") %></span>
+  <% end %>
 <% end %>
diff --git a/app/components/DS/link.rb b/app/components/DS/link.rb
index 209f86b09..9ca73aacb 100644
--- a/app/components/DS/link.rb
+++ b/app/components/DS/link.rb
@@ -5,8 +5,14 @@ class DS::Link < DS::Buttonish
 
   VARIANTS = VARIANTS.reverse_merge(
     default: {
-      container_classes: "",
-      icon_classes: "fg-gray"
+      # Underline + `text-link` so the link is distinguishable by more
+      # than color alone (WCAG 1.4.1). Focus ring uses the established
+      # alpha-ring DS pattern (also used by DS::Toggle, DS::Tooltip,
+      # provider_card, form-field) so theming stays centralized.
+      container_classes: "text-link underline underline-offset-2 hover:no-underline " \
+                         "focus-visible:ring-2 focus-visible:ring-alpha-black-300 " \
+                         "theme-dark:focus-visible:ring-alpha-white-300",
+      icon_classes: "text-secondary"
     }
   ).freeze
 
@@ -18,12 +24,48 @@ class DS::Link < DS::Buttonish
       data = data.merge(turbo_frame: frame)
     end
 
+    # External link hardening: `target="_blank"` without `rel="noopener"`
+    # exposes window.opener to the new tab (reverse-tabnabbing). Always
+    # set `noopener noreferrer` when we send the user off-tab. Authors
+    # can override by passing `rel:` explicitly.
+    if merged_opts[:target].to_s == "_blank"
+      merged_opts[:rel] ||= "noopener noreferrer"
+    end
+
+    # Icon-only links have no visible text node, so screen readers fall
+    # back to announcing the href. Derive a humanized fallback from the
+    # icon key so AT users hear *something* meaningful; explicit
+    # `aria: { label: }` on the caller still wins. Mirrors DS::Button.
+    #
+    # When the link also opens in a new tab, fold the cue into the
+    # generated `aria-label` itself — `aria-label` overrides the
+    # descendant accessible name, so the sr-only "(opens in new tab)"
+    # span in the template would otherwise be masked.
+    if icon_only? && icon.present?
+      aria = (merged_opts[:aria] || {}).symbolize_keys
+      if aria[:label].blank? && merged_opts[:"aria-label"].blank?
+        label = icon.to_s.tr("-_", " ").humanize
+        if merged_opts[:target].to_s == "_blank"
+          label = "#{label} #{I18n.t("ds.link.opens_in_new_tab", default: "(opens in new tab)")}"
+        end
+        aria[:label] = label
+        merged_opts[:aria] = aria
+      end
+    end
+
     merged_opts.merge(
       class: class_names(container_classes, extra_classes),
       data: data
     )
   end
 
+  # Render an sr-only suffix when the link opens in a new tab so AT
+  # users hear "(opens in new tab)" — visual is a separate concern
+  # (callers can render a `external-link` icon if they want a glyph).
+  def opens_in_new_tab?
+    opts[:target].to_s == "_blank"
+  end
+
   private
     def container_size_classes
       super unless variant == :default
diff --git a/app/components/DS/menu.html.erb b/app/components/DS/menu.html.erb
index ed6490184..c77895cbd 100644
--- a/app/components/DS/menu.html.erb
+++ b/app/components/DS/menu.html.erb
@@ -1,26 +1,16 @@
 <%= tag.div data: { controller: "DS--menu", DS__menu_placement_value: placement, DS__menu_offset_value: offset, DS__menu_mobile_fullwidth_value: mobile_fullwidth, testid: testid } do %>
-  <% if variant == :icon %>
-    <%= render DS::Button.new(variant: "icon", icon: icon_vertical ? "more-vertical" : "more-horizontal", data: { DS__menu_target: "button" }) %>
+  <% if icon_only? %>
+    <%= render DS::Button.new(variant: "icon", size: icon_button_size, icon: icon_vertical ? "more-vertical" : "more-horizontal", aria: { haspopup: "menu", expanded: "false", controls: menu_id }, data: { DS__menu_target: "button" }) %>
   <% elsif variant == :button %>
     <%= button %>
-  <% elsif variant == :avatar %>
-    <button data-DS--menu-target="button">
-      <div class="w-9 h-9 cursor-pointer">
-        <%= render "settings/user_avatar", avatar_url: avatar_url, initials: initials %>
-      </div>
-    </button>
   <% end %>
 
-  <div data-DS--menu-target="content" class="px-2 lg:px-0 max-w-full hidden z-50">
+  <div id="<%= menu_id %>" data-DS--menu-target="content" class="px-2 lg:px-0 max-w-full hidden z-50" role="menu">
     <%= tag.div class: "mx-auto min-w-[200px] shadow-border-xs bg-container rounded-lg", style: ("max-width: #{max_width}" if max_width) do %>
-      <%= header %>
-
       <%= tag.div class: class_names("py-1" => !no_padding) do %>
         <% items.each do |item| %>
           <%= item %>
         <% end %>
-
-        <%= custom_content %>
       <% end %>
     <% end %>
   </div>
diff --git a/app/components/DS/menu.rb b/app/components/DS/menu.rb
index 32a14a472..778d48702 100644
--- a/app/components/DS/menu.rb
+++ b/app/components/DS/menu.rb
@@ -1,32 +1,40 @@
 # frozen_string_literal: true
 
+# `DS::Menu` is a strict action-list primitive. Children are `DS::MenuItem`
+# (link / button / divider) only; the container announces as `role="menu"`,
+# items as `role="menuitem"`, dividers as `role="separator"`. Arrow Up/Down
+# and Home/End move focus across items (roving tabindex). Use **only** for
+# flat clickable-action lists.
+#
+# Need a panel that hosts forms, pickers, headings, or user-account
+# content? Use `DS::Popover` — `role="menu"` restricts AT users to
+# menuitem-only navigation and breaks anything that isn't an action.
 class DS::Menu < DesignSystemComponent
-  attr_reader :variant, :avatar_url, :initials, :placement, :offset, :icon_vertical, :no_padding, :testid, :mobile_fullwidth, :max_width
+  attr_reader :variant, :placement, :offset, :icon_vertical, :no_padding, :testid, :mobile_fullwidth, :max_width, :menu_id
 
   renders_one :button, ->(**button_options, &block) do
-    options_with_target = button_options.merge(data: { DS__menu_target: "button" })
+    options_with_target = button_options.deep_dup
+    options_with_target[:data] = (options_with_target[:data] || {}).merge(DS__menu_target: "button")
+    options_with_target[:aria] = (options_with_target[:aria] || {}).merge(
+      haspopup: "menu",
+      expanded: "false",
+      controls: menu_id
+    )
 
     if block
+      options_with_target[:type] ||= "button"
       content_tag(:button, **options_with_target, &block)
     else
       DS::Button.new(**options_with_target)
     end
   end
 
-  renders_one :header, ->(&block) do
-    content_tag(:div, class: "border-b border-tertiary", &block)
-  end
-
-  renders_one :custom_content
-
   renders_many :items, DS::MenuItem
 
-  VARIANTS = %i[icon button avatar].freeze
+  VARIANTS = %i[icon icon_sm button].freeze
 
-  def initialize(variant: "icon", avatar_url: nil, initials: nil, placement: "bottom-end", offset: 12, icon_vertical: false, no_padding: false, testid: nil, mobile_fullwidth: true, max_width: nil)
+  def initialize(variant: "icon", placement: "bottom-end", offset: 12, icon_vertical: false, no_padding: false, testid: nil, mobile_fullwidth: true, max_width: nil)
     @variant = variant.to_sym
-    @avatar_url = avatar_url
-    @initials = initials
     @placement = placement
     @offset = offset
     @icon_vertical = icon_vertical
@@ -34,7 +42,26 @@ class DS::Menu < DesignSystemComponent
     @testid = testid
     @mobile_fullwidth = mobile_fullwidth
     @max_width = max_width
+    @menu_id = "menu-#{SecureRandom.hex(4)}"
 
-    raise ArgumentError, "Invalid variant: #{@variant}" unless VARIANTS.include?(@variant)
+    raise ArgumentError, "Invalid variant: #{@variant}. DS::Menu is for action lists only; use DS::Popover for mixed content (forms, pickers, account dropdowns)." unless VARIANTS.include?(@variant)
+  end
+
+  # `:icon_sm` renders the dropdown trigger as a 32x32 icon button (DS::Button
+  # `size: :sm`) instead of the default 44x44 `:md`. Use for action menus
+  # embedded in dense lists (e.g. the category dropdown row trigger) where the
+  # 44x44 enhanced-touch-target trigger introduced in #1840 makes every row
+  # ~8px taller and the cumulative list height regresses visibly.
+  #
+  # Trade-off: the `sm` icon button is 32x32, which meets WCAG 2.5.8 AA
+  # (24x24) but not 2.5.5 AAA enhanced (44x44). Acceptable for compact
+  # dropdown rows that aren't primary touch surfaces; do not use on
+  # standalone toolbar / row-action triggers where 44x44 should remain.
+  def icon_only?
+    variant == :icon || variant == :icon_sm
+  end
+
+  def icon_button_size
+    variant == :icon_sm ? "sm" : "md"
   end
 end
diff --git a/app/components/DS/menu_controller.js b/app/components/DS/menu_controller.js
index 5e24b3a0f..0c766909f 100644
--- a/app/components/DS/menu_controller.js
+++ b/app/components/DS/menu_controller.js
@@ -8,7 +8,10 @@ import {
 import { Controller } from "@hotwired/stimulus";
 
 /**
- * A "menu" can contain arbitrary content including non-clickable items, links, buttons, and forms.
+ * Strict action-list menu. Container is `role="menu"`, items are
+ * `role="menuitem"`. Arrow Up/Down moves focus between items, Home/End
+ * jumps to first/last, Escape closes the menu and returns focus to the
+ * trigger. Use DS::Popover for mixed-content panels (forms, pickers).
  */
 export default class extends Controller {
   static targets = ["button", "content"];
@@ -59,31 +62,71 @@ export default class extends Controller {
     if (event.key === "Escape") {
       this.close();
       this.buttonTarget.focus();
+      return;
     }
+    if (!this.show) return;
+
+    const items = this.#menuItems();
+    if (items.length === 0) return;
+    const currentIndex = items.indexOf(event.target);
+
+    // Activate the focused item on Enter / Space (ARIA menu pattern).
+    // Without this, link-based menuitems can't be activated by keyboard
+    // once focus has moved off the native default.
+    if (event.key === "Enter" || event.key === " ") {
+      if (currentIndex < 0) return;
+      event.preventDefault();
+      items[currentIndex].click();
+      return;
+    }
+
+    let nextIndex = null;
+    switch (event.key) {
+      case "ArrowDown":
+        nextIndex = currentIndex < 0 ? 0 : (currentIndex + 1) % items.length;
+        break;
+      case "ArrowUp":
+        nextIndex = currentIndex < 0 ? items.length - 1 : (currentIndex - 1 + items.length) % items.length;
+        break;
+      case "Home":
+        nextIndex = 0;
+        break;
+      case "End":
+        nextIndex = items.length - 1;
+        break;
+      default:
+        return;
+    }
+    event.preventDefault();
+    items.forEach((item, i) => item.setAttribute("tabindex", i === nextIndex ? "0" : "-1"));
+    items[nextIndex].focus();
   };
 
   toggle = () => {
     this.show = !this.show;
     this.contentTarget.classList.toggle("hidden", !this.show);
+    this.buttonTarget.setAttribute("aria-expanded", this.show.toString());
     if (this.show) {
       this.update();
-      this.focusFirstElement();
+      this.#focusFirstMenuItem();
     }
   };
 
   close() {
     this.show = false;
     this.contentTarget.classList.add("hidden");
+    this.buttonTarget.setAttribute("aria-expanded", "false");
   }
 
-  focusFirstElement() {
-    const focusableElements =
-      'button, [href], input, select, textarea, [tabindex]:not([tabindex="-1"])';
-    const firstFocusableElement =
-      this.contentTarget.querySelectorAll(focusableElements)[0];
-    if (firstFocusableElement) {
-      firstFocusableElement.focus({ preventScroll: true });
-    }
+  #menuItems() {
+    return Array.from(this.contentTarget.querySelectorAll('[role="menuitem"]'));
+  }
+
+  #focusFirstMenuItem() {
+    const items = this.#menuItems();
+    if (items.length === 0) return;
+    items.forEach((item, i) => item.setAttribute("tabindex", i === 0 ? "0" : "-1"));
+    items[0].focus({ preventScroll: true });
   }
 
   startAutoUpdate() {
diff --git a/app/components/DS/menu_item.html.erb b/app/components/DS/menu_item.html.erb
index cb71dc6d3..1e401ddf2 100644
--- a/app/components/DS/menu_item.html.erb
+++ b/app/components/DS/menu_item.html.erb
@@ -1,7 +1,9 @@
 <% if variant == :divider %>
-  <%= render "shared/ruler", classes: "my-1" %>
+  <div role="separator">
+    <%= render "shared/ruler", classes: "my-1" %>
+  </div>
 <% else %>
-  <div class="px-1">
+  <div class="px-1" role="none">
     <%= wrapper do %>
       <% if icon %>
         <%= helpers.icon(icon, color: destructive? ? :destructive : :default) %>
diff --git a/app/components/DS/menu_item.rb b/app/components/DS/menu_item.rb
index 5aa3959b3..7e55968c2 100644
--- a/app/components/DS/menu_item.rb
+++ b/app/components/DS/menu_item.rb
@@ -1,9 +1,14 @@
 class DS::MenuItem < DesignSystemComponent
   VARIANTS = %i[link button divider].freeze
 
-  attr_reader :variant, :text, :icon, :href, :method, :destructive, :confirm, :frame, :opts
+  attr_reader :variant, :text, :icon, :href, :method, :destructive, :confirm, :frame, :roving, :opts
 
-  def initialize(variant:, text: nil, icon: nil, href: nil, method: :post, destructive: false, confirm: nil, frame: nil, **opts)
+  # `roving: true` (default) emits `tabindex="-1"` and `role="menuitem"` — correct
+  # for `DS::Menu`, which provides arrow-key roving and announces `role="menu"`.
+  # `roving: false` omits both so items stay in the normal Tab order — required
+  # inside `DS::Popover`, which has no roving handler and is not a `role="menu"`
+  # container.
+  def initialize(variant:, text: nil, icon: nil, href: nil, method: :post, destructive: false, confirm: nil, frame: nil, roving: true, **opts)
     @variant = variant.to_sym
     @text = text
     @icon = icon
@@ -12,15 +17,22 @@ class DS::MenuItem < DesignSystemComponent
     @destructive = destructive
     @confirm = confirm
     @frame = frame
+    @roving = roving
     @opts = opts
     raise ArgumentError, "Invalid variant: #{@variant}" unless VARIANTS.include?(@variant)
   end
 
   def wrapper(&block)
+    # When roving is on, `menuitem_attrs` is part of the `DS::Menu` ARIA contract
+    # and must win — strip any caller overrides of `role`/`tabindex` from
+    # `merged_opts` before splatting, so a stray `role: :button` or
+    # `tabindex: 0` can't downgrade keyboard/AT semantics.
+    html_opts = roving ? merged_opts.except(:role, :tabindex) : merged_opts
+
     if variant == :button
-      button_to href, method: method, class: container_classes, **merged_opts, &block
+      button_to href, method: method, class: container_classes, **html_opts, **menuitem_attrs, &block
     elsif variant == :link
-      link_to href, class: container_classes, **merged_opts, &block
+      link_to href, class: container_classes, **html_opts, **menuitem_attrs, &block
     else
       nil
     end
@@ -38,6 +50,10 @@ class DS::MenuItem < DesignSystemComponent
   end
 
   private
+    def menuitem_attrs
+      roving ? { role: "menuitem", tabindex: "-1" } : {}
+    end
+
     def container_classes
       [
         "flex items-center gap-2 p-2 rounded-md w-full",
diff --git a/app/components/DS/pill.html.erb b/app/components/DS/pill.html.erb
new file mode 100644
index 000000000..2dc15e0ec
--- /dev/null
+++ b/app/components/DS/pill.html.erb
@@ -0,0 +1,20 @@
+<% if dot_only %>
+  <%# Compact dot — no label, no border, just the colored marker. Used on the
+      collapsed sidebar nav. Keeps tone semantics without taking up label
+      width. %>
+  <span role="img"
+        class="inline-block shrink-0 align-middle rounded-full"
+        style="width: <%= dot_size_px %>px; height: <%= dot_size_px %>px; background-color: <%= dot_color %>;"
+        aria-label="<%= title || t("ds.pill.aria_label", label: label) %>"
+        title="<%= title || t("ds.pill.aria_label", label: label) %>"></span>
+<% else %>
+  <span class="<%= container_classes %>" style="<%= container_styles %>" title="<%= title || label %>">
+    <% if icon %>
+      <%= helpers.icon(icon, size: "xs", color: "current") %>
+    <% elsif show_dot %>
+      <span class="inline-block shrink-0 rounded-full"
+            style="width: <%= dot_size_px %>px; height: <%= dot_size_px %>px; background-color: <%= dot_color %>;"></span>
+    <% end %>
+    <%= label %>
+  </span>
+<% end %>
diff --git a/app/components/DS/pill.rb b/app/components/DS/pill.rb
new file mode 100644
index 000000000..899c97345
--- /dev/null
+++ b/app/components/DS/pill.rb
@@ -0,0 +1,131 @@
+class DS::Pill < DesignSystemComponent
+  TONES = %i[violet indigo fuchsia amber green gray red].freeze
+  STYLES = %i[soft filled outline].freeze
+  SIZES = %i[sm md].freeze
+
+  # Semantic-name → visual-tone aliases. Lets callers say
+  # `tone: :success` instead of binding to the underlying palette name.
+  # The aliases live here (not on the caller) so the visual palette can
+  # be retuned without touching every callsite.
+  SEMANTIC_TONE_ALIASES = {
+    success:     :green,
+    warning:     :amber,
+    error:       :red,
+    destructive: :red,
+    info:        :indigo,
+    neutral:     :gray
+  }.freeze
+
+  attr_reader :label, :tone, :style, :size, :show_dot, :dot_only, :title, :icon, :marker
+
+  # Generic inline pill primitive. Two modes:
+  #
+  # - `marker: true` (default) — the original shape from #1829: uppercase
+  #   10/11px text, tracking-wide. Reads as a stage marker (Beta, Canary,
+  #   NEW, PRO, EXPERIMENTAL, …).
+  #
+  # - `marker: false` — normal case, snaps to the DS text scale
+  #   (`text-xs` / `text-sm`). Reads as a status / category badge.
+  #   Pair with semantic tones (`:success`, `:warning`, `:error`,
+  #   `:info`, `:neutral`) for status badges; pair with visual tones
+  #   (`:violet`, `:indigo`, etc.) for category tags.
+  #
+  # Other options:
+  #
+  # - `dot_only: true` renders only the colored dot (no label, no border).
+  #   Use on the collapsed sidebar nav, where there's no room for the label.
+  # - `icon:` overrides the dot with a Lucide icon (sized xs, current color).
+  #   Useful for status pills that benefit from a glyph (circle-check,
+  #   triangle-alert, pause, etc.) rather than the generic dot.
+  # - Tones accept both visual names (`:violet`, `:amber`, …) and
+  #   semantic aliases (`:success`, `:warning`, `:error`,
+  #   `:destructive`, `:neutral`, `:info`). Aliases resolve via
+  #   `SEMANTIC_TONE_ALIASES`.
+  # - Sure has full violet / indigo / fuchsia / amber / green / gray /
+  #   red ramps in the design system; this component picks named tokens
+  #   at render time. No raw hex.
+  def initialize(label: nil, tone: :violet, style: :soft, size: :sm, show_dot: true, dot_only: false, title: nil, icon: nil, marker: true)
+    resolved_tone = SEMANTIC_TONE_ALIASES.fetch(tone.to_sym, tone.to_sym)
+    @label = label || I18n.t("ds.pill.default_label", default: "Beta")
+    @tone = TONES.include?(resolved_tone) ? resolved_tone : :violet
+    @style = STYLES.include?(style.to_sym) ? style.to_sym : :soft
+    @size = SIZES.include?(size.to_sym) ? size.to_sym : :sm
+    @show_dot = show_dot
+    @dot_only = dot_only
+    @title = title
+    @icon = icon
+    @marker = marker
+  end
+
+  def palette
+    {
+      violet:  { bg: "var(--color-violet-50)",  bg_dark: "var(--color-violet-tint-10)",  text: "var(--color-violet-700)",  text_dark: "var(--color-violet-200)",  border: "var(--color-violet-200)",  dot: "var(--color-violet-500)",  fill: "var(--color-violet-500)" },
+      indigo:  { bg: "var(--color-indigo-50)",  bg_dark: "var(--color-indigo-tint-10)",  text: "var(--color-indigo-700)",  text_dark: "var(--color-indigo-200)",  border: "var(--color-indigo-200)",  dot: "var(--color-indigo-500)",  fill: "var(--color-indigo-500)" },
+      fuchsia: { bg: "var(--color-fuchsia-50)", bg_dark: "var(--color-fuchsia-tint-10)", text: "var(--color-fuchsia-700)", text_dark: "var(--color-fuchsia-200)", border: "var(--color-fuchsia-200)", dot: "var(--color-fuchsia-500)", fill: "var(--color-fuchsia-500)" },
+      amber:   { bg: "var(--color-yellow-50)",  bg_dark: "var(--color-yellow-tint-10)",  text: "var(--color-yellow-700)",  text_dark: "var(--color-yellow-200)",  border: "var(--color-yellow-200)",  dot: "var(--color-yellow-500)",  fill: "var(--color-yellow-500)" },
+      green:   { bg: "var(--color-green-50)",   bg_dark: "var(--color-green-tint-10)",   text: "var(--color-green-700)",   text_dark: "var(--color-green-200)",   border: "var(--color-green-200)",   dot: "var(--color-green-500)",   fill: "var(--color-green-500)" },
+      gray:    { bg: "var(--color-gray-100)",   bg_dark: "var(--color-gray-tint-10)",    text: "var(--color-gray-700)",    text_dark: "var(--color-gray-200)",    border: "var(--color-gray-200)",    dot: "var(--color-gray-500)",    fill: "var(--color-gray-500)" },
+      red:     { bg: "var(--color-red-50)",     bg_dark: "var(--color-red-tint-10)",     text: "var(--color-red-700)",     text_dark: "var(--color-red-200)",     border: "var(--color-red-200)",     dot: "var(--color-red-500)",     fill: "var(--color-red-500)" }
+    }[tone]
+  end
+
+  def dot_size_px
+    size == :md ? 6 : 5
+  end
+
+  def container_styles
+    p = palette
+    case style
+    when :filled
+      <<~CSS.strip.gsub(/\s+/, " ")
+        background-color: #{p[:fill]};
+        color: var(--color-white);
+        border-color: transparent;
+      CSS
+    when :outline
+      <<~CSS.strip.gsub(/\s+/, " ")
+        background-color: transparent;
+        color: light-dark(#{p[:text]}, #{p[:text_dark]});
+        border-color: light-dark(#{p[:border]}, color-mix(in oklab, #{p[:dot]} 40%, transparent));
+      CSS
+    else # :soft
+      <<~CSS.strip.gsub(/\s+/, " ")
+        background-color: light-dark(#{p[:bg]}, #{p[:bg_dark]});
+        color: light-dark(#{p[:text]}, #{p[:text_dark]});
+        border-color: light-dark(#{p[:border]}, color-mix(in oklab, #{p[:dot]} 20%, transparent));
+      CSS
+    end
+  end
+
+  def dot_color
+    style == :filled ? "rgba(255,255,255,0.85)" : palette[:dot]
+  end
+
+  def container_classes
+    base = [
+      "inline-flex items-center align-middle font-medium whitespace-nowrap shrink-0",
+      "border leading-none"
+    ]
+
+    if marker
+      # Marker mode (Beta / Canary / NEW): rounded-md (slight chip
+      # shape), uppercase, sub-12px text, wider tracking.
+      # text-[10/11px] stays as arbitrary values — the pill is
+      # intentionally sub-12px (Sure's smallest scale token is text-xs
+      # / 12px) so it reads as a marker, not a label. Padding / gap /
+      # tracking snap to Tailwind's scale to satisfy the design-system
+      # "no arbitrary values" rule.
+      base << "rounded-md uppercase"
+      base << (size == :md ? "px-2 py-0.5 text-[11px] tracking-wide gap-1" : "px-1.5 py-0.5 text-[10px] tracking-wider gap-1")
+    else
+      # Badge mode (Pending / Active / Past due / category tag):
+      # rounded-full pill shape (matches the existing convention used
+      # by `settings/providers/_status_pill`, `_maturity_badge`, and
+      # the inline transaction badges). Normal case, snaps to the
+      # design-system text scale (`text-xs` / `text-sm`).
+      base << "rounded-full"
+      base << (size == :md ? "px-2 py-0.5 text-sm gap-1.5" : "px-1.5 py-0.5 text-xs gap-1")
+    end
+    class_names(*base)
+  end
+end
diff --git a/app/components/DS/popover.html.erb b/app/components/DS/popover.html.erb
new file mode 100644
index 000000000..2b7e45d15
--- /dev/null
+++ b/app/components/DS/popover.html.erb
@@ -0,0 +1,32 @@
+<%= tag.div data: { controller: "DS--popover", DS__popover_placement_value: placement, DS__popover_offset_value: offset, DS__popover_mobile_fullwidth_value: mobile_fullwidth, testid: testid } do %>
+  <% if variant == :icon %>
+    <%= render DS::Button.new(variant: "icon", icon: icon, aria_label: trigger_aria_label, aria: { haspopup: "dialog", expanded: "false", controls: panel_id }, data: { DS__popover_target: "button" }) %>
+  <% elsif variant == :button %>
+    <%= button %>
+  <% elsif variant == :avatar %>
+    <%# Avatar trigger needs an explicit accessible name — the inner
+        avatar image is decorative. Caller must pass `aria_label:` or
+        the fallback `ds.popover.avatar_default_label` is used. %>
+    <button type="button"
+            data-DS--popover-target="button"
+            class="inline-flex items-center justify-center w-11 h-11 cursor-pointer rounded-full focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-gray-900 theme-dark:focus-visible:outline-white"
+            aria-label="<%= trigger_aria_label %>"
+            aria-haspopup="dialog"
+            aria-expanded="false"
+            aria-controls="<%= panel_id %>">
+      <div class="w-9 h-9">
+        <%= render "settings/user_avatar", avatar_url: avatar_url, initials: initials %>
+      </div>
+    </button>
+  <% end %>
+
+  <div id="<%= panel_id %>" data-DS--popover-target="content" class="px-2 lg:px-0 max-w-full hidden z-50">
+    <%= tag.div class: "mx-auto min-w-[200px] shadow-border-xs bg-container rounded-lg", style: ("max-width: #{max_width}" if max_width) do %>
+      <%= header %>
+
+      <%= tag.div class: class_names("py-1" => !no_padding) do %>
+        <%= custom_content %>
+      <% end %>
+    <% end %>
+  </div>
+<% end %>
diff --git a/app/components/DS/popover.rb b/app/components/DS/popover.rb
new file mode 100644
index 000000000..8361e9519
--- /dev/null
+++ b/app/components/DS/popover.rb
@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+# `DS::Popover` is a positioned panel for **mixed, non-action-list** content:
+# user-account menus, picker forms, filter forms, embedded controls. The
+# panel hosts arbitrary markup and **does not** announce as a `role="menu"`
+# — that role restricts AT users to menuitem-only navigation, which breaks
+# any panel containing form inputs, headings, or generic groupings.
+#
+# Use `DS::Menu` instead when the panel is a flat list of clickable actions.
+class DS::Popover < DesignSystemComponent
+  attr_reader :variant, :avatar_url, :initials, :placement, :offset, :icon, :no_padding, :testid, :mobile_fullwidth, :max_width, :panel_id
+
+  renders_one :button, ->(**button_options, &block) do
+    options_with_target = button_options.deep_dup
+    options_with_target[:data] = (options_with_target[:data] || {}).merge(DS__popover_target: "button")
+    options_with_target[:aria] = {
+      haspopup: "dialog",
+      expanded: "false",
+      controls: panel_id
+    }.merge(options_with_target[:aria] || {})
+
+    if block
+      options_with_target[:type] ||= "button"
+      content_tag(:button, **options_with_target, &block)
+    else
+      DS::Button.new(**options_with_target)
+    end
+  end
+
+  renders_one :header, ->(&block) do
+    content_tag(:div, class: "border-b border-tertiary", &block)
+  end
+
+  renders_one :custom_content
+
+  VARIANTS = %i[icon button avatar].freeze
+
+  def initialize(variant: "icon", avatar_url: nil, initials: nil, placement: "bottom-end", offset: 12, icon: "more-horizontal", no_padding: false, testid: nil, mobile_fullwidth: true, max_width: nil, aria_label: nil)
+    @variant = variant.to_sym
+    @avatar_url = avatar_url
+    @initials = initials
+    @placement = placement
+    @offset = offset
+    @icon = icon
+    @no_padding = no_padding
+    @testid = testid
+    @mobile_fullwidth = mobile_fullwidth
+    @max_width = max_width
+    @aria_label = aria_label
+    @panel_id = "popover-#{SecureRandom.hex(4)}"
+
+    raise ArgumentError, "Invalid variant: #{@variant}" unless VARIANTS.include?(@variant)
+  end
+
+  # Accessible name for the trigger button. The `:avatar` variant has no
+  # visible text, so the caller MUST pass `aria_label:`. `:icon` and
+  # `:button` variants fall back to DS::Button's icon-derived label and
+  # the slot's own text respectively.
+  def trigger_aria_label
+    @aria_label || (variant == :avatar ? I18n.t("ds.popover.avatar_default_label", default: "Open menu") : nil)
+  end
+end
diff --git a/app/components/DS/popover_controller.js b/app/components/DS/popover_controller.js
new file mode 100644
index 000000000..2040a04e2
--- /dev/null
+++ b/app/components/DS/popover_controller.js
@@ -0,0 +1,140 @@
+import {
+  autoUpdate,
+  computePosition,
+  flip,
+  offset,
+  shift,
+} from "@floating-ui/dom";
+import { Controller } from "@hotwired/stimulus";
+
+/**
+ * Positioned panel for mixed content (forms, pickers, account menus).
+ * Mirrors DS--menu's positioning + open/close lifecycle but skips the
+ * `role="menu"` / arrow-key navigation that's specific to action lists.
+ * Wiring `aria-expanded` on the trigger so AT users hear "expanded" /
+ * "collapsed" as the panel opens / closes.
+ */
+export default class extends Controller {
+  static targets = ["button", "content"];
+
+  static values = {
+    show: Boolean,
+    placement: { type: String, default: "bottom-end" },
+    offset: { type: Number, default: 6 },
+    mobileFullwidth: { type: Boolean, default: true },
+  };
+
+  connect() {
+    this.show = this.showValue;
+    this.boundUpdate = this.update.bind(this);
+    this.addEventListeners();
+    this.startAutoUpdate();
+  }
+
+  disconnect() {
+    this.removeEventListeners();
+    this.stopAutoUpdate();
+    this.close();
+  }
+
+  addEventListeners() {
+    this.buttonTarget.addEventListener("click", this.toggle);
+    this.element.addEventListener("keydown", this.handleKeydown);
+    document.addEventListener("click", this.handleOutsideClick);
+    document.addEventListener("turbo:load", this.handleTurboLoad);
+  }
+
+  removeEventListeners() {
+    this.buttonTarget.removeEventListener("click", this.toggle);
+    this.element.removeEventListener("keydown", this.handleKeydown);
+    document.removeEventListener("click", this.handleOutsideClick);
+    document.removeEventListener("turbo:load", this.handleTurboLoad);
+  }
+
+  handleTurboLoad = () => {
+    if (!this.show) this.close();
+  };
+
+  handleOutsideClick = (event) => {
+    if (this.show && !this.element.contains(event.target)) this.close();
+  };
+
+  handleKeydown = (event) => {
+    if (event.key === "Escape") {
+      this.close();
+      this.buttonTarget.focus();
+    }
+  };
+
+  toggle = () => {
+    this.show = !this.show;
+    this.contentTarget.classList.toggle("hidden", !this.show);
+    this.buttonTarget.setAttribute("aria-expanded", this.show.toString());
+    if (this.show) {
+      this.update();
+      this.focusFirstElement();
+    }
+  };
+
+  close() {
+    this.show = false;
+    this.contentTarget.classList.add("hidden");
+    this.buttonTarget.setAttribute("aria-expanded", "false");
+  }
+
+  focusFirstElement() {
+    const focusableElements =
+      'button, [href], input, select, textarea, [tabindex]:not([tabindex="-1"])';
+    const firstFocusableElement =
+      this.contentTarget.querySelectorAll(focusableElements)[0];
+    if (firstFocusableElement) {
+      firstFocusableElement.focus({ preventScroll: true });
+    }
+  }
+
+  startAutoUpdate() {
+    if (!this._cleanup) {
+      this._cleanup = autoUpdate(
+        this.buttonTarget,
+        this.contentTarget,
+        this.boundUpdate,
+      );
+    }
+  }
+
+  stopAutoUpdate() {
+    if (this._cleanup) {
+      this._cleanup();
+      this._cleanup = null;
+    }
+  }
+
+  update() {
+    if (!this.buttonTarget || !this.contentTarget) return;
+
+    const isSmallScreen = !window.matchMedia("(min-width: 768px)").matches;
+    const useMobileFullwidth = isSmallScreen && this.mobileFullwidthValue;
+
+    computePosition(this.buttonTarget, this.contentTarget, {
+      placement: useMobileFullwidth ? "bottom" : this.placementValue,
+      middleware: [offset(this.offsetValue), flip({ padding: 5 }), shift({ padding: 5 })],
+      strategy: "fixed",
+    }).then(({ x, y }) => {
+      if (useMobileFullwidth) {
+        Object.assign(this.contentTarget.style, {
+          position: "fixed",
+          left: "0px",
+          width: "100vw",
+          top: `${y}px`,
+        });
+      } else {
+        Object.assign(this.contentTarget.style, {
+          position: "fixed",
+          left: `${x}px`,
+          top: `${y}px`,
+          width: "",
+        });
+      }
+    });
+  }
+}
diff --git a/app/components/DS/search_input.html.erb b/app/components/DS/search_input.html.erb
new file mode 100644
index 000000000..e79fd6715
--- /dev/null
+++ b/app/components/DS/search_input.html.erb
@@ -0,0 +1,17 @@
+<%= tag.div class: container_classes do %>
+  <%= tag.input type: "search",
+                name: name,
+                value: value,
+                placeholder: placeholder,
+                "aria-label": aria_label,
+                autocomplete: "off",
+                class: input_classes,
+                **opts %>
+  <% if variant == :embedded %>
+    <%= helpers.icon("search", class: "absolute inset-0 ml-2 transform top-1/2 -translate-y-1/2") %>
+  <% else %>
+    <div class="absolute inset-y-0 left-0 flex items-center pl-3 pointer-events-none">
+      <%= helpers.icon("search", class: "text-secondary") %>
+    </div>
+  <% end %>
+<% end %>
diff --git a/app/components/DS/search_input.rb b/app/components/DS/search_input.rb
new file mode 100644
index 000000000..51c3dc9ca
--- /dev/null
+++ b/app/components/DS/search_input.rb
@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+# `DS::SearchInput` is the search-field primitive.
+#
+# Two variants:
+#
+# - `:standalone` (default) — top-of-list filter inputs (Preferences
+#   currency search, Settings/Bank Sync provider filter). Bordered
+#   bg-container surface, icon-on-left, full token-backed focus ring.
+#
+# - `:embedded` — search-inside-a-panel (DS::Select internal search,
+#   splits category filter, any future DS::Popover that hosts a filter).
+#   No border / no own focus ring — the parent panel provides the
+#   chrome, so adding ring + outline here would compete with the
+#   parent's focus-within state.
+#
+# For `form.search_field :foo` inside a `styled_form_with` block,
+# keep using the form helper — it routes through `StyledFormBuilder`'s
+# form-field CSS, which is a different visual contract.
+class DS::SearchInput < DesignSystemComponent
+  VARIANTS = %i[standalone embedded].freeze
+
+  attr_reader :variant, :name, :placeholder, :value, :aria_label, :extra_classes, :opts
+
+  def initialize(variant: :standalone, name: nil, placeholder: nil, value: nil, aria_label: nil, class: nil, **opts)
+    @variant = variant.to_sym
+    @name = name
+    @placeholder = placeholder
+    @value = value
+    @aria_label = aria_label || placeholder
+    @extra_classes = binding.local_variable_get(:class)
+    @opts = opts
+
+    raise ArgumentError, "Invalid variant: #{@variant}. Must be one of #{VARIANTS.inspect}" unless VARIANTS.include?(@variant)
+  end
+
+  def container_classes
+    class_names("relative", extra_classes)
+  end
+
+  def input_classes
+    # `text-base sm:text-sm` — keep the base font at 16px so iOS Safari
+    # does not zoom the viewport when the input is focused. Shrink to
+    # 14px from `sm:` upward. The previous unconditional `text-sm`
+    # triggered the mobile zoom regression.
+    case variant
+    when :embedded
+      # No own focus ring — the parent panel handles focus chrome via
+      # `focus-within`. `focus:outline-hidden focus:ring-0` neutralizes
+      # the browser default so it doesn't compete with the panel's
+      # state.
+      "bg-container text-primary text-base sm:text-sm placeholder:text-secondary font-normal " \
+        "h-10 pl-10 w-full border-none rounded-lg " \
+        "focus:outline-hidden focus:ring-0"
+    else
+      # `focus-visible:outline-*` matches the focus-ring pattern from
+      # DS::Button (base.css) so every interactive surface in the design
+      # system uses the same ring token. Replaces the broken
+      # `focus:ring-gray-500` from the inline callsites — that utility
+      # had no backing token and rendered invisibly on the bordered
+      # bg-container surface.
+      "block w-full border border-secondary rounded-md py-2.5 pl-10 pr-3 bg-container text-base sm:text-sm " \
+        "focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-gray-900 " \
+        "theme-dark:focus-visible:outline-white"
+    end
+  end
+
+  def icon_classes
+    variant == :embedded ? "absolute inset-0 ml-2 transform top-1/2 -translate-y-1/2" : "text-secondary"
+  end
+
+  def icon_wrapper_classes
+    # Standalone variant wraps the icon in a positioned div; embedded
+    # places the icon as an absolutely-positioned sibling so the parent
+    # panel can stay in control of vertical alignment.
+    variant == :embedded ? nil : "absolute inset-0 ml-2 top-1/2 -translate-y-1/2 pointer-events-none"
+  end
+end
diff --git a/app/components/DS/select.html.erb b/app/components/DS/select.html.erb
index 170d3ee26..1ac9b027f 100644
--- a/app/components/DS/select.html.erb
+++ b/app/components/DS/select.html.erb
@@ -1,36 +1,47 @@
 <%# locals: form:, method:, collection:, options: {} %>
 
-<div class="relative" data-controller="select <%= "list-filter" if searchable %> form-dropdown" data-action="dropdown:select->form-dropdown#onSelect">
+<div class="relative" data-controller="select <%= "list-filter" if searchable %> form-dropdown" data-select-menu-placement-value="<%= menu_placement %>" data-action="dropdown:select->form-dropdown#onSelect">
   <div class="form-field <%= options[:container_class] %>">
     <div class="form-field__body">
-        <%= form.label method, options[:label], class: "form-field__label" if options[:label].present? %>
+        <%= form.label method, options[:label], class: "form-field__label", id: "#{method}_label" if options[:label].present? %>
         <%= form.hidden_field method,
             value: @selected_value,
             data: {
               "form-dropdown-target": "input",
-              "auto-submit-target": "auto"
+              "auto-submit-target": "auto",
+              **(options.dig(:html_options, :data) || {})
             } %>
+        <%# `aria-expanded` reflects MENU open/closed state — managed by the
+            select controller's openMenu/close. Init as "false"; previously
+            this incorrectly mirrored whether a value was selected.
+
+            `aria-labelledby` points at BOTH the visible label and the
+            trigger button itself so AT users hear "<label> <selected
+            value>" — referencing only the label would override the
+            button's text node and suppress the current value. %>
         <button type="button"
+                id="<%= method %>_trigger"
                 class="form-field__input w-full"
                 data-select-target="button"
                 data-action="click->select#toggle"
                 aria-haspopup="listbox"
-                aria-expanded="<%= @selected_value.present? ? "true" : "false" %>"
-                aria-labelledby="<%= "#{method}_label" %>">
+                aria-expanded="false"
+                <%= "aria-labelledby=\"#{method}_label #{method}_trigger\"".html_safe if options[:label].present? %>>
           <%= selected_item&.dig(:label) || @placeholder %>
         </button>
     </div>
   </div>
   <div class="absolute z-50 p-1.5 w-full min-w-32 rounded-lg shadow-lg shadow-border-xs bg-container mt-1.5 transition duration-150 ease-out -translate-y-1 opacity-0 hidden" data-select-target="menu">
     <% if searchable %>
-      <div class="relative flex items-center bg-container border border-secondary rounded-lg mb-1">
-        <input type="search"
-               placeholder="<%= t("helpers.select.search_placeholder") %>"
-               autocomplete="off"
-               class="bg-container text-sm placeholder:text-secondary font-normal h-10 pl-10 w-full border-none rounded-lg focus:outline-hidden focus:ring-0"
-               data-list-filter-target="input"
-               data-action="list-filter#filter">
-        <%= helpers.icon("search", class: "absolute inset-0 ml-2 transform top-1/2 -translate-y-1/2") %>
+      <div class="flex items-center bg-container border border-secondary rounded-lg mb-1 focus-within:ring-4 focus-within:ring-alpha-black-200 theme-dark:focus-within:ring-alpha-white-300 transition-shadow">
+        <%= render DS::SearchInput.new(
+          variant: :embedded,
+          placeholder: t("helpers.select.search_placeholder"),
+          data: {
+            list_filter_target: "input",
+            action: "input->list-filter#filter input->select#syncTabindex"
+          }
+        ) %>
       </div>
     <% end %>
     <div data-list-filter-target="list" data-select-target="content" class="flex flex-col gap-0.5 max-h-64 overflow-auto"
@@ -39,10 +50,14 @@
         <% is_selected = item[:value] == selected_value %>
         <% obj = item[:object] %>
 
-        <div class="filterable-item text-sm cursor-pointer flex items-center gap-2 px-3 py-2 rounded-lg hover:bg-container-inset-hover <%= "bg-container-inset" if is_selected %>"
+        <%# Roving tabindex: selected option is in tab order (`0`); others
+            are reachable only via ArrowUp/Down (`-1`). WAI-ARIA APG
+            listbox keyboard pattern. %>
+        <div class="filterable-item text-primary text-sm cursor-pointer flex items-center gap-2 px-3 py-2 rounded-lg hover:bg-container-inset-hover <%= "bg-container-inset" if is_selected %>"
               role="option"
-              tabindex="0"
+              tabindex="<%= is_selected ? "0" : "-1" %>"
               aria-selected="<%= is_selected %>"
+              data-select-target="option"
               data-action="click->select#select"
               data-value="<%= item[:value] %>"
               data-filter-name="<%= item[:label] %>">
diff --git a/app/components/DS/select.rb b/app/components/DS/select.rb
index abbd48ada..b19166bfb 100644
--- a/app/components/DS/select.rb
+++ b/app/components/DS/select.rb
@@ -1,18 +1,20 @@
 module DS
   class Select < ViewComponent::Base
-    attr_reader :form, :method, :items, :selected_value, :placeholder, :variant, :searchable, :options
+    attr_reader :form, :method, :items, :selected_value, :placeholder, :variant, :searchable, :menu_placement, :options
 
     VARIANTS = %i[simple logo badge].freeze
+    MENU_PLACEMENTS = %w[auto down up].freeze
     HEX_COLOR_REGEX = /\A#[0-9a-fA-F]{3}(?:[0-9a-fA-F]{3})?\z/
     RGB_COLOR_REGEX = /\Argb\(\s*\d{1,3}\s*,\s*\d{1,3}\s*,\s*\d{1,3}\s*\)\z/
     DEFAULT_COLOR = "#737373"
 
-    def initialize(form:, method:, items:, selected: nil, placeholder: I18n.t("helpers.select.default_label"), variant: :simple, include_blank: nil, searchable: false, **options)
+    def initialize(form:, method:, items:, selected: nil, placeholder: I18n.t("helpers.select.default_label"), variant: :simple, include_blank: nil, searchable: false, menu_placement: :auto, **options)
       @form = form
       @method = method
       @placeholder = placeholder
       @variant = variant
       @searchable = searchable
+      @menu_placement = normalize_menu_placement(menu_placement)
       @options = options
 
       normalized_items = normalize_items(items)
@@ -61,6 +63,11 @@ module DS
 
     private
 
+      def normalize_menu_placement(value)
+        normalized = value.to_s.downcase
+        MENU_PLACEMENTS.include?(normalized) ? normalized : "auto"
+      end
+
       def normalize_items(collection)
         collection.map do |item|
           case item
diff --git a/app/components/DS/tabs.rb b/app/components/DS/tabs.rb
index a2c0ff95e..5a0f735be 100644
--- a/app/components/DS/tabs.rb
+++ b/app/components/DS/tabs.rb
@@ -5,6 +5,7 @@ class DS::Tabs < DesignSystemComponent
       active_btn_classes: active_btn_classes,
       inactive_btn_classes: inactive_btn_classes,
       btn_classes: base_btn_classes,
+      dom_prefix: dom_prefix,
       classes: unstyled? ? classes : class_names(nav_container_classes, classes)
     )
   end
@@ -13,16 +14,35 @@ class DS::Tabs < DesignSystemComponent
     content_tag(
       :div,
       class: ("hidden" unless tab_id == active_tab),
+      role: "tabpanel",
+      id: panel_dom_id(tab_id),
+      "aria-labelledby": tab_dom_id(tab_id),
+      tabindex: "0",
       data: { id: tab_id, DS__tabs_target: "panel" },
       &block
     )
   end
 
+  # Scope tab/panel DOM ids to this component instance so multiple
+  # `DS::Tabs` widgets on the same page (which often reuse generic
+  # tab ids like "all" or "overview") don't collide and break the
+  # `aria-controls` / `aria-labelledby` associations.
+  def tab_dom_id(tab_id)
+    "#{dom_prefix}-tab-#{tab_id}"
+  end
+
+  def panel_dom_id(tab_id)
+    "#{dom_prefix}-panel-#{tab_id}"
+  end
+
   VARIANTS = {
     default: {
-      active_btn_classes: "bg-white theme-dark:bg-gray-700 text-primary shadow-sm",
+      # `tab-item-active` is a Sure token utility (white light / gray-700 dark).
+      # Swapping out the raw `bg-white theme-dark:bg-gray-700` removes the
+      # last raw-palette reference in DS::Tabs.
+      active_btn_classes: "tab-item-active text-primary shadow-sm",
       inactive_btn_classes: "text-secondary hover:bg-surface-inset-hover",
-      base_btn_classes: "w-full inline-flex justify-center items-center text-sm font-medium px-2 py-1 rounded-md transition-colors duration-200",
+      base_btn_classes: "w-full inline-flex justify-center items-center text-sm font-medium px-2 py-1 rounded-md motion-safe:transition-colors motion-safe:duration-200",
       nav_container_classes: "flex bg-surface-inset p-1 rounded-lg mb-4"
     }
   }
@@ -48,6 +68,10 @@ class DS::Tabs < DesignSystemComponent
   end
 
   private
+    def dom_prefix
+      @dom_prefix ||= "tabs-#{object_id}"
+    end
+
     def unstyled?
       variant == :unstyled
     end
diff --git a/app/components/DS/tabs/nav.rb b/app/components/DS/tabs/nav.rb
index 8e795588d..eb77672fa 100644
--- a/app/components/DS/tabs/nav.rb
+++ b/app/components/DS/tabs/nav.rb
@@ -1,6 +1,16 @@
 class DS::Tabs::Nav < DesignSystemComponent
   erb_template <<~ERB
-    <%= tag.nav class: classes do %>
+    <%# Neutral `<div>` host for `role="tablist"`. Per ARIA-in-HTML,
+        `<nav>` has a fixed landmark role and may not be repurposed as
+        a tablist — some AT implementations ignore the override and
+        the child `role="tab"` elements end up parentless. The tab
+        pattern is its own widget per WAI-ARIA APG; keyboard nav
+        (ArrowLeft/Right, Home, End, Enter/Space) is driven by the
+        Stimulus controller with the manual-activation pattern
+        (focus moves first, activate on Enter/Space). %>
+    <%= tag.div class: classes,
+                role: "tablist",
+                "aria-orientation": "horizontal" do %>
       <% btns.each do |btn| %>
         <%= btn %>
       <% end %>
@@ -8,19 +18,25 @@ class DS::Tabs::Nav < DesignSystemComponent
   ERB
 
   renders_many :btns, ->(id:, label:, classes: nil, &block) do
+    is_active = id == active_tab
     content_tag(
-      :button, label, id: id,
+      :button, label, id: "#{dom_prefix}-tab-#{id}",
       type: "button",
-      class: class_names(btn_classes, id == active_tab ? active_btn_classes : inactive_btn_classes, classes),
-      data: { id: id, action: "DS--tabs#show", DS__tabs_target: "navBtn" },
+      class: class_names(btn_classes, is_active ? active_btn_classes : inactive_btn_classes, classes),
+      role: "tab",
+      "aria-selected": is_active.to_s,
+      "aria-controls": "#{dom_prefix}-panel-#{id}",
+      tabindex: is_active ? "0" : "-1",
+      data: { id: id, action: "click->DS--tabs#show keydown->DS--tabs#handleKeydown", DS__tabs_target: "navBtn" },
       &block
     )
   end
 
-  attr_reader :active_tab, :classes, :active_btn_classes, :inactive_btn_classes, :btn_classes
+  attr_reader :active_tab, :classes, :active_btn_classes, :inactive_btn_classes, :btn_classes, :dom_prefix
 
-  def initialize(active_tab:, classes: nil, active_btn_classes: nil, inactive_btn_classes: nil, btn_classes: nil)
+  def initialize(active_tab:, dom_prefix:, classes: nil, active_btn_classes: nil, inactive_btn_classes: nil, btn_classes: nil)
     @active_tab = active_tab
+    @dom_prefix = dom_prefix
     @classes = classes
     @active_btn_classes = active_btn_classes
     @inactive_btn_classes = inactive_btn_classes
diff --git a/app/components/DS/tabs_controller.js b/app/components/DS/tabs_controller.js
index 259765aa7..5089ea63e 100644
--- a/app/components/DS/tabs_controller.js
+++ b/app/components/DS/tabs_controller.js
@@ -11,13 +11,19 @@ export default class extends Controller {
     const selectedTabId = btn.dataset.id;
 
     this.navBtnTargets.forEach((navBtn) => {
-      if (navBtn.dataset.id === selectedTabId) {
+      const isSelected = navBtn.dataset.id === selectedTabId;
+      if (isSelected) {
         navBtn.classList.add(...this.navBtnActiveClasses);
         navBtn.classList.remove(...this.navBtnInactiveClasses);
       } else {
         navBtn.classList.add(...this.navBtnInactiveClasses);
         navBtn.classList.remove(...this.navBtnActiveClasses);
       }
+      // Roving tabindex per WAI-ARIA APG: only the active tab is in
+      // the tab order. ArrowLeft/Right (see handleKeydown) moves focus
+      // across the tablist; Tab moves past the widget.
+      navBtn.setAttribute("aria-selected", isSelected.toString());
+      navBtn.setAttribute("tabindex", isSelected ? "0" : "-1");
     });
 
     this.panelTargets.forEach((panel) => {
@@ -38,7 +44,43 @@ export default class extends Controller {
     if (this.sessionKeyValue) {
       this.#updateSessionPreference(selectedTabId);
     }
-  } 
+  }
+
+  // WAI-ARIA APG "Tabs with Manual Activation" — arrow keys move
+  // focus, Enter/Space activates. Prevents accidental tab swap when
+  // tabbing through, which is important here because some tab
+  // contents trigger Turbo fetches.
+  handleKeydown(e) {
+    const navBtns = this.navBtnTargets;
+    const currentIndex = navBtns.indexOf(e.target);
+    if (currentIndex === -1) return;
+
+    let nextIndex = null;
+    switch (e.key) {
+      case "ArrowRight":
+        nextIndex = (currentIndex + 1) % navBtns.length;
+        break;
+      case "ArrowLeft":
+        nextIndex = (currentIndex - 1 + navBtns.length) % navBtns.length;
+        break;
+      case "Home":
+        nextIndex = 0;
+        break;
+      case "End":
+        nextIndex = navBtns.length - 1;
+        break;
+      case "Enter":
+      case " ":
+        e.preventDefault();
+        this.show(e);
+        return;
+      default:
+        return;
+    }
+
+    e.preventDefault();
+    navBtns[nextIndex].focus();
+  }
 
   #updateSessionPreference(selectedTabId) {
     fetch("/current_session", {
diff --git a/app/components/DS/toggle.html.erb b/app/components/DS/toggle.html.erb
index 6845686c4..327a995b4 100644
--- a/app/components/DS/toggle.html.erb
+++ b/app/components/DS/toggle.html.erb
@@ -1,5 +1,9 @@
 <div class="relative inline-block select-none">
+  <%# Paired hidden field carries the off-state value when the checkbox is unchecked. Do NOT add an external `hidden_field_tag` with the same `name` in the caller view — it causes ID/label collisions and duplicate params. %>
   <%= hidden_field_tag name, unchecked_value, id: nil %>
-  <%= check_box_tag name, checked_value, checked, class: "sr-only peer", disabled: disabled, id: id, **opts %>
+  <%# `role="switch"` upgrades the underlying checkbox so AT users hear
+      "switch, on" / "switch, off" instead of "checkbox, checked". The
+      visual already reads as a switch — semantics now match. %>
+  <%= check_box_tag name, checked_value, checked, class: "sr-only peer", disabled: disabled, id: id, role: "switch", **opts %>
   <%= label_tag name, "&nbsp;".html_safe, class: label_classes, for: id %>
 </div>
diff --git a/app/components/DS/toggle.rb b/app/components/DS/toggle.rb
index c384a2969..e45b69051 100644
--- a/app/components/DS/toggle.rb
+++ b/app/components/DS/toggle.rb
@@ -13,13 +13,25 @@ class DS::Toggle < DesignSystemComponent
 
   def label_classes
     class_names(
-       "block w-9 h-5 cursor-pointer",
-       "rounded-full bg-gray-100 theme-dark:bg-gray-700",
-       "transition-colors duration-300",
+       "relative block w-9 h-5 cursor-pointer",
+       # `bg-toggle-track` lifts the dark-mode off-track to gray-700 so the
+       # switch keeps WCAG 1.4.11 contrast against the surrounding
+       # bg-container (gray-900). `bg-surface-inset` resolves to gray-800
+       # in dark mode and dropped to ~1.5:1 against the container,
+       # making the toggle nearly invisible inside modals.
+       "rounded-full bg-toggle-track",
+       # `motion-safe:` gates the bg + thumb-translate transitions on
+       # `prefers-reduced-motion`; reduced-motion users get a snap.
+       "motion-safe:transition-colors motion-safe:duration-300",
        "after:content-[''] after:block after:bg-white after:absolute after:rounded-full",
        "after:top-0.5 after:left-0.5 after:w-4 after:h-4",
-       "after:transition-transform after:duration-300 after:ease-in-out",
-       "peer-checked:bg-green-600 peer-checked:after:translate-x-4",
+       "motion-safe:after:transition-transform motion-safe:after:duration-300 motion-safe:after:ease-in-out",
+       "peer-checked:bg-success peer-checked:after:translate-x-4",
+       # Focus ring driven from the sr-only input via `peer-focus-visible:`.
+       # Offset places the ring outside the track so it lands on the
+       # surrounding chrome regardless of theme.
+       "peer-focus-visible:ring-2 peer-focus-visible:ring-offset-2",
+       "peer-focus-visible:ring-alpha-black-300 theme-dark:peer-focus-visible:ring-alpha-white-300",
        "peer-disabled:opacity-70 peer-disabled:cursor-not-allowed"
     )
   end
diff --git a/app/components/DS/tooltip.html.erb b/app/components/DS/tooltip.html.erb
index 3bd7a1ba1..fe0c04366 100644
--- a/app/components/DS/tooltip.html.erb
+++ b/app/components/DS/tooltip.html.erb
@@ -1,8 +1,39 @@
 <span data-controller="DS--tooltip" data-DS--tooltip-placement-value="<%= placement %>" data-DS--tooltip-offset-value="<%= offset %>" data-DS--tooltip-cross-axis-value="<%= cross_axis %>" class="inline-flex">
-  <%= helpers.icon icon_name, size: size, color: color %>
+  <% if as == :button %>
+    <%# Wrap the trigger icon in a focusable `<button>` so AT users (and
+        keyboard-only users) can land on the tooltip anchor. The Lucide
+        icon itself carries `aria-hidden`, so the button's accessible
+        name comes from `aria-label`, and the tooltip text is exposed
+        via `aria-describedby`. %>
+    <button type="button"
+            class="inline-flex items-center cursor-default focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-alpha-black-300 theme-dark:focus-visible:ring-alpha-white-300 rounded"
+            aria-describedby="<%= tooltip_id %>"
+            aria-label="<%= t("ds.tooltip.trigger_label", default: "More info") %>">
+      <%= helpers.icon icon_name, size: size, color: color %>
+    </button>
+  <% else %>
+    <%# `as: :span` — used when the tooltip is rendered inside an
+        already-focusable interactive ancestor (e.g. `<summary>`),
+        where the HTML spec forbids nested interactive content.
+        Keyboard reveal is wired in the controller, which (in addition
+        to listening on the outer span for the standalone case) also
+        binds `focusin/focusout/keydown` on the closest `<summary>`
+        ancestor — because `focusin` only bubbles UP, a listener on
+        this descendant span would never fire when the ancestor
+        disclosure receives focus. %>
+    <span class="inline-flex items-center"
+          aria-describedby="<%= tooltip_id %>">
+      <%= helpers.icon icon_name, size: size, color: color %>
+    </span>
+  <% end %>
 
-  <div role="tooltip" data-DS--tooltip-target="tooltip" class="hidden absolute z-50 bg-gray-700 text-sm px-1.5 py-1 rounded-md">
-    <div class="fg-inverse font-normal max-w-[200px]">
+  <div role="tooltip"
+       id="<%= tooltip_id %>"
+       data-DS--tooltip-target="tooltip"
+       class="hidden absolute z-50 bg-inverse text-sm px-1.5 py-1 rounded-md">
+    <%# `max-w-[20rem]` scales with the root font-size so AT users with
+        a larger base font don't see the tooltip clipped. %>
+    <div class="text-inverse font-normal max-w-[20rem]">
       <%= tooltip_content %>
     </div>
   </div>
diff --git a/app/components/DS/tooltip.rb b/app/components/DS/tooltip.rb
index 7189c4f35..757f77bcf 100644
--- a/app/components/DS/tooltip.rb
+++ b/app/components/DS/tooltip.rb
@@ -1,7 +1,26 @@
 class DS::Tooltip < ApplicationComponent
-  attr_reader :placement, :offset, :cross_axis, :icon_name, :size, :color
+  AS_OPTIONS = %i[button span].freeze
+
+  attr_reader :placement, :offset, :cross_axis, :icon_name, :size, :color, :tooltip_id, :as
+
+  # NOTE: tooltip content must be non-interactive — no buttons, links,
+  # or form controls inside. Tooltips are exposed via `aria-describedby`,
+  # which announces the content as a description but does not expose
+  # interactive descendants to AT. Use a popover/menu primitive when
+  # the surface needs to host actions.
+  #
+  # `as:` controls the trigger element.
+  #   :button (default) — renders `<button type="button">`, focusable on
+  #     its own. Use for tooltips placed in standalone, non-interactive
+  #     surrounding markup.
+  #   :span — renders `<span>` with no `tabindex`. Use when the tooltip
+  #     sits inside an already-focusable interactive ancestor (most
+  #     commonly `<summary>`, where the HTML spec forbids nested
+  #     interactive content). The ancestor's focus still triggers the
+  #     tooltip because `focusin` bubbles up to the Stimulus controller.
+  def initialize(text: nil, placement: "top", offset: 10, cross_axis: 0, icon: "info", size: "sm", color: "default", as: :button)
+    raise ArgumentError, "as: must be one of #{AS_OPTIONS.inspect}" unless AS_OPTIONS.include?(as)
 
-  def initialize(text: nil, placement: "top", offset: 10, cross_axis: 0, icon: "info", size: "sm", color: "default")
     @text = text
     @placement = placement
     @offset = offset
@@ -9,6 +28,8 @@ class DS::Tooltip < ApplicationComponent
     @icon_name = icon
     @size = size
     @color = color
+    @as = as
+    @tooltip_id = "tooltip-#{SecureRandom.hex(4)}"
   end
 
   def tooltip_content
diff --git a/app/components/DS/tooltip_controller.js b/app/components/DS/tooltip_controller.js
index 8f198baed..5f0a4b396 100644
--- a/app/components/DS/tooltip_controller.js
+++ b/app/components/DS/tooltip_controller.js
@@ -29,11 +29,44 @@ export default class extends Controller {
   addEventListeners() {
     this.element.addEventListener("mouseenter", this.show);
     this.element.addEventListener("mouseleave", this.hide);
+    // Keyboard parity: keyboard users hit the trigger via Tab + focus,
+    // not hover. Without these the tooltip never appears for them.
+    this.element.addEventListener("focusin", this.show);
+    this.element.addEventListener("focusout", this.hide);
+    // Esc-to-dismiss matches the WAI-ARIA Authoring Practices for the
+    // tooltip pattern.
+    this.element.addEventListener("keydown", this.handleKeydown);
+
+    // `as: :span` renders a non-focusable trigger inside an
+    // already-focusable ancestor (typically `<summary>`). When the
+    // ancestor receives keyboard focus the `focusin` event fires on
+    // *it* and bubbles UP to the document — it never reaches a
+    // descendant span. Without a listener on the ancestor itself,
+    // the tooltip stays hidden for keyboard users on in-summary rows.
+    // Bind the same handlers on the closest `<summary>` (if any) so
+    // focusing the disclosure reveals the tooltip and Esc still
+    // dismisses it.
+    this.summaryAncestor = this.element.closest("summary");
+    if (this.summaryAncestor) {
+      this.summaryAncestor.addEventListener("focusin", this.show);
+      this.summaryAncestor.addEventListener("focusout", this.hide);
+      this.summaryAncestor.addEventListener("keydown", this.handleKeydown);
+    }
   }
 
   removeEventListeners() {
     this.element.removeEventListener("mouseenter", this.show);
     this.element.removeEventListener("mouseleave", this.hide);
+    this.element.removeEventListener("focusin", this.show);
+    this.element.removeEventListener("focusout", this.hide);
+    this.element.removeEventListener("keydown", this.handleKeydown);
+
+    if (this.summaryAncestor) {
+      this.summaryAncestor.removeEventListener("focusin", this.show);
+      this.summaryAncestor.removeEventListener("focusout", this.hide);
+      this.summaryAncestor.removeEventListener("keydown", this.handleKeydown);
+      this.summaryAncestor = null;
+    }
   }
 
   show = () => {
@@ -47,6 +80,12 @@ export default class extends Controller {
     this.stopAutoUpdate();
   };
 
+  handleKeydown = (event) => {
+    if (event.key === "Escape" && !this.tooltipTarget.classList.contains("hidden")) {
+      this.hide();
+    }
+  };
+
   startAutoUpdate() {
     if (!this._cleanup) {
       const reference = this.element.querySelector("[data-icon]");
diff --git a/app/components/UI/account/activity_date.html.erb b/app/components/UI/account/activity_date.html.erb
index a1a330588..e788bfa4b 100644
--- a/app/components/UI/account/activity_date.html.erb
+++ b/app/components/UI/account/activity_date.html.erb
@@ -20,8 +20,8 @@
 
         <div class="flex items-center gap-4">
           <div class="flex items-center gap-2">
-            <span class="font-medium"><%= end_balance_money.format %></span>
-            <%= render DS::Tooltip.new(text: "The end of day balance, after all transactions and adjustments", placement: "left", size: "sm") %>
+            <span class="font-medium privacy-sensitive"><%= end_balance_money.format %></span>
+            <%= render DS::Tooltip.new(text: t(".balance_tooltip"), placement: "left", size: "sm", as: :span) %>
           </div>
           <%= helpers.icon "chevron-down", class: "group-open:rotate-180" %>
         </div>
@@ -32,7 +32,7 @@
       <% if balance %>
         <%= render UI::Account::BalanceReconciliation.new(balance: balance, account: account) %>
       <% else %>
-        <p class="text-sm text-secondary">No balance data available for this date</p>
+        <p class="text-sm text-secondary"><%= t(".no_balance_data") %></p>
       <% end %>
     </div>
   </details>
diff --git a/app/components/UI/account/activity_feed.html.erb b/app/components/UI/account/activity_feed.html.erb
index 00adaf3fd..8639ab62a 100644
--- a/app/components/UI/account/activity_feed.html.erb
+++ b/app/components/UI/account/activity_feed.html.erb
@@ -54,7 +54,7 @@
               data: { controller: "auto-submit-form" } do |form| %>
         <div class="flex gap-2 mb-4">
           <div class="grow">
-            <div class="flex items-center px-3 py-2 gap-2 border border-secondary rounded-lg focus-within:ring-gray-100 focus-within:border-gray-900">
+            <div class="flex items-center px-3 py-2 gap-2 border border-secondary rounded-lg focus-within:border-primary">
               <%= helpers.icon("search") %>
 
               <%= hidden_field_tag :account_id, account.id %>
@@ -67,8 +67,8 @@
             </div>
           </div>
 
-          <%= render DS::Menu.new(variant: "button", no_padding: true) do |menu| %>
-            <% menu.with_button(
+          <%= render DS::Popover.new(variant: "button", no_padding: true) do |popover| %>
+            <% popover.with_button(
               id: "activity-status-filter-button",
               type: "button",
               text: t("accounts.show.activity.filter"),
@@ -76,7 +76,7 @@
               icon: "list-filter"
             ) %>
 
-            <% menu.with_custom_content do %>
+            <% popover.with_custom_content do %>
               <div class="p-3 space-y-3 min-w-[160px]">
                 <p class="text-xs font-medium text-secondary uppercase"><%= t("accounts.show.activity.status") %></p>
                 <div class="flex items-center gap-3">
diff --git a/app/components/UI/account/balance_reconciliation.rb b/app/components/UI/account/balance_reconciliation.rb
index 980fad60d..0839bd1e1 100644
--- a/app/components/UI/account/balance_reconciliation.rb
+++ b/app/components/UI/account/balance_reconciliation.rb
@@ -27,105 +27,108 @@ class UI::Account::BalanceReconciliation < ApplicationComponent
 
   private
 
+    def t_label(key)
+      I18n.t("UI.account.balance_reconciliation.labels.#{key}")
+    end
+
+    def t_tooltip(key)
+      I18n.t("UI.account.balance_reconciliation.tooltips.#{key}")
+    end
+
     def default_items
       items = [
-        { label: "Start balance", value: balance.start_balance_money, tooltip: "The account balance at the beginning of this day", style: :start },
-        { label: "Net cash flow", value: net_cash_flow, tooltip: "Net change in balance from all transactions during the day", style: :flow }
+        { label: t_label(:start_balance), value: balance.start_balance_money, tooltip: t_tooltip(:start_balance), style: :start },
+        { label: t_label(:net_cash_flow), value: net_cash_flow, tooltip: t_tooltip(:net_cash_flow), style: :flow }
       ]
 
       if has_adjustments?
-        items << { label: "End balance", value: end_balance_before_adjustments, tooltip: "The calculated balance after all transactions", style: :subtotal }
-        items << { label: "Adjustments", value: total_adjustments, tooltip: "Manual reconciliations or other adjustments", style: :adjustment }
+        items << { label: t_label(:end_balance), value: end_balance_before_adjustments, tooltip: t_tooltip(:end_balance), style: :subtotal }
+        items << { label: t_label(:adjustments), value: total_adjustments, tooltip: t_tooltip(:adjustments), style: :adjustment }
       end
 
-      items << { label: "Final balance", value: balance.end_balance_money, tooltip: "The final account balance for the day", style: :final }
+      items << { label: t_label(:final_balance), value: balance.end_balance_money, tooltip: t_tooltip(:final_balance), style: :final }
       items
     end
 
     def credit_card_items
       items = [
-        { label: "Start balance", value: balance.start_balance_money, tooltip: "The balance owed at the beginning of this day", style: :start },
-        { label: "Charges", value: balance.cash_outflows_money, tooltip: "New charges made during the day", style: :flow },
-        { label: "Payments", value: balance.cash_inflows_money * -1, tooltip: "Payments made to the card during the day", style: :flow }
+        { label: t_label(:start_balance), value: balance.start_balance_money, tooltip: t_tooltip(:start_balance_credit), style: :start },
+        { label: t_label(:charges), value: balance.cash_outflows_money, tooltip: t_tooltip(:charges), style: :flow },
+        { label: t_label(:payments), value: balance.cash_inflows_money * -1, tooltip: t_tooltip(:payments), style: :flow }
       ]
 
       if has_adjustments?
-        items << { label: "End balance", value: end_balance_before_adjustments, tooltip: "The calculated balance after all transactions", style: :subtotal }
-        items << { label: "Adjustments", value: total_adjustments, tooltip: "Manual reconciliations or other adjustments", style: :adjustment }
+        items << { label: t_label(:end_balance), value: end_balance_before_adjustments, tooltip: t_tooltip(:end_balance), style: :subtotal }
+        items << { label: t_label(:adjustments), value: total_adjustments, tooltip: t_tooltip(:adjustments), style: :adjustment }
       end
 
-      items << { label: "Final balance", value: balance.end_balance_money, tooltip: "The final balance owed for the day", style: :final }
+      items << { label: t_label(:final_balance), value: balance.end_balance_money, tooltip: t_tooltip(:final_balance_credit), style: :final }
       items
     end
 
     def investment_items
       items = [
-        { label: "Start balance", value: balance.start_balance_money, tooltip: "The total portfolio value at the beginning of this day", style: :start }
+        { label: t_label(:start_balance), value: balance.start_balance_money, tooltip: t_tooltip(:start_balance_investment), style: :start }
       ]
 
-      # Change in brokerage cash (includes deposits, withdrawals, and cash from trades)
-      items << { label: "Change in brokerage cash", value: net_cash_flow, tooltip: "Net change in cash from deposits, withdrawals, and trades", style: :flow }
-
-      # Change in holdings from trading activity
-      items << { label: "Change in holdings (buys/sells)", value: net_non_cash_flow, tooltip: "Impact on holdings from buying and selling securities", style: :flow }
-
-      # Market price changes
-      items << { label: "Change in holdings (market price activity)", value: balance.net_market_flows_money, tooltip: "Change in holdings value from market price movements", style: :flow }
+      items << { label: t_label(:change_in_brokerage_cash), value: net_cash_flow, tooltip: t_tooltip(:change_in_brokerage_cash), style: :flow }
+      items << { label: t_label(:change_in_holdings_trades), value: net_non_cash_flow, tooltip: t_tooltip(:change_in_holdings_trades), style: :flow }
+      items << { label: t_label(:change_in_holdings_market), value: balance.net_market_flows_money, tooltip: t_tooltip(:change_in_holdings_market), style: :flow }
 
       if has_adjustments?
-        items << { label: "End balance", value: end_balance_before_adjustments, tooltip: "The calculated balance after all activity", style: :subtotal }
-        items << { label: "Adjustments", value: total_adjustments, tooltip: "Manual reconciliations or other adjustments", style: :adjustment }
+        items << { label: t_label(:end_balance), value: end_balance_before_adjustments, tooltip: t_tooltip(:end_balance_investment), style: :subtotal }
+        items << { label: t_label(:adjustments), value: total_adjustments, tooltip: t_tooltip(:adjustments), style: :adjustment }
       end
 
-      items << { label: "Final balance", value: balance.end_balance_money, tooltip: "The final portfolio value for the day", style: :final }
+      items << { label: t_label(:final_balance), value: balance.end_balance_money, tooltip: t_tooltip(:final_balance_investment), style: :final }
       items
     end
 
     def loan_items
       items = [
-        { label: "Start principal", value: balance.start_balance_money, tooltip: "The principal balance at the beginning of this day", style: :start },
-        { label: "Net principal change", value: net_non_cash_flow, tooltip: "Principal payments and new borrowing during the day", style: :flow }
+        { label: t_label(:start_principal), value: balance.start_balance_money, tooltip: t_tooltip(:start_principal), style: :start },
+        { label: t_label(:net_principal_change), value: net_non_cash_flow, tooltip: t_tooltip(:net_principal_change), style: :flow }
       ]
 
       if has_adjustments?
-        items << { label: "End principal", value: end_balance_before_adjustments, tooltip: "The calculated principal after all transactions", style: :subtotal }
-        items << { label: "Adjustments", value: balance.non_cash_adjustments_money, tooltip: "Manual reconciliations or other adjustments", style: :adjustment }
+        items << { label: t_label(:end_principal), value: end_balance_before_adjustments, tooltip: t_tooltip(:end_principal), style: :subtotal }
+        items << { label: t_label(:adjustments), value: balance.non_cash_adjustments_money, tooltip: t_tooltip(:adjustments), style: :adjustment }
       end
 
-      items << { label: "Final principal", value: balance.end_balance_money, tooltip: "The final principal balance for the day", style: :final }
+      items << { label: t_label(:final_principal), value: balance.end_balance_money, tooltip: t_tooltip(:final_principal), style: :final }
       items
     end
 
-    def asset_items # Property/Vehicle
+    def asset_items
       items = [
-        { label: "Start value", value: balance.start_balance_money, tooltip: "The asset value at the beginning of this day", style: :start },
-        { label: "Net value change", value: net_total_flow, tooltip: "All value changes including improvements and depreciation", style: :flow }
+        { label: t_label(:start_value), value: balance.start_balance_money, tooltip: t_tooltip(:start_value), style: :start },
+        { label: t_label(:net_value_change), value: net_total_flow, tooltip: t_tooltip(:net_value_change), style: :flow }
       ]
 
       if has_adjustments?
-        items << { label: "End value", value: end_balance_before_adjustments, tooltip: "The calculated value after all changes", style: :subtotal }
-        items << { label: "Adjustments", value: total_adjustments, tooltip: "Manual value adjustments or appraisals", style: :adjustment }
+        items << { label: t_label(:end_value), value: end_balance_before_adjustments, tooltip: t_tooltip(:end_value), style: :subtotal }
+        items << { label: t_label(:adjustments), value: total_adjustments, tooltip: t_tooltip(:adjustments_asset), style: :adjustment }
       end
 
-      items << { label: "Final value", value: balance.end_balance_money, tooltip: "The final asset value for the day", style: :final }
+      items << { label: t_label(:final_value), value: balance.end_balance_money, tooltip: t_tooltip(:final_value), style: :final }
       items
     end
 
     def crypto_items
       items = [
-        { label: "Start balance", value: balance.start_balance_money, tooltip: "The crypto holdings value at the beginning of this day", style: :start }
+        { label: t_label(:start_balance), value: balance.start_balance_money, tooltip: t_tooltip(:start_balance_crypto), style: :start }
       ]
 
-      items << { label: "Buys", value: balance.cash_outflows_money * -1, tooltip: "Crypto purchases during the day", style: :flow } if balance.cash_outflows != 0
-      items << { label: "Sells", value: balance.cash_inflows_money, tooltip: "Crypto sales during the day", style: :flow } if balance.cash_inflows != 0
-      items << { label: "Market changes", value: balance.net_market_flows_money, tooltip: "Value changes from market price movements", style: :flow } if balance.net_market_flows != 0
+      items << { label: t_label(:buys), value: balance.cash_outflows_money * -1, tooltip: t_tooltip(:buys), style: :flow } if balance.cash_outflows != 0
+      items << { label: t_label(:sells), value: balance.cash_inflows_money, tooltip: t_tooltip(:sells), style: :flow } if balance.cash_inflows != 0
+      items << { label: t_label(:market_changes), value: balance.net_market_flows_money, tooltip: t_tooltip(:market_changes), style: :flow } if balance.net_market_flows != 0
 
       if has_adjustments?
-        items << { label: "End balance", value: end_balance_before_adjustments, tooltip: "The calculated balance after all activity", style: :subtotal }
-        items << { label: "Adjustments", value: total_adjustments, tooltip: "Manual reconciliations or other adjustments", style: :adjustment }
+        items << { label: t_label(:end_balance), value: end_balance_before_adjustments, tooltip: t_tooltip(:end_balance_crypto), style: :subtotal }
+        items << { label: t_label(:adjustments), value: total_adjustments, tooltip: t_tooltip(:adjustments), style: :adjustment }
       end
 
-      items << { label: "Final balance", value: balance.end_balance_money, tooltip: "The final crypto holdings value for the day", style: :final }
+      items << { label: t_label(:final_balance), value: balance.end_balance_money, tooltip: t_tooltip(:final_balance_crypto), style: :final }
       items
     end
 
diff --git a/app/components/UI/account/chart.html.erb b/app/components/UI/account/chart.html.erb
index efcdca7d6..91fb0b69c 100644
--- a/app/components/UI/account/chart.html.erb
+++ b/app/components/UI/account/chart.html.erb
@@ -21,7 +21,7 @@
       <div class="flex items-center gap-2">
         <% if account.investment? %>
           <%= form.select :chart_view,
-            [["Total value", "balance"], ["Holdings", "holdings_balance"], ["Cash", "cash_balance"]],
+            [[t(".views.total_value"), "balance"], [t(".views.holdings"), "holdings_balance"], [t(".views.cash"), "cash_balance"]],
             { selected: view },
             class: "bg-container border border-secondary rounded-lg text-sm pr-7 cursor-pointer text-primary focus:outline-hidden focus:ring-0",
             data: { "auto-submit-form-target": "auto" } %>
@@ -50,7 +50,7 @@
         data-time-series-chart-data-value="<%= series.to_json %>"></div>
       <% else %>
         <div class="w-full h-full flex items-center justify-center">
-          <p class="text-secondary text-sm">No data available</p>
+          <p class="text-secondary text-sm"><%= t(".no_data_available") %></p>
         </div>
       <% end %>
     </div>
diff --git a/app/components/UI/account/chart.rb b/app/components/UI/account/chart.rb
index 61ae4d6fc..25c5880ab 100644
--- a/app/components/UI/account/chart.rb
+++ b/app/components/UI/account/chart.rb
@@ -31,20 +31,22 @@ class UI::Account::Chart < ApplicationComponent
     when "Investment", "Crypto"
       case view
       when "balance"
-        "Total account value"
+        I18n.t("UI.account.chart.title.total_account_value")
       when "holdings_balance"
-        "Holdings value"
+        I18n.t("UI.account.chart.title.holdings_value")
       when "cash_balance"
-        "Cash value"
+        I18n.t("UI.account.chart.title.cash_value")
       end
-    when "Property", "Vehicle"
-      "Estimated #{account.accountable_type.humanize.downcase} value"
+    when "Property"
+      I18n.t("UI.account.chart.title.estimated_property_value")
+    when "Vehicle"
+      I18n.t("UI.account.chart.title.estimated_vehicle_value")
     when "CreditCard", "OtherLiability"
-      "Debt balance"
+      I18n.t("UI.account.chart.title.debt_balance")
     when "Loan"
-      "Remaining principal balance"
+      I18n.t("UI.account.chart.title.remaining_principal_balance")
     else
-      "Balance"
+      I18n.t("UI.account.chart.title.balance")
     end
   end
 
@@ -55,7 +57,11 @@ class UI::Account::Chart < ApplicationComponent
   def converted_balance_money
     return nil unless foreign_currency?
 
-    account.balance_money.exchange_to(account.family.currency, fallback_rate: 1)
+    begin
+      account.balance_money.exchange_to(account.family.currency)
+    rescue Money::ConversionError
+      nil
+    end
   end
 
   def view
@@ -75,7 +81,7 @@ class UI::Account::Chart < ApplicationComponent
     return period.comparison_label if start_date.blank?
 
     if start_date > period.start_date
-      "vs. available history"
+      I18n.t("UI.account.chart.vs_available_history")
     else
       period.comparison_label
     end
diff --git a/app/components/UI/account_page.html.erb b/app/components/UI/account_page.html.erb
index d1c9a5add..820d3a521 100644
--- a/app/components/UI/account_page.html.erb
+++ b/app/components/UI/account_page.html.erb
@@ -6,12 +6,21 @@
 
     <%= render UI::Account::Chart.new(account: account, period: chart_period, view: chart_view) %>
 
+    <% if (fx_coverage_start = fx_coverage_start_date).present? %>
+      <div class="px-3">
+        <%= render DS::Alert.new(
+          message: t("accounts.show.limited_fx_history_warning", date: l(fx_coverage_start, format: :long)),
+          variant: :warning
+        ) %>
+      </div>
+    <% end %>
+
     <div data-testid="account-details">
       <% if tabs.count > 1 %>
         <%= render DS::Tabs.new(active_tab: active_tab, url_param_key: "tab") do |tabs_container| %>
           <% tabs_container.with_nav(classes: "max-w-fit") do |nav| %>
             <% tabs.each do |tab| %>
-              <% nav.with_btn(id: tab, label: tab.to_s.humanize, classes: "px-6") %>
+              <% nav.with_btn(id: tab, label: t("accounts.show.tabs.#{tab}", default: tab.to_s.humanize), classes: "px-6") %>
             <% end %>
           <% end %>
 
diff --git a/app/components/UI/account_page.rb b/app/components/UI/account_page.rb
index 69e77c516..36be3c2b2 100644
--- a/app/components/UI/account_page.rb
+++ b/app/components/UI/account_page.rb
@@ -1,13 +1,19 @@
 class UI::AccountPage < ApplicationComponent
-  attr_reader :account, :chart_view, :chart_period
+  attr_reader :account, :chart_view, :chart_period, :statement_coverage, :statements, :reconciliation_statuses,
+              :can_manage_statements
 
   renders_one :activity_feed, ->(feed_data:, pagy:, search:) { UI::Account::ActivityFeed.new(feed_data: feed_data, pagy: pagy, search: search) }
 
-  def initialize(account:, chart_view: nil, chart_period: nil, active_tab: nil)
+  def initialize(account:, chart_view: nil, chart_period: nil, active_tab: nil, statement_coverage: nil, statements: [],
+                 reconciliation_statuses: {}, can_manage_statements: false)
     @account = account
     @chart_view = chart_view
     @chart_period = chart_period
     @active_tab = active_tab
+    @statement_coverage = statement_coverage
+    @statements = statements
+    @reconciliation_statuses = reconciliation_statuses
+    @can_manage_statements = can_manage_statements
   end
 
   def id
@@ -37,7 +43,7 @@ class UI::AccountPage < ApplicationComponent
   end
 
   def tabs
-    case account.accountable_type
+    base_tabs = case account.accountable_type
     when "Investment", "Crypto"
       [ :activity, :holdings ]
     when "Property", "Vehicle", "Loan"
@@ -45,6 +51,25 @@ class UI::AccountPage < ApplicationComponent
     else
       [ :activity ]
     end
+
+    base_tabs + [ :statements ]
+  end
+
+  def fx_coverage_start_date
+    return @fx_coverage_start_date if defined?(@fx_coverage_start_date)
+
+    result = nil
+    if account.family.present? && account.currency != account.family.currency
+      pair = ExchangeRatePair.for_pair(from: account.currency, to: account.family.currency)
+      if pair.first_provider_rate_on.present?
+        oldest_entry = account.entries.minimum(:date)
+        if oldest_entry.present? && oldest_entry < pair.first_provider_rate_on
+          result = pair.first_provider_rate_on
+        end
+      end
+    end
+
+    @fx_coverage_start_date = result
   end
 
   def tab_content_for(tab)
@@ -54,6 +79,32 @@ class UI::AccountPage < ApplicationComponent
     when :holdings, :overview
       # Accountable is responsible for implementing the partial in the correct folder
       render "#{account.accountable_type.downcase.pluralize}/tabs/#{tab}", account: account
+    when :statements
+      render_statement_tab
     end
   end
+
+  def render_statement_tab
+    return render "accounts/show/statements_frame", **statement_tab_locals if statement_tab_loaded?
+
+    turbo_frame_tag statement_tab_frame_id, src: helpers.account_path(account, tab: "statements"), loading: :lazy
+  end
+
+  def statement_tab_loaded?
+    statement_coverage.present?
+  end
+
+  def statement_tab_frame_id
+    dom_id(account, :statements_tab)
+  end
+
+  def statement_tab_locals
+    {
+      account: account,
+      coverage: statement_coverage,
+      statements: statements,
+      reconciliation_statuses: reconciliation_statuses,
+      can_manage_statements: can_manage_statements
+    }
+  end
 end
diff --git a/app/components/provider_sync_summary.html.erb b/app/components/provider_sync_summary.html.erb
index b6156edf7..2ddab4b76 100644
--- a/app/components/provider_sync_summary.html.erb
+++ b/app/components/provider_sync_summary.html.erb
@@ -1,4 +1,4 @@
-<details class="group bg-surface rounded-lg border border-surface-inset/50">
+<details class="group bg-surface rounded-lg border border-secondary">
   <summary class="flex items-center justify-between gap-2 p-3 cursor-pointer">
     <div class="flex items-center gap-2">
       <%= helpers.icon "chevron-right", class: "group-open:transform group-open:rotate-90" %>
@@ -123,7 +123,7 @@
             <% if error_details.any? %>
               <details class="mt-1">
                 <summary class="text-xs cursor-pointer text-secondary hover:text-primary"><%= t("provider_sync_summary.health.view_error_details") %></summary>
-                <div class="mt-1 pl-2 border-l-2 border-destructive/30 space-y-1">
+                <div class="mt-1 pl-2 border-l-2 border-destructive-subtle space-y-1">
                   <% error_details.each do |detail| %>
                     <p class="text-xs text-destructive">
                       <% if detail["name"].present? %><strong><%= detail["name"] %>:</strong> <% end %><%= detail["message"] %>
diff --git a/app/components/settings/provider_card.html.erb b/app/components/settings/provider_card.html.erb
new file mode 100644
index 000000000..6d0210a17
--- /dev/null
+++ b/app/components/settings/provider_card.html.erb
@@ -0,0 +1,25 @@
+<%= link_to connect_path,
+            class: "bg-container shadow-border-xs hover:bg-surface-inset rounded-xl p-4 flex flex-col gap-2.5 text-primary transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-alpha-black-300",
+            data: { turbo_frame: "drawer", turbo_prefetch: "false" }.merge(filter_data) do %>
+  <div class="flex items-start gap-2.5">
+    <div class="w-9 h-9 rounded-lg flex items-center justify-center shrink-0 <%= logo_bg %>">
+      <span class="text-xs font-bold text-inverse"><%= logo_text %></span>
+    </div>
+    <div class="flex-1 min-w-0">
+      <div class="flex items-center gap-2 flex-wrap">
+        <span class="text-sm font-medium text-primary"><%= name %></span>
+        <%= render "settings/providers/maturity_badge", label: maturity_label %>
+      </div>
+      <% if meta_line.present? %>
+        <p class="text-xs text-secondary mt-0.5"><%= meta_line %></p>
+      <% end %>
+    </div>
+  </div>
+  <% if tagline.present? %>
+    <p class="text-sm text-secondary grow leading-snug"><%= tagline %></p>
+  <% end %>
+  <div class="flex items-center justify-end gap-1.5 text-sm font-medium text-primary">
+    <%= t("settings.providers.connect") %>
+    <%= helpers.icon "arrow-right", size: "sm", class: "!w-3.5 !h-3.5" %>
+  </div>
+<% end %>
diff --git a/app/components/settings/provider_card.rb b/app/components/settings/provider_card.rb
new file mode 100644
index 000000000..c57657a2e
--- /dev/null
+++ b/app/components/settings/provider_card.rb
@@ -0,0 +1,47 @@
+class Settings::ProviderCard < ApplicationComponent
+  MATURITY_LABELS = {
+    beta: "settings.providers.maturity.beta",
+    alpha: "settings.providers.maturity.alpha"
+  }.freeze
+
+  def self.maturity_label(maturity)
+    key = MATURITY_LABELS[maturity&.to_sym]
+    I18n.t(key) if key
+  end
+
+  def initialize(provider_key:, name:, tagline: nil, region: nil, kind: nil, tier: nil,
+                 maturity: :stable, logo_bg: "bg-gray-500", logo_text: nil)
+    @provider_key = provider_key
+    @name         = name
+    @tagline      = tagline
+    @region       = region
+    @kind         = kind
+    @tier         = tier
+    @maturity     = maturity.to_sym
+    @logo_bg      = logo_bg
+    @logo_text    = logo_text || name.first(2).upcase
+  end
+
+  attr_reader :name, :tagline, :logo_bg, :logo_text
+
+  def maturity_label
+    self.class.maturity_label(@maturity)
+  end
+
+  def meta_line
+    [ @region, @kind, @tier ].compact.join(" · ")
+  end
+
+  def connect_path
+    helpers.connect_form_settings_providers_path(provider_key: @provider_key)
+  end
+
+  def filter_data
+    {
+      providers_filter_target: "card",
+      provider_name: @name.to_s.downcase,
+      provider_region: @region.to_s.downcase,
+      provider_kind: @kind.to_s.downcase
+    }
+  end
+end
diff --git a/app/controllers/account_statements_controller.rb b/app/controllers/account_statements_controller.rb
new file mode 100644
index 000000000..27793c4b6
--- /dev/null
+++ b/app/controllers/account_statements_controller.rb
@@ -0,0 +1,211 @@
+# frozen_string_literal: true
+
+class AccountStatementsController < ApplicationController
+  before_action :set_statement, only: %i[show update destroy link unlink reject]
+  before_action :ensure_statement_manager!, only: %i[index create update destroy link unlink reject]
+
+  def index
+    accessible_account_ids = Current.user.accessible_accounts.select(:id)
+    account_statements = Current.family.account_statements
+      .with_attached_original_file
+      .includes(:account, :suggested_account)
+      .ordered
+    visible_storage_scope = Current.family.account_statements
+      .where(account_id: nil)
+      .or(Current.family.account_statements.where(account_id: accessible_account_ids))
+    linked_statement_scope = account_statements.with_account.where(account_id: accessible_account_ids)
+
+    @unmatched_pagy, @unmatched_statements = pagy(account_statements.unmatched, limit: safe_per_page, page_param: :unmatched_page)
+    @linked_pagy, @linked_statements = pagy(linked_statement_scope, limit: safe_per_page, page_param: :linked_page)
+    @total_storage_bytes = visible_storage_scope.sum(:byte_size)
+    @accounts = Current.user.accessible_accounts.visible.alphabetically
+    @breadcrumbs = [
+      [ t("breadcrumbs.home"), root_path ],
+      [ t("account_statements.index.title"), account_statements_path ]
+    ]
+    render layout: "settings"
+  end
+
+  def show
+    @accounts = Current.user.accessible_accounts.visible.alphabetically
+    @can_manage_statement = @statement.manageable_by?(Current.user)
+    @reconciliation_checks = @statement.reconciliation_checks
+    @breadcrumbs = [
+      [ t("breadcrumbs.home"), root_path ],
+      [ t("account_statements.index.title"), account_statements_path ],
+      [ @statement.filename, nil ]
+    ]
+    render layout: "settings"
+  end
+
+  def create
+    files = Array(statement_upload_params[:files]).reject(&:blank?).select { |file| file.respond_to?(:read) }
+    account = target_account
+
+    if files.empty?
+      redirect_back_or_to account_statements_path, alert: t("account_statements.create.no_files")
+      return
+    end
+
+    return if account && !require_account_permission!(account)
+
+    created = []
+    duplicates = []
+    validation_errors = []
+
+    files.each do |file|
+      prepared_upload = AccountStatement.prepare_upload!(file)
+      created << AccountStatement.create_from_prepared_upload!(family: Current.family, account: account, prepared_upload: prepared_upload)
+    rescue AccountStatement::InvalidUploadError
+      validation_errors << t("account_statements.create.invalid_file_type")
+    rescue AccountStatement::DuplicateUploadError => e
+      duplicates << e.statement
+    rescue ActiveRecord::RecordInvalid => e
+      validation_errors << e.record.errors.full_messages.to_sentence
+    end
+
+    redirect_to redirect_after_create(account, created.first || duplicates.first),
+                flash_for_upload(created:, duplicates:, validation_errors:)
+  end
+
+  def update
+    return if @statement.account && !require_account_permission!(@statement.account)
+
+    target = statement_account_id.present? ? Current.user.accessible_accounts.find(statement_account_id) : nil
+    return if target && !require_account_permission!(target)
+
+    attrs = statement_params.to_h
+    attrs[:account] = target if statement_account_id_provided?
+
+    @statement.assign_attributes(attrs)
+    @statement.assign_account_match if @statement.account.nil? && !@statement.rejected?
+
+    if @statement.save
+      redirect_to account_statement_path(@statement), notice: t("account_statements.update.success")
+    else
+      @accounts = Current.user.accessible_accounts.visible.alphabetically
+      @can_manage_statement = @statement.manageable_by?(Current.user)
+      @reconciliation_checks = @statement.reconciliation_checks
+      flash.now[:alert] = @statement.errors.full_messages.to_sentence
+      render :show, status: :unprocessable_entity, layout: "settings"
+    end
+  end
+
+  def link
+    return if @statement.account && !require_account_permission!(@statement.account)
+
+    account_id = params[:account_id].presence || @statement.suggested_account_id
+    if account_id.blank?
+      redirect_to account_statement_path(@statement), alert: t("account_statements.link.no_account")
+      return
+    end
+
+    account = Current.user.accessible_accounts.find(account_id)
+    return unless require_account_permission!(account)
+
+    @statement.link_to_account!(account)
+    redirect_to post_link_path(@statement), notice: t("account_statements.link.success", account: account.name)
+  end
+
+  def unlink
+    return if @statement.account && !require_account_permission!(@statement.account)
+
+    @statement.unlink!
+    redirect_to account_statement_path(@statement), notice: t("account_statements.unlink.success")
+  end
+
+  def reject
+    return if @statement.account && !require_account_permission!(@statement.account)
+
+    @statement.reject_match!
+    redirect_to account_statements_path, notice: t("account_statements.reject.success")
+  end
+
+  def destroy
+    return if @statement.account && !require_account_permission!(@statement.account)
+
+    redirect_path = @statement.account ? account_path(@statement.account, tab: "statements") : account_statements_path
+    if @statement.destroy
+      redirect_to redirect_path, notice: t("account_statements.destroy.success")
+    else
+      redirect_back_or_to redirect_path, alert: t("account_statements.destroy.failure")
+    end
+  end
+
+  private
+
+    def set_statement
+      @statement = Current.family.account_statements
+        .with_attached_original_file
+        .includes(:account, :suggested_account)
+        .find(params[:id])
+
+      raise ActiveRecord::RecordNotFound unless @statement.viewable_by?(Current.user)
+    end
+
+    def ensure_statement_manager!
+      return if AccountStatement.statement_manager?(Current.user)
+
+      redirect_to accounts_path, alert: t("accounts.not_authorized")
+    end
+
+    def statement_upload_params
+      params.fetch(:account_statement, ActionController::Parameters.new).permit(files: [])
+    end
+
+    def statement_params
+      params.require(:account_statement).permit(
+        :institution_name_hint,
+        :account_name_hint,
+        :account_last4_hint,
+        :period_start_on,
+        :period_end_on,
+        :opening_balance,
+        :closing_balance,
+        :currency
+      )
+    end
+
+    def target_account
+      account_id = statement_account_id.presence
+      return nil if account_id.blank?
+
+      Current.user.accessible_accounts.find(account_id)
+    end
+
+    def statement_account_id
+      params.fetch(:account_statement, ActionController::Parameters.new)[:account_id]
+    end
+
+    def statement_account_id_provided?
+      params.fetch(:account_statement, ActionController::Parameters.new).key?(:account_id)
+    end
+
+    def redirect_after_create(account, statement = nil)
+      if account
+        account_path(account, tab: "statements")
+      elsif statement
+        account_statement_path(statement)
+      else
+        account_statements_path
+      end
+    end
+
+    def post_link_path(statement)
+      statement.account ? account_path(statement.account, tab: "statements") : account_statement_path(statement)
+    end
+
+    def flash_for_upload(created:, duplicates:, validation_errors: [])
+      alerts = []
+      alerts << t("account_statements.create.duplicates", count: duplicates.size) if duplicates.any?
+      alerts.concat(validation_errors.compact_blank)
+
+      if created.any?
+        flash = { notice: t("account_statements.create.success", count: created.size) }
+        flash[:alert] = alerts.to_sentence if alerts.any?
+        flash
+      else
+        { alert: alerts.to_sentence }
+      end
+    end
+end
diff --git a/app/controllers/accountable_sparklines_controller.rb b/app/controllers/accountable_sparklines_controller.rb
index 9ba69ff56..e32500773 100644
--- a/app/controllers/accountable_sparklines_controller.rb
+++ b/app/controllers/accountable_sparklines_controller.rb
@@ -43,8 +43,14 @@ class AccountableSparklinesController < ApplicationController
       ).balance_series
     end
 
+    # balance_type is derived purely from accountable_type, so only Investment/Crypto
+    # can yield :investment. Short-circuit to avoid an N+1 `account.linked?` check
+    # on every account for non-investment accountable types (loan, credit_card, etc).
+    # The `Account.linked` scope is the SQL-level mirror of `Account#linked?`.
     def requires_normalized_aggregation?
-      accounts.any? { |account| account.linked? && account.balance_type == :investment }
+      return false unless %w[Investment Crypto].include?(@accountable.name)
+
+      accounts.linked.exists?
     end
 
     def aggregate_normalized_series
diff --git a/app/controllers/accounts_controller.rb b/app/controllers/accounts_controller.rb
index 9ae5767e5..2becdd3b3 100644
--- a/app/controllers/accounts_controller.rb
+++ b/app/controllers/accounts_controller.rb
@@ -10,6 +10,7 @@ class AccountsController < ApplicationController
     @manual_accounts = family.accounts
           .listable_manual
           .where(id: @accessible_account_ids)
+          .includes(:accountable, :account_providers, :plaid_account, :simplefin_account)
           .order(:name)
     @plaid_items = visible_provider_items(family.plaid_items.ordered.includes(:syncs, :plaid_accounts))
     @simplefin_items = visible_provider_items(family.simplefin_items.ordered.includes(:syncs))
@@ -17,9 +18,12 @@ class AccountsController < ApplicationController
     @enable_banking_items = visible_provider_items(family.enable_banking_items.ordered.includes(:syncs))
     @coinstats_items = visible_provider_items(family.coinstats_items.ordered.includes(:coinstats_accounts, :accounts, :syncs))
     @mercury_items = visible_provider_items(family.mercury_items.ordered.includes(:syncs, :mercury_accounts))
+    @brex_items = visible_provider_items(family.brex_items.ordered.includes(:accounts, :syncs, brex_accounts: :account_provider))
     @coinbase_items = visible_provider_items(family.coinbase_items.ordered.includes(:coinbase_accounts, :accounts, :syncs))
     @snaptrade_items = visible_provider_items(family.snaptrade_items.ordered.includes(:syncs, :snaptrade_accounts))
+    @ibkr_items = visible_provider_items(family.ibkr_items.ordered.includes(:syncs, :ibkr_accounts))
     @indexa_capital_items = visible_provider_items(family.indexa_capital_items.ordered.includes(:syncs, :indexa_capital_accounts))
+    @sophtron_items = visible_provider_items(family.sophtron_items.ordered.includes(:syncs, :sophtron_accounts))
 
     # Build sync stats maps for all providers
     build_sync_stats_maps
@@ -45,13 +49,18 @@ class AccountsController < ApplicationController
     @chart_view = params[:chart_view] || "balance"
     @tab = params[:tab]
     @q = params.fetch(:q, {}).permit(:search, status: [])
-    entries = @account.entries.where(excluded: false).search(@q).reverse_chronological
+    entries = @account.entries.where(excluded: false).search(@q).reverse_chronological.includes(:entryable)
+    if statement_tab_active?
+      build_statement_tab_data
+      return render_statement_tab_frame if statement_tab_frame_request?
+    end
 
     @pagy, @entries = pagy(
       entries,
       limit: safe_per_page,
       params: request.query_parameters.except("tab").merge("tab" => "activity")
     )
+    Transaction::ActivitySecurityPreloader.new(@entries).preload
 
     @activity_feed_data = Account::ActivityFeedData.new(@account, @entries)
   end
@@ -232,6 +241,39 @@ class AccountsController < ApplicationController
       end
     end
 
+    def build_statement_tab_data
+      return unless statement_tab_active?
+
+      @statement_coverage = AccountStatement::Coverage.for_year(@account, params[:statement_year])
+      @account_statements = @account.account_statements.with_attached_original_file.ordered.to_a
+      @statement_reconciliation_statuses = AccountStatement.reconciliation_statuses_for(@account_statements, account: @account)
+      permission = @account.permission_for(Current.user)
+      @can_manage_statements = AccountStatement.statement_manager?(Current.user) &&
+        permission.in?([ :owner, :full_control ])
+    end
+
+    def statement_tab_frame_request?
+      turbo_frame_request? && request.headers["Turbo-Frame"] == helpers.dom_id(@account, :statements_tab)
+    end
+
+    def render_statement_tab_frame
+      render partial: "accounts/show/statements_frame", locals: statement_tab_locals, layout: false
+    end
+
+    def statement_tab_locals
+      {
+        account: @account,
+        coverage: @statement_coverage,
+        statements: @account_statements,
+        reconciliation_statuses: @statement_reconciliation_statuses,
+        can_manage_statements: @can_manage_statements
+      }
+    end
+
+    def statement_tab_active?
+      @tab == "statements"
+    end
+
     # Builds sync stats maps for all provider types to avoid N+1 queries in views
     def build_sync_stats_maps
       # SimpleFIN sync stats
@@ -299,6 +341,13 @@ class AccountsController < ApplicationController
         @coinstats_sync_stats_map[item.id] = latest_sync&.sync_stats || {}
       end
 
+      # Sophtron sync stats
+      @sophtron_sync_stats_map = {}
+      @sophtron_items.each do |item|
+        latest_sync = item.syncs.ordered.first
+        @sophtron_sync_stats_map[item.id] = latest_sync&.sync_stats || {}
+      end
+
       # Mercury sync stats
       @mercury_sync_stats_map = {}
       @mercury_items.each do |item|
@@ -306,6 +355,27 @@ class AccountsController < ApplicationController
         @mercury_sync_stats_map[item.id] = latest_sync&.sync_stats || {}
       end
 
+      # Brex sync stats
+      @brex_sync_stats_map = {}
+      @brex_account_counts_map = {}
+      @brex_institutions_count_map = {}
+      @brex_items.each do |item|
+        latest_sync = item.syncs.ordered.first
+        @brex_sync_stats_map[item.id] = latest_sync&.sync_stats || {}
+        brex_accounts = item.brex_accounts.to_a
+        linked_count = brex_accounts.count { |brex_account| brex_account.account_provider.present? }
+        total_count = brex_accounts.count
+        @brex_account_counts_map[item.id] = {
+          linked: linked_count,
+          unlinked: total_count - linked_count,
+          total: total_count
+        }
+        @brex_institutions_count_map[item.id] = brex_accounts
+          .filter_map(&:institution_metadata)
+          .uniq { |institution| institution["name"] || institution["institution_name"] }
+          .count
+      end
+
       # Coinbase sync stats
       @coinbase_sync_stats_map = {}
       @coinbase_unlinked_count_map = {}
diff --git a/app/controllers/api/v1/accounts_controller.rb b/app/controllers/api/v1/accounts_controller.rb
index e5e4cad3c..8b03a5f1f 100644
--- a/app/controllers/api/v1/accounts_controller.rb
+++ b/app/controllers/api/v1/accounts_controller.rb
@@ -7,53 +7,66 @@ class Api::V1::AccountsController < Api::V1::BaseController
   before_action :ensure_read_scope
 
   def index
-    # Test with Pagy pagination
-    family = current_resource_owner.family
-    accounts_query = family.accounts.accessible_by(current_resource_owner).visible.alphabetically
-
-    # Handle pagination with Pagy
-    @pagy, @accounts = pagy(
-      accounts_query,
-      page: safe_page_param,
-      limit: safe_per_page_param
-    )
-
     @per_page = safe_per_page_param
 
-    # Rails will automatically use app/views/api/v1/accounts/index.json.jbuilder
+    @pagy, @accounts = pagy(
+      accounts_scope.alphabetically,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
     render :index
   rescue => e
-    Rails.logger.error "AccountsController error: #{e.message}"
+    Rails.logger.error "AccountsController#index error: #{e.message}"
     Rails.logger.error e.backtrace.join("\n")
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
-end
-
-    private
-
-      def ensure_read_scope
-        authorize_scope!(:read)
-      end
-
-
-
-      def safe_page_param
-        page = params[:page].to_i
-        page > 0 ? page : 1
-      end
-
-      def safe_per_page_param
-        per_page = params[:per_page].to_i
-
-        # Default to 25, max 100
-        case per_page
-        when 1..100
-          per_page
-        else
-          25
-        end
-      end
+  end
+
+  def show
+    unless valid_uuid?(params[:id])
+      render json: {
+        error: "not_found",
+        message: "Account not found"
+      }, status: :not_found
+      return
+    end
+
+    @account = accounts_scope.find(params[:id])
+
+    render :show
+  rescue ActiveRecord::RecordNotFound
+    render json: {
+      error: "not_found",
+      message: "Account not found"
+    }, status: :not_found
+  rescue => e
+    Rails.logger.error "AccountsController#show error: #{e.message}"
+    Rails.logger.error e.backtrace.join("\n")
+
+    render json: {
+      error: "internal_server_error",
+      message: "An unexpected error occurred"
+    }, status: :internal_server_error
+  end
+
+  private
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
+    def accounts_scope
+      scope = current_resource_owner.family.accounts
+                                    .accessible_by(current_resource_owner)
+                                    .includes(:accountable, account_providers: :provider)
+      include_disabled_accounts? ? scope : scope.visible
+    end
+
+    def include_disabled_accounts?
+      ActiveModel::Type::Boolean.new.cast(params[:include_disabled])
+    end
 end
diff --git a/app/controllers/api/v1/auth_controller.rb b/app/controllers/api/v1/auth_controller.rb
index e522fb03f..c92e80334 100644
--- a/app/controllers/api/v1/auth_controller.rb
+++ b/app/controllers/api/v1/auth_controller.rb
@@ -45,23 +45,28 @@ module Api
         user.family = family
         user.role = User.role_for_new_family_creator
 
-        if user.save
-          # Claim invite code if provided
-          InviteCode.claim!(params[:invite_code]) if params[:invite_code].present?
-
-          # Create device and OAuth token
-          begin
+        # Atomic: user creation, invite-code claim, and device/token issuance
+        # either all commit or none do. Without this, a post-commit device
+        # failure (e.g., racing uniqueness) would leave the user/invite/family
+        # committed while the client got a 422 "Failed to register device".
+        token_response = nil
+        begin
+          ActiveRecord::Base.transaction do
+            unless user.save
+              render json: { errors: user.errors.full_messages }, status: :unprocessable_entity
+              raise ActiveRecord::Rollback
+            end
+            InviteCode.claim!(params[:invite_code]) if params[:invite_code].present?
             device = MobileDevice.upsert_device!(user, device_params)
             token_response = device.issue_token!
-          rescue ActiveRecord::RecordInvalid => e
-            render json: { error: "Failed to register device: #{e.message}" }, status: :unprocessable_entity
-            return
           end
-
-          render json: token_response.merge(user: mobile_user_payload(user)), status: :created
-        else
-          render json: { errors: user.errors.full_messages }, status: :unprocessable_entity
+        rescue ActiveRecord::RecordInvalid => e
+          Rails.logger.error("[Auth] Device registration failed: #{e.class} - #{e.message}")
+          render json: { error: "Failed to register device" }, status: :unprocessable_entity
+          return
         end
+
+        render json: token_response.merge(user: mobile_user_payload(user)), status: :created if token_response
       end
 
       def login
@@ -90,7 +95,8 @@ module Api
             device = MobileDevice.upsert_device!(user, device_params)
             token_response = device.issue_token!
           rescue ActiveRecord::RecordInvalid => e
-            render json: { error: "Failed to register device: #{e.message}" }, status: :unprocessable_entity
+            Rails.logger.error("[Auth] Device registration failed: #{e.message}")
+            render json: { error: "Failed to register device" }, status: :unprocessable_entity
             return
           end
 
@@ -312,7 +318,20 @@ module Api
           return false if device.nil?
 
           required_fields = %w[device_id device_name device_type os_version app_version]
-          required_fields.all? { |field| device[field].present? }
+          return false unless required_fields.all? { |field| device[field].present? }
+
+          # Run MobileDevice's attribute-level validations up front (e.g.,
+          # device_type must be ios/android/web) so a misconfigured client
+          # is rejected BEFORE signup commits user/family/invite. Skip
+          # errors we can't evaluate without a user: the :user belongs_to
+          # presence check, and device_id uniqueness scoped to user_id
+          # (upsert_device! treats collisions as updates anyway).
+          preview = MobileDevice.new(device_params)
+          preview.valid?
+          relevant_errors = preview.errors.errors.reject do |err|
+            err.type == :taken || err.attribute == :user
+          end
+          relevant_errors.empty?
         end
 
         def device_params
@@ -373,7 +392,8 @@ module Api
 
           render json: token_response.merge(user: mobile_user_payload(user))
         rescue ActiveRecord::RecordInvalid => e
-          render json: { error: "Failed to register device: #{e.message}" }, status: :unprocessable_entity
+          Rails.logger.error("[Auth] Device registration failed: #{e.message}")
+          render json: { error: "Failed to register device" }, status: :unprocessable_entity
         end
 
         def ensure_write_scope
diff --git a/app/controllers/api/v1/balances_controller.rb b/app/controllers/api/v1/balances_controller.rb
new file mode 100644
index 000000000..0e08d030a
--- /dev/null
+++ b/app/controllers/api/v1/balances_controller.rb
@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+class Api::V1::BalancesController < Api::V1::BaseController
+  include Pagy::Backend
+
+  before_action :ensure_read_scope
+  before_action :set_balance, only: :show
+  helper_method :format_money, :money_to_minor_units
+
+  def index
+    balances_query = apply_filters(balances_scope).order(date: :desc, created_at: :desc)
+    @per_page = safe_per_page_param
+
+    @pagy, @balances = pagy(
+      balances_query,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  rescue InvalidFilterError => e
+    render json: {
+      error: "validation_failed",
+      message: e.message,
+      errors: [ e.message ]
+    }, status: :unprocessable_entity
+  end
+
+  def show
+    render :show
+  end
+
+  private
+
+    def set_balance
+      raise ActiveRecord::RecordNotFound unless valid_uuid?(params[:id])
+
+      @balance = balances_scope.find(params[:id])
+    end
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
+    def balances_scope
+      Balance
+        .joins(:account)
+        .where(accounts: { id: accessible_account_ids })
+        .includes(:account)
+    end
+
+    def accessible_account_ids
+      @accessible_account_ids ||= current_resource_owner.family.accounts.accessible_by(current_resource_owner).select(:id)
+    end
+
+    def apply_filters(query)
+      if params[:account_id].present?
+        raise InvalidFilterError, "account_id must be a valid UUID" unless valid_uuid?(params[:account_id])
+
+        query = query.where(account_id: params[:account_id])
+      end
+
+      query = query.where(currency: params[:currency].to_s.upcase) if params[:currency].present?
+      query = query.where("balances.date >= ?", parse_date_param(:start_date)) if params[:start_date].present?
+      query = query.where("balances.date <= ?", parse_date_param(:end_date)) if params[:end_date].present?
+      query
+    end
+
+    def format_money(money)
+      money&.format
+    end
+
+    def money_to_minor_units(money)
+      (money.amount * money.currency.minor_unit_conversion).round(0).to_i if money
+    end
+end
diff --git a/app/controllers/api/v1/base_controller.rb b/app/controllers/api/v1/base_controller.rb
index d768bdf3f..f1631ec1c 100644
--- a/app/controllers/api/v1/base_controller.rb
+++ b/app/controllers/api/v1/base_controller.rb
@@ -3,6 +3,14 @@
 class Api::V1::BaseController < ApplicationController
   include Doorkeeper::Rails::Helpers
 
+  InvalidFilterError = Class.new(StandardError)
+
+  class << self
+    def valid_uuid?(value)
+      UuidFormat.valid?(value)
+    end
+  end
+
   # Skip regular session-based authentication for API
   skip_authentication
 
@@ -30,6 +38,7 @@ class Api::V1::BaseController < ApplicationController
   rescue_from ActiveRecord::RecordNotFound, with: :handle_not_found
   rescue_from Doorkeeper::Errors::DoorkeeperError, with: :handle_unauthorized
   rescue_from ActionController::ParameterMissing, with: :handle_bad_request
+  rescue_from InvalidFilterError, with: :handle_invalid_filter
 
   private
 
@@ -56,7 +65,7 @@ class Api::V1::BaseController < ApplicationController
       # Check token validity and scope (read_write includes read access)
       has_sufficient_scope = access_token&.scopes&.include?("read") || access_token&.scopes&.include?("read_write")
 
-      unless access_token && !access_token.expired? && has_sufficient_scope
+      unless access_token&.accessible? && has_sufficient_scope
         render_json({ error: "unauthorized", message: "Access token is invalid, expired, or missing required scope" }, status: :unauthorized)
         return false
       end
@@ -204,11 +213,41 @@ class Api::V1::BaseController < ApplicationController
       true
     end
 
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
     # Consistent JSON response method
     def render_json(data, status: :ok)
       render json: data, status: status
     end
 
+    def valid_uuid?(value)
+      self.class.valid_uuid?(value)
+    end
+
+    def safe_page_param
+      page = params[:page].to_i
+      page > 0 ? page : 1
+    end
+
+    def safe_per_page_param
+      per_page = params[:per_page].to_i
+      case per_page
+      when 1..100   then per_page
+      when (101..)  then 100
+      else               25
+      end
+    end
+
+    def render_validation_error(message)
+      render_json({
+        error: "validation_failed",
+        message: message,
+        errors: [ message ]
+      }, status: :unprocessable_entity)
+    end
+
     # Error handlers
     def handle_not_found(exception)
       Rails.logger.warn "API Record Not Found: #{exception.message}"
@@ -225,6 +264,16 @@ class Api::V1::BaseController < ApplicationController
       render_json({ error: "bad_request", message: "Required parameters are missing or invalid" }, status: :bad_request)
     end
 
+    def handle_invalid_filter(exception)
+      render_validation_error(exception.message)
+    end
+
+    def parse_date_param(key)
+      Date.iso8601(params[key].to_s)
+    rescue ArgumentError
+      raise InvalidFilterError, "#{key} must be an ISO 8601 date"
+    end
+
     # Log API access for monitoring and debugging
     def log_api_access
       return unless current_resource_owner
diff --git a/app/controllers/api/v1/budget_categories_controller.rb b/app/controllers/api/v1/budget_categories_controller.rb
new file mode 100644
index 000000000..5628e749e
--- /dev/null
+++ b/app/controllers/api/v1/budget_categories_controller.rb
@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+class Api::V1::BudgetCategoriesController < Api::V1::BaseController
+  include Pagy::Backend
+
+  before_action :ensure_read_scope
+  before_action :set_budget_category, only: :show
+
+  def index
+    budget_categories_query = apply_filters(budget_categories_scope)
+      .order("budgets.start_date DESC", "categories.name ASC")
+    @per_page = safe_per_page_param
+
+    @pagy, @budget_categories = pagy(
+      budget_categories_query,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  end
+
+  def show
+    render :show
+  end
+
+  private
+
+    def set_budget_category
+      raise ActiveRecord::RecordNotFound unless valid_uuid?(params[:id])
+
+      @budget_category = budget_categories_scope.find(params[:id])
+    end
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
+    def budget_categories_scope
+      BudgetCategory
+        .joins(:budget, :category)
+        .where(budgets: { family_id: current_resource_owner.family_id })
+        .includes({ budget: { budget_categories: { category: :parent } } }, category: :parent)
+    end
+
+    def apply_filters(query)
+      if params[:budget_id].present?
+        raise InvalidFilterError, "budget_id must be a valid UUID" unless valid_uuid?(params[:budget_id])
+
+        query = query.where(budget_id: params[:budget_id])
+      end
+
+      if params[:category_id].present?
+        raise InvalidFilterError, "category_id must be a valid UUID" unless valid_uuid?(params[:category_id])
+
+        query = query.where(category_id: params[:category_id])
+      end
+
+      query = query.where("budgets.start_date >= ?", parse_date_param(:start_date)) if params[:start_date].present?
+      query = query.where("budgets.end_date <= ?", parse_date_param(:end_date)) if params[:end_date].present?
+      query
+    end
+end
diff --git a/app/controllers/api/v1/budgets_controller.rb b/app/controllers/api/v1/budgets_controller.rb
new file mode 100644
index 000000000..d9203faaa
--- /dev/null
+++ b/app/controllers/api/v1/budgets_controller.rb
@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+class Api::V1::BudgetsController < Api::V1::BaseController
+  include Pagy::Backend
+
+  before_action :ensure_read_scope
+  before_action :set_budget, only: :show
+
+  def index
+    budgets_query = apply_filters(budgets_scope).order(start_date: :desc)
+    @per_page = safe_per_page_param
+
+    @pagy, @budgets = pagy(
+      budgets_query,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  end
+
+  def show
+    render :show
+  end
+
+  private
+
+    def set_budget
+      raise ActiveRecord::RecordNotFound unless valid_uuid?(params[:id])
+
+      @budget = budgets_scope.find(params[:id])
+    end
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
+    def apply_filters(query)
+      query = query.where("budgets.start_date >= ?", parse_date_param(:start_date)) if params[:start_date].present?
+      query = query.where("budgets.end_date <= ?", parse_date_param(:end_date)) if params[:end_date].present?
+      query
+    end
+
+    def budgets_scope
+      current_resource_owner.family.budgets.includes(budget_categories: :category)
+    end
+end
diff --git a/app/controllers/api/v1/categories_controller.rb b/app/controllers/api/v1/categories_controller.rb
index c810ffa25..302b97225 100644
--- a/app/controllers/api/v1/categories_controller.rb
+++ b/app/controllers/api/v1/categories_controller.rb
@@ -3,7 +3,8 @@
 class Api::V1::CategoriesController < Api::V1::BaseController
   include Pagy::Backend
 
-  before_action :ensure_read_scope
+  before_action :ensure_read_scope, only: %i[index show]
+  before_action :ensure_write_scope, only: :create
   before_action :set_category, only: :show
 
   def index
@@ -29,7 +30,7 @@ class Api::V1::CategoriesController < Api::V1::BaseController
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
@@ -41,10 +42,34 @@ class Api::V1::CategoriesController < Api::V1::BaseController
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
+  def create
+    family = current_resource_owner.family
+    attrs = category_params
+
+    if attrs[:parent_id].present? && !family.categories.exists?(id: attrs[:parent_id])
+      return render json: {
+        error: "unprocessable_entity",
+        message: "Parent must be a category in your family"
+      }, status: :unprocessable_entity
+    end
+
+    @category = family.categories.new(attrs)
+    @category.lucide_icon = Category.suggested_icon(@category.name) if @category.lucide_icon.blank?
+
+    if @category.save
+      render :show, status: :created
+    else
+      render json: {
+        error: "unprocessable_entity",
+        message: @category.errors.full_messages.join(", ")
+      }, status: :unprocessable_entity
+    end
+  end
+
   private
 
     def set_category
@@ -61,6 +86,17 @@ class Api::V1::CategoriesController < Api::V1::BaseController
       authorize_scope!(:read)
     end
 
+    def ensure_write_scope
+      authorize_scope!(:read_write)
+    end
+
+    def category_params
+      permitted = params.require(:category).permit(:name, :color, :icon, :parent_id)
+      icon = permitted.delete(:icon)
+      permitted[:lucide_icon] = icon if icon.present?
+      permitted
+    end
+
     def apply_filters(query)
       # Filter for root categories only (no parent)
       if params[:roots_only].present? && ActiveModel::Type::Boolean.new.cast(params[:roots_only])
diff --git a/app/controllers/api/v1/family_exports_controller.rb b/app/controllers/api/v1/family_exports_controller.rb
new file mode 100644
index 000000000..e3ad3fcfb
--- /dev/null
+++ b/app/controllers/api/v1/family_exports_controller.rb
@@ -0,0 +1,126 @@
+# frozen_string_literal: true
+
+class Api::V1::FamilyExportsController < Api::V1::BaseController
+  include Pagy::Backend
+
+  before_action :ensure_read_scope, only: [ :index, :show, :download ]
+  before_action :ensure_write_scope, only: [ :create ]
+  before_action :ensure_admin
+  before_action :set_family_export, only: [ :show, :download ]
+
+  def index
+    family_exports_query = current_resource_owner.family
+      .family_exports
+      .with_attached_export_file
+      .ordered
+
+    @per_page = safe_per_page_param
+    @pagy, @family_exports = pagy(
+      family_exports_query,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  rescue StandardError => e
+    Rails.logger.error "FamilyExportsController#index error: #{e.message}"
+    Rails.logger.error e.backtrace.join("\n")
+
+    render json: {
+      error: "internal_server_error",
+      message: "An unexpected error occurred"
+    }, status: :internal_server_error
+  end
+
+  def show
+    render :show
+  end
+
+  def create
+    if unsupported_create_params?
+      render json: {
+        error: "invalid_params",
+        message: "Family export creation does not accept request parameters"
+      }, status: :unprocessable_entity
+      return
+    end
+
+    @family_export = current_resource_owner.family.family_exports.create!
+    FamilyDataExportJob.perform_later(@family_export)
+
+    render :show, status: :accepted
+  rescue StandardError => e
+    Rails.logger.error "FamilyExportsController#create error: #{e.message}"
+    Rails.logger.error e.backtrace.join("\n")
+
+    render json: {
+      error: "internal_server_error",
+      message: "An unexpected error occurred"
+    }, status: :internal_server_error
+  end
+
+  def download
+    unless @family_export.downloadable?
+      render json: {
+        error: "export_not_ready",
+        message: "Export is not ready for download"
+      }, status: :conflict
+      return
+    end
+
+    redirect_to rails_blob_url(@family_export.export_file, disposition: "attachment"), allow_other_host: true
+  rescue StandardError => e
+    Rails.logger.error "FamilyExportsController#download error: #{e.message}"
+    Rails.logger.error e.backtrace.join("\n")
+
+    render json: {
+      error: "internal_server_error",
+      message: "An unexpected error occurred"
+    }, status: :internal_server_error
+  end
+
+  private
+
+    def set_family_export
+      raise ActiveRecord::RecordNotFound unless valid_uuid?(params[:id])
+
+      @family_export = current_resource_owner.family.family_exports.find(params[:id])
+    end
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
+    def ensure_write_scope
+      authorize_scope!(:write)
+    end
+
+    def ensure_admin
+      return if current_resource_owner.admin?
+
+      render json: {
+        error: "forbidden",
+        message: "Family exports require a family admin"
+      }, status: :forbidden
+    end
+
+    def unsupported_create_params?
+      params.except(:controller, :action, :format).present?
+    end
+
+    def safe_page_param
+      page = params[:page].to_i
+      page > 0 ? page : 1
+    end
+
+    def safe_per_page_param
+      per_page = params[:per_page].to_i
+
+      case per_page
+      when 1..100
+        per_page
+      else
+        25
+      end
+    end
+end
diff --git a/app/controllers/api/v1/family_settings_controller.rb b/app/controllers/api/v1/family_settings_controller.rb
new file mode 100644
index 000000000..bf5ece2f3
--- /dev/null
+++ b/app/controllers/api/v1/family_settings_controller.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class Api::V1::FamilySettingsController < Api::V1::BaseController
+  before_action :ensure_read_scope
+
+  def show
+    @family = current_resource_owner.family
+  end
+
+  private
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+end
diff --git a/app/controllers/api/v1/holdings_controller.rb b/app/controllers/api/v1/holdings_controller.rb
index 58d094abd..7f08dfe3b 100644
--- a/app/controllers/api/v1/holdings_controller.rb
+++ b/app/controllers/api/v1/holdings_controller.rb
@@ -102,7 +102,7 @@ class Api::V1::HoldingsController < Api::V1::BaseController
       Rails.logger.error exception.backtrace.join("\n")
       render json: {
         error: "internal_server_error",
-        message: "Error: #{exception.message}"
+        message: "An unexpected error occurred"
       }, status: :internal_server_error
     end
 end
diff --git a/app/controllers/api/v1/imports_controller.rb b/app/controllers/api/v1/imports_controller.rb
index e6b78f8bd..5f1e9cf3e 100644
--- a/app/controllers/api/v1/imports_controller.rb
+++ b/app/controllers/api/v1/imports_controller.rb
@@ -4,9 +4,10 @@ class Api::V1::ImportsController < Api::V1::BaseController
   include Pagy::Backend
 
   # Ensure proper scope authorization
-  before_action :ensure_read_scope, only: [ :index, :show ]
+  before_action :ensure_read_scope, only: [ :index, :show, :rows, :preflight ]
   before_action :ensure_write_scope, only: [ :create ]
-  before_action :set_import, only: [ :show ]
+  before_action :set_import_with_rows, only: [ :show ]
+  before_action :set_import, only: [ :rows ]
 
   def index
     family = current_resource_owner.family
@@ -44,12 +45,29 @@ class Api::V1::ImportsController < Api::V1::BaseController
     render json: { error: "internal_server_error", message: e.message }, status: :internal_server_error
   end
 
+  def rows
+    @per_page = safe_per_page_param
+    @pagy, @rows = pagy(
+      @import.rows_ordered,
+      page: safe_page_param,
+      limit: @per_page
+    )
+    @rows.each(&:valid?)
+    @row_mapping_lookup = @import.mappings.includes(:mappable).index_by { |mapping| [ mapping.type, mapping.key.to_s ] }
+
+    render :rows
+  rescue StandardError => e
+    Rails.logger.error "ImportsController#rows error: #{e.message}"
+    render json: { error: "internal_server_error", message: e.message }, status: :internal_server_error
+  end
+
   def create
     family = current_resource_owner.family
 
     # 1. Determine type and validate
     type = params[:type].to_s
     type = "TransactionImport" unless Import::TYPES.include?(type)
+    return create_sure_import(family) if type == "SureImport"
 
     # 2. Build the import object with permitted config attributes
     @import = family.imports.build(import_config_params.merge(type: type))
@@ -59,10 +77,10 @@ class Api::V1::ImportsController < Api::V1::BaseController
     if params[:file].present?
       file = params[:file]
 
-      if file.size > Import::MAX_CSV_SIZE
+      if file.size > Import.max_csv_size
         return render json: {
           error: "file_too_large",
-          message: "File is too large. Maximum size is #{Import::MAX_CSV_SIZE / 1.megabyte}MB."
+          message: "File is too large. Maximum size is #{Import.max_csv_size / 1.megabyte}MB."
         }, status: :unprocessable_entity
       end
 
@@ -75,10 +93,10 @@ class Api::V1::ImportsController < Api::V1::BaseController
 
       @import.raw_file_str = file.read
     elsif params[:raw_file_content].present?
-      if params[:raw_file_content].bytesize > Import::MAX_CSV_SIZE
+      if params[:raw_file_content].bytesize > Import.max_csv_size
         return render json: {
           error: "content_too_large",
-          message: "Content is too large. Maximum size is #{Import::MAX_CSV_SIZE / 1.megabyte}MB."
+          message: "Content is too large. Maximum size is #{Import.max_csv_size / 1.megabyte}MB."
         }, status: :unprocessable_entity
       end
 
@@ -118,11 +136,49 @@ class Api::V1::ImportsController < Api::V1::BaseController
     render json: { error: "internal_server_error", message: e.message }, status: :internal_server_error
   end
 
+  def preflight
+    preflight_result = Import::Preflight.new(family: current_resource_owner.family, params: preflight_params).call
+    render json: preflight_result.payload, status: preflight_result.status
+  rescue ActiveRecord::RecordNotFound
+    render json: {
+      error: "record_not_found",
+      message: "The requested resource was not found"
+    }, status: :not_found
+  rescue CSV::MalformedCSVError => e
+    render json: {
+      error: "invalid_csv",
+      message: "CSV content could not be parsed",
+      errors: [ e.message ]
+    }, status: :unprocessable_entity
+  rescue StandardError => e
+    Rails.logger.error "ImportsController#preflight error: #{e.message}"
+    e.backtrace&.each { |line| Rails.logger.error line }
+
+    render json: {
+      error: "internal_server_error",
+      message: "Error: #{e.message}"
+    }, status: :internal_server_error
+  end
+
   private
 
     def set_import
-      @import = current_resource_owner.family.imports.includes(:rows).find(params[:id])
+      @import = import_scope.find(params[:id])
     rescue ActiveRecord::RecordNotFound
+      render_import_not_found
+    end
+
+    def set_import_with_rows
+      @import = import_scope.includes(:rows).find(params[:id])
+    rescue ActiveRecord::RecordNotFound
+      render_import_not_found
+    end
+
+    def import_scope
+      current_resource_owner.family.imports
+    end
+
+    def render_import_not_found
       render json: { error: "not_found", message: "Import not found" }, status: :not_found
     end
 
@@ -154,10 +210,160 @@ class Api::V1::ImportsController < Api::V1::BaseController
         :signage_convention,
         :col_sep,
         :amount_type_strategy,
-        :amount_type_inflow_value
+        :amount_type_inflow_value,
+        :rows_to_skip
       )
     end
 
+    def preflight_params
+      params.permit(*Import::Preflight::PARAM_KEYS)
+    end
+
+    def create_sure_import(family)
+      content, filename, content_type = sure_import_upload_attributes
+      return unless content
+
+      begin
+        @import = persist_sure_import!(family, content, filename, content_type)
+      rescue ActiveRecord::RecordInvalid => e
+        render json: {
+          error: "validation_failed",
+          message: "Import could not be created",
+          errors: e.record&.errors&.full_messages || @import&.errors&.full_messages || []
+        }, status: :unprocessable_entity
+        return
+      rescue StandardError => e
+        Rails.logger.error "Sure import creation failed: #{e.message}"
+        render json: {
+          error: "internal_server_error",
+          message: "Import could not be created"
+        }, status: :internal_server_error
+        return
+      end
+
+      begin
+        @import.publish_later if @import.publishable? && params[:publish] == "true"
+      rescue Import::MaxRowCountExceededError
+        render json: {
+          error: "max_row_count_exceeded",
+          message: "Import was uploaded but has too many rows to publish automatically.",
+          import_id: @import.id
+        }, status: :unprocessable_entity
+        return
+      rescue StandardError => e
+        Rails.logger.error "Sure import publish failed for import #{@import.id}: #{e.message}"
+        restore_pending_sure_import_after_publish_failure
+        render json: {
+          error: "publish_failed",
+          message: "Import was uploaded but could not be queued for processing.",
+          import_id: @import.id
+        }, status: :internal_server_error
+        return
+      end
+
+      render :show, status: :created
+    end
+
+    def persist_sure_import!(family, content, filename, content_type)
+      import = nil
+      import = family.imports.create!(type: "SureImport")
+      import.ndjson_file.attach(
+        io: StringIO.new(content),
+        filename: filename,
+        content_type: content_type
+      )
+      import.sync_ndjson_rows_count!
+      import
+    rescue StandardError => e
+      clean_up_failed_sure_import(import)
+      raise
+    end
+
+    def restore_pending_sure_import_after_publish_failure
+      # Import#publish_later flips status to importing before enqueueing the job.
+      @import.update_column(:status, "pending") if @import&.persisted? && @import.importing?
+    end
+
+    def clean_up_failed_sure_import(import)
+      return unless import
+
+      begin
+        import.ndjson_file.purge if import.ndjson_file.attached?
+      rescue StandardError => e
+        Rails.logger.warn "Failed to purge Sure import attachment #{import.id}: #{e.message}"
+      ensure
+        import.destroy if import.persisted?
+      end
+    end
+
+    def sure_import_upload_attributes
+      if params[:file].present?
+        sure_import_file_upload_attributes(params[:file])
+      elsif params[:raw_file_content].present?
+        sure_import_raw_content_attributes(params[:raw_file_content].to_s)
+      else
+        render json: {
+          error: "missing_content",
+          message: "Provide a Sure NDJSON file or raw_file_content."
+        }, status: :unprocessable_entity
+        nil
+      end
+    end
+
+    def sure_import_file_upload_attributes(file)
+      if file.size > SureImport.max_ndjson_size
+        render json: {
+          error: "file_too_large",
+          message: "File is too large. Maximum size is #{SureImport.max_ndjson_size / 1.megabyte}MB."
+        }, status: :unprocessable_entity
+        return
+      end
+
+      extension = File.extname(file.original_filename.to_s).downcase
+      unless SureImport::ALLOWED_NDJSON_CONTENT_TYPES.include?(file.content_type) || extension.in?(%w[.ndjson .json])
+        render json: {
+          error: "invalid_file_type",
+          message: "Invalid file type. Please upload a Sure NDJSON file."
+        }, status: :unprocessable_entity
+        return
+      end
+
+      content = file.read
+      sure_import_validated_attributes(
+        content: content,
+        filename: file.original_filename.presence || "sure-import.ndjson",
+        content_type: file.content_type.presence || "application/x-ndjson"
+      )
+    end
+
+    def sure_import_raw_content_attributes(content)
+      if content.bytesize > SureImport.max_ndjson_size
+        render json: {
+          error: "content_too_large",
+          message: "Content is too large. Maximum size is #{SureImport.max_ndjson_size / 1.megabyte}MB."
+        }, status: :unprocessable_entity
+        return
+      end
+
+      sure_import_validated_attributes(
+        content: content,
+        filename: "sure-import.ndjson",
+        content_type: "application/x-ndjson"
+      )
+    end
+
+    def sure_import_validated_attributes(content:, filename:, content_type:)
+      unless SureImport.valid_ndjson_first_line?(content)
+        render json: {
+          error: "invalid_ndjson",
+          message: "Invalid Sure NDJSON content."
+        }, status: :unprocessable_entity
+        return
+      end
+
+      [ content, filename, content_type ]
+    end
+
     def safe_page_param
       page = params[:page].to_i
       page > 0 ? page : 1
diff --git a/app/controllers/api/v1/provider_connections_controller.rb b/app/controllers/api/v1/provider_connections_controller.rb
new file mode 100644
index 000000000..11e0c6f7b
--- /dev/null
+++ b/app/controllers/api/v1/provider_connections_controller.rb
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+class Api::V1::ProviderConnectionsController < Api::V1::BaseController
+  before_action :ensure_read_scope
+
+  def index
+    @provider_connections = ProviderConnectionStatus.for_family(Current.family)
+    render :index
+  rescue StandardError => e
+    Rails.logger.error "ProviderConnectionsController#index error: #{e.message}"
+    e.backtrace&.each { |line| Rails.logger.error line }
+
+    render_json({
+      error: "internal_server_error",
+      message: "An unexpected error occurred"
+    }, status: :internal_server_error)
+  end
+
+  private
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+end
diff --git a/app/controllers/api/v1/recurring_transactions_controller.rb b/app/controllers/api/v1/recurring_transactions_controller.rb
new file mode 100644
index 000000000..9e56464c9
--- /dev/null
+++ b/app/controllers/api/v1/recurring_transactions_controller.rb
@@ -0,0 +1,275 @@
+# frozen_string_literal: true
+
+class Api::V1::RecurringTransactionsController < Api::V1::BaseController
+  include Pagy::Backend
+
+  before_action :ensure_read_scope, only: %i[index show]
+  before_action :ensure_write_scope, only: %i[create update destroy]
+  before_action :set_readable_recurring_transaction, only: :show
+  before_action :set_writable_recurring_transaction, only: %i[update destroy]
+
+  def index
+    return render_invalid_account_filter if params[:account_id].present? && !valid_uuid?(params[:account_id])
+
+    @per_page = safe_per_page_param
+    recurring_transactions_query = read_recurring_transactions_scope
+      .includes(:account, :merchant)
+      .order(status: :asc, next_expected_date: :asc)
+
+    recurring_transactions_query = apply_filters(recurring_transactions_query)
+
+    @pagy, @recurring_transactions = pagy(
+      recurring_transactions_query,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  rescue => e
+    Rails.logger.error "RecurringTransactionsController#index error: #{e.message}"
+    Rails.logger.error e.backtrace.join("\n")
+
+    render json: {
+      error: "internal_server_error",
+      message: "Internal server error"
+    }, status: :internal_server_error
+  end
+
+  def show
+    render :show
+  rescue => e
+    Rails.logger.error "RecurringTransactionsController#show error: #{e.message}"
+    Rails.logger.error e.backtrace.join("\n")
+
+    render json: {
+      error: "internal_server_error",
+      message: "Internal server error"
+    }, status: :internal_server_error
+  end
+
+  def create
+    @recurring_transaction = current_resource_owner.family.recurring_transactions.new(
+      recurring_transaction_create_attributes
+    )
+    validate_create_write_params(@recurring_transaction)
+
+    if @recurring_transaction.errors.empty? && @recurring_transaction.save
+      render :show, status: :created
+    else
+      render json: {
+        error: "validation_failed",
+        message: "Recurring transaction could not be created",
+        errors: @recurring_transaction.errors.full_messages
+      }, status: :unprocessable_entity
+    end
+  rescue ActiveRecord::RecordNotFound
+    raise
+  rescue ActionController::ParameterMissing, ArgumentError => e
+    render json: {
+      error: "validation_failed",
+      message: e.message
+    }, status: :unprocessable_entity
+  rescue ActiveRecord::RecordNotUnique
+    render json: {
+      error: "conflict",
+      message: "Recurring transaction already exists"
+    }, status: :conflict
+  rescue => e
+    Rails.logger.error "RecurringTransactionsController#create error: #{e.message}"
+    Rails.logger.error e.backtrace.join("\n")
+
+    render json: {
+      error: "internal_server_error",
+      message: "Internal server error"
+    }, status: :internal_server_error
+  end
+
+  def update
+    @recurring_transaction.assign_attributes(recurring_transaction_update_attributes)
+    validate_update_write_params(@recurring_transaction)
+
+    if @recurring_transaction.errors.empty? && @recurring_transaction.save
+      render :show
+    else
+      render json: {
+        error: "validation_failed",
+        message: "Recurring transaction could not be updated",
+        errors: @recurring_transaction.errors.full_messages
+      }, status: :unprocessable_entity
+    end
+  rescue ActiveRecord::RecordNotFound
+    raise
+  rescue ActionController::ParameterMissing, ArgumentError => e
+    render json: {
+      error: "validation_failed",
+      message: e.message
+    }, status: :unprocessable_entity
+  rescue ActiveRecord::RecordNotUnique
+    render json: {
+      error: "conflict",
+      message: "Recurring transaction already exists"
+    }, status: :conflict
+  rescue => e
+    Rails.logger.error "RecurringTransactionsController#update error: #{e.message}"
+    Rails.logger.error e.backtrace.join("\n")
+
+    render json: {
+      error: "internal_server_error",
+      message: "Internal server error"
+    }, status: :internal_server_error
+  end
+
+  def destroy
+    @recurring_transaction.destroy!
+
+    render json: { message: "Recurring transaction deleted successfully" }, status: :ok
+  rescue ActiveRecord::RecordNotFound
+    raise
+  rescue => e
+    Rails.logger.error "RecurringTransactionsController#destroy error: #{e.message}"
+    Rails.logger.error e.backtrace.join("\n")
+
+    render json: {
+      error: "internal_server_error",
+      message: "Internal server error"
+    }, status: :internal_server_error
+  end
+
+  private
+    def set_readable_recurring_transaction
+      @recurring_transaction = find_recurring_transaction(read_recurring_transactions_scope)
+    end
+
+    def set_writable_recurring_transaction
+      @recurring_transaction = find_recurring_transaction(write_recurring_transactions_scope)
+    end
+
+    def find_recurring_transaction(scope)
+      raise ActiveRecord::RecordNotFound unless valid_uuid?(params[:id])
+
+      scope.includes(:account, :merchant).find(params[:id])
+    end
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
+    def ensure_write_scope
+      authorize_scope!(:write)
+    end
+
+    def read_recurring_transactions_scope
+      current_resource_owner.family.recurring_transactions.accessible_by(current_resource_owner)
+    end
+
+    def write_recurring_transactions_scope
+      scope = current_resource_owner.family.recurring_transactions
+      writable_account_ids = current_resource_owner.family.accounts.writable_by(current_resource_owner).select(:id)
+      scope.where(account_id: writable_account_ids).or(scope.where(account_id: nil))
+    end
+
+    def apply_filters(query)
+      query = query.where(status: params[:status]) if params[:status].present?
+      if params[:account_id].present?
+        return query.none unless valid_uuid?(params[:account_id])
+
+        query = query.where(account_id: params[:account_id])
+      end
+      query
+    end
+
+    def recurring_transaction_create_attributes
+      attrs = recurring_transaction_create_params.to_h.symbolize_keys
+      attrs[:manual] = true if attrs[:manual].nil?
+      input = recurring_transaction_input
+
+      attrs[:account] = writable_account(input[:account_id]) if input.key?(:account_id)
+      attrs[:merchant] = family_merchant(input[:merchant_id]) if input.key?(:merchant_id)
+
+      attrs
+    end
+
+    def recurring_transaction_update_attributes
+      recurring_transaction_update_params.to_h.symbolize_keys
+    end
+
+    def writable_account(account_id)
+      return nil if account_id.blank?
+      raise ActiveRecord::RecordNotFound, "Account not found" unless valid_uuid?(account_id)
+
+      current_resource_owner.family.accounts.writable_by(current_resource_owner).find_by(id: account_id) ||
+        raise(ActiveRecord::RecordNotFound, "Account not found")
+    end
+
+    def family_merchant(merchant_id)
+      return nil if merchant_id.blank?
+      raise ActiveRecord::RecordNotFound, "Merchant not found" unless valid_uuid?(merchant_id)
+
+      current_resource_owner.family.merchants.find_by(id: merchant_id) ||
+        raise(ActiveRecord::RecordNotFound, "Merchant not found")
+    end
+
+    def validate_create_write_params(recurring_transaction)
+      input = recurring_transaction_input
+      recurring_transaction.errors.add(:last_occurrence_date, :blank) if input[:last_occurrence_date].blank?
+      recurring_transaction.errors.add(:next_expected_date, :blank) if input[:next_expected_date].blank?
+    end
+
+    def validate_update_write_params(recurring_transaction)
+      input = recurring_transaction_input
+      if input.key?(:next_expected_date) && input[:next_expected_date].blank?
+        recurring_transaction.errors.add(:next_expected_date, :blank)
+      end
+    end
+
+    def recurring_transaction_input
+      params.require(:recurring_transaction)
+    end
+
+    def render_invalid_account_filter
+      render json: {
+        error: "validation_failed",
+        message: "account_id must be a valid UUID"
+      }, status: :unprocessable_entity
+    end
+
+    def recurring_transaction_create_params
+      params.require(:recurring_transaction).permit(
+        :name,
+        :amount,
+        :currency,
+        :expected_day_of_month,
+        :last_occurrence_date,
+        :next_expected_date,
+        :status,
+        :occurrence_count,
+        :manual,
+        :expected_amount_min,
+        :expected_amount_max,
+        :expected_amount_avg
+      )
+    end
+
+    def recurring_transaction_update_params
+      params.require(:recurring_transaction).permit(
+        :status,
+        :expected_day_of_month,
+        :next_expected_date
+      )
+    end
+
+    def safe_page_param
+      page = params[:page].to_i
+      page > 0 ? page : 1
+    end
+
+    def safe_per_page_param
+      per_page = params[:per_page].to_i
+      case per_page
+      when 1..100
+        per_page
+      else
+        25
+      end
+    end
+end
diff --git a/app/controllers/api/v1/rejected_transfers_controller.rb b/app/controllers/api/v1/rejected_transfers_controller.rb
new file mode 100644
index 000000000..e341341bd
--- /dev/null
+++ b/app/controllers/api/v1/rejected_transfers_controller.rb
@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+class Api::V1::RejectedTransfersController < Api::V1::BaseController
+  include Pagy::Backend
+  include Api::V1::TransferDecisionFiltering
+
+  before_action :ensure_read_scope
+  before_action :set_rejected_transfer, only: :show
+
+  def index
+    rejected_transfers_query = apply_transfer_decision_filters(rejected_transfers_scope).order(created_at: :desc)
+    @per_page = safe_per_page_param
+
+    @pagy, @rejected_transfers = pagy(
+      rejected_transfers_query,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  rescue Api::V1::TransferDecisionFiltering::InvalidFilterError => e
+    render_validation_error(e.message)
+  end
+
+  def show
+    render :show
+  end
+
+  private
+
+    def set_rejected_transfer
+      raise ActiveRecord::RecordNotFound unless valid_uuid?(params[:id])
+
+      @rejected_transfer = rejected_transfers_scope.find(params[:id])
+    end
+
+    def rejected_transfers_scope
+      transfer_decision_scope(RejectedTransfer)
+    end
+end
diff --git a/app/controllers/api/v1/rule_runs_controller.rb b/app/controllers/api/v1/rule_runs_controller.rb
new file mode 100644
index 000000000..4aeae3a62
--- /dev/null
+++ b/app/controllers/api/v1/rule_runs_controller.rb
@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+class Api::V1::RuleRunsController < Api::V1::BaseController
+  include Pagy::Backend
+
+  STATUSES = %w[pending success failed].freeze
+  EXECUTION_TYPES = %w[manual scheduled].freeze
+  InvalidFilterError = Class.new(StandardError)
+
+  before_action :ensure_read_scope
+  before_action :set_rule_run, only: :show
+
+  def index
+    rule_runs_query = apply_filters(rule_runs_scope).recent
+    @per_page = safe_per_page_param
+
+    @pagy, @rule_runs = pagy(
+      rule_runs_query,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  rescue InvalidFilterError => e
+    render_validation_error(e.message)
+  end
+
+  def show
+    render :show
+  end
+
+  private
+
+    def set_rule_run
+      raise ActiveRecord::RecordNotFound, "Rule run not found" unless valid_uuid?(params[:id])
+
+      @rule_run = rule_runs_scope.find(params[:id])
+    end
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
+    def rule_runs_scope
+      RuleRun
+        .joins(:rule)
+        .where(rules: { family_id: Current.family.id })
+        .includes(:rule)
+    end
+
+    def apply_filters(query)
+      if params[:rule_id].present?
+        raise InvalidFilterError, "rule_id must be a valid UUID" unless valid_uuid?(params[:rule_id])
+
+        query = query.where(rule_id: params[:rule_id])
+      end
+
+      if params[:status].present?
+        raise InvalidFilterError, "status must be one of: #{STATUSES.join(', ')}" unless STATUSES.include?(params[:status])
+
+        query = query.where(status: params[:status])
+      end
+
+      if params[:execution_type].present?
+        unless EXECUTION_TYPES.include?(params[:execution_type])
+          raise InvalidFilterError, "execution_type must be one of: #{EXECUTION_TYPES.join(', ')}"
+        end
+
+        query = query.where(execution_type: params[:execution_type])
+      end
+
+      query = query.where("rule_runs.executed_at >= ?", parse_time_param(:start_executed_at)) if params[:start_executed_at].present?
+      query = query.where("rule_runs.executed_at <= ?", parse_time_param(:end_executed_at)) if params[:end_executed_at].present?
+      query
+    end
+
+    def parse_time_param(key)
+      Time.iso8601(params[key].to_s)
+    rescue ArgumentError
+      raise InvalidFilterError, "#{key} must be an ISO 8601 timestamp"
+    end
+end
diff --git a/app/controllers/api/v1/rules_controller.rb b/app/controllers/api/v1/rules_controller.rb
new file mode 100644
index 000000000..06b9f753a
--- /dev/null
+++ b/app/controllers/api/v1/rules_controller.rb
@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+class Api::V1::RulesController < Api::V1::BaseController
+  include Pagy::Backend
+
+  BOOLEAN_FILTERS = {
+    "true" => true,
+    "1" => true,
+    "false" => false,
+    "0" => false
+  }.freeze
+  RESOURCE_TYPES = %w[transaction].freeze
+
+  before_action :ensure_read_scope
+  before_action :set_rule, only: :show
+
+  def index
+    return render_invalid_resource_type_filter if invalid_resource_type_filter?
+
+    @per_page = safe_per_page_param
+    rules_query = current_resource_owner.family.rules
+      .includes(:actions, conditions: :sub_conditions)
+      .order(:created_at, :id)
+
+    rules_query = rules_query.where(resource_type: params[:resource_type]) if params[:resource_type].present?
+    if params[:active].present?
+      active = parse_boolean_filter(params[:active])
+      return if performed?
+
+      rules_query = rules_query.where(active: active)
+    end
+
+    @pagy, @rules = pagy(
+      rules_query,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  end
+
+  def show
+    render :show
+  end
+
+  private
+
+    def set_rule
+      @rule = current_resource_owner.family.rules
+        .includes(:actions, conditions: :sub_conditions)
+        .find(params[:id])
+    end
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
+    def parse_boolean_filter(value)
+      normalized = value.to_s.downcase
+      return BOOLEAN_FILTERS[normalized] if BOOLEAN_FILTERS.key?(normalized)
+
+      render_validation_error("active must be one of: true, false, 1, 0")
+      nil
+    end
+
+    def invalid_resource_type_filter?
+      params[:resource_type].present? && !params[:resource_type].in?(RESOURCE_TYPES)
+    end
+
+    def render_invalid_resource_type_filter
+      render_validation_error("resource_type must be one of: #{RESOURCE_TYPES.join(", ")}")
+    end
+end
diff --git a/app/controllers/api/v1/securities_controller.rb b/app/controllers/api/v1/securities_controller.rb
new file mode 100644
index 000000000..bc0715d10
--- /dev/null
+++ b/app/controllers/api/v1/securities_controller.rb
@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+class Api::V1::SecuritiesController < Api::V1::BaseController
+  include Pagy::Backend
+  include Api::V1::SecurityResourceFiltering
+
+  before_action :ensure_read_scope
+  before_action :set_security, only: :show
+
+  def index
+    securities_query = apply_filters(securities_scope).order(:ticker, :exchange_operating_mic, :name)
+    @per_page = safe_per_page_param
+
+    @pagy, @securities = pagy(
+      securities_query,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  rescue Api::V1::SecurityResourceFiltering::InvalidFilterError => e
+    render_validation_error(e.message)
+  end
+
+  def show
+    render :show
+  end
+
+  private
+
+    def set_security
+      raise ActiveRecord::RecordNotFound, "Security not found" unless valid_uuid?(params[:id])
+
+      @security = securities_scope.find(params[:id])
+    end
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
+    def securities_scope
+      Security
+        .where(id: scoped_security_ids)
+    end
+
+    def apply_filters(query)
+      query = query.where("LOWER(securities.ticker) = ?", params[:ticker].to_s.strip.downcase) if params[:ticker].present?
+      query = query.where(exchange_operating_mic: params[:exchange_operating_mic].to_s.strip.upcase) if params[:exchange_operating_mic].present?
+      if params[:kind].present?
+        invalid_filter!("kind must be one of: #{Security::KINDS.join(', ')}") unless Security::KINDS.include?(params[:kind])
+
+        query = query.where(kind: params[:kind])
+      end
+      if params.key?(:offline)
+        offline = parse_boolean_filter_param(:offline)
+        query = query.where(offline: offline)
+      end
+      query
+    end
+end
diff --git a/app/controllers/api/v1/security_prices_controller.rb b/app/controllers/api/v1/security_prices_controller.rb
new file mode 100644
index 000000000..5463f0f97
--- /dev/null
+++ b/app/controllers/api/v1/security_prices_controller.rb
@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+class Api::V1::SecurityPricesController < Api::V1::BaseController
+  include Pagy::Backend
+  include Api::V1::SecurityResourceFiltering
+
+  before_action :ensure_read_scope
+  before_action :set_security_price, only: :show
+
+  def index
+    security_prices_query = apply_filters(security_prices_scope).order(date: :desc, created_at: :desc)
+    @per_page = safe_per_page_param
+
+    @pagy, @security_prices = pagy(
+      security_prices_query,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  rescue Api::V1::SecurityResourceFiltering::InvalidFilterError => e
+    render_validation_error(e.message)
+  end
+
+  def show
+    render :show
+  end
+
+  private
+
+    def set_security_price
+      raise ActiveRecord::RecordNotFound, "Security price not found" unless valid_uuid?(params[:id])
+
+      @security_price = security_prices_scope.find(params[:id])
+    end
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
+    def security_prices_scope
+      Security::Price
+        .where(security_id: scoped_security_ids)
+        .includes(:security)
+    end
+
+    def apply_filters(query)
+      if params[:security_id].present?
+        invalid_filter!("security_id must be a valid UUID") unless valid_uuid?(params[:security_id])
+
+        query = query.where(security_id: params[:security_id])
+      end
+
+      query = query.where(currency: params[:currency].to_s.strip.upcase) if params[:currency].present?
+      query = query.where("security_prices.date >= ?", parse_date_param(:start_date)) if params[:start_date].present?
+      query = query.where("security_prices.date <= ?", parse_date_param(:end_date)) if params[:end_date].present?
+      if params.key?(:provisional)
+        provisional = parse_boolean_filter_param(:provisional)
+        query = query.where(provisional: provisional)
+      end
+      query
+    end
+end
diff --git a/app/controllers/api/v1/sync_controller.rb b/app/controllers/api/v1/sync_controller.rb
index b5f89fb60..add56fd44 100644
--- a/app/controllers/api/v1/sync_controller.rb
+++ b/app/controllers/api/v1/sync_controller.rb
@@ -21,7 +21,7 @@ class Api::V1::SyncController < Api::V1::BaseController
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
diff --git a/app/controllers/api/v1/syncs_controller.rb b/app/controllers/api/v1/syncs_controller.rb
new file mode 100644
index 000000000..401362392
--- /dev/null
+++ b/app/controllers/api/v1/syncs_controller.rb
@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+class Api::V1::SyncsController < Api::V1::BaseController
+  include Pagy::Backend
+
+  before_action :ensure_read_scope
+  before_action :set_sync, only: [ :show ]
+
+  def index
+    @per_page = safe_per_page_param
+    @pagy, @syncs = pagy(
+      family_syncs_query.preload(:syncable, :children).ordered,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  end
+
+  def latest
+    @sync = family_syncs_query.preload(:syncable, :children).ordered.first
+    return render json: { data: nil } unless @sync
+
+    render :show
+  end
+
+  def show
+    render :show
+  end
+
+  private
+
+    def set_sync
+      raise ActiveRecord::RecordNotFound unless valid_uuid?(params[:id])
+
+      @sync = family_syncs_query.preload(:syncable, :children).find(params[:id])
+    end
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
+    def family_syncs_query
+      Sync.for_family(Current.family, resource_owner: Current.user)
+    end
+end
diff --git a/app/controllers/api/v1/trades_controller.rb b/app/controllers/api/v1/trades_controller.rb
index 8f442c81a..0538fe321 100644
--- a/app/controllers/api/v1/trades_controller.rb
+++ b/app/controllers/api/v1/trades_controller.rb
@@ -292,7 +292,7 @@ class Api::V1::TradesController < Api::V1::BaseController
       Rails.logger.error exception.backtrace.join("\n")
       render json: {
         error: "internal_server_error",
-        message: "Error: #{exception.message}"
+        message: "An unexpected error occurred"
       }, status: :internal_server_error
     end
 
diff --git a/app/controllers/api/v1/transactions_controller.rb b/app/controllers/api/v1/transactions_controller.rb
index b5942b7fc..f208d83b2 100644
--- a/app/controllers/api/v1/transactions_controller.rb
+++ b/app/controllers/api/v1/transactions_controller.rb
@@ -10,8 +10,11 @@ class Api::V1::TransactionsController < Api::V1::BaseController
 
   def index
     family = current_resource_owner.family
-    accessible_account_ids = family.accounts.accessible_by(current_resource_owner).select(:id)
-    transactions_query = family.transactions.visible
+    accessible_account_ids = family.accounts
+      .accessible_by(current_resource_owner)
+      .where.not(status: "pending_deletion")
+      .select(:id)
+    transactions_query = family.transactions
       .joins(:entry).where(entries: { account_id: accessible_account_ids })
 
     # Apply filters
@@ -47,7 +50,7 @@ class Api::V1::TransactionsController < Api::V1::BaseController
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
@@ -61,7 +64,7 @@ class Api::V1::TransactionsController < Api::V1::BaseController
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
@@ -69,7 +72,7 @@ class Api::V1::TransactionsController < Api::V1::BaseController
     family = current_resource_owner.family
 
     # Validate account_id is present
-    unless transaction_params[:account_id].present?
+    unless account_id_param.present?
       render json: {
         error: "validation_failed",
         message: "Account ID is required",
@@ -78,7 +81,21 @@ class Api::V1::TransactionsController < Api::V1::BaseController
       return
     end
 
-    account = family.accounts.writable_by(current_resource_owner).find(transaction_params[:account_id])
+    if idempotency_source_param.present? && idempotency_external_id.blank?
+      render json: {
+        error: "validation_failed",
+        message: "Source requires external_id",
+        errors: [ "Source requires external_id" ]
+      }, status: :unprocessable_entity
+      return
+    end
+
+    account = family.accounts.writable_by(current_resource_owner).find(account_id_param)
+
+    if idempotency_key_requested? && (existing_entry = existing_idempotent_entry(account))
+      return render_existing_idempotent_entry(existing_entry)
+    end
+
     @entry = account.entries.new(entry_params_for_create)
 
     if @entry.save
@@ -96,13 +113,19 @@ class Api::V1::TransactionsController < Api::V1::BaseController
       }, status: :unprocessable_entity
     end
 
+  rescue ActiveRecord::RecordNotUnique
+    if idempotency_key_requested? && account && (existing_entry = existing_idempotent_entry(account))
+      render_existing_idempotent_entry(existing_entry)
+    else
+      raise
+    end
   rescue => e
     Rails.logger.error "TransactionsController#create error: #{e.message}"
     Rails.logger.error e.backtrace.join("\n")
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
 end
 
@@ -148,7 +171,7 @@ end
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
@@ -171,13 +194,15 @@ end
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
   private
 
     def set_transaction
+      raise ActiveRecord::RecordNotFound unless valid_uuid?(params[:id])
+
       family = current_resource_owner.family
       @transaction = family.transactions
         .joins(entry: :account)
@@ -282,11 +307,15 @@ end
 
     def transaction_params
       params.require(:transaction).permit(
-        :account_id, :date, :amount, :name, :description, :notes, :currency,
+        :date, :amount, :name, :description, :notes, :currency,
         :category_id, :merchant_id, :nature, tag_ids: []
       )
     end
 
+    def account_id_param
+      params.dig(:transaction, :account_id).presence
+    end
+
     def entry_params_for_create
       entry_params = {
         name: transaction_params[:name] || transaction_params[:description],
@@ -301,6 +330,10 @@ end
           tag_ids: transaction_params[:tag_ids] || []
         }
       }
+      if idempotency_key_requested?
+        entry_params[:external_id] = idempotency_external_id
+        entry_params[:source] = idempotency_source
+      end
 
       entry_params.compact
     end
@@ -339,6 +372,49 @@ end
         params.dig(:transaction, :nature).present?
     end
 
+    def idempotency_key_requested?
+      idempotency_external_id.present?
+    end
+
+    def idempotency_external_id
+      idempotency_param_value(:external_id)
+    end
+
+    def idempotency_source
+      idempotency_source_param.presence || "api"
+    end
+
+    def idempotency_source_param
+      idempotency_param_value(:source)
+    end
+
+    def idempotency_param_value(key)
+      value = params.dig(:transaction, key)
+      value.to_s.presence if value.is_a?(String) || value.is_a?(Numeric)
+    end
+
+    def existing_idempotent_entry(account)
+      account.entries.find_by(
+        external_id: idempotency_external_id,
+        source: idempotency_source
+      )
+    end
+
+    def render_existing_idempotent_entry(entry)
+      unless entry.entryable.is_a?(Transaction)
+        render json: {
+          error: "validation_failed",
+          message: "External ID already exists for a non-transaction entry",
+          errors: [ "External ID already exists for a non-transaction entry" ]
+        }, status: :unprocessable_entity
+        return
+      end
+
+      @entry = entry
+      @transaction = entry.transaction
+      render :show, status: :ok
+    end
+
     def calculate_signed_amount
       amount = transaction_params[:amount].to_f
       nature = transaction_params[:nature]
diff --git a/app/controllers/api/v1/transfers_controller.rb b/app/controllers/api/v1/transfers_controller.rb
new file mode 100644
index 000000000..bfbfe9c68
--- /dev/null
+++ b/app/controllers/api/v1/transfers_controller.rb
@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+class Api::V1::TransfersController < Api::V1::BaseController
+  include Pagy::Backend
+  include Api::V1::TransferDecisionFiltering
+
+  before_action :ensure_read_scope
+  before_action :set_transfer, only: :show
+
+  def index
+    transfers_query = apply_transfer_decision_filters(transfers_scope, status_model: Transfer).order(created_at: :desc)
+    @per_page = safe_per_page_param
+
+    @pagy, @transfers = pagy(
+      transfers_query,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  rescue Api::V1::TransferDecisionFiltering::InvalidFilterError => e
+    render_validation_error(e.message)
+  end
+
+  def show
+    render :show
+  end
+
+  private
+
+    def set_transfer
+      raise ActiveRecord::RecordNotFound unless valid_uuid?(params[:id])
+
+      @transfer = transfers_scope.find(params[:id])
+    end
+
+    def transfers_scope
+      transfer_decision_scope(Transfer)
+    end
+end
diff --git a/app/controllers/api/v1/users_controller.rb b/app/controllers/api/v1/users_controller.rb
index 0a87bf43e..121fded34 100644
--- a/app/controllers/api/v1/users_controller.rb
+++ b/app/controllers/api/v1/users_controller.rb
@@ -1,12 +1,44 @@
 # frozen_string_literal: true
 
 class Api::V1::UsersController < Api::V1::BaseController
-  before_action :ensure_write_scope
-  before_action :ensure_admin, only: :reset
+  before_action :ensure_read_scope, only: :reset_status
+  before_action :ensure_write_scope, except: :reset_status
+  before_action :ensure_admin, only: %i[reset reset_status]
 
   def reset
-    FamilyResetJob.perform_later(Current.family)
-    render json: { message: "Account reset has been initiated" }
+    family = current_resource_owner.family
+    begin
+      job = FamilyResetJob.perform_later(family)
+    rescue StandardError => e
+      Rails.logger.error "Failed to enqueue FamilyResetJob for family #{family.id}: #{e.message}"
+
+      render json: {
+        error: "reset_enqueue_failed",
+        message: "Account reset could not be queued"
+      }, status: :internal_server_error
+      return
+    end
+
+    render json: {
+      message: "Account reset has been initiated",
+      status: "queued",
+      job_id: job.job_id,
+      family_id: family.id,
+      status_url: api_v1_users_reset_status_path
+    }
+  end
+
+  def reset_status
+    family = current_resource_owner.family
+    counts = reset_target_counts(family)
+    reset_complete = counts.values.sum.zero?
+
+    render json: {
+      status: reset_complete ? "complete" : "data_remaining",
+      family_id: family.id,
+      reset_complete: reset_complete,
+      counts: counts
+    }
   end
 
   def destroy
@@ -26,10 +58,26 @@ class Api::V1::UsersController < Api::V1::BaseController
       authorize_scope!(:write)
     end
 
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
     def ensure_admin
       return true if current_resource_owner&.admin?
 
-      render_json({ error: "forbidden", message: I18n.t("users.reset.unauthorized") }, status: :forbidden)
+      render_json({ error: "forbidden", message: "You are not authorized to perform this action" }, status: :forbidden)
       false
     end
+
+    def reset_target_counts(family)
+      {
+        accounts: family.accounts.count,
+        categories: family.categories.count,
+        tags: family.tags.count,
+        merchants: family.merchants.count,
+        plaid_items: family.plaid_items.count,
+        imports: family.imports.count,
+        budgets: family.budgets.count
+      }
+    end
 end
diff --git a/app/controllers/api/v1/valuations_controller.rb b/app/controllers/api/v1/valuations_controller.rb
index 633a90461..24c9cfd21 100644
--- a/app/controllers/api/v1/valuations_controller.rb
+++ b/app/controllers/api/v1/valuations_controller.rb
@@ -1,10 +1,48 @@
 # frozen_string_literal: true
 
 class Api::V1::ValuationsController < Api::V1::BaseController
-  before_action :ensure_read_scope, only: [ :show ]
+  include Pagy::Backend
+
+  InvalidFilterError = Class.new(StandardError)
+  BOOLEAN_PARAM = ActiveModel::Type::Boolean.new
+
+  before_action :ensure_read_scope, only: [ :index, :show ]
   before_action :ensure_write_scope, only: [ :create, :update ]
   before_action :set_valuation, only: [ :show, :update ]
 
+  def index
+    family = current_resource_owner.family
+    accessible_account_ids = family.accounts.accessible_by(current_resource_owner).select(:id)
+    valuations_query = family.entries
+      .where(entryable_type: "Valuation", account_id: accessible_account_ids)
+      .includes(:account, :entryable)
+
+    valuations_query = apply_filters(valuations_query).reverse_chronological
+    @per_page = safe_per_page_param
+
+    @pagy, @entries = pagy(
+      valuations_query,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  rescue InvalidFilterError => e
+    render json: {
+      error: "validation_failed",
+      message: e.message,
+      errors: [ e.message ]
+    }, status: :unprocessable_entity
+  rescue => e
+    Rails.logger.error "ValuationsController#index error: #{e.message}"
+    Rails.logger.error e.backtrace.join("\n")
+
+    render json: {
+      error: "internal_server_error",
+      message: "An unexpected error occurred"
+    }, status: :internal_server_error
+  end
+
   def show
     render :show
   rescue => e
@@ -13,7 +51,7 @@ class Api::V1::ValuationsController < Api::V1::BaseController
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
@@ -46,11 +84,17 @@ class Api::V1::ValuationsController < Api::V1::BaseController
     end
 
     account = current_resource_owner.family.accounts.find(valuation_account_id)
+    requested_upsert = upsert_requested?
+    existing_write = false
 
     create_success = false
     error_payload = nil
 
     ActiveRecord::Base.transaction do
+      account.lock! if requested_upsert
+      existing_write = account.entries.valuations.exists?(date: valuation_params[:date]) if requested_upsert
+
+      # upsert=true only affects response status; reconciliation owns write behavior.
       result = account.create_reconciliation(
         balance: valuation_params[:amount],
         date: valuation_params[:date]
@@ -87,7 +131,7 @@ class Api::V1::ValuationsController < Api::V1::BaseController
       return
     end
 
-    render :show, status: :created
+    render :show, status: requested_upsert && existing_write ? :ok : :created
 
   rescue ActiveRecord::RecordNotFound
     render json: {
@@ -100,7 +144,7 @@ class Api::V1::ValuationsController < Api::V1::BaseController
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
@@ -181,7 +225,7 @@ class Api::V1::ValuationsController < Api::V1::BaseController
 
     render json: {
       error: "internal_server_error",
-      message: "Error: #{e.message}"
+      message: "An unexpected error occurred"
     }, status: :internal_server_error
   end
 
@@ -208,6 +252,39 @@ class Api::V1::ValuationsController < Api::V1::BaseController
       authorize_scope!(:write)
     end
 
+    def apply_filters(query)
+      if params[:account_id].present?
+        raise InvalidFilterError, "account_id must be a valid UUID" unless valid_uuid?(params[:account_id])
+
+        query = query.where(account_id: params[:account_id])
+      end
+      query = query.where("entries.date >= ?", parse_date_param(:start_date)) if params[:start_date].present?
+      query = query.where("entries.date <= ?", parse_date_param(:end_date)) if params[:end_date].present?
+      query
+    end
+
+    def parse_date_param(key)
+      Date.iso8601(params[key].to_s)
+    rescue ArgumentError
+      raise InvalidFilterError, "#{key} must be an ISO 8601 date"
+    end
+
+    def safe_page_param
+      page = params[:page].to_i
+      page > 0 ? page : 1
+    end
+
+    def safe_per_page_param
+      per_page = params[:per_page].to_i
+
+      case per_page
+      when 1..100
+        per_page
+      else
+        25
+      end
+    end
+
     def valuation_account_id
       params.dig(:valuation, :account_id)
     end
@@ -215,4 +292,10 @@ class Api::V1::ValuationsController < Api::V1::BaseController
     def valuation_params
       params.require(:valuation).permit(:amount, :date, :notes)
     end
+
+    def upsert_requested?
+      raw_value = params.key?(:upsert) ? params[:upsert] : params.dig(:valuation, :upsert)
+
+      BOOLEAN_PARAM.cast(raw_value)
+    end
 end
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 7604ed654..7306d504f 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -1,7 +1,8 @@
 class ApplicationController < ActionController::Base
   include RestoreLayoutPreferences, Onboardable, Localize, AutoSync, Authentication, Invitable,
           SelfHostable, StoreLocation, Impersonatable, Breadcrumbable,
-          FeatureGuardable, Notifiable, SafePagination, AccountAuthorizable
+          FeatureGuardable, Notifiable, SafePagination, AccountAuthorizable,
+          PreviewGateable
   include Pundit::Authorization
 
   include Pagy::Backend
diff --git a/app/controllers/brex_items/account_flows_controller.rb b/app/controllers/brex_items/account_flows_controller.rb
new file mode 100644
index 000000000..1a240708b
--- /dev/null
+++ b/app/controllers/brex_items/account_flows_controller.rb
@@ -0,0 +1,132 @@
+class BrexItems::AccountFlowsController < ApplicationController
+  before_action :require_admin!
+
+  def preload_accounts
+    render json: brex_account_flow.preload_payload
+  end
+
+  def select_accounts
+    @accountable_type = params[:accountable_type] || "Depository"
+    @return_to = safe_return_to_path
+    result = brex_account_flow.select_accounts_result(accountable_type: @accountable_type)
+
+    return handle_brex_selection_result(result, empty_path: new_account_path, api_return_path: @return_to) unless result.success?
+
+    @brex_item = result.brex_item
+    @available_accounts = result.available_accounts
+
+    render "brex_items/select_accounts", layout: false
+  end
+
+  def link_accounts
+    result = brex_account_flow.link_new_accounts_result(
+      account_ids: params[:account_ids] || [],
+      accountable_type: params[:accountable_type] || "Depository"
+    )
+
+    redirect_with_navigation(result, return_to: safe_return_to_path)
+  end
+
+  def select_existing_account
+    return redirect_to accounts_path, alert: t("brex_items.select_existing_account.no_account_specified") if params[:account_id].blank?
+
+    @account = Current.family.accounts.find_by(id: params[:account_id])
+    return redirect_to accounts_path, alert: t("brex_items.select_existing_account.no_account_specified") unless @account
+
+    result = brex_account_flow.select_existing_account_result(account: @account)
+
+    return handle_brex_selection_result(result, empty_path: accounts_path, api_return_path: accounts_path) unless result.success?
+
+    @brex_item = result.brex_item
+    @available_accounts = result.available_accounts
+    @return_to = safe_return_to_path
+
+    render "brex_items/select_existing_account", layout: false
+  end
+
+  def link_existing_account
+    return redirect_to accounts_path, alert: t("brex_items.link_existing_account.no_account_specified") if params[:account_id].blank?
+
+    account = Current.family.accounts.find_by(id: params[:account_id])
+    return redirect_to accounts_path, alert: t("brex_items.link_existing_account.no_account_specified") unless account
+
+    result = brex_account_flow.link_existing_account_result(
+      account: account,
+      brex_account_id: params[:brex_account_id]
+    )
+
+    redirect_with_navigation(result, return_to: safe_return_to_path)
+  end
+
+  private
+
+    def brex_account_flow
+      @brex_account_flow ||= BrexItem::AccountFlow.new(family: Current.family, brex_item_id: params[:brex_item_id])
+    end
+
+    def handle_brex_selection_result(result, empty_path:, api_return_path:)
+      case result.status
+      when :empty, :account_already_linked
+        redirect_to empty_path, alert: result.message
+      when :no_api_token, :select_connection
+        redirect_to settings_providers_path, alert: result.message
+      when :setup_required
+        if turbo_frame_request?
+          render partial: "brex_items/setup_required", layout: false
+        else
+          redirect_to settings_providers_path, alert: result.message
+        end
+      when :api_error, :unexpected_error
+        render_api_error_partial(result.message, api_return_path)
+      else
+        redirect_to settings_providers_path, alert: result.message
+      end
+    end
+
+    def redirect_with_navigation(result, return_to:)
+      redirect_to navigation_path_for(result.target, return_to: return_to), result.flash_type => result.message
+    end
+
+    def navigation_path_for(target, return_to:)
+      {
+        new_account: new_account_path,
+        settings_providers: settings_providers_path,
+        return_to_or_accounts: return_to || accounts_path
+      }.fetch(target, accounts_path)
+    end
+
+    def render_api_error_partial(error_message, return_path)
+      render partial: "brex_items/api_error", locals: { error_message: error_message, return_path: return_path }, layout: false
+    end
+
+    def safe_return_to_path
+      return nil if params[:return_to].blank?
+
+      return_to = params[:return_to].to_s.strip
+      return nil unless return_to.start_with?("/")
+
+      second_character = return_to[1]
+      return nil if second_character.blank?
+      return nil if second_character == "/" || second_character == "\\"
+      return nil if second_character.match?(/[[:space:][:cntrl:]]/)
+      return nil if encoded_path_separator?(return_to)
+
+      uri = URI.parse(return_to)
+
+      return nil if uri.scheme.present? || uri.host.present?
+
+      return_to
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    def encoded_path_separator?(return_to)
+      encoded_second_character = return_to[1, 3]
+      return false unless encoded_second_character&.start_with?("%")
+
+      decoded = URI.decode_www_form_component(encoded_second_character)
+      decoded == "/" || decoded == "\\"
+    rescue ArgumentError
+      false
+    end
+end
diff --git a/app/controllers/brex_items/account_setups_controller.rb b/app/controllers/brex_items/account_setups_controller.rb
new file mode 100644
index 000000000..45678aef0
--- /dev/null
+++ b/app/controllers/brex_items/account_setups_controller.rb
@@ -0,0 +1,109 @@
+class BrexItems::AccountSetupsController < ApplicationController
+  before_action :require_admin!
+  before_action :set_brex_item
+
+  def setup_accounts
+    flow = brex_account_flow
+    @api_error = flow.import_accounts_with_user_facing_error
+    @brex_accounts = flow.unlinked_brex_accounts
+    @account_type_options = flow.account_type_options
+    @displayable_account_type_options = flow.displayable_account_type_options
+    @subtype_options = flow.subtype_options
+
+    render "brex_items/setup_accounts"
+  end
+
+  def complete_account_setup
+    result = brex_account_flow.complete_setup_result(
+      account_types: sanitized_account_types,
+      account_subtypes: sanitized_account_subtypes
+    )
+
+    unless result.success?
+      redirect_to accounts_path, alert: result.message, status: :see_other
+      return
+    end
+
+    flash[:notice] = result.message
+
+    if turbo_frame_request?
+      render_accounts_update_after_setup
+    else
+      redirect_to accounts_path, status: :see_other
+    end
+  end
+
+  private
+
+    def set_brex_item
+      @brex_item = Current.family.brex_items.find(params[:id])
+    end
+
+    def brex_account_flow
+      @brex_account_flow ||= BrexItem::AccountFlow.new(family: Current.family, brex_item: @brex_item)
+    end
+
+    def render_accounts_update_after_setup
+      @manual_accounts = Account.uncached { Current.family.accounts.visible_manual.order(:name).to_a }
+      @brex_items = Current.family.brex_items.ordered
+
+      manual_accounts_stream = if @manual_accounts.any?
+        turbo_stream.update(
+          "manual-accounts",
+          partial: "accounts/index/manual_accounts",
+          locals: { accounts: @manual_accounts }
+        )
+      else
+        turbo_stream.replace("manual-accounts", view_context.tag.div(id: "manual-accounts"))
+      end
+
+      render turbo_stream: [
+        manual_accounts_stream,
+        turbo_stream.replace(
+          ActionView::RecordIdentifier.dom_id(@brex_item),
+          partial: "brex_items/brex_item",
+          locals: { brex_item: @brex_item }
+        )
+      ] + Array(flash_notification_stream_items)
+    end
+
+    def sanitized_account_types
+      supported_types = Provider::BrexAdapter.supported_account_types
+
+      setup_param_hash(:account_types, allowed_account_ids).each_with_object({}) do |(account_id, selected_type), sanitized|
+        next unless allowed_account_ids.include?(account_id.to_s)
+
+        normalized_type = selected_type.to_s
+        sanitized[account_id.to_s] = supported_types.include?(normalized_type) ? normalized_type : "skip"
+      end
+    end
+
+    def sanitized_account_subtypes
+      allowed_subtypes = (Depository::SUBTYPES.keys + CreditCard::SUBTYPES.keys).map(&:to_s)
+
+      setup_param_hash(:account_subtypes, allowed_account_ids).each_with_object({}) do |(account_id, selected_subtype), sanitized|
+        next unless allowed_account_ids.include?(account_id.to_s)
+        next if selected_subtype.blank?
+        next unless allowed_subtypes.include?(selected_subtype.to_s)
+
+        sanitized[account_id.to_s] = selected_subtype.to_s
+      end
+    end
+
+    def setup_param_hash(key, allowed_keys)
+      raw_params = params.fetch(key, {})
+      return {} if raw_params.blank?
+
+      if raw_params.is_a?(ActionController::Parameters)
+        raw_params.permit(*allowed_keys).to_h
+      elsif raw_params.is_a?(Hash)
+        raw_params.slice(*allowed_keys)
+      else
+        {}
+      end
+    end
+
+    def allowed_account_ids
+      @allowed_account_ids ||= @brex_item.brex_accounts.pluck(:id).map(&:to_s)
+    end
+end
diff --git a/app/controllers/brex_items_controller.rb b/app/controllers/brex_items_controller.rb
new file mode 100644
index 000000000..551a36c47
--- /dev/null
+++ b/app/controllers/brex_items_controller.rb
@@ -0,0 +1,98 @@
+class BrexItemsController < ApplicationController
+  before_action :set_brex_item, only: [ :show, :edit, :update, :destroy, :sync ]
+  before_action :require_admin!, only: [ :new, :create, :edit, :update, :destroy, :sync ]
+
+  def index
+    @brex_items = Current.family.brex_items.active.ordered
+    render layout: "settings"
+  end
+
+  def show
+  end
+
+  def new
+    @brex_item = Current.family.brex_items.build
+  end
+
+  def create
+    @brex_item = Current.family.brex_items.build(brex_item_params)
+    @brex_item.name = t("brex_items.default_connection_name") if @brex_item.name.blank?
+
+    if @brex_item.save
+      @brex_item.sync_later
+      render_provider_panel_success(t(".success"))
+    else
+      render_provider_panel_error
+    end
+  end
+
+  def edit
+  end
+
+  def update
+    if BrexItem::AccountFlow.update_item_with_cache_expiration(@brex_item, family: Current.family, attributes: brex_item_params)
+      render_provider_panel_success(t(".success"))
+    else
+      render_provider_panel_error
+    end
+  end
+
+  def destroy
+    @brex_item.unlink_all!(dry_run: false)
+    @brex_item.destroy_later
+    redirect_to accounts_path, notice: t(".success")
+  end
+
+  def sync
+    @brex_item.sync_later unless @brex_item.syncing?
+
+    respond_to do |format|
+      format.html { redirect_back_or_to accounts_path }
+      format.json { head :ok }
+    end
+  end
+
+  private
+
+    def render_provider_panel_success(message)
+      return redirect_to accounts_path, notice: message, status: :see_other unless turbo_frame_request?
+
+      flash.now[:notice] = message
+      @brex_items = Current.family.brex_items.active.ordered.includes(:syncs, :brex_accounts)
+      render_brex_provider_panel(locals: { brex_items: @brex_items }, include_flash: true)
+    end
+
+    def render_provider_panel_error
+      @error_message = @brex_item.errors.full_messages.join(", ")
+      return redirect_to settings_providers_path, alert: @error_message, status: :see_other unless turbo_frame_request?
+
+      render_brex_provider_panel(locals: { error_message: @error_message }, status: :unprocessable_entity)
+    end
+
+    def render_brex_provider_panel(locals:, status: :ok, include_flash: false)
+      streams = [
+        turbo_stream.replace(
+          "brex-providers-panel",
+          partial: "settings/providers/brex_panel",
+          locals: locals
+        )
+      ]
+      streams += flash_notification_stream_items if include_flash
+      render turbo_stream: streams, status: status
+    end
+
+    def set_brex_item
+      @brex_item = Current.family.brex_items.find(params[:id])
+    end
+
+    def brex_item_params
+      permitted = params.require(:brex_item).permit(:name, :sync_start_date, :token, :base_url)
+      permitted.delete(:token) if @brex_item&.persisted? && permitted[:token].blank?
+      permitted[:token] = permitted[:token].to_s.strip if permitted[:token].present?
+      if permitted.key?(:base_url)
+        permitted[:base_url] = permitted[:base_url].to_s.strip
+        permitted[:base_url] = nil if permitted[:base_url].blank?
+      end
+      permitted
+    end
+end
diff --git a/app/controllers/budget_categories_controller.rb b/app/controllers/budget_categories_controller.rb
index 0490a5f61..65880ea05 100644
--- a/app/controllers/budget_categories_controller.rb
+++ b/app/controllers/budget_categories_controller.rb
@@ -7,7 +7,15 @@ class BudgetCategoriesController < ApplicationController
   end
 
   def show
+    # The aggregate `Budget#actual_spending` already excludes transactions
+    # whose kind is in BUDGET_EXCLUDED_KINDS (funds_movement, one_time,
+    # cc_payment) via IncomeStatement. The drilldown list must apply the
+    # same filter, otherwise a matched transfer (post-#874 the matcher
+    # correctly tags inflow as funds_movement and outflow per destination
+    # account) shows under the Uncategorized card -- or any retained
+    # category -- even though the aggregate ignores it. See issue #1059.
     @recent_transactions = @budget.transactions
+                                  .where.not(transactions: { kind: Transaction::BUDGET_EXCLUDED_KINDS })
 
     if params[:id] == BudgetCategory.uncategorized.id
       @budget_category = @budget.uncategorized_budget_category
diff --git a/app/controllers/budgets_controller.rb b/app/controllers/budgets_controller.rb
index db04a4720..af4178411 100644
--- a/app/controllers/budgets_controller.rb
+++ b/app/controllers/budgets_controller.rb
@@ -7,6 +7,7 @@ class BudgetsController < ApplicationController
 
   def show
     @source_budget = @budget.most_recent_initialized_budget unless @budget.initialized?
+    @breadcrumbs = [ [ t("breadcrumbs.home"), root_path ], [ t("breadcrumbs.budgets"), nil ] ]
   end
 
   def edit
diff --git a/app/controllers/categories_controller.rb b/app/controllers/categories_controller.rb
index 6d5e6b9fc..a38e5166c 100644
--- a/app/controllers/categories_controller.rb
+++ b/app/controllers/categories_controller.rb
@@ -58,7 +58,7 @@ class CategoriesController < ApplicationController
 
   def destroy_all
     Current.family.categories.destroy_all
-    redirect_back_or_to categories_path, notice: "All categories deleted"
+    redirect_back_or_to categories_path, notice: t(".success")
   end
 
   def bootstrap
diff --git a/app/controllers/chats_controller.rb b/app/controllers/chats_controller.rb
index 6b8b494a7..aefb7daf4 100644
--- a/app/controllers/chats_controller.rb
+++ b/app/controllers/chats_controller.rb
@@ -29,7 +29,7 @@ class ChatsController < ApplicationController
     @chat.update!(chat_params)
 
     respond_to do |format|
-      format.html { redirect_back_or_to chat_path(@chat), notice: "Chat updated" }
+      format.html { redirect_back_or_to chat_path(@chat), notice: t(".success") }
       format.turbo_stream { render turbo_stream: turbo_stream.replace(dom_id(@chat, :title), partial: "chats/chat_title", locals: { chat: @chat }) }
     end
   end
@@ -38,12 +38,12 @@ class ChatsController < ApplicationController
     @chat.destroy
     clear_last_viewed_chat
 
-    redirect_to chats_path, notice: "Chat was successfully deleted"
+    redirect_to chats_path, notice: t(".notice")
   end
 
   def retry
     @chat.retry_last_message!
-    redirect_to chat_path(@chat, thinking: true)
+    redirect_to chat_path(@chat)
   end
 
   private
diff --git a/app/controllers/concerns/accountable_resource.rb b/app/controllers/concerns/accountable_resource.rb
index 23fd76107..479ad9efc 100644
--- a/app/controllers/concerns/accountable_resource.rb
+++ b/app/controllers/concerns/accountable_resource.rb
@@ -62,8 +62,10 @@ module AccountableResource
       end
     end
 
-    # Update remaining account attributes
-    update_params = account_params.except(:return_to, :balance, :currency, :opening_balance_date)
+    # Update remaining account attributes. Note: currency is intentionally allowed
+    # here so all account types (depositories, credit cards, loans, etc.) can
+    # have their currency changed via this shared update path.
+    update_params = account_params.except(:return_to, :balance, :opening_balance_date)
     unless @account.update(update_params)
       @error_message = @account.errors.full_messages.join(", ")
       render :edit, status: :unprocessable_entity
diff --git a/app/controllers/concerns/api/v1/security_resource_filtering.rb b/app/controllers/concerns/api/v1/security_resource_filtering.rb
new file mode 100644
index 000000000..8f58391f1
--- /dev/null
+++ b/app/controllers/concerns/api/v1/security_resource_filtering.rb
@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module Api::V1::SecurityResourceFiltering
+  class InvalidFilterError < StandardError; end
+
+  BOOLEAN_FILTERS = {
+    "true" => true,
+    "1" => true,
+    "false" => false,
+    "0" => false
+  }.freeze
+
+  private
+
+    def scoped_security_ids
+      Security
+        .where(id: holding_security_ids)
+        .or(Security.where(id: trade_security_ids))
+        .distinct
+        .select(:id)
+    end
+
+    def holding_security_ids
+      Holding.where(account_id: accessible_account_ids).select(:security_id)
+    end
+
+    def trade_security_ids
+      Trade.joins(:entry).where(entries: { account_id: accessible_account_ids }).select(:security_id)
+    end
+
+    def accessible_account_ids
+      @accessible_account_ids ||= current_resource_owner.family.accounts.visible.accessible_by(current_resource_owner).select(:id)
+    end
+
+    def parse_boolean_filter_param(key)
+      normalized_value = params[key].to_s.strip.downcase
+
+      invalid_filter!("#{key} must be true or false") if normalized_value.blank?
+      return BOOLEAN_FILTERS.fetch(normalized_value) if BOOLEAN_FILTERS.key?(normalized_value)
+
+      invalid_filter!("#{key} must be true or false")
+    end
+
+    def parse_date_param(key)
+      Date.iso8601(params[key].to_s)
+    rescue ArgumentError
+      invalid_filter!("#{key} must be an ISO 8601 date")
+    end
+
+    def invalid_filter!(message)
+      raise InvalidFilterError, message
+    end
+end
diff --git a/app/controllers/concerns/api/v1/transfer_decision_filtering.rb b/app/controllers/concerns/api/v1/transfer_decision_filtering.rb
new file mode 100644
index 000000000..fa2d0ac5c
--- /dev/null
+++ b/app/controllers/concerns/api/v1/transfer_decision_filtering.rb
@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module Api::V1::TransferDecisionFiltering
+  extend ActiveSupport::Concern
+
+  InvalidFilterError = Class.new(StandardError)
+
+  private
+
+    def transfer_decision_scope(model_class)
+      model_class
+        .where(
+          inflow_transaction_id: accessible_transaction_ids,
+          outflow_transaction_id: accessible_transaction_ids
+        )
+        .includes(
+          inflow_transaction: { entry: :account },
+          outflow_transaction: { entry: :account }
+        )
+    end
+
+    def apply_transfer_decision_filters(query, status_model: nil)
+      query = apply_transfer_status_filter(query, status_model) if status_model
+      query = apply_transfer_account_filter(query) if params[:account_id].present?
+      query = apply_transfer_date_filter(query) if params[:start_date].present? || params[:end_date].present?
+      query
+    end
+
+    def accessible_transaction_ids
+      accessible_transactions.select(:id)
+    end
+
+    def accessible_transactions
+      Transaction
+        .joins(:entry)
+        .where(entries: { account_id: accessible_account_ids })
+    end
+
+    def accessible_account_ids
+      @accessible_account_ids ||= Current.family.accounts.accessible_by(Current.user).select(:id)
+    end
+
+    def apply_transfer_status_filter(query, status_model)
+      return query unless params[:status].present?
+
+      unless status_model.statuses.key?(params[:status])
+        invalid_filter!("status must be one of: #{status_model.statuses.keys.join(", ")}")
+      end
+
+      query.where(status: params[:status])
+    end
+
+    def apply_transfer_account_filter(query)
+      invalid_filter!("account_id must be a valid UUID") unless valid_uuid?(params[:account_id])
+
+      account_transaction_ids = accessible_transaction_ids_for_account(params[:account_id])
+      query
+        .where(inflow_transaction_id: account_transaction_ids)
+        .or(query.where(outflow_transaction_id: account_transaction_ids))
+    end
+
+    def apply_transfer_date_filter(query)
+      date_transaction_ids = transfer_date_transaction_ids
+      query
+        .where(inflow_transaction_id: date_transaction_ids)
+        .or(query.where(outflow_transaction_id: date_transaction_ids))
+    end
+
+    def accessible_transaction_ids_for_account(account_id)
+      Transaction
+        .joins(:entry)
+        .where(entries: { account_id: accessible_account_ids.where(id: account_id) })
+        .select(:id)
+    end
+
+    def transfer_date_transaction_ids
+      query = accessible_transactions
+      query = query.where("entries.date >= ?", parse_date_param(:start_date)) if params[:start_date].present?
+      query = query.where("entries.date <= ?", parse_date_param(:end_date)) if params[:end_date].present?
+      query.select(:id)
+    end
+
+    def parse_date_param(key)
+      Date.iso8601(params[key].to_s)
+    rescue ArgumentError
+      invalid_filter!("#{key} must be an ISO 8601 date")
+    end
+
+    def invalid_filter!(message)
+      raise InvalidFilterError, message
+    end
+end
diff --git a/app/controllers/concerns/breadcrumbable.rb b/app/controllers/concerns/breadcrumbable.rb
index 38ebd8895..f2ff12282 100644
--- a/app/controllers/concerns/breadcrumbable.rb
+++ b/app/controllers/concerns/breadcrumbable.rb
@@ -2,12 +2,21 @@ module Breadcrumbable
   extend ActiveSupport::Concern
 
   included do
-    before_action :set_breadcrumbs
+    helper_method :breadcrumbs
   end
 
   private
-    # The default, unless specific controller or action explicitly overrides
-    def set_breadcrumbs
-      @breadcrumbs = [ [ "Home", root_path ], [ controller_name.titleize, nil ] ]
+    # Render-time helper so I18n.locale (set by Localize's around_action) is
+    # already in effect when the breadcrumb labels are translated.
+    # Controllers can still override by assigning @breadcrumbs in their action.
+    def breadcrumbs
+      @breadcrumbs || default_breadcrumbs
+    end
+
+    def default_breadcrumbs
+      [
+        [ I18n.t("breadcrumbs.home"), root_path ],
+        [ I18n.t("breadcrumbs.#{controller_name}", default: controller_name.titleize), nil ]
+      ]
     end
 end
diff --git a/app/controllers/concerns/periodable.rb b/app/controllers/concerns/periodable.rb
index 88be0f05c..bac475253 100644
--- a/app/controllers/concerns/periodable.rb
+++ b/app/controllers/concerns/periodable.rb
@@ -7,7 +7,12 @@ module Periodable
 
   private
     def set_period
-      period_key = params[:period] || Current.user&.default_period
+      if params[:period].present?
+        period_key = params[:period]
+        Current.user&.update!(default_period: period_key) if Period.valid_key?(period_key)
+      else
+        period_key = Current.user&.default_period
+      end
 
       @period = if period_key == "current_month"
         Period.current_month_for(Current.family)
diff --git a/app/controllers/concerns/preview_gateable.rb b/app/controllers/concerns/preview_gateable.rb
new file mode 100644
index 000000000..7ae25ce8f
--- /dev/null
+++ b/app/controllers/concerns/preview_gateable.rb
@@ -0,0 +1,20 @@
+module PreviewGateable
+  extend ActiveSupport::Concern
+
+  included do
+    helper_method :preview_features_enabled?
+  end
+
+  def preview_features_enabled?
+    Current.user&.preview_features_enabled? == true
+  end
+
+  # Use as a `before_action` on controllers that gate a preview feature.
+  # Redirects users without preview access to the dashboard with a flash
+  # explaining the feature is opt-in. Self-served via Settings → Preferences.
+  def require_preview_features!
+    return if preview_features_enabled?
+
+    redirect_to root_path, alert: I18n.t("preview.not_enabled")
+  end
+end
diff --git a/app/controllers/concerns/self_hostable.rb b/app/controllers/concerns/self_hostable.rb
index 3631571ae..83498269b 100644
--- a/app/controllers/concerns/self_hostable.rb
+++ b/app/controllers/concerns/self_hostable.rb
@@ -23,7 +23,7 @@ module SelfHostable
       if controller_name == "pages" && action_name == "redis_configuration_error"
         # If Redis is now working, redirect to home
         if redis_connected?
-          redirect_to root_path, notice: "Redis is now configured properly! You can now setup your Sure application."
+          redirect_to root_path, notice: t("concerns.self_hostable.redis_configured")
         end
 
         return
diff --git a/app/controllers/concerns/webauthn_relying_party.rb b/app/controllers/concerns/webauthn_relying_party.rb
new file mode 100644
index 000000000..a6dfb7905
--- /dev/null
+++ b/app/controllers/concerns/webauthn_relying_party.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module WebauthnRelyingParty
+  extend ActiveSupport::Concern
+
+  private
+    def webauthn_relying_party
+      webauthn_config = Rails.application.config.x.webauthn
+
+      WebAuthn::RelyingParty.new(
+        name: "Sure",
+        id: webauthn_config.rp_id,
+        allowed_origins: webauthn_config.allowed_origins,
+        # Accept consumer passkeys/security keys without attesting device vendor
+        # identity; this keeps MFA registration broad for self-hosted users.
+        verify_attestation_statement: false
+      )
+    end
+
+    def webauthn_credential_payload
+      payload = params.require(:credential)
+      payload = JSON.parse(payload) if payload.is_a?(String)
+
+      payload = payload.to_unsafe_h if payload.respond_to?(:to_unsafe_h)
+      raise ActionController::BadRequest, "credential must be an object" unless payload.is_a?(Hash)
+
+      payload
+    rescue JSON::ParserError, TypeError, ArgumentError
+      raise ActionController::BadRequest, "invalid credential payload"
+    end
+end
diff --git a/app/controllers/enable_banking_items_controller.rb b/app/controllers/enable_banking_items_controller.rb
index 6cb8b1fc8..0bfc0dabb 100644
--- a/app/controllers/enable_banking_items_controller.rb
+++ b/app/controllers/enable_banking_items_controller.rb
@@ -103,14 +103,15 @@ class EnableBankingItemsController < ApplicationController
       return
     end
 
-    # Track if this is for creating a new connection (vs re-authorizing existing)
     @new_connection = params[:new_connection] == "true"
 
     begin
       provider = @enable_banking_item.enable_banking_provider
       response = provider.get_aspsps(country: @enable_banking_item.country_code)
-      # API returns { aspsps: [...] }, extract the array
-      @aspsps = response[:aspsps] || response["aspsps"] || []
+      raw_aspsps = response[:aspsps] || response["aspsps"] || []
+
+      # Sort: non-beta alphabetically, then beta alphabetically
+      @aspsps = raw_aspsps.map(&:with_indifferent_access).sort_by { |a| [ a[:beta] ? 1 : 0, a[:name].to_s.downcase ] }
     rescue Provider::EnableBanking::EnableBankingError => e
       Rails.logger.error "Enable Banking API error in select_bank: #{e.message}"
       @error_message = e.message
@@ -123,14 +124,47 @@ class EnableBankingItemsController < ApplicationController
   # Initiate authorization for a selected bank
   def authorize
     aspsp_name = params[:aspsp_name]
+    psu_type   = params[:psu_type].presence || "personal"
 
     unless aspsp_name.present?
       redirect_to settings_providers_path, alert: t(".bank_required", default: "Please select a bank.")
       return
     end
 
+    # Re-fetch ASPSP list from provider to avoid session cookie overflow.
+    # We do not store full ASPSP metadata in the session to stay within the 4KB limit;
+    # instead, we re-query the provider here for the final authorization parameters.
+    aspsp_data = nil
+    begin
+      provider_for_lookup = @enable_banking_item.enable_banking_provider
+      if provider_for_lookup
+        response = provider_for_lookup.get_aspsps(country: @enable_banking_item.country_code)
+        raw_aspsps = response[:aspsps] || response["aspsps"] || []
+        found = raw_aspsps.find { |a| a[:name] == aspsp_name || a["name"] == aspsp_name }
+        aspsp_data = found&.with_indifferent_access
+      end
+    rescue Provider::EnableBanking::EnableBankingError => e
+      Rails.logger.warn "Enable Banking: could not fetch ASPSP metadata in authorize: #{e.message}"
+    end
+
+    # Block DECOUPLED banks — our OAuth redirect flow doesn't support them
+    if aspsp_data.present?
+      # Adjust psu_type if the bank does not support the requested type
+      supported_types = Array(aspsp_data[:psu_types]).map(&:to_s)
+      if supported_types.any? && !supported_types.include?(psu_type)
+        psu_type = supported_types.first
+      end
+
+      first_method = Array(aspsp_data[:auth_methods]).first
+      approach = first_method&.dig(:approach) || first_method&.dig("approach")
+      if approach == "DECOUPLED"
+        redirect_to settings_providers_path, alert: t(".decoupled_not_supported",
+          default: "This bank uses a separate device authentication method which is not yet supported. Please add this account manually.")
+        return
+      end
+    end
+
     begin
-      # If this is a new connection request, create the item now (when user has selected a bank)
       target_item = if params[:new_connection] == "true"
         Current.family.enable_banking_items.create!(
           name: "Enable Banking Connection",
@@ -142,10 +176,18 @@ class EnableBankingItemsController < ApplicationController
         @enable_banking_item
       end
 
+      # Capture PSU IP for use in background sync PSU headers
+      target_item.update(last_psu_ip: request.remote_ip) if request.remote_ip.present?
+
+      language = I18n.locale.to_s.split("-").first
+
       redirect_url = target_item.start_authorization(
         aspsp_name: aspsp_name,
         redirect_url: enable_banking_callback_url,
-        state: target_item.id
+        state: target_item.id,
+        psu_type: psu_type,
+        aspsp_data: aspsp_data,
+        language: language
       )
 
       safe_redirect_to_enable_banking(
@@ -156,10 +198,13 @@ class EnableBankingItemsController < ApplicationController
     rescue Provider::EnableBanking::EnableBankingError => e
       if e.message.include?("REDIRECT_URI_NOT_ALLOWED")
         Rails.logger.error "Enable Banking redirect URI not allowed: #{e.message}"
-        redirect_to settings_providers_path, alert: t(".redirect_uri_not_allowed", default: "Redirect not allowed. Configure `%{callback_url}` in your Enable Banking application settings.", callback_url: enable_banking_callback_url)
+        redirect_to settings_providers_path, alert: t(".redirect_uri_not_allowed",
+          default: "Redirect not allowed. Configure `%{callback_url}` in your Enable Banking application settings.",
+          callback_url: enable_banking_callback_url)
       else
         Rails.logger.error "Enable Banking authorization error: #{e.message}"
-        redirect_to settings_providers_path, alert: t(".authorization_failed", default: "Failed to start authorization: %{message}", message: e.message)
+        redirect_to settings_providers_path, alert: t(".authorization_failed",
+          default: "Failed to start authorization: %{message}", message: e.message)
       end
     rescue => e
       Rails.logger.error "Unexpected error in authorize: #{e.class}: #{e.message}"
@@ -193,6 +238,9 @@ class EnableBankingItemsController < ApplicationController
       return
     end
 
+    # Refresh PSU IP on callback (user's browser is present here)
+    enable_banking_item.update(last_psu_ip: request.remote_ip) if request.remote_ip.present?
+
     begin
       enable_banking_item.complete_authorization(code: code)
 
@@ -219,10 +267,14 @@ class EnableBankingItemsController < ApplicationController
   # Re-authorize an expired session
   def reauthorize
     begin
+      language = I18n.locale.to_s.split("-").first
+
       redirect_url = @enable_banking_item.start_authorization(
         aspsp_name: @enable_banking_item.aspsp_name,
         redirect_url: enable_banking_callback_url,
-        state: @enable_banking_item.id
+        state: @enable_banking_item.id,
+        psu_type: @enable_banking_item.psu_type || "personal",
+        language: language
       )
 
       safe_redirect_to_enable_banking(
@@ -232,7 +284,8 @@ class EnableBankingItemsController < ApplicationController
       )
     rescue Provider::EnableBanking::EnableBankingError => e
       Rails.logger.error "Enable Banking reauthorization error: #{e.message}"
-      redirect_to settings_providers_path, alert: t(".reauthorization_failed", default: "Failed to re-authorize: %{message}", message: e.message)
+      redirect_to settings_providers_path, alert: t(".reauthorization_failed",
+        default: "Failed to re-authorize: %{message}", message: e.message)
     end
   end
 
diff --git a/app/controllers/exchange_rates_controller.rb b/app/controllers/exchange_rates_controller.rb
new file mode 100644
index 000000000..78be651b4
--- /dev/null
+++ b/app/controllers/exchange_rates_controller.rb
@@ -0,0 +1,36 @@
+class ExchangeRatesController < ApplicationController
+  def show
+    # Pure currency-to-currency exchange rate lookup
+    unless params[:from].present? && params[:to].present?
+      return render json: { error: "from and to currencies are required" }, status: :bad_request
+    end
+
+    from_currency = params[:from].upcase
+    to_currency = params[:to].upcase
+
+    # Same currency returns 1.0
+    if from_currency == to_currency
+      return render json: { rate: 1.0, same_currency: true }
+    end
+
+    # Parse date
+    begin
+      date = params[:date].present? ? Date.parse(params[:date]) : Date.current
+    rescue ArgumentError, TypeError
+      return render json: { error: "Invalid date format" }, status: :bad_request
+    end
+
+    begin
+      rate_obj = ExchangeRate.find_or_fetch_rate(from: from_currency, to: to_currency, date: date)
+    rescue StandardError
+      return render json: { error: "Failed to fetch exchange rate" }, status: :bad_request
+    end
+
+    if rate_obj.nil?
+      return render json: { error: "Exchange rate not found" }, status: :not_found
+    end
+
+    rate_value = rate_obj.is_a?(Numeric) ? rate_obj : rate_obj.rate
+    render json: { rate: rate_value.to_f }
+  end
+end
diff --git a/app/controllers/family_merchants_controller.rb b/app/controllers/family_merchants_controller.rb
index 04e8fc15d..db77ee413 100644
--- a/app/controllers/family_merchants_controller.rb
+++ b/app/controllers/family_merchants_controller.rb
@@ -2,7 +2,7 @@ class FamilyMerchantsController < ApplicationController
   before_action :set_merchant, only: %i[edit update destroy]
 
   def index
-    @breadcrumbs = [ [ "Home", root_path ], [ "Merchants", nil ] ]
+    @breadcrumbs = [ [ t("breadcrumbs.home"), root_path ], [ t("breadcrumbs.merchants"), nil ] ]
 
     # Show all merchants for this family
     @family_merchants = Current.family.merchants.alphabetically
diff --git a/app/controllers/holdings_controller.rb b/app/controllers/holdings_controller.rb
index d51fbc411..45a89f938 100644
--- a/app/controllers/holdings_controller.rb
+++ b/app/controllers/holdings_controller.rb
@@ -42,7 +42,7 @@ class HoldingsController < ApplicationController
       @holding.destroy_holding_and_entries!
       flash[:notice] = t(".success")
     else
-      flash[:alert] = "You cannot delete this holding"
+      flash[:alert] = t(".cannot_delete")
     end
 
     respond_to do |format|
@@ -52,36 +52,44 @@ class HoldingsController < ApplicationController
   end
 
   def remap_security
-    # Combobox returns "TICKER|EXCHANGE" format
-    ticker, exchange = params[:security_id].to_s.split("|")
+    # Combobox returns "TICKER|EXCHANGE|PROVIDER" format
+    parsed = Security.parse_combobox_id(params[:security_id])
 
     # Validate ticker is present (form has required: true, but can be bypassed)
-    if ticker.blank?
-      flash[:alert] = t(".security_not_found")
-      redirect_to account_path(@holding.account, tab: "holdings")
-      return
-    end
-
-    new_security = Security::Resolver.new(
-      ticker,
-      exchange_operating_mic: exchange,
-      country_code: Current.family.country
-    ).resolve
-
-    if new_security.nil?
+    if parsed[:ticker].blank?
       flash[:alert] = t(".security_not_found")
       redirect_to account_path(@holding.account, tab: "holdings")
       return
     end
 
     # The user explicitly selected this security from provider search results,
-    # so we know the provider can handle it. Bring it back online if it was
-    # previously marked offline (e.g. by a failed QIF import resolution).
-    if new_security.offline?
-      new_security.update!(offline: false, failed_fetch_count: 0, failed_fetch_at: nil)
-    end
+    # so we use the combobox data directly — no need to re-resolve via provider APIs.
+    new_security = Security.find_or_initialize_by(
+      ticker: parsed[:ticker],
+      exchange_operating_mic: parsed[:exchange_operating_mic]
+    )
+
+    # Honor the user's provider choice (validated by model inclusion check on save)
+    new_security.price_provider = parsed[:price_provider] if parsed[:price_provider].present?
+
+    # Bring it online — user explicitly selected it from provider search results,
+    # so we know the provider can handle it.
+    new_security.offline = false
+    new_security.failed_fetch_count = 0
+    new_security.failed_fetch_at = nil
+
+    new_security.save!
 
     @holding.remap_security!(new_security)
+
+    # Re-materialize holdings with the new security's prices.
+    # Reload account to avoid stale associations from remap_security!.
+    # The around_action :switch_timezone already sets the family timezone
+    # for this request, so Date.current is correct here.
+    account = Account.find(@holding.account_id)
+    strategy = account.linked? ? :reverse : :forward
+    Balance::Materializer.new(account, strategy: strategy, security_ids: [ new_security.id ]).materialize_balances
+
     flash[:notice] = t(".success")
 
     respond_to do |format|
diff --git a/app/controllers/ibkr_items_controller.rb b/app/controllers/ibkr_items_controller.rb
new file mode 100644
index 000000000..34936995b
--- /dev/null
+++ b/app/controllers/ibkr_items_controller.rb
@@ -0,0 +1,236 @@
+class IbkrItemsController < ApplicationController
+  before_action :set_ibkr_item, only: [ :update, :destroy, :sync, :setup_accounts, :complete_account_setup ]
+  before_action :require_admin!, only: [ :create, :select_accounts, :select_existing_account, :link_existing_account, :update, :destroy, :sync, :setup_accounts, :complete_account_setup ]
+
+  def create
+    @ibkr_item = Current.family.ibkr_items.build(ibkr_item_params)
+    @ibkr_item.name ||= t("ibkr_items.defaults.name")
+
+    if @ibkr_item.save
+      @ibkr_item.sync_later
+
+      if turbo_frame_request?
+        flash.now[:notice] = t(".success")
+        render turbo_stream: [
+          turbo_stream.replace(
+            "ibkr-providers-panel",
+            partial: "settings/providers/ibkr_panel"
+          ),
+          *flash_notification_stream_items
+        ]
+      else
+        redirect_to accounts_path, notice: t(".success"), status: :see_other
+      end
+    else
+      @error_message = @ibkr_item.errors.full_messages.join(", ")
+
+      if turbo_frame_request?
+        render turbo_stream: turbo_stream.replace(
+          "ibkr-providers-panel",
+          partial: "settings/providers/ibkr_panel",
+          locals: { error_message: @error_message }
+        ), status: :unprocessable_entity
+      else
+        redirect_to settings_providers_path, alert: @error_message, status: :see_other
+      end
+    end
+  end
+
+  def update
+    attrs = ibkr_item_params.to_h
+    attrs["query_id"] = @ibkr_item.query_id if attrs["query_id"].blank?
+    attrs["token"] = @ibkr_item.token if attrs["token"].blank?
+
+    if @ibkr_item.update(attrs.merge(status: :good))
+      @ibkr_item.sync_later unless @ibkr_item.syncing?
+
+      if turbo_frame_request?
+        flash.now[:notice] = t(".success")
+        render turbo_stream: [
+          turbo_stream.replace(
+            "ibkr-providers-panel",
+            partial: "settings/providers/ibkr_panel"
+          ),
+          *flash_notification_stream_items
+        ]
+      else
+        redirect_to accounts_path, notice: t(".success"), status: :see_other
+      end
+    else
+      @error_message = @ibkr_item.errors.full_messages.join(", ")
+
+      if turbo_frame_request?
+        render turbo_stream: turbo_stream.replace(
+          "ibkr-providers-panel",
+          partial: "settings/providers/ibkr_panel",
+          locals: { error_message: @error_message }
+        ), status: :unprocessable_entity
+      else
+        redirect_to settings_providers_path, alert: @error_message, status: :see_other
+      end
+    end
+  end
+
+  def destroy
+    begin
+      @ibkr_item.unlink_all!(dry_run: false)
+    rescue => e
+      Rails.logger.warn("IBKR unlink during destroy failed: #{e.class} - #{e.message}")
+    end
+
+    @ibkr_item.destroy_later
+    redirect_to settings_providers_path, notice: t(".success"), status: :see_other
+  end
+
+  def sync
+    @ibkr_item.sync_later unless @ibkr_item.syncing?
+
+    respond_to do |format|
+      format.html { redirect_back_or_to accounts_path }
+      format.json { head :ok }
+    end
+  end
+
+  def select_accounts
+    ibkr_item = current_ibkr_item
+    unless ibkr_item
+      redirect_to settings_providers_path, alert: t(".not_configured")
+      return
+    end
+
+    redirect_to setup_accounts_ibkr_item_path(ibkr_item)
+  end
+
+  def select_existing_account
+    @account = Current.family.accounts.find(params[:account_id])
+    @available_ibkr_accounts = Current.family.ibkr_items
+      .includes(ibkr_accounts: { account_provider: :account })
+      .flat_map(&:ibkr_accounts)
+      .select { |ibkr_account| ibkr_account.account_provider.nil? }
+      .sort_by { |ibkr_account| ibkr_account.updated_at || ibkr_account.created_at }
+      .reverse
+
+    render :select_existing_account, layout: false
+  end
+
+  def link_existing_account
+    account = Current.family.accounts.find_by(id: params[:account_id])
+    ibkr_account = Current.family.ibkr_items
+      .joins(:ibkr_accounts)
+      .where(ibkr_accounts: { id: params[:ibkr_account_id] })
+      .first
+      &.ibkr_accounts
+      &.find_by(id: params[:ibkr_account_id])
+
+    if account.blank? || ibkr_account.blank?
+      redirect_to settings_providers_path, alert: t(".not_found")
+      return
+    end
+
+    if account.accountable_type != "Investment" || account.account_providers.any? || account.plaid_account_id.present? || account.simplefin_account_id.present?
+      redirect_to account_path(account), alert: t(".only_manual_investment")
+      return
+    end
+
+    provider = nil
+
+    ibkr_account.with_lock do
+      if ibkr_account.current_account.present?
+        redirect_to account_path(account), alert: t(".already_linked")
+        return
+      end
+
+      provider = ibkr_account.ensure_account_provider!(account)
+    end
+
+    raise "Failed to create AccountProvider link" unless provider
+
+    begin
+      IbkrAccount::Processor.new(ibkr_account.reload).process
+    rescue => e
+      Rails.logger.error("Failed to process linked IBKR account #{ibkr_account.id}: #{e.class} - #{e.message}")
+    end
+
+    ibkr_account.ibkr_item.sync_later unless ibkr_account.ibkr_item.syncing?
+    redirect_to account_path(account), notice: t(".success"), status: :see_other
+  rescue => e
+    Rails.logger.error("Failed to link existing IBKR account: #{e.class} - #{e.message}")
+    redirect_to settings_providers_path, alert: t(".failed"), status: :see_other
+  end
+
+  def setup_accounts
+    @ibkr_accounts = @ibkr_item.ibkr_accounts.includes(account_provider: :account)
+    @linked_accounts = @ibkr_accounts.select { |ibkr_account| ibkr_account.current_account.present? }
+    @unlinked_accounts = @ibkr_accounts.reject { |ibkr_account| ibkr_account.current_account.present? }
+
+    no_accounts = @linked_accounts.blank? && @unlinked_accounts.blank?
+    latest_sync = @ibkr_item.syncs.ordered.first
+    should_sync = latest_sync.nil? || !latest_sync.completed?
+
+    if no_accounts && !@ibkr_item.syncing? && should_sync
+      @ibkr_item.sync_later
+    end
+
+    @linkable_accounts = Current.family.accounts
+      .visible
+      .where(accountable_type: "Investment")
+      .left_joins(:account_providers)
+      .where(account_providers: { id: nil })
+      .order(:name)
+
+    @syncing = @ibkr_item.syncing?
+    @waiting_for_sync = no_accounts && @syncing
+    @no_accounts_found = no_accounts && !@syncing && @ibkr_item.last_synced_at.present?
+  end
+
+  def complete_account_setup
+    selected_accounts = Array(params[:account_ids]).reject(&:blank?)
+    created_accounts = []
+
+    selected_accounts.each do |ibkr_account_id|
+      ibkr_account = @ibkr_item.ibkr_accounts.find_by(id: ibkr_account_id)
+      next unless ibkr_account
+
+      ibkr_account.with_lock do
+        next if ibkr_account.current_account.present?
+
+        account = Account.create_from_ibkr_account(ibkr_account)
+        ibkr_account.ensure_account_provider!(account)
+        created_accounts << account
+      end
+
+      begin
+        IbkrAccount::Processor.new(ibkr_account.reload).process
+      rescue => e
+        Rails.logger.error("Failed to process IBKR account #{ibkr_account.id} after setup: #{e.class} - #{e.message}")
+      end
+    end
+
+    @ibkr_item.update!(pending_account_setup: @ibkr_item.unlinked_accounts_count.positive?)
+    @ibkr_item.sync_later if created_accounts.any?
+
+    if created_accounts.any?
+      redirect_to accounts_path, notice: t(".success", count: created_accounts.count), status: :see_other
+    elsif selected_accounts.empty?
+      redirect_to setup_accounts_ibkr_item_path(@ibkr_item), alert: t(".none_selected"), status: :see_other
+    else
+      redirect_to setup_accounts_ibkr_item_path(@ibkr_item), alert: t(".none_created"), status: :see_other
+    end
+  end
+
+  private
+
+    def set_ibkr_item
+      @ibkr_item = Current.family.ibkr_items.find(params[:id])
+    end
+
+    def current_ibkr_item
+      active_items = Current.family.ibkr_items.active
+
+      active_items.syncable.ordered.first || active_items.ordered.first
+    end
+
+    def ibkr_item_params
+      params.require(:ibkr_item).permit(:name, :query_id, :token)
+    end
+end
diff --git a/app/controllers/import/cleans_controller.rb b/app/controllers/import/cleans_controller.rb
index 7d91f2134..4b0b46c16 100644
--- a/app/controllers/import/cleans_controller.rb
+++ b/app/controllers/import/cleans_controller.rb
@@ -6,7 +6,7 @@ class Import::CleansController < ApplicationController
   def show
     unless @import.configured?
       redirect_path = @import.is_a?(PdfImport) ? import_path(@import) : import_configuration_path(@import)
-      return redirect_to redirect_path, alert: "Please configure your import before proceeding."
+      return redirect_to redirect_path, alert: t(".not_configured")
     end
 
     rows = @import.rows_ordered
diff --git a/app/controllers/import/confirms_controller.rb b/app/controllers/import/confirms_controller.rb
index 1a687d4bd..029a58469 100644
--- a/app/controllers/import/confirms_controller.rb
+++ b/app/controllers/import/confirms_controller.rb
@@ -8,7 +8,7 @@ class Import::ConfirmsController < ApplicationController
       return redirect_to import_path(@import)
     end
 
-    redirect_to import_clean_path(@import), alert: "You have invalid data, please edit until all errors are resolved" unless @import.cleaned?
+    redirect_to import_clean_path(@import), alert: t(".invalid_data") unless @import.cleaned?
   end
 
   private
diff --git a/app/controllers/import/qif_category_selections_controller.rb b/app/controllers/import/qif_category_selections_controller.rb
index 2ed7b195a..cf7538b9b 100644
--- a/app/controllers/import/qif_category_selections_controller.rb
+++ b/app/controllers/import/qif_category_selections_controller.rb
@@ -54,7 +54,7 @@ class Import::QifCategorySelectionsController < ApplicationController
       @import.sync_mappings unless format_changed
     end
 
-    redirect_to import_clean_path(@import), notice: "Categories and tags saved."
+    redirect_to import_clean_path(@import), notice: t(".success")
   end
 
   private
diff --git a/app/controllers/import/uploads_controller.rb b/app/controllers/import/uploads_controller.rb
index 0212bc850..bd08c3e2a 100644
--- a/app/controllers/import/uploads_controller.rb
+++ b/app/controllers/import/uploads_controller.rb
@@ -85,7 +85,7 @@ class Import::UploadsController < ApplicationController
         @import.sync_mappings
       end
 
-      redirect_to import_qif_category_selection_path(@import), notice: "QIF file uploaded successfully."
+      redirect_to import_qif_category_selection_path(@import), notice: t(".qif_uploaded")
     end
 
     def csv_str
diff --git a/app/controllers/imports_controller.rb b/app/controllers/imports_controller.rb
index 4a3cc0492..94526c310 100644
--- a/app/controllers/imports_controller.rb
+++ b/app/controllers/imports_controller.rb
@@ -22,9 +22,9 @@ class ImportsController < ApplicationController
   def publish
     @import.publish_later
 
-    redirect_to import_path(@import), notice: "Your import has started in the background."
+    redirect_to import_path(@import), notice: t(".started")
   rescue Import::MaxRowCountExceededError
-    redirect_back_or_to import_path(@import), alert: "Your import exceeds the maximum row count of #{@import.max_row_count}."
+    redirect_back_or_to import_path(@import), alert: t(".max_rows_exceeded", max: @import.max_row_count)
   end
 
   def index
@@ -33,7 +33,9 @@ class ImportsController < ApplicationController
       [ t("breadcrumbs.home"), root_path ],
       [ t("breadcrumbs.imports"), imports_path ]
     ]
-    render layout: "settings"
+    respond_to do |format|
+      format.html { render layout: "settings" }
+    end
   end
 
   def new
@@ -112,22 +114,22 @@ class ImportsController < ApplicationController
 
   def revert
     @import.revert_later
-    redirect_to imports_path, notice: "Import is reverting in the background."
+    redirect_to imports_path, notice: t(".started")
   end
 
   def apply_template
     if @import.suggested_template
       @import.apply_template!(@import.suggested_template)
-      redirect_to import_configuration_path(@import), notice: "Template applied."
+      redirect_to import_configuration_path(@import), notice: t(".template_applied")
     else
-      redirect_to import_configuration_path(@import), alert: "No template found, please manually configure your import."
+      redirect_to import_configuration_path(@import), alert: t(".no_template_found")
     end
   end
 
   def destroy
     @import.destroy
 
-    redirect_to imports_path, notice: "Your import has been deleted."
+    redirect_to imports_path, notice: t(".deleted")
   end
 
   private
diff --git a/app/controllers/indexa_capital_items_controller.rb b/app/controllers/indexa_capital_items_controller.rb
index 4b37eea8a..d5872528b 100644
--- a/app/controllers/indexa_capital_items_controller.rb
+++ b/app/controllers/indexa_capital_items_controller.rb
@@ -222,9 +222,10 @@ class IndexaCapitalItemsController < ApplicationController
   end
 
   def complete_account_setup
-    account_configs = params[:accounts] || {}
+    account_ids = Array(params[:account_ids]).reject(&:blank?)
+    sync_start_dates = params[:sync_start_dates] || {}
 
-    if account_configs.empty?
+    if account_ids.empty?
       redirect_to setup_accounts_indexa_capital_item_path(@indexa_capital_item), alert: t(".no_accounts")
       return
     end
@@ -232,25 +233,31 @@ class IndexaCapitalItemsController < ApplicationController
     created_count = 0
     skipped_count = 0
 
-    account_configs.each do |indexa_capital_account_id, config|
-      next if config[:account_type] == "skip"
-
+    account_ids.each do |indexa_capital_account_id|
       indexa_capital_account = @indexa_capital_item.indexa_capital_accounts.find_by(id: indexa_capital_account_id)
       next unless indexa_capital_account
       next if indexa_capital_account.account_provider.present?
 
-      accountable_type = infer_accountable_type(config[:account_type], config[:subtype])
-      account = create_account_from_indexa_capital(indexa_capital_account, accountable_type, config)
+      # Parse the form-supplied date up front so a malformed value is silently
+      # dropped rather than aborting the loop body after the account is
+      # already persisted (which would mark a successfully-created account
+      # as "skipped").
+      raw_sync_start_date = sync_start_dates[indexa_capital_account_id]
+      sync_start_date = (Date.parse(raw_sync_start_date.to_s) rescue nil) if raw_sync_start_date.present?
 
-      if account&.persisted?
+      # Wrap creation, provider link, and sync_start_date persistence in a
+      # single transaction so a failure in ensure_account_provider! (or the
+      # sync_start_date update) rolls back the Account row instead of leaving
+      # an orphan that is also wrongly counted as "created".
+      ActiveRecord::Base.transaction do
+        account = create_account_from_indexa_capital(indexa_capital_account, "Investment", {})
         indexa_capital_account.ensure_account_provider!(account)
-        indexa_capital_account.update!(sync_start_date: config[:sync_start_date]) if config[:sync_start_date].present?
-        created_count += 1
-      else
-        skipped_count += 1
+        indexa_capital_account.update!(sync_start_date: sync_start_date) if sync_start_date
       end
+
+      created_count += 1
     rescue => e
-      Rails.logger.error "IndexaCapitalItemsController#complete_account_setup - Error: #{e.message}"
+      Rails.logger.error "IndexaCapitalItemsController#complete_account_setup - Error linking #{indexa_capital_account_id}: #{e.message}"
       skipped_count += 1
     end
 
diff --git a/app/controllers/invite_codes_controller.rb b/app/controllers/invite_codes_controller.rb
index f9bcf6760..436e9a7d1 100644
--- a/app/controllers/invite_codes_controller.rb
+++ b/app/controllers/invite_codes_controller.rb
@@ -8,13 +8,13 @@ class InviteCodesController < ApplicationController
 
   def create
     InviteCode.generate!
-    redirect_back_or_to invite_codes_path, notice: "Code generated"
+    redirect_back_or_to invite_codes_path, notice: t(".success")
   end
 
   def destroy
     code = InviteCode.find(params[:id])
     code.destroy
-    redirect_back_or_to invite_codes_path, notice: "Code deleted"
+    redirect_back_or_to invite_codes_path, notice: t(".success")
   end
 
   private
diff --git a/app/controllers/kraken_items_controller.rb b/app/controllers/kraken_items_controller.rb
new file mode 100644
index 000000000..6daba850f
--- /dev/null
+++ b/app/controllers/kraken_items_controller.rb
@@ -0,0 +1,241 @@
+# frozen_string_literal: true
+
+class KrakenItemsController < ApplicationController
+  before_action :set_kraken_item, only: %i[update destroy sync setup_accounts complete_account_setup]
+  before_action :require_admin!, only: %i[create select_accounts link_accounts select_existing_account link_existing_account update destroy sync setup_accounts complete_account_setup]
+
+  def create
+    @kraken_item = Current.family.kraken_items.build(kraken_item_params)
+    @kraken_item.name ||= t(".default_name")
+
+    if @kraken_item.save
+      @kraken_item.set_kraken_institution_defaults!
+      @kraken_item.sync_later
+      render_panel_success(t(".success"))
+    else
+      render_panel_error(@kraken_item.errors.full_messages.join(", "))
+    end
+  end
+
+  def update
+    if @kraken_item.update(kraken_item_params)
+      render_panel_success(t(".success"))
+    else
+      render_panel_error(@kraken_item.errors.full_messages.join(", "))
+    end
+  end
+
+  def destroy
+    @kraken_item.unlink_all!(dry_run: false)
+    @kraken_item.destroy_later
+    redirect_to settings_providers_path, notice: t(".success")
+  end
+
+  def sync
+    @kraken_item.sync_later unless @kraken_item.syncing?
+
+    respond_to do |format|
+      format.html { redirect_back_or_to settings_providers_path }
+      format.json { head :ok }
+    end
+  end
+
+  def select_accounts
+    account_flow = kraken_item_account_flow_context
+    kraken_item = account_flow[:kraken_item]
+
+    unless kraken_item
+      redirect_to settings_providers_path, alert: kraken_item_selection_message(account_flow[:credentialed_items])
+      return
+    end
+
+    redirect_to setup_accounts_kraken_item_path(kraken_item, return_to: safe_return_to_path), status: :see_other
+  end
+
+  def link_accounts
+    kraken_item = kraken_item_account_flow_context[:kraken_item]
+    unless kraken_item
+      redirect_to settings_providers_path, alert: t(".select_connection")
+      return
+    end
+
+    redirect_to setup_accounts_kraken_item_path(kraken_item), status: :see_other
+  end
+
+  def select_existing_account
+    @account = Current.family.accounts.find(params[:account_id])
+    account_flow = kraken_item_account_flow_context
+    @kraken_item = account_flow[:kraken_item]
+
+    unless manual_crypto_exchange_account?(@account)
+      redirect_to accounts_path, alert: t("kraken_items.link_existing_account.errors.only_manual")
+      return
+    end
+
+    unless @kraken_item
+      redirect_to settings_providers_path, alert: kraken_item_selection_message(account_flow[:credentialed_items])
+      return
+    end
+
+    @available_kraken_accounts = @kraken_item.kraken_accounts
+      .left_joins(:account_provider)
+      .where(account_providers: { id: nil })
+      .order(:name)
+
+    render :select_existing_account, layout: false
+  end
+
+  def link_existing_account
+    @account = Current.family.accounts.find(params[:account_id])
+    kraken_item = kraken_item_account_flow_context[:kraken_item]
+
+    unless manual_crypto_exchange_account?(@account)
+      return redirect_or_flash_error(t(".errors.only_manual"), account_path(@account))
+    end
+
+    unless kraken_item
+      redirect_to settings_providers_path, alert: t(".select_connection")
+      return
+    end
+
+    kraken_account = kraken_item.kraken_accounts.find_by(id: params[:kraken_account_id])
+    unless kraken_account
+      return redirect_or_flash_error(t(".errors.invalid_kraken_account"), account_path(@account))
+    end
+    if kraken_account.account_provider.present?
+      return redirect_or_flash_error(t(".errors.kraken_account_already_linked"), account_path(@account))
+    end
+
+    AccountProvider.create!(account: @account, provider: kraken_account)
+    kraken_item.sync_later
+
+    redirect_to accounts_path, notice: t(".success")
+  end
+
+  def setup_accounts
+    @kraken_accounts = unlinked_accounts_for(@kraken_item)
+  end
+
+  def complete_account_setup
+    selected_accounts = Array(params[:selected_accounts]).reject(&:blank?)
+    created_accounts = []
+
+    selected_accounts.each do |kraken_account_id|
+      kraken_account = @kraken_item.kraken_accounts.find_by(id: kraken_account_id)
+      next unless kraken_account
+
+      kraken_account.with_lock do
+        next if kraken_account.account_provider.present?
+
+        account = Account.create_from_kraken_account(kraken_account)
+        provider_link = kraken_account.ensure_account_provider!(account)
+        provider_link ? created_accounts << account : account.destroy!
+      end
+
+      KrakenAccount::Processor.new(kraken_account.reload).process
+    rescue StandardError => e
+      Rails.logger.error("Failed to setup account for KrakenAccount #{kraken_account_id}: #{e.message}")
+    end
+
+    @kraken_item.update!(pending_account_setup: unlinked_accounts_for(@kraken_item).exists?)
+    @kraken_item.sync_later if created_accounts.any?
+
+    notice = if created_accounts.any?
+      t(".success", count: created_accounts.count)
+    elsif selected_accounts.empty?
+      t(".none_selected")
+    else
+      t(".no_accounts")
+    end
+
+    redirect_to accounts_path, notice: notice, status: :see_other
+  end
+
+  private
+
+    def set_kraken_item
+      @kraken_item = Current.family.kraken_items.find(params[:id])
+    end
+
+    def kraken_item_params
+      permitted = params.require(:kraken_item).permit(:name, :sync_start_date, :api_key, :api_secret)
+      if @kraken_item&.persisted?
+        permitted.delete(:api_key) if permitted[:api_key].blank?
+        permitted.delete(:api_secret) if permitted[:api_secret].blank?
+      end
+      permitted
+    end
+
+    def render_panel_success(message)
+      if turbo_frame_request?
+        flash.now[:notice] = message
+        @kraken_items = Current.family.kraken_items.active.ordered
+        stream = turbo_stream.update("kraken-providers-panel", partial: "settings/providers/kraken_panel", locals: { kraken_items: @kraken_items })
+        render turbo_stream: [ stream, *flash_notification_stream_items ]
+      else
+        redirect_to settings_providers_path, notice: message, status: :see_other
+      end
+    end
+
+    def render_panel_error(message)
+      if turbo_frame_request?
+        render turbo_stream: turbo_stream.replace(
+          "kraken-providers-panel",
+          partial: "settings/providers/kraken_panel",
+          locals: { error_message: message }
+        ), status: :unprocessable_entity
+      else
+        redirect_to settings_providers_path, alert: message, status: :see_other
+      end
+    end
+
+    def kraken_item_account_flow_context
+      credentialed_items = Current.family.kraken_items.active.credentials_configured.ordered.select(&:credentials_configured?)
+      item = if params[:kraken_item_id].present?
+        credentialed_items.find { |candidate| candidate.id.to_s == params[:kraken_item_id].to_s }
+      elsif credentialed_items.one?
+        credentialed_items.first
+      end
+
+      { kraken_item: item, credentialed_items: credentialed_items }
+    end
+
+    def unlinked_accounts_for(kraken_item)
+      kraken_item.kraken_accounts.left_joins(:account_provider).where(account_providers: { id: nil }).order(:name)
+    end
+
+    def kraken_item_selection_message(credentialed_items)
+      if credentialed_items.count > 1 && params[:kraken_item_id].blank?
+        t("kraken_items.select_accounts.select_connection")
+      else
+        t("kraken_items.select_accounts.no_credentials_configured")
+      end
+    end
+
+    def manual_crypto_exchange_account?(account)
+      account.manual_crypto_exchange?
+    end
+
+    def redirect_or_flash_error(message, fallback_path)
+      if turbo_frame_request?
+        flash.now[:alert] = message
+        render turbo_stream: Array(flash_notification_stream_items)
+      else
+        redirect_to fallback_path, alert: message
+      end
+    end
+
+    def safe_return_to_path
+      return nil if params[:return_to].blank?
+
+      value = params[:return_to].to_s
+      uri = URI.parse(value)
+      return nil if uri.scheme.present?
+      return nil if uri.host.present?
+      return nil unless value.start_with?("/")
+
+      value
+    rescue URI::InvalidURIError
+      nil
+    end
+end
diff --git a/app/controllers/loans_controller.rb b/app/controllers/loans_controller.rb
index 961c5acf0..e6066f4ad 100644
--- a/app/controllers/loans_controller.rb
+++ b/app/controllers/loans_controller.rb
@@ -2,6 +2,6 @@ class LoansController < ApplicationController
   include AccountableResource
 
   permitted_accountable_attributes(
-    :id, :rate_type, :interest_rate, :term_months, :initial_balance
+    :id, :subtype, :rate_type, :interest_rate, :term_months, :initial_balance
   )
 end
diff --git a/app/controllers/mercury_items_controller.rb b/app/controllers/mercury_items_controller.rb
index 14e34ca0f..f971caec5 100644
--- a/app/controllers/mercury_items_controller.rb
+++ b/app/controllers/mercury_items_controller.rb
@@ -13,13 +13,19 @@ class MercuryItemsController < ApplicationController
   # Preload Mercury accounts in background (async, non-blocking)
   def preload_accounts
     begin
-      # Check if family has credentials
-      unless Current.family.has_mercury_credentials?
+      account_flow = mercury_item_account_flow_context
+      mercury_item = account_flow[:mercury_item]
+      unless mercury_item
+        render json: mercury_item_selection_error_payload(account_flow[:credentialed_items])
+        return
+      end
+
+      unless mercury_item.credentials_configured?
         render json: { success: false, error: "no_credentials", has_accounts: false }
         return
       end
 
-      cache_key = "mercury_accounts_#{Current.family.id}"
+      cache_key = mercury_accounts_cache_key(mercury_item)
 
       # Check if already cached
       cached_accounts = Rails.cache.read(cache_key)
@@ -29,8 +35,7 @@ class MercuryItemsController < ApplicationController
         return
       end
 
-      # Fetch from API
-      mercury_provider = Provider::MercuryAdapter.build_provider(family: Current.family)
+      mercury_provider = mercury_item.mercury_provider
 
       unless mercury_provider.present?
         render json: { success: false, error: "no_api_token", has_accounts: false }
@@ -58,28 +63,21 @@ class MercuryItemsController < ApplicationController
   # Fetch available accounts from Mercury API and show selection UI
   def select_accounts
     begin
-      # Check if family has Mercury credentials configured
-      unless Current.family.has_mercury_credentials?
-        if turbo_frame_request?
-          # Render setup modal for turbo frame requests
-          render partial: "mercury_items/setup_required", layout: false
-        else
-          # Redirect for regular requests
-          redirect_to settings_providers_path,
-                     alert: t(".no_credentials_configured",
-                            default: "Please configure your Mercury API token first in Provider Settings.")
-        end
+      account_flow = mercury_item_account_flow_context
+      @mercury_item = account_flow[:mercury_item]
+      unless @mercury_item
+        render_mercury_item_selection_failure(credentialed_items: account_flow[:credentialed_items])
         return
       end
 
-      cache_key = "mercury_accounts_#{Current.family.id}"
+      cache_key = mercury_accounts_cache_key(@mercury_item)
 
       # Try to get cached accounts first
       @available_accounts = Rails.cache.read(cache_key)
 
       # If not cached, fetch from API
       if @available_accounts.nil?
-        mercury_provider = Provider::MercuryAdapter.build_provider(family: Current.family)
+        mercury_provider = @mercury_item.mercury_provider
 
         unless mercury_provider.present?
           redirect_to settings_providers_path, alert: t(".no_api_token",
@@ -95,12 +93,8 @@ class MercuryItemsController < ApplicationController
         Rails.cache.write(cache_key, @available_accounts, expires_in: 5.minutes)
       end
 
-      # Filter out already linked accounts
-      mercury_item = Current.family.mercury_items.first
-      if mercury_item
-        linked_account_ids = mercury_item.mercury_accounts.joins(:account_provider).pluck(:account_id)
-        @available_accounts = @available_accounts.reject { |acc| linked_account_ids.include?(acc[:id].to_s) }
-      end
+      linked_account_ids = @mercury_item.mercury_accounts.joins(:account_provider).pluck(:account_id)
+      @available_accounts = @available_accounts.reject { |acc| linked_account_ids.include?(acc[:id].to_s) }
 
       @accountable_type = params[:accountable_type] || "Depository"
       @return_to = safe_return_to_path
@@ -139,13 +133,16 @@ class MercuryItemsController < ApplicationController
       return
     end
 
-    # Create or find mercury_item for this family
-    mercury_item = Current.family.mercury_items.first_or_create!(
-      name: "Mercury Connection"
-    )
+    account_flow = mercury_item_account_flow_context
+    mercury_item = account_flow[:mercury_item]
+
+    unless mercury_item
+      redirect_to settings_providers_path, alert: t(".select_connection", default: "Choose a Mercury connection before linking accounts.")
+      return
+    end
 
     # Fetch account details from API
-    mercury_provider = Provider::MercuryAdapter.build_provider(family: Current.family)
+    mercury_provider = mercury_item.mercury_provider
     unless mercury_provider.present?
       redirect_to new_account_path, alert: t(".no_api_token")
       return
@@ -259,29 +256,22 @@ class MercuryItemsController < ApplicationController
       return
     end
 
-    # Check if family has Mercury credentials configured
-    unless Current.family.has_mercury_credentials?
-      if turbo_frame_request?
-        # Render setup modal for turbo frame requests
-        render partial: "mercury_items/setup_required", layout: false
-      else
-        # Redirect for regular requests
-        redirect_to settings_providers_path,
-                   alert: t(".no_credentials_configured",
-                          default: "Please configure your Mercury API token first in Provider Settings.")
-      end
+    account_flow = mercury_item_account_flow_context
+    @mercury_item = account_flow[:mercury_item]
+    unless @mercury_item
+      render_mercury_item_selection_failure(credentialed_items: account_flow[:credentialed_items])
       return
     end
 
     begin
-      cache_key = "mercury_accounts_#{Current.family.id}"
+      cache_key = mercury_accounts_cache_key(@mercury_item)
 
       # Try to get cached accounts first
       @available_accounts = Rails.cache.read(cache_key)
 
       # If not cached, fetch from API
       if @available_accounts.nil?
-        mercury_provider = Provider::MercuryAdapter.build_provider(family: Current.family)
+        mercury_provider = @mercury_item.mercury_provider
 
         unless mercury_provider.present?
           redirect_to settings_providers_path, alert: t(".no_api_token",
@@ -302,12 +292,8 @@ class MercuryItemsController < ApplicationController
         return
       end
 
-      # Filter out already linked accounts
-      mercury_item = Current.family.mercury_items.first
-      if mercury_item
-        linked_account_ids = mercury_item.mercury_accounts.joins(:account_provider).pluck(:account_id)
-        @available_accounts = @available_accounts.reject { |acc| linked_account_ids.include?(acc[:id].to_s) }
-      end
+      linked_account_ids = @mercury_item.mercury_accounts.joins(:account_provider).pluck(:account_id)
+      @available_accounts = @available_accounts.reject { |acc| linked_account_ids.include?(acc[:id].to_s) }
 
       if @available_accounts.empty?
         redirect_to accounts_path, alert: t(".all_accounts_already_linked")
@@ -343,6 +329,9 @@ class MercuryItemsController < ApplicationController
       return
     end
 
+    account_flow = mercury_item_account_flow_context
+    mercury_item = account_flow[:mercury_item]
+
     @account = Current.family.accounts.find(account_id)
 
     # Check if account is already linked
@@ -351,13 +340,13 @@ class MercuryItemsController < ApplicationController
       return
     end
 
-    # Create or find mercury_item for this family
-    mercury_item = Current.family.mercury_items.first_or_create!(
-      name: "Mercury Connection"
-    )
+    unless mercury_item
+      redirect_to settings_providers_path, alert: t(".select_connection", default: "Choose a Mercury connection before linking accounts.")
+      return
+    end
 
     # Fetch account details from API
-    mercury_provider = Provider::MercuryAdapter.build_provider(family: Current.family)
+    mercury_provider = mercury_item.mercury_provider
     unless mercury_provider.present?
       redirect_to accounts_path, alert: t(".no_api_token")
       return
@@ -423,7 +412,7 @@ class MercuryItemsController < ApplicationController
 
       if turbo_frame_request?
         flash.now[:notice] = t(".success")
-        @mercury_items = Current.family.mercury_items.ordered
+        @mercury_items = Current.family.mercury_items.active.ordered.includes(:syncs, :mercury_accounts)
         render turbo_stream: [
           turbo_stream.replace(
             "mercury-providers-panel",
@@ -454,10 +443,15 @@ class MercuryItemsController < ApplicationController
   end
 
   def update
-    if @mercury_item.update(mercury_item_params)
+    permitted_params = mercury_item_params
+    expire_accounts_cache = mercury_accounts_cache_sensitive_update?(permitted_params)
+
+    if @mercury_item.update(permitted_params)
+      Rails.cache.delete(mercury_accounts_cache_key(@mercury_item)) if expire_accounts_cache
+
       if turbo_frame_request?
         flash.now[:notice] = t(".success")
-        @mercury_items = Current.family.mercury_items.ordered
+        @mercury_items = Current.family.mercury_items.active.ordered.includes(:syncs, :mercury_accounts)
         render turbo_stream: [
           turbo_stream.replace(
             "mercury-providers-panel",
@@ -750,7 +744,67 @@ class MercuryItemsController < ApplicationController
     end
 
     def mercury_item_params
-      params.require(:mercury_item).permit(:name, :sync_start_date, :token, :base_url)
+      permitted = params.require(:mercury_item).permit(:name, :sync_start_date, :token, :base_url)
+      permitted.delete(:token) if @mercury_item&.persisted? && permitted[:token].blank?
+      permitted
+    end
+
+    def mercury_items_with_credentials
+      Current.family.mercury_items.active.ordered.select(&:credentials_configured?)
+    end
+
+    def mercury_item_account_flow_context
+      credentialed_items = mercury_items_with_credentials
+      mercury_item = nil
+
+      if params[:mercury_item_id].present?
+        mercury_item = credentialed_items.find { |item| item.id.to_s == params[:mercury_item_id].to_s }
+      elsif credentialed_items.one?
+        mercury_item = credentialed_items.first
+      end
+
+      {
+        mercury_item: mercury_item,
+        credentialed_items: credentialed_items
+      }
+    end
+
+    def mercury_accounts_cache_key(mercury_item)
+      "mercury_accounts_#{Current.family.id}_#{mercury_item.id}"
+    end
+
+    def mercury_accounts_cache_sensitive_update?(permitted_params)
+      permitted_params.key?(:token) || permitted_params.key?(:base_url)
+    end
+
+    def mercury_item_selection_error_payload(credentialed_items)
+      if mercury_item_selection_required?(credentialed_items)
+        {
+          success: false,
+          error: "select_connection",
+          error_message: t(".select_connection", default: "Choose a Mercury connection before loading accounts."),
+          has_accounts: nil
+        }
+      else
+        { success: false, error: "no_credentials", has_accounts: false }
+      end
+    end
+
+    def render_mercury_item_selection_failure(credentialed_items:)
+      if mercury_item_selection_required?(credentialed_items)
+        redirect_to settings_providers_path,
+                    alert: t(".select_connection", default: "Choose a Mercury connection in Provider Settings.")
+      elsif turbo_frame_request?
+        render partial: "mercury_items/setup_required", layout: false
+      else
+        redirect_to settings_providers_path,
+                    alert: t(".no_credentials_configured",
+                             default: "Please configure your Mercury API token first in Provider Settings.")
+      end
+    end
+
+    def mercury_item_selection_required?(credentialed_items)
+      credentialed_items.count > 1 && params[:mercury_item_id].blank?
     end
 
     # Sanitize return_to parameter to prevent XSS attacks
diff --git a/app/controllers/mfa_controller.rb b/app/controllers/mfa_controller.rb
index 987170a9c..51154ac51 100644
--- a/app/controllers/mfa_controller.rb
+++ b/app/controllers/mfa_controller.rb
@@ -1,6 +1,8 @@
 class MfaController < ApplicationController
+  include WebauthnRelyingParty
+
   layout :determine_layout
-  skip_authentication only: [ :verify, :verify_code ]
+  skip_authentication only: [ :verify, :verify_code, :webauthn_options, :verify_webauthn ]
 
   def new
     redirect_to root_path if Current.user.otp_required?
@@ -9,8 +11,7 @@ class MfaController < ApplicationController
 
   def create
     if Current.user.verify_otp?(params[:code])
-      Current.user.enable_mfa!
-      @backup_codes = Current.user.otp_backup_codes
+      @backup_codes = Current.user.enable_mfa!
       render :backup_codes
     else
       Current.user.disable_mfa!
@@ -30,9 +31,7 @@ class MfaController < ApplicationController
     @user = User.find_by(id: session[:mfa_user_id])
 
     if @user&.verify_otp?(params[:code])
-      session.delete(:mfa_user_id)
-      @session = create_session_for(@user)
-      flash[:notice] = t("invitations.accept_choice.joined_household") if accept_pending_invitation_for(@user)
+      complete_mfa_sign_in(@user)
       redirect_to root_path
     else
       flash.now[:alert] = t(".invalid_code")
@@ -40,6 +39,60 @@ class MfaController < ApplicationController
     end
   end
 
+  def webauthn_options
+    @user = User.find_by(id: session[:mfa_user_id])
+
+    unless @user&.webauthn_enabled?
+      return render json: { error: t(".unavailable") }, status: :unprocessable_entity
+    end
+
+    options = webauthn_relying_party.options_for_authentication(
+      allow: @user.webauthn_credentials.pluck(:credential_id),
+      user_verification: "preferred"
+    )
+    session[:webauthn_authentication_challenge] = options.challenge
+
+    render json: options
+  end
+
+  def verify_webauthn
+    @user = User.find_by(id: session[:mfa_user_id])
+    challenge = session.delete(:webauthn_authentication_challenge)
+
+    unless @user&.webauthn_enabled? && challenge.present?
+      return render json: { error: t(".invalid_credential") }, status: :unprocessable_entity
+    end
+
+    credential = WebAuthn::Credential.from_get(
+      webauthn_credential_payload,
+      relying_party: webauthn_relying_party
+    )
+    stored_credential = @user.webauthn_credentials.find_by(credential_id: credential.id)
+
+    unless stored_credential
+      return render json: { error: t(".invalid_credential") }, status: :unprocessable_entity
+    end
+
+    stored_credential.with_lock do
+      credential.verify(
+        challenge,
+        public_key: stored_credential.public_key,
+        sign_count: stored_credential.sign_count,
+        user_presence: true
+      )
+
+      stored_credential.update!(
+        sign_count: credential.sign_count,
+        last_used_at: Time.current
+      )
+    end
+    complete_mfa_sign_in(@user)
+
+    render json: { redirect_url: root_path }
+  rescue WebAuthn::Error, ActionController::BadRequest, ActionController::ParameterMissing
+    render json: { error: t(".invalid_credential") }, status: :unprocessable_entity
+  end
+
   def disable
     Current.user.disable_mfa!
     redirect_to settings_security_path, notice: t(".success")
@@ -48,10 +101,18 @@ class MfaController < ApplicationController
   private
 
     def determine_layout
-      if action_name.in?(%w[verify verify_code])
+      if action_name.in?(%w[webauthn_options verify_webauthn])
+        false
+      elsif action_name.in?(%w[verify verify_code])
         "auth"
       else
         "settings"
       end
     end
+
+    def complete_mfa_sign_in(user)
+      session.delete(:mfa_user_id)
+      @session = create_session_for(user)
+      flash[:notice] = t("invitations.accept_choice.joined_household") if accept_pending_invitation_for(user)
+    end
 end
diff --git a/app/controllers/oidc_accounts_controller.rb b/app/controllers/oidc_accounts_controller.rb
index 25548995d..a0e31e7a4 100644
--- a/app/controllers/oidc_accounts_controller.rb
+++ b/app/controllers/oidc_accounts_controller.rb
@@ -7,7 +7,7 @@ class OidcAccountsController < ApplicationController
     @pending_auth = session[:pending_oidc_auth]
 
     if @pending_auth.nil?
-      redirect_to new_session_path, alert: "No pending OIDC authentication found"
+      redirect_to new_session_path, alert: t(".no_pending_oidc")
       return
     end
 
@@ -26,7 +26,7 @@ class OidcAccountsController < ApplicationController
     @pending_auth = session[:pending_oidc_auth]
 
     if @pending_auth.nil?
-      redirect_to new_session_path, alert: "No pending OIDC authentication found"
+      redirect_to new_session_path, alert: t(".no_pending_oidc")
       return
     end
 
@@ -75,7 +75,7 @@ class OidcAccountsController < ApplicationController
     @pending_auth = session[:pending_oidc_auth]
 
     if @pending_auth.nil?
-      redirect_to new_session_path, alert: "No pending OIDC authentication found"
+      redirect_to new_session_path, alert: t(".no_pending_oidc")
       return
     end
 
@@ -91,7 +91,7 @@ class OidcAccountsController < ApplicationController
     @pending_auth = session[:pending_oidc_auth]
 
     if @pending_auth.nil?
-      redirect_to new_session_path, alert: "No pending OIDC authentication found"
+      redirect_to new_session_path, alert: t(".no_pending_oidc")
       return
     end
 
@@ -104,7 +104,7 @@ class OidcAccountsController < ApplicationController
     # domain is not allowed, block JIT account creation—unless there's a
     # pending invitation for this user.
     unless invitation.present? || (!AuthConfig.jit_link_only? && AuthConfig.allowed_oidc_domain?(email))
-      redirect_to new_session_path, alert: "SSO account creation is disabled. Please contact an administrator."
+      redirect_to new_session_path, alert: t(".account_creation_disabled")
       return
     end
 
@@ -164,7 +164,7 @@ class OidcAccountsController < ApplicationController
       elsif accept_pending_invitation_for(@user)
         t("invitations.accept_choice.joined_household")
       else
-        "Welcome! Your account has been created."
+        t(".account_created")
       end
       redirect_to root_path, notice: notice
     else
diff --git a/app/controllers/pages_controller.rb b/app/controllers/pages_controller.rb
index e0802c1c5..c52b7a883 100644
--- a/app/controllers/pages_controller.rb
+++ b/app/controllers/pages_controller.rb
@@ -26,11 +26,11 @@ class PagesController < ApplicationController
 
     @dashboard_sections = build_dashboard_sections
 
-    @breadcrumbs = [ [ "Home", root_path ], [ "Dashboard", nil ] ]
+    @breadcrumbs = [ [ t("breadcrumbs.home"), root_path ], [ t("breadcrumbs.dashboard"), nil ] ]
   end
 
   def intro
-    @breadcrumbs = [ [ "Home", chats_path ], [ "Intro", nil ] ]
+    @breadcrumbs = [ [ t("breadcrumbs.home"), chats_path ], [ t("breadcrumbs.intro"), nil ] ]
   end
 
   def update_preferences
@@ -152,7 +152,7 @@ class PagesController < ApplicationController
 
       add_node = ->(unique_key, display_name, value, percentage, color) {
         node_indices[unique_key] ||= begin
-          nodes << { name: display_name, value: value.to_f.round(2), percentage: percentage.to_f.round(1), color: color }
+          nodes << { id: unique_key, name: display_name, value: value.to_f.round(2), percentage: percentage.to_f.round(1), color: color }
           nodes.size - 1
         end
       }
diff --git a/app/controllers/pending_duplicate_merges_controller.rb b/app/controllers/pending_duplicate_merges_controller.rb
index 80c592f3b..ec2914097 100644
--- a/app/controllers/pending_duplicate_merges_controller.rb
+++ b/app/controllers/pending_duplicate_merges_controller.rb
@@ -21,7 +21,7 @@ class PendingDuplicateMergesController < ApplicationController
 
     # Manually merge the pending transaction with the selected posted transaction
     unless merge_params[:posted_entry_id].present?
-      redirect_back_or_to transactions_path, alert: "Please select a posted transaction to merge with"
+      redirect_back_or_to transactions_path, alert: t(".no_posted_selected")
       return
     end
 
@@ -29,7 +29,7 @@ class PendingDuplicateMergesController < ApplicationController
     posted_entry = find_eligible_posted_entry(merge_params[:posted_entry_id])
 
     unless posted_entry
-      redirect_back_or_to transactions_path, alert: "Invalid transaction selected for merge"
+      redirect_back_or_to transactions_path, alert: t(".invalid_transaction")
       return
     end
 
@@ -48,10 +48,14 @@ class PendingDuplicateMergesController < ApplicationController
 
     # Immediately merge
     if @transaction.merge_with_duplicate!
-      redirect_back_or_to transactions_path, notice: "Pending transaction merged with posted transaction"
+      redirect_back_or_to transactions_path, notice: t(".merge_success")
     else
-      redirect_back_or_to transactions_path, alert: "Could not merge transactions"
+      redirect_back_or_to transactions_path, alert: t(".merge_failed")
     end
+  rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotDestroyed,
+         ActiveRecord::Deadlocked, ActiveRecord::LockWaitTimeout => e
+    Rails.logger.error("Failed to manually merge pending transaction: #{e.message}")
+    redirect_back_or_to transactions_path, alert: t("transactions.merge_duplicate.failure")
   end
 
   private
@@ -60,7 +64,7 @@ class PendingDuplicateMergesController < ApplicationController
       @transaction = entry.entryable
 
       unless @transaction.is_a?(Transaction) && @transaction.pending?
-        redirect_to transactions_path, alert: "This feature is only available for pending transactions"
+        redirect_to transactions_path, alert: t("pending_duplicate_merges.set_transaction.pending_only")
       end
     end
 
diff --git a/app/controllers/plaid_items_controller.rb b/app/controllers/plaid_items_controller.rb
index bfe8c5bd5..08de7e0b4 100644
--- a/app/controllers/plaid_items_controller.rb
+++ b/app/controllers/plaid_items_controller.rb
@@ -62,7 +62,7 @@ class PlaidItemsController < ApplicationController
       .select { |pa| pa.account_provider.nil? && pa.account.nil? } # Not linked via new or legacy system
 
     if @available_plaid_accounts.empty?
-      redirect_to account_path(@account), alert: "No available Plaid accounts to link. Please connect a new Plaid account first."
+      redirect_to account_path(@account), alert: t(".no_available_accounts")
     end
   end
 
@@ -72,13 +72,13 @@ class PlaidItemsController < ApplicationController
 
     # Verify the Plaid account belongs to this family's Plaid items
     unless Current.family.plaid_items.include?(plaid_account.plaid_item)
-      redirect_to account_path(@account), alert: "Invalid Plaid account selected"
+      redirect_to account_path(@account), alert: t(".invalid_account")
       return
     end
 
     # Verify the Plaid account is not already linked
     if plaid_account.account_provider.present? || plaid_account.account.present?
-      redirect_to account_path(@account), alert: "This Plaid account is already linked"
+      redirect_to account_path(@account), alert: t(".already_linked")
       return
     end
 
@@ -88,7 +88,7 @@ class PlaidItemsController < ApplicationController
       provider: plaid_account
     )
 
-    redirect_to accounts_path, notice: "Account successfully linked to Plaid"
+    redirect_to accounts_path, notice: t(".success")
   end
 
   private
diff --git a/app/controllers/properties_controller.rb b/app/controllers/properties_controller.rb
index e937c4fb6..1de7a5f8c 100644
--- a/app/controllers/properties_controller.rb
+++ b/app/controllers/properties_controller.rb
@@ -10,7 +10,12 @@ class PropertiesController < ApplicationController
 
   def create
     @account = Current.family.accounts.create!(
-      property_params.merge(currency: Current.family.currency, balance: 0, status: "draft", owner: Current.user)
+      property_params.merge(
+        balance: 0,
+        status: "draft",
+        owner: Current.user,
+        currency: property_params[:currency].presence || Current.family.currency
+      )
     )
     @account.auto_share_with_family! if Current.family.share_all_by_default?
 
@@ -39,9 +44,14 @@ class PropertiesController < ApplicationController
   end
 
   def update_balances
-    result = @account.set_current_balance(balance_params[:balance].to_d)
+    result = nil
+    Account.transaction do
+      @account.update!(currency: balance_params[:currency]) if balance_params[:currency].present?
+      result = @account.set_current_balance(balance_params[:balance].to_d)
+      raise ActiveRecord::Rollback unless result.success?
+    end
 
-    if result.success?
+    if result&.success?
       @success_message = "Balance updated successfully."
 
       if @account.active?
@@ -50,7 +60,7 @@ class PropertiesController < ApplicationController
         redirect_to address_property_path(@account)
       end
     else
-      @error_message = result.error_message
+      @error_message = result&.error_message
       render :balances, status: :unprocessable_entity
     end
   end
@@ -93,6 +103,7 @@ class PropertiesController < ApplicationController
       params.require(:account)
             .permit(
               :name,
+              :currency,
               :accountable_type,
               :institution_name,
               :institution_domain,
diff --git a/app/controllers/pwa_controller.rb b/app/controllers/pwa_controller.rb
new file mode 100644
index 000000000..dd3f1a65f
--- /dev/null
+++ b/app/controllers/pwa_controller.rb
@@ -0,0 +1,15 @@
+class PwaController < ApplicationController
+  skip_authentication
+
+  def manifest
+    # Force JSON format to avoid MissingTemplate errors when browsers request /manifest
+    # with HTML Accept headers (Safari Mobile does this for PWA manifest discovery)
+    render "pwa/manifest", content_type: "application/manifest+json"
+  end
+
+  def service_worker
+    # Explicitly render JS template to avoid format negotiation issues
+    render "pwa/service-worker", content_type: "application/javascript"
+  end
+  # Renders app/views/pwa/service-worker.js with content type application/javascript
+end
diff --git a/app/controllers/registrations_controller.rb b/app/controllers/registrations_controller.rb
index 074f46cbd..5da04aaf3 100644
--- a/app/controllers/registrations_controller.rb
+++ b/app/controllers/registrations_controller.rb
@@ -6,7 +6,6 @@ class RegistrationsController < ApplicationController
   before_action :ensure_signup_open, if: :self_hosted?
   before_action :set_user, only: :create
   before_action :set_invitation
-  before_action :claim_invite_code, only: :create, if: :invite_code_required?
   before_action :validate_password_requirements, only: :create
 
   def new
@@ -29,10 +28,10 @@ class RegistrationsController < ApplicationController
       @user.role = User.role_for_new_family_creator
     end
 
-    if @user.save
-      @invitation&.update!(accepted_at: Time.current)
-      @session = create_session_for(@user)
+    if signup_with_invite_claim!
       redirect_to root_path, notice: t(".success")
+    elsif @invite_code_invalid
+      redirect_to new_registration_path, alert: t("registrations.create.invalid_invite_code")
     else
       render :new, status: :unprocessable_entity, alert: t(".failure")
     end
@@ -55,10 +54,30 @@ class RegistrationsController < ApplicationController
       specific_param ? params[specific_param] : params
     end
 
-    def claim_invite_code
-      unless InviteCode.claim! params[:user][:invite_code]
-        redirect_to new_registration_path, alert: t("registrations.create.invalid_invite_code")
+    # Keep save+claim atomic so failed signups never burn valid invite codes.
+    def signup_with_invite_claim!
+      invite_code = user_params[:invite_code]
+      @invite_code_invalid = invite_code_required? && invite_code.blank?
+      return false if @invite_code_invalid
+
+      success = false
+
+      ActiveRecord::Base.transaction do
+        unless @user.save
+          raise ActiveRecord::Rollback
+        end
+
+        if invite_code_required? && !InviteCode.claim!(invite_code)
+          @invite_code_invalid = true
+          raise ActiveRecord::Rollback
+        end
+
+        @invitation&.update!(accepted_at: Time.current)
+        @session = create_session_for(@user)
+        success = true
       end
+
+      success
     end
 
     def validate_password_requirements
diff --git a/app/controllers/reports_controller.rb b/app/controllers/reports_controller.rb
index 47202ec48..26a03f23d 100644
--- a/app/controllers/reports_controller.rb
+++ b/app/controllers/reports_controller.rb
@@ -12,7 +12,7 @@ class ReportsController < ApplicationController
     # Build reports sections for collapsible/reorderable UI
     @reports_sections = build_reports_sections
 
-    @breadcrumbs = [ [ "Home", root_path ], [ "Reports", nil ] ]
+    @breadcrumbs = [ [ t("breadcrumbs.home"), root_path ], [ t("breadcrumbs.reports"), nil ] ]
   end
 
   def print
@@ -88,6 +88,15 @@ class ReportsController < ApplicationController
     # It will render *inside* the modal frame.
   end
 
+  def picker
+    @period_type = params[:period_type]&.to_sym || :monthly
+    @start_date = parse_date_param(:start_date) || Date.current.beginning_of_month
+    render partial: "reports/period_picker", locals: {
+      period_type: @period_type,
+      start_date: @start_date
+    }
+  end
+
   private
     def setup_report_data(show_flash: false)
       @period_type = params[:period_type]&.to_sym || :monthly
@@ -128,6 +137,9 @@ class ReportsController < ApplicationController
 
       # Flags for view rendering
       @has_accounts = accessible_accounts.any?
+
+      # Build navigation links for period switching
+      @nav = build_period_navigation
     end
 
     def preferences_params
@@ -388,7 +400,11 @@ class ReportsController < ApplicationController
       # Helper to process an entry (transaction or trade)
       process_entry = ->(category, entry, is_trade) do
         type = entry.amount > 0 ? "expense" : "income"
-        converted_amount = Money.new(entry.amount.abs, entry.currency).exchange_to(family_currency, fallback_rate: 1).amount
+        begin
+          converted_amount = Money.new(entry.amount.abs, entry.currency).exchange_to(family_currency).amount
+        rescue Money::ConversionError
+          converted_amount = entry.amount.abs
+        end
 
         if category.nil?
           # Uncategorized or Other Investments (for trades)
@@ -497,6 +513,32 @@ class ReportsController < ApplicationController
 
       trades_by_treatment = sell_trades.group_by { |t| t.entry.account.tax_treatment || :taxable }
 
+      # Unwrap helper: Trend#value / realized_gain_loss#value are Money objects,
+      # and this codebase's Money keeps the source currency through `*` and
+      # through `Money.new(money, _)`. Unwrapping to BigDecimal first keeps sums
+      # and the final Money.new(..., currency) correctly labeled in family currency.
+      to_numeric = ->(value) { value.is_a?(Money) ? value.amount : value }
+
+      # Unrealized gains mark holdings to market, so convert at today's FX.
+      foreign_holding_currencies = current_holdings.map(&:currency).compact.uniq.reject { |c| c == currency }
+      holding_rates = ExchangeRate.rates_for(foreign_holding_currencies, to: currency, date: Date.current)
+      convert_current = ->(amount, from) {
+        numeric = to_numeric.call(amount)
+        from == currency ? numeric : numeric * (holding_rates[from] || 1)
+      }
+
+      # Realized gains are locked at trade time, so convert each at its own
+      # entry-date FX. Mirrors InvestmentStatement::Totals, which also uses
+      # entry-date rates for contributions/withdrawals on this same card.
+      foreign_trade_currencies = sell_trades.map(&:currency).compact.uniq.reject { |c| c == currency }
+      rates_by_trade_date = sell_trades.map { |t| t.entry.date }.uniq.each_with_object({}) do |date, memo|
+        memo[date] = ExchangeRate.rates_for(foreign_trade_currencies, to: currency, date: date)
+      end
+      convert_trade = ->(amount, from, date) {
+        numeric = to_numeric.call(amount)
+        from == currency ? numeric : numeric * (rates_by_trade_date.dig(date, from) || 1)
+      }
+
       # Build metrics per treatment
       %i[taxable tax_deferred tax_exempt tax_advantaged].each_with_object({}) do |treatment, hash|
         holdings = holdings_by_treatment[treatment] || []
@@ -505,13 +547,13 @@ class ReportsController < ApplicationController
         # Sum unrealized gains from holdings (only those with known cost basis)
         unrealized = holdings.sum do |h|
           trend = h.trend
-          trend ? trend.value : 0
+          trend ? convert_current.call(trend.value, h.currency) : 0
         end
 
         # Sum realized gains from sell trades
         realized = trades.sum do |t|
           gain = t.realized_gain_loss
-          gain ? gain.value : 0
+          gain ? convert_trade.call(gain.value, t.currency, t.entry.date) : 0
         end
 
         # Only include treatment groups that have some activity
@@ -679,7 +721,11 @@ class ReportsController < ApplicationController
         month_key = entry.date.beginning_of_month
 
         # Convert to family currency
-        converted_amount = Money.new(entry.amount.abs, entry.currency).exchange_to(family_currency, fallback_rate: 1).amount
+        begin
+          converted_amount = Money.new(entry.amount.abs, entry.currency).exchange_to(family_currency).amount
+        rescue Money::ConversionError
+          converted_amount = entry.amount.abs
+        end
 
         key = [ category_name, type ]
         breakdown[key] ||= { category: category_name, type: type, months: {}, total: 0 }
@@ -1036,4 +1082,65 @@ class ReportsController < ApplicationController
 
       true
     end
+
+    def build_period_navigation
+      # Called at the end of setup_report_data, so @start_date and @end_date are guaranteed to be set.
+      case @period_type
+      when :monthly
+        prev_start = @start_date.beginning_of_month - 1.month
+        prev_end   = prev_start.end_of_month
+        next_start = @start_date.beginning_of_month + 1.month
+        next_end   = next_start.end_of_month
+        at_latest  = @start_date.beginning_of_month >= Date.current.beginning_of_month
+      when :quarterly
+        prev_start = (@start_date.beginning_of_quarter - 1.day).beginning_of_quarter
+        prev_end   = prev_start.end_of_quarter
+        next_start = @end_date.end_of_quarter + 1.day
+        next_end   = next_start.end_of_quarter
+        at_latest  = @start_date.beginning_of_quarter >= Date.current.beginning_of_quarter
+      when :ytd
+        prev_year  = @start_date.year - 1
+        prev_start = Date.new(prev_year, 1, 1)
+        prev_end   = Date.new(prev_year, 12, 31)
+        next_year  = @start_date.year + 1
+        next_start = Date.new(next_year, 1, 1)
+        next_end   = next_year == Date.current.year ? Date.current : Date.new(next_year, 12, 31)
+        at_latest  = @start_date.year >= Date.current.year
+      when :last_6_months
+        prev_start = @start_date.beginning_of_month - 6.months
+        prev_end   = prev_start + 6.months - 1.day
+        candidate_start = @start_date.beginning_of_month + 6.months
+        if candidate_start + 6.months >= Date.current.beginning_of_month
+          next_end   = Date.current.end_of_month
+          next_start = (next_end + 1.day - 6.months).beginning_of_month
+        else
+          next_start = candidate_start
+          next_end   = next_start + 6.months - 1.day
+        end
+        at_latest  = @end_date >= Date.current.end_of_month
+      else
+        return nil
+      end
+
+      { prev_start: prev_start, prev_end: prev_end, next_start: next_start, next_end: next_end, at_latest: at_latest, label: period_label }
+    end
+
+    def period_label
+      case @period_type
+      when :monthly
+        I18n.l(@start_date, format: :month_year)
+      when :quarterly
+        t("reports.index.period_label.quarterly", quarter: @start_date.quarter, year: @start_date.year)
+      when :ytd
+        if @start_date.year == Date.current.year
+          t("reports.index.period_label.ytd", year: @start_date.year)
+        else
+          t("reports.index.period_label.past_year", year: @start_date.year)
+        end
+      when :last_6_months
+        t("reports.index.period_label.last_6_months",
+          start: I18n.l(@start_date, format: :short_month_year),
+          end: I18n.l(@end_date, format: :short_month_year))
+      end
+    end
 end
diff --git a/app/controllers/rules_controller.rb b/app/controllers/rules_controller.rb
index 5e7496cb8..ae9e1ee1f 100644
--- a/app/controllers/rules_controller.rb
+++ b/app/controllers/rules_controller.rb
@@ -86,8 +86,8 @@ class RulesController < ApplicationController
   def update
     if @rule.update(rule_params)
       respond_to do |format|
-        format.html { redirect_back_or_to rules_path, notice: "Rule updated" }
-        format.turbo_stream { stream_redirect_back_or_to rules_path, notice: "Rule updated" }
+        format.html { redirect_back_or_to rules_path, notice: t(".success") }
+        format.turbo_stream { stream_redirect_back_or_to rules_path, notice: t(".success") }
       end
     else
       render :edit, status: :unprocessable_entity
@@ -96,12 +96,12 @@ class RulesController < ApplicationController
 
   def destroy
     @rule.destroy
-    redirect_to rules_path, notice: "Rule deleted"
+    redirect_to rules_path, notice: t(".success")
   end
 
   def destroy_all
     Current.family.rules.destroy_all
-    redirect_to rules_path, notice: "All rules deleted"
+    redirect_to rules_path, notice: t(".success")
   end
 
   def confirm_all
diff --git a/app/controllers/settings/ai_prompts_controller.rb b/app/controllers/settings/ai_prompts_controller.rb
index ecd42b6f0..dddbc15df 100644
--- a/app/controllers/settings/ai_prompts_controller.rb
+++ b/app/controllers/settings/ai_prompts_controller.rb
@@ -3,8 +3,8 @@ class Settings::AiPromptsController < ApplicationController
 
   def show
     @breadcrumbs = [
-      [ "Home", root_path ],
-      [ "AI Prompts", nil ]
+      [ t("breadcrumbs.home"), root_path ],
+      [ t("breadcrumbs.ai_prompts"), nil ]
     ]
     @family = Current.family
     @assistant_config = Assistant.config_for(OpenStruct.new(user: Current.user))
diff --git a/app/controllers/settings/api_keys_controller.rb b/app/controllers/settings/api_keys_controller.rb
index c509df41a..cb8b2c3db 100644
--- a/app/controllers/settings/api_keys_controller.rb
+++ b/app/controllers/settings/api_keys_controller.rb
@@ -7,8 +7,8 @@ class Settings::ApiKeysController < ApplicationController
 
   def show
     @breadcrumbs = [
-      [ "Home", root_path ],
-      [ "API Key", nil ]
+      [ t("breadcrumbs.home"), root_path ],
+      [ t("breadcrumbs.api_key"), nil ]
     ]
     @current_api_key = @api_key
   end
@@ -31,7 +31,7 @@ class Settings::ApiKeysController < ApplicationController
     existing_keys.each { |key| key.update_column(:revoked_at, Time.current) }
 
     if @api_key.save
-      flash[:notice] = "Your API key has been created successfully"
+      flash[:notice] = t(".success")
       redirect_to settings_api_key_path
     else
       # Restore existing keys if new key creation failed
@@ -42,13 +42,13 @@ class Settings::ApiKeysController < ApplicationController
 
   def destroy
     if @api_key.nil?
-      flash[:alert] = "API key not found"
+      flash[:alert] = t(".not_found")
     elsif @api_key.demo_monitoring_key?
-      flash[:alert] = "This API key cannot be revoked"
+      flash[:alert] = t(".cannot_revoke")
     elsif @api_key.revoke!
-      flash[:notice] = "API key has been revoked successfully"
+      flash[:notice] = t(".revoked_successfully")
     else
-      flash[:alert] = "Failed to revoke API key"
+      flash[:alert] = t(".revoke_failed")
     end
     redirect_to settings_api_key_path
   end
diff --git a/app/controllers/settings/bank_sync_controller.rb b/app/controllers/settings/bank_sync_controller.rb
deleted file mode 100644
index f954e5369..000000000
--- a/app/controllers/settings/bank_sync_controller.rb
+++ /dev/null
@@ -1,36 +0,0 @@
-class Settings::BankSyncController < ApplicationController
-  layout "settings"
-
-  def show
-    @providers = [
-      {
-        name: "Lunch Flow",
-        description: "US, Canada, UK, EU, Brazil and Asia through multiple open banking providers.",
-        path: "https://lunchflow.app/features/sure-integration?atp=BiDIYS",
-        target: "_blank",
-        rel: "noopener noreferrer"
-      },
-      {
-        name: "Plaid",
-        description: "US & Canada bank connections with transactions, investments, and liabilities.",
-        path: "https://github.com/we-promise/sure/blob/main/docs/hosting/plaid.md",
-        target: "_blank",
-        rel: "noopener noreferrer"
-      },
-      {
-        name: "SimpleFIN",
-        description: "US & Canada connections via SimpleFIN protocol.",
-        path: "https://beta-bridge.simplefin.org",
-        target: "_blank",
-        rel: "noopener noreferrer"
-      },
-      {
-        name: "Enable Banking (beta)",
-        description: "European bank connections via open banking APIs across multiple countries.",
-        path: "https://enablebanking.com",
-        target: "_blank",
-        rel: "noopener noreferrer"
-      }
-    ]
-  end
-end
diff --git a/app/controllers/settings/debugs_controller.rb b/app/controllers/settings/debugs_controller.rb
new file mode 100644
index 000000000..aebed5616
--- /dev/null
+++ b/app/controllers/settings/debugs_controller.rb
@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+class Settings::DebugsController < Admin::BaseController
+  FILTER_ID_PARAMS = %i[family_id account_id user_id account_provider_id].freeze
+
+  def show
+    filter_params = debug_filters_params
+
+    @start_date = safe_parse_date(filter_params[:start_date])
+    @end_date = safe_parse_date(filter_params[:end_date])
+
+    @breadcrumbs = [
+      [ t("breadcrumbs.home"), root_path ],
+      [ t("settings.debugs.show.page_title"), nil ]
+    ]
+
+    scope = DebugLogEntry.includes(:family, :account, :user, :account_provider).recent
+    scope = scope.with_category(filter_params[:category])
+    scope = scope.with_level(filter_params[:level])
+    scope = scope.with_source(filter_params[:source])
+    scope = scope.with_provider_key(filter_params[:provider_key])
+
+    FILTER_ID_PARAMS.each do |key|
+      value = safe_uuid(filter_params[key])
+      scope = scope.where(key => value) if value.present?
+    end
+
+    scope = scope.where("created_at >= ?", @start_date.beginning_of_day) if @start_date.present?
+    scope = scope.where("created_at < ?", @end_date.next_day.beginning_of_day) if @end_date.present?
+
+    @pagy, @debug_log_entries = pagy(scope, limit: safe_per_page(50))
+    @categories = DebugLogEntry.distinct.order(:category).pluck(:category)
+    @levels = DebugLogEntry::LEVELS
+    @sources = DebugLogEntry.distinct.order(:source).pluck(:source)
+    @provider_keys = DebugLogEntry.where.not(provider_key: [ nil, "" ]).distinct.order(:provider_key).pluck(:provider_key)
+  end
+
+  private
+    def safe_parse_date(value)
+      Date.iso8601(value)
+    rescue ArgumentError, TypeError
+      nil
+    end
+
+    def safe_uuid(value)
+      return if value.blank?
+
+      uuid = value.to_s.strip
+      uuid.match?(/\A[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\z/i) ? uuid : nil
+    end
+
+    def debug_filters_params
+      params.permit(:category, :level, :source, :provider_key, :start_date, :end_date, *FILTER_ID_PARAMS)
+    end
+end
diff --git a/app/controllers/settings/guides_controller.rb b/app/controllers/settings/guides_controller.rb
index a21840a91..c078d15dd 100644
--- a/app/controllers/settings/guides_controller.rb
+++ b/app/controllers/settings/guides_controller.rb
@@ -3,8 +3,8 @@ class Settings::GuidesController < ApplicationController
 
   def show
     @breadcrumbs = [
-      [ "Home", root_path ],
-      [ "Guides", nil ]
+      [ t("breadcrumbs.home"), root_path ],
+      [ t("breadcrumbs.guides"), nil ]
     ]
     markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML,
       autolink: true,
diff --git a/app/controllers/settings/hostings_controller.rb b/app/controllers/settings/hostings_controller.rb
index f3a63e9a7..e2a577bfc 100644
--- a/app/controllers/settings/hostings_controller.rb
+++ b/app/controllers/settings/hostings_controller.rb
@@ -1,6 +1,15 @@
 class Settings::HostingsController < ApplicationController
   layout "settings"
 
+  # Minimum accepted value for each configurable LLM budget field. Mirrors the
+  # `min:` attribute on the form inputs in `_openai_settings.html.erb` so the
+  # controller rejects what the browser-side validator would reject.
+  LLM_BUDGET_MINIMUMS = {
+    llm_context_window: 256,
+    llm_max_response_tokens: 64,
+    llm_max_items_per_call: 1
+  }.freeze
+
   guard_feature unless: -> { self_hosted? }
 
   before_action :ensure_admin, only: [ :update, :clear_cache, :disconnect_external_assistant ]
@@ -8,19 +17,20 @@ class Settings::HostingsController < ApplicationController
 
   def show
     @breadcrumbs = [
-      [ "Home", root_path ],
-      [ "Self-Hosting", nil ]
+      [ t("breadcrumbs.home"), root_path ],
+      [ t("breadcrumbs.self_hosting"), nil ]
     ]
 
     # Determine which providers are currently selected
     exchange_rate_provider = ENV["EXCHANGE_RATE_PROVIDER"].presence || Setting.exchange_rate_provider
-    securities_provider = ENV["SECURITIES_PROVIDER"].presence || Setting.securities_provider
+    enabled_securities = Setting.enabled_securities_providers
 
-    # Show Twelve Data settings if either provider is set to twelve_data
-    @show_twelve_data_settings = exchange_rate_provider == "twelve_data" || securities_provider == "twelve_data"
-
-    # Show Yahoo Finance settings if either provider is set to yahoo_finance
-    @show_yahoo_finance_settings = exchange_rate_provider == "yahoo_finance" || securities_provider == "yahoo_finance"
+    # Show provider settings if used for FX or enabled for securities
+    @show_twelve_data_settings = exchange_rate_provider == "twelve_data" || enabled_securities.include?("twelve_data")
+    @show_yahoo_finance_settings = exchange_rate_provider == "yahoo_finance" || enabled_securities.include?("yahoo_finance")
+    @show_tiingo_settings = enabled_securities.include?("tiingo")
+    @show_eodhd_settings = enabled_securities.include?("eodhd")
+    @show_alpha_vantage_settings = enabled_securities.include?("alpha_vantage")
 
     # Only fetch provider data if we're showing the section
     if @show_twelve_data_settings
@@ -57,9 +67,7 @@ class Settings::HostingsController < ApplicationController
       Setting.brand_fetch_high_res_logos = hosting_params[:brand_fetch_high_res_logos] == "1"
     end
 
-    if hosting_params.key?(:twelve_data_api_key)
-      Setting.twelve_data_api_key = hosting_params[:twelve_data_api_key]
-    end
+    update_encrypted_setting(:twelve_data_api_key)
 
     if hosting_params.key?(:exchange_rate_provider)
       Setting.exchange_rate_provider = hosting_params[:exchange_rate_provider]
@@ -69,6 +77,40 @@ class Settings::HostingsController < ApplicationController
       Setting.securities_provider = hosting_params[:securities_provider]
     end
 
+    if hosting_params.key?(:securities_providers)
+      new_providers = Array(hosting_params[:securities_providers]).reject(&:blank?) & Security.valid_price_providers
+      old_providers = Setting.enabled_securities_providers
+
+      Setting.securities_providers = new_providers.join(",")
+
+      # Clear the legacy singular setting so the fallback in
+      # enabled_securities_providers doesn't re-enable a provider
+      # the user just unchecked.
+      Setting.securities_provider = nil if new_providers.empty?
+
+      # Mark securities linked to removed providers as offline so they aren't
+      # silently queried against an incompatible fallback provider (e.g. MFAPI
+      # scheme codes sent to TwelveData). The price_provider is preserved so
+      # provider_status can report :provider_unavailable.
+      removed = old_providers - new_providers
+      removed.each do |removed_provider|
+        Security.where(price_provider: removed_provider, offline: false)
+                .in_batches.update_all(offline: true, offline_reason: "provider_disabled")
+      end
+
+      # Bring securities back online when their provider is re-enabled — but only
+      # those that were taken offline by a provider toggle, not by health checks.
+      added = new_providers - old_providers
+      added.each do |added_provider|
+        Security.where(price_provider: added_provider, offline: true, offline_reason: "provider_disabled")
+                .in_batches.update_all(offline: false, offline_reason: nil, failed_fetch_count: 0, failed_fetch_at: nil)
+      end
+    end
+
+    update_encrypted_setting(:tiingo_api_key)
+    update_encrypted_setting(:eodhd_api_key)
+    update_encrypted_setting(:alpha_vantage_api_key)
+
     if hosting_params.key?(:syncs_include_pending)
       Setting.syncs_include_pending = hosting_params[:syncs_include_pending] == "1"
     end
@@ -124,6 +166,21 @@ class Settings::HostingsController < ApplicationController
       Setting.openai_json_mode = hosting_params[:openai_json_mode].presence
     end
 
+    LLM_BUDGET_MINIMUMS.each do |key, minimum|
+      next unless hosting_params.key?(key)
+      raw = hosting_params[key].to_s.strip
+      if raw.blank?
+        Setting.public_send("#{key}=", nil)
+        next
+      end
+      parsed = Integer(raw, 10) rescue nil
+      if parsed.nil? || parsed < minimum
+        label = t("settings.hostings.openai_settings.#{key}_label")
+        raise Setting::ValidationError, t(".invalid_llm_budget", field: label, minimum: minimum)
+      end
+      Setting.public_send("#{key}=", parsed)
+    end
+
     if hosting_params.key?(:external_assistant_url)
       Setting.external_assistant_url = hosting_params[:external_assistant_url]
     end
@@ -166,7 +223,7 @@ class Settings::HostingsController < ApplicationController
   private
     def hosting_params
       return ActionController::Parameters.new unless params.key?(:setting)
-      params.require(:setting).permit(:onboarding_state, :require_email_confirmation, :invite_only_default_family_id, :brand_fetch_client_id, :brand_fetch_high_res_logos, :twelve_data_api_key, :openai_access_token, :openai_uri_base, :openai_model, :openai_json_mode, :exchange_rate_provider, :securities_provider, :syncs_include_pending, :auto_sync_enabled, :auto_sync_time, :external_assistant_url, :external_assistant_token, :external_assistant_agent_id)
+      params.require(:setting).permit(:onboarding_state, :require_email_confirmation, :invite_only_default_family_id, :brand_fetch_client_id, :brand_fetch_high_res_logos, :twelve_data_api_key, :tiingo_api_key, :eodhd_api_key, :alpha_vantage_api_key, :openai_access_token, :openai_uri_base, :openai_model, :openai_json_mode, :llm_context_window, :llm_max_response_tokens, :llm_max_items_per_call, :exchange_rate_provider, :securities_provider, :syncs_include_pending, :auto_sync_enabled, :auto_sync_time, :external_assistant_url, :external_assistant_token, :external_assistant_agent_id, securities_providers: [])
     end
 
     def update_assistant_type
@@ -195,6 +252,12 @@ class Settings::HostingsController < ApplicationController
       flash[:alert] = t(".scheduler_sync_failed")
     end
 
+    def update_encrypted_setting(param_key)
+      return unless hosting_params.key?(param_key)
+      value = hosting_params[param_key].to_s.strip
+      Setting.public_send(:"#{param_key}=", value) unless value.blank? || value == "********"
+    end
+
     def current_user_timezone
       Current.family&.timezone.presence || "UTC"
     end
diff --git a/app/controllers/settings/llm_usages_controller.rb b/app/controllers/settings/llm_usages_controller.rb
index 8013ecdff..73ec812b8 100644
--- a/app/controllers/settings/llm_usages_controller.rb
+++ b/app/controllers/settings/llm_usages_controller.rb
@@ -3,8 +3,8 @@ class Settings::LlmUsagesController < ApplicationController
 
   def show
     @breadcrumbs = [
-      [ "Home", root_path ],
-      [ "LLM Usage", nil ]
+      [ t("breadcrumbs.home"), root_path ],
+      [ t("breadcrumbs.llm_usage"), nil ]
     ]
     @family = Current.family
 
diff --git a/app/controllers/settings/preferences_controller.rb b/app/controllers/settings/preferences_controller.rb
index 83f9e2e44..5798c573e 100644
--- a/app/controllers/settings/preferences_controller.rb
+++ b/app/controllers/settings/preferences_controller.rb
@@ -4,4 +4,24 @@ class Settings::PreferencesController < ApplicationController
   def show
     @user = Current.user
   end
+
+  # Writes per-user boolean preferences stored in the JSONB `users.preferences`
+  # column. Mirrors Settings::AppearancesController#update so the toggle card on
+  # the Preferences page can submit directly without going through the broader
+  # UsersController#update flow (which expects a full user form payload).
+  def update
+    @user = Current.user
+    user_params = params.permit(user: [ :preview_features_enabled ]).fetch(:user, {})
+
+    @user.transaction do
+      @user.lock!
+      updated_prefs = (@user.preferences || {}).deep_dup
+      if user_params.key?(:preview_features_enabled)
+        updated_prefs["preview_features_enabled"] =
+          ActiveModel::Type::Boolean.new.cast(user_params[:preview_features_enabled])
+      end
+      @user.update!(preferences: updated_prefs)
+    end
+    redirect_to settings_preferences_path
+  end
 end
diff --git a/app/controllers/settings/profiles_controller.rb b/app/controllers/settings/profiles_controller.rb
index 6e8dbbf0e..e1f3b5db4 100644
--- a/app/controllers/settings/profiles_controller.rb
+++ b/app/controllers/settings/profiles_controller.rb
@@ -6,8 +6,8 @@ class Settings::ProfilesController < ApplicationController
     @users = Current.family.users.order(:created_at)
     @pending_invitations = Current.family.invitations.pending
     @breadcrumbs = [
-      [ "Home", root_path ],
-      [ "Profile Info", nil ]
+      [ t("breadcrumbs.home"), root_path ],
+      [ t("breadcrumbs.profile"), nil ]
     ]
   end
 
@@ -29,9 +29,9 @@ class Settings::ProfilesController < ApplicationController
     if @user.destroy
       # Also destroy the invitation associated with this user for this family
       Current.family.invitations.find_by(email: @user.email)&.destroy
-      flash[:notice] = "Member removed successfully."
+      flash[:notice] = t(".member_removed")
     else
-      flash[:alert] = "Failed to remove member."
+      flash[:alert] = t(".member_removal_failed")
     end
 
     redirect_to settings_profile_path
diff --git a/app/controllers/settings/providers_controller.rb b/app/controllers/settings/providers_controller.rb
index b8c07784b..2d123f2ab 100644
--- a/app/controllers/settings/providers_controller.rb
+++ b/app/controllers/settings/providers_controller.rb
@@ -1,12 +1,12 @@
 class Settings::ProvidersController < ApplicationController
-  layout "settings"
+  layout -> { turbo_frame_request? ? "turbo_rails/frame" : "settings" }
 
-  before_action :ensure_admin, only: [ :show, :update ]
+  before_action :ensure_admin, only: [ :show, :update, :sync_all, :sync, :connect_form ]
 
   def show
     @breadcrumbs = [
-      [ "Home", root_path ],
-      [ "Sync Providers", nil ]
+      [ t("breadcrumbs.home"), root_path ],
+      [ t("breadcrumbs.bank_sync"), nil ]
     ]
 
     prepare_show_context
@@ -66,17 +66,72 @@ class Settings::ProvidersController < ApplicationController
       # Reload provider configurations if needed
       reload_provider_configs(updated_fields)
 
-      redirect_to settings_providers_path, notice: "Provider settings updated successfully"
+      redirect_to settings_providers_path, notice: t(".updated_successfully")
     else
-      redirect_to settings_providers_path, notice: "No changes were made"
+      redirect_to settings_providers_path, notice: t(".no_changes")
     end
   rescue => error
-    Rails.logger.error("Failed to update provider settings: #{error.message}")
-    flash.now[:alert] = "Failed to update provider settings: #{error.message}"
+    Rails.logger.error("Failed to update provider settings: #{error.class} - #{error.message}")
+    flash.now[:alert] = "Failed to update provider settings. Please try again."
     prepare_show_context
     render :show, status: :unprocessable_entity
   end
 
+  def sync_all
+    family = Current.family
+    now = Time.current
+
+    updated_count = Family
+      .where(id: family.id)
+      .where("last_sync_all_attempted_at IS NULL OR last_sync_all_attempted_at <= ?", 30.seconds.ago)
+      .update_all(last_sync_all_attempted_at: now, updated_at: now)
+
+    if updated_count.zero?
+      return redirect_to settings_providers_path, notice: t("settings.providers.sync_all_recently")
+    end
+
+    SyncAllProvidersJob.perform_later(family.id)
+    redirect_to settings_providers_path, notice: t("settings.providers.sync_all_in_progress")
+  end
+
+  def sync
+    provider_key  = params[:provider_key]
+    syncable_type = PANEL_SYNCABLE_TYPES[provider_key]
+    return redirect_to settings_providers_path unless syncable_type
+
+    items = syncable_type.constantize.where(family: Current.family).syncable
+    scheduled = items.reject(&:syncing?)
+    scheduled.each(&:sync_later)
+
+    notice_key = scheduled.any? ? "settings.providers.sync_provider_in_progress" : "settings.providers.sync_provider_no_items"
+    redirect_to settings_providers_path, notice: t(notice_key)
+  end
+
+  def connect_form
+    provider_key = params[:provider_key]
+
+    panel = FAMILY_PANELS.find { |p| p[:key] == provider_key }
+    if panel
+      @panel_key     = panel[:key]
+      @panel_partial = panel[:partial]
+      @panel_title   = panel[:title]
+      load_provider_items(provider_key)
+      return render :connect_form
+    end
+
+    Provider::Factory.ensure_adapters_loaded
+    config = Provider::ConfigurationRegistry.all.find { |c| c.provider_key.to_s == provider_key }
+    if config
+      @panel_title           = Provider::Metadata.for(provider_key)[:name] || provider_key.titleize
+      @provider_configuration = config
+      return render :connect_form
+    end
+
+    redirect_to settings_providers_path, alert: t("settings.providers.not_found")
+  rescue ActiveRecord::Encryption::Errors::Configuration
+    redirect_to settings_providers_path, alert: t("settings.providers.encryption_error.title")
+  end
+
   private
     def provider_params
       # Dynamically permit all provider configuration fields
@@ -93,7 +148,9 @@ class Settings::ProvidersController < ApplicationController
     end
 
     def ensure_admin
-      redirect_to settings_providers_path, alert: "Not authorized" unless Current.user.admin?
+      return if Current.user.admin?
+
+      redirect_to root_path, alert: t("settings.providers.not_authorized")
     end
 
     # Reload provider configurations after settings update
@@ -119,28 +176,192 @@ class Settings::ProvidersController < ApplicationController
       end
     end
 
+    # Hardcoded family-scoped panels — provider connections are managed through
+    # their own models (SimplefinItem, LunchflowItem, etc.) rather than global
+    # settings, so they need custom UI per-provider for connection management,
+    # status display, and sync actions. The configuration registry excludes
+    # them (see prepare_show_context).
+    FAMILY_PANELS = [
+      { key: "lunchflow",      title: "Lunch Flow",      turbo_id: "lunchflow",      partial: "lunchflow_panel" },
+      { key: "simplefin",      title: "SimpleFIN",       turbo_id: "simplefin",      partial: "simplefin_panel" },
+      { key: "enable_banking", title: "Enable Banking",  turbo_id: "enable_banking", partial: "enable_banking_panel" },
+      { key: "coinstats",      title: "CoinStats",       turbo_id: "coinstats",      partial: "coinstats_panel" },
+      { key: "mercury",        title: "Mercury",         turbo_id: "mercury",        partial: "mercury_panel" },
+      { key: "brex",           title: "Brex",            turbo_id: "brex",           partial: "brex_panel" },
+      { key: "coinbase",       title: "Coinbase",        turbo_id: "coinbase",       partial: "coinbase_panel" },
+      { key: "binance",        title: "Binance",         turbo_id: "binance",        partial: "binance_panel" },
+      { key: "kraken",         title: "Kraken",          turbo_id: "kraken",         partial: "kraken_panel" },
+      { key: "snaptrade",      title: "SnapTrade",       turbo_id: "snaptrade",      partial: "snaptrade_panel", auto_open: "manage" },
+      { key: "ibkr",           title: "Interactive Brokers", turbo_id: "ibkr",      partial: "ibkr_panel" },
+      { key: "indexa_capital", title: "Indexa Capital",  turbo_id: "indexa_capital", partial: "indexa_capital_panel" },
+      { key: "sophtron",       title: "Sophtron",        turbo_id: "sophtron",       partial: "sophtron_panel" }
+    ].freeze
+
+    FAMILY_PANEL_KEYS = FAMILY_PANELS.map { |p| p[:key] }.freeze
+
+    # Maps panel key → ActiveRecord model name for sync health queries
+    PANEL_SYNCABLE_TYPES = {
+      "simplefin"      => "SimplefinItem",
+      "lunchflow"      => "LunchflowItem",
+      "enable_banking" => "EnableBankingItem",
+      "coinstats"      => "CoinstatsItem",
+      "mercury"        => "MercuryItem",
+      "brex"           => "BrexItem",
+      "coinbase"       => "CoinbaseItem",
+      "binance"        => "BinanceItem",
+      "kraken"         => "KrakenItem",
+      "snaptrade"      => "SnaptradeItem",
+      "ibkr"           => "IbkrItem",
+      "indexa_capital" => "IndexaCapitalItem",
+      "sophtron"       => "SophtronItem"
+    }.freeze
+
+    def load_provider_items(provider_key)
+      case provider_key
+      when "simplefin"
+        @simplefin_items = Current.family.simplefin_items.ordered
+      when "lunchflow"
+        @lunchflow_items = Current.family.lunchflow_items.ordered
+      when "enable_banking"
+        @enable_banking_items = Current.family.enable_banking_items.ordered
+      when "coinstats"
+        @coinstats_items = Current.family.coinstats_items.ordered
+      when "mercury"
+        @mercury_items = Current.family.mercury_items.active.ordered.includes(:syncs, :mercury_accounts)
+      when "brex"
+        @brex_items = Current.family.brex_items.active.ordered.includes(:syncs, :brex_accounts)
+      when "coinbase"
+        @coinbase_items = Current.family.coinbase_items.ordered
+      when "binance"
+        @binance_items = Current.family.binance_items.active.ordered
+      when "kraken"
+        @kraken_items = Current.family.kraken_items.active.ordered
+      when "snaptrade"
+        @snaptrade_items = Current.family.snaptrade_items.includes(:snaptrade_accounts).ordered
+      when "ibkr"
+        @ibkr_items = Current.family.ibkr_items.ordered
+      when "indexa_capital"
+        @indexa_capital_items = Current.family.indexa_capital_items.ordered
+      when "sophtron"
+        @sophtron_items = Current.family.sophtron_items.ordered
+      end
+    end
+
     # Prepares instance vars needed by the show view and partials
     def prepare_show_context
-      # Load all provider configurations (exclude SimpleFin and Lunchflow, which have their own family-specific panels below)
+      # Load all provider configurations (exclude family-scoped panels, which have their own UI below)
       Provider::Factory.ensure_adapters_loaded
       @provider_configurations = Provider::ConfigurationRegistry.all.reject do |config|
-        config.provider_key.to_s.casecmp("simplefin").zero? || config.provider_key.to_s.casecmp("lunchflow").zero? || \
-        config.provider_key.to_s.casecmp("enable_banking").zero? || \
-        config.provider_key.to_s.casecmp("coinstats").zero? || \
-        config.provider_key.to_s.casecmp("mercury").zero? || \
-        config.provider_key.to_s.casecmp("coinbase").zero? || \
-        config.provider_key.to_s.casecmp("snaptrade").zero? || \
-        config.provider_key.to_s.casecmp("indexa_capital").zero?
+        FAMILY_PANEL_KEYS.any? { |key| config.provider_key.to_s.casecmp(key).zero? }
       end
 
       # Providers page only needs to know whether any SimpleFin/Lunchflow connections exist with valid credentials
       @simplefin_items = Current.family.simplefin_items.where.not(access_url: [ nil, "" ]).ordered.select(:id)
       @lunchflow_items = Current.family.lunchflow_items.where.not(api_key: [ nil, "" ]).ordered.select(:id)
       @enable_banking_items = Current.family.enable_banking_items.ordered # Enable Banking panel needs session info for status display
+      # Providers page only needs to know whether any Sophtron connections exist with valid credentials
+      @sophtron_items = Current.family.sophtron_items.where.not(user_id: [ nil, "" ], access_key: [ nil, "" ]).ordered.select(:id)
       @coinstats_items = Current.family.coinstats_items.ordered # CoinStats panel needs account info for status display
-      @mercury_items = Current.family.mercury_items.ordered.select(:id)
+      @mercury_items = Current.family.mercury_items.active.ordered
+      @brex_items = Current.family.brex_items.active.ordered
       @coinbase_items = Current.family.coinbase_items.ordered # Coinbase panel needs name and sync info for status display
-      @snaptrade_items = Current.family.snaptrade_items.includes(:snaptrade_accounts).ordered
+      @snaptrade_items = Current.family.snaptrade_items.ordered
+      @ibkr_items = Current.family.ibkr_items.ordered.select(:id)
       @indexa_capital_items = Current.family.indexa_capital_items.ordered.select(:id)
+      @binance_items = Current.family.binance_items.active.ordered
+      @kraken_items = Current.family.kraken_items.active.ordered
+
+      @provider_sync_health = compute_provider_sync_health(family_panel_items)
+
+      entries = build_provider_entries
+
+      @connected        = entries.select { |e| e[:summary][:status] == :ok }
+      @needs_attention  = entries.select { |e| [ :warn, :err ].include?(e[:summary][:status]) }
+      @available        = entries.select { |e| e[:summary][:status] == :off }
+
+      @health = view_context.provider_health_strip(connected: @connected, needs_attention: @needs_attention)
+    end
+
+    # Maps each family panel key to the loaded item collection. Used by
+    # compute_provider_sync_health and build_provider_entries to avoid relying
+    # on instance_variable_get for control flow.
+    def family_panel_items
+      {
+        "simplefin"      => @simplefin_items,
+        "lunchflow"      => @lunchflow_items,
+        "enable_banking" => @enable_banking_items,
+        "coinstats"      => @coinstats_items,
+        "mercury"        => @mercury_items,
+        "brex"           => @brex_items,
+        "coinbase"       => @coinbase_items,
+        "binance"        => @binance_items,
+        "kraken"         => @kraken_items,
+        "snaptrade"      => @snaptrade_items,
+        "ibkr"           => @ibkr_items,
+        "indexa_capital" => @indexa_capital_items,
+        "sophtron"       => @sophtron_items
+      }
+    end
+
+    # Returns a hash mapping provider key → { error:, last_synced_at:, stale: }
+    # by querying the latest sync per item for each family panel provider.
+    def compute_provider_sync_health(items_map)
+      PANEL_SYNCABLE_TYPES.each_with_object({}) do |(key, syncable_type), health|
+        ids = items_map[key]&.map(&:id)&.compact
+        next if ids.blank?
+
+        health[key] = sync_health_for(syncable_type, ids)
+      end
+    end
+
+    # Determines error/stale status and last successful sync time for a set of items.
+    def sync_health_for(syncable_type, item_ids)
+      # Use window function to get the single latest sync per item (same pattern as ProviderConnectionStatus)
+      ranked_subq = Sync
+        .where(syncable_type: syncable_type, syncable_id: item_ids)
+        .select("syncs.*, ROW_NUMBER() OVER (PARTITION BY syncable_id ORDER BY created_at DESC, id DESC) AS sync_rank")
+
+      latest_per_item = Sync.from(ranked_subq, :syncs).where("sync_rank = 1").to_a
+
+      has_error = latest_per_item.any? { |s| s.failed? || s.stale? }
+
+      last_synced = Sync
+        .where(syncable_type: syncable_type, syncable_id: item_ids, status: "completed")
+        .maximum(:completed_at)
+
+      stale = !has_error && last_synced.present? && last_synced < 24.hours.ago
+
+      { error: has_error, last_synced_at: last_synced, stale: stale }
+    end
+
+    # Builds a unified list of provider entries (registry-driven configurations
+    # and hardcoded family panels) with pre-computed status, sorted
+    # alphabetically by display title. Each entry carries enough data for the
+    # view to render either a provider_form or a family panel partial.
+    def build_provider_entries
+      configuration_entries = @provider_configurations.map do |config|
+        meta = Provider::Metadata.for(config.provider_key)
+        {
+          provider_key: config.provider_key.to_s,
+          title: meta[:name] || config.provider_key.to_s.titleize,
+          configuration: config,
+          maturity: meta[:maturity],
+          summary: view_context.provider_summary(config.provider_key)
+        }
+      end
+
+      family_entries = FAMILY_PANELS.map do |panel|
+        {
+          provider_key: panel[:key],
+          title: panel[:title],
+          turbo_id: panel[:turbo_id],
+          partial: panel[:partial],
+          auto_open_param: panel[:auto_open],
+          maturity: Provider::Metadata.for(panel[:key])[:maturity],
+          summary: view_context.provider_summary(panel[:key])
+        }
+      end
+
+      (configuration_entries + family_entries).sort_by { |entry| entry[:title].downcase }
     end
 end
diff --git a/app/controllers/settings/securities_controller.rb b/app/controllers/settings/securities_controller.rb
index fd6791994..d53bddd77 100644
--- a/app/controllers/settings/securities_controller.rb
+++ b/app/controllers/settings/securities_controller.rb
@@ -3,9 +3,10 @@ class Settings::SecuritiesController < ApplicationController
 
   def show
     @breadcrumbs = [
-      [ "Home", root_path ],
-      [ "Security", nil ]
+      [ t("breadcrumbs.home"), root_path ],
+      [ t("breadcrumbs.security"), nil ]
     ]
     @oidc_identities = Current.user.oidc_identities.order(:provider)
+    @webauthn_credentials = Current.user.webauthn_credentials.order(created_at: :asc)
   end
 end
diff --git a/app/controllers/settings/webauthn_credentials_controller.rb b/app/controllers/settings/webauthn_credentials_controller.rb
new file mode 100644
index 000000000..943ec75ea
--- /dev/null
+++ b/app/controllers/settings/webauthn_credentials_controller.rb
@@ -0,0 +1,83 @@
+class Settings::WebauthnCredentialsController < ApplicationController
+  include WebauthnRelyingParty
+
+  layout "settings"
+
+  before_action :ensure_mfa_enabled
+
+  def options
+    Current.user.ensure_webauthn_id!
+
+    registration_options = webauthn_relying_party.options_for_registration(
+      user: {
+        id: Current.user.webauthn_id,
+        name: Current.user.email,
+        display_name: Current.user.display_name
+      },
+      exclude: Current.user.webauthn_credentials.pluck(:credential_id),
+      authenticator_selection: { user_verification: "preferred" },
+      attestation: "none"
+    )
+
+    session[:webauthn_registration_challenge] = registration_options.challenge
+
+    render json: registration_options
+  end
+
+  def create
+    challenge = session.delete(:webauthn_registration_challenge)
+
+    unless challenge.present?
+      return render json: { error: t("webauthn_credentials.failure") }, status: :unprocessable_entity
+    end
+
+    credential = webauthn_relying_party.verify_registration(
+      webauthn_credential_payload,
+      challenge,
+      user_presence: true
+    )
+
+    Current.user.webauthn_credentials.create!(
+      nickname: webauthn_credential_name,
+      credential_id: credential.id,
+      public_key: credential.public_key,
+      sign_count: credential.sign_count,
+      transports: webauthn_credential_transports
+    )
+
+    render json: { redirect_url: settings_security_path }
+  rescue WebAuthn::Error, ActiveRecord::RecordInvalid, ActiveRecord::RecordNotUnique, ActionController::BadRequest, ActionController::ParameterMissing
+    render json: { error: t("webauthn_credentials.failure") }, status: :unprocessable_entity
+  end
+
+  def destroy
+    Current.user.webauthn_credentials.find(params[:id]).destroy!
+    redirect_to settings_security_path, notice: t("webauthn_credentials.success")
+  end
+
+  private
+    def ensure_mfa_enabled
+      return if Current.user.otp_required?
+
+      respond_to do |format|
+        format.html { redirect_to settings_security_path, alert: t("webauthn_credentials.mfa_required") }
+        format.json { render json: { error: t("webauthn_credentials.mfa_required") }, status: :forbidden }
+      end
+    end
+
+    def webauthn_credential_name
+      webauthn_credential_params[:nickname]
+    end
+
+    def webauthn_credential_transports
+      Array(credential_response_params.dig(:response, :transports)).compact_blank
+    end
+
+    def webauthn_credential_params
+      params.fetch(:webauthn_credential, ActionController::Parameters.new).permit(:nickname)
+    end
+
+    def credential_response_params
+      params.fetch(:credential, ActionController::Parameters.new).permit(response: [ transports: [] ])
+    end
+end
diff --git a/app/controllers/simplefin_items_controller.rb b/app/controllers/simplefin_items_controller.rb
index 32ba1deb4..836f7e10f 100644
--- a/app/controllers/simplefin_items_controller.rb
+++ b/app/controllers/simplefin_items_controller.rb
@@ -1,7 +1,7 @@
 class SimplefinItemsController < ApplicationController
   include SimplefinItems::MapsHelper
-  before_action :set_simplefin_item, only: [ :show, :edit, :update, :destroy, :sync, :balances, :setup_accounts, :complete_account_setup ]
-  before_action :require_admin!, only: [ :new, :create, :select_existing_account, :link_existing_account, :edit, :update, :destroy, :sync, :balances, :setup_accounts, :complete_account_setup ]
+  before_action :set_simplefin_item, only: [ :show, :edit, :update, :destroy, :sync, :balances, :setup_accounts, :complete_account_setup, :dismiss_replacement_suggestion ]
+  before_action :require_admin!, only: [ :new, :create, :select_existing_account, :link_existing_account, :edit, :update, :destroy, :sync, :balances, :setup_accounts, :complete_account_setup, :dismiss_replacement_suggestion ]
 
   def index
     @simplefin_items = Current.family.simplefin_items.active.ordered
@@ -123,6 +123,28 @@ class SimplefinItemsController < ApplicationController
     end
   end
 
+  # Marks one replacement-suggestion as dismissed so the banner stops showing
+  # for that specific (dormant, active) pair. Composite key lets us suppress
+  # just one option if a dormant card has multiple candidates, without hiding
+  # the others. Dismissals are persisted on the latest sync's sync_stats; a
+  # fresh sync emits new suggestions with fresh dismissal state.
+  def dismiss_replacement_suggestion
+    dormant_sfa_id = params.require(:dormant_sfa_id)
+    active_sfa_id = params.require(:active_sfa_id)
+    dismissal_key = "#{dormant_sfa_id}:#{active_sfa_id}"
+    sync = @simplefin_item.syncs.order(created_at: :desc).first
+
+    if sync
+      stats = sync.sync_stats.is_a?(Hash) ? sync.sync_stats.dup : {}
+      dismissed = Array(stats["dismissed_replacement_suggestions"])
+      stats["dismissed_replacement_suggestions"] = (dismissed + [ dismissal_key ]).uniq
+      sync.update!(sync_stats: stats)
+    end
+
+    redirect_back_or_to accounts_path,
+      notice: t(".dismissed")
+  end
+
   # Starts a balances-only sync for this SimpleFin item
   def balances
     # Create a Sync and enqueue it to run asynchronously with a runtime-only flag
@@ -365,9 +387,16 @@ class SimplefinItemsController < ApplicationController
     @account = Current.family.accounts.find(params[:account_id])
     simplefin_account = SimplefinAccount.find(params[:simplefin_account_id])
 
-    # Guard: only manual accounts can be linked (no existing provider links or legacy IDs)
-    if @account.account_providers.any? || @account.plaid_account_id.present? || @account.simplefin_account_id.present?
-      flash[:alert] = t("simplefin_items.link_existing_account.errors.only_manual")
+    # Cross-provider guard: we only support swapping SimpleFIN-to-SimpleFIN links
+    # here. If @account is linked to a different provider type (Plaid, Binance,
+    # etc.), require explicit unlink first so users don't silently lose
+    # cross-provider data. Same-provider relinks (e.g., Citi fraud replacement
+    # swapping to a new card sfa) are now allowed below.
+    has_foreign_provider = @account.account_providers
+      .where.not(provider_type: "SimplefinAccount").exists? ||
+      @account.plaid_account_id.present?
+    if has_foreign_provider
+      flash[:alert] = t("simplefin_items.link_existing_account.errors.different_provider")
       if turbo_frame_request?
         return render turbo_stream: Array(flash_notification_stream_items)
       else
@@ -390,6 +419,18 @@ class SimplefinItemsController < ApplicationController
     Account.transaction do
       simplefin_account.lock!
 
+      # Detach @account's EXISTING SimpleFIN link (if any) before attaching the
+      # new one. This is the fraud-replacement path: user is swapping from
+      # sfa_old (dead card) to sfa_new (replacement). Without this, @account
+      # would end up with two AccountProviders and the old sfa's data would
+      # still flow in on every sync.
+      @account.account_providers.where(provider_type: "SimplefinAccount").find_each do |existing_ap|
+        # Skip the one we're about to (re)assign — avoid deleting what we then recreate.
+        next if existing_ap.provider_id == simplefin_account.id
+        existing_ap.destroy
+      end
+      @account.update!(simplefin_account_id: nil) if @account.simplefin_account_id.present?
+
       # Clear legacy association if present (Account.simplefin_account_id)
       if (legacy_account = simplefin_account.account)
         legacy_account.update!(simplefin_account_id: nil)
diff --git a/app/controllers/snaptrade_items_controller.rb b/app/controllers/snaptrade_items_controller.rb
index f02d5a155..6062c4dfb 100644
--- a/app/controllers/snaptrade_items_controller.rb
+++ b/app/controllers/snaptrade_items_controller.rb
@@ -132,12 +132,19 @@ class SnaptradeItemsController < ApplicationController
     snaptrade_item = Current.family.snaptrade_items.find_by(id: params[:item_id])
 
     if snaptrade_item
-      # Trigger a sync to fetch the newly connected accounts
       snaptrade_item.sync_later unless snaptrade_item.syncing?
-      # Redirect to accounts page - user can click "accounts need setup" badge
-      # when sync completes. This avoids the auto-refresh loop issues.
-      redirect_to accounts_path, notice: t(".success")
+
+      stored_return_to, stored_accountable_type = clear_snaptrade_resume_context
+      return_to = params[:return_to].presence || stored_return_to
+      accountable_type = params[:accountable_type].presence || stored_accountable_type
+
+      if return_to == "setup_accounts"
+        redirect_to setup_accounts_snaptrade_item_path(snaptrade_item, accountable_type: accountable_type.presence), notice: t(".success")
+      else
+        redirect_to accounts_path, notice: t(".success")
+      end
     else
+      clear_snaptrade_resume_context
       redirect_to settings_providers_path, alert: t(".no_item")
     end
   end
@@ -340,35 +347,46 @@ class SnaptradeItemsController < ApplicationController
   # Collection actions for account linking flow
 
   def preload_accounts
-    snaptrade_item = Current.family.snaptrade_items.first
-    if snaptrade_item
+    snaptrade_item = current_snaptrade_item
+    unless snaptrade_item
+      redirect_to settings_providers_path, alert: t(".not_configured", default: "SnapTrade is not configured.")
+      return
+    end
+
+    if snaptrade_item.user_registered?
       snaptrade_item.sync_later unless snaptrade_item.syncing?
       redirect_to setup_accounts_snaptrade_item_path(snaptrade_item)
     else
-      redirect_to settings_providers_path, alert: t(".not_configured", default: "SnapTrade is not configured.")
+      redirect_to connect_snaptrade_item_path(snaptrade_item)
     end
   end
 
   def select_accounts
     @accountable_type = params[:accountable_type]
     @return_to = params[:return_to]
-    snaptrade_item = Current.family.snaptrade_items.first
+    snaptrade_item = current_snaptrade_item
 
-    if snaptrade_item
+    unless snaptrade_item
+      redirect_to settings_providers_path, alert: t(".not_configured", default: "SnapTrade is not configured.")
+      return
+    end
+
+    if snaptrade_item.user_registered?
       redirect_to setup_accounts_snaptrade_item_path(snaptrade_item, accountable_type: @accountable_type, return_to: @return_to)
     else
-      redirect_to settings_providers_path, alert: t(".not_configured", default: "SnapTrade is not configured.")
+      store_snaptrade_resume_context(return_to: @return_to, accountable_type: @accountable_type)
+      redirect_to connect_snaptrade_item_path(snaptrade_item)
     end
   end
 
   def link_accounts
-    redirect_to settings_providers_path, alert: "Use the account setup flow instead"
+    redirect_to settings_providers_path, alert: t(".use_setup_flow")
   end
 
   def select_existing_account
     @account_id = params[:account_id]
     @account = Current.family.accounts.find_by(id: @account_id)
-    snaptrade_item = Current.family.snaptrade_items.first
+    snaptrade_item = current_snaptrade_item
 
     if snaptrade_item && @account
       @snaptrade_accounts = snaptrade_item.snaptrade_accounts
@@ -417,6 +435,26 @@ class SnaptradeItemsController < ApplicationController
       @snaptrade_item = Current.family.snaptrade_items.find(params[:id])
     end
 
+    def current_snaptrade_item
+      active_items = Current.family.snaptrade_items.active
+
+      active_items.syncable.ordered.first ||
+        active_items.credentials_configured.ordered.first ||
+        active_items.ordered.first
+    end
+
+    def store_snaptrade_resume_context(return_to:, accountable_type:)
+      session[:snaptrade_resume] = {
+        return_to: return_to,
+        accountable_type: accountable_type
+      }
+    end
+
+    def clear_snaptrade_resume_context
+      resume = (session.delete(:snaptrade_resume) || {}).with_indifferent_access
+      [ resume[:return_to], resume[:accountable_type] ]
+    end
+
     def snaptrade_item_params
       params.require(:snaptrade_item).permit(
         :name,
diff --git a/app/controllers/sophtron_items_controller.rb b/app/controllers/sophtron_items_controller.rb
new file mode 100644
index 000000000..6222954ef
--- /dev/null
+++ b/app/controllers/sophtron_items_controller.rb
@@ -0,0 +1,1250 @@
+class SophtronItemsController < ApplicationController
+  include SyncStats::Collector
+
+  CONNECTION_STATUS_MAX_POLLS = 6
+  LOGIN_PROGRESS_CONNECTION_STATUS_MAX_POLLS = 15
+  POST_MFA_CONNECTION_STATUS_MAX_POLLS = 15
+  CONNECTION_STATUS_POLL_INTERVAL_MS = 4_000
+  MAX_SECURITY_ANSWERS = 10
+  MAX_SECURITY_ANSWER_LENGTH = 256
+  MANUAL_SYNC_PROCESSED_ACCOUNT_IDS_KEY = "manual_sync_processed_sophtron_account_ids"
+
+  before_action :set_sophtron_item, only: [
+    :show, :edit, :update, :destroy, :connect_institution, :sync,
+    :connection_status, :submit_mfa, :toggle_manual_sync,
+    :setup_accounts, :complete_account_setup
+  ]
+  before_action :require_admin!, only: [
+    :new, :create, :preload_accounts, :select_accounts, :link_accounts,
+    :select_existing_account, :link_existing_account, :connect_institution,
+    :edit, :update, :destroy, :sync, :connection_status, :submit_mfa, :toggle_manual_sync,
+    :setup_accounts, :complete_account_setup
+  ]
+
+  def index
+    @sophtron_items = Current.family.sophtron_items.active.ordered
+    render layout: "settings"
+  end
+
+  def show
+  end
+
+  def preload_accounts
+    item = configured_sophtron_item
+    unless item
+      render json: { success: false, error: "no_credentials_configured", has_accounts: false }
+      return
+    end
+
+    item.ensure_customer!
+
+    unless item.connected_to_institution?
+      render json: { success: false, error: "no_institution_connected", has_accounts: nil }
+      return
+    end
+
+    accounts = item.fetch_remote_accounts
+    render json: { success: true, has_accounts: accounts.any?, cached: true }
+  rescue Provider::Sophtron::Error => e
+    Rails.logger.error("Sophtron preload error: #{e.message}")
+    render json: { success: false, error: "api_error", error_message: t(".api_error"), has_accounts: nil }
+  rescue StandardError => e
+    Rails.logger.error("Unexpected error preloading Sophtron accounts: #{e.class}: #{e.message}")
+    render json: { success: false, error: "unexpected_error", error_message: t(".unexpected_error"), has_accounts: nil }
+  end
+
+  def select_accounts
+    item = configured_sophtron_item
+    unless item
+      render_or_redirect_setup_required
+      return
+    end
+
+    item.ensure_customer!
+
+    if connect_new_institution_flow? || !item.connected_to_institution?
+      prepare_connection_form(item)
+      render :connect, layout: false
+      return
+    end
+
+    @available_accounts = item.reject_already_linked(item.fetch_remote_accounts)
+    @accountable_type = params[:accountable_type] || "Depository"
+    @return_to = safe_return_to_path
+
+    if @available_accounts.empty?
+      redirect_to new_account_path, alert: t(".no_accounts_found")
+      return
+    end
+
+    render layout: false
+  rescue Provider::Sophtron::Error => e
+    Rails.logger.error("Sophtron API error in select_accounts: #{e.message}")
+    render_api_error(t(".api_error"), safe_return_to_path)
+  rescue StandardError => e
+    Rails.logger.error("Unexpected error in select_accounts: #{e.class}: #{e.message}")
+    render_api_error(t(".unexpected_error"), safe_return_to_path)
+  end
+
+  def connect_institution
+    if params[:institution_id].blank? || params[:bank_username].blank? || params[:bank_password].blank?
+      redirect_to select_accounts_sophtron_items_path(connection_context_params), alert: t(".missing_parameters")
+      return
+    end
+
+    item = item_for_institution_connection(@sophtron_item)
+    item.ensure_customer!
+    response = sophtron_response_data!(
+      item.sophtron_provider.create_user_institution(
+        institution_id: params[:institution_id],
+        username: params[:bank_username],
+        password: params[:bank_password],
+        pin: ""
+      )
+    ).with_indifferent_access
+
+    job_id = response[:JobID] || response[:job_id]
+    user_institution_id = response[:UserInstitutionID] || response[:user_institution_id]
+
+    if job_id.blank? || user_institution_id.blank?
+      raise Provider::Sophtron::Error.new("Sophtron did not return JobID and UserInstitutionID", :invalid_response)
+    end
+
+    item.update!(
+      name: item.name.presence || t("sophtron_items.defaults.name"),
+      institution_id: params[:institution_id],
+      institution_name: params[:institution_name],
+      user_institution_id: user_institution_id,
+      current_job_id: job_id,
+      raw_job_payload: response,
+      job_status: nil,
+      last_connection_error: nil,
+      status: :good
+    )
+
+    redirect_to connection_status_sophtron_item_path(item, connection_context_params)
+  rescue Provider::Sophtron::Error => e
+    Rails.logger.error("Sophtron connect institution error: #{e.message}")
+    redirect_to select_accounts_sophtron_items_path(connection_context_params), alert: t(".api_error", message: e.message)
+  end
+
+  def connection_status
+    if prefetch_request?
+      head :no_content
+      return
+    end
+
+    if @sophtron_item.current_job_id.blank?
+      redirect_to select_accounts_sophtron_items_path(connection_context_params)
+      return
+    end
+
+    @poll_attempt = requested_poll_attempt
+    if @poll_attempt > connection_status_max_polls
+      render_connection_timeout
+      return
+    end
+
+    job = sophtron_response_data!(@sophtron_item.sophtron_provider.get_job_information(@sophtron_item.current_job_id))
+    @sophtron_item.upsert_job_snapshot!(job)
+
+    if Provider::Sophtron.job_success?(job)
+      if manual_sync_flow?
+        complete_manual_sync_from_job(job)
+        return
+      end
+
+      @sophtron_item.update!(
+        current_job_id: nil,
+        last_connection_error: nil,
+        pending_account_setup: true,
+        status: :good
+      )
+      render_account_selection(@sophtron_item, force_refresh: true)
+    elsif Provider::Sophtron.job_requires_input?(job)
+      @challenge = @sophtron_item.build_mfa_challenge(job)
+      prepare_connection_status_context
+      render :mfa, layout: false
+    elsif Provider::Sophtron.job_completed?(job)
+      if manual_sync_flow?
+        complete_manual_sync_from_job(job)
+        return
+      end
+
+      if post_mfa_polling?
+        return if render_account_selection_if_accounts_available(@sophtron_item)
+      end
+
+      render_pending_connection_status
+    elsif Provider::Sophtron.job_failed?(job)
+      failure_message = sophtron_connection_failure_message(job)
+      @sophtron_item.update!(
+        current_job_id: nil,
+        current_job_sophtron_account_id: nil,
+        user_institution_id: (manual_sync_flow? ? @sophtron_item.user_institution_id : nil),
+        last_connection_error: failure_message,
+        status: :requires_update
+      )
+      fail_manual_sync!(manual_sync_record, failure_message) if manual_sync_flow?
+      render_institution_connection_error(failure_message)
+    else
+      render_pending_connection_status
+    end
+  rescue Provider::Sophtron::Error => e
+    Rails.logger.error("Sophtron job polling error: #{e.message}")
+    render_api_error(t(".api_error", message: e.message), accounts_path)
+  end
+
+  def submit_mfa
+    provider = @sophtron_item.sophtron_provider
+    job_id = @sophtron_item.current_job_id
+
+    case params[:mfa_type]
+    when "security_answer"
+      security_answers = normalized_security_answers
+      unless security_answers
+        redirect_to connection_status_sophtron_item_path(@sophtron_item, connection_context_params), alert: t(".invalid_security_answers")
+        return
+      end
+
+      sophtron_response_data!(provider.update_job_security_answer(job_id, security_answers))
+    when "token_choice"
+      sophtron_response_data!(provider.update_job_token_input(job_id, token_choice: params[:token_choice]))
+    when "token_input"
+      sophtron_response_data!(provider.update_job_token_input(job_id, token_input: params[:token_input]))
+    when "verify_phone"
+      sophtron_response_data!(provider.update_job_token_input(job_id, verify_phone_flag: true))
+    when "captcha"
+      sophtron_response_data!(provider.update_job_captcha(job_id, params[:captcha_input]))
+    else
+      redirect_to connection_status_sophtron_item_path(@sophtron_item, connection_context_params), alert: t(".unknown_challenge")
+      return
+    end
+
+    redirect_to connection_status_sophtron_item_path(@sophtron_item, connection_context_params.merge(post_mfa: true))
+  rescue Provider::Sophtron::Error => e
+    Rails.logger.error("Sophtron MFA submission error: #{e.message}")
+    redirect_to connection_status_sophtron_item_path(@sophtron_item, connection_context_params), alert: t(".api_error", message: e.message)
+  end
+
+  def link_accounts
+    selected_account_ids = params[:account_ids] || []
+    accountable_type = params[:accountable_type] || "Depository"
+    return_to = safe_return_to_path
+
+    if selected_account_ids.empty?
+      redirect_to new_account_path, alert: t(".no_accounts_selected")
+      return
+    end
+
+    item = configured_sophtron_item
+    unless item&.connected_to_institution?
+      redirect_to select_accounts_sophtron_items_path(accountable_type: accountable_type, return_to: return_to), alert: t(".no_institution_connected")
+      return
+    end
+
+    accounts_data = item.fetch_remote_accounts(force: true)
+
+    created_accounts = []
+    already_linked_accounts = []
+    invalid_accounts = []
+
+    selected_account_ids.each do |account_id|
+      account_data = accounts_data.find { |account| SophtronItem.external_account_id(account).to_s == account_id.to_s }
+      next unless account_data
+
+      if account_data[:account_name].blank?
+        invalid_accounts << account_id
+        Rails.logger.warn "SophtronItemsController - Skipping account #{account_id} with blank name"
+        next
+      end
+
+      sophtron_account = item.upsert_sophtron_account(account_data)
+
+      if sophtron_account.account_provider.present?
+        already_linked_accounts << account_data[:account_name]
+        next
+      end
+
+      ActiveRecord::Base.transaction do
+        account = Account.create_and_sync(
+          {
+            family: Current.family,
+            name: account_data[:account_name],
+            balance: 0,
+            currency: account_data[:currency] || "USD",
+            accountable_type: accountable_type,
+            accountable_attributes: {}
+          },
+          skip_initial_sync: true
+        )
+
+        AccountProvider.create!(account: account, provider: sophtron_account)
+        created_accounts << account
+      end
+    end
+
+    item.start_initial_load_later if created_accounts.any?
+    redirect_after_account_link(return_to, created_accounts, already_linked_accounts, invalid_accounts)
+  rescue Provider::Sophtron::Error => e
+    redirect_to new_account_path, alert: t(".api_error", message: e.message)
+  end
+
+  def select_existing_account
+    unless params[:account_id].present?
+      redirect_to accounts_path, alert: t(".no_account_specified")
+      return
+    end
+
+    @account = Current.family.accounts.find(params[:account_id])
+
+    if @account.account_providers.exists?
+      redirect_to accounts_path, alert: t(".account_already_linked")
+      return
+    end
+
+    item = configured_sophtron_item
+    unless item
+      render_or_redirect_setup_required
+      return
+    end
+
+    item.ensure_customer!
+
+    unless item.connected_to_institution?
+      prepare_connection_form(item, account: @account)
+      render :connect, layout: false
+      return
+    end
+
+    @available_accounts = item.reject_already_linked(item.fetch_remote_accounts)
+    @return_to = safe_return_to_path
+
+    if @available_accounts.empty?
+      redirect_to accounts_path, alert: t(".all_accounts_already_linked")
+      return
+    end
+
+    render layout: false
+  rescue Provider::Sophtron::Error => e
+    Rails.logger.error("Sophtron API error in select_existing_account: #{e.message}")
+    render_api_error(t(".api_error", message: e.message), accounts_path)
+  rescue StandardError => e
+    Rails.logger.error("Unexpected error in select_existing_account: #{e.class}: #{e.message}")
+    render_api_error(t(".unexpected_error"), accounts_path)
+  end
+
+  def link_existing_account
+    account_id = params[:account_id]
+    sophtron_account_id = params[:sophtron_account_id]
+    return_to = safe_return_to_path
+
+    unless account_id.present? && sophtron_account_id.present?
+      redirect_to accounts_path, alert: t(".missing_parameters")
+      return
+    end
+
+    account = Current.family.accounts.find(account_id)
+
+    if account.account_providers.exists?
+      redirect_to accounts_path, alert: t(".account_already_linked")
+      return
+    end
+
+    item = configured_sophtron_item
+    unless item&.connected_to_institution?
+      redirect_to accounts_path, alert: t(".no_institution_connected")
+      return
+    end
+
+    account_data = item.fetch_remote_accounts(force: true).find { |remote_account| SophtronItem.external_account_id(remote_account).to_s == sophtron_account_id.to_s }
+    unless account_data
+      redirect_to accounts_path, alert: t(".sophtron_account_not_found")
+      return
+    end
+
+    if account_data[:account_name].blank?
+      redirect_to accounts_path, alert: t(".invalid_account_name")
+      return
+    end
+
+    sophtron_account = item.upsert_sophtron_account(account_data)
+
+    if sophtron_account.account_provider.present?
+      redirect_to accounts_path, alert: t(".sophtron_account_already_linked")
+      return
+    end
+
+    AccountProvider.create!(account: account, provider: sophtron_account)
+    item.start_initial_load_later
+
+    redirect_to return_to || accounts_path, notice: t(".success", account_name: account.name)
+  rescue Provider::Sophtron::Error => e
+    Rails.logger.error("Sophtron API error in link_existing_account: #{e.message}")
+    redirect_to accounts_path, alert: t(".api_error", message: e.message)
+  end
+
+  def new
+    @sophtron_item = Current.family.sophtron_items.build
+  end
+
+  def create
+    @sophtron_item = Current.family.sophtron_items.build(sophtron_params)
+    @sophtron_item.name ||= t("sophtron_items.defaults.name")
+
+    if @sophtron_item.save
+      unless verify_and_provision_customer(@sophtron_item)
+        render_sophtron_panel_error(:new, @sophtron_item.last_connection_error)
+        return
+      end
+
+      render_sophtron_panel_success(:create)
+    else
+      render_sophtron_panel_error(:new, @sophtron_item.errors.full_messages.join(", "))
+    end
+  end
+
+  def edit
+  end
+
+  def update
+    if @sophtron_item.update(sophtron_params)
+      unless verify_and_provision_customer(@sophtron_item)
+        render_sophtron_panel_error(:edit, @sophtron_item.last_connection_error)
+        return
+      end
+
+      render_sophtron_panel_success(:update)
+    else
+      render_sophtron_panel_error(:edit, @sophtron_item.errors.full_messages.join(", "))
+    end
+  end
+
+  def destroy
+    begin
+      @sophtron_item.unlink_all!(dry_run: false)
+    rescue => e
+      Rails.logger.warn("Sophtron unlink during destroy failed: #{e.class} - #{e.message}")
+    end
+
+    @sophtron_item.destroy_later
+    redirect_to accounts_path, notice: t(".success")
+  end
+
+  def sync
+    if @sophtron_item.manual_sync_required?
+      start_manual_sync
+      return
+    end
+
+    @sophtron_item.sync_later unless @sophtron_item.syncing?
+
+    respond_to do |format|
+      format.html { redirect_back_or_to accounts_path }
+      format.json { head :ok }
+    end
+  end
+
+  def toggle_manual_sync
+    toggle_accounts = manual_sync_toggle_sophtron_accounts
+
+    if toggle_accounts.exists?
+      enabled = if @sophtron_item.manual_sync?
+        @sophtron_item.sophtron_accounts.where.not(id: toggle_accounts.select(:id)).update_all(manual_sync: true, updated_at: Time.current)
+        false
+      else
+        !toggle_accounts.requires_manual_sync.exists?
+      end
+      toggle_accounts.update_all(manual_sync: enabled, updated_at: Time.current)
+      @sophtron_item.update!(manual_sync: false) unless enabled
+    elsif params[:institution_key].present? || params[:user_institution_id].present?
+      redirect_back_or_to accounts_path, alert: t("sophtron_items.sync.no_linked_accounts")
+      return
+    else
+      @sophtron_item.update!(manual_sync: !@sophtron_item.manual_sync?)
+      enabled = @sophtron_item.manual_sync?
+    end
+
+    respond_to do |format|
+      format.html { redirect_back_or_to accounts_path, notice: t(".success_#{enabled ? 'enabled' : 'disabled'}") }
+      format.turbo_stream do
+        flash.now[:notice] = t(".success_#{enabled ? 'enabled' : 'disabled'}")
+        render turbo_stream: [
+          turbo_stream.replace(
+            ActionView::RecordIdentifier.dom_id(@sophtron_item),
+            partial: "sophtron_items/sophtron_item",
+            locals: { sophtron_item: @sophtron_item.reload }
+          ),
+          *flash_notification_stream_items
+        ]
+      end
+    end
+  end
+
+  def setup_accounts
+    @api_error = fetch_sophtron_accounts_from_api
+
+    @sophtron_accounts = @sophtron_item.sophtron_accounts
+      .left_joins(:account_provider)
+      .where(account_providers: { id: nil })
+
+    supported_types = Provider::SophtronAdapter.supported_account_types
+    account_type_keys = {
+      "depository" => "Depository",
+      "credit_card" => "CreditCard",
+      "investment" => "Investment",
+      "loan" => "Loan",
+      "other_asset" => "OtherAsset"
+    }
+
+    all_account_type_options = account_type_keys.filter_map do |key, type|
+      next unless supported_types.include?(type)
+      [ t(".account_types.#{key}"), type ]
+    end
+
+    @account_type_options = [ [ t(".account_types.skip"), "skip" ] ] + all_account_type_options
+    @subtype_options = {
+      "Depository" => {
+        label: "Account Subtype:",
+        options: Depository::SUBTYPES.map { |k, v| [ v[:long], k ] }
+      },
+      "CreditCard" => {
+        label: "",
+        options: [],
+        message: "Credit cards will be automatically set up as credit card accounts."
+      },
+      "Investment" => {
+        label: "Investment Type:",
+        options: Investment::SUBTYPES.map { |k, v| [ v[:long], k ] }
+      },
+      "Loan" => {
+        label: "Loan Type:",
+        options: Loan::SUBTYPES.map { |k, v| [ v[:long], k ] }
+      },
+      "Crypto" => {
+        label: nil,
+        options: [],
+        message: "Crypto accounts track cryptocurrency holdings."
+      },
+      "OtherAsset" => {
+        label: nil,
+        options: [],
+        message: "No additional options needed for Other Assets."
+      }
+    }
+  end
+
+  def complete_account_setup
+    account_types = params[:account_types] || {}
+    account_subtypes = params[:account_subtypes] || {}
+    valid_types = Provider::SophtronAdapter.supported_account_types
+    created_accounts = []
+    skipped_count = 0
+
+    begin
+      ActiveRecord::Base.transaction do
+        account_types.each do |sophtron_account_id, selected_type|
+          if selected_type == "skip" || selected_type.blank?
+            skipped_count += 1
+            next
+          end
+
+          unless valid_types.include?(selected_type)
+            Rails.logger.warn("Invalid account type '#{selected_type}' submitted for Sophtron account #{sophtron_account_id}")
+            next
+          end
+
+          sophtron_account = @sophtron_item.sophtron_accounts.find_by(id: sophtron_account_id)
+          unless sophtron_account
+            Rails.logger.warn("Sophtron account #{sophtron_account_id} not found for item #{@sophtron_item.id}")
+            next
+          end
+
+          if sophtron_account.account_provider.present?
+            Rails.logger.info("Sophtron account #{sophtron_account_id} already linked, skipping")
+            next
+          end
+
+          selected_subtype = account_subtypes[sophtron_account_id]
+          selected_subtype = "credit_card" if selected_type == "CreditCard" && selected_subtype.blank?
+
+          account = Account.create_and_sync(
+            {
+              family: Current.family,
+              name: sophtron_account.name,
+              balance: sophtron_account.balance || 0,
+              currency: sophtron_account.currency || "USD",
+              accountable_type: selected_type,
+              accountable_attributes: selected_subtype.present? ? { subtype: selected_subtype } : {}
+            },
+            skip_initial_sync: true
+          )
+
+          AccountProvider.create!(account: account, provider: sophtron_account)
+          created_accounts << account
+        end
+      end
+    rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotSaved => e
+      Rails.logger.error("Sophtron account setup failed: #{e.class} - #{e.message}")
+      Rails.logger.error(e.backtrace.first(10).join("\n"))
+      flash[:alert] = t(".creation_failed")
+      redirect_to accounts_path, status: :see_other
+      return
+    rescue StandardError => e
+      Rails.logger.error("Sophtron account setup failed unexpectedly: #{e.class} - #{e.message}")
+      Rails.logger.error(e.backtrace.first(10).join("\n"))
+      flash[:alert] = t(".unexpected_error")
+      redirect_to accounts_path, status: :see_other
+      return
+    end
+
+    @sophtron_item.start_initial_load_later if created_accounts.any?
+
+    flash[:notice] = if created_accounts.any?
+      t(".success", count: created_accounts.count)
+    elsif skipped_count > 0
+      t(".all_skipped")
+    else
+      t(".no_accounts")
+    end
+
+    if turbo_frame_request?
+      @manual_accounts = Account.uncached {
+        Current.family.accounts.visible_manual.order(:name).to_a
+      }
+      @sophtron_items = Current.family.sophtron_items.ordered
+      manual_accounts_stream = if @manual_accounts.any?
+        turbo_stream.update(
+          "manual-accounts",
+          partial: "accounts/index/manual_accounts",
+          locals: { accounts: @manual_accounts }
+        )
+      else
+        turbo_stream.replace("manual-accounts", view_context.tag.div(id: "manual-accounts"))
+      end
+
+      render turbo_stream: [
+        manual_accounts_stream,
+        turbo_stream.replace(
+          ActionView::RecordIdentifier.dom_id(@sophtron_item),
+          partial: "sophtron_items/sophtron_item",
+          locals: { sophtron_item: @sophtron_item }
+        )
+      ] + Array(flash_notification_stream_items)
+    else
+      redirect_to accounts_path, status: :see_other
+    end
+  end
+
+  private
+
+    def start_manual_sync
+      if @sophtron_item.current_job_sophtron_account_id.present?
+        redirect_to active_manual_sync_path, alert: t(".already_running")
+        return
+      end
+
+      unless linked_manual_sync_sophtron_accounts.exists?
+        redirect_back_or_to accounts_path, alert: t(".no_linked_accounts")
+        return
+      end
+
+      sync = @sophtron_item.syncs.create!
+      sync.start! if sync.may_start?
+      @manual_sync = sync
+
+      provider = @sophtron_item.sophtron_provider
+      raise Provider::Sophtron::Error.new("Sophtron provider is not configured", :configuration_error) unless provider
+
+      reset_manual_sync_progress!(sync)
+      start_next_manual_sync_account(sync, provider)
+    rescue Provider::Sophtron::Error => e
+      clear_or_fail_manual_sync_after_error!(sync, e.message) if defined?(sync) && sync.present?
+      Rails.logger.error("Sophtron manual sync error: #{e.message}")
+      redirect_back_or_to accounts_path, alert: t(".api_error", message: e.message)
+    end
+
+    def active_manual_sync_path
+      return accounts_path if @sophtron_item.current_job_id.blank?
+
+      connection_status_sophtron_item_path(
+        @sophtron_item,
+        connection_context_params.merge(
+          manual_sync: true,
+          sync_id: manual_sync_record&.id,
+          sophtron_account_id: @sophtron_item.current_job_sophtron_account_id
+        )
+      )
+    end
+
+    def start_next_manual_sync_account(sync, provider)
+      sophtron_account = next_manual_sync_sophtron_account(sync)
+
+      unless sophtron_account
+        @sophtron_item.update!(
+          current_job_id: nil,
+          current_job_sophtron_account_id: nil,
+          last_connection_error: nil,
+          status: :good
+        )
+        sync.finalize_if_all_children_finalized
+        flash.discard(:alert)
+        @manual_sync = sync
+        render :manual_sync_complete, layout: false
+        return
+      end
+
+      start_manual_sync_for_account(sophtron_account, provider, sync)
+    end
+
+    def start_manual_sync_for_account(sophtron_account, provider, sync)
+      refresh_response = sophtron_response_data!(provider.refresh_account(sophtron_account.account_id)).with_indifferent_access
+      job_id = refresh_response[:JobID] || refresh_response[:job_id]
+
+      if job_id.blank?
+        complete_manual_sync!(sophtron_account, provider, sync)
+        start_next_manual_sync_account(sync, provider)
+        return
+      end
+
+      @sophtron_item.update!(
+        current_job_id: job_id,
+        current_job_sophtron_account_id: sophtron_account.id,
+        raw_job_payload: refresh_response,
+        job_status: nil,
+        last_connection_error: nil,
+        status: :good
+      )
+
+      job = sophtron_response_data!(provider.get_job_information(job_id))
+      @sophtron_item.upsert_job_snapshot!(job)
+
+      if Provider::Sophtron.job_requires_input?(job)
+        @challenge = @sophtron_item.build_mfa_challenge(job)
+        prepare_connection_status_context
+        render :mfa, layout: false
+      elsif Provider::Sophtron.job_failed?(job)
+        failure_message = t(".failed")
+        fail_manual_sync_and_clear_job!(sync, failure_message)
+        redirect_back_or_to accounts_path, alert: failure_message
+      elsif Provider::Sophtron.job_success?(job) || Provider::Sophtron.job_completed?(job)
+        complete_manual_sync!(sophtron_account, provider, sync)
+        start_next_manual_sync_account(sync, provider)
+      else
+        @poll_attempt = 1
+        render_pending_connection_status
+      end
+    end
+
+    def complete_manual_sync_from_job(job)
+      sophtron_account = @sophtron_item.current_job_sophtron_account
+      sophtron_account ||= linked_manual_sync_sophtron_accounts.find_by(id: params[:sophtron_account_id]) if params[:sophtron_account_id].present?
+      sync = manual_sync_record
+
+      unless sophtron_account && sync
+        @sophtron_item.update!(current_job_id: nil, current_job_sophtron_account_id: nil)
+        render_api_error(t("sophtron_items.sync.no_linked_accounts"), accounts_path)
+        return
+      end
+
+      provider = @sophtron_item.sophtron_provider
+      complete_manual_sync!(sophtron_account, provider, sync)
+      start_next_manual_sync_account(sync, provider)
+    rescue Provider::Sophtron::Error => e
+      fail_manual_sync_and_clear_job!(sync, e.message) if defined?(sync) && sync.present?
+      render_api_error(t("sophtron_items.sync.api_error", message: e.message), accounts_path)
+    end
+
+    def complete_manual_sync!(sophtron_account, provider, sync)
+      raise Provider::Sophtron::Error.new("Sophtron provider is not configured", :configuration_error) unless provider
+
+      result = SophtronItem::Importer.new(@sophtron_item, sophtron_provider: provider, sync: sync)
+                                    .import_transactions_after_refresh(sophtron_account)
+
+      unless result[:success]
+        error_message = result[:error] || t("sophtron_items.sync.failed")
+        fail_manual_sync_and_clear_job!(sync, error_message)
+        raise Provider::Sophtron::Error.new(error_message, :api_error)
+      end
+
+      processing_result = process_manual_sync_account!(sync, sophtron_account)
+      mark_manual_sync_account_processed!(sync, sophtron_account)
+      collect_manual_sync_stats!(sync, processing_result)
+      @sophtron_item.update!(
+        current_job_id: nil,
+        current_job_sophtron_account_id: nil,
+        last_connection_error: nil,
+        status: :good
+      )
+
+      if (account = sophtron_account.current_account)
+        account.sync_later(
+          parent_sync: sync,
+          window_start_date: sync.window_start_date,
+          window_end_date: sync.window_end_date
+        )
+      else
+        sync.finalize_if_all_children_finalized
+      end
+
+      @manual_sync_account = sophtron_account
+      @manual_sync = sync
+    end
+
+    def process_manual_sync_account!(sync, sophtron_account)
+      SophtronAccount::Processor.new(sophtron_account.reload).process
+    rescue StandardError => e
+      Rails.logger.error("Sophtron manual sync processing error: #{e.class} - #{e.message}")
+      fail_manual_sync_and_clear_job!(sync, e.message)
+      raise Provider::Sophtron::Error.new(t("sophtron_items.sync.processing_failed"), :api_error)
+    end
+
+    def fail_manual_sync_and_clear_job!(sync, message)
+      clear_manual_sync_job!(message, status: :requires_update)
+      fail_manual_sync!(sync, message)
+    end
+
+    def clear_or_fail_manual_sync_after_error!(sync, message)
+      if sync.failed?
+        clear_manual_sync_job!(@sophtron_item.last_connection_error, status: :requires_update)
+      else
+        fail_manual_sync_and_clear_job!(sync, message)
+      end
+    end
+
+    def clear_manual_sync_job!(message = nil, status: nil)
+      attributes = {
+        current_job_id: nil,
+        current_job_sophtron_account_id: nil
+      }
+      attributes[:last_connection_error] = message if message.present?
+      attributes[:status] = status if status.present?
+
+      @sophtron_item.update!(attributes)
+    end
+
+    def fail_manual_sync!(sync, message)
+      return unless sync
+
+      sync.start! if sync.may_start?
+      sync.fail! if sync.may_fail?
+      sync.update!(error: message)
+    end
+
+    def manual_sync_record
+      return @manual_sync if defined?(@manual_sync) && @manual_sync.present?
+
+      sync = @sophtron_item.syncs.find_by(id: params[:sync_id]) if params[:sync_id].present?
+      sync || visible_manual_sync_record
+    end
+
+    def visible_manual_sync_record
+      @sophtron_item.syncs.visible.ordered.detect do |sync|
+        sync.sync_stats.to_h.key?(MANUAL_SYNC_PROCESSED_ACCOUNT_IDS_KEY)
+      end
+    end
+
+    def linked_manual_sync_sophtron_accounts
+      @sophtron_item.manual_sync_sophtron_accounts
+    end
+
+    def manual_sync_toggle_sophtron_accounts
+      accounts = @sophtron_item.sophtron_accounts.order(:created_at, :id)
+      institution_key = params[:institution_key].presence || params[:user_institution_id]
+      return accounts if institution_key.blank?
+
+      account_ids = accounts.select do |sophtron_account|
+        sophtron_account.institution_key.to_s == institution_key.to_s
+      end.map(&:id)
+
+      accounts.where(id: account_ids)
+    end
+
+    def next_manual_sync_sophtron_account(sync)
+      processed_ids = manual_sync_processed_sophtron_account_ids(sync)
+      linked_manual_sync_sophtron_accounts.detect { |sophtron_account| processed_ids.exclude?(sophtron_account.id.to_s) }
+    end
+
+    def reset_manual_sync_progress!(sync)
+      sync.update!(sync_stats: { MANUAL_SYNC_PROCESSED_ACCOUNT_IDS_KEY => [] })
+    end
+
+    def mark_manual_sync_account_processed!(sync, sophtron_account)
+      processed_ids = manual_sync_processed_sophtron_account_ids(sync)
+      processed_ids << sophtron_account.id.to_s
+      stats = sync.sync_stats.to_h
+      sync.update!(sync_stats: stats.merge(MANUAL_SYNC_PROCESSED_ACCOUNT_IDS_KEY => processed_ids.uniq))
+    end
+
+    def collect_manual_sync_stats!(sync, processing_result)
+      mark_import_started(sync)
+      collect_setup_stats(sync, provider_accounts: @sophtron_item.sophtron_accounts.includes(:account_provider, :account))
+
+      account_ids = @sophtron_item.sophtron_accounts
+                                  .where(id: manual_sync_processed_sophtron_account_ids(sync))
+                                  .includes(:account_provider)
+                                  .filter_map { |sophtron_account| sophtron_account.current_account&.id }
+
+      collect_transaction_stats(
+        sync,
+        account_ids: account_ids,
+        source: "sophtron",
+        window_start: sync.syncing_at || sync.created_at,
+        window_end: Time.current
+      )
+
+      collect_manual_sync_health_stats!(sync, processing_result)
+    end
+
+    def collect_manual_sync_health_stats!(sync, processing_result)
+      if processing_result.is_a?(Hash) && processing_result[:success] == false
+        errors = Array(processing_result[:errors]).presence || [ { message: t("sophtron_items.sync.failed"), category: "transaction_import" } ]
+        collect_health_stats(sync, errors: errors)
+      elsif sync.sync_stats.to_h["total_errors"].to_i.zero?
+        collect_health_stats(sync, errors: nil)
+      end
+    end
+
+    def manual_sync_processed_sophtron_account_ids(sync)
+      Array(sync.sync_stats.to_h[MANUAL_SYNC_PROCESSED_ACCOUNT_IDS_KEY]).map(&:to_s)
+    end
+
+    def configured_sophtron_item
+      Current.family.configured_sophtron_item
+    end
+
+    def normalized_security_answers
+      raw_answers = Array(params[:security_answers]).flatten
+      return if raw_answers.size > MAX_SECURITY_ANSWERS
+      return if raw_answers.any? { |answer| answer.to_s.length > MAX_SECURITY_ANSWER_LENGTH }
+
+      answers = raw_answers.filter_map do |answer|
+        answer.to_s.strip.presence
+      end
+
+      return if answers.empty?
+
+      answers
+    end
+
+    def sophtron_response_data!(response)
+      Provider::Sophtron.response_data!(response)
+    end
+
+    def verify_and_provision_customer(item)
+      provider = item.sophtron_provider
+      raise Provider::Sophtron::Error.new("Sophtron provider is not configured", :configuration_error) unless provider
+
+      sophtron_response_data!(provider.health_check_auth)
+      item.ensure_customer!(provider: provider)
+      true
+    rescue Provider::Sophtron::Error => e
+      item.update(status: :requires_update, last_connection_error: e.message)
+      Rails.logger.error("Sophtron customer provisioning failed: #{e.message}")
+      false
+    end
+
+    def render_sophtron_panel_success(action_name)
+      if turbo_frame_request?
+        flash.now[:notice] = t("sophtron_items.#{action_name}.success")
+        @sophtron_items = Current.family.sophtron_items.ordered
+        render turbo_stream: [
+          turbo_stream.replace(
+            "sophtron-providers-panel",
+            partial: "settings/providers/sophtron_panel",
+            locals: { sophtron_items: @sophtron_items }
+          ),
+          *flash_notification_stream_items
+        ]
+      else
+        redirect_to accounts_path, notice: t("sophtron_items.#{action_name}.success"), status: :see_other
+      end
+    end
+
+    def render_sophtron_panel_error(view_name, message)
+      @error_message = message
+      if turbo_frame_request?
+        render turbo_stream: turbo_stream.replace(
+          "sophtron-providers-panel",
+          partial: "settings/providers/sophtron_panel",
+          locals: { error_message: @error_message }
+        ), status: :unprocessable_entity
+      else
+        render view_name, status: :unprocessable_entity
+      end
+    end
+
+    def render_or_redirect_setup_required
+      if turbo_frame_request?
+        render partial: "sophtron_items/setup_required", layout: false
+      else
+        redirect_to settings_providers_path, alert: t("sophtron_items.select_accounts.no_credentials_configured")
+      end
+    end
+
+    def item_for_institution_connection(item)
+      return item unless connect_new_institution_flow? && should_create_sophtron_item_for_new_institution?(item)
+
+      Current.family.sophtron_items.create!(
+        name: item.name.presence || t("sophtron_items.defaults.name"),
+        user_id: item.user_id,
+        access_key: item.access_key,
+        base_url: item.base_url,
+        customer_id: item.customer_id,
+        customer_name: item.customer_name,
+        raw_customer_payload: item.raw_customer_payload,
+        sync_start_date: item.sync_start_date
+      )
+    end
+
+    def should_create_sophtron_item_for_new_institution?(item)
+      item.user_institution_id.present? ||
+        item.current_job_id.present? ||
+        item.institution_id.present? ||
+        item.institution_name.present? ||
+        item.sophtron_accounts.exists?
+    end
+
+    def prepare_connection_form(item, account: nil)
+      @sophtron_item = item
+      @account = account
+      @accountable_type = params[:accountable_type] || "Depository"
+      @return_to = safe_return_to_path
+      @connect_new_institution = connect_new_institution_flow?
+      @institution_search = params[:institution_name].to_s.strip
+      @institutions = []
+
+      if @institution_search.length >= 2
+        @institutions = sophtron_response_data!(item.sophtron_provider.search_institutions(@institution_search))
+      end
+    end
+
+    def render_account_selection(item, force_refresh: false)
+      @available_accounts = item.reject_already_linked(item.fetch_remote_accounts(force: force_refresh))
+      @accountable_type = params[:accountable_type] || "Depository"
+      @return_to = safe_return_to_path
+
+      if params[:account_id].present?
+        @account = Current.family.accounts.find(params[:account_id])
+        render :select_existing_account, layout: false
+      else
+        render :select_accounts, layout: false
+      end
+    end
+
+    def render_account_selection_if_accounts_available(item)
+      accounts = item.fetch_remote_accounts(force: true)
+      return false if accounts.empty?
+
+      item.update!(
+        current_job_id: nil,
+        last_connection_error: nil,
+        pending_account_setup: true,
+        status: :good
+      )
+
+      @available_accounts = item.reject_already_linked(accounts)
+      @accountable_type = params[:accountable_type] || "Depository"
+      @return_to = safe_return_to_path
+
+      if params[:account_id].present?
+        @account = Current.family.accounts.find(params[:account_id])
+        render :select_existing_account, layout: false
+      else
+        render :select_accounts, layout: false
+      end
+
+      true
+    rescue Provider::Sophtron::Error => e
+      Rails.logger.info("Sophtron accounts are not available after completed job #{item.current_job_id}: #{e.message}")
+      false
+    end
+
+    def render_pending_connection_status
+      if @poll_attempt >= connection_status_max_polls
+        render_connection_timeout
+        return
+      end
+
+      prepare_connection_status_context
+      @next_poll_attempt = @poll_attempt + 1
+      render :connection_status, layout: false
+    end
+
+    def prepare_connection_status_context
+      @accountable_type = params[:accountable_type] || "Depository"
+      @account_id = params[:account_id]
+      @return_to = safe_return_to_path
+      @manual_sync_flow = manual_sync_flow?
+      @manual_sync_id = manual_sync_record&.id if @manual_sync_flow
+      @manual_sync_sophtron_account_id = params[:sophtron_account_id] || @sophtron_item.current_job_sophtron_account_id
+      @poll_interval_ms = CONNECTION_STATUS_POLL_INTERVAL_MS
+      @post_mfa_polling = post_mfa_polling?
+      @max_poll_attempts = connection_status_max_polls
+    end
+
+    def requested_poll_attempt
+      poll_attempt = params[:poll_attempt].to_i
+      poll_attempt.positive? ? poll_attempt : 1
+    end
+
+    def render_connection_timeout
+      @poll_attempt = connection_status_max_polls if @poll_attempt.to_i > connection_status_max_polls
+      @poll_attempt = 1 if @poll_attempt.to_i < 1
+      @sophtron_item.update!(
+        last_connection_error: t(".timeout"),
+        status: :requires_update
+      )
+      prepare_connection_status_context
+      @timed_out = true
+      render :connection_status, layout: false
+    end
+
+    def connection_status_max_polls
+      if post_mfa_polling?
+        POST_MFA_CONNECTION_STATUS_MAX_POLLS
+      elsif login_progress_polling?
+        LOGIN_PROGRESS_CONNECTION_STATUS_MAX_POLLS
+      else
+        CONNECTION_STATUS_MAX_POLLS
+      end
+    end
+
+    def post_mfa_polling?
+      ActiveModel::Type::Boolean.new.cast(params[:post_mfa]) || post_mfa_job_payload?(@sophtron_item.raw_job_payload)
+    end
+
+    def manual_sync_flow?
+      ActiveModel::Type::Boolean.new.cast(params[:manual_sync]) || @sophtron_item.current_job_sophtron_account_id.present?
+    end
+
+    def post_mfa_job_payload?(job_payload)
+      job = (job_payload || {}).with_indifferent_access
+      job[:TokenInput].present? || %w[TokenInput TransactionTable].include?(job[:LastStep].to_s)
+    end
+
+    def login_progress_polling?
+      login_progress_job_payload?(@sophtron_item.raw_job_payload)
+    end
+
+    def login_progress_job_payload?(job_payload)
+      job = (job_payload || {}).with_indifferent_access
+      last_status = job[:LastStatus] || job[:last_status]
+      return false if Provider::Sophtron.failure_job_status?(last_status)
+
+      job[:LastStep].present? || job[:last_step].present? || last_status.present?
+    end
+
+    def prefetch_request?
+      [
+        request.headers["X-Sec-Purpose"],
+        request.headers["Sec-Purpose"],
+        request.headers["Purpose"]
+      ].any? { |value| value.to_s.include?("prefetch") }
+    end
+
+    def render_institution_connection_error(message)
+      render_api_error(
+        message,
+        select_accounts_sophtron_items_path(connection_context_params.except(:post_mfa, "post_mfa")),
+        heading: t("sophtron_items.api_error.institution_unable_to_connect"),
+        issue_keys: %w[bad_credentials verification_code institution_timeout unsupported_mfa],
+        action_label: t("sophtron_items.api_error.try_again")
+      )
+    end
+
+    def sophtron_connection_failure_message(job)
+      last_status = job.with_indifferent_access[:LastStatus].to_s
+      return t("sophtron_items.connection_status.failed_timeout") if last_status.match?(/timeout/i)
+
+      t("sophtron_items.connection_status.failed")
+    end
+
+    def render_api_error(message, return_path, heading: nil, issue_keys: nil, action_label: nil)
+      render partial: "sophtron_items/api_error",
+             locals: {
+               error_message: message,
+               return_path: return_path,
+               heading: heading,
+               issue_keys: issue_keys,
+               action_label: action_label
+             },
+             layout: false
+    end
+
+    def redirect_after_account_link(return_to, created_accounts, already_linked_accounts, invalid_accounts)
+      if invalid_accounts.any? && created_accounts.empty? && already_linked_accounts.empty?
+        redirect_to new_account_path, alert: t(".invalid_account_names", count: invalid_accounts.count)
+      elsif invalid_accounts.any? && (created_accounts.any? || already_linked_accounts.any?)
+        redirect_to return_to || accounts_path,
+                    alert: t(".partial_invalid",
+                             created_count: created_accounts.count,
+                             already_linked_count: already_linked_accounts.count,
+                             invalid_count: invalid_accounts.count)
+      elsif created_accounts.any? && already_linked_accounts.any?
+        redirect_to return_to || accounts_path,
+                    notice: t(".partial_success",
+                             created_count: created_accounts.count,
+                             already_linked_count: already_linked_accounts.count,
+                             already_linked_names: already_linked_accounts.join(", "))
+      elsif created_accounts.any?
+        redirect_to return_to || accounts_path, notice: t(".success", count: created_accounts.count)
+      elsif already_linked_accounts.any?
+        redirect_to return_to || accounts_path,
+                    alert: t(".all_already_linked",
+                            count: already_linked_accounts.count,
+                            names: already_linked_accounts.join(", "))
+      else
+        redirect_to new_account_path, alert: t(".link_failed")
+      end
+    end
+
+    def fetch_sophtron_accounts_from_api
+      return nil unless @sophtron_item.sophtron_accounts.empty?
+      return t("sophtron_items.setup_accounts.no_access_key") unless @sophtron_item.credentials_configured?
+      return t("sophtron_items.setup_accounts.no_institution_connected") unless @sophtron_item.connected_to_institution?
+
+      @sophtron_item.fetch_remote_accounts(force: true)
+      nil
+    rescue Provider::Sophtron::Error => e
+      Rails.logger.error("Sophtron API error: #{e.message}")
+      t("sophtron_items.setup_accounts.api_error")
+    rescue StandardError => e
+      Rails.logger.error("Unexpected error fetching Sophtron accounts: #{e.class}: #{e.message}")
+      Rails.logger.error(e.backtrace.first(10).join("\n"))
+      t("sophtron_items.setup_accounts.api_error")
+    end
+
+    def set_sophtron_item
+      @sophtron_item = Current.family.sophtron_items.find(params[:id])
+    end
+
+    def sophtron_params
+      params.require(:sophtron_item).permit(:name, :user_id, :access_key, :base_url, :sync_start_date)
+    end
+
+    def connection_context_params
+      params.permit(:accountable_type, :account_id, :return_to, :post_mfa, :connect_new_institution, :manual_sync, :sync_id, :sophtron_account_id, :institution_key, :user_institution_id).to_h.compact
+    end
+
+    def connect_new_institution_flow?
+      ActiveModel::Type::Boolean.new.cast(params[:connect_new_institution])
+    end
+
+    def safe_return_to_path
+      return nil if params[:return_to].blank?
+
+      return_to = params[:return_to].to_s
+
+      begin
+        uri = URI.parse(return_to)
+        return nil if uri.scheme.present? || uri.host.present?
+        return nil if return_to.start_with?("//")
+        return nil unless return_to.start_with?("/")
+
+        return_to
+      rescue URI::InvalidURIError
+        nil
+      end
+    end
+end
diff --git a/app/controllers/splits_controller.rb b/app/controllers/splits_controller.rb
index a62540e9d..e31b64596 100644
--- a/app/controllers/splits_controller.rb
+++ b/app/controllers/splits_controller.rb
@@ -16,7 +16,7 @@ class SplitsController < ApplicationController
     raw_splits = raw_splits.values if raw_splits.respond_to?(:values)
 
     splits = raw_splits.map do |s|
-      { name: s[:name], amount: s[:amount].to_d * -1, category_id: s[:category_id].presence }
+      { name: s[:name], amount: s[:amount].to_d * -1, category_id: s[:category_id].presence, excluded: s[:excluded] }
     end
 
     @entry.split!(splits)
@@ -51,7 +51,7 @@ class SplitsController < ApplicationController
     raw_splits = raw_splits.values if raw_splits.respond_to?(:values)
 
     splits = raw_splits.map do |s|
-      { name: s[:name], amount: s[:amount].to_d * -1, category_id: s[:category_id].presence }
+      { name: s[:name], amount: s[:amount].to_d * -1, category_id: s[:category_id].presence, excluded: s[:excluded] }
     end
 
     Entry.transaction do
@@ -95,6 +95,6 @@ class SplitsController < ApplicationController
     end
 
     def split_params
-      params.require(:split).permit(splits: [ :name, :amount, :category_id ])
+      params.require(:split).permit(splits: [ :name, :amount, :category_id, :excluded ])
     end
 end
diff --git a/app/controllers/subscriptions_controller.rb b/app/controllers/subscriptions_controller.rb
index da02534bd..d6d5ba7d7 100644
--- a/app/controllers/subscriptions_controller.rb
+++ b/app/controllers/subscriptions_controller.rb
@@ -8,7 +8,7 @@ class SubscriptionsController < ApplicationController
   # Upgrade page for unsubscribed users
   def upgrade
     if Current.family.subscription&.active?
-      redirect_to root_path, notice: "You are already contributing. Thank you!"
+      redirect_to root_path, notice: t(".already_contributing")
     else
       @plan = params[:plan] || "annual"
       render layout: "onboardings"
@@ -33,9 +33,9 @@ class SubscriptionsController < ApplicationController
   def create
     if Current.family.can_start_trial?
       Current.family.start_trial_subscription!
-      redirect_to root_path, notice: "Welcome to Sure!"
+      redirect_to root_path, notice: t(".welcome")
     else
-      redirect_to root_path, alert: "You have already started or completed a trial. Please upgrade to continue."
+      redirect_to root_path, alert: t(".trial_already_used")
     end
   end
 
@@ -54,9 +54,9 @@ class SubscriptionsController < ApplicationController
 
     if checkout_result.success?
       Current.family.start_subscription!(checkout_result.subscription_id)
-      redirect_to root_path, notice: "Welcome to Sure!  Your contribution is appreciated."
+      redirect_to root_path, notice: t(".welcome_with_contribution")
     else
-      redirect_to root_path, alert: "Something went wrong processing your contribution. Please try again."
+      redirect_to root_path, alert: t(".contribution_failed")
     end
   end
 
diff --git a/app/controllers/tags_controller.rb b/app/controllers/tags_controller.rb
index 1c2862907..219971529 100644
--- a/app/controllers/tags_controller.rb
+++ b/app/controllers/tags_controller.rb
@@ -36,7 +36,7 @@ class TagsController < ApplicationController
 
   def destroy_all
     Current.family.tags.destroy_all
-    redirect_back_or_to tags_path, notice: "All tags deleted"
+    redirect_back_or_to tags_path, notice: t(".all_deleted")
   end
 
   private
diff --git a/app/controllers/transaction_categories_controller.rb b/app/controllers/transaction_categories_controller.rb
index 6a8ff353a..d9daf436a 100644
--- a/app/controllers/transaction_categories_controller.rb
+++ b/app/controllers/transaction_categories_controller.rb
@@ -21,6 +21,7 @@ class TransactionCategoriesController < ApplicationController
     transaction.lock_saved_attributes!
     @entry.lock_saved_attributes!
 
+    in_split_group = helpers.in_split_group?(@entry, params[:grouped])
     respond_to do |format|
       format.html { redirect_back_or_to transaction_path(@entry) }
       format.turbo_stream do
@@ -28,12 +29,12 @@ class TransactionCategoriesController < ApplicationController
           turbo_stream.replace(
             dom_id(transaction, "category_menu_mobile"),
             partial: "transactions/transaction_category",
-            locals: { transaction: transaction, variant: "mobile" }
+            locals: { transaction: transaction, variant: "mobile", in_split_group: in_split_group }
           ),
           turbo_stream.replace(
             dom_id(transaction, "category_menu_desktop"),
             partial: "transactions/transaction_category",
-            locals: { transaction: transaction, variant: "desktop" }
+            locals: { transaction: transaction, variant: "desktop", in_split_group: in_split_group }
           ),
           turbo_stream.replace(
             "category_name_mobile_#{transaction.id}",
diff --git a/app/controllers/transactions/bulk_updates_controller.rb b/app/controllers/transactions/bulk_updates_controller.rb
index 82d4c6ddf..133452f21 100644
--- a/app/controllers/transactions/bulk_updates_controller.rb
+++ b/app/controllers/transactions/bulk_updates_controller.rb
@@ -16,7 +16,7 @@ class Transactions::BulkUpdatesController < ApplicationController
   private
     def bulk_update_params
       params.require(:bulk_update)
-            .permit(:date, :notes, :category_id, :merchant_id, entry_ids: [], tag_ids: [])
+            .permit(:date, :notes, :name, :category_id, :merchant_id, entry_ids: [], tag_ids: [])
     end
 
     # Check if tag_ids was explicitly provided in the request.
diff --git a/app/controllers/transactions_controller.rb b/app/controllers/transactions_controller.rb
index 6548d26ed..fbcd89c18 100644
--- a/app/controllers/transactions_controller.rb
+++ b/app/controllers/transactions_controller.rb
@@ -27,6 +27,7 @@ class TransactionsController < ApplicationController
                        )
 
     @pagy, @transactions = pagy(base_scope, limit: safe_per_page)
+    Transaction::ActivitySecurityPreloader.new(@transactions).preload
 
     # Preload split parent data
     entry_ids = @transactions.map { |t| t.entry.id }
@@ -62,6 +63,8 @@ class TransactionsController < ApplicationController
                                          10.days.from_now.to_date,
                                          Date.current)
                                   .includes(:merchant)
+
+    @breadcrumbs = [ [ t("breadcrumbs.home"), root_path ], [ t("breadcrumbs.transactions"), nil ] ]
   end
 
   def clear_filter
@@ -106,7 +109,7 @@ class TransactionsController < ApplicationController
       @entry.mark_user_modified!
       @entry.transaction.lock_attr!(:tag_ids) if @entry.transaction.tags.any?
 
-      flash[:notice] = "Transaction created"
+      flash[:notice] = t(".created")
 
       respond_to do |format|
         format.html { redirect_back_or_to account_path(@entry.account) }
@@ -134,12 +137,15 @@ class TransactionsController < ApplicationController
       @entry.transaction.lock_attr!(:tag_ids) if @entry.transaction.tags.any?
       @entry.sync_account_later
 
+      notes_changed = @entry.saved_change_to_notes?
+
       # Reload to ensure fresh state for turbo stream rendering
       @entry.reload
 
       respond_to do |format|
-        format.html { redirect_back_or_to account_path(@entry.account), notice: "Transaction updated" }
+        format.html { redirect_back_or_to account_path(@entry.account), notice: t(".updated") }
         format.turbo_stream do
+          in_split_group = helpers.in_split_group?(@entry, params[:grouped])
           render turbo_stream: [
             turbo_stream.replace(
               dom_id(@entry, :header),
@@ -151,9 +157,18 @@ class TransactionsController < ApplicationController
               partial: "entries/protection_indicator",
               locals: { entry: @entry, unlock_path: unlock_transaction_path(@entry.transaction) }
             ),
-            turbo_stream.replace(@entry),
+            (turbo_stream.replace(
+              dom_id(@entry, :notes),
+              partial: "transactions/notes",
+              locals: { entry: @entry, can_annotate: can_annotate_entry? }
+            ) if params[:entry]&.key?(:notes) && notes_changed),
+            turbo_stream.replace(
+              dom_id(@entry),
+              partial: "entries/entry",
+              locals: { entry: @entry, in_split_group: in_split_group }
+            ),
             *flash_notification_stream_items
-          ]
+          ].compact
         end
       end
     else
@@ -173,7 +188,9 @@ class TransactionsController < ApplicationController
     end
 
     redirect_to transactions_path
-  rescue ActiveRecord::RecordNotDestroyed, ActiveRecord::RecordInvalid => e
+  rescue ActiveRecord::RecordNotFound, ActiveRecord::RecordInvalid,
+         ActiveRecord::RecordNotDestroyed, ActiveRecord::Deadlocked,
+         ActiveRecord::LockWaitTimeout => e
     Rails.logger.error("Failed to merge duplicate transaction #{params[:id]}: #{e.message}")
     flash[:alert] = t("transactions.merge_duplicate.failure")
     redirect_to transactions_path
@@ -353,6 +370,30 @@ class TransactionsController < ApplicationController
     head :unprocessable_entity
   end
 
+  def exchange_rate
+    account = Current.family.accounts.find(params[:account_id])
+    currency_from = params[:currency]
+    date = params[:date]&.to_date || Date.current
+
+    if account.currency == currency_from
+      render json: { same_currency: true, rate: 1.0 }
+    else
+      rate_obj = ExchangeRate.find_or_fetch_rate(
+        from: currency_from,
+        to: account.currency,
+        date: date
+      )
+
+      if rate_obj.nil?
+        return render json: { error: "Exchange rate not found" }, status: :not_found
+      end
+
+      rate_value = rate_obj.is_a?(Numeric) ? rate_obj : rate_obj.rate
+
+      render json: { rate: rate_value.to_f, account_currency: account.currency }
+    end
+  end
+
   private
     def accessible_transactions
       Current.family.transactions
@@ -409,12 +450,13 @@ class TransactionsController < ApplicationController
     def entry_params
       entry_params = params.require(:entry).permit(
         :name, :date, :amount, :currency, :excluded, :notes, :nature, :entryable_type,
-        entryable_attributes: [ :id, :category_id, :merchant_id, :kind, :investment_activity_label, { tag_ids: [] } ]
+        entryable_attributes: [ :id, :category_id, :merchant_id, :kind, :investment_activity_label, :exchange_rate, { tag_ids: [] } ]
       )
 
       nature = entry_params.delete(:nature)
 
       entry_params.delete(:amount) if entry_params[:amount].blank?
+      entry_params.delete(:date) if entry_params[:date].blank?
 
       if nature.present? && entry_params[:amount].present?
         signed_amount = nature == "inflow" ? -entry_params[:amount].to_d : entry_params[:amount].to_d
@@ -500,12 +542,18 @@ class TransactionsController < ApplicationController
       if params[:security_id] == "__custom__"
         # User selected "Enter custom ticker" - check for combobox selection or manual entry
         if params[:ticker].present?
-          # Combobox selection: format is "SYMBOL|EXCHANGE"
-          ticker_symbol, exchange_operating_mic = params[:ticker].split("|")
+          # Combobox selection: format is "SYMBOL|EXCHANGE|PROVIDER"
+          parsed = Security.parse_combobox_id(params[:ticker])
+          if parsed[:ticker].blank?
+            flash[:alert] = t("transactions.convert_to_trade.errors.enter_ticker")
+            redirect_back_or_to transactions_path
+            return nil
+          end
           Security::Resolver.new(
-            ticker_symbol.strip,
-            exchange_operating_mic: exchange_operating_mic.presence || params[:exchange_operating_mic].presence,
-            country_code: user_country
+            parsed[:ticker].strip,
+            exchange_operating_mic: parsed[:exchange_operating_mic] || params[:exchange_operating_mic].presence,
+            country_code: user_country,
+            price_provider: parsed[:price_provider]
           ).resolve
         elsif params[:custom_ticker].present?
           # Manual entry from combobox's name_when_new or fallback text field
@@ -528,12 +576,18 @@ class TransactionsController < ApplicationController
         end
         found
       elsif params[:ticker].present?
-        # Direct combobox (no existing holdings) - format is "SYMBOL|EXCHANGE"
-        ticker_symbol, exchange_operating_mic = params[:ticker].split("|")
+        # Direct combobox (no existing holdings) - format is "SYMBOL|EXCHANGE|PROVIDER"
+        parsed = Security.parse_combobox_id(params[:ticker])
+        if parsed[:ticker].blank?
+          flash[:alert] = t("transactions.convert_to_trade.errors.enter_ticker")
+          redirect_back_or_to transactions_path
+          return nil
+        end
         Security::Resolver.new(
-          ticker_symbol.strip,
-          exchange_operating_mic: exchange_operating_mic.presence || params[:exchange_operating_mic].presence,
-          country_code: user_country
+          parsed[:ticker].strip,
+          exchange_operating_mic: parsed[:exchange_operating_mic] || params[:exchange_operating_mic].presence,
+          country_code: user_country,
+          price_provider: parsed[:price_provider]
         ).resolve
       elsif params[:custom_ticker].present?
         # Manual entry from combobox's name_when_new (no existing holdings path)
diff --git a/app/controllers/transfer_matches_controller.rb b/app/controllers/transfer_matches_controller.rb
index 341688d5d..4e67653ba 100644
--- a/app/controllers/transfer_matches_controller.rb
+++ b/app/controllers/transfer_matches_controller.rb
@@ -32,7 +32,7 @@ class TransferMatchesController < ApplicationController
 
     @transfer.sync_account_later
 
-    redirect_back_or_to transactions_path, notice: "Transfer created"
+    redirect_back_or_to transactions_path, notice: t(".success")
   end
 
   private
diff --git a/app/controllers/transfers_controller.rb b/app/controllers/transfers_controller.rb
index 0a000fad6..465891f2f 100644
--- a/app/controllers/transfers_controller.rb
+++ b/app/controllers/transfers_controller.rb
@@ -1,22 +1,27 @@
 class TransfersController < ApplicationController
   include StreamExtensions
 
-  before_action :set_transfer, only: %i[show destroy update]
+  before_action :set_transfer, only: %i[show destroy update mark_as_recurring]
+  before_action :set_accounts, only: %i[new create]
 
   def new
     @transfer = Transfer.new
     @from_account_id = params[:from_account_id]
-
-    @accounts = accessible_accounts
-    .alphabetically
-    .includes(
-      :account_providers,
-      logo_attachment: :blob
-    )
   end
 
   def show
     @categories = Current.family.categories.alphabetically
+
+    # Whether the current user can hit `mark_as_recurring`: feature flag on,
+    # AND they have write access to BOTH transfer endpoints. Gating the
+    # view button on this avoids showing a CTA that the controller would
+    # reject via `require_account_permission!` for read-only sharers.
+    endpoint_ids = [ @transfer.from_account&.id, @transfer.to_account&.id ].compact
+    writable_endpoint_count = Account.writable_by(Current.user).where(id: endpoint_ids).distinct.count
+    @can_mark_as_recurring_transfer =
+      !Current.family.recurring_transactions_disabled? &&
+      endpoint_ids.size == 2 &&
+      writable_endpoint_count == 2
   end
 
   def create
@@ -31,8 +36,9 @@ class TransfersController < ApplicationController
       family: Current.family,
       source_account_id: source_account.id,
       destination_account_id: destination_account.id,
-      date: Date.parse(transfer_params[:date]),
-      amount: transfer_params[:amount].to_d
+      date: transfer_params[:date].present? ? Date.parse(transfer_params[:date]) : Date.current,
+      amount: transfer_params[:amount].to_d,
+      exchange_rate: transfer_params[:exchange_rate].presence&.to_d
     ).create
 
     if @transfer.persisted?
@@ -45,6 +51,16 @@ class TransfersController < ApplicationController
       @from_account_id = transfer_params[:from_account_id]
       render :new, status: :unprocessable_entity
     end
+  rescue Money::ConversionError
+    @transfer ||= Transfer.new
+    @transfer.errors.add(:base, "Exchange rate unavailable for selected currencies and date")
+    set_accounts
+    render :new, status: :unprocessable_entity
+  rescue ArgumentError
+    @transfer ||= Transfer.new
+    @transfer.errors.add(:date, "is invalid")
+    set_accounts
+    render :new, status: :unprocessable_entity
   end
 
   def update
@@ -70,6 +86,65 @@ class TransfersController < ApplicationController
     redirect_back_or_to transactions_url, notice: t(".success")
   end
 
+  def mark_as_recurring
+    if Current.family.recurring_transactions_disabled?
+      flash[:alert] = t("recurring_transactions.transfer_feature_disabled")
+      redirect_back_or_to transactions_path
+      return
+    end
+
+    source_account      = @transfer.from_account
+    destination_account = @transfer.to_account
+
+    if source_account.nil? || destination_account.nil?
+      flash[:alert] = t("recurring_transactions.unexpected_error")
+      redirect_back_or_to transactions_path
+      return
+    end
+
+    return unless require_account_permission!(source_account)
+    return unless require_account_permission!(destination_account)
+
+    existing = Current.family.recurring_transactions.find_by(
+      account_id: source_account.id,
+      destination_account_id: destination_account.id,
+      amount: @transfer.outflow_transaction.entry.amount,
+      currency: @transfer.outflow_transaction.entry.currency
+    )
+
+    if existing
+      flash[:alert] = t("recurring_transactions.transfer_already_exists")
+      respond_to do |format|
+        format.html { redirect_back_or_to transactions_path }
+      end
+      return
+    end
+
+    begin
+      RecurringTransaction.create_from_transfer(@transfer)
+      flash[:notice] = t("recurring_transactions.transfer_marked_as_recurring")
+      respond_to do |format|
+        format.html { redirect_back_or_to transactions_path }
+      end
+    rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotUnique
+      # RecordNotUnique covers the race window between `find_by` and `create!`
+      # (the partial unique index protects us at the DB level).
+      flash[:alert] = t("recurring_transactions.transfer_creation_failed")
+      respond_to do |format|
+        format.html { redirect_back_or_to transactions_path }
+      end
+    rescue StandardError => e
+      Rails.logger.error(
+        "transfers#mark_as_recurring failed: #{e.class} #{e.message} " \
+        "(transfer=#{@transfer&.id} family=#{Current.family&.id} user=#{Current.user&.id})"
+      )
+      flash[:alert] = t("recurring_transactions.unexpected_error")
+      respond_to do |format|
+        format.html { redirect_back_or_to transactions_path }
+      end
+    end
+  end
+
   private
     def set_transfer
       # Finds the transfer and ensures the user has access to it
@@ -85,7 +160,16 @@ class TransfersController < ApplicationController
     end
 
     def transfer_params
-      params.require(:transfer).permit(:from_account_id, :to_account_id, :amount, :date, :name, :excluded)
+      params.require(:transfer).permit(:from_account_id, :to_account_id, :amount, :date, :name, :excluded, :exchange_rate)
+    end
+
+    def set_accounts
+      @accounts = accessible_accounts
+        .alphabetically
+        .includes(
+          :account_providers,
+          logo_attachment: :blob
+        )
     end
 
     def transfer_update_params
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index ebf250d03..d265734c6 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -6,7 +6,7 @@ class UsersController < ApplicationController
     if @user.resend_confirmation_email
       redirect_to settings_profile_path, notice: t(".success")
     else
-      redirect_to settings_profile_path, alert: t("no_pending_change")
+      redirect_to settings_profile_path, alert: t(".no_pending_change")
     end
   end
 
@@ -107,7 +107,10 @@ class UsersController < ApplicationController
 
     def user_params
       family_attrs = [ :name, :currency, :country, :date_format, :timezone, :locale, :month_start_day, :id ]
-      family_attrs.push(:moniker, :default_account_sharing) if Current.user.admin?
+      if Current.user.admin?
+        family_attrs.push(:moniker, :default_account_sharing)
+        family_attrs << { enabled_currencies: [] }
+      end
 
       params.require(:user).permit(
         :first_name, :last_name, :email, :profile_image, :redirect_to, :delete_profile_image, :onboarded_at,
@@ -127,8 +130,9 @@ class UsersController < ApplicationController
 
       moniker_changed = family_attrs[:moniker].present? && family_attrs[:moniker] != Current.family.moniker
       sharing_changed = family_attrs[:default_account_sharing].present? && family_attrs[:default_account_sharing] != Current.family.default_account_sharing
+      enabled_currencies_changed = family_attrs.key?(:enabled_currencies)
 
-      moniker_changed || sharing_changed
+      moniker_changed || sharing_changed || enabled_currencies_changed
     end
 
     def ensure_admin
diff --git a/app/controllers/valuations_controller.rb b/app/controllers/valuations_controller.rb
index 32ec2df74..9dbfdd597 100644
--- a/app/controllers/valuations_controller.rb
+++ b/app/controllers/valuations_controller.rb
@@ -7,6 +7,12 @@ class ValuationsController < ApplicationController
 
     @entry = @account.entries.build(entry_params.merge(currency: @account.currency))
 
+    if entry_params[:amount].blank?
+      @error_message = t("valuations.errors.amount_required")
+      render :new, status: :unprocessable_entity
+      return
+    end
+
     @reconciliation_dry_run = @entry.account.create_reconciliation(
       balance: entry_params[:amount],
       date: entry_params[:date],
@@ -21,6 +27,13 @@ class ValuationsController < ApplicationController
     return unless require_account_permission!(@entry.account)
 
     @account = @entry.account
+
+    if entry_params[:amount].blank?
+      @error_message = t("valuations.errors.amount_required")
+      render :show, status: :unprocessable_entity
+      return
+    end
+
     @entry.assign_attributes(entry_params.merge(currency: @account.currency))
 
     @reconciliation_dry_run = @entry.account.update_reconciliation(
@@ -44,8 +57,8 @@ class ValuationsController < ApplicationController
 
     if result.success?
       respond_to do |format|
-        format.html { redirect_back_or_to account_path(account), notice: "Account updated" }
-        format.turbo_stream { stream_redirect_back_or_to(account_path(account), notice: "Account updated") }
+        format.html { redirect_back_or_to account_path(account), notice: t(".account_updated") }
+        format.turbo_stream { stream_redirect_back_or_to(account_path(account), notice: t(".account_updated")) }
       end
     else
       @error_message = result.error_message
@@ -71,7 +84,7 @@ class ValuationsController < ApplicationController
       @entry.reload
 
       respond_to do |format|
-        format.html { redirect_back_or_to account_path(@entry.account), notice: "Entry updated" }
+        format.html { redirect_back_or_to account_path(@entry.account), notice: t(".entry_updated") }
         format.turbo_stream do
           render turbo_stream: [
             turbo_stream.replace(
diff --git a/app/controllers/webhooks_controller.rb b/app/controllers/webhooks_controller.rb
index 54cf8331f..e50325dcd 100644
--- a/app/controllers/webhooks_controller.rb
+++ b/app/controllers/webhooks_controller.rb
@@ -15,7 +15,8 @@ class WebhooksController < ApplicationController
     render json: { received: true }, status: :ok
   rescue => error
     Sentry.capture_exception(error)
-    render json: { error: "Invalid webhook: #{error.message}" }, status: :bad_request
+    Rails.logger.error("Webhook error: #{error.class} - #{error.message}")
+    render json: { error: "Invalid webhook" }, status: :bad_request
   end
 
   def plaid_eu
@@ -31,7 +32,8 @@ class WebhooksController < ApplicationController
     render json: { received: true }, status: :ok
   rescue => error
     Sentry.capture_exception(error)
-    render json: { error: "Invalid webhook: #{error.message}" }, status: :bad_request
+    Rails.logger.error("Webhook error: #{error.class} - #{error.message}")
+    render json: { error: "Invalid webhook" }, status: :bad_request
   end
 
   def stripe
diff --git a/app/helpers/account_statements_helper.rb b/app/helpers/account_statements_helper.rb
new file mode 100644
index 000000000..fa736b5ae
--- /dev/null
+++ b/app/helpers/account_statements_helper.rb
@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+module AccountStatementsHelper
+  ACCOUNT_STATEMENT_BALANCE_FIELDS = %w[opening_balance closing_balance].freeze
+
+  def account_statement_status_badge(statement)
+    case statement.review_status
+    when "linked"
+      render("shared/badge", color: "success") { t("account_statements.status.linked") }
+    when "rejected"
+      render("shared/badge", color: "warning") { t("account_statements.status.rejected") }
+    else
+      render("shared/badge") { t("account_statements.status.unmatched") }
+    end
+  end
+
+  def account_statement_coverage_classes(status)
+    case status.to_s
+    when "not_expected"
+      "bg-container-inset text-subdued ring-alpha-black-25"
+    when "covered"
+      "bg-success/10 text-success ring-success/20"
+    when "duplicate", "ambiguous"
+      "bg-warning/10 text-warning ring-warning/20"
+    when "mismatched"
+      "bg-destructive/10 text-destructive ring-destructive/20"
+    else
+      "bg-gray-tint-5 text-secondary ring-alpha-black-50"
+    end
+  end
+
+  def account_statement_period(statement)
+    if statement.period_start_on.present? && statement.period_end_on.present?
+      "#{format_date(statement.period_start_on)} - #{format_date(statement.period_end_on)}"
+    else
+      t("account_statements.period.unknown")
+    end
+  end
+
+  def account_statement_coverage_label(month)
+    account_statement_month_label(month.date)
+  end
+
+  def account_statement_month_label(date)
+    l(date, format: "%b %Y")
+  end
+
+  def account_statement_coverage_range(coverage)
+    t(
+      "account_statements.account_tab.coverage_range",
+      start: account_statement_month_label(coverage.expected_start_month),
+      end: account_statement_month_label(coverage.expected_end_month)
+    )
+  end
+
+  def account_statement_reconciliation_label(check)
+    key = check[:key] if check.respond_to?(:key?) && check.key?(:key)
+    key ||= check["key"] if check.respond_to?(:key?) && check.key?("key")
+    fallback = t("account_statements.reconciliation.checks.unknown_check")
+    return fallback if key.blank?
+
+    t(
+      "account_statements.reconciliation.checks.#{key}",
+      default: fallback
+    )
+  end
+
+  def account_statement_balance_label(statement, field)
+    return t("account_statements.balance.unknown") unless field.to_s.in?(ACCOUNT_STATEMENT_BALANCE_FIELDS)
+
+    money = statement.public_send("#{field}_money")
+    money ? money.format : t("account_statements.balance.unknown")
+  end
+
+  def account_statement_currency_options(statement)
+    currency_picker_options_for_family(Current.family, extra: [ statement.currency ]).map do |code|
+      currency = Money::Currency.new(code)
+      [ "#{currency.name} (#{currency.iso_code})", currency.iso_code ]
+    end
+  end
+
+  def account_statement_file_icon(statement)
+    if statement.pdf?
+      "file-text"
+    elsif statement.xlsx?
+      "sheet"
+    else
+      "file-spreadsheet"
+    end
+  end
+end
diff --git a/app/helpers/accounts_helper.rb b/app/helpers/accounts_helper.rb
index 99ef891ce..a119246fd 100644
--- a/app/helpers/accounts_helper.rb
+++ b/app/helpers/accounts_helper.rb
@@ -8,4 +8,41 @@ module AccountsHelper
     # Always use the account sync path, which handles syncing all providers
     sync_account_path(account)
   end
+
+  # Returns the account id segment from `/accounts/<id>(/...)?`, or nil.
+  # Used as a cache-key component so the sidebar's active-link styling is
+  # correct without busting the cache for every unrelated path change.
+  def sidebar_active_account_id
+    match = request.path.match(%r{\A/accounts/([\w-]+)})
+    match && match[1]
+  end
+
+  # Cache key for `accounts/_account_sidebar_tabs.html.erb`.
+  # Kept here (not in the ERB) so the partial stays render-only.
+  #
+  # `shares_version` includes both row count and `max(updated_at)` because
+  # deleting a non-most-recent share would not move `max(updated_at)` and
+  # could otherwise serve stale fragments to a user who lost access.
+  # Both are pulled in a single SQL round-trip via `pick`. Note: Rails
+  # returns the values as Strings for raw SQL fragments — that's fine
+  # since they only feed into a cache key (concat-stable, never coerced).
+  def account_sidebar_tabs_cache_key(family:, active_tab:, mobile:)
+    shares_version =
+      if Current.user
+        count, max_at = AccountShare
+          .where(user_id: Current.user.id)
+          .pick(Arel.sql("count(*)"), Arel.sql("max(updated_at)"))
+        "#{count}-#{max_at}"
+      end
+
+    [
+      family.build_cache_key("account_sidebar_tabs_v1", invalidate_on_data_updates: true),
+      Current.user&.id,
+      shares_version,
+      active_tab,
+      mobile,
+      I18n.locale,
+      sidebar_active_account_id
+    ]
+  end
 end
diff --git a/app/helpers/api/v1/money_helper.rb b/app/helpers/api/v1/money_helper.rb
new file mode 100644
index 000000000..2556a1941
--- /dev/null
+++ b/app/helpers/api/v1/money_helper.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Api::V1::MoneyHelper
+  def money_to_minor_units(money)
+    (money.amount * money.currency.minor_unit_conversion).round(0).to_i if money
+  end
+end
diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 7f0aad0bd..9f2c0a647 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -14,10 +14,28 @@ module ApplicationHelper
     form_with(**options, &block)
   end
 
+  # Locale-aware ordinal label for integers.
+  # English falls through to Ruby's ordinalize ("1st"); Catalan returns "1r"/"2n"/...
+  def localized_ordinal(number)
+    case I18n.locale
+    when :ca
+      n = number.to_i
+      suffix = case n
+      when 1, 3 then "r"
+      when 2 then "n"
+      when 4 then "t"
+      else "è"
+      end
+      "#{n}#{suffix}"
+    else
+      number.to_i.ordinalize
+    end
+  end
+
   def icon(key, size: "md", color: "default", custom: false, as_button: false, **opts)
     extra_classes = opts.delete(:class)
     sizes = { xs: "w-3 h-3", sm: "w-4 h-4", md: "w-5 h-5", lg: "w-6 h-6", xl: "w-7 h-7", "2xl": "w-8 h-8" }
-    colors = { default: "fg-gray", white: "fg-inverse", success: "text-success", warning: "text-warning", destructive: "text-destructive", current: "text-current" }
+    colors = { default: "text-secondary", white: "text-inverse", success: "text-success", warning: "text-warning", destructive: "text-destructive", info: "text-info", current: "text-current" }
 
     icon_classes = class_names(
       "shrink-0",
@@ -26,12 +44,14 @@ module ApplicationHelper
       extra_classes
     )
 
+    resolved_key = normalize_icon_key(key)
+
     if custom
-      inline_svg_tag("#{key}.svg", class: icon_classes, **opts)
+      inline_svg_tag("#{resolved_key}.svg", class: icon_classes, **opts)
     elsif as_button
-      render DS::Button.new(variant: "icon", class: extra_classes, icon: key, size: size, type: "button", **opts)
+      render DS::Button.new(variant: "icon", class: extra_classes, icon: resolved_key, size: size, type: "button", **opts)
     else
-      lucide_icon(key, class: icon_classes, **opts)
+      safe_lucide_icon(resolved_key, class: icon_classes, **opts)
     end
   end
 
@@ -72,7 +92,7 @@ module ApplicationHelper
 
 
   def family_moniker
-    Current.family&.moniker_label || "Family"
+    Current.family&.moniker_label || I18n.t("shared.family_moniker.singular")
   end
 
   def family_moniker_downcase
@@ -80,7 +100,7 @@ module ApplicationHelper
   end
 
   def family_moniker_plural
-    Current.family&.moniker_label_plural || "Families"
+    Current.family&.moniker_label_plural || I18n.t("shared.family_moniker.plural")
   end
 
   def family_moniker_plural_downcase
@@ -100,6 +120,17 @@ module ApplicationHelper
               .join(separator)
   end
 
+  def currency_picker_options_for_family(family = Current.family, extra: [])
+    return Money::Currency.as_options.map(&:iso_code) unless family
+
+    family.enabled_currency_codes(extra:)
+  end
+
+  def currency_label(currency_or_code)
+    currency = currency_or_code.is_a?(Money::Currency) ? currency_or_code : Money::Currency.new(currency_or_code)
+    "#{currency.name} (#{currency.iso_code})"
+  end
+
   def show_super_admin_bar?
     if params[:admin].present?
       cookies.permanent[:admin] = params[:admin]
@@ -179,6 +210,20 @@ module ApplicationHelper
   end
 
   private
+    def safe_lucide_icon(key, **opts)
+      lucide_icon(key, **opts)
+    rescue StandardError => e
+      Rails.logger.warn("[ApplicationHelper] Falling back to key for unknown icon #{key.inspect}: #{e.message}")
+      lucide_icon("key", **opts)
+    end
+
+    def normalize_icon_key(key)
+      normalized = key.to_s.strip
+      return normalized if normalized.blank?
+
+      normalized.downcase
+    end
+
     def calculate_total(item, money_method, negate)
       # Filter out transfer-type transactions from entries
       # Only Entry objects have entryable transactions, Account objects don't
diff --git a/app/helpers/brex_items_helper.rb b/app/helpers/brex_items_helper.rb
new file mode 100644
index 000000000..be30ecb40
--- /dev/null
+++ b/app/helpers/brex_items_helper.rb
@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+module BrexItemsHelper
+  BrexAccountDisplay = Struct.new(
+    :id,
+    :name,
+    :kind,
+    :currency,
+    :status,
+    :blank_name,
+    keyword_init: true
+  ) do
+    alias_method :blank_name?, :blank_name
+  end
+
+  def brex_account_display(account)
+    data = account.with_indifferent_access
+    kind = BrexAccount.kind_for(data)
+    name = BrexAccount.name_for(data)
+
+    BrexAccountDisplay.new(
+      id: data[:id],
+      name: name,
+      kind: kind,
+      currency: BrexAccount.currency_code_from_money(data[:current_balance] || data[:available_balance] || data[:account_limit]),
+      status: data[:status],
+      blank_name: name.blank?
+    )
+  end
+
+  def brex_account_metadata(display)
+    parts = [
+      t("brex_items.account_metadata.provider"),
+      display.currency,
+      translated_brex_metadata_value("kinds", display.kind),
+      translated_brex_metadata_value("statuses", display.status)
+    ].compact
+
+    parts.join(t("brex_items.account_metadata.separator"))
+  end
+
+  def brex_item_render_locals(brex_item, sync_stats_map: nil, account_counts_map: nil, institutions_count_map: nil)
+    counts = (account_counts_map || {})[brex_item.id] || {}
+
+    {
+      brex_item: brex_item,
+      stats: (sync_stats_map || {})[brex_item.id] || brex_item.syncs.ordered.first&.sync_stats || {},
+      unlinked_count: counts[:unlinked] || brex_item.unlinked_accounts_count,
+      linked_count: counts[:linked] || brex_item.linked_accounts_count,
+      total_count: counts[:total] || brex_item.total_accounts_count,
+      institutions_count: (institutions_count_map || {})[brex_item.id] || brex_item.connected_institutions.size
+    }
+  end
+
+  def default_brex_depository_subtype(account_name)
+    normalized_name = account_name.to_s.downcase
+
+    if normalized_name.match?(/\bchecking\b|\bchequing\b|\bck\b|demand\s+deposit/)
+      "checking"
+    elsif normalized_name.match?(/\bsavings\b|\bsv\b/)
+      "savings"
+    elsif normalized_name.match?(/money\s+market|\bmm\b/)
+      "money_market"
+    else
+      "checking"
+    end
+  end
+
+  private
+    def translated_brex_metadata_value(scope, value)
+      key = value.to_s
+      return nil if key.blank?
+
+      t("brex_items.#{scope}.#{key}", default: key.titleize)
+    end
+end
diff --git a/app/helpers/budgets_helper.rb b/app/helpers/budgets_helper.rb
new file mode 100644
index 000000000..8ffb27ad8
--- /dev/null
+++ b/app/helpers/budgets_helper.rb
@@ -0,0 +1,70 @@
+module BudgetsHelper
+  def budget_has_over_budget?(budget)
+    return false unless budget.initialized?
+
+    budget.budget_categories.any?(&:any_over_budget?)
+  end
+
+  def budget_categories_view_state(budget)
+    @budget_categories_view_state ||= {}
+    @budget_categories_view_state[budget.object_id] ||= build_budget_categories_view_state(budget)
+  end
+
+  private
+
+    def build_budget_categories_view_state(budget)
+      uncategorized_budget_category = budget.uncategorized_budget_category
+      all_category_groups = BudgetCategory::Group.for(budget.budget_categories)
+
+      over_budget_groups = if budget.initialized?
+        filtered_groups_for(all_category_groups) { |budget_category| budget_category.any_over_budget? }
+      else
+        []
+      end
+
+      show_over_budget_uncategorized = budget.initialized? && uncategorized_budget_category.any_over_budget?
+      over_budget_count = visible_count_for(over_budget_groups) { |budget_category| budget_category.any_over_budget? }
+      over_budget_count += 1 if show_over_budget_uncategorized
+
+      on_track_groups = if budget.initialized?
+        filtered_groups_for(all_category_groups) { |budget_category| budget_category.visible_on_track? }
+      else
+        all_category_groups
+      end
+
+      show_on_track_uncategorized = all_category_groups.any? && (!budget.initialized? || uncategorized_budget_category.on_track?)
+      on_track_count = visible_count_for(on_track_groups) { |budget_category| parent_visible_for_on_track?(budget, budget_category) }
+      on_track_count += 1 if show_on_track_uncategorized
+      visible_expenses_empty = on_track_count.zero?
+
+      {
+        uncategorized_budget_category: uncategorized_budget_category,
+        visible_expenses_empty: visible_expenses_empty,
+        over_budget_groups: over_budget_groups,
+        show_over_budget_uncategorized: show_over_budget_uncategorized,
+        over_budget_count: over_budget_count,
+        on_track_groups: on_track_groups,
+        show_on_track_uncategorized: show_on_track_uncategorized,
+        on_track_count: on_track_count
+      }
+    end
+
+    def parent_visible_for_on_track?(budget, budget_category)
+      budget.initialized? ? budget_category.visible_on_track? : true
+    end
+
+    def filtered_groups_for(groups)
+      groups.each_with_object([]) do |group, filtered_groups|
+        visible_subcategories = group.budget_subcategories.select { |budget_category| yield(budget_category) }
+        next unless yield(group.budget_category) || visible_subcategories.any?
+
+        filtered_groups << BudgetCategory::Group.new(group.budget_category, visible_subcategories)
+      end
+    end
+
+    def visible_count_for(groups)
+      groups.sum do |group|
+        (yield(group.budget_category) ? 1 : 0) + group.budget_subcategories.count
+      end
+    end
+end
diff --git a/app/helpers/categories_helper.rb b/app/helpers/categories_helper.rb
index 2d586dee7..458dae432 100644
--- a/app/helpers/categories_helper.rb
+++ b/app/helpers/categories_helper.rb
@@ -1,21 +1,21 @@
 module CategoriesHelper
   def transfer_category
     Category.new \
-      name: "Transfer",
+      name: I18n.t("categories.virtual.transfer"),
       color: Category::TRANSFER_COLOR,
       lucide_icon: "arrow-right-left"
   end
 
   def payment_category
     Category.new \
-      name: "Payment",
+      name: I18n.t("categories.virtual.payment"),
       color: Category::PAYMENT_COLOR,
       lucide_icon: "arrow-right"
   end
 
   def trade_category
     Category.new \
-      name: "Trade",
+      name: I18n.t("categories.virtual.trade"),
       color: Category::TRADE_COLOR
   end
 
diff --git a/app/helpers/custom_confirm.rb b/app/helpers/custom_confirm.rb
index cdf245853..f2d59a009 100644
--- a/app/helpers/custom_confirm.rb
+++ b/app/helpers/custom_confirm.rb
@@ -38,14 +38,14 @@ class CustomConfirm
     end
 
     def default_title
-      "Are you sure?"
+      I18n.t("shared.custom_confirm.default_title")
     end
 
     def default_body
-      "This is not reversible."
+      I18n.t("shared.custom_confirm.default_body")
     end
 
     def default_btn_text
-      "Confirm"
+      I18n.t("shared.custom_confirm.default_btn_text")
     end
 end
diff --git a/app/helpers/imports_helper.rb b/app/helpers/imports_helper.rb
index 6cf680452..30f986bce 100644
--- a/app/helpers/imports_helper.rb
+++ b/app/helpers/imports_helper.rb
@@ -1,51 +1,60 @@
 module ImportsHelper
   def mapping_label(mapping_class)
     {
-      "Import::AccountTypeMapping" => "Account Type",
-      "Import::AccountMapping" => "Account",
-      "Import::CategoryMapping" => "Category",
-      "Import::TagMapping" => "Tag"
+      "Import::AccountTypeMapping" => I18n.t("imports.mapping_labels.account_type"),
+      "Import::AccountMapping" => I18n.t("imports.mapping_labels.account"),
+      "Import::CategoryMapping" => I18n.t("imports.mapping_labels.category"),
+      "Import::TagMapping" => I18n.t("imports.mapping_labels.tag")
     }.fetch(mapping_class.name)
   end
 
   def import_col_label(key)
     {
-      date: "Date",
-      amount: "Amount",
-      name: "Name",
-      currency: "Currency",
-      category: "Category",
-      tags: "Tags",
-      account: "Account",
-      notes: "Notes",
-      qty: "Quantity",
-      ticker: "Ticker",
-      exchange: "Exchange",
-      price: "Price",
-      entity_type: "Type",
-      category_parent: "Parent category",
-      category_color: "Color",
-      category_icon: "Lucide icon"
+      date: I18n.t("imports.column_labels.date"),
+      amount: I18n.t("imports.column_labels.amount"),
+      name: I18n.t("imports.column_labels.name"),
+      currency: I18n.t("imports.column_labels.currency"),
+      category: I18n.t("imports.column_labels.category"),
+      tags: I18n.t("imports.column_labels.tags"),
+      account: I18n.t("imports.column_labels.account"),
+      notes: I18n.t("imports.column_labels.notes"),
+      qty: I18n.t("imports.column_labels.qty"),
+      ticker: I18n.t("imports.column_labels.ticker"),
+      exchange: I18n.t("imports.column_labels.exchange"),
+      price: I18n.t("imports.column_labels.price"),
+      entity_type: I18n.t("imports.column_labels.entity_type"),
+      category_parent: I18n.t("imports.column_labels.category_parent"),
+      category_color: I18n.t("imports.column_labels.category_color"),
+      category_icon: I18n.t("imports.column_labels.category_icon")
     }[key]
   end
 
   def dry_run_resource(key)
     map = {
-      transactions: DryRunResource.new(label: "Transactions", icon: "credit-card", text_class: "text-cyan-500", bg_class: "bg-cyan-500/5"),
-      accounts: DryRunResource.new(label: "Accounts", icon: "layers", text_class: "text-orange-500", bg_class: "bg-orange-500/5"),
-      categories: DryRunResource.new(label: "Categories", icon: "shapes", text_class: "text-blue-500", bg_class: "bg-blue-500/5"),
-      tags: DryRunResource.new(label: "Tags", icon: "tags", text_class: "text-violet-500", bg_class: "bg-violet-500/5"),
-      rules: DryRunResource.new(label: "Rules", icon: "workflow", text_class: "text-green-500", bg_class: "bg-green-500/5"),
-      merchants: DryRunResource.new(label: "Merchants", icon: "store", text_class: "text-amber-500", bg_class: "bg-amber-500/5"),
-      trades: DryRunResource.new(label: "Trades", icon: "arrow-left-right", text_class: "text-emerald-500", bg_class: "bg-emerald-500/5"),
-      valuations: DryRunResource.new(label: "Valuations", icon: "trending-up", text_class: "text-pink-500", bg_class: "bg-pink-500/5"),
-      budgets: DryRunResource.new(label: "Budgets", icon: "wallet", text_class: "text-indigo-500", bg_class: "bg-indigo-500/5"),
-      budget_categories: DryRunResource.new(label: "Budget Categories", icon: "pie-chart", text_class: "text-teal-500", bg_class: "bg-teal-500/5")
+      transactions: DryRunResource.new(label: t("imports.dry_run_resources.transactions"), icon: "credit-card", text_class: "text-info", bg_class: "bg-info/10"),
+      balances: DryRunResource.new(label: t("imports.dry_run_resources.balances"), icon: "line-chart", text_class: "text-secondary", bg_class: "bg-container-inset"),
+      accounts: DryRunResource.new(label: t("imports.dry_run_resources.accounts"), icon: "layers", text_class: "text-warning", bg_class: "bg-warning/10"),
+      categories: DryRunResource.new(label: t("imports.dry_run_resources.categories"), icon: "shapes", text_class: "text-info", bg_class: "bg-info/10"),
+      tags: DryRunResource.new(label: t("imports.dry_run_resources.tags"), icon: "tags", text_class: "text-info", bg_class: "bg-info/10"),
+      rules: DryRunResource.new(label: t("imports.dry_run_resources.rules"), icon: "workflow", text_class: "text-success", bg_class: "bg-success/10"),
+      merchants: DryRunResource.new(label: t("imports.dry_run_resources.merchants"), icon: "store", text_class: "text-warning", bg_class: "bg-warning/10"),
+      recurring_transactions: DryRunResource.new(label: t("imports.dry_run_resources.recurring_transactions"), icon: "repeat-2", text_class: "text-secondary", bg_class: "bg-container-inset"),
+      transfers: DryRunResource.new(label: t("imports.dry_run_resources.transfers"), icon: "repeat", text_class: "text-secondary", bg_class: "bg-container-inset"),
+      rejected_transfers: DryRunResource.new(label: t("imports.dry_run_resources.rejected_transfers"), icon: "ban", text_class: "text-destructive", bg_class: "bg-destructive/10"),
+      trades: DryRunResource.new(label: t("imports.dry_run_resources.trades"), icon: "arrow-left-right", text_class: "text-success", bg_class: "bg-success/10"),
+      holdings: DryRunResource.new(label: t("imports.dry_run_resources.holdings"), icon: "briefcase-business", text_class: "text-secondary", bg_class: "bg-container-inset"),
+      valuations: DryRunResource.new(label: t("imports.dry_run_resources.valuations"), icon: "trending-up", text_class: "text-info", bg_class: "bg-info/10"),
+      budgets: DryRunResource.new(label: t("imports.dry_run_resources.budgets"), icon: "wallet", text_class: "text-info", bg_class: "bg-info/10"),
+      budget_categories: DryRunResource.new(label: t("imports.dry_run_resources.budget_categories"), icon: "pie-chart", text_class: "text-success", bg_class: "bg-success/10")
     }
 
     map[key]
   end
 
+  def import_verification_view(import)
+    ImportVerificationView.new(import.verification_payload)
+  end
+
   def permitted_import_configuration_path(import)
     if permitted_import_types.include?(import.type.underscore)
       "import/configurations/#{import.type.underscore}"
@@ -71,8 +80,53 @@ module ImportsHelper
 
   private
     def permitted_import_types
-      %w[transaction_import trade_import account_import mint_import category_import rule_import]
+      %w[transaction_import trade_import account_import mint_import actual_import category_import rule_import]
     end
 
     DryRunResource = Struct.new(:label, :icon, :text_class, :bg_class, keyword_init: true)
+
+    ImportVerificationView = Struct.new(:payload) do
+      def status
+        readback.fetch("status", "not_verified").to_s
+      end
+
+      def checked_total
+        checked_counts.values.sum(&:to_i)
+      end
+
+      def checked_counts
+        hash_value(readback["checked_counts"])
+      end
+
+      def mismatches
+        hash_value(readback["mismatches"])
+      end
+
+      def mismatches_count
+        mismatches.size
+      end
+
+      def mismatches_preview
+        mismatches.first(3)
+      end
+
+      def mismatches?
+        mismatches.any?
+      end
+
+      private
+        def readback
+          hash_value(payload_hash["readback"])
+        end
+
+        def payload_hash
+          hash_value(payload)
+        end
+
+        def hash_value(value)
+          return {} unless value.respond_to?(:to_h)
+
+          value.to_h.deep_stringify_keys
+        end
+    end
 end
diff --git a/app/helpers/languages_helper.rb b/app/helpers/languages_helper.rb
index 6f451d4a4..66677a6c1 100644
--- a/app/helpers/languages_helper.rb
+++ b/app/helpers/languages_helper.rb
@@ -167,7 +167,8 @@ module LanguagesHelper
     "pt-BR", # Brazilian Portuguese
     "zh-CN", # Chinese (Simplified)
     "zh-TW",  # Chinese (Traditional)
-    "nl"   # Dutch
+    "nl",   # Dutch
+    "hu"   # Hungarian
   ].freeze
 
   COUNTRY_MAPPING = {
@@ -370,7 +371,12 @@ module LanguagesHelper
   }.freeze
 
   def country_options
-    COUNTRY_MAPPING.keys.map { |key| [ COUNTRY_MAPPING[key], key ] }
+    COUNTRY_MAPPING.keys.map do |key|
+      english = COUNTRY_MAPPING[key]
+      emoji, name = english.split(" ", 2)
+      label = I18n.t("countries.#{key}", default: name)
+      [ "#{emoji} #{label}", key ]
+    end
   end
 
   def language_options
diff --git a/app/helpers/reports_helper.rb b/app/helpers/reports_helper.rb
index d79535146..adc964f7b 100644
--- a/app/helpers/reports_helper.rb
+++ b/app/helpers/reports_helper.rb
@@ -1,15 +1,13 @@
 module ReportsHelper
-  # Returns CSS classes for tax treatment badge styling
-  def tax_treatment_badge_classes(treatment)
+  # Returns the DS::Pill tone for a given tax treatment. Mirrors the
+  # mapping used by `accounts/_tax_treatment_badge.html.erb` so the
+  # report and the per-account badge stay visually aligned.
+  def tax_treatment_pill_tone(treatment)
     case treatment.to_sym
-    when :tax_exempt
-      "bg-green-500/10 text-green-600 theme-dark:text-green-400"
-    when :tax_deferred
-      "bg-blue-500/10 text-blue-600 theme-dark:text-blue-400"
-    when :tax_advantaged
-      "bg-purple-500/10 text-purple-600 theme-dark:text-purple-400"
-    else
-      "bg-gray-500/10 text-secondary"
+    when :tax_exempt     then :green
+    when :tax_deferred   then :indigo  # was raw blue-500/10 → closest DS tone
+    when :tax_advantaged then :violet  # was raw purple-500/10 → closest DS tone
+    else                      :neutral
     end
   end
 
diff --git a/app/helpers/settings_helper.rb b/app/helpers/settings_helper.rb
index 79a3c248a..d9eb42a0e 100644
--- a/app/helpers/settings_helper.rb
+++ b/app/helpers/settings_helper.rb
@@ -1,31 +1,31 @@
 module SettingsHelper
   SETTINGS_ORDER = [
     # General section
-    { name: "Accounts", path: :accounts_path },
-    { name: "Bank Sync", path: :settings_bank_sync_path },
-    { name: "Preferences", path: :settings_preferences_path },
-    { name: "Appearance", path: :settings_appearance_path },
-    { name: "Profile Info", path: :settings_profile_path },
-    { name: "Security", path: :settings_security_path },
-    { name: "Payment", path: :settings_payment_path, condition: :not_self_hosted? },
+    { name: -> { t("settings.settings_nav.accounts_label") }, path: :accounts_path },
+    { name: -> { t("settings.settings_nav.bank_sync_label") }, path: :settings_providers_path, condition: :admin_user? },
+    { name: -> { t("settings.settings_nav.preferences_label") }, path: :settings_preferences_path },
+    { name: -> { t("settings.settings_nav.appearance_label") }, path: :settings_appearance_path },
+    { name: -> { t("settings.settings_nav.profile_label") }, path: :settings_profile_path },
+    { name: -> { t("settings.settings_nav.security_label") }, path: :settings_security_path },
+    { name: -> { t("settings.settings_nav.payment_label") }, path: :settings_payment_path, condition: :not_self_hosted? },
     # Transactions section
-    { name: "Categories", path: :categories_path },
-    { name: "Tags", path: :tags_path },
-    { name: "Rules", path: :rules_path },
-    { name: "Merchants", path: :family_merchants_path },
-    { name: "Recurring", path: :recurring_transactions_path },
+    { name: -> { t("settings.settings_nav.categories_label") }, path: :categories_path },
+    { name: -> { t("settings.settings_nav.tags_label") }, path: :tags_path },
+    { name: -> { t("settings.settings_nav.rules_label") }, path: :rules_path },
+    { name: -> { t("settings.settings_nav.merchants_label") }, path: :family_merchants_path },
+    { name: -> { t("settings.settings_nav.recurring_transactions_label") }, path: :recurring_transactions_path },
+    { name: -> { t("settings.settings_nav.statement_vault_label") }, path: :account_statements_path, condition: :admin_user? },
     # Advanced section
-    { name: "AI Prompts", path: :settings_ai_prompts_path, condition: :admin_user? },
-    { name: "LLM Usage", path: :settings_llm_usage_path, condition: :admin_user? },
-    { name: "API Key", path: :settings_api_key_path, condition: :admin_user? },
-    { name: "Self-Hosting", path: :settings_hosting_path, condition: :self_hosted_and_admin? },
-    { name: "Providers", path: :settings_providers_path, condition: :admin_user? },
-    { name: "Imports", path: :imports_path, condition: :admin_user? },
-    { name: "Exports", path: :family_exports_path, condition: :admin_user? },
+    { name: -> { t("settings.settings_nav.ai_prompts_label") }, path: :settings_ai_prompts_path, condition: :admin_user? },
+    { name: -> { t("settings.settings_nav.llm_usage_label") }, path: :settings_llm_usage_path, condition: :admin_user? },
+    { name: -> { t("settings.settings_nav.api_key_label") }, path: :settings_api_key_path, condition: :admin_user? },
+    { name: -> { t("settings.settings_nav.self_hosting_label") }, path: :settings_hosting_path, condition: :self_hosted_and_admin? },
+    { name: -> { t("settings.settings_nav.imports_label") }, path: :imports_path, condition: :admin_user? },
+    { name: -> { t("settings.settings_nav.exports_label") }, path: :family_exports_path, condition: :admin_user? },
     # More section
-    { name: "Guides", path: :settings_guides_path },
-    { name: "What's new", path: :changelog_path },
-    { name: "Feedback", path: :feedback_path }
+    { name: -> { t("settings.settings_nav.guides_label") }, path: :settings_guides_path },
+    { name: -> { t("settings.settings_nav.whats_new_label") }, path: :changelog_path },
+    { name: -> { t("settings.settings_nav.feedback_label") }, path: :feedback_path }
   ]
 
   def adjacent_setting(current_path, offset)
@@ -41,13 +41,68 @@ module SettingsHelper
     render partial: "settings/settings_nav_link_large", locals: {
       path: send(adjacent[:path]),
       direction: offset > 0 ? "next" : "previous",
-      title: adjacent[:name]
+      title: setting_name(adjacent)
     }
   end
 
-  def settings_section(title:, subtitle: nil, collapsible: false, open: true, auto_open_param: nil, &block)
+  def settings_section(title:, subtitle: nil, collapsible: false, open: true, auto_open_param: nil, status: nil, meta: nil, actions: nil, badge: nil, &block)
     content = capture(&block)
-    render partial: "settings/section", locals: { title: title, subtitle: subtitle, content: content, collapsible: collapsible, open: open, auto_open_param: auto_open_param }
+    render partial: "settings/section", locals: { title: title, subtitle: subtitle, content: content, collapsible: collapsible, open: open, auto_open_param: auto_open_param, status: status, meta: meta, actions: actions, badge: badge }
+  end
+
+  def provider_summary(provider_key)
+    key = provider_key.to_s.downcase
+
+    case key
+    when "plaid", "plaid_eu"
+      configured = @provider_configurations&.find { |c| c.provider_key.to_s.casecmp(key).zero? }&.configured?
+      configured ? { status: :ok } : { status: :off }
+    when "simplefin"
+      return { status: :off } unless @simplefin_items&.any?
+      sync_based_summary(key)
+    when "lunchflow"
+      return { status: :off } unless @lunchflow_items&.any?
+      sync_based_summary(key)
+    when "enable_banking"
+      return { status: :off } unless @enable_banking_items&.any?
+      enable_banking_summary
+    when "coinstats"
+      return { status: :off } unless @coinstats_items&.any?
+      sync_based_summary(key)
+    when "mercury"
+      return { status: :off } unless @mercury_items&.any?
+      sync_based_summary(key)
+    when "brex"
+      return { status: :off } unless @brex_items&.any?
+      sync_based_summary(key)
+    when "coinbase"
+      return { status: :off } unless @coinbase_items&.any?
+      sync_based_summary(key)
+    when "binance"
+      return { status: :off } unless @binance_items&.any?
+      sync_based_summary(key)
+    when "kraken"
+      return { status: :off } unless @kraken_items&.any?
+      sync_based_summary(key)
+    when "snaptrade"
+      configured_item = @snaptrade_items&.find(&:credentials_configured?)
+      return { status: :off } unless configured_item
+      unless configured_item.user_registered?
+        return { status: :warn, meta: t("settings.providers.meta.registration_needed") }
+      end
+      sync_based_summary(key)
+    when "ibkr"
+      return { status: :off } unless @ibkr_items&.any?
+      sync_based_summary(key)
+    when "indexa_capital"
+      return { status: :off } unless @indexa_capital_items&.any?
+      sync_based_summary(key)
+    when "sophtron"
+      return { status: :off } unless @sophtron_items&.any?
+      sync_based_summary(key)
+    else
+      { status: :off }
+    end
   end
 
   def settings_nav_footer
@@ -70,11 +125,94 @@ module SettingsHelper
     end
   end
 
+  # Below this many synced accounts, the per-row pills already give the user
+  # enough at-a-glance signal and the strip is redundant chrome.
+  HEALTH_STRIP_MIN_ACCOUNTS = 10
+
+  # Slim health-strip data for the providers index. Pulls counts from the
+  # already-resolved entry summaries plus the family's distinct synced-account
+  # count for the trailing stat. Returns a hash consumed by the
+  # `settings/providers/_health_strip` partial, or nil when the family has
+  # fewer than HEALTH_STRIP_MIN_ACCOUNTS connected accounts.
+  def provider_health_strip(connected:, needs_attention:)
+    accounts_count = Current.family.accounts.joins(:account_providers).distinct.count
+    return nil if accounts_count < HEALTH_STRIP_MIN_ACCOUNTS
+
+    active_entries = connected + needs_attention
+    last_synced_at = active_entries.map { |e| e[:summary][:last_synced_at] }.compact.max
+
+    {
+      connected:        active_entries.size,
+      needs_attention:  needs_attention.size,
+      accounts_syncing: accounts_count,
+      last_synced_at:   last_synced_at
+    }
+  end
+
+  # Strips the leading "about " from `time_ago_in_words` so copy reads as
+  # "Synced 6 hours ago" instead of "Synced about 6 hours ago".
+  def concise_time_ago(time)
+    time_ago_in_words(time).sub(/\Aabout /, "")
+  end
+
   private
+    def sync_based_summary(provider_key)
+      health = @provider_sync_health&.dig(provider_key) || {}
+      last_synced_at = health[:last_synced_at]
+
+      base = if health[:error]
+        { status: :err, meta: t("settings.providers.meta.sync_error") }
+      elsif health[:stale]
+        { status: :warn, meta: t("settings.providers.meta.no_recent_sync") }
+      elsif last_synced_at.present?
+        { status: :ok, meta: t("settings.providers.meta.last_synced", time: concise_time_ago(last_synced_at)) }
+      else
+        { status: :ok }
+      end
+
+      base.merge(last_synced_at: last_synced_at)
+    end
+
+    def enable_banking_summary
+      health = @provider_sync_health&.dig("enable_banking") || {}
+      last_synced_at = health[:last_synced_at]
+
+      return { status: :err, meta: t("settings.providers.meta.sync_error"), last_synced_at: nil } if health[:error]
+
+      valid_items = @enable_banking_items&.select(&:session_valid?) || []
+
+      # All items have expired/missing sessions — need re-authorization
+      if valid_items.empty?
+        return { status: :warn, meta: t("settings.providers.meta.reconsent_required"), last_synced_at: last_synced_at }
+      end
+
+      expiring = valid_items.find do |item|
+        item.session_expires_at.present? && item.session_expires_at < 7.days.from_now
+      end
+
+      if expiring
+        days = [ ((expiring.session_expires_at - Time.current) / 1.day).ceil, 1 ].max
+        return { status: :warn, meta: t("settings.providers.meta.reconsent_needed", count: days), last_synced_at: last_synced_at }
+      end
+
+      return { status: :warn, meta: t("settings.providers.meta.no_recent_sync"), last_synced_at: last_synced_at } if health[:stale]
+
+      if last_synced_at.present?
+        { status: :ok, meta: t("settings.providers.meta.last_synced", time: concise_time_ago(last_synced_at)), last_synced_at: last_synced_at }
+      else
+        { status: :ok, last_synced_at: nil }
+      end
+    end
+
     def not_self_hosted?
       !self_hosted?
     end
 
+    def setting_name(setting)
+      name = setting[:name]
+      name.respond_to?(:call) ? instance_exec(&name) : name
+    end
+
     # Helper used by SETTINGS_ORDER conditions
     def admin_user?
       Current.user&.admin?
diff --git a/app/helpers/simplefin_items_helper.rb b/app/helpers/simplefin_items_helper.rb
index d141bdf17..7f704279c 100644
--- a/app/helpers/simplefin_items_helper.rb
+++ b/app/helpers/simplefin_items_helper.rb
@@ -38,4 +38,16 @@ module SimplefinItemsHelper
     parts << " — #{sample}" if sample.present?
     parts.join
   end
+
+  # Human-friendly relative-time phrase for an activity badge. Returns nil for
+  # a nil input so callers can fall through to "no activity" copy.
+  def activity_when(time, now: Time.current)
+    return nil if time.blank?
+    days = ((now.to_i - time.to_i) / 86_400).floor
+    case days
+    when ..0 then t("simplefin_items.setup_accounts.activity.today")
+    when 1 then t("simplefin_items.setup_accounts.activity.yesterday")
+    else t("simplefin_items.setup_accounts.activity.days_ago", count: days)
+    end
+  end
 end
diff --git a/app/helpers/styled_form_builder.rb b/app/helpers/styled_form_builder.rb
index bb51ab2ff..277d34aa3 100644
--- a/app/helpers/styled_form_builder.rb
+++ b/app/helpers/styled_form_builder.rb
@@ -44,6 +44,7 @@ class StyledFormBuilder < ActionView::Helpers::FormBuilder
         selected: selected_value,
         placeholder: placeholder,
         searchable: options.fetch(:searchable, false),
+        menu_placement: options[:menu_placement],
         variant: options.fetch(:variant, :simple),
         include_blank: options[:include_blank],
         label: options[:label],
@@ -88,6 +89,7 @@ class StyledFormBuilder < ActionView::Helpers::FormBuilder
     @template.render(
       DS::Button.new(
         text: value,
+        type: "submit",
         data: (options[:data] || {}).merge({ turbo_submits_with: "Submitting..." }),
         full_width: true
       )
diff --git a/app/helpers/transactions_helper.rb b/app/helpers/transactions_helper.rb
index 92ce26c81..b9ea06d35 100644
--- a/app/helpers/transactions_helper.rb
+++ b/app/helpers/transactions_helper.rb
@@ -20,6 +20,10 @@ module TransactionsHelper
     transaction_search_filters[0]
   end
 
+  def in_split_group?(entry, params_grouped)
+    entry.split_child? && Current.user.show_split_grouped? && params_grouped == "true"
+  end
+
   # ---- Transaction extra details helpers ----
   # Returns a structured hash describing extra details for a transaction.
   # Input can be a Transaction or an Entry (responds_to :transaction).
diff --git a/app/javascript/application.js b/app/javascript/application.js
index 3f3b9c3a1..353017fa9 100644
--- a/app/javascript/application.js
+++ b/app/javascript/application.js
@@ -1,6 +1,49 @@
 // Configure your import map in config/importmap.rb. Read more: https://github.com/rails/importmap-rails
 import "@hotwired/turbo-rails";
 import "controllers";
+import HwComboboxController from "controllers/hw_combobox_controller";
+
+// Fix hotwire_combobox race condition: when typing quickly, a slow response for
+// an early query (e.g. "A") can overwrite the correct results for the final query
+// (e.g. "AAPL"). We abort the previous in-flight request whenever a new one fires,
+// so stale Turbo Stream responses never reach the DOM.
+const originalFilterAsync = HwComboboxController.prototype._filterAsync;
+HwComboboxController.prototype._filterAsync = async function(inputType) {
+  if (this._searchAbortController) {
+    this._searchAbortController.abort();
+  }
+  this._searchAbortController = new AbortController();
+
+  const query = {
+    q: this._fullQuery,
+    input_type: inputType,
+    for_id: this.element.dataset.asyncId,
+    callback_id: this._enqueueCallback()
+  };
+
+  const url = new URL(this.asyncSrcValue, window.location.origin);
+  Object.entries(query).forEach(([k, v]) => {
+    if (v != null) url.searchParams.set(k, v);
+  });
+
+  try {
+    const response = await fetch(url.toString(), {
+      headers: {
+        "Accept": "text/vnd.turbo-stream.html, text/html, application/xhtml+xml",
+        "X-Requested-With": "XMLHttpRequest",
+        "X-CSRF-Token": document.querySelector('meta[name="csrf-token"]')?.content
+      },
+      signal: this._searchAbortController.signal,
+      credentials: "same-origin"
+    });
+
+    if (response.ok) {
+      await Turbo.renderStreamMessage(await response.text());
+    }
+  } catch (e) {
+    if (e.name !== "AbortError") throw e;
+  }
+};
 
 Turbo.StreamActions.redirect = function () {
   // Use "replace" to avoid adding form submission to browser history
diff --git a/app/javascript/controllers/account_type_selector_controller.js b/app/javascript/controllers/account_type_selector_controller.js
index 4504c41b7..ef9ced189 100644
--- a/app/javascript/controllers/account_type_selector_controller.js
+++ b/app/javascript/controllers/account_type_selector_controller.js
@@ -18,7 +18,8 @@ export default class extends Controller {
     // Hide all subtype selects
     const subtypeSelects = container.querySelectorAll('.subtype-select')
     subtypeSelects.forEach(select => {
-      select.style.display = 'none'
+      select.classList.add('hidden')
+      select.style.removeProperty('display')
       // Clear the name attribute so it doesn't get submitted
       const selectElement = select.querySelector('select')
       if (selectElement) {
@@ -34,7 +35,8 @@ export default class extends Controller {
     // Show the relevant subtype select
     const relevantSubtype = container.querySelector(`[data-type="${selectedType}"]`)
     if (relevantSubtype) {
-      relevantSubtype.style.display = 'block'
+      relevantSubtype.classList.remove('hidden')
+      relevantSubtype.style.removeProperty('display')
       // Re-add the name attribute so it gets submitted
       const selectElement = relevantSubtype.querySelector('select')
       if (selectElement) {
@@ -65,4 +67,4 @@ export default class extends Controller {
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/app/javascript/controllers/admin_sso_form_controller.js b/app/javascript/controllers/admin_sso_form_controller.js
index 2344b8b63..2ade19da5 100644
--- a/app/javascript/controllers/admin_sso_form_controller.js
+++ b/app/javascript/controllers/admin_sso_form_controller.js
@@ -111,10 +111,21 @@ export default class extends Controller {
       if (response.ok) {
         const data = await response.json()
         if (data.issuer) {
-          // Valid OIDC discovery endpoint
-          issuerInput.classList.remove('border-yellow-300', 'border-red-300')
-          issuerInput.classList.add('border-green-300')
-          this.showValidationMessage(issuerInput, 'Valid OIDC issuer', 'success')
+          if (data.issuer === issuer) {
+            issuerInput.classList.remove('border-yellow-300', 'border-red-300', 'border-amber-300')
+            issuerInput.classList.add('border-green-300')
+            this.showValidationMessage(issuerInput, 'Valid OIDC issuer', 'success')
+          } else {
+            issuerInput.classList.remove('border-yellow-300', 'border-green-300')
+            issuerInput.classList.add('border-amber-300')
+
+            const trailingSlashOnly = data.issuer.replace(/\/$/, '') === issuer.replace(/\/$/, '')
+            const message = trailingSlashOnly
+              ? `Issuer mismatch: discovery returned ${data.issuer}. This is usually a trailing slash mismatch, so copy the issuer exactly as returned.`
+              : `Issuer mismatch: discovery returned ${data.issuer}. Copy the issuer exactly as returned by the provider.`
+
+            this.showValidationMessage(issuerInput, message, 'warning')
+          }
         } else {
           throw new Error('Invalid discovery response')
         }
diff --git a/app/javascript/controllers/app_layout_controller.js b/app/javascript/controllers/app_layout_controller.js
index cc15c78c2..612114735 100644
--- a/app/javascript/controllers/app_layout_controller.js
+++ b/app/javascript/controllers/app_layout_controller.js
@@ -21,22 +21,27 @@ export default class extends Controller {
   toggleLeftSidebar() {
     const isOpen = this.leftSidebarTarget.classList.contains("w-full");
     this.#updateUserPreference("show_sidebar", !isOpen);
-    this.#toggleSidebarWidth(this.leftSidebarTarget, isOpen);
+    this.#toggleSidebarWidth(this.leftSidebarTarget, isOpen, "left");
   }
 
   toggleRightSidebar() {
     const isOpen = this.rightSidebarTarget.classList.contains("w-full");
     this.#updateUserPreference("show_ai_sidebar", !isOpen);
-    this.#toggleSidebarWidth(this.rightSidebarTarget, isOpen);
+    this.#toggleSidebarWidth(this.rightSidebarTarget, isOpen, "right");
   }
 
-  #toggleSidebarWidth(el, isCurrentlyOpen) {
+  #toggleSidebarWidth(el, isCurrentlyOpen, side) {
+    const expandedClasses = side === "left" ? [...this.expandedSidebarClasses, "border-r"] : [...this.expandedSidebarClasses, "border-l"];
+    const collapsedClasses = side === "left" ? [...this.collapsedSidebarClasses, "border-r-0"] : [...this.collapsedSidebarClasses, "border-l-0"];
+
     if (isCurrentlyOpen) {
-      el.classList.remove(...this.expandedSidebarClasses);
-      el.classList.add(...this.collapsedSidebarClasses);
+      el.classList.remove(...expandedClasses);
+      el.classList.add(...collapsedClasses);
+      el.inert = true;
     } else {
-      el.classList.add(...this.expandedSidebarClasses);
-      el.classList.remove(...this.collapsedSidebarClasses);
+      el.classList.add(...expandedClasses);
+      el.classList.remove(...collapsedClasses);
+      el.inert = false;
     }
   }
 
diff --git a/app/javascript/controllers/bank_search_controller.js b/app/javascript/controllers/bank_search_controller.js
new file mode 100644
index 000000000..a2c045cd9
--- /dev/null
+++ b/app/javascript/controllers/bank_search_controller.js
@@ -0,0 +1,19 @@
+import { Controller } from "@hotwired/stimulus";
+
+export default class extends Controller {
+  static targets = ["input", "item", "emptyState"];
+
+  filter() {
+    const query = this.inputTarget.value.toLocaleLowerCase().trim();
+    let visibleCount = 0;
+
+    this.itemTargets.forEach(item => {
+      const name = item.dataset.bankName?.toLocaleLowerCase() ?? "";
+      const match = name.includes(query);
+      item.style.display = match ? "" : "none";
+      if (match) visibleCount++;
+    });
+
+    this.emptyStateTarget.classList.toggle("hidden", visibleCount > 0);
+  }
+}
diff --git a/app/javascript/controllers/budget_filter_controller.js b/app/javascript/controllers/budget_filter_controller.js
new file mode 100644
index 000000000..2187a0f65
--- /dev/null
+++ b/app/javascript/controllers/budget_filter_controller.js
@@ -0,0 +1,58 @@
+import { Controller } from "@hotwired/stimulus";
+
+export default class extends Controller {
+  static targets = ["onTrack", "overBudget", "tab"];
+  static values = { filter: { type: String, default: "all" } };
+
+  connect() {
+    const filterParam = new URLSearchParams(window.location.search).get("filter");
+
+    if (this.#isValidFilter(filterParam) && filterParam !== this.filterValue) {
+      this.filterValue = filterParam;
+    } else if (filterParam && !this.#isValidFilter(filterParam)) {
+      this.#syncFilterParam();
+    }
+  }
+
+  setFilter(event) {
+    this.filterValue = event.params.filter;
+    this.#syncFilterParam();
+  }
+
+  filterValueChanged() {
+    const filter = this.filterValue;
+
+    if (this.hasOnTrackTarget) {
+      this.onTrackTarget.hidden = filter === "over_budget";
+    }
+
+    if (this.hasOverBudgetTarget) {
+      this.overBudgetTarget.hidden = filter === "on_track";
+    }
+
+    this.tabTargets.forEach((tab) => {
+      const isActive = tab.dataset.budgetFilterFilterParam === filter;
+      tab.classList.toggle("bg-white", isActive);
+      tab.classList.toggle("theme-dark:bg-gray-700", isActive);
+      tab.classList.toggle("text-primary", isActive);
+      tab.classList.toggle("shadow-sm", isActive);
+      tab.classList.toggle("text-secondary", !isActive);
+    });
+  }
+
+  #isValidFilter(filter) {
+    return ["all", "over_budget", "on_track"].includes(filter);
+  }
+
+  #syncFilterParam() {
+    const url = new URL(window.location.href);
+
+    if (this.filterValue === "all") {
+      url.searchParams.delete("filter");
+    } else {
+      url.searchParams.set("filter", this.filterValue);
+    }
+
+    window.history.replaceState({}, "", url);
+  }
+}
diff --git a/app/javascript/controllers/bulk_select_controller.js b/app/javascript/controllers/bulk_select_controller.js
index 271b6a0f5..cac1867f5 100644
--- a/app/javascript/controllers/bulk_select_controller.js
+++ b/app/javascript/controllers/bulk_select_controller.js
@@ -13,6 +13,8 @@ export default class extends Controller {
   static values = {
     singularLabel: String,
     pluralLabel: String,
+    selectedLabel: { type: String, default: "selected" },
+    editLabel: { type: String, default: "Edit" },
     selectedIds: { type: Array, default: [] },
   };
 
@@ -28,7 +30,7 @@ export default class extends Controller {
 
   bulkEditDrawerHeaderTargetConnected(element) {
     const headingTextEl = element.querySelector("h2");
-    headingTextEl.innerText = `Edit ${
+    headingTextEl.innerText = `${this.editLabelValue} ${
       this.selectedIdsValue.length
     } ${this._pluralizedResourceName()}`;
   }
@@ -132,14 +134,19 @@ export default class extends Controller {
 
   _updateSelectionBar() {
     const count = this.selectedIdsValue.length;
-    this.selectionBarTextTarget.innerText = `${count} ${this._pluralizedResourceName()} selected`;
+    this.selectionBarTextTarget.innerText = `${count} ${this._pluralizedResourceName()} ${this.selectedLabelValue}`;
     this.selectionBarTarget.classList.toggle("hidden", count === 0);
     this.selectionBarTarget.querySelector("input[type='checkbox']").checked =
       count > 0;
 
     if (this.hasDuplicateLinkTarget) {
-      this.duplicateLinkTarget.classList.toggle("hidden", count !== 1);
-      if (count === 1) {
+      const selectedRow = this._selectedRow();
+      const canDuplicate =
+        count === 1 && selectedRow?.dataset.entryType === "Transaction";
+
+      this.duplicateLinkTarget.classList.toggle("hidden", !canDuplicate);
+
+      if (canDuplicate) {
         const url = new URL(
           this.duplicateLinkTarget.href,
           window.location.origin,
@@ -158,6 +165,14 @@ export default class extends Controller {
     return this.pluralLabelValue;
   }
 
+  _selectedRow() {
+    if (this.selectedIdsValue.length !== 1) return null;
+
+    return this.rowTargets.find(
+      (row) => row.dataset.id === this.selectedIdsValue[0],
+    );
+  }
+
   _updateGroups() {
     this.groupTargets.forEach((group) => {
       const rows = this.rowTargets.filter(
diff --git a/app/javascript/controllers/currency_preferences_controller.js b/app/javascript/controllers/currency_preferences_controller.js
new file mode 100644
index 000000000..4908d2f9e
--- /dev/null
+++ b/app/javascript/controllers/currency_preferences_controller.js
@@ -0,0 +1,57 @@
+import { Controller } from "@hotwired/stimulus";
+
+export default class extends Controller {
+  static targets = ["dialog", "checkbox", "selectedCount"];
+  static values = {
+    baseCurrency: String,
+    locale: String,
+    selectedCountTranslations: Object,
+  };
+
+  connect() {
+    this.updateSelectedCount();
+  }
+
+  open() {
+    this.updateSelectedCount();
+    this.dialogTarget.showModal();
+  }
+
+  selectAll() {
+    this.checkboxTargets.forEach((checkbox) => {
+      checkbox.checked = true;
+    });
+
+    this.updateSelectedCount();
+  }
+
+  selectBaseOnly() {
+    this.checkboxTargets.forEach((checkbox) => {
+      checkbox.checked = checkbox.value === this.baseCurrencyValue;
+    });
+
+    this.updateSelectedCount();
+  }
+
+  updateSelectedCount() {
+    if (!this.hasSelectedCountTarget) return;
+
+    const selectedCount = this.checkboxTargets.filter((checkbox) => checkbox.checked).length;
+    const pluralRules = new Intl.PluralRules(this.localeValue || undefined);
+    const pluralCategory = pluralRules.select(selectedCount);
+    const labelTemplate =
+      this.selectedCountTranslationsValue[pluralCategory] ||
+      this.selectedCountTranslationsValue.other ||
+      "%{count}";
+    const label = labelTemplate.replace("%{count}", selectedCount);
+
+    this.selectedCountTarget.textContent = label;
+  }
+
+  handleSubmitEnd(event) {
+    if (!event.detail.success) return;
+    if (!this.dialogTarget.open) return;
+
+    this.dialogTarget.close();
+  }
+}
diff --git a/app/javascript/controllers/donut_chart_controller.js b/app/javascript/controllers/donut_chart_controller.js
index 216e7d9d6..933c7f2b0 100644
--- a/app/javascript/controllers/donut_chart_controller.js
+++ b/app/javascript/controllers/donut_chart_controller.js
@@ -26,12 +26,14 @@ export default class extends Controller {
     this.#draw();
     document.addEventListener("turbo:load", this.#redraw);
     this.element.addEventListener("mouseleave", this.#clearSegmentHover);
+    this.contentContainerTarget.addEventListener("mouseleave", this.#clearSegmentHover);
   }
 
   disconnect() {
     this.#teardown();
     document.removeEventListener("turbo:load", this.#redraw);
     this.element.removeEventListener("mouseleave", this.#clearSegmentHover);
+    this.contentContainerTarget.removeEventListener("mouseleave", this.#clearSegmentHover);
   }
 
   get #data() {
@@ -151,8 +153,12 @@ export default class extends Controller {
           this.#handleSegmentHover(event);
         }, 10);
       })
-      .on("mouseleave", () => {
+      .on("mouseleave", (event, d) => {
         clearTimeout(hoverTimeout);
+        const leavingUnused = d.data.id === this.unusedSegmentIdValue;
+        if (leavingUnused || !this.contentContainerTarget.contains(event.relatedTarget)) {
+          this.#clearSegmentHover();
+        }
       })
       .on("click", (event, d) => {
         if (this.enableClickValue) {
diff --git a/app/javascript/controllers/exchange_rate_form_controller.js b/app/javascript/controllers/exchange_rate_form_controller.js
new file mode 100644
index 000000000..80126bb20
--- /dev/null
+++ b/app/javascript/controllers/exchange_rate_form_controller.js
@@ -0,0 +1,298 @@
+import { Controller } from "@hotwired/stimulus";
+
+export default class extends Controller {
+  static targets = [
+    "amount",
+    "destinationAmount",
+    "date",
+    "exchangeRateContainer",
+    "exchangeRateField",
+    "convertDestinationDisplay",
+    "calculateRateDisplay"
+  ];
+
+  static values = {
+    exchangeRateUrl: String,
+    accountCurrencies: Object
+  };
+
+  connect() {
+    this.sourceCurrency = null;
+    this.destinationCurrency = null;
+    this.activeTab = "convert";
+
+    if (!this.hasRequiredExchangeRateTargets()) {
+      return;
+    }
+
+    this.checkCurrencyDifference();
+  }
+
+  hasRequiredExchangeRateTargets() {
+    return this.hasDateTarget;
+  }
+
+  checkCurrencyDifference() {
+    const context = this.getExchangeRateContext();
+
+    if (!context) {
+      this.hideExchangeRateField();
+      return;
+    }
+
+    const { fromCurrency, toCurrency, date } = context;
+
+    if (!fromCurrency || !toCurrency) {
+      this.hideExchangeRateField();
+      return;
+    }
+
+    this.sourceCurrency = fromCurrency;
+    this.destinationCurrency = toCurrency;
+
+    if (fromCurrency === toCurrency) {
+      this.hideExchangeRateField();
+      return;
+    }
+
+    this.fetchExchangeRate(fromCurrency, toCurrency, date);
+  }
+
+  onExchangeRateTabClick(event) {
+    const btn = event.target.closest("button[data-id]");
+    if (!btn) {
+      return;
+    }
+
+    const nextTab = btn.dataset.id;
+
+    if (nextTab === this.activeTab) {
+      return;
+    }
+
+    this.activeTab = nextTab;
+
+    if (this.activeTab === "convert") {
+      this.clearCalculateRateFields();
+    } else if (this.activeTab === "calculateRate") {
+      this.clearConvertFields();
+    }
+  }
+
+  onAmountChange() {
+    this.onAmountInputChange();
+  }
+
+  onSourceAmountChange() {
+    this.onAmountInputChange();
+  }
+
+  onAmountInputChange() {
+    if (!this.hasAmountTarget) {
+      return;
+    }
+
+    if (this.activeTab === "convert") {
+      this.calculateConvertDestination();
+    } else {
+      this.calculateRateFromAmounts();
+    }
+  }
+
+  onConvertSourceAmountChange() {
+    this.calculateConvertDestination();
+  }
+
+  onConvertExchangeRateChange() {
+    this.calculateConvertDestination();
+  }
+
+  calculateConvertDestination() {
+    if (!this.hasAmountTarget || !this.hasExchangeRateFieldTarget || !this.hasConvertDestinationDisplayTarget) {
+      return;
+    }
+
+    const amount = Number.parseFloat(this.amountTarget.value);
+    const rate = Number.parseFloat(this.exchangeRateFieldTarget.value);
+
+    if (amount && rate && rate !== 0) {
+      const destAmount = (amount * rate).toFixed(2);
+      this.convertDestinationDisplayTarget.textContent = this.destinationCurrency ? `${destAmount} ${this.destinationCurrency}` : destAmount;
+    } else {
+      this.convertDestinationDisplayTarget.textContent = "-";
+    }
+  }
+
+  onCalculateRateSourceAmountChange() {
+    this.calculateRateFromAmounts();
+  }
+
+  onCalculateRateDestinationAmountChange() {
+    this.calculateRateFromAmounts();
+  }
+
+  calculateRateFromAmounts() {
+    if (!this.hasAmountTarget || !this.hasDestinationAmountTarget || !this.hasCalculateRateDisplayTarget || !this.hasExchangeRateFieldTarget) {
+      return;
+    }
+
+    const amount = Number.parseFloat(this.amountTarget.value);
+    const destAmount = Number.parseFloat(this.destinationAmountTarget.value);
+
+    if (amount && destAmount && amount !== 0) {
+      const rate = destAmount / amount;
+      const formattedRate = this.formatExchangeRate(rate);
+      this.calculateRateDisplayTarget.textContent = formattedRate;
+      this.exchangeRateFieldTarget.value = rate.toFixed(14);
+    } else {
+      this.calculateRateDisplayTarget.textContent = "-";
+      this.exchangeRateFieldTarget.value = "";
+    }
+  }
+
+  formatExchangeRate(rate) {
+    let formattedRate = rate.toFixed(14);
+    formattedRate = formattedRate.replace(/(\.\d{2}\d*?)0+$/, "$1");
+
+    if (!formattedRate.includes(".")) {
+      formattedRate += ".00";
+    } else if (formattedRate.match(/\.\d$/)) {
+      formattedRate += "0";
+    }
+
+    return formattedRate;
+  }
+
+  clearConvertFields() {
+    if (this.hasExchangeRateFieldTarget) {
+      this.exchangeRateFieldTarget.value = "";
+    }
+    if (this.hasConvertDestinationDisplayTarget) {
+      this.convertDestinationDisplayTarget.textContent = "-";
+    }
+  }
+
+  clearCalculateRateFields() {
+    if (this.hasDestinationAmountTarget) {
+      this.destinationAmountTarget.value = "";
+    }
+    if (this.hasCalculateRateDisplayTarget) {
+      this.calculateRateDisplayTarget.textContent = "-";
+    }
+    if (this.hasExchangeRateFieldTarget) {
+      this.exchangeRateFieldTarget.value = "";
+    }
+  }
+
+  async fetchExchangeRate(fromCurrency, toCurrency, date) {
+    if (this.exchangeRateAbortController) {
+      this.exchangeRateAbortController.abort();
+    }
+
+    this.exchangeRateAbortController = new AbortController();
+    const signal = this.exchangeRateAbortController.signal;
+
+    try {
+      const url = new URL(this.exchangeRateUrlValue, window.location.origin);
+      url.searchParams.set("from", fromCurrency);
+      url.searchParams.set("to", toCurrency);
+      if (date) {
+        url.searchParams.set("date", date);
+      }
+
+      const response = await fetch(url, { signal });
+      const data = await response.json();
+
+      if (!this.isCurrentExchangeRateState(fromCurrency, toCurrency, date)) {
+        return;
+      }
+
+      if (!response.ok) {
+        if (this.shouldShowManualExchangeRate(data)) {
+          this.showManualExchangeRateField();
+        } else {
+          this.hideExchangeRateField();
+        }
+        return;
+      }
+
+      if (data.same_currency) {
+        this.hideExchangeRateField();
+      } else {
+        this.sourceCurrency = fromCurrency;
+        this.destinationCurrency = toCurrency;
+        this.showExchangeRateField(data.rate);
+      }
+    } catch (error) {
+      if (error.name === "AbortError") {
+        return;
+      }
+
+      console.error("Error fetching exchange rate:", error);
+      this.hideExchangeRateField();
+    }
+  }
+
+  showExchangeRateField(rate) {
+    if (this.hasExchangeRateFieldTarget) {
+      this.exchangeRateFieldTarget.value = this.formatExchangeRate(rate);
+    }
+    if (this.hasExchangeRateContainerTarget) {
+      this.exchangeRateContainerTarget.classList.remove("hidden");
+    }
+
+    this.calculateConvertDestination();
+  }
+
+  showManualExchangeRateField() {
+    const context = this.getExchangeRateContext();
+    this.sourceCurrency = context?.fromCurrency || null;
+    this.destinationCurrency = context?.toCurrency || null;
+
+    if (this.hasExchangeRateFieldTarget) {
+      this.exchangeRateFieldTarget.value = "";
+    }
+    if (this.hasExchangeRateContainerTarget) {
+      this.exchangeRateContainerTarget.classList.remove("hidden");
+    }
+
+    this.calculateConvertDestination();
+  }
+
+  shouldShowManualExchangeRate(data) {
+    if (!data || typeof data.error !== "string") {
+      return false;
+    }
+
+    return data.error === "Exchange rate not found" || data.error === "Exchange rate unavailable";
+  }
+
+  hideExchangeRateField() {
+    if (this.hasExchangeRateContainerTarget) {
+      this.exchangeRateContainerTarget.classList.add("hidden");
+    }
+    if (this.hasExchangeRateFieldTarget) {
+      this.exchangeRateFieldTarget.value = "";
+    }
+    if (this.hasConvertDestinationDisplayTarget) {
+      this.convertDestinationDisplayTarget.textContent = "-";
+    }
+    if (this.hasCalculateRateDisplayTarget) {
+      this.calculateRateDisplayTarget.textContent = "-";
+    }
+    if (this.hasDestinationAmountTarget) {
+      this.destinationAmountTarget.value = "";
+    }
+
+    this.sourceCurrency = null;
+    this.destinationCurrency = null;
+  }
+
+  getExchangeRateContext() {
+    throw new Error("Subclasses must implement getExchangeRateContext()");
+  }
+
+  isCurrentExchangeRateState(_fromCurrency, _toCurrency, _date) {
+    throw new Error("Subclasses must implement isCurrentExchangeRateState()");
+  }
+}
diff --git a/app/javascript/controllers/form_dropdown_controller.js b/app/javascript/controllers/form_dropdown_controller.js
index d191106f8..a13f22eef 100644
--- a/app/javascript/controllers/form_dropdown_controller.js
+++ b/app/javascript/controllers/form_dropdown_controller.js
@@ -9,6 +9,9 @@ export default class extends Controller {
     const inputEvent = new Event("input", { bubbles: true })
     this.inputTarget.dispatchEvent(inputEvent)
 
+    const changeEvent = new Event("change", { bubbles: true })
+    this.inputTarget.dispatchEvent(changeEvent)
+
     const form = this.element.closest("form")
     const controllers = (form?.dataset.controller || "").split(/\s+/)
     if (form && controllers.includes("auto-submit-form")) {
diff --git a/app/javascript/controllers/password_validator_controller.js b/app/javascript/controllers/password_validator_controller.js
index 4de9c6fd1..76cca812e 100644
--- a/app/javascript/controllers/password_validator_controller.js
+++ b/app/javascript/controllers/password_validator_controller.js
@@ -52,11 +52,11 @@ export default class extends Controller {
     // Update block lines sequentially based on total requirements met
     this.blockLineTargets.forEach((line, index) => {
       if (index < requirementsMet) {
-        line.classList.remove("bg-gray-200");
+        line.classList.remove("bg-surface-inset");
         line.classList.add("bg-green-600");
       } else {
         line.classList.remove("bg-green-600");
-        line.classList.add("bg-gray-200");
+        line.classList.add("bg-surface-inset");
       }
     });
   }
diff --git a/app/javascript/controllers/polling_controller.js b/app/javascript/controllers/polling_controller.js
index 0e9e743f8..8478b2f69 100644
--- a/app/javascript/controllers/polling_controller.js
+++ b/app/javascript/controllers/polling_controller.js
@@ -6,6 +6,7 @@ export default class extends Controller {
   static values = {
     url: String,
     interval: { type: Number, default: 3000 },
+    frameId: String,
   };
 
   connect() {
@@ -33,10 +34,16 @@ export default class extends Controller {
 
   async refresh() {
     try {
+      const frame = this.frameElement();
+      if (!frame) {
+        this.stopPolling();
+        return;
+      }
+
       const response = await fetch(this.urlValue, {
         headers: {
           Accept: "text/html",
-          "Turbo-Frame": this.element.id,
+          "Turbo-Frame": frame.id,
         },
       });
 
@@ -46,13 +53,19 @@ export default class extends Controller {
         template.innerHTML = html;
 
         const newFrame = template.content.querySelector(
-          `turbo-frame#${this.element.id}`,
+          `turbo-frame#${this.cssEscape(frame.id)}`,
         );
         if (newFrame) {
-          this.element.innerHTML = newFrame.innerHTML;
+          if (frame === this.element) {
+            this.syncPollingAttributes(newFrame);
+          }
+          frame.innerHTML = newFrame.innerHTML;
 
           // Check if we should stop polling (no more pending/processing exports)
-          if (!newFrame.hasAttribute("data-polling-url-value")) {
+          if (
+            frame === this.element &&
+            !newFrame.hasAttribute("data-polling-url-value")
+          ) {
             this.stopPolling();
           }
         }
@@ -61,4 +74,41 @@ export default class extends Controller {
       console.error("Polling error:", error);
     }
   }
+
+  frameElement() {
+    if (this.hasFrameIdValue) {
+      return document.getElementById(this.frameIdValue);
+    }
+
+    if (this.element.tagName.toLowerCase() === "turbo-frame") {
+      return this.element;
+    }
+
+    return this.element.closest("turbo-frame");
+  }
+
+  cssEscape(value) {
+    if (window.CSS?.escape) return CSS.escape(value);
+
+    return value.replaceAll('"', '\\"');
+  }
+
+  syncPollingAttributes(newFrame) {
+    const pollingUrl = newFrame.getAttribute("data-polling-url-value");
+    const pollingInterval = newFrame.getAttribute(
+      "data-polling-interval-value",
+    );
+
+    if (pollingUrl) {
+      this.element.setAttribute("data-polling-url-value", pollingUrl);
+    } else {
+      this.element.removeAttribute("data-polling-url-value");
+    }
+
+    if (pollingInterval) {
+      this.element.setAttribute("data-polling-interval-value", pollingInterval);
+    } else {
+      this.element.removeAttribute("data-polling-interval-value");
+    }
+  }
 }
diff --git a/app/javascript/controllers/providers_filter_controller.js b/app/javascript/controllers/providers_filter_controller.js
new file mode 100644
index 000000000..54004b2f6
--- /dev/null
+++ b/app/javascript/controllers/providers_filter_controller.js
@@ -0,0 +1,68 @@
+import { Controller } from "@hotwired/stimulus";
+
+// Connects to data-controller="providers-filter"
+// Filters provider cards by free-text query and a chip-selected kind.
+// Updates the visible-count target on the section heading and toggles
+// an empty-state target when no card matches.
+export default class extends Controller {
+  static targets = ["input", "chip", "card", "empty", "count"];
+  static values = { kind: { type: String, default: "all" } };
+
+  connect() {
+    this.syncChipState();
+  }
+
+  filter() {
+    const query = this.hasInputTarget
+      ? this.inputTarget.value.toLocaleLowerCase().trim()
+      : "";
+    const activeKind = this.kindValue;
+    let visibleCount = 0;
+
+    this.cardTargets.forEach((card) => {
+      const name = card.dataset.providerName ?? "";
+      const region = card.dataset.providerRegion ?? "";
+      const kind = card.dataset.providerKind ?? "";
+      const haystack = `${name} ${region} ${kind}`;
+      const matchesQuery = !query || haystack.includes(query);
+      const matchesKind = activeKind === "all" || kind === activeKind;
+      const visible = matchesQuery && matchesKind;
+      card.classList.toggle("hidden", !visible);
+      if (visible) visibleCount++;
+    });
+
+    if (this.hasCountTarget) {
+      this.countTarget.textContent = visibleCount;
+    }
+
+    if (this.hasEmptyTarget) {
+      this.emptyTarget.classList.toggle("hidden", visibleCount > 0);
+    }
+  }
+
+  selectChip(event) {
+    this.kindValue = event.currentTarget.dataset.kind ?? "all";
+    this.syncChipState();
+    this.filter();
+  }
+
+  clear() {
+    if (this.hasInputTarget) this.inputTarget.value = "";
+    this.kindValue = "all";
+    this.syncChipState();
+    this.filter();
+    if (this.hasInputTarget) this.inputTarget.focus();
+  }
+
+  syncChipState() {
+    if (!this.hasChipTarget) return;
+    this.chipTargets.forEach((chip) => {
+      const active = chip.dataset.kind === this.kindValue;
+      chip.classList.toggle("bg-container", active);
+      chip.classList.toggle("shadow-border-xs", active);
+      chip.classList.toggle("text-primary", active);
+      chip.classList.toggle("text-secondary", !active);
+      chip.setAttribute("aria-pressed", active ? "true" : "false");
+    });
+  }
+}
diff --git a/app/javascript/controllers/sankey_chart_controller.js b/app/javascript/controllers/sankey_chart_controller.js
index 15cbf374b..1af8a25a8 100644
--- a/app/javascript/controllers/sankey_chart_controller.js
+++ b/app/javascript/controllers/sankey_chart_controller.js
@@ -1,14 +1,17 @@
 import { Controller } from "@hotwired/stimulus";
 import * as d3 from "d3";
 import { sankey } from "d3-sankey";
+import { sankeyNodeHasChildren, zoomSankeyData } from "utils/sankey_zoom";
 
 // Connects to data-controller="sankey-chart"
 export default class extends Controller {
+  static targets = ["chart", "zoomOutButton"];
+
   static values = {
     data: Object,
     nodeWidth: { type: Number, default: 15 },
     nodePadding: { type: Number, default: 20 },
-    currencySymbol: { type: String, default: "$" }
+    currencySymbol: { type: String, default: "$" },
   };
 
   // Visual constants
@@ -18,64 +21,158 @@ export default class extends Controller {
   static MIN_NODE_PADDING = 4;
   static MAX_PADDING_RATIO = 0.4;
   static CORNER_RADIUS = 8;
+  static ZOOM_TRANSITION_MS = 220;
   static DEFAULT_COLOR = "var(--color-gray-400)";
   static CSS_VAR_MAP = {
     "var(--color-success)": "#10A861",
     "var(--color-destructive)": "#EC2222",
     "var(--color-gray-400)": "#9E9E9E",
-    "var(--color-gray-500)": "#737373"
+    "var(--color-gray-500)": "#737373",
   };
   static MIN_LABEL_SPACING = 28; // Minimum vertical space needed for labels (2 lines)
 
   connect() {
+    this.connected = true;
+    this.zoomRootId = null;
     this.resizeObserver = new ResizeObserver(() => this.#draw());
-    this.resizeObserver.observe(this.element);
+    this.resizeObserver.observe(this.#chartElement());
     this.tooltip = null;
     this.#createTooltip();
+    this.#syncZoomControls();
+    this.#draw();
+  }
+
+  dataValueChanged() {
+    if (!this.connected) return;
+
+    this.zoomRootId = null;
+    this.#syncZoomControls();
     this.#draw();
   }
 
   disconnect() {
+    this.connected = false;
     this.resizeObserver?.disconnect();
+    clearTimeout(this.drawTimeout);
     this.tooltip?.remove();
     this.tooltip = null;
   }
 
-  #draw() {
-    const { nodes = [], links = [] } = this.dataValue || {};
+  zoomOut() {
+    if (!this.zoomRootId) return;
+
+    this.zoomRootId = null;
+    this.#syncZoomControls();
+    this.#draw({ animate: true });
+  }
+
+  #draw({ animate = false } = {}) {
+    const { nodes = [], links = [] } = this.#visibleData();
     if (!nodes.length || !links.length) return;
 
     // Hide tooltip and reset any hover states before redrawing
     this.#hideTooltip();
 
-    d3.select(this.element).selectAll("svg").remove();
+    const chartElement = this.#chartElement();
+    const chart = d3.select(chartElement);
 
-    const width = this.element.clientWidth || 600;
-    const height = this.element.clientHeight || 400;
+    clearTimeout(this.drawTimeout);
+    chart.selectAll("svg").interrupt();
 
-    const svg = d3.select(this.element)
+    if (animate) {
+      chart
+        .selectAll("svg")
+        .transition()
+        .duration(this.constructor.ZOOM_TRANSITION_MS / 2)
+        .style("opacity", 0)
+        .remove();
+
+      this.drawTimeout = setTimeout(() => {
+        this.#render(nodes, links, true);
+      }, this.constructor.ZOOM_TRANSITION_MS / 2);
+    } else {
+      chart.selectAll("svg").remove();
+      this.#render(nodes, links, false);
+    }
+  }
+
+  #render(nodes, links, animate) {
+    const chartElement = this.#chartElement();
+    const chart = d3.select(chartElement);
+
+    const width = chartElement.clientWidth || 600;
+    const height = chartElement.clientHeight || 400;
+
+    const svg = chart
       .append("svg")
       .attr("width", width)
-      .attr("height", height);
+      .attr("height", height)
+      .style("opacity", animate ? 0 : 1);
 
     const effectivePadding = this.#calculateNodePadding(nodes.length, height);
-    const sankeyData = this.#generateSankeyData(nodes, links, width, height, effectivePadding);
+    const sankeyData = this.#generateSankeyData(
+      nodes,
+      links,
+      width,
+      height,
+      effectivePadding,
+    );
 
     this.#createGradients(svg, sankeyData.links);
 
     const linkPaths = this.#drawLinks(svg, sankeyData.links);
-    const { nodeGroups, hiddenLabels } = this.#drawNodes(svg, sankeyData.nodes, width);
+    const { nodeGroups, hiddenLabels } = this.#drawNodes(
+      svg,
+      sankeyData.nodes,
+      width,
+    );
 
     this.#attachHoverEvents(linkPaths, nodeGroups, sankeyData, hiddenLabels);
+
+    if (animate) {
+      svg
+        .transition()
+        .duration(this.constructor.ZOOM_TRANSITION_MS / 2)
+        .style("opacity", 1);
+    }
+  }
+
+  #chartElement() {
+    return this.hasChartTarget ? this.chartTarget : this.element;
+  }
+
+  #visibleData() {
+    if (!this.zoomRootId) return this.dataValue || {};
+
+    return zoomSankeyData(this.dataValue, this.zoomRootId);
+  }
+
+  #syncZoomControls() {
+    this.zoomOutButtonTargets.forEach((button) => {
+      button.hidden = !this.zoomRootId;
+    });
+  }
+
+  #zoomIn(node) {
+    if (!node.id || !sankeyNodeHasChildren(this.#visibleData(), node.id))
+      return;
+
+    this.zoomRootId = node.id;
+    this.#syncZoomControls();
+    this.#draw({ animate: true });
   }
 
   // Dynamic padding prevents padding from dominating when there are many nodes
   #calculateNodePadding(nodeCount, height) {
     const margin = this.constructor.EXTENT_MARGIN;
-    const availableHeight = height - (margin * 2);
-    const maxPaddingTotal = availableHeight * this.constructor.MAX_PADDING_RATIO;
+    const availableHeight = height - margin * 2;
+    const maxPaddingTotal =
+      availableHeight * this.constructor.MAX_PADDING_RATIO;
     const gaps = Math.max(nodeCount - 1, 1);
-    const dynamicPadding = Math.min(this.nodePaddingValue, Math.floor(maxPaddingTotal / gaps));
+    const dynamicPadding = Math.min(
+      this.nodePaddingValue,
+      Math.floor(maxPaddingTotal / gaps),
+    );
     return Math.max(this.constructor.MIN_NODE_PADDING, dynamicPadding);
   }
 
@@ -84,11 +181,14 @@ export default class extends Controller {
     const sankeyGenerator = sankey()
       .nodeWidth(this.nodeWidthValue)
       .nodePadding(nodePadding)
-      .extent([[margin, margin], [width - margin, height - margin]]);
+      .extent([
+        [margin, margin],
+        [width - margin, height - margin],
+      ]);
 
     return sankeyGenerator({
-      nodes: nodes.map(d => ({ ...d })),
-      links: links.map(d => ({ ...d })),
+      nodes: nodes.map((d) => ({ ...d })),
+      links: links.map((d) => ({ ...d })),
     });
   }
 
@@ -97,17 +197,20 @@ export default class extends Controller {
 
     links.forEach((link, i) => {
       const gradientId = this.#gradientId(link, i);
-      const gradient = defs.append("linearGradient")
+      const gradient = defs
+        .append("linearGradient")
         .attr("id", gradientId)
         .attr("gradientUnits", "userSpaceOnUse")
         .attr("x1", link.source.x1)
         .attr("x2", link.target.x0);
 
-      gradient.append("stop")
+      gradient
+        .append("stop")
         .attr("offset", "0%")
         .attr("stop-color", this.#colorWithOpacity(link.source.color));
 
-      gradient.append("stop")
+      gradient
+        .append("stop")
         .attr("offset", "100%")
         .attr("stop-color", this.#colorWithOpacity(link.target.color));
     });
@@ -132,32 +235,37 @@ export default class extends Controller {
   }
 
   #drawLinks(svg, links) {
-    return svg.append("g")
+    return svg
+      .append("g")
       .attr("fill", "none")
       .selectAll("path")
       .data(links)
       .join("path")
       .attr("class", "sankey-link")
-      .attr("d", d => d3.linkHorizontal()({
-        source: [d.source.x1, d.y0],
-        target: [d.target.x0, d.y1]
-      }))
+      .attr("d", (d) =>
+        d3.linkHorizontal()({
+          source: [d.source.x1, d.y0],
+          target: [d.target.x0, d.y1],
+        }),
+      )
       .attr("stroke", (d, i) => `url(#${this.#gradientId(d, i)})`)
-      .attr("stroke-width", d => Math.max(1, d.width))
+      .attr("stroke-width", (d) => Math.max(1, d.width))
       .style("transition", "opacity 0.3s ease");
   }
 
   #drawNodes(svg, nodes, width) {
-    const nodeGroups = svg.append("g")
+    const nodeGroups = svg
+      .append("g")
       .selectAll("g")
       .data(nodes)
       .join("g")
       .style("transition", "opacity 0.3s ease");
 
-    nodeGroups.append("path")
-      .attr("d", d => this.#nodePath(d))
-      .attr("fill", d => d.color || this.constructor.DEFAULT_COLOR)
-      .attr("stroke", d => d.color ? "none" : "var(--color-gray-500)");
+    nodeGroups
+      .append("path")
+      .attr("d", (d) => this.#nodePath(d))
+      .attr("fill", (d) => d.color || this.constructor.DEFAULT_COLOR)
+      .attr("stroke", (d) => (d.color ? "none" : "var(--color-gray-500)"));
 
     const hiddenLabels = this.#addNodeLabels(nodeGroups, width, nodes);
 
@@ -167,10 +275,15 @@ export default class extends Controller {
   #nodePath(node) {
     const { x0, y0, x1, y1 } = node;
     const height = y1 - y0;
-    const radius = Math.max(0, Math.min(this.constructor.CORNER_RADIUS, height / 2));
+    const radius = Math.max(
+      0,
+      Math.min(this.constructor.CORNER_RADIUS, height / 2),
+    );
 
-    const isSourceNode = node.sourceLinks?.length > 0 && !node.targetLinks?.length;
-    const isTargetNode = node.targetLinks?.length > 0 && !node.sourceLinks?.length;
+    const isSourceNode =
+      node.sourceLinks?.length > 0 && !node.targetLinks?.length;
+    const isTargetNode =
+      node.targetLinks?.length > 0 && !node.sourceLinks?.length;
 
     // Too small for rounded corners
     if (height < radius * 2) {
@@ -215,14 +328,18 @@ export default class extends Controller {
     const controller = this;
     const hiddenLabels = this.#calculateHiddenLabels(nodes);
 
-    nodeGroups.append("text")
-      .attr("x", d => d.x0 < width / 2 ? d.x1 + 6 : d.x0 - 6)
-      .attr("y", d => (d.y1 + d.y0) / 2)
+    nodeGroups
+      .append("text")
+      .attr("x", (d) => (d.x0 < width / 2 ? d.x1 + 6 : d.x0 - 6))
+      .attr("y", (d) => (d.y1 + d.y0) / 2)
       .attr("dy", "-0.2em")
-      .attr("text-anchor", d => d.x0 < width / 2 ? "start" : "end")
-      .attr("class", "text-xs font-medium text-primary fill-current select-none")
+      .attr("text-anchor", (d) => (d.x0 < width / 2 ? "start" : "end"))
+      .attr(
+        "class",
+        "text-xs font-medium text-primary fill-current select-none",
+      )
       .style("cursor", "default")
-      .style("opacity", d => hiddenLabels.has(d.index) ? 0 : 1)
+      .style("opacity", (d) => (hiddenLabels.has(d.index) ? 0 : 1))
       .style("transition", "opacity 0.2s ease")
       .each(function (d) {
         const textEl = d3.select(this);
@@ -230,7 +347,8 @@ export default class extends Controller {
 
         textEl.append("tspan").text(d.name);
 
-        textEl.append("tspan")
+        textEl
+          .append("tspan")
           .attr("x", textEl.attr("x"))
           .attr("dy", "1.2em")
           .attr("class", "font-mono text-secondary")
@@ -244,26 +362,28 @@ export default class extends Controller {
   // Calculate which labels should be hidden to prevent overlap
   #calculateHiddenLabels(nodes) {
     const hiddenLabels = new Set();
-    const height = this.element.clientHeight || 400;
+    const height = this.#chartElement().clientHeight || 400;
     const isLargeGraph = height > 600;
-    const minSpacing = isLargeGraph ? this.constructor.MIN_LABEL_SPACING * 0.7 : this.constructor.MIN_LABEL_SPACING;
+    const minSpacing = isLargeGraph
+      ? this.constructor.MIN_LABEL_SPACING * 0.7
+      : this.constructor.MIN_LABEL_SPACING;
 
     // Group nodes by column (using depth which d3-sankey assigns)
     const columns = new Map();
-    nodes.forEach(node => {
+    nodes.forEach((node) => {
       const depth = node.depth;
       if (!columns.has(depth)) columns.set(depth, []);
       columns.get(depth).push(node);
     });
 
     // For each column, check for overlapping labels
-    columns.forEach(columnNodes => {
+    columns.forEach((columnNodes) => {
       // Sort by vertical position
-      columnNodes.sort((a, b) => ((a.y0 + a.y1) / 2) - ((b.y0 + b.y1) / 2));
+      columnNodes.sort((a, b) => (a.y0 + a.y1) / 2 - (b.y0 + b.y1) / 2);
 
       let lastVisibleY = Number.NEGATIVE_INFINITY;
 
-      columnNodes.forEach(node => {
+      columnNodes.forEach((node) => {
         const nodeY = (node.y0 + node.y1) / 2;
         const nodeHeight = node.y1 - node.y0;
 
@@ -284,25 +404,41 @@ export default class extends Controller {
   #attachHoverEvents(linkPaths, nodeGroups, sankeyData, hiddenLabels) {
     const applyHover = (targetLinks) => {
       const targetSet = new Set(targetLinks);
-      const connectedNodes = new Set(targetLinks.flatMap(l => [l.source, l.target]));
+      const connectedNodes = new Set(
+        targetLinks.flatMap((l) => [l.source, l.target]),
+      );
 
       linkPaths
-        .style("opacity", d => targetSet.has(d) ? 1 : this.constructor.HOVER_OPACITY)
-        .style("filter", d => targetSet.has(d) ? this.constructor.HOVER_FILTER : "none");
+        .style("opacity", (d) =>
+          targetSet.has(d) ? 1 : this.constructor.HOVER_OPACITY,
+        )
+        .style("filter", (d) =>
+          targetSet.has(d) ? this.constructor.HOVER_FILTER : "none",
+        );
 
-      nodeGroups.style("opacity", d => connectedNodes.has(d) ? 1 : this.constructor.HOVER_OPACITY);
+      nodeGroups.style("opacity", (d) =>
+        connectedNodes.has(d) ? 1 : this.constructor.HOVER_OPACITY,
+      );
 
       // Show labels for connected nodes (even if normally hidden)
-      nodeGroups.selectAll("text")
-        .style("opacity", d => connectedNodes.has(d) ? 1 : (hiddenLabels.has(d.index) ? 0 : this.constructor.HOVER_OPACITY));
+      nodeGroups
+        .selectAll("text")
+        .style("opacity", (d) =>
+          connectedNodes.has(d)
+            ? 1
+            : hiddenLabels.has(d.index)
+              ? 0
+              : this.constructor.HOVER_OPACITY,
+        );
     };
 
     const resetHover = () => {
       linkPaths.style("opacity", 1).style("filter", "none");
       nodeGroups.style("opacity", 1);
       // Restore hidden labels to hidden state
-      nodeGroups.selectAll("text")
-        .style("opacity", d => hiddenLabels.has(d.index) ? 0 : 1);
+      nodeGroups
+        .selectAll("text")
+        .style("opacity", (d) => (hiddenLabels.has(d.index) ? 0 : 1));
     };
 
     linkPaths
@@ -310,33 +446,56 @@ export default class extends Controller {
         applyHover([d]);
         this.#showTooltip(event, d.value, d.percentage);
       })
-      .on("mousemove", event => this.#updateTooltipPosition(event))
+      .on("mousemove", (event) => this.#updateTooltipPosition(event))
       .on("mouseleave", () => {
         resetHover();
         this.#hideTooltip();
       });
 
     // Hover on node rectangles (not just text)
-    nodeGroups.selectAll("path")
-      .style("cursor", "default")
+    nodeGroups
+      .selectAll("path")
+      .style("cursor", (d) =>
+        sankeyNodeHasChildren(this.#visibleData(), d.id)
+          ? "pointer"
+          : "default",
+      )
       .on("mouseenter", (event, d) => {
-        const connectedLinks = sankeyData.links.filter(l => l.source === d || l.target === d);
+        const connectedLinks = sankeyData.links.filter(
+          (l) => l.source === d || l.target === d,
+        );
         applyHover(connectedLinks);
         this.#showTooltip(event, d.value, d.percentage, d.name);
       })
-      .on("mousemove", event => this.#updateTooltipPosition(event))
+      .on("mousemove", (event) => this.#updateTooltipPosition(event))
+      .on("click", (event, d) => {
+        event.stopPropagation();
+        this.#zoomIn(d);
+      })
       .on("mouseleave", () => {
         resetHover();
         this.#hideTooltip();
       });
 
-    nodeGroups.selectAll("text")
+    nodeGroups
+      .selectAll("text")
+      .style("cursor", (d) =>
+        sankeyNodeHasChildren(this.#visibleData(), d.id)
+          ? "pointer"
+          : "default",
+      )
       .on("mouseenter", (event, d) => {
-        const connectedLinks = sankeyData.links.filter(l => l.source === d || l.target === d);
+        const connectedLinks = sankeyData.links.filter(
+          (l) => l.source === d || l.target === d,
+        );
         applyHover(connectedLinks);
         this.#showTooltip(event, d.value, d.percentage, d.name);
       })
-      .on("mousemove", event => this.#updateTooltipPosition(event))
+      .on("mousemove", (event) => this.#updateTooltipPosition(event))
+      .on("click", (event, d) => {
+        event.stopPropagation();
+        this.#zoomIn(d);
+      })
       .on("mouseleave", () => {
         resetHover();
         this.#hideTooltip();
@@ -347,9 +506,13 @@ export default class extends Controller {
 
   #createTooltip() {
     const dialog = this.element.closest("dialog");
-    this.tooltip = d3.select(dialog || document.body)
+    this.tooltip = d3
+      .select(dialog || document.body)
       .append("div")
-      .attr("class", "bg-gray-700 text-white text-sm p-2 rounded pointer-events-none absolute z-50 top-0")
+      .attr(
+        "class",
+        "bg-gray-700 text-white text-sm p-2 rounded pointer-events-none absolute z-50 top-0",
+      )
       .style("opacity", 0)
       .style("pointer-events", "none");
   }
@@ -381,9 +544,7 @@ export default class extends Controller {
       const x = isInDialog ? event.clientX : event.pageX;
       const y = isInDialog ? event.clientY : event.pageY;
 
-      this.tooltip
-        ?.style("left", `${x + 10}px`)
-        .style("top", `${y - 10}px`);
+      this.tooltip?.style("left", `${x + 10}px`).style("top", `${y - 10}px`);
     }
   }
 
@@ -400,7 +561,7 @@ export default class extends Controller {
   #formatCurrency(value) {
     const formatted = Number.parseFloat(value).toLocaleString(undefined, {
       minimumFractionDigits: 2,
-      maximumFractionDigits: 2
+      maximumFractionDigits: 2,
     });
     return this.currencySymbolValue + formatted;
   }
diff --git a/app/javascript/controllers/select_controller.js b/app/javascript/controllers/select_controller.js
index 23b56051d..19b44bb64 100644
--- a/app/javascript/controllers/select_controller.js
+++ b/app/javascript/controllers/select_controller.js
@@ -2,9 +2,9 @@ import { Controller } from "@hotwired/stimulus"
 import { autoUpdate } from "@floating-ui/dom"
 
 export default class extends Controller {
-  static targets = ["button", "menu", "input"]
+  static targets = ["button", "menu", "input", "content", "option"]
   static values = {
-    placement: { type: String, default: "bottom-start" },
+    menuPlacement: { type: String, default: "auto" },
     offset: { type: Number, default: 6 }
   }
 
@@ -70,12 +70,14 @@ export default class extends Controller {
     const previousSelected = this.menuTarget.querySelector("[aria-selected='true']")
     if (previousSelected) {
       previousSelected.setAttribute("aria-selected", "false")
+      previousSelected.setAttribute("tabindex", "-1")
       previousSelected.classList.remove("bg-container-inset")
       const prevIcon = previousSelected.querySelector(".check-icon")
       if (prevIcon) prevIcon.classList.add("hidden")
     }
 
     selectedElement.setAttribute("aria-selected", "true")
+    selectedElement.setAttribute("tabindex", "0")
     selectedElement.classList.add("bg-container-inset")
     const selectedIcon = selectedElement.querySelector(".check-icon")
     if (selectedIcon) selectedIcon.classList.remove("hidden")
@@ -103,7 +105,25 @@ export default class extends Controller {
 
   scrollToSelected() {
     const selected = this.menuTarget.querySelector(".bg-container-inset")
-    if (selected) selected.scrollIntoView({ block: "center" })
+    if (!selected) return
+
+    const container = this.hasContentTarget ? this.contentTarget : this.menuTarget
+    const containerRect = container.getBoundingClientRect()
+    const selectedRect = selected.getBoundingClientRect()
+    const delta = selectedRect.top - containerRect.top - (container.clientHeight - selectedRect.height) / 2
+
+    const nextScrollTop = container.scrollTop + delta
+    const maxScrollTop = Math.max(0, container.scrollHeight - container.clientHeight)
+    container.scrollTop = this.clamp(nextScrollTop, 0, maxScrollTop)
+  }
+
+  clamp(value, min, max) {
+    return Math.min(max, Math.max(min, value))
+  }
+
+  placementMode() {
+    const mode = (this.menuPlacementValue || "auto").toLowerCase()
+    return ["auto", "down", "up"].includes(mode) ? mode : "auto"
   }
 
   handleOutsideClick(event) {
@@ -112,8 +132,66 @@ export default class extends Controller {
 
   handleKeydown(event) {
     if (!this.isOpen) return
-    if (event.key === "Escape") { this.close(); this.buttonTarget.focus() }
-    if (event.key === "Enter" && event.target.dataset.value) { event.preventDefault(); event.target.click() }
+    if (event.key === "Escape") { this.close(); this.buttonTarget.focus(); return }
+    if (event.key === "Enter" && event.target.dataset.value) { event.preventDefault(); event.target.click(); return }
+
+    // WAI-ARIA APG listbox keyboard pattern: ArrowUp/Down moves focus
+    // between options (roving tabindex), Home/End jump to first/last.
+    // From the search input, ArrowDown/Up bridge into the visible
+    // options so users can reach the filtered matches; other keys
+    // (typing, caret movement) stay with the input.
+    const fromSearch = event.target.matches('input[type="search"]')
+    const visibleOptions = this.visibleOptions()
+    if (fromSearch) {
+      if (event.key !== "ArrowDown" && event.key !== "ArrowUp") return
+      if (visibleOptions.length === 0) return
+      event.preventDefault()
+      const targetIndex = event.key === "ArrowDown" ? 0 : visibleOptions.length - 1
+      this.rovingFocus(visibleOptions, targetIndex)
+      return
+    }
+
+    if (visibleOptions.length === 0) return
+    const currentIndex = visibleOptions.indexOf(event.target)
+    let nextIndex = null
+    switch (event.key) {
+      case "ArrowDown": nextIndex = currentIndex < 0 ? 0 : (currentIndex + 1) % visibleOptions.length; break
+      case "ArrowUp": nextIndex = currentIndex < 0 ? visibleOptions.length - 1 : (currentIndex - 1 + visibleOptions.length) % visibleOptions.length; break
+      case "Home": nextIndex = 0; break
+      case "End": nextIndex = visibleOptions.length - 1; break
+      default: return
+    }
+    event.preventDefault()
+    this.rovingFocus(visibleOptions, nextIndex)
+  }
+
+  // Roving tabindex helper: makes the target option tabbable (and
+  // focuses it), clears tabindex on every other option in the listbox.
+  rovingFocus(visibleOptions, index) {
+    const all = this.hasOptionTarget ? this.optionTargets : []
+    const target = visibleOptions[index]
+    all.forEach(opt => opt.setAttribute("tabindex", opt === target ? "0" : "-1"))
+    target.focus()
+  }
+
+  // Options the user can currently see — list-filter hides non-matches
+  // by setting `style.display = "none"`. Inline check keeps it cheap.
+  visibleOptions() {
+    const options = this.hasOptionTarget ? this.optionTargets : []
+    return options.filter(opt => opt.style.display !== "none")
+  }
+
+  // After list-filter#filter runs, the option holding tabindex="0" may
+  // be hidden. Promote the first visible option so Tab from the search
+  // input still lands somewhere reachable; if none match, no-op.
+  syncTabindex() {
+    const visible = this.visibleOptions()
+    if (visible.length === 0) return
+    const tabbable = visible.find(opt => opt.getAttribute("tabindex") === "0")
+    if (tabbable) return
+    const all = this.hasOptionTarget ? this.optionTargets : []
+    all.forEach(opt => opt.setAttribute("tabindex", "-1"))
+    visible[0].setAttribute("tabindex", "0")
   }
 
   handleTurboLoad() { if (this.isOpen) this.close() }
@@ -163,7 +241,8 @@ export default class extends Controller {
 
     const spaceBelow = containerRect.bottom - buttonRect.bottom
     const spaceAbove = buttonRect.top - containerRect.top
-    const shouldOpenUp = spaceBelow < menuHeight && spaceAbove > spaceBelow
+    const placement = this.placementMode()
+    const shouldOpenUp = placement === "up" || (placement === "auto" && spaceBelow < menuHeight && spaceAbove > spaceBelow)
 
     this.menuTarget.style.left = "0"
     this.menuTarget.style.width = "100%"
diff --git a/app/javascript/controllers/theme_controller.js b/app/javascript/controllers/theme_controller.js
index 361ae95ed..ff64fd41c 100644
--- a/app/javascript/controllers/theme_controller.js
+++ b/app/javascript/controllers/theme_controller.js
@@ -39,15 +39,15 @@ export default class extends Controller {
     }
   }
 
-  // Sets or removes the data-theme attribute
+  // Sets the data-theme attribute and broadcasts a `theme:change` event so
+  // imperative consumers (D3/SVG/canvas) can repaint without polling.
   setTheme(isDark) {
-    if (isDark) {
-      localStorage.theme = "dark";
-      document.documentElement.setAttribute("data-theme", "dark");
-    } else {
-      localStorage.theme = "light";
-      document.documentElement.setAttribute("data-theme", "light");
-    }
+    const theme = isDark ? "dark" : "light";
+    localStorage.theme = theme;
+    document.documentElement.setAttribute("data-theme", theme);
+    document.documentElement.dispatchEvent(
+      new CustomEvent("theme:change", { detail: { theme } }),
+    );
   }
 
   systemPrefersDark() {
diff --git a/app/javascript/controllers/time_series_chart_controller.js b/app/javascript/controllers/time_series_chart_controller.js
index 4344bf59a..d4f4988af 100644
--- a/app/javascript/controllers/time_series_chart_controller.js
+++ b/app/javascript/controllers/time_series_chart_controller.js
@@ -110,7 +110,7 @@ export default class extends Controller {
       .attr("cx", this._d3InitialContainerWidth / 2)
       .attr("cy", this._d3InitialContainerHeight / 2)
       .attr("r", 4)
-      .attr("class", "fg-subdued")
+      .attr("class", "text-subdued")
       .style("fill", "currentColor");
   }
 
@@ -220,7 +220,7 @@ export default class extends Controller {
     // Style ticks
     this._d3Group
       .selectAll(".tick text")
-      .attr("class", "fg-gray")
+      .attr("class", "text-secondary")
       .style("font-size", "12px")
       .style("font-weight", "500")
       .attr("text-anchor", "middle")
@@ -289,7 +289,7 @@ export default class extends Controller {
       .append("div")
       .attr(
         "class",
-        "bg-container text-sm font-sans absolute p-2 border border-secondary rounded-lg pointer-events-none opacity-0 top-0",
+        "bg-container text-sm font-sans absolute p-2 border border-secondary rounded-lg pointer-events-none opacity-0 top-0 privacy-sensitive",
       );
   }
 
@@ -334,7 +334,7 @@ export default class extends Controller {
         // Guideline
         this._d3Group
           .append("line")
-          .attr("class", "guideline fg-subdued")
+          .attr("class", "guideline text-subdued")
           .attr("x1", this._d3XScale(d.date))
           .attr("y1", 0)
           .attr("x2", this._d3XScale(d.date))
diff --git a/app/javascript/controllers/transaction_form_controller.js b/app/javascript/controllers/transaction_form_controller.js
new file mode 100644
index 000000000..739b923da
--- /dev/null
+++ b/app/javascript/controllers/transaction_form_controller.js
@@ -0,0 +1,60 @@
+import ExchangeRateFormController from "controllers/exchange_rate_form_controller";
+
+// Connects to data-controller="transaction-form"
+export default class extends ExchangeRateFormController {
+  static targets = [
+    ...ExchangeRateFormController.targets,
+    "account",
+    "currency"
+  ];
+
+  hasRequiredExchangeRateTargets() {
+    if (!this.hasAccountTarget || !this.hasCurrencyTarget || !this.hasDateTarget) {
+      return false;
+    }
+
+    return true;
+  }
+
+  getExchangeRateContext() {
+    if (!this.hasRequiredExchangeRateTargets()) {
+      return null;
+    }
+
+    const accountId = this.accountTarget.value;
+    const currency = this.currencyTarget.value;
+    const date = this.dateTarget.value;
+
+    if (!accountId || !currency) {
+      return null;
+    }
+
+    const accountCurrency = this.accountCurrenciesValue[accountId];
+    if (!accountCurrency) {
+      return null;
+    }
+
+    return {
+      fromCurrency: currency,
+      toCurrency: accountCurrency,
+      date
+    };
+  }
+
+  isCurrentExchangeRateState(fromCurrency, toCurrency, date) {
+    if (!this.hasRequiredExchangeRateTargets()) {
+      return false;
+    }
+
+    const currentAccountId = this.accountTarget.value;
+    const currentCurrency = this.currencyTarget.value;
+    const currentDate = this.dateTarget.value;
+    const currentAccountCurrency = this.accountCurrenciesValue[currentAccountId];
+
+    return fromCurrency === currentCurrency && toCurrency === currentAccountCurrency && date === currentDate;
+  }
+
+  onCurrencyChange() {
+    this.checkCurrencyDifference();
+  }
+}
diff --git a/app/javascript/controllers/transaction_type_tabs_controller.js b/app/javascript/controllers/transaction_type_tabs_controller.js
new file mode 100644
index 000000000..e347121de
--- /dev/null
+++ b/app/javascript/controllers/transaction_type_tabs_controller.js
@@ -0,0 +1,21 @@
+import { Controller } from "@hotwired/stimulus"
+
+const ACTIVE_CLASSES = ["bg-container", "text-primary", "shadow-sm"]
+const INACTIVE_CLASSES = ["hover:bg-container", "text-subdued", "hover:text-primary", "hover:shadow-sm"]
+
+export default class extends Controller {
+  static targets = ["tab", "natureField"]
+
+  selectTab(event) {
+    event.preventDefault()
+
+    const selectedTab = event.currentTarget
+    this.natureFieldTarget.value = selectedTab.dataset.nature
+
+    this.tabTargets.forEach(tab => {
+      const isActive = tab === selectedTab
+      tab.classList.remove(...(isActive ? INACTIVE_CLASSES : ACTIVE_CLASSES))
+      tab.classList.add(...(isActive ? ACTIVE_CLASSES : INACTIVE_CLASSES))
+    })
+  }
+}
diff --git a/app/javascript/controllers/transfer_form_controller.js b/app/javascript/controllers/transfer_form_controller.js
new file mode 100644
index 000000000..e8d17437c
--- /dev/null
+++ b/app/javascript/controllers/transfer_form_controller.js
@@ -0,0 +1,59 @@
+import ExchangeRateFormController from "controllers/exchange_rate_form_controller";
+
+// Connects to data-controller="transfer-form"
+export default class extends ExchangeRateFormController {
+  static targets = [
+    ...ExchangeRateFormController.targets,
+    "fromAccount",
+    "toAccount"
+  ];
+
+  hasRequiredExchangeRateTargets() {
+    if (!this.hasFromAccountTarget || !this.hasToAccountTarget || !this.hasDateTarget) {
+      return false;
+    }
+
+    return true;
+  }
+
+  getExchangeRateContext() {
+    if (!this.hasRequiredExchangeRateTargets()) {
+      return null;
+    }
+
+    const fromAccountId = this.fromAccountTarget.value;
+    const toAccountId = this.toAccountTarget.value;
+    const date = this.dateTarget.value;
+
+    if (!fromAccountId || !toAccountId) {
+      return null;
+    }
+
+    const fromCurrency = this.accountCurrenciesValue[fromAccountId];
+    const toCurrency = this.accountCurrenciesValue[toAccountId];
+
+    if (!fromCurrency || !toCurrency) {
+      return null;
+    }
+
+    return {
+      fromCurrency,
+      toCurrency,
+      date
+    };
+  }
+
+  isCurrentExchangeRateState(fromCurrency, toCurrency, date) {
+    if (!this.hasRequiredExchangeRateTargets()) {
+      return false;
+    }
+
+    const currentFromAccountId = this.fromAccountTarget.value;
+    const currentToAccountId = this.toAccountTarget.value;
+    const currentFromCurrency = this.accountCurrenciesValue[currentFromAccountId];
+    const currentToCurrency = this.accountCurrenciesValue[currentToAccountId];
+    const currentDate = this.dateTarget.value;
+
+    return fromCurrency === currentFromCurrency && toCurrency === currentToCurrency && date === currentDate;
+  }
+}
diff --git a/app/javascript/controllers/webauthn_authentication_controller.js b/app/javascript/controllers/webauthn_authentication_controller.js
new file mode 100644
index 000000000..d4c141307
--- /dev/null
+++ b/app/javascript/controllers/webauthn_authentication_controller.js
@@ -0,0 +1,62 @@
+import WebauthnController from "controllers/webauthn_controller";
+import {
+  prepareCredentialRequestOptions,
+  serializePublicKeyCredential,
+} from "utils/webauthn";
+
+export default class extends WebauthnController {
+  static targets = ["error"];
+  static values = {
+    optionsUrl: String,
+    verifyUrl: String,
+    unsupportedMessage: String,
+    errorFallback: String,
+  };
+
+  async authenticate(event) {
+    event.preventDefault();
+    this.clearError();
+
+    if (!window.PublicKeyCredential) {
+      this.showError(this.unsupportedMessageValue);
+      return;
+    }
+
+    try {
+      const options = await this.fetchOptions();
+      const credential = await navigator.credentials.get({
+        publicKey: prepareCredentialRequestOptions(options),
+      });
+
+      await this.verifyCredential(serializePublicKeyCredential(credential));
+    } catch (error) {
+      this.showError(error.message);
+    }
+  }
+
+  async fetchOptions() {
+    const response = await fetch(this.optionsUrlValue, {
+      method: "POST",
+      headers: this.headers,
+      credentials: "same-origin",
+    });
+
+    if (!response.ok) throw new Error(await this.errorMessage(response));
+
+    return response.json();
+  }
+
+  async verifyCredential(credential) {
+    const response = await fetch(this.verifyUrlValue, {
+      method: "POST",
+      headers: this.headers,
+      credentials: "same-origin",
+      body: JSON.stringify({ credential }),
+    });
+
+    if (!response.ok) throw new Error(await this.errorMessage(response));
+
+    const result = await response.json();
+    window.location.href = result.redirect_url;
+  }
+}
diff --git a/app/javascript/controllers/webauthn_controller.js b/app/javascript/controllers/webauthn_controller.js
new file mode 100644
index 000000000..f421451ec
--- /dev/null
+++ b/app/javascript/controllers/webauthn_controller.js
@@ -0,0 +1,39 @@
+import { Controller } from "@hotwired/stimulus";
+
+export default class extends Controller {
+  get headers() {
+    return {
+      Accept: "application/json",
+      "Content-Type": "application/json",
+      "X-CSRF-Token": document.querySelector("meta[name='csrf-token']")
+        ?.content,
+    };
+  }
+
+  async errorMessage(response) {
+    try {
+      const result = await response.clone().json();
+      if (result.error) return result.error;
+    } catch (_error) {
+      return this.errorFallbackValue;
+    }
+
+    return this.errorFallbackValue;
+  }
+
+  showError(message) {
+    if (this.hasErrorTarget) {
+      this.errorTarget.textContent = message;
+      this.errorTarget.hidden = false;
+      this.errorTarget.setAttribute("aria-hidden", "false");
+    }
+  }
+
+  clearError() {
+    if (this.hasErrorTarget) {
+      this.errorTarget.textContent = "";
+      this.errorTarget.hidden = true;
+      this.errorTarget.setAttribute("aria-hidden", "true");
+    }
+  }
+}
diff --git a/app/javascript/controllers/webauthn_registration_controller.js b/app/javascript/controllers/webauthn_registration_controller.js
new file mode 100644
index 000000000..2e0325a6f
--- /dev/null
+++ b/app/javascript/controllers/webauthn_registration_controller.js
@@ -0,0 +1,67 @@
+import WebauthnController from "controllers/webauthn_controller";
+import {
+  prepareCredentialCreationOptions,
+  serializePublicKeyCredential,
+} from "utils/webauthn";
+
+export default class extends WebauthnController {
+  static targets = ["error", "nickname"];
+  static values = {
+    optionsUrl: String,
+    createUrl: String,
+    unsupportedMessage: String,
+    errorFallback: String,
+  };
+
+  async register(event) {
+    event.preventDefault();
+    this.clearError();
+
+    if (!window.PublicKeyCredential) {
+      this.showError(this.unsupportedMessageValue);
+      return;
+    }
+
+    try {
+      const options = await this.fetchOptions();
+      const credential = await navigator.credentials.create({
+        publicKey: prepareCredentialCreationOptions(options),
+      });
+
+      await this.createCredential(serializePublicKeyCredential(credential));
+    } catch (error) {
+      this.showError(error.message);
+    }
+  }
+
+  async fetchOptions() {
+    const response = await fetch(this.optionsUrlValue, {
+      method: "POST",
+      headers: this.headers,
+      credentials: "same-origin",
+    });
+
+    if (!response.ok) throw new Error(await this.errorMessage(response));
+
+    return response.json();
+  }
+
+  async createCredential(credential) {
+    const response = await fetch(this.createUrlValue, {
+      method: "POST",
+      headers: this.headers,
+      credentials: "same-origin",
+      body: JSON.stringify({
+        credential,
+        webauthn_credential: {
+          nickname: this.hasNicknameTarget ? this.nicknameTarget.value : "",
+        },
+      }),
+    });
+
+    if (!response.ok) throw new Error(await this.errorMessage(response));
+
+    const result = await response.json();
+    window.location.href = result.redirect_url;
+  }
+}
diff --git a/app/javascript/utils/sankey_zoom.mjs b/app/javascript/utils/sankey_zoom.mjs
new file mode 100644
index 000000000..15e27b9ae
--- /dev/null
+++ b/app/javascript/utils/sankey_zoom.mjs
@@ -0,0 +1,149 @@
+const CASH_FLOW_NODE_ID = "cash_flow_node";
+const CASH_FLOW_NODE_NAME = "Cash Flow";
+
+export function sankeyNodeHasChildren(data, nodeId) {
+  const graph = buildGraph(data);
+  const nodeIndex = graph.indexById.get(nodeId);
+  if (nodeIndex === undefined || graph.cashFlowIndex < 0) return false;
+
+  return childIndexesFor(graph, nodeIndex).length > 0;
+}
+
+export function zoomSankeyData(data, rootNodeId) {
+  const graph = buildGraph(data);
+  const rootIndex = graph.indexById.get(rootNodeId);
+  if (rootIndex === undefined || graph.cashFlowIndex < 0) return data;
+
+  const includedIndexes = descendantIndexesFor(graph, rootIndex);
+  if (includedIndexes.size <= 1) return data;
+
+  const orderedIndexes = graph.nodes
+    .map((_, index) => index)
+    .filter((index) => includedIndexes.has(index));
+  const reindexed = new Map(
+    orderedIndexes.map((index, newIndex) => [index, newIndex]),
+  );
+
+  return {
+    ...data,
+    nodes: orderedIndexes.map((index) => ({ ...graph.nodes[index] })),
+    links: graph.links
+      .filter(
+        (link) =>
+          includedIndexes.has(link.sourceIndex) &&
+          includedIndexes.has(link.targetIndex),
+      )
+      .map((link) => ({
+        ...link.original,
+        source: reindexed.get(link.sourceIndex),
+        target: reindexed.get(link.targetIndex),
+      })),
+  };
+}
+
+function buildGraph(data) {
+  const nodes = data?.nodes || [];
+  const links = (data?.links || []).map((link) => {
+    const sourceIndex = linkIndex(link.source);
+    const targetIndex = linkIndex(link.target);
+
+    return {
+      original: link,
+      sourceIndex,
+      targetIndex,
+    };
+  });
+
+  const indexById = new Map(
+    nodes.map((node, index) => [nodeId(node, index), index]),
+  );
+  const cashFlowIndex = nodes.findIndex(
+    (node) =>
+      nodeId(node, -1) === CASH_FLOW_NODE_ID ||
+      node.name === CASH_FLOW_NODE_NAME,
+  );
+
+  return {
+    nodes,
+    links,
+    indexById,
+    cashFlowIndex,
+    outbound: groupLinksBy(links, "sourceIndex"),
+    inbound: groupLinksBy(links, "targetIndex"),
+  };
+}
+
+function nodeId(node, index) {
+  return node?.id ?? index;
+}
+
+function linkIndex(endpoint) {
+  return typeof endpoint === "object" ? endpoint.index : endpoint;
+}
+
+function groupLinksBy(links, key) {
+  const groups = new Map();
+
+  links.forEach((link) => {
+    const index = link[key];
+    if (!groups.has(index)) groups.set(index, []);
+    groups.get(index).push(link);
+  });
+
+  return groups;
+}
+
+function descendantIndexesFor(graph, rootIndex) {
+  const included = new Set([rootIndex]);
+  const queue = [rootIndex];
+
+  while (queue.length) {
+    const currentIndex = queue.shift();
+
+    childIndexesFor(graph, currentIndex).forEach((childIndex) => {
+      if (included.has(childIndex)) return;
+
+      included.add(childIndex);
+      queue.push(childIndex);
+    });
+  }
+
+  return included;
+}
+
+function childIndexesFor(graph, nodeIndex) {
+  if (nodeIndex === graph.cashFlowIndex) {
+    return (graph.outbound.get(nodeIndex) || []).map((link) => link.targetIndex);
+  }
+
+  if (canReach(graph, graph.cashFlowIndex, nodeIndex)) {
+    return (graph.outbound.get(nodeIndex) || []).map((link) => link.targetIndex);
+  }
+
+  if (canReach(graph, nodeIndex, graph.cashFlowIndex)) {
+    return (graph.inbound.get(nodeIndex) || []).map((link) => link.sourceIndex);
+  }
+
+  return [];
+}
+
+function canReach(graph, startIndex, targetIndex) {
+  if (startIndex === targetIndex) return true;
+
+  const visited = new Set([startIndex]);
+  const queue = [startIndex];
+
+  while (queue.length) {
+    const currentIndex = queue.shift();
+
+    for (const link of graph.outbound.get(currentIndex) || []) {
+      if (link.targetIndex === targetIndex) return true;
+      if (visited.has(link.targetIndex)) continue;
+
+      visited.add(link.targetIndex);
+      queue.push(link.targetIndex);
+    }
+  }
+
+  return false;
+}
diff --git a/app/javascript/utils/webauthn.js b/app/javascript/utils/webauthn.js
new file mode 100644
index 000000000..f7799e64d
--- /dev/null
+++ b/app/javascript/utils/webauthn.js
@@ -0,0 +1,85 @@
+function bufferToBase64url(buffer) {
+  const bytes = new Uint8Array(buffer);
+  const binary = String.fromCharCode(...bytes);
+
+  return btoa(binary)
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/g, "");
+}
+
+function base64urlToBuffer(value) {
+  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.padEnd(
+    base64.length + ((4 - (base64.length % 4)) % 4),
+    "=",
+  );
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+
+  for (let i = 0; i < binary.length; i += 1) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+
+  return bytes.buffer;
+}
+
+export function prepareCredentialCreationOptions(options) {
+  options.challenge = base64urlToBuffer(options.challenge);
+  options.user.id = base64urlToBuffer(options.user.id);
+  options.excludeCredentials = (options.excludeCredentials || []).map(
+    (credential) => ({
+      ...credential,
+      id: base64urlToBuffer(credential.id),
+    }),
+  );
+
+  return options;
+}
+
+export function prepareCredentialRequestOptions(options) {
+  options.challenge = base64urlToBuffer(options.challenge);
+  options.allowCredentials = (options.allowCredentials || []).map(
+    (credential) => ({
+      ...credential,
+      id: base64urlToBuffer(credential.id),
+    }),
+  );
+
+  return options;
+}
+
+export function serializePublicKeyCredential(credential) {
+  const serialized = {
+    id: credential.id,
+    rawId: bufferToBase64url(credential.rawId),
+    type: credential.type,
+    authenticatorAttachment: credential.authenticatorAttachment,
+    clientExtensionResults: credential.getClientExtensionResults(),
+  };
+
+  if (credential.response.attestationObject) {
+    serialized.response = {
+      attestationObject: bufferToBase64url(
+        credential.response.attestationObject,
+      ),
+      clientDataJSON: bufferToBase64url(credential.response.clientDataJSON),
+      transports: credential.response.getTransports
+        ? credential.response.getTransports()
+        : [],
+    };
+  } else {
+    serialized.response = {
+      authenticatorData: bufferToBase64url(
+        credential.response.authenticatorData,
+      ),
+      clientDataJSON: bufferToBase64url(credential.response.clientDataJSON),
+      signature: bufferToBase64url(credential.response.signature),
+      userHandle: credential.response.userHandle
+        ? bufferToBase64url(credential.response.userHandle)
+        : null,
+    };
+  }
+
+  return serialized;
+}
diff --git a/app/jobs/assistant_response_job.rb b/app/jobs/assistant_response_job.rb
index 70664f02b..36a6c0e84 100644
--- a/app/jobs/assistant_response_job.rb
+++ b/app/jobs/assistant_response_job.rb
@@ -1,7 +1,7 @@
 class AssistantResponseJob < ApplicationJob
   queue_as :high_priority
 
-  def perform(message)
-    message.request_response
+  def perform(message, assistant_message = nil)
+    message.request_response(assistant_message: assistant_message)
   end
 end
diff --git a/app/jobs/debug_log_cleanup_job.rb b/app/jobs/debug_log_cleanup_job.rb
new file mode 100644
index 000000000..3edf46f9f
--- /dev/null
+++ b/app/jobs/debug_log_cleanup_job.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class DebugLogCleanupJob < ApplicationJob
+  queue_as :scheduled
+
+  def perform
+    deleted_count = DebugLogEntry.where(created_at: ...retention_period.ago).delete_all
+    Rails.logger.info("DebugLogCleanupJob: Deleted #{deleted_count} debug log entries older than #{retention_period.inspect}") if deleted_count > 0
+  end
+
+  private
+    def retention_period
+      Rails.application.config.x.debug_log.retention_days.days
+    end
+end
diff --git a/app/jobs/demo_family_refresh_job.rb b/app/jobs/demo_family_refresh_job.rb
index 65f6a8c9b..b30f6cab2 100644
--- a/app/jobs/demo_family_refresh_job.rb
+++ b/app/jobs/demo_family_refresh_job.rb
@@ -2,10 +2,12 @@ class DemoFamilyRefreshJob < ApplicationJob
   queue_as :scheduled
 
   def perform
+    return unless Rails.application.config.app_mode.managed?
+
     period_end = Time.current
     period_start = period_end - 24.hours
 
-    demo_email = Rails.application.config_for(:demo).fetch("email")
+    demo_email = Rails.application.config_for(:demo).with_indifferent_access.fetch(:email)
     demo_user = User.find_by(email: demo_email)
     old_family = demo_user&.family
 
diff --git a/app/jobs/destroy_job.rb b/app/jobs/destroy_job.rb
index 8b5622423..ba937e61f 100644
--- a/app/jobs/destroy_job.rb
+++ b/app/jobs/destroy_job.rb
@@ -5,6 +5,6 @@ class DestroyJob < ApplicationJob
   def perform(model)
     model.destroy
   rescue => e
-    model.update!(scheduled_for_deletion: false) # Let's the user try again by resetting the state
+    model.update!(scheduled_for_deletion: false) if model.respond_to?(:scheduled_for_deletion) # Let's the user try again by resetting the state
   end
 end
diff --git a/app/jobs/identify_recurring_transactions_job.rb b/app/jobs/identify_recurring_transactions_job.rb
index 92e1e9151..9bb2c4156 100644
--- a/app/jobs/identify_recurring_transactions_job.rb
+++ b/app/jobs/identify_recurring_transactions_job.rb
@@ -51,6 +51,7 @@ class IdentifyRecurringTransactionsJob < ApplicationJob
       return true if family.simplefin_items.joins(:syncs).merge(Sync.incomplete).exists? if family.respond_to?(:simplefin_items)
       return true if family.lunchflow_items.joins(:syncs).merge(Sync.incomplete).exists? if family.respond_to?(:lunchflow_items)
       return true if family.enable_banking_items.joins(:syncs).merge(Sync.incomplete).exists? if family.respond_to?(:enable_banking_items)
+      return true if family.sophtron_items.joins(:syncs).merge(Sync.incomplete).exists? if family.respond_to?(:sophtron_items)
 
       # Check accounts' syncs
       return true if family.accounts.joins(:syncs).merge(Sync.incomplete).exists?
diff --git a/app/jobs/rule_job.rb b/app/jobs/rule_job.rb
index 92a23c086..c70c79fa9 100644
--- a/app/jobs/rule_job.rb
+++ b/app/jobs/rule_job.rb
@@ -40,7 +40,7 @@ class RuleJob < ApplicationJob
         status = "pending"
       elsif result.is_a?(Integer)
         # Only synchronous actions were executed
-        transactions_processed = result
+        transactions_processed = transactions_queued
         transactions_modified = result
         status = "success"
       else
diff --git a/app/jobs/sophtron_initial_load_job.rb b/app/jobs/sophtron_initial_load_job.rb
new file mode 100644
index 000000000..ca91a9c64
--- /dev/null
+++ b/app/jobs/sophtron_initial_load_job.rb
@@ -0,0 +1,20 @@
+class SophtronInitialLoadJob < ApplicationJob
+  queue_as :high_priority
+
+  RETRY_DELAY = 10.seconds
+  MAX_ATTEMPTS = 30
+
+  def perform(sophtron_item, attempts_remaining: MAX_ATTEMPTS)
+    if sophtron_item.syncing?
+      if attempts_remaining.positive?
+        self.class.set(wait: RETRY_DELAY).perform_later(sophtron_item, attempts_remaining: attempts_remaining - 1)
+      else
+        Rails.logger.warn("SophtronInitialLoadJob - gave up waiting for SophtronItem #{sophtron_item.id} to finish syncing")
+      end
+
+      return
+    end
+
+    sophtron_item.sync_later
+  end
+end
diff --git a/app/jobs/sophtron_refresh_poll_job.rb b/app/jobs/sophtron_refresh_poll_job.rb
new file mode 100644
index 000000000..1f5afb08a
--- /dev/null
+++ b/app/jobs/sophtron_refresh_poll_job.rb
@@ -0,0 +1,76 @@
+class SophtronRefreshPollJob < ApplicationJob
+  queue_as :high_priority
+
+  POLL_INTERVAL = 4.seconds
+  MAX_ATTEMPTS = 60
+
+  def perform(sophtron_account, job_id:, attempts_remaining: MAX_ATTEMPTS, sync: nil)
+    sophtron_item = sophtron_account.sophtron_item
+    provider = sophtron_item.sophtron_provider
+    raise Provider::Sophtron::Error.new("Sophtron provider is not configured", :configuration_error) unless provider
+
+    job = Provider::Sophtron.response_data!(provider.get_job_information(job_id))
+    sophtron_item.upsert_job_snapshot!(job)
+
+    if Provider::Sophtron.job_requires_input?(job)
+      mark_requires_update!(sophtron_item, job_id)
+    elsif Provider::Sophtron.job_failed?(job)
+      sophtron_item.update!(last_connection_error: "Sophtron refresh failed")
+    elsif Provider::Sophtron.job_success?(job) || Provider::Sophtron.job_completed?(job)
+      import_transactions!(sophtron_account, provider, sync)
+    elsif attempts_remaining.to_i > 1
+      self.class.set(wait: POLL_INTERVAL).perform_later(
+        sophtron_account,
+        job_id: job_id,
+        attempts_remaining: attempts_remaining.to_i - 1,
+        sync: sync
+      )
+    else
+      sophtron_item.update!(last_connection_error: "Sophtron refresh did not finish before the polling timeout")
+    end
+  rescue Provider::Sophtron::Error => e
+    handle_provider_error!(sophtron_account.sophtron_item, e)
+  end
+
+  private
+
+    def import_transactions!(sophtron_account, provider, sync)
+      sophtron_item = sophtron_account.sophtron_item
+      result = SophtronItem::Importer.new(sophtron_item, sophtron_provider: provider, sync: sync)
+                                    .import_transactions_after_refresh(sophtron_account)
+
+      unless result[:success]
+        attributes = { last_connection_error: result[:error] }
+        attributes[:status] = :requires_update if result[:requires_update]
+        sophtron_item.update!(attributes)
+        return
+      end
+
+      SophtronAccount::Processor.new(sophtron_account.reload).process
+
+      account = sophtron_account.current_account
+      return unless account
+
+      account.sync_later(
+        parent_sync: sync,
+        window_start_date: sync&.window_start_date,
+        window_end_date: sync&.window_end_date
+      )
+    end
+
+    def mark_requires_update!(sophtron_item, job_id)
+      sophtron_item.update!(
+        status: :requires_update,
+        current_job_id: job_id,
+        last_connection_error: "Sophtron refresh requires MFA"
+      )
+    end
+
+    def handle_provider_error!(sophtron_item, error)
+      requires_update = error.error_type.in?([ :unauthorized, :access_forbidden ])
+      attributes = { last_connection_error: error.message }
+      attributes[:status] = :requires_update if requires_update
+      sophtron_item.update!(attributes)
+      Rails.logger.error "SophtronRefreshPollJob - Sophtron API error for item #{sophtron_item.id}: #{error.message}"
+    end
+end
diff --git a/app/jobs/sync_all_providers_job.rb b/app/jobs/sync_all_providers_job.rb
new file mode 100644
index 000000000..431b77cad
--- /dev/null
+++ b/app/jobs/sync_all_providers_job.rb
@@ -0,0 +1,9 @@
+class SyncAllProvidersJob < ApplicationJob
+  queue_as :high_priority
+  sidekiq_options lock: :until_executed, lock_args: ->(args) { [ args.first ] }, on_conflict: :log
+
+  def perform(family_id)
+    family = Family.find_by(id: family_id)
+    family&.sync_later
+  end
+end
diff --git a/app/models/account.rb b/app/models/account.rb
index 8a31a8d5e..b0595d308 100644
--- a/app/models/account.rb
+++ b/app/models/account.rb
@@ -2,6 +2,8 @@ class Account < ApplicationRecord
   include AASM, Syncable, Monetizable, Chartable, Linkable, Enrichable, Anchorable, Reconcileable, TaxTreatable
 
   before_validation :assign_default_owner, if: -> { owner_id.blank? }
+  before_destroy :capture_account_statement_ids_to_move
+  after_destroy_commit :move_account_statements_to_inbox
 
   validates :name, :balance, :currency, presence: true
   validate :owner_belongs_to_family, if: -> { owner_id.present? && family_id.present? }
@@ -20,6 +22,14 @@ class Account < ApplicationRecord
   has_many :holdings, dependent: :destroy
   has_many :balances, dependent: :destroy
   has_many :recurring_transactions, dependent: :destroy
+  # Inverse for recurring transfers where this account is the destination.
+  # Account#recurring_transactions only matches account_id; without this
+  # association, destroying the destination account would hit the FK
+  # cascade silently and the AR cache wouldn't reflect the deletion.
+  has_many :inbound_recurring_transfers,
+           class_name: "RecurringTransaction",
+           foreign_key: :destination_account_id,
+           dependent: :destroy
 
   monetize :balance, :cash_balance
 
@@ -69,6 +79,8 @@ class Account < ApplicationRecord
   }
 
   has_one_attached :logo, dependent: :purge_later
+  # No dependent: option; before_destroy captures IDs, after_destroy_commit moves statements back to inbox.
+  has_many :account_statements
 
   delegated_type :accountable, types: Accountable::TYPES, dependent: :destroy
   delegate :subtype, to: :accountable, allow_nil: true
@@ -248,27 +260,55 @@ class Account < ApplicationRecord
     end
 
     def create_from_binance_account(binance_account)
-      family = binance_account.binance_item.family
+      create_from_crypto_exchange_account(binance_account, family: binance_account.binance_item.family)
+    end
+
+    def create_from_ibkr_account(ibkr_account)
+      family = ibkr_account.ibkr_item.family
+      default_name = if ibkr_account.ibkr_account_id.present?
+        "Interactive Brokers (#{ibkr_account.ibkr_account_id})"
+      else
+        "Interactive Brokers"
+      end
 
       attributes = {
         family: family,
-        name: binance_account.name,
-        balance: (binance_account.current_balance || 0).to_d,
+        name: default_name,
+        balance: 0,
         cash_balance: 0,
-        currency: binance_account.currency.presence || family.currency,
-        accountable_type: "Crypto",
+        currency: ibkr_account.currency.presence || family.currency,
+        accountable_type: "Investment",
         accountable_attributes: {
-          subtype: "exchange",
-          tax_treatment: "taxable"
+          subtype: "brokerage"
         }
       }
 
       create_and_sync(attributes, skip_initial_sync: true)
     end
 
+    def create_from_kraken_account(kraken_account)
+      create_from_crypto_exchange_account(kraken_account, family: kraken_account.kraken_item.family)
+    end
 
     private
 
+      def create_from_crypto_exchange_account(provider_account, family:)
+        attributes = {
+          family: family,
+          name: provider_account.name,
+          balance: (provider_account.current_balance || 0).to_d,
+          cash_balance: 0,
+          currency: provider_account.currency.presence || family.currency,
+          accountable_type: "Crypto",
+          accountable_attributes: {
+            subtype: "exchange",
+            tax_treatment: "taxable"
+          }
+        }
+
+        create_and_sync(attributes, skip_initial_sync: true)
+      end
+
       def build_simplefin_accountable_attributes(simplefin_account, account_type, subtype)
         attributes = {}
         attributes[:subtype] = subtype if subtype.present?
@@ -298,6 +338,14 @@ class Account < ApplicationRecord
     read_attribute(:institution_domain).presence || provider&.institution_domain
   end
 
+  def manual_crypto_exchange?
+    accountable_type == "Crypto" &&
+      accountable&.subtype == "exchange" &&
+      account_providers.none? &&
+      plaid_account_id.blank? &&
+      simplefin_account_id.blank?
+  end
+
   def logo_url
     if institution_domain.present? && Setting.brand_fetch_client_id.present?
       logo_size = Setting.brand_fetch_logo_size
@@ -328,15 +376,23 @@ class Account < ApplicationRecord
   end
 
   def current_holdings
-    holdings
-      .where(currency: currency)
-      .where.not(qty: 0)
-      .where(
-        id: holdings.select("DISTINCT ON (security_id) id")
-                    .where(currency: currency)
-                    .order(:security_id, date: :desc)
-      )
-      .order(amount: :desc)
+    if (provider_snapshot_date = latest_provider_holdings_snapshot_date)
+      holdings
+        .where.not(account_provider_id: nil)
+        .where(date: provider_snapshot_date)
+        .where.not(qty: 0)
+        .order(amount: :desc)
+    else
+      holdings
+        .where(currency: currency)
+        .where.not(qty: 0)
+        .where(
+          id: holdings.select("DISTINCT ON (security_id) id")
+                      .where(currency: currency)
+                      .order(:security_id, date: :desc)
+        )
+        .order(amount: :desc)
+    end
   end
 
   def latest_provider_holdings_snapshot_date
@@ -470,4 +526,21 @@ class Account < ApplicationRecord
       return if User.where(id: owner_id, family_id: family_id).exists?
       errors.add(:owner, :invalid, message: "must belong to the same family as the account")
     end
+
+    def capture_account_statement_ids_to_move
+      @statement_ids_to_move = account_statements.ids
+    end
+
+    def move_account_statements_to_inbox
+      statement_ids = Array(@statement_ids_to_move).compact
+      return if statement_ids.empty?
+
+      # Bypass callbacks deliberately: the account was destroyed, so linked statements need a direct inbox move.
+      AccountStatement.where(id: statement_ids).update_all(
+        account_id: nil,
+        review_status: "unmatched",
+        match_confidence: nil,
+        updated_at: Time.current
+      )
+    end
 end
diff --git a/app/models/account/current_balance_manager.rb b/app/models/account/current_balance_manager.rb
index f1c5928a5..b01c2f26a 100644
--- a/app/models/account/current_balance_manager.rb
+++ b/app/models/account/current_balance_manager.rb
@@ -92,22 +92,55 @@ class Account::CurrentBalanceManager
     # Linked accounts manage "current balance" via the special `current_anchor` valuation.
     # This is NOT a user-facing feature, and is primarily used in "processors" while syncing
     # linked account data (e.g. via Plaid)
+    #
+    # Before overwriting a stale (previous-day) current_anchor, we convert it to a
+    # reconciliation valuation. This preserves the API-reported balance as a historical
+    # waypoint that the ReverseCalculator uses for more accurate balance history.
     def set_current_balance_for_linked_account(balance)
-      if current_anchor_valuation
-        changes_made = update_current_anchor(balance)
-        Result.new(success?: true, changes_made?: changes_made, error: nil)
-      else
-        create_current_anchor(balance)
-        Result.new(success?: true, changes_made?: true, error: nil)
+      changes_made = false
+
+      ActiveRecord::Base.transaction do
+        # If an anchor exists from a previous day, preserve it as a reconciliation
+        # before replacing it with today's fresh anchor.
+        preserve_anchor_as_reconciliation_if_stale if current_anchor_valuation
+
+        # Re-check: the memoized value was cleared if the anchor was converted
+        if current_anchor_valuation
+          changes_made = update_current_anchor(balance)
+        else
+          create_current_anchor(balance)
+          changes_made = true
+        end
       end
+
+      Result.new(success?: true, changes_made?: changes_made, error: nil)
     end
 
     def current_anchor_valuation
       @current_anchor_valuation ||= account.valuations.current_anchor.includes(:entry).first
     end
 
+    # If the existing current_anchor is from a previous day, convert it to a
+    # reconciliation before overwriting. This accumulates a chain of API-reported
+    # balance waypoints over time without creating extra entries per sync.
+    #
+    # Same-day updates are left in place (no extra reconciliations on repeated syncs).
+    def preserve_anchor_as_reconciliation_if_stale
+      entry = current_anchor_valuation.entry
+      return if entry.date == Date.current # Same-day update — nothing to preserve
+
+      current_anchor_valuation.update!(kind: "reconciliation")
+      entry.update!(name: Valuation.build_reconciliation_name(account.accountable_type))
+      Rails.logger.info("[AnchorRotation] Converted current_anchor to reconciliation for account #{account.id}, date=#{entry.date}, entry_id=#{entry.id}")
+
+      # Clear memoized value so the next check creates a fresh current_anchor.
+      # The chained scope (.current_anchor.first) always issues a fresh SQL query,
+      # so we don't need to reload the full association.
+      @current_anchor_valuation = nil
+    end
+
     def create_current_anchor(balance)
-      entry = account.entries.create!(
+      account.entries.create!(
         date: Date.current,
         name: Valuation.build_current_anchor_name(account.accountable_type),
         amount: balance,
@@ -115,31 +148,28 @@ class Account::CurrentBalanceManager
         entryable: Valuation.new(kind: "current_anchor")
       )
 
-      # Reload associations and clear memoized value so it gets the new anchor
-      account.valuations.reload
+      # Clear memoized value so it picks up the new anchor on next access.
       @current_anchor_valuation = nil
     end
 
     def update_current_anchor(balance)
       changes_made = false
 
-      ActiveRecord::Base.transaction do
-        # Update associated entry attributes
-        entry = current_anchor_valuation.entry
+      # Update associated entry attributes
+      entry = current_anchor_valuation.entry
 
-        if entry.amount != balance
-          entry.amount = balance
-          changes_made = true
-        end
-
-        if entry.date != Date.current
-          entry.date = Date.current
-          changes_made = true
-        end
-
-        entry.save! if entry.changed?
+      if entry.amount != balance
+        entry.amount = balance
+        changes_made = true
       end
 
+      if entry.date != Date.current
+        entry.date = Date.current
+        changes_made = true
+      end
+
+      entry.save! if entry.changed?
+
       changes_made
     end
 end
diff --git a/app/models/account/linkable.rb b/app/models/account/linkable.rb
index d3830ddda..b91d4ed83 100644
--- a/app/models/account/linkable.rb
+++ b/app/models/account/linkable.rb
@@ -8,6 +8,17 @@ module Account::Linkable
     # Legacy provider associations - kept for backward compatibility during migration
     belongs_to :plaid_account, optional: true
     belongs_to :simplefin_account, optional: true
+
+    # SQL-level mirror of `linked?`. Use this for set-based checks (e.g. bulk
+    # `EXISTS`) so both definitions stay in sync. If `linked?` adds a new
+    # provider source, update this scope too.
+    scope :linked, -> {
+      left_outer_joins(:account_providers)
+        .where(
+          "account_providers.id IS NOT NULL OR accounts.plaid_account_id IS NOT NULL OR accounts.simplefin_account_id IS NOT NULL"
+        )
+        .distinct
+    }
   end
 
   # A "linked" account gets transaction and balance data from a third party like Plaid or SimpleFin
diff --git a/app/models/account/market_data_importer.rb b/app/models/account/market_data_importer.rb
index c6caf7980..5e7ae6182 100644
--- a/app/models/account/market_data_importer.rb
+++ b/app/models/account/market_data_importer.rb
@@ -24,18 +24,12 @@ class Account::MarketDataImporter
            .each do |source_currency, date|
       key = [ source_currency, account.currency ]
       pair_dates[key] = [ pair_dates[key], date ].compact.min
-
-      inverse_key = [ account.currency, source_currency ]
-      pair_dates[inverse_key] = [ pair_dates[inverse_key], date ].compact.min
     end
 
     # 2. ACCOUNT-BASED PAIR – convert the account currency to the family currency (if different)
     if foreign_account?
       key = [ account.currency, account.family.currency ]
       pair_dates[key] = [ pair_dates[key], account.start_date ].compact.min
-
-      inverse_key = [ account.family.currency, account.currency ]
-      pair_dates[inverse_key] = [ pair_dates[inverse_key], account.start_date ].compact.min
     end
 
     pair_dates.each do |(source, target), start_date|
@@ -51,34 +45,71 @@ class Account::MarketDataImporter
   def import_security_prices
     return unless Security.provider
 
-    account_securities = (account.trades.map(&:security) + account.current_holdings.map(&:security)).uniq
+    current_security_ids = account.current_holdings.pluck(:security_id).to_set
+    traded_security_ids  = account.trades.pluck(:security_id).uniq
 
-    return if account_securities.empty?
+    all_security_ids = (current_security_ids | traded_security_ids)
+    return if all_security_ids.empty?
 
-    account_securities.each do |security|
-      security.import_provider_prices(
-        start_date: first_required_price_date(security),
-        end_date: Date.current
-      )
+    securities = Security.online.where(id: all_security_ids).index_by(&:id)
 
+    start_dates    = batch_first_required_price_dates(all_security_ids)
+    historical_ids = traded_security_ids - current_security_ids.to_a
+
+    # For securities no longer held, cap end_date at the last holding date so
+    # all_prices_exist? stays stable and we don't call the provider every sync.
+    last_holding_date = account.holdings
+                               .where(security_id: historical_ids)
+                               .group(:security_id)
+                               .maximum(:date)
+
+    # import_market_data runs before materialize_balances in Account::Syncer, so
+    # current_holdings can reflect a stale pre-trade snapshot. If a historical
+    # security has a trade newer than its last holding date the position was
+    # reopened this sync; fetch prices through today so the forthcoming
+    # materialization has a price available.
+    latest_trade_date = account.trades
+                               .where(security_id: historical_ids)
+                               .group(:security_id)
+                               .maximum("entries.date")
+
+    all_security_ids.each do |security_id|
+      security = securities[security_id]
+      next unless security
+
+      end_date = if current_security_ids.include?(security_id)
+        Date.current
+      else
+        holding_date = last_holding_date[security_id]
+        trade_date   = latest_trade_date[security_id]
+        reopened     = trade_date && holding_date && trade_date > holding_date
+        reopened ? Date.current : (holding_date || Date.current)
+      end
+
+      security.import_provider_prices(start_date: start_dates[security_id], end_date: end_date)
       security.import_provider_details
     end
   end
 
   private
-    # Calculates the first date we require a price for the given security scoped to this account
-    def first_required_price_date(security)
-      trade_start_date = account.trades.with_entry
-                              .where(security: security)
-                              .where(entries: { account_id: account.id })
-                              .minimum("entries.date")
+    # Replaces 2-queries-per-security with 3 queries total.
+    def batch_first_required_price_dates(security_ids)
+      # account.trades is a has_many :through :entries, so entries is already joined
+      trade_start_dates = account.trades.group(:security_id).minimum("entries.date")
 
-      holding_start_date =
-        if account.holdings.where(security: security).where.not(account_provider_id: nil).exists?
-          account.start_date
-        end
+      provider_holding_security_ids = account.holdings
+                                             .where(security_id: security_ids)
+                                             .where.not(account_provider_id: nil)
+                                             .pluck(:security_id)
+                                             .to_set
 
-      [ trade_start_date, holding_start_date ].compact.min
+      account_start_date = account.start_date
+
+      security_ids.each_with_object({}) do |security_id, hash|
+        trade_date   = trade_start_dates[security_id]
+        holding_date = provider_holding_security_ids.include?(security_id) ? account_start_date : nil
+        hash[security_id] = [ trade_date, holding_date ].compact.min || account_start_date
+      end
     end
 
     def needs_exchange_rates?
diff --git a/app/models/account/opening_balance_manager.rb b/app/models/account/opening_balance_manager.rb
index 95597cdaa..3ad6818e0 100644
--- a/app/models/account/opening_balance_manager.rb
+++ b/app/models/account/opening_balance_manager.rb
@@ -51,7 +51,11 @@ class Account::OpeningBalanceManager
     end
 
     def oldest_entry_date
-      @oldest_entry_date ||= account.entries.minimum(:date)
+      if opening_anchor_valuation&.entry
+        account.entries.where.not(id: opening_anchor_valuation.entry.id).minimum(:date)
+      else
+        account.entries.minimum(:date)
+      end
     end
 
     def default_date
diff --git a/app/models/account/provider_import_adapter.rb b/app/models/account/provider_import_adapter.rb
index 2d814e9e8..549423f10 100644
--- a/app/models/account/provider_import_adapter.rb
+++ b/app/models/account/provider_import_adapter.rb
@@ -83,7 +83,8 @@ class Account::ProviderImportAdapter
         incoming_pending =
           ActiveModel::Type::Boolean.new.cast(pending_extra.dig("simplefin", "pending")) ||
           ActiveModel::Type::Boolean.new.cast(pending_extra.dig("plaid", "pending")) ||
-          ActiveModel::Type::Boolean.new.cast(pending_extra.dig("lunchflow", "pending"))
+          ActiveModel::Type::Boolean.new.cast(pending_extra.dig("lunchflow", "pending")) ||
+          ActiveModel::Type::Boolean.new.cast(pending_extra.dig("enable_banking", "pending"))
       end
 
       if entry.new_record? && !incoming_pending
@@ -108,18 +109,53 @@ class Account::ProviderImportAdapter
         end
 
         if pending_match
+          old_pending_external_id = pending_match.external_id
+          pending_entry_date      = pending_match.date
           entry = pending_match
           entry.assign_attributes(external_id: external_id)
+
+          # Clear the pending flag so this entry no longer shows as pending after being claimed
+          # by a booked transaction. Also record the old external_id so the sync engine can
+          # exclude it from re-import (preventing the old pending from being recreated on the
+          # next sync when the stored raw payload still contains the pending transaction data).
+          if entry.entryable.is_a?(Transaction)
+            ex = (entry.transaction.extra || {}).deep_dup
+            Transaction::PENDING_PROVIDERS.each do |provider|
+              next unless ex.key?(provider)
+              ex[provider].delete("pending")
+              ex.delete(provider) if ex[provider].empty?
+            end
+            if old_pending_external_id.present?
+              existing_claims = Array.wrap(ex["auto_claimed_pending_ids"])
+              ex["auto_claimed_pending_ids"] = (existing_claims + [ old_pending_external_id ]).uniq
+            end
+            entry.transaction.extra = ex
+          end
         end
       end
 
       # Track if this is a new posted transaction (for fuzzy suggestion after save)
       is_new_posted = entry.new_record? && !incoming_pending
 
+      # Preserve the original pending date across all syncs:
+      # - First claim: pending_entry_date is captured from the pending match above
+      # - Subsequent syncs: entry already exists (no pending_match found), so check
+      #   auto_claimed_pending_ids which signals it was previously auto-claimed and
+      #   keep entry.date (the pending date stored on first claim) unchanged
+      effective_date = if pending_entry_date
+        pending_entry_date
+      elsif !entry.new_record? &&
+            entry.entryable.is_a?(Transaction) &&
+            entry.transaction.extra&.key?("auto_claimed_pending_ids")
+        entry.date
+      else
+        date
+      end
+
       entry.assign_attributes(
         amount: amount,
         currency: currency,
-        date: date
+        date: effective_date
       )
 
       # Use enrichment pattern to respect user overrides
@@ -160,6 +196,10 @@ class Account::ProviderImportAdapter
       elsif detected_label == "Contribution"
         auto_kind = "investment_contribution"
         auto_category = account.family.investment_contributions_category
+      elsif account.accountable_type == "Loan" && amount.negative?
+        auto_kind = "loan_payment"
+      elsif account.accountable_type == "CreditCard" && amount.negative?
+        auto_kind = "cc_payment"
       end
 
       # Set investment activity label, kind, and category if detected
@@ -546,8 +586,9 @@ class Account::ProviderImportAdapter
   # @param external_id [String, nil] Provider's unique ID (optional, for deduplication)
   # @param source [String] Provider name
   # @param activity_label [String, nil] Investment activity label (e.g., "Buy", "Sell", "Reinvestment")
+  # @param exchange_rate [BigDecimal, Numeric, nil] Optional provider-supplied FX rate into the account currency
   # @return [Entry] The created entry with trade
-  def import_trade(security:, quantity:, price:, amount:, currency:, date:, name: nil, external_id: nil, source:, activity_label: nil)
+  def import_trade(security:, quantity:, price:, amount:, currency:, date:, name: nil, external_id: nil, source:, activity_label: nil, exchange_rate: nil)
     raise ArgumentError, "security is required" if security.nil?
     raise ArgumentError, "source is required" if source.blank?
 
@@ -580,13 +621,16 @@ class Account::ProviderImportAdapter
       end
 
       # Always update Trade attributes (works for both new and existing records)
-      entry.entryable.assign_attributes(
+      trade_attributes = {
         security: security,
         qty: quantity,
         price: price,
         currency: currency,
         investment_activity_label: activity_label || (quantity > 0 ? "Buy" : "Sell")
-      )
+      }
+      trade_attributes[:exchange_rate] = exchange_rate unless exchange_rate.nil?
+
+      entry.entryable.assign_attributes(trade_attributes)
 
       entry.assign_attributes(
         date: date,
@@ -691,6 +735,7 @@ class Account::ProviderImportAdapter
         (transactions.extra -> 'simplefin' ->> 'pending')::boolean = true
         OR (transactions.extra -> 'plaid' ->> 'pending')::boolean = true
         OR (transactions.extra -> 'lunchflow' ->> 'pending')::boolean = true
+        OR (transactions.extra -> 'enable_banking' ->> 'pending')::boolean = true
       SQL
       .order(date: :desc) # Prefer most recent pending transaction
 
@@ -737,6 +782,7 @@ class Account::ProviderImportAdapter
         (transactions.extra -> 'simplefin' ->> 'pending')::boolean = true
         OR (transactions.extra -> 'plaid' ->> 'pending')::boolean = true
         OR (transactions.extra -> 'lunchflow' ->> 'pending')::boolean = true
+        OR (transactions.extra -> 'enable_banking' ->> 'pending')::boolean = true
       SQL
 
     # If merchant_id is provided, prioritize matching by merchant
@@ -806,6 +852,7 @@ class Account::ProviderImportAdapter
         (transactions.extra -> 'simplefin' ->> 'pending')::boolean = true
         OR (transactions.extra -> 'plaid' ->> 'pending')::boolean = true
         OR (transactions.extra -> 'lunchflow' ->> 'pending')::boolean = true
+        OR (transactions.extra -> 'enable_banking' ->> 'pending')::boolean = true
       SQL
 
     # For low confidence, require BOTH merchant AND name match (stronger signal needed)
diff --git a/app/models/account/syncer.rb b/app/models/account/syncer.rb
index 3b6a4c9b0..874091f81 100644
--- a/app/models/account/syncer.rb
+++ b/app/models/account/syncer.rb
@@ -9,6 +9,7 @@ class Account::Syncer
     Rails.logger.info("Processing balances (#{account.linked? ? 'reverse' : 'forward'})")
     import_market_data
     materialize_balances(window_start_date: sync.window_start_date)
+    apply_provider_balance_overrides
   end
 
   def perform_post_sync
@@ -34,4 +35,16 @@ class Account::Syncer
       Rails.logger.error("Error syncing market data for account #{account.id}: #{e.message}")
       Sentry.capture_exception(e)
     end
+
+    def apply_provider_balance_overrides
+      return unless account.linked_to?("IbkrAccount")
+
+      ibkr_account = account.account_providers.find_by(provider_type: "IbkrAccount")&.provider
+      return unless ibkr_account
+
+      IbkrAccount::HistoricalBalancesSync.new(ibkr_account).sync!
+    rescue => e
+      Rails.logger.error("Error syncing IBKR historical balances for account #{account.id}: #{e.class} - #{e.message}")
+      Sentry.capture_exception(e)
+    end
 end
diff --git a/app/models/account_import.rb b/app/models/account_import.rb
index 02f19c05b..53ee51f1f 100644
--- a/app/models/account_import.rb
+++ b/app/models/account_import.rb
@@ -59,11 +59,11 @@ class AccountImport < Import
   end
 
   def csv_template
-    template = <<-CSV
+    template = <<~CSV
       Account type*,Name*,Balance*,Currency,Balance Date
-      Checking,Main Checking Account,1000.00,USD,01/01/2024
-      Savings,Emergency Fund,5000.00,USD,01/15/2024
-      Credit Card,Rewards Card,-500.00,USD,02/01/2024
+      Checking,Main Checking Account,1000.00,USD,2024-01-01
+      Savings,Emergency Fund,5000.00,USD,2024-01-15
+      Credit Card,Rewards Card,-500.00,USD,2024-02-01
     CSV
 
     CSV.parse(template, headers: true)
diff --git a/app/models/account_order.rb b/app/models/account_order.rb
index 8a26c0fc4..bd7367c0b 100644
--- a/app/models/account_order.rb
+++ b/app/models/account_order.rb
@@ -33,11 +33,11 @@ class AccountOrder
   end
 
   def label
-    ORDERS.dig(key, :label)
+    I18n.t("account_order.#{key}.label", default: ORDERS.dig(key, :label))
   end
 
   def label_short
-    ORDERS.dig(key, :label_short)
+    I18n.t("account_order.#{key}.label_short", default: ORDERS.dig(key, :label_short))
   end
 
   def sql_order
diff --git a/app/models/account_statement.rb b/app/models/account_statement.rb
new file mode 100644
index 000000000..07cc80c86
--- /dev/null
+++ b/app/models/account_statement.rb
@@ -0,0 +1,462 @@
+# frozen_string_literal: true
+
+require "digest/md5"
+require "digest/sha2"
+require "stringio"
+
+class AccountStatement < ApplicationRecord
+  include Monetizable
+
+  DuplicateUploadError = Class.new(StandardError) do
+    attr_reader :statement
+
+    def initialize(statement)
+      @statement = statement
+      super("Statement file has already been uploaded")
+    end
+  end
+  InvalidUploadError = Class.new(StandardError)
+
+  PreparedUpload = Data.define(:content, :filename, :content_type, :byte_size, :checksum, :content_sha256)
+
+  MAX_FILE_SIZE = 25.megabytes
+  READ_CHUNK_SIZE = 1.megabyte
+  ALLOWED_EXTENSION_CONTENT_TYPES = {
+    ".pdf" => %w[application/pdf],
+    ".csv" => %w[text/csv text/plain application/csv application/vnd.ms-excel],
+    ".xlsx" => %w[application/vnd.openxmlformats-officedocument.spreadsheetml.sheet]
+  }.freeze
+  ALLOWED_CONTENT_TYPES = ALLOWED_EXTENSION_CONTENT_TYPES.values.flatten.uniq.freeze
+  ACCEPTED_FILE_EXTENSIONS = ALLOWED_EXTENSION_CONTENT_TYPES.keys.freeze
+
+  belongs_to :family
+  belongs_to :account, optional: true
+  belongs_to :suggested_account, class_name: "Account", optional: true
+
+  has_one_attached :original_file, dependent: :purge_later
+
+  enum :source, { manual_upload: "manual_upload" }, validate: true, default: "manual_upload"
+  enum :upload_status, { stored: "stored", failed: "failed" }, validate: true, default: "stored"
+  enum :review_status, { unmatched: "unmatched", linked: "linked", rejected: "rejected" }, validate: true, default: "unmatched", scopes: false
+
+  monetize :opening_balance, :closing_balance
+
+  before_validation :sync_file_metadata, if: -> { original_file.attached? }
+  before_validation :normalize_currency
+  before_validation :sync_review_status
+
+  validates :filename, :content_type, :checksum, presence: true
+  validates :byte_size, presence: true, numericality: { greater_than: 0, less_than_or_equal_to: MAX_FILE_SIZE }
+  validates :content_type, inclusion: { in: ALLOWED_CONTENT_TYPES }
+  validates :content_sha256,
+            format: { with: /\A[0-9a-f]{64}\z/ },
+            uniqueness: { scope: :family_id, allow_nil: true, message: :duplicate_statement_file },
+            allow_nil: true
+  validates :parser_confidence, :match_confidence, numericality: { greater_than_or_equal_to: 0, less_than_or_equal_to: 1 }, allow_nil: true
+  validate :account_belongs_to_family
+  validate :suggested_account_belongs_to_family
+  validate :period_order
+  validate :currency_is_valid
+  validate :filename_extension_matches_content_type
+  validate :original_file_attached
+  validate :original_file_constraints, if: -> { original_file.attached? }
+
+  scope :ordered, -> { order(created_at: :desc) }
+  scope :with_account, -> { where.not(account_id: nil) }
+  scope :unmatched, -> { where(account_id: nil).where(review_status: "unmatched") }
+  scope :for_month, ->(month) {
+    month_start = month.to_date.beginning_of_month
+    month_end = month_start.end_of_month
+    where("period_start_on <= ? AND period_end_on >= ?", month_end, month_start)
+  }
+
+  class << self
+    def statement_manager?(user)
+      user&.admin? || user&.member?
+    end
+
+    def create_from_upload!(family:, account:, file:)
+      prepared_upload = prepare_upload!(file)
+      create_from_prepared_upload!(family: family, account: account, prepared_upload: prepared_upload)
+    end
+
+    def create_from_prepared_upload!(family:, account:, prepared_upload:)
+      statement = nil
+      duplicate = duplicate_for(family, prepared_upload)
+      raise DuplicateUploadError, duplicate if duplicate
+
+      statement = family.account_statements.build(
+        account: account,
+        filename: prepared_upload.filename,
+        content_type: prepared_upload.content_type,
+        byte_size: prepared_upload.byte_size,
+        checksum: prepared_upload.checksum,
+        content_sha256: prepared_upload.content_sha256,
+        source: :manual_upload,
+        upload_status: :stored,
+        review_status: account.present? ? :linked : :unmatched,
+        currency: account&.currency || family.currency
+      )
+
+      statement.original_file.attach(
+        io: StringIO.new(prepared_upload.content),
+        filename: prepared_upload.filename,
+        content_type: prepared_upload.content_type
+      )
+
+      MetadataDetector.new(statement, content: prepared_upload.content).apply
+      statement.assign_account_match unless account.present?
+      statement.save!
+      statement
+    rescue ActiveRecord::RecordNotUnique
+      duplicate = duplicate_for(family, prepared_upload)
+      purge_original_file(statement)
+
+      if duplicate
+        raise DuplicateUploadError, duplicate
+      end
+
+      raise
+    rescue StandardError
+      purge_original_file(statement)
+      raise
+    end
+
+    def reconciliation_statuses_for(statements, account:)
+      statement_list = statements.to_a
+      balance_lookup = balance_lookup_for(account, statement_list)
+
+      statement_list.to_h do |statement|
+        [ statement.id, statement.reconciliation_status(balance_lookup: balance_lookup) ]
+      end
+    end
+
+    def prepare_upload!(file)
+      filename = file.original_filename.to_s
+      content = read_upload_content!(file)
+      byte_size = content.bytesize
+      raise InvalidUploadError if byte_size.zero?
+
+      content_type = detected_content_type(content:, filename:, declared_content_type: file.content_type)
+      raise InvalidUploadError unless allowed_upload?(filename:, content_type:)
+      raise InvalidUploadError if content_type == "application/pdf" && !valid_pdf_content?(content)
+
+      PreparedUpload.new(
+        content: content,
+        filename: filename,
+        content_type: content_type,
+        byte_size: byte_size,
+        checksum: Digest::MD5.base64digest(content),
+        content_sha256: Digest::SHA256.hexdigest(content)
+      )
+    end
+
+    def detected_content_type(content:, filename:, declared_content_type:)
+      Marcel::MimeType.for(
+        StringIO.new(content),
+        name: filename,
+        declared_type: declared_content_type.presence
+      )
+    end
+
+    def allowed_upload?(filename:, content_type:)
+      allowed_content_types_for_filename(filename).include?(content_type)
+    end
+
+    def allowed_content_types_for_filename(filename)
+      ALLOWED_EXTENSION_CONTENT_TYPES.fetch(File.extname(filename.to_s).downcase, [])
+    end
+
+    def valid_pdf_content?(content)
+      content.start_with?("%PDF-")
+    end
+
+    def purge_original_file(statement)
+      return unless statement&.original_file&.attached?
+
+      statement.original_file.purge
+    rescue StandardError => e
+      Rails.logger.warn("AccountStatement staged blob cleanup failed: #{e.class}: #{e.message}")
+    end
+
+    def balance_lookup_for(account, statements)
+      currencies = statements.map(&:statement_currency).compact.uniq
+      dates = statements.flat_map { |statement| [ statement.period_start_on, statement.period_end_on ] }.compact.uniq
+      balances = if currencies.any? && dates.any?
+        account.balances.where(currency: currencies, date: dates).to_a
+      else
+        []
+      end
+      balances_by_key = balances.index_by { |balance| [ balance.date, balance.currency ] }
+
+      ->(date, currency) { balances_by_key[[ date, currency ]] }
+    end
+
+    def read_upload_content!(file)
+      declared_size = declared_upload_size(file)
+      raise InvalidUploadError if declared_size.present? && declared_size > MAX_FILE_SIZE
+
+      content = +"".b
+      loop do
+        chunk = file.read(READ_CHUNK_SIZE)
+        break if chunk.nil? || chunk.empty?
+
+        content << chunk
+        raise InvalidUploadError if content.bytesize > MAX_FILE_SIZE
+      end
+
+      file.rewind if file.respond_to?(:rewind)
+      content
+    end
+
+    def declared_upload_size(file)
+      if file.respond_to?(:size)
+        file.size
+      elsif file.respond_to?(:length)
+        file.length
+      end
+    end
+
+    def duplicate_for(family, prepared_upload)
+      scope = family.account_statements
+      sha_duplicate = scope.find_by(content_sha256: prepared_upload.content_sha256) if prepared_upload.content_sha256.present?
+      return sha_duplicate if sha_duplicate
+
+      # Active Storage's MD5 checksum is retained only to catch legacy rows that predate content_sha256.
+      legacy_scope = prepared_upload.content_sha256.present? ? scope.where(content_sha256: nil) : scope
+      legacy_scope.find_by(checksum: prepared_upload.checksum)
+    end
+  end
+
+  def viewable_by?(user)
+    return false unless user&.family_id == family_id
+
+    account.present? ? account.shared_with?(user) : self.class.statement_manager?(user)
+  end
+
+  def manageable_by?(user)
+    return false unless user&.family_id == family_id
+
+    return self.class.statement_manager?(user) if account.blank?
+
+    account.permission_for(user).in?([ :owner, :full_control ]) && self.class.statement_manager?(user)
+  end
+
+  def link_to_account!(target_account, confidence: 1.0)
+    update!(
+      account: target_account,
+      suggested_account: nil,
+      match_confidence: confidence,
+      review_status: :linked,
+      currency: currency.presence || target_account.currency
+    )
+  end
+
+  def unlink!
+    transaction do
+      update!(
+        account: nil,
+        review_status: :unmatched,
+        match_confidence: nil
+      )
+      assign_account_match
+      save!
+    end
+  end
+
+  def reject_match!
+    update!(
+      suggested_account: nil,
+      match_confidence: nil,
+      review_status: :rejected
+    )
+  end
+
+  def assign_account_match
+    match = AccountMatcher.new(self).best_match
+
+    self.suggested_account = match&.account
+    self.match_confidence = match&.confidence
+    clear_invalid_suggested_account
+  end
+
+  def covered_months
+    return [] unless period_start_on.present? && period_end_on.present?
+
+    current = period_start_on.beginning_of_month
+    last = period_end_on.beginning_of_month
+    months = []
+
+    while current <= last
+      months << current
+      current = current.next_month
+    end
+
+    months
+  end
+
+  def covers_month?(month)
+    covered_months.include?(month.to_date.beginning_of_month)
+  end
+
+  def reconciliation_status(balance_lookup: nil)
+    checks = reconciliation_checks(balance_lookup: balance_lookup)
+    return "unavailable" if checks.empty?
+
+    checks.any? { |check| check[:status] == "mismatched" } ? "mismatched" : "matched"
+  end
+
+  def reconciliation_mismatched?(balance_lookup: nil)
+    reconciliation_status(balance_lookup: balance_lookup) == "mismatched"
+  end
+
+  def reconciliation_checks(balance_lookup: nil)
+    return [] unless account.present? && period_start_on.present? && period_end_on.present?
+
+    checks = []
+    opening_balance_record = balance_record_for(period_start_on, statement_currency, balance_lookup)
+    closing_balance_record = balance_record_for(period_end_on, statement_currency, balance_lookup)
+
+    if opening_balance.present? && opening_balance_record.present?
+      checks << reconciliation_check(
+        key: "opening_balance",
+        statement_amount: opening_balance,
+        ledger_amount: opening_balance_record.start_balance
+      )
+    end
+
+    if closing_balance.present? && closing_balance_record.present?
+      checks << reconciliation_check(
+        key: "closing_balance",
+        statement_amount: closing_balance,
+        ledger_amount: closing_balance_record.end_balance
+      )
+    end
+
+    if opening_balance.present? && closing_balance.present? && opening_balance_record.present? && closing_balance_record.present?
+      checks << reconciliation_check(
+        key: "period_movement",
+        statement_amount: closing_balance - opening_balance,
+        ledger_amount: closing_balance_record.end_balance - opening_balance_record.start_balance
+      )
+    end
+
+    checks
+  end
+
+  def statement_currency
+    currency.presence || account&.currency || family.currency
+  end
+
+  def pdf?
+    content_type.in?(ALLOWED_EXTENSION_CONTENT_TYPES[".pdf"])
+  end
+
+  def csv?
+    content_type.in?(ALLOWED_EXTENSION_CONTENT_TYPES[".csv"])
+  end
+
+  def xlsx?
+    content_type.in?(ALLOWED_EXTENSION_CONTENT_TYPES[".xlsx"])
+  end
+
+  private
+
+    def reconciliation_check(key:, statement_amount:, ledger_amount:)
+      difference = statement_amount.to_d - ledger_amount.to_d
+      {
+        key: key,
+        statement_amount: statement_amount.to_d,
+        ledger_amount: ledger_amount.to_d,
+        difference: difference,
+        status: difference.abs <= 0.01.to_d ? "matched" : "mismatched"
+      }
+    end
+
+    def balance_record_for(date, currency, balance_lookup)
+      return balance_lookup.call(date, currency) if balance_lookup
+
+      account.balances.find_by(date: date, currency: currency)
+    end
+
+    def sync_file_metadata
+      blob = original_file.blob
+      self.filename ||= blob.filename.to_s
+      self.content_type ||= blob.content_type
+      self.byte_size ||= blob.byte_size
+      self.checksum ||= blob.checksum
+    end
+
+    def normalize_currency
+      self.currency = currency.to_s.upcase.presence if currency.present?
+    end
+
+    def sync_review_status
+      return if rejected?
+
+      self.review_status = "linked" if account.present? && !linked?
+      self.review_status = "unmatched" if account.blank? && linked?
+    end
+
+    def account_belongs_to_family
+      return if account.nil?
+      return if account.family_id == family_id
+
+      errors.add(:account, :invalid)
+    end
+
+    def suggested_account_belongs_to_family
+      return if suggested_account_valid_for_family?
+
+      errors.add(:suggested_account, :invalid)
+    end
+
+    def clear_invalid_suggested_account
+      return if suggested_account_valid_for_family?
+
+      self.suggested_account = nil
+      self.match_confidence = nil
+    end
+
+    def suggested_account_valid_for_family?
+      suggested_account.nil? || suggested_account.family_id == family_id
+    end
+
+    def period_order
+      return if period_start_on.blank? || period_end_on.blank?
+      return if period_start_on <= period_end_on
+
+      errors.add(:period_end_on, :on_or_after_start)
+    end
+
+    def currency_is_valid
+      return if currency.blank?
+
+      Money::Currency.new(currency)
+    rescue Money::Currency::UnknownCurrencyError, ArgumentError
+      errors.add(:currency, :invalid)
+    end
+
+    def filename_extension_matches_content_type
+      return if filename.blank? || content_type.blank?
+      return if self.class.allowed_upload?(filename: filename, content_type: content_type)
+
+      errors.add(:content_type, :invalid)
+    end
+
+    def original_file_constraints
+      if original_file.byte_size.zero?
+        errors.add(:original_file, :blank)
+      elsif original_file.byte_size > MAX_FILE_SIZE
+        errors.add(:original_file, :too_large, max_mb: MAX_FILE_SIZE / 1.megabyte)
+      end
+
+      unless self.class.allowed_upload?(filename: original_file.filename.to_s, content_type: original_file.content_type)
+        errors.add(:original_file, :invalid_format, file_format: original_file.content_type)
+      end
+    end
+
+    def original_file_attached
+      errors.add(:original_file, :blank) unless original_file.attached?
+    end
+end
diff --git a/app/models/account_statement/account_matcher.rb b/app/models/account_statement/account_matcher.rb
new file mode 100644
index 000000000..6e8c5c1c2
--- /dev/null
+++ b/app/models/account_statement/account_matcher.rb
@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+class AccountStatement::AccountMatcher
+  Match = Struct.new(:account, :confidence, keyword_init: true)
+
+  attr_reader :statement
+
+  def initialize(statement)
+    @statement = statement
+  end
+
+  def best_match
+    candidates = statement.family.accounts.visible.to_a.filter_map do |account|
+      confidence = confidence_for(account)
+      next if confidence < 0.35
+
+      Match.new(account: account, confidence: confidence.round(4))
+    end
+
+    candidates.max_by(&:confidence)
+  end
+
+  private
+
+    def confidence_for(account)
+      score = 0.to_d
+
+      if institution_hint.present?
+        score += 0.45.to_d if account_text(account).include?(institution_hint)
+      end
+
+      if account_name_hint.present?
+        score += 0.25.to_d if account.name.to_s.downcase.include?(account_name_hint)
+      end
+
+      if account_last4_hint.present?
+        score += 0.25.to_d if account_sensitive_match_text(account).include?(account_last4_hint)
+      end
+
+      score += 0.05.to_d if statement.statement_currency == account.currency
+      [ score, 1.to_d ].min
+    end
+
+    def institution_hint
+      @institution_hint ||= statement.institution_name_hint.to_s.downcase.squish.presence
+    end
+
+    def account_name_hint
+      @account_name_hint ||= statement.account_name_hint.to_s.downcase.squish.presence
+    end
+
+    def account_last4_hint
+      @account_last4_hint ||= statement.account_last4_hint.to_s.downcase.squish.presence
+    end
+
+    def account_text(account)
+      [
+        account.name,
+        account.institution_name,
+        account.institution_domain
+      ].compact.join(" ").downcase
+    end
+
+    def account_sensitive_match_text(account)
+      # Exclude user-controlled account notes from matching hints. Statement
+      # matching should use conservative account metadata, not free-form prose
+      # that can accidentally manufacture a last-four match.
+      [
+        account.name,
+        account.institution_name
+      ].compact.join(" ").downcase
+    end
+end
diff --git a/app/models/account_statement/coverage.rb b/app/models/account_statement/coverage.rb
new file mode 100644
index 000000000..225df183c
--- /dev/null
+++ b/app/models/account_statement/coverage.rb
@@ -0,0 +1,194 @@
+# frozen_string_literal: true
+
+class AccountStatement::Coverage
+  Month = Struct.new(:date, :status, :statements, :ambiguous_statements, keyword_init: true) do
+    def expected?
+      status != "not_expected"
+    end
+
+    def covered?
+      status == "covered"
+    end
+
+    def missing?
+      status == "missing"
+    end
+
+    def duplicate?
+      status == "duplicate"
+    end
+
+    def ambiguous?
+      status == "ambiguous"
+    end
+
+    def mismatched?
+      status == "mismatched"
+    end
+
+    def not_expected?
+      status == "not_expected"
+    end
+  end
+
+  attr_reader :account, :start_month, :end_month, :expected_start_month, :expected_end_month, :selected_year, :available_years
+
+  class << self
+    def for_year(account, year)
+      expected_end_month = default_expected_end_month
+      expected_start_month = default_expected_start_month(account, fallback_end_month: expected_end_month)
+      available_years = years_between(expected_start_month, expected_end_month)
+      selected_year = resolve_year_value(year, available_years)
+
+      new(
+        account,
+        start_month: Date.new(selected_year, 1, 1),
+        end_month: Date.new(selected_year, 12, 1),
+        expected_start_month: expected_start_month,
+        expected_end_month: expected_end_month,
+        selected_year: selected_year,
+        available_years: available_years
+      )
+    end
+
+    def years_for(account)
+      expected_end_month = default_expected_end_month
+      expected_start_month = default_expected_start_month(account, fallback_end_month: expected_end_month)
+
+      years_between(expected_start_month, expected_end_month)
+    end
+
+    def resolve_year(account, year)
+      resolve_year_value(year, years_for(account))
+    end
+
+    def default_expected_end_month
+      Date.current.prev_month.beginning_of_month
+    end
+
+    def default_expected_start_month(account, fallback_end_month: default_expected_end_month)
+      candidates = [
+        account.entries.minimum(:date),
+        account.balances.minimum(:date),
+        account.account_statements.where.not(period_start_on: nil).minimum(:period_start_on),
+        account.family.account_statements.unmatched.where(suggested_account: account).where.not(period_start_on: nil).minimum(:period_start_on)
+      ].compact
+
+      start_month = (candidates.min || fallback_end_month.advance(months: -11)).to_date.beginning_of_month
+      start_month > fallback_end_month ? fallback_end_month : start_month
+    end
+
+    private
+
+      def years_between(start_month, end_month)
+        (start_month.year..end_month.year).to_a.reverse
+      end
+
+      def resolve_year_value(year, available_years)
+        requested_year = year.to_i if year.present?
+
+        available_years.include?(requested_year) ? requested_year : available_years.first
+      end
+  end
+
+  def initialize(account, start_month: nil, end_month: nil, expected_start_month: nil, expected_end_month: nil, selected_year: nil, available_years: nil)
+    raise ArgumentError, "account is required" if account.nil?
+
+    @account = account
+    @expected_end_month = (expected_end_month || end_month || self.class.default_expected_end_month).to_date.beginning_of_month
+    resolved_expected_start_month = (expected_start_month || start_month || self.class.default_expected_start_month(account, fallback_end_month: @expected_end_month)).to_date.beginning_of_month
+    @expected_start_month = resolved_expected_start_month > @expected_end_month ? @expected_end_month : resolved_expected_start_month
+    @start_month = (start_month || @expected_start_month).to_date.beginning_of_month
+    @end_month = (end_month || @expected_end_month).to_date.beginning_of_month
+    @selected_year = selected_year
+    @available_years = available_years || self.class.years_for(account)
+  end
+
+  def months
+    @months ||= begin
+      current = start_month
+      result = []
+
+      while current <= end_month
+        result << build_month(current)
+        current = current.next_month
+      end
+
+      result
+    end
+  end
+
+  def summary_counts
+    months.group_by(&:status).transform_values(&:count)
+  end
+
+  private
+
+    def build_month(month)
+      return Month.new(date: month, status: "not_expected", statements: [], ambiguous_statements: []) unless expected_month?(month)
+
+      linked_statements = statements_covering(linked_statement_scope, month)
+      ambiguous_statements = statements_covering(ambiguous_statement_scope, month)
+
+      status = if linked_statements.size > 1
+        "duplicate"
+      elsif linked_statements.any? { |statement| statement.reconciliation_mismatched?(balance_lookup: balance_lookup) }
+        "mismatched"
+      elsif linked_statements.one?
+        "covered"
+      elsif ambiguous_statements.any?
+        "ambiguous"
+      else
+        "missing"
+      end
+
+      Month.new(date: month, status: status, statements: linked_statements, ambiguous_statements: ambiguous_statements)
+    end
+
+    def expected_month?(month)
+      month >= expected_start_month && month <= expected_end_month
+    end
+
+    def linked_statement_scope
+      @linked_statement_scope ||= account.account_statements
+        .where("period_start_on <= ? AND period_end_on >= ?", end_month.end_of_month, start_month)
+        .ordered
+        .to_a
+    end
+
+    def ambiguous_statement_scope
+      @ambiguous_statement_scope ||= account.family.account_statements
+        .unmatched
+        .where(suggested_account: account)
+        .where("period_start_on <= ? AND period_end_on >= ?", end_month.end_of_month, start_month)
+        .ordered
+        .to_a
+    end
+
+    def statements_covering(statements, month)
+      month_start = month.to_date.beginning_of_month
+      month_end = month_start.end_of_month
+
+      statements.select do |statement|
+        statement.period_start_on.present? &&
+          statement.period_end_on.present? &&
+          statement.period_start_on <= month_end &&
+          statement.period_end_on >= month_start
+      end
+    end
+
+    def balance_lookup
+      @balance_lookup ||= begin
+        currencies = linked_statement_scope.map(&:statement_currency).compact.uniq
+        dates = linked_statement_scope.flat_map { |statement| [ statement.period_start_on, statement.period_end_on ] }.compact.uniq
+        balances = if currencies.any? && dates.any?
+          account.balances.where(currency: currencies, date: dates).to_a
+        else
+          []
+        end
+        by_key = balances.index_by { |balance| [ balance.date, balance.currency ] }
+
+        ->(date, currency) { by_key[[ date, currency ]] }
+      end
+    end
+end
diff --git a/app/models/account_statement/metadata_detector.rb b/app/models/account_statement/metadata_detector.rb
new file mode 100644
index 000000000..e8079d5b8
--- /dev/null
+++ b/app/models/account_statement/metadata_detector.rb
@@ -0,0 +1,221 @@
+# frozen_string_literal: true
+
+require "csv"
+require "stringio"
+
+class AccountStatement::MetadataDetector
+  DATE_PATTERNS = [
+    /(?<![a-z0-9])\d{4}[-_\.]\d{1,2}[-_\.]\d{1,2}(?![a-z0-9])/,
+    /(?<![a-z0-9])\d{1,2}[-_\.]\d{1,2}[-_\.]\d{4}(?![a-z0-9])/,
+    /(?<![a-z0-9])\d{8}(?![a-z0-9])/
+  ].freeze
+
+  MONTH_PATTERN = /
+    (?<![a-z0-9])
+    (?:
+      (?<year_first>\d{4})[-_\.](?<month_first>0?[1-9]|1[0-2])
+      |
+      (?<month_name>jan(?:uary)?|feb(?:ruary)?|mar(?:ch)?|apr(?:il)?|may|jun(?:e)?|jul(?:y)?|aug(?:ust)?|sep(?:t(?:ember)?)?|oct(?:ober)?|nov(?:ember)?|dec(?:ember)?)
+      [-_\s\.]+(?<year_second>\d{4})
+    )
+    (?![a-z0-9])
+  /ix.freeze
+
+  LAST4_PATTERN = /(?:^|[^a-z0-9])(?:x{2,}|ending|last\s*4|acct|account|card)[^\d]*(\d{4})(?=\D|$)/i.freeze
+  GENERIC_FILENAME_HINTS = [
+    "statement",
+    "statements",
+    "bank statement",
+    "bank statements",
+    "account statement",
+    "account statements",
+    "credit card statement",
+    "card statement"
+  ].freeze
+  MAX_CSV_COLUMNS = 100
+  MAX_CSV_DATE_SAMPLES = 250
+  MAX_CSV_SAMPLE_BYTES = 256
+
+  attr_reader :statement, :content
+
+  def initialize(statement, content:)
+    @statement = statement
+    @content = content
+  end
+
+  def apply
+    output = statement.sanitized_parser_output || {}
+    metadata_sources = []
+
+    if detect_from_filename
+      metadata_sources << "filename"
+    end
+
+    if statement.csv? && detect_from_csv(output)
+      metadata_sources << "csv_dates"
+    elsif statement.xlsx?
+      output["spreadsheet_detection"] = "filename_only"
+    elsif statement.pdf?
+      output["pdf_detection"] = "filename_only"
+    end
+
+    output["metadata_sources"] = metadata_sources
+    statement.sanitized_parser_output = output
+    statement.parser_confidence ||= if metadata_sources.include?("csv_dates")
+      0.65
+    elsif metadata_sources.any?
+      0.45
+    else
+      0.1
+    end
+  end
+
+  private
+
+    def detect_from_filename
+      basename = File.basename(statement.filename.to_s, ".*")
+      return false if basename.blank?
+
+      detected = false
+
+      if (last4 = basename.match(LAST4_PATTERN)&.captures&.first)
+        statement.account_last4_hint ||= last4
+        detected = true
+      end
+
+      dates = DATE_PATTERNS.flat_map { |pattern| basename.scan(pattern) }
+                           .map { |match| Array(match).first }
+                           .filter_map { |value| parse_date(value) }
+                           .uniq
+                           .sort
+
+      if dates.size >= 2
+        statement.period_start_on ||= dates.first
+        statement.period_end_on ||= dates.last
+        detected = true
+      elsif dates.size == 1
+        statement.period_start_on ||= dates.first.beginning_of_month
+        statement.period_end_on ||= dates.first.end_of_month
+        detected = true
+      elsif (month_date = parse_month_from_filename(basename))
+        statement.period_start_on ||= month_date.beginning_of_month
+        statement.period_end_on ||= month_date.end_of_month
+        detected = true
+      end
+
+      hint = basename
+        .gsub(LAST4_PATTERN, "")
+        .gsub(/\b\d{4}[-_\.]\d{1,2}(?:[-_\.]\d{1,2})?\b/, "")
+        .gsub(/\b\d{8}\b/, "")
+        .tr("_-", " ")
+        .gsub(/\b(?:19|20)\d{2}\b/, "")
+        .gsub(/\b(?:0?[1-9]|1[0-2])\b/, "")
+        .squish
+        .presence
+
+      if (meaningful_hint = meaningful_filename_hint(hint))
+        statement.institution_name_hint ||= meaningful_hint
+        statement.account_name_hint ||= meaningful_hint
+        detected = true
+      end
+
+      detected
+    end
+
+    def detect_from_csv(output)
+      csv = CSV.new(StringIO.new(content.to_s), headers: true, liberal_parsing: true)
+      first_row = csv.shift
+      return false if first_row.blank?
+
+      headers = first_row.headers.compact.map(&:to_s)
+      return false if headers.size > MAX_CSV_COLUMNS
+
+      date_header = headers.find { |header| csv_sample_text(header).to_s.match?(/date|posted|transaction/i) }
+      return false if date_header.blank?
+
+      samples = [ csv_sample_text(first_row[date_header]) ].compact_blank
+      csv.each do |row|
+        break if samples.size >= MAX_CSV_DATE_SAMPLES
+
+        sample = csv_sample_text(row[date_header])
+        samples << sample if sample.present?
+      end
+      return false if samples.blank?
+
+      date_format = Import.detect_date_format(samples)
+      dates = samples.filter_map { |sample| parse_date_with_format(sample, date_format) }.uniq.sort
+      return false if dates.blank?
+
+      statement.period_start_on ||= dates.first
+      statement.period_end_on ||= dates.last
+      output["csv"] = {
+        "date_header" => date_header.to_s,
+        "date_format" => date_format,
+        "rows_sampled" => samples.size
+      }
+      true
+    rescue CSV::MalformedCSVError
+      false
+    end
+
+    def csv_sample_text(value)
+      text = value.to_s
+      return nil if text.bytesize > MAX_CSV_SAMPLE_BYTES
+
+      text
+    end
+
+    def meaningful_filename_hint(hint)
+      return nil if hint.blank?
+
+      normalized = hint.downcase.gsub(/[^a-z0-9]+/, " ").squish
+      without_generic_words = normalized
+        .gsub(/\b(?:bank|account|card|credit|debit|statement|statements)\b/, "")
+        .squish
+
+      return nil if GENERIC_FILENAME_HINTS.include?(normalized) || without_generic_words.blank?
+
+      hint
+    end
+
+    def parse_date(value)
+      text = value.to_s.tr("_", "-")
+      date = if text.match?(/\A\d{8}\z/)
+        Date.strptime(text, "%Y%m%d")
+      else
+        Date.parse(text)
+      end
+
+      AccountStatement::MetadataDetector.reasonable_date?(date) ? date : nil
+    rescue Date::Error, ArgumentError
+      nil
+    end
+
+    def parse_date_with_format(value, format)
+      date = Date.strptime(value.to_s, format)
+      AccountStatement::MetadataDetector.reasonable_date?(date) ? date : nil
+    rescue Date::Error, ArgumentError
+      nil
+    end
+
+    def parse_month_from_filename(basename)
+      match = basename.match(MONTH_PATTERN)
+      return nil unless match
+
+      year = (match[:year_first] || match[:year_second]).to_i
+      month = if match[:month_first]
+        match[:month_first].to_i
+      else
+        Date::ABBR_MONTHNAMES.index(match[:month_name][0, 3].capitalize)
+      end
+
+      date = Date.new(year, month, 1)
+      AccountStatement::MetadataDetector.reasonable_date?(date) ? date : nil
+    rescue Date::Error, NoMethodError
+      nil
+    end
+
+    def self.reasonable_date?(date)
+      Import.reasonable_date_range.cover?(date)
+    end
+end
diff --git a/app/models/actual_import.rb b/app/models/actual_import.rb
new file mode 100644
index 000000000..32628f4aa
--- /dev/null
+++ b/app/models/actual_import.rb
@@ -0,0 +1,104 @@
+class ActualImport < Import
+  after_create :set_mappings
+
+  DEFAULT_COLUMN_MAPPINGS = {
+    signage_convention: "inflows_positive",
+    date_col_label: "Date",
+    date_format: "%Y-%m-%d",
+    name_col_label: "Payee",
+    amount_col_label: "Amount",
+    account_col_label: "Account",
+    category_col_label: "Category",
+    notes_col_label: "Notes"
+  }.freeze
+
+  CATEGORY_GROUP_COLUMN = "Category_Group".freeze
+
+  def self.default_column_mappings
+    DEFAULT_COLUMN_MAPPINGS
+  end
+
+  def generate_rows_from_csv
+    rows.destroy_all
+
+    mapped_rows = csv_rows.map.with_index(1) do |row, index|
+      {
+        source_row_number: index,
+        account: row[account_col_label].to_s,
+        date: row[date_col_label].to_s,
+        amount: signed_csv_amount(row).to_s,
+        currency: default_currency.to_s,
+        name: row[name_col_label].to_s,
+        category: combined_category(row),
+        notes: row[notes_col_label].to_s
+      }
+    end
+
+    rows.insert_all!(mapped_rows)
+    update_column(:rows_count, rows.count)
+  end
+
+  def import!
+    transaction do
+      mappings.each(&:create_mappable!)
+
+      rows.each do |row|
+        account = mappings.accounts.mappable_for(row.account)
+        category = mappings.categories.mappable_for(row.category)
+
+        entry = account.entries.build \
+          date: row.date_iso,
+          amount: row.signed_amount,
+          name: row.name,
+          currency: account.currency.presence || family.currency,
+          notes: row.notes,
+          entryable: Transaction.new(category: category),
+          import: self
+
+        entry.save!
+      end
+    end
+  end
+
+  def mapping_steps
+    [ Import::CategoryMapping, Import::AccountMapping ]
+  end
+
+  def required_column_keys
+    %i[date amount]
+  end
+
+  def column_keys
+    %i[date amount name category account notes]
+  end
+
+  def csv_template
+    template = <<~CSV
+      Account,Date,Payee,Notes,Category_Group,Category,Amount,Split_Amount,Cleared
+      Checking Account,2024-01-01,Employer,Monthly salary,Income,Paycheck,2500.00,0,Reconciled
+      Credit Card,2024-01-03,Coffee Shop,Morning coffee,Food,Coffee,-4.25,0,Cleared
+    CSV
+
+    CSV.parse(template, headers: true)
+  end
+
+  def signed_csv_amount(csv_row)
+    csv_row[amount_col_label].to_d
+  end
+
+  private
+    def set_mappings
+      assign_attributes(self.class.default_column_mappings)
+      save!
+    end
+
+    def combined_category(row)
+      category = row[category_col_label].to_s.strip
+      category_group = row[CATEGORY_GROUP_COLUMN].to_s.strip
+
+      return category if category_group.blank?
+      return category_group if category.blank?
+
+      "#{category_group}: #{category}"
+    end
+end
diff --git a/app/models/api_key.rb b/app/models/api_key.rb
index ae24ccec3..4c12b4668 100644
--- a/app/models/api_key.rb
+++ b/app/models/api_key.rb
@@ -112,7 +112,7 @@ class ApiKey < ApplicationRecord
     def prevent_demo_monitoring_key_destroy!
       return unless demo_monitoring_key?
 
-      errors.add(:base, "Cannot destroy demo monitoring API key")
+      errors.add(:base, :cannot_destroy_demo_key)
       throw(:abort)
     end
 end
diff --git a/app/models/assistant/base.rb b/app/models/assistant/base.rb
index 2b77671af..42bd69397 100644
--- a/app/models/assistant/base.rb
+++ b/app/models/assistant/base.rb
@@ -1,13 +1,11 @@
 class Assistant::Base
-  include Assistant::Broadcastable
-
   attr_reader :chat
 
   def initialize(chat)
     @chat = chat
   end
 
-  def respond_to(message)
+  def respond_to(message, assistant_message: nil)
     raise NotImplementedError, "#{self.class}#respond_to must be implemented"
   end
 end
diff --git a/app/models/assistant/broadcastable.rb b/app/models/assistant/broadcastable.rb
deleted file mode 100644
index 7fd2507b5..000000000
--- a/app/models/assistant/broadcastable.rb
+++ /dev/null
@@ -1,12 +0,0 @@
-module Assistant::Broadcastable
-  extend ActiveSupport::Concern
-
-  private
-    def update_thinking(thought)
-      chat.broadcast_update target: "thinking-indicator", partial: "chats/thinking_indicator", locals: { chat: chat, message: thought }
-    end
-
-    def stop_thinking
-      chat.broadcast_remove target: "thinking-indicator"
-    end
-end
diff --git a/app/models/assistant/builtin.rb b/app/models/assistant/builtin.rb
index 1d615eb5a..6a1ae93c9 100644
--- a/app/models/assistant/builtin.rb
+++ b/app/models/assistant/builtin.rb
@@ -17,12 +17,8 @@ class Assistant::Builtin < Assistant::Base
     @functions = functions
   end
 
-  def respond_to(message)
-    assistant_message = AssistantMessage.new(
-      chat: chat,
-      content: "",
-      ai_model: message.ai_model
-    )
+  def respond_to(message, assistant_message: nil)
+    assistant_message ||= AssistantMessage.new(chat: chat, content: "", ai_model: message.ai_model)
 
     llm_provider = get_model_provider(message.ai_model)
     unless llm_provider
@@ -40,7 +36,6 @@ class Assistant::Builtin < Assistant::Base
 
     responder.on(:output_text) do |text|
       if assistant_message.content.blank?
-        stop_thinking
         Chat.transaction do
           assistant_message.append_text!(text)
           chat.update_latest_response!(latest_response_id)
@@ -51,7 +46,6 @@ class Assistant::Builtin < Assistant::Base
     end
 
     responder.on(:response) do |data|
-      update_thinking("Analyzing your data...")
       if data[:function_tool_calls].present?
         assistant_message.tool_calls = data[:function_tool_calls]
         latest_response_id = data[:id]
@@ -62,7 +56,14 @@ class Assistant::Builtin < Assistant::Base
 
     responder.respond(previous_response_id: latest_response_id)
   rescue => e
-    stop_thinking
+    if assistant_message&.persisted?
+      if assistant_message.content.blank?
+        assistant_message.destroy
+      else
+        # Demote partially-streamed turns to `failed` so `Responder#conversation_history` excludes them.
+        assistant_message.update_columns(status: "failed")
+      end
+    end
     chat.add_error(e)
   end
 
diff --git a/app/models/assistant/external.rb b/app/models/assistant/external.rb
index a64888a6e..f2e200641 100644
--- a/app/models/assistant/external.rb
+++ b/app/models/assistant/external.rb
@@ -33,8 +33,9 @@ class Assistant::External < Assistant::Base
     end
   end
 
-  def respond_to(message)
+  def respond_to(message, assistant_message: nil)
     response_completed = false
+    assistant_message ||= AssistantMessage.new(chat: chat, content: "", ai_model: "external-agent")
 
     unless self.class.configured?
       raise Assistant::Error,
@@ -45,12 +46,6 @@ class Assistant::External < Assistant::Base
       raise Assistant::Error, "Your account is not authorized to use the external assistant."
     end
 
-    assistant_message = AssistantMessage.new(
-      chat: chat,
-      content: "",
-      ai_model: "external-agent"
-    )
-
     client = build_client
     messages = build_conversation_messages
 
@@ -58,17 +53,10 @@ class Assistant::External < Assistant::Base
       messages: messages,
       user: "sure-family-#{chat.user.family_id}"
     ) do |text|
-      if assistant_message.content.blank?
-        stop_thinking
-        assistant_message.content = text
-        assistant_message.save!
-      else
-        assistant_message.append_text!(text)
-      end
+      assistant_message.append_text!(text)
     end
 
-    if assistant_message.new_record?
-      stop_thinking
+    if assistant_message.content.blank?
       raise Assistant::Error, "External assistant returned an empty response."
     end
 
@@ -76,12 +64,10 @@ class Assistant::External < Assistant::Base
     assistant_message.update!(ai_model: model) if model.present?
   rescue Assistant::Error, ActiveRecord::ActiveRecordError => e
     cleanup_partial_response(assistant_message) unless response_completed
-    stop_thinking
     chat.add_error(e)
   rescue => e
     Rails.logger.error("[Assistant::External] Unexpected error: #{e.class} - #{e.message}")
     cleanup_partial_response(assistant_message) unless response_completed
-    stop_thinking
     chat.add_error(Assistant::Error.new("Something went wrong with the external assistant. Check server logs for details."))
   end
 
@@ -103,7 +89,7 @@ class Assistant::External < Assistant::Base
     end
 
     def build_conversation_messages
-      chat.conversation_messages.ordered.last(MAX_CONVERSATION_MESSAGES).map do |msg|
+      chat.conversation_messages.where(status: "complete").ordered.last(MAX_CONVERSATION_MESSAGES).map do |msg|
         { role: msg.role, content: msg.content }
       end
     end
diff --git a/app/models/assistant/function/import_bank_statement.rb b/app/models/assistant/function/import_bank_statement.rb
index b0cd02906..dee54602f 100644
--- a/app/models/assistant/function/import_bank_statement.rb
+++ b/app/models/assistant/function/import_bank_statement.rb
@@ -155,7 +155,7 @@ class Assistant::Function::ImportBankStatement < Assistant::Function
       account_holder: result[:account_holder],
       message: "Successfully extracted #{result[:transactions].size} transactions. Import created with ID: #{import.id}. Review and publish when ready."
     }
-  rescue Provider::ProviderError, Faraday::Error, Timeout::Error, RuntimeError => e
+  rescue Provider::Error, Faraday::Error, Timeout::Error, RuntimeError => e
     Rails.logger.error("ImportBankStatement error: #{e.class.name} - #{e.message}")
     Rails.logger.error(e.backtrace.first(10).join("\n"))
     {
diff --git a/app/models/assistant/history_trimmer.rb b/app/models/assistant/history_trimmer.rb
new file mode 100644
index 000000000..02e64f8b9
--- /dev/null
+++ b/app/models/assistant/history_trimmer.rb
@@ -0,0 +1,53 @@
+class Assistant::HistoryTrimmer
+  def initialize(messages, max_tokens:)
+    @messages = messages || []
+    @max_tokens = max_tokens.to_i
+  end
+
+  def call
+    return [] if @messages.empty? || @max_tokens <= 0
+
+    kept = []
+    tokens = 0
+
+    group_tool_pairs(@messages).reverse_each do |group|
+      group_tokens = Assistant::TokenEstimator.estimate(group)
+      break if tokens + group_tokens > @max_tokens
+
+      kept.unshift(*group)
+      tokens += group_tokens
+    end
+
+    kept
+  end
+
+  private
+
+    # Bundles each assistant message that has `tool_calls` with the
+    # consecutive `role: "tool"` results that follow it, so the trimmer
+    # never splits a call/result pair when dropping from the oldest end.
+    def group_tool_pairs(messages)
+      groups = []
+      current_group = nil
+
+      messages.each do |msg|
+        if assistant_with_tool_calls?(msg)
+          groups << current_group if current_group
+          current_group = [ msg ]
+        elsif msg[:role].to_s == "tool" && current_group
+          current_group << msg
+        else
+          groups << current_group if current_group
+          current_group = nil
+          groups << [ msg ]
+        end
+      end
+
+      groups << current_group if current_group
+      groups
+    end
+
+    def assistant_with_tool_calls?(msg)
+      msg[:role].to_s == "assistant" && msg[:tool_calls].is_a?(Array) && msg[:tool_calls].any?
+    end
+end
diff --git a/app/models/assistant/responder.rb b/app/models/assistant/responder.rb
index f2b6d121a..480c69c22 100644
--- a/app/models/assistant/responder.rb
+++ b/app/models/assistant/responder.rb
@@ -79,6 +79,7 @@ class Assistant::Responder
         instructions: instructions,
         functions: function_tool_caller.function_definitions,
         function_results: function_results,
+        messages: conversation_history,
         streamer: streamer,
         previous_response_id: previous_response_id,
         session_id: chat_session_id,
@@ -114,4 +115,46 @@ class Assistant::Responder
     def chat
       @chat ||= message.chat
     end
+
+    def conversation_history
+      messages = []
+      return messages unless chat&.messages
+
+      chat.messages
+          .where(type: [ "UserMessage", "AssistantMessage" ], status: "complete")
+          .includes(:tool_calls)
+          .ordered
+          .each do |chat_message|
+        if chat_message.tool_calls.any?
+          messages << {
+            role: chat_message.role,
+            content: chat_message.content || "",
+            tool_calls: chat_message.tool_calls.map(&:to_tool_call)
+          }
+
+          chat_message.tool_calls.map(&:to_result).each do |fn_result|
+            # Handle nil explicitly to avoid serializing to "null"
+            output = fn_result[:output]
+            content = if output.nil?
+              ""
+            elsif output.is_a?(String)
+              output
+            else
+              output.to_json
+            end
+
+            messages << {
+              role: "tool",
+              tool_call_id: fn_result[:call_id],
+              name: fn_result[:name],
+              content: content
+            }
+          end
+
+        elsif !chat_message.content.blank?
+          messages << { role: chat_message.role, content: chat_message.content || "" }
+        end
+      end
+      messages
+    end
 end
diff --git a/app/models/assistant/token_estimator.rb b/app/models/assistant/token_estimator.rb
new file mode 100644
index 000000000..4f5e3fd60
--- /dev/null
+++ b/app/models/assistant/token_estimator.rb
@@ -0,0 +1,19 @@
+module Assistant::TokenEstimator
+  CHARS_PER_TOKEN = 4
+  SAFETY_FACTOR = 1.25
+
+  def self.estimate(value)
+    chars = char_length(value)
+    ((chars / CHARS_PER_TOKEN.to_f) * SAFETY_FACTOR).ceil
+  end
+
+  def self.char_length(value)
+    case value
+    when nil    then 0
+    when String then value.length
+    when Array  then value.sum { |v| char_length(v) }
+    when Hash   then value.to_json.length
+    else value.to_s.length
+    end
+  end
+end
diff --git a/app/models/assistant_message.rb b/app/models/assistant_message.rb
index 4b1a1404a..a40304d2c 100644
--- a/app/models/assistant_message.rb
+++ b/app/models/assistant_message.rb
@@ -7,6 +7,7 @@ class AssistantMessage < Message
 
   def append_text!(text)
     self.content += text
+    self.status = :complete if pending?
     save!
   end
 end
diff --git a/app/models/auth_config.rb b/app/models/auth_config.rb
index 7cb630966..7b4c9c7a4 100644
--- a/app/models/auth_config.rb
+++ b/app/models/auth_config.rb
@@ -74,7 +74,17 @@ class AuthConfig
     end
 
     def sso_providers
-      Rails.configuration.x.auth.sso_providers || []
+      if FeatureFlags.db_sso_providers?
+        # After boot, OmniAuth registers successfully configured providers into
+        # Rails.configuration.x.auth.sso_providers. Prefer that filtered list
+        # so we never render login buttons for providers that couldn't be
+        # registered (e.g., missing required fields in YAML fallback).
+        # Fall back to ProviderLoader for pre-boot contexts.
+        registered = Rails.configuration.x.auth.sso_providers
+        registered&.any? ? registered : ProviderLoader.load_providers
+      else
+        Rails.configuration.x.auth.sso_providers || []
+      end
     end
   end
 end
diff --git a/app/models/balance/base_calculator.rb b/app/models/balance/base_calculator.rb
index a1e43d99e..c8b090547 100644
--- a/app/models/balance/base_calculator.rb
+++ b/app/models/balance/base_calculator.rb
@@ -15,8 +15,7 @@ class Balance::BaseCalculator
     end
 
     def holdings_value_for_date(date)
-      @holdings_value_for_date ||= {}
-      @holdings_value_for_date[date] ||= sync_cache.get_holdings(date).sum(&:amount)
+      sync_cache.get_holdings_value(date)
     end
 
     def derive_cash_balance_on_date_from_total(total_balance:, date:)
diff --git a/app/models/balance/chart_series_builder.rb b/app/models/balance/chart_series_builder.rb
index 034f54c67..c8c733579 100644
--- a/app/models/balance/chart_series_builder.rb
+++ b/app/models/balance/chart_series_builder.rb
@@ -1,5 +1,5 @@
 class Balance::ChartSeriesBuilder
-  def initialize(account_ids:, currency:, period: Period.last_30_days, interval: "1 day", favorable_direction: "up")
+  def initialize(account_ids:, currency:, period: Period.last_30_days, interval: nil, favorable_direction: "up")
     @account_ids = account_ids
     @currency = currency
     @period = period
diff --git a/app/models/balance/reverse_calculator.rb b/app/models/balance/reverse_calculator.rb
index 35a774452..39b530178 100644
--- a/app/models/balance/reverse_calculator.rb
+++ b/app/models/balance/reverse_calculator.rb
@@ -12,6 +12,7 @@ class Balance::ReverseCalculator < Balance::BaseCalculator
       # Calculates in reverse-chronological order (End of day -> Start of day)
       account.current_anchor_date.downto(account.opening_anchor_date).map do |date|
         flows = flows_for_date(date)
+        valuation = sync_cache.get_valuation(date)
 
         if use_opening_anchor_for_date?(date)
           end_cash_balance = derive_cash_balance_on_date_from_total(
@@ -20,6 +21,21 @@ class Balance::ReverseCalculator < Balance::BaseCalculator
           )
           end_non_cash_balance = account.opening_anchor_balance - end_cash_balance
 
+          start_cash_balance = end_cash_balance
+          start_non_cash_balance = end_non_cash_balance
+          market_value_change = 0
+        elsif valuation && valuation.entryable.reconciliation?
+          # Reconciliation waypoint: reset to the known API-reported balance.
+          # These waypoints are created by CurrentBalanceManager when it preserves
+          # a stale current_anchor as a reconciliation before replacing it.
+          # We derive both cash and non-cash from the total to ensure the split
+          # reflects the account's cash ratio on that date.
+          end_cash_balance = derive_cash_balance_on_date_from_total(
+            total_balance: valuation.amount,
+            date: date
+          )
+          end_non_cash_balance = valuation.amount - end_cash_balance
+
           start_cash_balance = end_cash_balance
           start_non_cash_balance = end_non_cash_balance
           market_value_change = 0
@@ -73,9 +89,9 @@ class Balance::ReverseCalculator < Balance::BaseCalculator
       derive_non_cash_balance(end_non_cash_balance, date, direction: :reverse)
     end
 
-    # Reverse syncs are a bit different than forward syncs because we do not allow "reconciliation" valuations
-    # to be used at all. This is primarily to keep the code and the UI easy to understand. For a more detailed
-    # explanation, see the test suite.
+    # Checks if this date should use the opening anchor balance instead of deriving it.
+    # Only the opening_anchor_date itself gets this treatment — reconciliation waypoints
+    # are handled separately in the calculate loop above.
     def use_opening_anchor_for_date?(date)
       account.has_opening_anchor? && date == account.opening_anchor_date
     end
diff --git a/app/models/balance/sync_cache.rb b/app/models/balance/sync_cache.rb
index a6e12c9ee..58caf70ad 100644
--- a/app/models/balance/sync_cache.rb
+++ b/app/models/balance/sync_cache.rb
@@ -7,8 +7,8 @@ class Balance::SyncCache
     entries_by_date[date]&.find { |e| e.valuation? }
   end
 
-  def get_holdings(date)
-    holdings_by_date[date] || []
+  def get_holdings_value(date)
+    holdings_value_by_date[date] || 0
   end
 
   def get_entries(date)
@@ -22,33 +22,32 @@ class Balance::SyncCache
       @entries_by_date ||= converted_entries.group_by(&:date)
     end
 
-    def holdings_by_date
-      @holdings_by_date ||= converted_holdings.group_by(&:date)
+    def holdings_value_by_date
+      @holdings_value_by_date ||= account.holdings.each_with_object(Hash.new(0)) do |h, totals|
+        begin
+          converted = Money.new(h.amount, h.currency).exchange_to(account.currency, date: h.date).amount
+        rescue Money::ConversionError
+          converted = h.amount # fallback to 1:1 conversion rate if exchange rate unavailable
+        end
+        totals[h.date] += converted
+      end
     end
 
     def converted_entries
-      @converted_entries ||= account.entries.excluding_split_parents.order(:date).to_a.map do |e|
+      @converted_entries ||= account.entries.excluding_split_parents.includes(:entryable).order(:date).to_a.map do |e|
         converted_entry = e.dup
+
+        custom_rate = e.entryable.exchange_rate if e.entryable.respond_to?(:exchange_rate)
+
+        # Use Money#exchange_to with custom rate if available, standard lookup otherwise
         converted_entry.amount = converted_entry.amount_money.exchange_to(
           account.currency,
           date: e.date,
-          fallback_rate: 1
+          custom_rate: custom_rate
         ).amount
+
         converted_entry.currency = account.currency
         converted_entry
       end
     end
-
-    def converted_holdings
-      @converted_holdings ||= account.holdings.map do |h|
-        converted_holding = h.dup
-        converted_holding.amount = converted_holding.amount_money.exchange_to(
-          account.currency,
-          date: h.date,
-          fallback_rate: 1
-        ).amount
-        converted_holding.currency = account.currency
-        converted_holding
-      end
-    end
 end
diff --git a/app/models/balance_sheet/account_totals.rb b/app/models/balance_sheet/account_totals.rb
index d03340423..5c767687f 100644
--- a/app/models/balance_sheet/account_totals.rb
+++ b/app/models/balance_sheet/account_totals.rb
@@ -27,7 +27,14 @@ class BalanceSheet::AccountTotals
 
     def visible_accounts
       @visible_accounts ||= begin
-        scope = family.accounts.visible.with_attached_logo.includes(:account_shares)
+        scope = family.accounts.visible.with_attached_logo
+                  .includes(
+                    :account_shares,
+                    :accountable,
+                    :plaid_account,
+                    :simplefin_account,
+                    account_providers: :provider
+                  )
         scope = scope.accessible_by(user) if user
         scope
       end
diff --git a/app/models/balance_sheet/classification_group.rb b/app/models/balance_sheet/classification_group.rb
index 968d4b6c0..2efced22d 100644
--- a/app/models/balance_sheet/classification_group.rb
+++ b/app/models/balance_sheet/classification_group.rb
@@ -13,7 +13,7 @@ class BalanceSheet::ClassificationGroup
   end
 
   def name
-    classification.titleize.pluralize
+    I18n.t("pages.dashboard.balance_sheet.classifications.#{classification}", default: classification.titleize.pluralize)
   end
 
   def icon
@@ -34,7 +34,7 @@ class BalanceSheet::ClassificationGroup
                      .transform_keys { |at| Accountable.from_type(at) }
                      .map do |accountable, account_rows|
                        BalanceSheet::AccountGroup.new(
-                         name: I18n.t("accounts.types.#{accountable.name.underscore}", default: accountable.display_name),
+                         name: accountable.display_name,
                          color: accountable.color,
                          accountable_type: accountable,
                          accounts: account_rows,
diff --git a/app/models/binance_account/usd_converter.rb b/app/models/binance_account/usd_converter.rb
index 405a94775..96c582460 100644
--- a/app/models/binance_account/usd_converter.rb
+++ b/app/models/binance_account/usd_converter.rb
@@ -21,7 +21,7 @@ module BinanceAccount::UsdConverter
         return [ amount.to_d, true, nil ]
       end
 
-      converted = Money.new(amount, "USD").exchange_to(target_currency, fallback_rate: rate.rate).amount
+      converted = Money.new(amount, "USD").exchange_to(target_currency, custom_rate: rate.rate).amount
       stale     = rate.date != date
       rate_date = stale ? rate.date : nil
 
diff --git a/app/models/brex_account.rb b/app/models/brex_account.rb
new file mode 100644
index 000000000..743fcc01a
--- /dev/null
+++ b/app/models/brex_account.rb
@@ -0,0 +1,204 @@
+# frozen_string_literal: true
+
+class BrexAccount < ApplicationRecord
+  include CurrencyNormalizable, Encryptable
+
+  CARD_PRIMARY_ACCOUNT_ID = "card_primary"
+
+  if encryption_ready?
+    encrypts :raw_payload
+    encrypts :raw_transactions_payload
+  end
+
+  belongs_to :brex_item
+
+  has_one :account_provider, as: :provider, dependent: :destroy
+  has_one :account, through: :account_provider, source: :account
+
+  validates :name, :currency, presence: true
+  validates :account_id, uniqueness: { scope: :brex_item_id }
+  validates :account_kind, inclusion: { in: %w[cash card] }
+
+  def self.card_account_id
+    CARD_PRIMARY_ACCOUNT_ID
+  end
+
+  def self.kind_for(account_data)
+    return account_data.account_kind if account_data.respond_to?(:account_kind)
+
+    data = account_data.with_indifferent_access
+    kind = data[:account_kind].presence || data[:kind].presence || "cash"
+    kind.to_s == "credit_card" ? "card" : kind.to_s
+  end
+
+  def self.name_for(account_data)
+    data = account_data.with_indifferent_access
+    kind = kind_for(data)
+
+    if kind == "card"
+      data[:name].presence || I18n.t("brex_items.default_card_name", default: "Brex Card")
+    else
+      data[:name].presence || data[:display_name].presence || I18n.t("brex_items.default_cash_name", id: data[:id], default: "Brex Cash #{data[:id]}")
+    end
+  end
+
+  def self.currency_for(account_data)
+    data = account_data.with_indifferent_access
+    currency_code_from_money(data[:current_balance] || data[:available_balance] || data[:account_limit])
+  end
+
+  def self.default_account_type_for(account_data)
+    kind_for(account_data) == "card" ? "CreditCard" : "Depository"
+  end
+
+  def self.default_accountable_attributes(accountable_type)
+    case accountable_type
+    when "CreditCard"
+      { subtype: CreditCard::DEFAULT_SUBTYPE }
+    when "Depository"
+      { subtype: Depository::DEFAULT_SUBTYPE }
+    else
+      {}
+    end
+  end
+
+  def self.money_to_decimal(money_payload)
+    return nil if money_payload.blank?
+
+    payload = money_payload.is_a?(Hash) ? money_payload.with_indifferent_access : { amount: money_payload, currency: "USD" }
+    amount = payload[:amount]
+    return nil if amount.nil?
+
+    currency = currency_code_from_money(payload)
+    divisor = Money::Currency.new(currency).minor_unit_conversion
+    BigDecimal(amount.to_s) / BigDecimal(divisor.to_s)
+  rescue Money::Currency::UnknownCurrencyError, ArgumentError
+    Rails.logger.warn("Invalid Brex money payload #{money_payload.inspect}, defaulting conversion to USD")
+    begin
+      safe_amount = BigDecimal(payload[:amount].to_s)
+      safe_amount / BigDecimal(Money::Currency.new("USD").minor_unit_conversion.to_s)
+    rescue ArgumentError, TypeError
+      BigDecimal("0")
+    end
+  end
+
+  def self.currency_code_from_money(money_payload)
+    payload = money_payload.is_a?(Hash) ? money_payload.with_indifferent_access : {}
+    currency = payload[:currency].presence || "USD"
+    Money::Currency.new(currency).iso_code
+  rescue Money::Currency::UnknownCurrencyError
+    "USD"
+  end
+
+  def self.sanitize_payload(payload)
+    case payload
+    when Array
+      payload.map { |value| sanitize_payload(value) }
+    when Hash
+      payload.each_with_object({}) do |(key, value), sanitized|
+        key_string = key.to_s
+        normalized_key = key_string.downcase
+
+        if sensitive_number_key?(normalized_key)
+          sanitized["#{key_string}_last4"] = last_four(value)
+        elsif normalized_key == "card_metadata"
+          sanitized[key_string] = sanitize_card_metadata(value)
+        elsif sensitive_secret_key?(normalized_key)
+          sanitized[key_string] = "[FILTERED]"
+        else
+          sanitized[key_string] = sanitize_payload(value)
+        end
+      end
+    else
+      payload
+    end
+  end
+
+  def self.last_four(value)
+    digits = value.to_s.gsub(/\D/, "")
+    digits.last(4) if digits.present?
+  end
+
+  def self.sanitize_card_metadata(value)
+    return nil unless value.is_a?(Hash)
+
+    metadata = value.with_indifferent_access
+    {
+      "card_id" => metadata[:card_id].presence || metadata[:id].presence,
+      "card_name" => metadata[:card_name].presence || metadata[:name].presence,
+      "card_type" => metadata[:card_type].presence || metadata[:type].presence,
+      "last_four" => last_four(metadata[:last_four].presence || metadata[:last4].presence || metadata[:card_last_four].presence)
+    }.compact
+  end
+
+  def current_account
+    account
+  end
+
+  def linked_account
+    account
+  end
+
+  def cash?
+    account_kind == "cash"
+  end
+
+  def card?
+    account_kind == "card"
+  end
+
+  def upsert_brex_snapshot!(account_snapshot)
+    snapshot = account_snapshot.with_indifferent_access
+    kind = snapshot[:account_kind].presence || snapshot[:kind].presence || "cash"
+    kind = "card" if kind.to_s == "credit_card"
+
+    update!(
+      current_balance: self.class.money_to_decimal(snapshot[:current_balance]),
+      available_balance: self.class.money_to_decimal(snapshot[:available_balance]),
+      account_limit: self.class.money_to_decimal(snapshot[:account_limit]),
+      currency: self.class.currency_code_from_money(snapshot[:current_balance] || snapshot[:available_balance] || snapshot[:account_limit]),
+      name: self.class.name_for(snapshot.merge(account_kind: kind)),
+      account_id: snapshot[:id]&.to_s,
+      account_kind: kind,
+      account_status: snapshot[:status],
+      account_type: snapshot[:type],
+      provider: "brex",
+      institution_metadata: build_institution_metadata(snapshot, kind),
+      raw_payload: self.class.sanitize_payload(account_snapshot)
+    )
+  end
+
+  def upsert_brex_transactions_snapshot!(transactions_snapshot)
+    update!(
+      raw_transactions_payload: self.class.sanitize_payload(transactions_snapshot)
+    )
+  end
+
+  private
+
+    def self.sensitive_number_key?(normalized_key)
+      normalized_key.in?(%w[account_number routing_number pan primary_account_number card_number])
+    end
+
+    def self.sensitive_secret_key?(normalized_key)
+      normalized_key.include?("token") ||
+        normalized_key.include?("secret") ||
+        normalized_key.in?(%w[api_key access_key authorization cvc cvv security_code])
+    end
+    private_class_method :sensitive_number_key?, :sensitive_secret_key?
+
+    def build_institution_metadata(snapshot, kind)
+      {
+        name: "Brex",
+        domain: "brex.com",
+        url: "https://brex.com",
+        account_kind: kind,
+        account_type: snapshot[:type],
+        primary: snapshot[:primary],
+        account_number_last4: self.class.last_four(snapshot[:account_number]),
+        routing_number_last4: self.class.last_four(snapshot[:routing_number]),
+        status: snapshot[:status],
+        current_statement_period: self.class.sanitize_payload(snapshot[:current_statement_period])
+      }.compact
+    end
+end
diff --git a/app/models/brex_account/processor.rb b/app/models/brex_account/processor.rb
new file mode 100644
index 000000000..67c8a4a7b
--- /dev/null
+++ b/app/models/brex_account/processor.rb
@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+class BrexAccount::Processor
+  include CurrencyNormalizable
+
+  attr_reader :brex_account
+
+  def initialize(brex_account)
+    @brex_account = brex_account
+  end
+
+  def process
+    unless brex_account.current_account.present?
+      Rails.logger.info "BrexAccount::Processor - No linked account for brex_account #{brex_account.id}, skipping processing"
+      return
+    end
+
+    process_account!
+    process_transactions
+  rescue StandardError => e
+    Rails.logger.error "BrexAccount::Processor - Failed to process account #{brex_account.id}: #{e.message}"
+    report_exception(e, "account")
+    raise
+  end
+
+  private
+
+    def process_account!
+      account = brex_account.current_account
+      balance = brex_account.current_balance
+      currency = parse_currency(brex_account.currency)
+
+      if balance.nil?
+        Rails.logger.warn "BrexAccount::Processor - current_balance is nil for brex_account #{brex_account.id}, defaulting to 0"
+        balance = 0
+      end
+
+      if currency.nil?
+        Rails.logger.warn "BrexAccount::Processor - currency parse failed for brex_account #{brex_account.id}: #{brex_account.currency.inspect}, defaulting to USD"
+        Sentry.capture_message("BrexAccount currency parse failed", level: :warning) do |scope|
+          scope.set_tags(brex_account_id: brex_account.id)
+          scope.set_context("brex_account", {
+            id: brex_account.id,
+            currency: brex_account.currency
+          })
+        end
+        currency = "USD"
+      end
+
+      account.update!(
+        balance: balance,
+        cash_balance: balance,
+        currency: currency
+      )
+
+      if account.accountable_type == "CreditCard" && brex_account.available_balance.present?
+        account.accountable.update!(available_credit: brex_account.available_balance)
+      end
+    end
+
+    # Transaction import errors are logged and swallowed so balance sync can continue.
+    def process_transactions
+      BrexAccount::Transactions::Processor.new(brex_account).process
+    rescue StandardError => e
+      Rails.logger.error "BrexAccount::Processor - Failed to process transactions for brex_account #{brex_account.id}: #{e.message}"
+      Rails.logger.error Array(e.backtrace).first(10).join("\n")
+      report_exception(e, "transactions")
+    end
+
+    def report_exception(error, context)
+      Sentry.capture_exception(error) do |scope|
+        scope.set_tags(
+          brex_account_id: brex_account.id,
+          context: context
+        )
+      end
+    end
+end
diff --git a/app/models/brex_account/transactions/processor.rb b/app/models/brex_account/transactions/processor.rb
new file mode 100644
index 000000000..da0a81e17
--- /dev/null
+++ b/app/models/brex_account/transactions/processor.rb
@@ -0,0 +1,83 @@
+class BrexAccount::Transactions::Processor
+  attr_reader :brex_account
+
+  def initialize(brex_account)
+    @brex_account = brex_account
+  end
+
+  def process
+    unless brex_account.raw_transactions_payload.present?
+      Rails.logger.info "BrexAccount::Transactions::Processor - No transactions in raw_transactions_payload for brex_account #{brex_account.id}"
+      return { success: true, total: 0, imported: 0, skipped: 0, failed: 0, errors: [], skipped_transactions: [] }
+    end
+
+    total_count = brex_account.raw_transactions_payload.count
+    Rails.logger.info "BrexAccount::Transactions::Processor - Processing #{total_count} transactions for brex_account #{brex_account.id}"
+
+    imported_count = 0
+    failed_count = 0
+    skipped_count = 0
+    errors = []
+    skipped = []
+
+    # Each entry is processed inside a transaction, but to avoid locking up the DB when
+    # there are hundreds or thousands of transactions, we process them individually.
+    brex_account.raw_transactions_payload.each_with_index do |transaction_data, index|
+      begin
+        result = BrexEntry::Processor.new(
+          transaction_data,
+          brex_account: brex_account
+        ).process
+
+        if result == :skipped
+          skipped_count += 1
+          skipped << { index: index, transaction_id: transaction_id_for(transaction_data), reason: "No linked account" }
+        elsif result.nil?
+          failed_count += 1
+          errors << { index: index, transaction_id: transaction_id_for(transaction_data), error: "No transaction imported" }
+        else
+          imported_count += 1
+        end
+      rescue ArgumentError => e
+        # Validation error - log and continue
+        failed_count += 1
+        transaction_id = transaction_id_for(transaction_data)
+        error_message = "Validation error: #{e.message}"
+        Rails.logger.error "BrexAccount::Transactions::Processor - #{error_message} (transaction #{transaction_id})"
+        errors << { index: index, transaction_id: transaction_id, error: error_message }
+      rescue => e
+        # Unexpected error - log with full context and continue
+        failed_count += 1
+        transaction_id = transaction_id_for(transaction_data)
+        error_message = "#{e.class}: #{e.message}"
+        Rails.logger.error "BrexAccount::Transactions::Processor - Error processing transaction #{transaction_id}: #{error_message}"
+        Rails.logger.error Array(e.backtrace).first(10).join("\n")
+        errors << { index: index, transaction_id: transaction_id, error: error_message }
+      end
+    end
+
+    result = {
+      success: failed_count == 0,
+      total: total_count,
+      imported: imported_count,
+      skipped: skipped_count,
+      failed: failed_count,
+      errors: errors,
+      skipped_transactions: skipped
+    }
+
+    if failed_count > 0
+      Rails.logger.warn "BrexAccount::Transactions::Processor - Completed with #{failed_count} failures out of #{total_count} transactions"
+    else
+      Rails.logger.info "BrexAccount::Transactions::Processor - Successfully processed #{imported_count} transactions"
+    end
+
+    result
+  end
+
+  private
+
+    def transaction_id_for(transaction_data)
+      transaction_data&.dig(:id) || transaction_data&.dig("id") || "unknown"
+    end
+end
diff --git a/app/models/brex_entry/processor.rb b/app/models/brex_entry/processor.rb
new file mode 100644
index 000000000..03bbb8689
--- /dev/null
+++ b/app/models/brex_entry/processor.rb
@@ -0,0 +1,180 @@
+# frozen_string_literal: true
+
+require "digest/md5"
+
+class BrexEntry::Processor
+  include CurrencyNormalizable
+
+  def initialize(brex_transaction, brex_account:)
+    @brex_transaction = brex_transaction
+    @brex_account = brex_account
+  end
+
+  def process
+    cached_external_id = nil
+    cached_external_id = external_id
+
+    unless account.present?
+      Rails.logger.warn "BrexEntry::Processor - No linked account for brex_account #{brex_account.id}, skipping transaction #{cached_external_id}"
+      return :skipped
+    end
+
+    import_adapter.import_transaction(
+      external_id: cached_external_id,
+      amount: amount,
+      currency: currency,
+      date: date,
+      name: name,
+      source: "brex",
+      merchant: merchant,
+      notes: notes,
+      extra: extra
+    )
+  rescue ArgumentError => e
+    Rails.logger.error "BrexEntry::Processor - Validation error for transaction #{cached_external_id || safe_external_id}: #{e.message}"
+    raise
+  rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotSaved => e
+    Rails.logger.error "BrexEntry::Processor - Failed to save transaction #{cached_external_id || safe_external_id}: #{e.message}"
+    raise StandardError.new("Failed to import transaction: #{e.message}")
+  rescue => e
+    Rails.logger.error "BrexEntry::Processor - Unexpected error processing transaction #{cached_external_id || safe_external_id}: #{e.class} - #{e.message}"
+    Rails.logger.error Array(e.backtrace).join("\n")
+    raise StandardError.new("Unexpected error importing transaction: #{e.message}")
+  end
+
+  private
+    attr_reader :brex_transaction, :brex_account
+
+    def import_adapter
+      @import_adapter ||= Account::ProviderImportAdapter.new(account)
+    end
+
+    def account
+      @account ||= brex_account.current_account
+    end
+
+    def data
+      @data ||= brex_transaction.with_indifferent_access
+    end
+
+    def external_id
+      id = data[:id].presence
+      raise ArgumentError, "Brex transaction missing required field 'id'" unless id
+
+      "brex_#{id}"
+    end
+
+    def safe_external_id
+      external_id
+    rescue ArgumentError
+      "brex_unknown"
+    end
+
+    def name
+      data[:description].presence ||
+        merchant_payload[:raw_descriptor].presence ||
+        merchant_payload[:name].presence ||
+        I18n.t("brex_items.entries.default_name")
+    end
+
+    def notes
+      note_parts = []
+      note_parts << data[:type] if data[:type].present?
+      note_parts << data[:expense_id] if data[:expense_id].present?
+      note_parts.any? ? note_parts.join(" - ") : nil
+    end
+
+    def merchant
+      merchant_name = merchant_payload[:raw_descriptor].presence || merchant_payload[:name].presence
+      return @merchant if instance_variable_defined?(:@merchant)
+      return @merchant = nil if merchant_name.blank?
+
+      merchant_name = merchant_name.to_s.strip
+      return @merchant = nil if merchant_name.blank?
+
+      merchant_id = Digest::MD5.hexdigest(merchant_name.downcase)
+
+      @merchant = import_adapter.find_or_create_merchant(
+        provider_merchant_id: "brex_merchant_#{merchant_id}",
+        name: merchant_name,
+        source: "brex"
+      )
+    rescue ActiveRecord::RecordInvalid => e
+      Rails.logger.error "BrexEntry::Processor - Failed to create merchant '#{merchant_name}': #{e.message}"
+      @merchant = nil
+    end
+
+    def merchant_payload
+      @merchant_payload ||= begin
+        payload = data[:merchant]
+        payload.is_a?(Hash) ? payload.with_indifferent_access : {}
+      end
+    end
+
+    def amount
+      BrexAccount.money_to_decimal(data[:amount]) || BigDecimal("0")
+    rescue ArgumentError => e
+      Rails.logger.error "Failed to parse Brex transaction amount: #{data[:amount].inspect} - #{e.message}"
+      raise
+    end
+
+    def currency
+      amount_currency = transaction_amount_currency
+      log_invalid_currency(amount_currency) if amount_currency.blank? && data[:amount].present?
+
+      parse_currency(amount_currency) ||
+        parse_currency(brex_account.currency) ||
+        "USD"
+    end
+
+    def transaction_amount_currency
+      amount_payload = data[:amount]
+      return nil unless amount_payload.is_a?(Hash)
+
+      amount_payload.with_indifferent_access[:currency]
+    end
+
+    def log_invalid_currency(currency_value)
+      Rails.logger.warn(
+        "Invalid Brex currency #{currency_value.inspect} for transaction #{data[:id].presence || 'unknown'} " \
+        "on brex_account #{brex_account.id} amount=#{data[:amount].inspect} account_currency=#{brex_account.currency.inspect}; defaulting to fallback"
+      )
+    end
+
+    def date
+      date_value = data[:posted_at_date].presence || data[:initiated_at_date].presence
+
+      case date_value
+      when String
+        Date.parse(date_value)
+      when Integer, Float
+        Time.at(date_value).to_date
+      when Time, DateTime
+        date_value.to_date
+      when Date
+        date_value
+      else
+        raise ArgumentError, "Invalid date format: #{date_value.inspect}"
+      end
+    rescue ArgumentError, TypeError => e
+      Rails.logger.error("Failed to parse Brex transaction date '#{date_value}': #{e.message}")
+      raise ArgumentError, "Unable to parse transaction date: #{date_value.inspect}"
+    end
+
+    def extra
+      {
+        brex: {
+          transaction_id: data[:id],
+          account_kind: brex_account.account_kind,
+          type: data[:type],
+          card_id: data[:card_id],
+          transfer_id: data[:transfer_id],
+          expense_id: data[:expense_id],
+          card_transaction_operation_reference_id: data[:card_transaction_operation_reference_id],
+          initiated_at_date: data[:initiated_at_date],
+          posted_at_date: data[:posted_at_date],
+          merchant: BrexAccount.sanitize_payload(data[:merchant])
+        }.compact
+      }
+    end
+end
diff --git a/app/models/brex_item.rb b/app/models/brex_item.rb
new file mode 100644
index 000000000..865797e65
--- /dev/null
+++ b/app/models/brex_item.rb
@@ -0,0 +1,197 @@
+class BrexItem < ApplicationRecord
+  include Syncable, Provided, Unlinking, Encryptable
+
+  BLANK_TOKEN_SENTINELS = [ "", " ", "  ", "   ", "\t", "\n", "\r" ].freeze
+
+  enum :status, { good: "good", requires_update: "requires_update" }, default: :good
+
+  if encryption_ready?
+    encrypts :token, deterministic: true
+    encrypts :raw_payload
+  end
+
+  validates :name, presence: true
+  validates :token, presence: true, on: :create
+  validate :base_url_must_be_official_brex_url
+  validate :token_cannot_be_blank_when_changed
+  before_validation :normalize_token
+  before_validation :normalize_base_url
+
+  belongs_to :family
+  has_one_attached :logo, dependent: :purge_later
+
+  has_many :brex_accounts, dependent: :destroy
+  has_many :accounts, through: :brex_accounts
+
+  scope :active, -> { where(scheduled_for_deletion: false) }
+  scope :syncable, -> { active }
+  scope :ordered, -> { order(created_at: :desc) }
+  scope :needs_update, -> { where(status: :requires_update) }
+  scope :with_credentials, -> { where.not(token: [ nil, *BLANK_TOKEN_SENTINELS ]).where("BTRIM(token) <> ''") }
+
+  def self.resolve_for(family:, brex_item_id: nil)
+    normalized_id = brex_item_id.to_s.strip.presence
+
+    if normalized_id.present?
+      return family.brex_items.active.with_credentials.find_by(id: normalized_id)
+    end
+
+    credentialed_items = family.brex_items.active.with_credentials.ordered
+    credentialed_items.first if credentialed_items.one?
+  end
+
+  def destroy_later
+    update!(scheduled_for_deletion: true)
+    DestroyJob.perform_later(self)
+  end
+
+  def import_latest_brex_data(sync_start_date: nil)
+    provider = brex_provider
+    unless provider
+      Rails.logger.error "BrexItem #{id} - Cannot import: provider is not configured"
+      raise Provider::Brex::BrexError.new("Brex provider is not configured", :not_configured)
+    end
+
+    BrexItem::Importer.new(self, brex_provider: provider, sync_start_date: sync_start_date).import
+  rescue => e
+    Rails.logger.error "BrexItem #{id} - Failed to import data: #{e.message}"
+    raise
+  end
+
+  def process_accounts
+    return [] if brex_accounts.empty?
+
+    results = []
+    brex_accounts.joins(:account).includes(:account).merge(Account.visible).each do |brex_account|
+      begin
+        result = BrexAccount::Processor.new(brex_account).process
+        results << { brex_account_id: brex_account.id, success: true, result: result }
+      rescue => e
+        Rails.logger.error "BrexItem #{id} - Failed to process account #{brex_account.id}: #{e.message}"
+        results << { brex_account_id: brex_account.id, success: false, error: e.message }
+      end
+    end
+
+    results
+  end
+
+  def schedule_account_syncs(parent_sync: nil, window_start_date: nil, window_end_date: nil)
+    return [] if accounts.empty?
+
+    results = []
+    accounts.visible.each do |account|
+      begin
+        account.sync_later(
+          parent_sync: parent_sync,
+          window_start_date: window_start_date,
+          window_end_date: window_end_date
+        )
+        results << { account_id: account.id, success: true }
+      rescue => e
+        Rails.logger.error "BrexItem #{id} - Failed to schedule sync for account #{account.id}: #{e.message}"
+        results << { account_id: account.id, success: false, error: e.message }
+      end
+    end
+
+    results
+  end
+
+  def upsert_brex_snapshot!(accounts_snapshot)
+    update!(raw_payload: BrexAccount.sanitize_payload(accounts_snapshot))
+  end
+
+  def has_completed_initial_setup?
+    # Setup is complete if we have any linked accounts
+    accounts.any?
+  end
+
+  def sync_status_summary
+    total_accounts = total_accounts_count
+    linked_count = linked_accounts_count
+    unlinked_count = unlinked_accounts_count
+
+    if total_accounts == 0
+      I18n.t("brex_items.sync_status.no_accounts")
+    elsif unlinked_count == 0
+      I18n.t("brex_items.sync_status.all_synced", count: linked_count)
+    else
+      I18n.t("brex_items.sync_status.partial_setup", synced: linked_count, pending: unlinked_count)
+    end
+  end
+
+  def linked_accounts_count
+    brex_accounts.joins(:account_provider).count
+  end
+
+  def unlinked_accounts_count
+    brex_accounts.left_joins(:account_provider).where(account_providers: { id: nil }).count
+  end
+
+  def total_accounts_count
+    brex_accounts.count
+  end
+
+  def institution_display_name
+    institution_name.presence || institution_domain.presence || name
+  end
+
+  def connected_institutions
+    brex_accounts.where.not(institution_metadata: nil)
+                 .pluck(:institution_metadata)
+                 .compact
+                 .uniq { |inst| inst["name"] || inst["institution_name"] }
+  end
+
+  def institution_summary
+    institutions = connected_institutions
+    case institutions.count
+    when 0
+      I18n.t("brex_items.institution_summary.none")
+    when 1
+      name = institutions.first["name"] ||
+             institutions.first["institution_name"] ||
+             I18n.t("brex_items.institution_summary.count", count: 1)
+      I18n.t("brex_items.institution_summary.one", name: name)
+    else
+      I18n.t("brex_items.institution_summary.count", count: institutions.count)
+    end
+  end
+
+  def credentials_configured?
+    token.to_s.strip.present?
+  end
+
+  def effective_base_url
+    return Provider::Brex::DEFAULT_BASE_URL if base_url.blank?
+
+    Provider::Brex.normalize_base_url(base_url)
+  end
+
+  private
+    def normalize_token
+      self.token = token&.strip
+    end
+
+    def token_cannot_be_blank_when_changed
+      return unless persisted? && will_save_change_to_token? && token.blank?
+
+      errors.add(:token, :blank)
+    end
+
+    def normalize_base_url
+      stripped = base_url.to_s.strip
+      if stripped.blank?
+        self.base_url = nil
+        return
+      end
+
+      normalized = Provider::Brex.normalize_base_url(stripped)
+      self.base_url = normalized if normalized.present?
+    end
+
+    def base_url_must_be_official_brex_url
+      return if base_url.blank? || Provider::Brex.allowed_base_url?(base_url)
+
+      errors.add(:base_url, :official_hosts_only)
+    end
+end
diff --git a/app/models/brex_item/account_flow.rb b/app/models/brex_item/account_flow.rb
new file mode 100644
index 000000000..7fc08ed0d
--- /dev/null
+++ b/app/models/brex_item/account_flow.rb
@@ -0,0 +1,425 @@
+# frozen_string_literal: true
+
+class BrexItem::AccountFlow
+  require_dependency "brex_item/account_flow/setup"
+
+  include Setup
+
+  CACHE_TTL = 5.minutes
+
+  class NoApiTokenError < StandardError; end
+  class AccountNotFoundError < StandardError; end
+  class InvalidAccountNameError < StandardError; end
+  class AccountAlreadyLinkedError < StandardError; end
+
+  NavigationResult = Data.define(:target, :flash_type, :message)
+
+  SelectionResult = Data.define(:status, :brex_item, :available_accounts, :accountable_type, :message) do
+    def success? = status == :success
+    def setup_required? = status == :setup_required
+    def provider_error? = status.in?([ :api_error, :unexpected_error ])
+  end
+
+  LinkAccountsResult = Data.define(:created_accounts, :already_linked_names, :invalid_account_ids) do
+    def created_count = created_accounts.count
+    def already_linked_count = already_linked_names.count
+    def invalid_count = invalid_account_ids.count
+  end
+
+  SetupResult = Data.define(:created_accounts, :skipped_count, :failed_count) do
+    def created_count = created_accounts.count
+  end
+
+  SetupCompletion = Data.define(:success, :message) do
+    def success? = success
+  end
+
+  attr_reader :family, :brex_item_id, :brex_item, :credentialed_items
+
+  def initialize(family:, brex_item_id: nil, brex_item: nil)
+    @family = family
+    @brex_item_id = brex_item_id.to_s.strip.presence
+    @credentialed_items = family.brex_items.active.with_credentials.ordered
+    @brex_item = brex_item || BrexItem.resolve_for(family: family, brex_item_id: @brex_item_id)
+  end
+
+  def self.cache_key(family, brex_item)
+    "brex_accounts_#{family.id}_#{brex_item.id}"
+  end
+
+  def self.cache_sensitive_update?(permitted_params)
+    permitted_params.key?(:token) || permitted_params.key?(:base_url)
+  end
+
+  def self.update_item_with_cache_expiration(brex_item, family:, attributes:)
+    expire_accounts_cache = cache_sensitive_update?(attributes)
+    updated = brex_item.update(attributes)
+
+    Rails.cache.delete(cache_key(family, brex_item)) if updated && expire_accounts_cache
+
+    updated
+  end
+
+  def selected?
+    brex_item.present?
+  end
+
+  def selection_required?
+    credentialed_items.count > 1 && brex_item_id.blank?
+  end
+
+  def preload_payload
+    return selection_error_payload if !selected?
+    return { success: false, error: "no_credentials", has_accounts: false } unless brex_item.credentials_configured?
+
+    cached_accounts = Rails.cache.read(cache_key)
+    cached = !cached_accounts.nil?
+    available_accounts = cached ? cached_accounts : fetch_and_cache_accounts
+
+    { success: true, has_accounts: available_accounts.any?, cached: cached }
+  rescue NoApiTokenError
+    { success: false, error: "no_api_token", has_accounts: false }
+  rescue Provider::Brex::BrexError => e
+    Rails.logger.error("Brex preload error: #{e.message}")
+    { success: false, error: "api_error", error_message: e.message, has_accounts: nil }
+  rescue StandardError => e
+    Rails.logger.error("Unexpected error preloading Brex accounts: #{e.class}: #{e.message}")
+    { success: false, error: "unexpected_error", error_message: I18n.t("brex_items.errors.unexpected_error"), has_accounts: nil }
+  end
+
+  def select_accounts_result(accountable_type:)
+    selection_result_for(
+      scope: "brex_items.select_accounts",
+      accountable_type: accountable_type,
+      empty_message_key: "no_accounts_found",
+      log_context: "select_accounts"
+    )
+  end
+
+  def select_existing_account_result(account:)
+    return linked_account_result if account.account_providers.exists?
+
+    selection_result_for(
+      scope: "brex_items.select_existing_account",
+      accountable_type: account.accountable_type,
+      empty_message_key: "all_accounts_already_linked",
+      log_context: "select_existing_account"
+    )
+  end
+
+  def link_new_accounts_result(account_ids:, accountable_type:)
+    return navigation(:new_account, :alert, I18n.t("brex_items.link_accounts.no_accounts_selected")) if account_ids.blank?
+    return navigation(:new_account, :alert, I18n.t("brex_items.link_accounts.invalid_account_type")) unless supported_account_type?(accountable_type)
+    return navigation(:settings_providers, :alert, I18n.t("brex_items.link_accounts.select_connection")) unless selected?
+
+    link_navigation_result(link_new_accounts!(account_ids: account_ids, accountable_type: accountable_type))
+  rescue NoApiTokenError
+    navigation(:new_account, :alert, I18n.t("brex_items.link_accounts.no_api_token"))
+  rescue Provider::Brex::BrexError => e
+    navigation(:new_account, :alert, I18n.t("brex_items.link_accounts.api_error", message: e.message))
+  rescue StandardError => e
+    Rails.logger.error("Brex account linking failed: #{e.class} - #{e.message}")
+    Rails.logger.error(Array(e.backtrace).first(10).join("\n"))
+    navigation(:new_account, :alert, I18n.t("brex_items.errors.unexpected_error"))
+  end
+
+  def link_existing_account_result(account:, brex_account_id:)
+    return navigation(:accounts, :alert, I18n.t("brex_items.link_existing_account.missing_parameters")) if account.blank? || brex_account_id.blank?
+    return navigation(:accounts, :alert, I18n.t("brex_items.link_existing_account.account_already_linked")) if account.account_providers.exists?
+    return navigation(:settings_providers, :alert, I18n.t("brex_items.link_existing_account.select_connection")) unless selected?
+
+    link_existing_account!(account: account, brex_account_id: brex_account_id)
+
+    navigation(:return_to_or_accounts, :notice, I18n.t("brex_items.link_existing_account.success", account_name: account.name))
+  rescue NoApiTokenError
+    navigation(:accounts, :alert, I18n.t("brex_items.link_existing_account.no_api_token"))
+  rescue AccountNotFoundError
+    navigation(:accounts, :alert, I18n.t("brex_items.link_existing_account.provider_account_not_found"))
+  rescue InvalidAccountNameError
+    navigation(:accounts, :alert, I18n.t("brex_items.link_existing_account.invalid_account_name"))
+  rescue AccountAlreadyLinkedError
+    navigation(:accounts, :alert, I18n.t("brex_items.link_existing_account.provider_account_already_linked"))
+  rescue Provider::Brex::BrexError => e
+    navigation(:accounts, :alert, I18n.t("brex_items.link_existing_account.api_error", message: e.message))
+  rescue StandardError => e
+    Rails.logger.error("Brex existing account linking failed: #{e.class} - #{e.message}")
+    Rails.logger.error(Array(e.backtrace).first(10).join("\n"))
+    navigation(:accounts, :alert, I18n.t("brex_items.errors.unexpected_error"))
+  end
+
+  def link_new_accounts!(account_ids:, accountable_type:)
+    raise ArgumentError, "Unsupported Brex account type: #{accountable_type}" unless supported_account_type?(accountable_type)
+
+    created_accounts = []
+    already_linked_names = []
+    invalid_account_ids = []
+    accounts_by_id = indexed_accounts
+
+    ActiveRecord::Base.transaction do
+      account_ids.each do |account_id|
+        account_data = accounts_by_id[account_id.to_s]
+        next unless account_data
+
+        account_name = BrexAccount.name_for(account_data)
+
+        if account_name.blank?
+          invalid_account_ids << account_id
+          Rails.logger.warn "BrexItem::AccountFlow - Skipping account #{account_id} with blank name"
+          next
+        end
+
+        brex_account = upsert_brex_account!(account_id, account_data)
+
+        if brex_account.account_provider.present?
+          already_linked_names << account_name
+          next
+        end
+
+        account = Account.create_and_sync(
+          {
+            family: family,
+            name: account_name,
+            balance: 0,
+            currency: BrexAccount.currency_for(account_data),
+            accountable_type: accountable_type,
+            accountable_attributes: BrexAccount.default_accountable_attributes(accountable_type)
+          },
+          skip_initial_sync: true
+        )
+
+        AccountProvider.create!(account: account, provider: brex_account)
+        created_accounts << account
+      end
+    end
+
+    brex_item.sync_later if created_accounts.any?
+
+    LinkAccountsResult.new(
+      created_accounts: created_accounts,
+      already_linked_names: already_linked_names,
+      invalid_account_ids: invalid_account_ids
+    )
+  end
+
+  def link_existing_account!(account:, brex_account_id:)
+    account_data = indexed_accounts[brex_account_id.to_s]
+    raise AccountNotFoundError unless account_data
+
+    account_name = BrexAccount.name_for(account_data)
+    raise InvalidAccountNameError if account_name.blank?
+
+    brex_account = nil
+
+    ActiveRecord::Base.transaction do
+      brex_account = upsert_brex_account!(brex_account_id, account_data)
+      raise AccountAlreadyLinkedError if brex_account.account_provider.present?
+
+      AccountProvider.create!(account: account, provider: brex_account)
+    end
+
+    brex_item.sync_later
+
+    brex_account
+  end
+
+  private
+
+    def selection_error_payload
+      if brex_item_id.present?
+        return {
+          success: false,
+          error: "select_connection",
+          error_message: I18n.t("brex_items.select_accounts.select_connection"),
+          has_accounts: nil
+        }
+      end
+
+      return { success: false, error: "no_credentials", has_accounts: false } unless selection_required?
+
+      {
+        success: false,
+        error: "select_connection",
+        error_message: I18n.t("brex_items.select_accounts.select_connection"),
+        has_accounts: nil
+      }
+    end
+
+    def selection_failure_result(scope, accountable_type: nil)
+      if selection_required?
+        SelectionResult.new(
+          status: :select_connection,
+          brex_item: nil,
+          available_accounts: [],
+          accountable_type: accountable_type,
+          message: I18n.t("#{scope}.select_connection")
+        )
+      else
+        SelectionResult.new(
+          status: :setup_required,
+          brex_item: nil,
+          available_accounts: [],
+          accountable_type: accountable_type,
+          message: I18n.t("#{scope}.no_credentials_configured")
+        )
+      end
+    end
+
+    def selection_result_for(scope:, accountable_type:, empty_message_key:, log_context:)
+      return selection_failure_result(scope, accountable_type: accountable_type) unless selected?
+
+      available_accounts = filter_accounts(unlinked_available_accounts, accountable_type)
+      if available_accounts.empty?
+        return selection_result(
+          status: :empty,
+          accountable_type: accountable_type,
+          message: I18n.t("#{scope}.#{empty_message_key}")
+        )
+      end
+
+      selection_result(status: :success, accountable_type: accountable_type, available_accounts: available_accounts)
+    rescue NoApiTokenError
+      selection_result(
+        status: :no_api_token,
+        accountable_type: accountable_type,
+        message: I18n.t("#{scope}.no_api_token")
+      )
+    rescue Provider::Brex::BrexError => e
+      Rails.logger.error("Brex API error in #{log_context}: #{e.message}")
+      selection_result(status: :api_error, accountable_type: accountable_type, message: e.message)
+    rescue StandardError => e
+      Rails.logger.error("Unexpected error in #{log_context}: #{e.class}: #{e.message}")
+      selection_result(
+        status: :unexpected_error,
+        accountable_type: accountable_type,
+        message: I18n.t("#{scope}.unexpected_error")
+      )
+    end
+
+    def selection_result(status:, accountable_type:, available_accounts: [], message: nil)
+      SelectionResult.new(
+        status: status,
+        brex_item: brex_item,
+        available_accounts: available_accounts,
+        accountable_type: accountable_type,
+        message: message
+      )
+    end
+
+    def linked_account_result
+      SelectionResult.new(
+        status: :account_already_linked,
+        brex_item: brex_item,
+        available_accounts: [],
+        accountable_type: nil,
+        message: I18n.t("brex_items.select_existing_account.account_already_linked")
+      )
+    end
+
+    def link_navigation_result(result)
+      if result.invalid_count.positive? && result.created_count.zero? && result.already_linked_count.zero?
+        navigation(:new_account, :alert, I18n.t("brex_items.link_accounts.invalid_account_names", count: result.invalid_count))
+      elsif result.invalid_count.positive? && (result.created_count.positive? || result.already_linked_count.positive?)
+        navigation(
+          :return_to_or_accounts,
+          :alert,
+          I18n.t(
+            "brex_items.link_accounts.partial_invalid",
+            created_count: result.created_count,
+            already_linked_count: result.already_linked_count,
+            invalid_count: result.invalid_count
+          )
+        )
+      elsif result.created_count.positive? && result.already_linked_count.positive?
+        navigation(
+          :return_to_or_accounts,
+          :notice,
+          I18n.t(
+            "brex_items.link_accounts.partial_success",
+            created_count: result.created_count,
+            already_linked_count: result.already_linked_count,
+            already_linked_names: result.already_linked_names.join(", ")
+          )
+        )
+      elsif result.created_count.positive?
+        navigation(:return_to_or_accounts, :notice, I18n.t("brex_items.link_accounts.success", count: result.created_count))
+      elsif result.already_linked_count.positive?
+        navigation(
+          :return_to_or_accounts,
+          :alert,
+          I18n.t(
+            "brex_items.link_accounts.all_already_linked",
+            count: result.already_linked_count,
+            names: result.already_linked_names.join(", ")
+          )
+        )
+      else
+        navigation(:new_account, :alert, I18n.t("brex_items.link_accounts.link_failed"))
+      end
+    end
+
+    def navigation(target, flash_type, message)
+      NavigationResult.new(target: target, flash_type: flash_type, message: message)
+    end
+
+    def cache_key
+      self.class.cache_key(family, brex_item)
+    end
+
+    def fetch_accounts
+      provider = brex_item&.brex_provider
+      raise NoApiTokenError unless provider.present?
+
+      accounts_data = provider.get_accounts
+      accounts_data[:accounts] || []
+    end
+
+    def accounts
+      cached_accounts = Rails.cache.read(cache_key)
+      return cached_accounts unless cached_accounts.nil?
+
+      fetch_and_cache_accounts
+    end
+
+    def fetch_and_cache_accounts
+      available_accounts = fetch_accounts
+      Rails.cache.write(cache_key, available_accounts, expires_in: CACHE_TTL)
+      available_accounts
+    end
+
+    def unlinked_available_accounts
+      linked_account_ids = brex_item.brex_accounts
+                                   .joins(:account_provider)
+                                   .pluck("#{BrexAccount.table_name}.account_id")
+                                   .map(&:to_s)
+      accounts.reject { |account| linked_account_ids.include?(account.with_indifferent_access[:id].to_s) }
+    end
+
+    def filter_accounts(accounts, accountable_type)
+      return [] unless Provider::BrexAdapter.supported_account_types.include?(accountable_type)
+
+      accounts.select do |account|
+        case accountable_type
+        when "CreditCard"
+          BrexAccount.kind_for(account) == "card"
+        when "Depository"
+          BrexAccount.kind_for(account) == "cash"
+        else
+          true
+        end
+      end
+    end
+
+    def indexed_accounts
+      accounts.index_by { |account| account.with_indifferent_access[:id].to_s }
+    end
+
+    def upsert_brex_account!(account_id, account_data)
+      brex_account = brex_item.brex_accounts.find_or_initialize_by(account_id: account_id.to_s)
+      brex_account.upsert_brex_snapshot!(account_data)
+      brex_account
+    end
+
+    def supported_account_type?(accountable_type)
+      Provider::BrexAdapter.supported_account_types.include?(accountable_type)
+    end
+end
diff --git a/app/models/brex_item/account_flow/setup.rb b/app/models/brex_item/account_flow/setup.rb
new file mode 100644
index 000000000..730892b4e
--- /dev/null
+++ b/app/models/brex_item/account_flow/setup.rb
@@ -0,0 +1,242 @@
+# frozen_string_literal: true
+
+class BrexItem::AccountFlow
+  module Setup
+    def import_accounts_from_api_if_needed
+      raise NoApiTokenError unless brex_item&.credentials_configured?
+
+      available_accounts = fetch_accounts
+      return nil if available_accounts.empty?
+
+      existing_accounts = brex_item.brex_accounts.index_by(&:account_id)
+
+      available_accounts.each do |account_data|
+        account_id = account_data.with_indifferent_access[:id].to_s
+        account_name = BrexAccount.name_for(account_data)
+        next if account_id.blank? || account_name.blank?
+
+        brex_account = existing_accounts[account_id]
+        next if brex_account.present? && !brex_account_snapshot_changed?(brex_account, account_data)
+
+        upsert_brex_account!(account_id, account_data)
+      end
+
+      nil
+    end
+
+    def unlinked_brex_accounts
+      brex_item.brex_accounts
+               .left_joins(:account_provider)
+               .where(account_providers: { id: nil })
+    end
+
+    def account_type_options
+      supported_types = Provider::BrexAdapter.supported_account_types
+      account_type_keys = {
+        "depository" => "Depository",
+        "credit_card" => "CreditCard",
+        "investment" => "Investment",
+        "loan" => "Loan",
+        "other_asset" => "OtherAsset"
+      }
+
+      options = account_type_keys.filter_map do |key, type|
+        next unless supported_types.include?(type)
+
+        [ I18n.t("brex_items.setup_accounts.account_types.#{key}"), type ]
+      end
+
+      [ [ I18n.t("brex_items.setup_accounts.account_types.skip"), "skip" ] ] + options
+    end
+
+    def displayable_account_type_options
+      account_type_options.reject { |_, type| type == "skip" }
+    end
+
+    def subtype_options
+      supported_types = Provider::BrexAdapter.supported_account_types
+      all_subtype_options = {
+        "Depository" => {
+          label: I18n.t("brex_items.setup_accounts.subtype_labels.depository"),
+          options: translate_subtypes("depository", Depository::SUBTYPES)
+        },
+        "CreditCard" => {
+          label: I18n.t("brex_items.setup_accounts.subtype_labels.credit_card"),
+          options: [],
+          message: I18n.t("brex_items.setup_accounts.subtype_messages.credit_card")
+        },
+        "Investment" => {
+          label: I18n.t("brex_items.setup_accounts.subtype_labels.investment"),
+          options: translate_subtypes("investment", Investment::SUBTYPES)
+        },
+        "Loan" => {
+          label: I18n.t("brex_items.setup_accounts.subtype_labels.loan"),
+          options: translate_subtypes("loan", Loan::SUBTYPES)
+        },
+        "OtherAsset" => {
+          label: I18n.t("brex_items.setup_accounts.subtype_labels.other_asset", default: "Other asset"),
+          options: [],
+          message: I18n.t("brex_items.setup_accounts.subtype_messages.other_asset")
+        }
+      }
+
+      all_subtype_options.slice(*supported_types)
+    end
+
+    def complete_setup!(account_types:, account_subtypes:)
+      created_accounts = []
+      skipped_count = 0
+      valid_types = Provider::BrexAdapter.supported_account_types
+      failed_count = 0
+
+      submitted_brex_accounts = brex_item.brex_accounts
+                                      .where(id: account_types.keys)
+                                      .includes(:account_provider)
+                                      .index_by { |brex_account| brex_account.id.to_s }
+
+      account_types.each do |brex_account_id, selected_type|
+        if selected_type == "skip" || selected_type.blank?
+          skipped_count += 1
+          next
+        end
+
+        unless valid_types.include?(selected_type)
+          Rails.logger.warn("Invalid account type '#{selected_type}' submitted for Brex account #{brex_account_id}")
+          skipped_count += 1
+          next
+        end
+
+        brex_account = submitted_brex_accounts[brex_account_id.to_s]
+        unless brex_account
+          Rails.logger.warn("Brex account #{brex_account_id} not found for item #{brex_item.id}")
+          next
+        end
+
+        if brex_account.account_provider.present?
+          Rails.logger.info("Brex account #{brex_account_id} already linked, skipping")
+          next
+        end
+
+        selected_subtype = selected_subtype_for(
+          selected_type: selected_type,
+          submitted_subtype: account_subtypes[brex_account_id]
+        )
+
+        begin
+          ActiveRecord::Base.transaction do
+            account = Account.create_and_sync(
+              {
+                family: family,
+                name: brex_account.name,
+                balance: brex_account.current_balance || 0,
+                currency: brex_account.currency.presence || family.currency,
+                accountable_type: selected_type,
+                accountable_attributes: selected_subtype.present? ? { subtype: selected_subtype } : {}
+              },
+              skip_initial_sync: true
+            )
+
+            AccountProvider.create!(account: account, provider: brex_account)
+            created_accounts << account
+          end
+        rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotSaved => e
+          failed_count += 1
+          Rails.logger.error("Brex account setup failed for #{brex_account_id}: #{e.class} - #{e.message}")
+          Rails.logger.error(Array(e.backtrace).first(10).join("\n"))
+        end
+      end
+
+      brex_item.sync_later if created_accounts.any?
+
+      SetupResult.new(created_accounts: created_accounts, skipped_count: skipped_count, failed_count: failed_count)
+    end
+
+    def import_accounts_with_user_facing_error
+      import_accounts_from_api_if_needed
+    rescue NoApiTokenError
+      I18n.t("brex_items.setup_accounts.no_api_token")
+    rescue Provider::Brex::BrexError => e
+      Rails.logger.error("Brex API error: #{e.message}")
+      I18n.t("brex_items.setup_accounts.api_error", message: e.message)
+    rescue StandardError => e
+      Rails.logger.error("Unexpected error fetching Brex accounts: #{e.class}: #{e.message}")
+      I18n.t("brex_items.setup_accounts.api_error", message: I18n.t("brex_items.errors.unexpected_error"))
+    end
+
+    def complete_setup_result(account_types:, account_subtypes:)
+      result = complete_setup!(account_types: account_types, account_subtypes: account_subtypes)
+
+      SetupCompletion.new(success: result.failed_count.zero? && result.created_count.positive?, message: setup_notice(result))
+    rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotSaved => e
+      Rails.logger.error("Brex account setup failed: #{e.class} - #{e.message}")
+      Rails.logger.error(Array(e.backtrace).first(10).join("\n"))
+      SetupCompletion.new(
+        success: false,
+        message: I18n.t("brex_items.complete_account_setup.creation_failed", error: e.message)
+      )
+    rescue StandardError => e
+      Rails.logger.error("Brex account setup failed unexpectedly: #{e.class} - #{e.message}")
+      Rails.logger.error(Array(e.backtrace).first(10).join("\n"))
+      SetupCompletion.new(
+        success: false,
+        message: I18n.t(
+          "brex_items.complete_account_setup.creation_failed",
+          error: I18n.t("brex_items.complete_account_setup.unexpected_error")
+        )
+      )
+    end
+
+  private
+
+    def setup_notice(result)
+      if result.failed_count.positive? && result.created_count.positive?
+        I18n.t("brex_items.complete_account_setup.partial_success", created_count: result.created_count, failed_count: result.failed_count)
+      elsif result.skipped_count.positive? && result.created_count.positive?
+        I18n.t("brex_items.complete_account_setup.partial_skipped", created_count: result.created_count, skipped_count: result.skipped_count)
+      elsif result.failed_count.positive?
+        I18n.t("brex_items.complete_account_setup.creation_failed_count", count: result.failed_count)
+      elsif result.created_count.positive?
+        I18n.t("brex_items.complete_account_setup.success", count: result.created_count)
+      elsif result.skipped_count.positive?
+        I18n.t("brex_items.complete_account_setup.all_skipped")
+      else
+        I18n.t("brex_items.complete_account_setup.no_accounts")
+      end
+    end
+
+    def brex_account_snapshot_changed?(brex_account, account_data)
+      snapshot = account_data.with_indifferent_access
+      balances = snapshot.slice(:current_balance, :available_balance, :account_limit)
+
+      expected = {
+        account_kind: BrexAccount.kind_for(snapshot),
+        account_status: snapshot[:status],
+        account_type: snapshot[:type],
+        available_balance: BrexAccount.money_to_decimal(balances[:available_balance]),
+        current_balance: BrexAccount.money_to_decimal(balances[:current_balance]),
+        account_limit: BrexAccount.money_to_decimal(balances[:account_limit]),
+        currency: BrexAccount.currency_code_from_money(balances[:current_balance] || balances[:available_balance] || balances[:account_limit]),
+        name: BrexAccount.name_for(snapshot),
+        raw_payload: BrexAccount.sanitize_payload(account_data)
+      }
+
+      expected.any? { |attribute, value| brex_account.public_send(attribute) != value }
+    end
+
+    def translate_subtypes(type_key, subtypes_hash)
+      subtypes_hash.map do |key, value|
+        [
+          I18n.t("brex_items.setup_accounts.subtypes.#{type_key}.#{key}", default: value[:long] || key.to_s.humanize),
+          key
+        ]
+      end
+    end
+
+    def selected_subtype_for(selected_type:, submitted_subtype:)
+      return CreditCard::DEFAULT_SUBTYPE if selected_type == "CreditCard" && submitted_subtype.blank?
+      return Depository::DEFAULT_SUBTYPE if selected_type == "Depository" && submitted_subtype.blank?
+
+      submitted_subtype
+    end
+  end
+end
diff --git a/app/models/brex_item/importer.rb b/app/models/brex_item/importer.rb
new file mode 100644
index 000000000..a053c16e2
--- /dev/null
+++ b/app/models/brex_item/importer.rb
@@ -0,0 +1,245 @@
+# frozen_string_literal: true
+
+class BrexItem::Importer
+  attr_reader :brex_item, :brex_provider, :sync_start_date
+
+  def initialize(brex_item, brex_provider:, sync_start_date: nil)
+    @brex_item = brex_item
+    @brex_provider = brex_provider
+    @sync_start_date = sync_start_date
+  end
+
+  def import
+    Rails.logger.info "BrexItem::Importer - Starting import for item #{brex_item.id}"
+
+    accounts_data = fetch_accounts_data
+    return failed_result("Failed to fetch accounts data") unless accounts_data
+
+    store_item_snapshot(accounts_data)
+
+    account_result = import_accounts(accounts_data[:accounts].to_a)
+    transaction_result = import_transactions
+
+    brex_item.update!(status: :good) if account_result[:accounts_failed].zero? && transaction_result[:transactions_failed].zero?
+
+    {
+      success: account_result[:accounts_failed].zero? && transaction_result[:transactions_failed].zero?,
+      **account_result,
+      **transaction_result
+    }
+  end
+
+  private
+
+    def fetch_accounts_data
+      accounts_data = brex_provider.get_accounts
+
+      unless accounts_data.is_a?(Hash)
+        Rails.logger.error "BrexItem::Importer - Invalid accounts_data format: expected Hash, got #{accounts_data.class}"
+        return nil
+      end
+
+      accounts_data
+    rescue Provider::Brex::BrexError => e
+      mark_requires_update_if_credentials_error(e)
+      Rails.logger.error "BrexItem::Importer - Brex API error: #{e.message} trace_id=#{e.trace_id}"
+      nil
+    rescue JSON::ParserError => e
+      Rails.logger.error "BrexItem::Importer - Failed to parse Brex API response: #{e.message}"
+      nil
+    rescue => e
+      Rails.logger.error "BrexItem::Importer - Unexpected error fetching accounts: #{e.class} - #{e.message}"
+      Rails.logger.error Array(e.backtrace).join("\n")
+      nil
+    end
+
+    def store_item_snapshot(accounts_data)
+      brex_item.upsert_brex_snapshot!(accounts_data)
+    rescue => e
+      Rails.logger.error "BrexItem::Importer - Failed to store accounts snapshot: #{e.message}"
+      Sentry.capture_exception(e) do |scope|
+        scope.set_tags(brex_item_id: brex_item.id)
+        scope.set_context("brex_item_snapshot", {
+          brex_item_id: brex_item.id,
+          accounts_data: BrexAccount.sanitize_payload(accounts_data)
+        })
+      end
+      raise
+    end
+
+    def import_accounts(accounts)
+      accounts_updated = 0
+      accounts_created = 0
+      accounts_failed = 0
+
+      all_existing_ids = brex_item.brex_accounts.pluck("#{BrexAccount.table_name}.account_id").map(&:to_s)
+
+      accounts.each do |account_data|
+        snapshot = account_data.with_indifferent_access
+        account_id = snapshot[:id].to_s
+        account_name = BrexAccount.name_for(snapshot)
+        next if account_id.blank? || account_name.blank?
+
+        if all_existing_ids.include?(account_id)
+          import_account(snapshot)
+          accounts_updated += 1
+        else
+          import_account(snapshot)
+          accounts_created += 1
+          all_existing_ids << account_id
+        end
+      rescue => e
+        accounts_failed += 1
+        Rails.logger.error "BrexItem::Importer - Failed to import account #{account_id.presence || 'unknown'}: #{e.message}"
+      end
+
+      {
+        accounts_updated: accounts_updated,
+        accounts_created: accounts_created,
+        accounts_failed: accounts_failed
+      }
+    end
+
+    def import_account(account_data)
+      account_id = account_data[:id].to_s
+      raise ArgumentError, "Account ID is required" if account_id.blank?
+
+      brex_account = brex_item.brex_accounts.find_or_initialize_by(account_id: account_id)
+      brex_account.name ||= BrexAccount.name_for(account_data)
+      brex_account.currency ||= BrexAccount.currency_code_from_money(account_data[:current_balance] || account_data[:available_balance] || account_data[:account_limit])
+      brex_account.upsert_brex_snapshot!(account_data)
+      brex_account
+    end
+
+    def import_transactions
+      transactions_imported = 0
+      transactions_failed = 0
+
+      brex_item.brex_accounts.joins(:account).merge(Account.visible).find_each do |brex_account|
+        result = fetch_and_store_transactions(brex_account)
+        if result[:success]
+          transactions_imported += result[:transactions_count]
+        else
+          transactions_failed += 1
+        end
+      rescue => e
+        transactions_failed += 1
+        Rails.logger.error "BrexItem::Importer - Failed to fetch/store transactions for account #{brex_account.account_id}: #{e.message}"
+      end
+
+      {
+        transactions_imported: transactions_imported,
+        transactions_failed: transactions_failed
+      }
+    end
+
+    def fetch_and_store_transactions(brex_account)
+      start_date = determine_sync_start_date(brex_account)
+      Rails.logger.info "BrexItem::Importer - Fetching #{brex_account.account_kind} transactions for account #{brex_account.account_id} from #{start_date}"
+
+      transactions_data = if brex_account.card?
+        brex_provider.get_primary_card_transactions(start_date: start_date)
+      else
+        brex_provider.get_cash_transactions(brex_account.account_id, start_date: start_date)
+      end
+
+      unless transactions_data.is_a?(Hash)
+        Rails.logger.error "BrexItem::Importer - Invalid transactions_data format for account #{brex_account.account_id}"
+        return { success: false, transactions_count: 0, error: "Invalid response format" }
+      end
+
+      transactions = transactions_data[:transactions].to_a
+      created_count = store_new_transactions(brex_account, transactions, window_start_date: start_date)
+
+      { success: true, transactions_count: created_count }
+    rescue Provider::Brex::BrexError => e
+      mark_requires_update_if_credentials_error(e)
+      Rails.logger.error "BrexItem::Importer - Brex API error for account #{brex_account.account_id}: #{e.message} trace_id=#{e.trace_id}"
+      { success: false, transactions_count: 0, error: e.message }
+    rescue JSON::ParserError => e
+      Rails.logger.error "BrexItem::Importer - Failed to parse transaction response for account #{brex_account.account_id}: #{e.message}"
+      { success: false, transactions_count: 0, error: "Failed to parse response" }
+    rescue => e
+      Rails.logger.error "BrexItem::Importer - Unexpected error fetching transactions for account #{brex_account.account_id}: #{e.class} - #{e.message}"
+      Rails.logger.error Array(e.backtrace).join("\n")
+      { success: false, transactions_count: 0, error: "Unexpected error: #{e.message}" }
+    end
+
+    def store_new_transactions(brex_account, transactions, window_start_date:)
+      existing_payload = brex_account.raw_transactions_payload.to_a
+      existing_transactions = transactions_in_window(existing_payload, window_start_date)
+      existing_ids = existing_transactions.map { |tx| tx.with_indifferent_access[:id] }.to_set
+
+      new_transactions = transactions.select do |tx|
+        tx_id = tx.with_indifferent_access[:id]
+        tx_id.present? && !existing_ids.include?(tx_id) && transaction_in_window?(tx, window_start_date)
+      end
+
+      return 0 if new_transactions.empty? && existing_transactions.count == existing_payload.count
+
+      brex_account.upsert_brex_transactions_snapshot!(existing_transactions + new_transactions)
+      new_transactions.count
+    end
+
+    def transactions_in_window(transactions, window_start_date)
+      transactions.select { |transaction| transaction_in_window?(transaction, window_start_date) }
+    end
+
+    def transaction_in_window?(transaction, window_start_date)
+      return true if window_start_date.blank?
+
+      transaction_date = transaction_date_for(transaction)
+      return true if transaction_date.blank?
+
+      transaction_date >= window_start_date.to_date
+    end
+
+    def transaction_date_for(transaction)
+      data = transaction.with_indifferent_access
+      date_value = data[:posted_at_date].presence || data[:initiated_at_date].presence || data[:posted_at].presence || data[:created_at].presence
+
+      case date_value
+      when Date
+        date_value
+      when Time, DateTime
+        date_value.to_date
+      when String
+        Date.parse(date_value)
+      else
+        nil
+      end
+    rescue ArgumentError, TypeError
+      nil
+    end
+
+    def determine_sync_start_date(brex_account)
+      return sync_start_date if sync_start_date.present?
+
+      if brex_account.raw_transactions_payload.to_a.any?
+        brex_item.last_synced_at ? brex_item.last_synced_at - 7.days : 90.days.ago
+      else
+        account_baseline = brex_account.created_at || Time.current
+        [ account_baseline - 7.days, 90.days.ago ].max
+      end
+    end
+
+    def mark_requires_update_if_credentials_error(error)
+      return unless error.error_type.in?([ :unauthorized, :access_forbidden ])
+
+      brex_item.update!(status: :requires_update)
+    rescue => update_error
+      Rails.logger.error "BrexItem::Importer - Failed to update item status: #{update_error.message}"
+    end
+
+    def failed_result(error)
+      {
+        success: false,
+        error: error,
+        accounts_updated: 0,
+        accounts_created: 0,
+        accounts_failed: 0,
+        transactions_imported: 0,
+        transactions_failed: 0
+      }
+    end
+end
diff --git a/app/models/brex_item/provided.rb b/app/models/brex_item/provided.rb
new file mode 100644
index 000000000..6e4b22d14
--- /dev/null
+++ b/app/models/brex_item/provided.rb
@@ -0,0 +1,16 @@
+module BrexItem::Provided
+  extend ActiveSupport::Concern
+
+  def brex_provider
+    return nil unless credentials_configured?
+
+    base_url = effective_base_url
+    return nil unless base_url.present?
+
+    Provider::Brex.new(token.to_s.strip, base_url: base_url)
+  end
+
+  def syncer
+    BrexItem::Syncer.new(self)
+  end
+end
diff --git a/app/models/brex_item/syncer.rb b/app/models/brex_item/syncer.rb
new file mode 100644
index 000000000..3e5de1686
--- /dev/null
+++ b/app/models/brex_item/syncer.rb
@@ -0,0 +1,148 @@
+class BrexItem::Syncer
+  include SyncStats::Collector
+
+  SafeSyncError = Class.new(StandardError)
+
+  attr_reader :brex_item
+
+  def initialize(brex_item)
+    @brex_item = brex_item
+  end
+
+  def perform_sync(sync)
+    sync_errors = []
+
+    # Phase 1: Import data from Brex API
+    update_status(sync, :importing_accounts)
+    import_result = brex_item.import_latest_brex_data(sync_start_date: sync.window_start_date)
+    sync_errors.concat(import_result_errors(import_result))
+
+    # Phase 2: Collect setup statistics
+    update_status(sync, :checking_account_configuration)
+
+    linked_count = brex_item.brex_accounts.joins(:account_provider).count
+    unlinked_count = brex_item.brex_accounts
+                             .left_joins(:account_provider)
+                             .where(account_providers: { id: nil })
+                             .count
+    total_count = linked_count + unlinked_count
+    collect_brex_setup_stats(
+      sync,
+      total_count: total_count,
+      linked_count: linked_count,
+      unlinked_count: unlinked_count
+    )
+
+    # Set pending_account_setup if there are unlinked accounts
+    if unlinked_count.positive?
+      brex_item.update!(pending_account_setup: true)
+      update_status(sync, :accounts_need_setup, count: unlinked_count)
+    else
+      brex_item.update!(pending_account_setup: false)
+    end
+
+    # Phase 3: Process transactions for linked accounts only
+    if linked_count.positive?
+      linked_accounts = brex_item.brex_accounts.joins(:account_provider)
+      update_status(sync, :processing_transactions)
+      mark_import_started(sync)
+      Rails.logger.info "BrexItem::Syncer - Processing #{linked_count} linked accounts"
+      process_results = brex_item.process_accounts
+      sync_errors.concat(result_failure_errors(process_results, category: :account_processing_error, message_key: :account_processing_failed))
+      Rails.logger.info "BrexItem::Syncer - Finished processing accounts"
+
+      # Phase 4: Schedule balance calculations for linked accounts
+      update_status(sync, :calculating_balances)
+      schedule_results = brex_item.schedule_account_syncs(
+        parent_sync: sync,
+        window_start_date: sync.window_start_date,
+        window_end_date: sync.window_end_date
+      )
+      sync_errors.concat(result_failure_errors(schedule_results, category: :account_sync_error, message_key: :account_sync_failed))
+
+      # Phase 5: Collect transaction statistics
+      account_ids = linked_accounts
+                    .includes(account_provider: :account)
+                    .filter_map { |ma| ma.current_account&.id }
+      collect_transaction_stats(sync, account_ids: account_ids, source: "brex")
+    else
+      Rails.logger.info "BrexItem::Syncer - No linked accounts to process"
+    end
+
+    # Mark sync health
+    collect_health_stats(sync, errors: sync_errors.presence)
+  rescue => e
+    safe_message = user_safe_error_message(e)
+    Rails.logger.error "BrexItem::Syncer - sync failed for Brex item #{brex_item.id}: #{e.class} - #{e.message}"
+    Rails.logger.error Array(e.backtrace).first(10).join("\n")
+    Sentry.capture_exception(e) do |scope|
+      scope.set_tags(brex_item_id: brex_item.id)
+    end
+    collect_health_stats(sync, errors: [ { message: safe_message, category: "sync_error" } ])
+    raise SafeSyncError, safe_message
+  end
+
+  def perform_post_sync
+    # no-op
+  end
+
+  private
+
+    def update_status(sync, key, **options)
+      return unless sync.respond_to?(:status_text)
+
+      sync.update!(status_text: I18n.t("brex_items.syncer.#{key}", **options))
+    end
+
+    def collect_brex_setup_stats(sync, total_count:, linked_count:, unlinked_count:)
+      return {} unless sync.respond_to?(:sync_stats)
+
+      setup_stats = {
+        "total_accounts" => total_count,
+        "linked_accounts" => linked_count,
+        "unlinked_accounts" => unlinked_count
+      }
+
+      merge_sync_stats(sync, setup_stats)
+      setup_stats
+    end
+
+    def import_result_errors(result)
+      return [] if result.is_a?(Hash) && result[:success]
+
+      unless result.is_a?(Hash)
+        return [ sync_error(:import_error, :import_failed) ]
+      end
+
+      errors = []
+      accounts_failed = result[:accounts_failed].to_i
+      transactions_failed = result[:transactions_failed].to_i
+
+      errors << sync_error(:account_import_error, :accounts_failed, count: accounts_failed) if accounts_failed.positive?
+      errors << sync_error(:transaction_import_error, :transactions_failed, count: transactions_failed) if transactions_failed.positive?
+      errors << sync_error(:import_error, :import_failed) if errors.empty?
+      errors
+    end
+
+    def result_failure_errors(results, category:, message_key:)
+      failed_count = Array(results).count { |result| result.is_a?(Hash) && result[:success] == false }
+      return [] unless failed_count.positive?
+
+      [ sync_error(category, message_key, count: failed_count) ]
+    end
+
+    def sync_error(category, message_key, **options)
+      {
+        message: I18n.t("brex_items.syncer.#{message_key}", **options),
+        category: category.to_s
+      }
+    end
+
+    def user_safe_error_message(error)
+      if error.is_a?(Provider::Brex::BrexError) && error.error_type.in?([ :unauthorized, :access_forbidden ])
+        I18n.t("brex_items.syncer.credentials_invalid")
+      else
+        I18n.t("brex_items.syncer.failed")
+      end
+    end
+end
diff --git a/app/models/brex_item/unlinking.rb b/app/models/brex_item/unlinking.rb
new file mode 100644
index 000000000..a2c1d3703
--- /dev/null
+++ b/app/models/brex_item/unlinking.rb
@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module BrexItem::Unlinking
+  # Concern that encapsulates unlinking logic for a Brex item.
+  extend ActiveSupport::Concern
+
+  # Idempotently remove all connections between this Brex item and local accounts.
+  # - Detaches any AccountProvider links for each BrexAccount
+  # - Detaches Holdings that point at the AccountProvider links
+  # Returns a per-account result payload for observability
+  def unlink_all!(dry_run: false)
+    results = []
+
+    brex_accounts.find_each do |provider_account|
+      result = {
+        provider_account_id: provider_account.id,
+        name: provider_account.name,
+        provider_link_ids: []
+      }
+      results << result
+
+      if dry_run
+        result[:provider_link_ids] = AccountProvider.where(provider_type: "BrexAccount", provider_id: provider_account.id).ids
+        next
+      end
+
+      link_ids = []
+
+      begin
+        ActiveRecord::Base.transaction do
+          links = AccountProvider.where(provider_type: "BrexAccount", provider_id: provider_account.id).to_a
+          link_ids = links.map(&:id)
+          result[:provider_link_ids] = link_ids
+
+          # Detach holdings for any provider links found
+          if link_ids.any?
+            Holding.where(account_provider_id: link_ids).update_all(account_provider_id: nil)
+          end
+
+          # Destroy all provider links
+          links.each do |ap|
+            ap.destroy!
+          end
+        end
+      rescue StandardError => e
+        Rails.logger.warn(
+          "BrexItem Unlinker: failed to fully unlink provider account ##{provider_account.id} (links=#{link_ids.inspect}): #{e.class} - #{e.message}"
+        )
+        # Record error for observability; continue with other accounts
+        result[:error] = e.message
+      end
+    end
+
+    results
+  end
+end
diff --git a/app/models/budget.rb b/app/models/budget.rb
index 64fcdb73d..f08f1e0d0 100644
--- a/app/models/budget.rb
+++ b/app/models/budget.rb
@@ -31,13 +31,14 @@ class Budget < ApplicationRecord
     end
 
     def budget_date_valid?(date, family:)
-      if family.uses_custom_month_start?
-        budget_start = family.custom_month_start_for(date)
-        budget_start >= oldest_valid_budget_date(family) && budget_start <= family.custom_month_end_for(Date.current)
+      budget_start = if family.uses_custom_month_start?
+        family.custom_month_start_for(date)
       else
-        beginning_of_month = date.beginning_of_month
-        beginning_of_month >= oldest_valid_budget_date(family) && beginning_of_month <= Date.current.end_of_month
+        date.beginning_of_month
       end
+
+      budget_start >= oldest_valid_budget_date(family) &&
+        budget_start <= latest_valid_budget_start_date(family)
     end
 
     def find_or_bootstrap(family, start_date:, user: nil)
@@ -73,6 +74,14 @@ class Budget < ApplicationRecord
         oldest_entry_date = family.oldest_entry_date.beginning_of_month
         [ two_years_ago, oldest_entry_date ].min
       end
+
+      def latest_valid_budget_start_date(family)
+        if family.uses_custom_month_start?
+          family.current_custom_month_period.start_date + 2.years
+        else
+          Date.current.beginning_of_month + 2.years
+        end
+      end
   end
 
   def period
@@ -121,11 +130,11 @@ class Budget < ApplicationRecord
     if family.uses_custom_month_start?
       I18n.t(
         "budgets.name.custom_range",
-        start: start_date.strftime("%b %d"),
-        end_date: end_date.strftime("%b %d, %Y")
+        start: I18n.l(start_date, format: :short),
+        end_date: I18n.l(end_date, format: :long)
       )
     else
-      I18n.t("budgets.name.month_year", month: start_date.strftime("%B %Y"))
+      I18n.t("budgets.name.month_year", month: I18n.l(start_date, format: :month_year))
     end
   end
 
@@ -188,8 +197,6 @@ class Budget < ApplicationRecord
   end
 
   def next_budget_param
-    return nil if current?
-
     next_date = start_date + 1.month
     return nil unless self.class.budget_date_valid?(next_date, family: family)
 
@@ -202,7 +209,7 @@ class Budget < ApplicationRecord
     # Continuous gray segment for empty budgets
     return [ { color: "var(--budget-unallocated-fill)", amount: 1, id: unused_segment_id } ] unless allocations_valid?
 
-    segments = budget_categories.map do |bc|
+    segments = budget_categories.reject(&:subcategory?).map do |bc|
       { color: bc.category.color, amount: budget_category_actual_spending(bc), id: bc.id }
     end
 
diff --git a/app/models/budget_category.rb b/app/models/budget_category.rb
index 764e3d744..312db666a 100644
--- a/app/models/budget_category.rb
+++ b/app/models/budget_category.rb
@@ -162,6 +162,35 @@ class BudgetCategory < ApplicationRecord
     available_to_spend.negative?
   end
 
+  def budgeted?
+    display_budgeted_spending.to_d.positive?
+  end
+
+  def unbudgeted_with_spending?
+    !budgeted? && actual_spending.to_d.positive?
+  end
+
+  def over_budget_with_budget?
+    budgeted? && over_budget?
+  end
+
+  def on_track?
+    budgeted? && !over_budget?
+  end
+
+  def any_over_budget?
+    unbudgeted_with_spending? || over_budget_with_budget?
+  end
+
+  def visible_on_track?
+    return false unless on_track?
+
+    # Subcategories inheriting parent budget are hidden until they have spending.
+    return true unless subcategory? && inherits_parent_budget?
+
+    actual_spending.to_d.positive?
+  end
+
   def near_limit?
     !over_budget? && percent_of_budget_spent >= 90
   end
diff --git a/app/models/category.rb b/app/models/category.rb
index 39a740f7d..2eb9ed736 100644
--- a/app/models/category.rb
+++ b/app/models/category.rb
@@ -197,28 +197,28 @@ class Category < ApplicationRecord
     private
       def default_categories
         [
-          [ "Income", "#22c55e", "circle-dollar-sign" ],
-          [ "Food & Drink", "#f97316", "utensils" ],
-          [ "Groceries", "#407706", "shopping-bag" ],
-          [ "Shopping", "#3b82f6", "shopping-cart" ],
-          [ "Transportation", "#0ea5e9", "bus" ],
-          [ "Travel", "#2563eb", "plane" ],
-          [ "Entertainment", "#a855f7", "drama" ],
-          [ "Healthcare", "#4da568", "pill" ],
-          [ "Personal Care", "#14b8a6", "scissors" ],
-          [ "Home Improvement", "#d97706", "hammer" ],
-          [ "Mortgage / Rent", "#b45309", "home" ],
-          [ "Utilities", "#eab308", "lightbulb" ],
-          [ "Subscriptions", "#6366f1", "wifi" ],
-          [ "Insurance", "#0284c7", "shield" ],
-          [ "Sports & Fitness", "#10b981", "dumbbell" ],
-          [ "Gifts & Donations", "#61c9ea", "hand-helping" ],
-          [ "Taxes", "#dc2626", "landmark" ],
-          [ "Loan Payments", "#e11d48", "credit-card" ],
-          [ "Services", "#7c3aed", "briefcase" ],
-          [ "Fees", "#6b7280", "receipt" ],
-          [ "Savings & Investments", "#059669", "piggy-bank" ],
-          [ investment_contributions_name, "#0d9488", "trending-up" ]
+          [ I18n.t("models.category.defaults.income"),                "#22c55e", "circle-dollar-sign" ],
+          [ I18n.t("models.category.defaults.food_and_drink"),        "#f97316", "utensils" ],
+          [ I18n.t("models.category.defaults.groceries"),             "#407706", "shopping-bag" ],
+          [ I18n.t("models.category.defaults.shopping"),              "#3b82f6", "shopping-cart" ],
+          [ I18n.t("models.category.defaults.transportation"),        "#0ea5e9", "bus" ],
+          [ I18n.t("models.category.defaults.travel"),                "#2563eb", "plane" ],
+          [ I18n.t("models.category.defaults.entertainment"),         "#a855f7", "drama" ],
+          [ I18n.t("models.category.defaults.healthcare"),            "#4da568", "pill" ],
+          [ I18n.t("models.category.defaults.personal_care"),         "#14b8a6", "scissors" ],
+          [ I18n.t("models.category.defaults.home_improvement"),      "#d97706", "hammer" ],
+          [ I18n.t("models.category.defaults.mortgage_rent"),         "#b45309", "home" ],
+          [ I18n.t("models.category.defaults.utilities"),             "#eab308", "lightbulb" ],
+          [ I18n.t("models.category.defaults.subscriptions"),         "#6366f1", "wifi" ],
+          [ I18n.t("models.category.defaults.insurance"),             "#0284c7", "shield" ],
+          [ I18n.t("models.category.defaults.sports_and_fitness"),    "#10b981", "dumbbell" ],
+          [ I18n.t("models.category.defaults.gifts_and_donations"),   "#61c9ea", "hand-helping" ],
+          [ I18n.t("models.category.defaults.taxes"),                 "#dc2626", "landmark" ],
+          [ I18n.t("models.category.defaults.loan_payments"),         "#e11d48", "credit-card" ],
+          [ I18n.t("models.category.defaults.services"),              "#7c3aed", "briefcase" ],
+          [ I18n.t("models.category.defaults.fees"),                  "#6b7280", "receipt" ],
+          [ I18n.t("models.category.defaults.savings_and_investments"), "#059669", "piggy-bank" ],
+          [ investment_contributions_name,                       "#0d9488", "trending-up" ]
         ]
       end
   end
diff --git a/app/models/category_import.rb b/app/models/category_import.rb
index f58a50b70..1bf4564bb 100644
--- a/app/models/category_import.rb
+++ b/app/models/category_import.rb
@@ -17,7 +17,7 @@ class CategoryImport < Import
         parent = ensure_placeholder_category(row.category_parent)
 
         if parent && parent == category
-          errors.add(:base, "Category '#{category.name}' cannot be its own parent")
+          errors.add(:base, :own_parent, name: category.name)
           raise ActiveRecord::RecordInvalid.new(self)
         end
 
@@ -65,8 +65,9 @@ class CategoryImport < Import
     parent_header = header_for("parent_category", "parent category")
     icon_header = header_for("lucide_icon", "lucide icon", "icon")
 
-    csv_rows.each do |row|
+    csv_rows.each.with_index(1) do |row, index|
       rows.create!(
+        source_row_number: index,
         name: row[name_header].to_s.strip,
         category_color: row[color_header].to_s.strip,
         category_parent: row[parent_header].to_s.strip,
@@ -81,7 +82,7 @@ class CategoryImport < Import
       missing_headers = required_column_keys.map(&:to_s).reject { |key| header_for(key).present? }
       return if missing_headers.empty?
 
-      errors.add(:base, "Missing required columns: #{missing_headers.join(', ')}")
+      errors.add(:base, :missing_columns, columns: missing_headers.join(", "))
       raise ActiveRecord::RecordInvalid.new(self)
     end
 
diff --git a/app/models/chat.rb b/app/models/chat.rb
index d47dcccac..1198ee4be 100644
--- a/app/models/chat.rb
+++ b/app/models/chat.rb
@@ -1,6 +1,32 @@
 class Chat < ApplicationRecord
   include Debuggable
 
+  RATE_LIMIT_PATTERNS = [
+    /\b429\b/i,
+    /rate limit/i,
+    /too many requests/i,
+    /quota exceeded/i
+  ].freeze
+
+  TEMPORARY_PROVIDER_PATTERNS = [
+    /\b5\d\d\b/i,
+    /service unavailable/i,
+    /temporarily unavailable/i,
+    /gateway timeout/i,
+    /bad gateway/i,
+    /overloaded/i,
+    /time(?:out|d?\s*out)/i,
+    /connection reset/i
+  ].freeze
+
+  AUTH_CONFIGURATION_PATTERNS = [
+    /unauthorized/i,
+    /authentication/i,
+    /invalid api key/i,
+    /incorrect api key/i,
+    /access token/i
+  ].freeze
+
   belongs_to :user
 
   has_one :viewer, class_name: "User", foreign_key: :last_viewed_chat_id, dependent: :nullify # "Last chat user has viewed"
@@ -26,9 +52,9 @@ class Chat < ApplicationRecord
     end
 
     # Returns the default AI model to use for chats
-    # Priority: ENV variable > Setting > OpenAI default
+    # Priority: AI Config > Setting
     def default_model
-      ENV["OPENAI_MODEL"].presence || Setting.openai_model.presence || Provider::Openai::DEFAULT_MODEL
+      Provider::Openai.effective_model.presence || Setting.openai_model
     end
   end
 
@@ -52,29 +78,97 @@ class Chat < ApplicationRecord
   end
 
   def add_error(e)
-    update! error: e.to_json
-    broadcast_append target: "messages", partial: "chats/error", locals: { chat: self }
+    update!(error: build_error_payload(e).to_json)
+    broadcast_append target: messages_target, partial: "chats/error", locals: { chat: self }
+  end
+
+  def presentable_error_message
+    return nil if error.blank?
+    parsed_error_payload["message"].presence || classify_error_message(error)
+  end
+
+  def technical_error_message
+    parsed_error_payload["technical_message"].presence || parsed_legacy_error_message || error
   end
 
   def clear_error
     update! error: nil
-    broadcast_remove target: "chat-error"
-  end
-
-  def assistant
-    @assistant ||= Assistant.for_chat(self)
-  end
-
-  def ask_assistant_later(message)
-    clear_error
-    AssistantResponseJob.perform_later(message)
-  end
-
-  def ask_assistant(message)
-    assistant.respond_to(message)
+    broadcast_remove target: error_target
   end
 
   def conversation_messages
     messages.where(type: [ "UserMessage", "AssistantMessage" ])
   end
+
+  def messages_target
+    ActionView::RecordIdentifier.dom_id(self, :messages)
+  end
+
+  def error_target
+    ActionView::RecordIdentifier.dom_id(self, :chat_error)
+  end
+
+  def ask_assistant_later(message)
+    clear_error
+    pending = messages.create!(type: "AssistantMessage", content: "", ai_model: message.ai_model, status: :pending)
+    AssistantResponseJob.perform_later(message, pending)
+  end
+
+  def ask_assistant(message, assistant_message: nil)
+    assistant.respond_to(message, assistant_message: assistant_message)
+  end
+
+  private
+
+    def build_error_payload(error)
+      technical_message = error_message_for(error)
+
+      {
+        message: classify_error_message(technical_message),
+        technical_message: technical_message,
+        type: error.class.name
+      }
+    end
+
+    def classify_error_message(message)
+      normalized_message = message.to_s.strip
+      return I18n.t("chat.errors.default") if normalized_message.blank?
+
+      if RATE_LIMIT_PATTERNS.any? { |pattern| normalized_message.match?(pattern) }
+        I18n.t("chat.errors.rate_limited")
+      elsif TEMPORARY_PROVIDER_PATTERNS.any? { |pattern| normalized_message.match?(pattern) }
+        I18n.t("chat.errors.temporarily_unavailable")
+      elsif AUTH_CONFIGURATION_PATTERNS.any? { |pattern| normalized_message.match?(pattern) }
+        I18n.t("chat.errors.misconfigured")
+      else
+        I18n.t("chat.errors.default")
+      end
+    end
+
+    def parsed_error_payload
+      return {} if error.blank?
+      return error if error.is_a?(Hash)
+
+      parsed = JSON.parse(error)
+      parsed.is_a?(Hash) ? parsed : {}
+    rescue JSON::ParserError, TypeError
+      {}
+    end
+
+    def error_message_for(error)
+      error.respond_to?(:message) ? error.message.to_s : error.to_s
+    rescue StandardError
+      ""
+    end
+
+    def parsed_legacy_error_message
+      parsed = JSON.parse(error)
+      parsed.is_a?(String) ? parsed : nil
+    rescue JSON::ParserError, TypeError
+      nil
+    end
+
+    def assistant
+      @assistant ||= Assistant.for_chat(self)
+    end
 end
diff --git a/app/models/coinstats_account/source_classification.rb b/app/models/coinstats_account/source_classification.rb
index 97f867d4a..a3e2ed520 100644
--- a/app/models/coinstats_account/source_classification.rb
+++ b/app/models/coinstats_account/source_classification.rb
@@ -3,9 +3,15 @@ module CoinstatsAccount::SourceClassification
 
   def wallet_source?
     payload = raw_payload.to_h.with_indifferent_access
+    return false if payload[:source] == "defi"
     payload[:source] == "wallet" || (payload[:address].present? && payload[:blockchain].present?)
   end
 
+  def defi_source?
+    payload = raw_payload.to_h.with_indifferent_access
+    payload[:source] == "defi"
+  end
+
   def exchange_source?
     exchange_source_for?(raw_payload)
   end
diff --git a/app/models/coinstats_item/defi_account_manager.rb b/app/models/coinstats_item/defi_account_manager.rb
new file mode 100644
index 000000000..a5962608f
--- /dev/null
+++ b/app/models/coinstats_item/defi_account_manager.rb
@@ -0,0 +1,206 @@
+# frozen_string_literal: true
+
+# Manages DeFi/staking accounts for a CoinStats wallet connection.
+# Discovers staking, LP, and yield farming positions via the CoinStats DeFi API
+# and keeps the corresponding CoinstatsAccounts up to date.
+class CoinstatsItem::DefiAccountManager
+  attr_reader :coinstats_item
+
+  def initialize(coinstats_item)
+    @coinstats_item = coinstats_item
+  end
+
+  # Fetches DeFi positions for the given wallet and creates/updates CoinstatsAccounts.
+  # Positions that disappear from the API (fully unstaked) are zeroed out.
+  # Returns true on success, false on failure.
+  def sync_wallet!(address:, blockchain:, provider:)
+    normalized_address = address.to_s.downcase
+    normalized_blockchain = blockchain.to_s.downcase
+
+    response = provider.get_wallet_defi(address: address, connection_id: blockchain)
+    unless response.success?
+      Rails.logger.warn "CoinstatsItem::DefiAccountManager - DeFi fetch failed for #{normalized_blockchain}:#{normalized_address}"
+      return false
+    end
+
+    defi_data = response.data.to_h.with_indifferent_access
+    protocols = Array(defi_data[:protocols])
+    active_defi_ids = []
+    had_upsert_failures = false
+
+    protocols.each do |protocol|
+      protocol = protocol.with_indifferent_access
+
+      Array(protocol[:investments]).each do |investment|
+        investment = investment.with_indifferent_access
+
+        Array(investment[:assets]).each do |asset|
+          asset = asset.with_indifferent_access
+          next if asset[:amount].to_f.zero?
+          next if asset[:coinId].blank? && asset[:symbol].blank?
+
+          account_id = build_account_id(protocol, investment, asset, blockchain: normalized_blockchain)
+
+          if upsert_account!(address: normalized_address, blockchain: normalized_blockchain, protocol: protocol, investment: investment, asset: asset, account_id: account_id)
+            active_defi_ids << account_id
+          else
+            had_upsert_failures = true
+          end
+        end
+      end
+    end
+
+    # Skip zero-out when upserts failed — active_defi_ids is incomplete and we'd risk
+    # zeroing accounts that are still active but failed to save this cycle.
+    return false if had_upsert_failures
+
+    zero_out_inactive_accounts!(normalized_address, normalized_blockchain, active_defi_ids)
+    true
+  rescue => e
+    Rails.logger.warn "CoinstatsItem::DefiAccountManager - Sync failed for #{blockchain}:#{address}: #{e.message}"
+    false
+  end
+
+  # Creates the local Account for a DeFi CoinstatsAccount if it doesn't exist yet.
+  def ensure_local_account!(coinstats_account)
+    return false if coinstats_account.account.present?
+
+    account = Account.create_and_sync({
+      family: coinstats_item.family,
+      name: coinstats_account.name,
+      balance: coinstats_account.current_balance || 0,
+      cash_balance: 0,
+      currency: coinstats_account.currency,
+      accountable_type: "Crypto",
+      accountable_attributes: {
+        subtype: "wallet",
+        tax_treatment: "taxable"
+      }
+    }, skip_initial_sync: true)
+
+    AccountProvider.create!(account: account, provider: coinstats_account)
+    true
+  rescue ActiveRecord::RecordNotUnique
+    # Another concurrent sync created the AccountProvider; destroy the orphaned Account we just created.
+    account&.destroy
+    false
+  end
+
+  private
+
+    # Builds a stable, unique account_id for a DeFi asset position.
+    # Format: "defi:<blockchain>:<protocol_id>:<investment_type>:<coin_id>:<asset_title>"
+    # Blockchain is included to avoid collisions when the same wallet address exists on
+    # multiple EVM-compatible chains (e.g. Ethereum and Polygon).
+    def build_account_id(protocol, investment, asset, blockchain:)
+      chain = blockchain.to_s.downcase.gsub(/\s+/, "_").presence || "unknown"
+      protocol_id = protocol[:id].to_s.downcase.gsub(/\s+/, "_").presence || "unknown"
+      coin_id = (asset[:coinId] || asset[:symbol]).to_s.downcase
+      title = asset[:title].to_s.downcase.gsub(/\s+/, "_").presence || "position"
+      investment_type = investment[:name].to_s.downcase.gsub(/\s+/, "_").presence
+      parts = [ "defi", chain, protocol_id, coin_id, title ]
+      parts.insert(3, investment_type) if investment_type.present?
+      parts.join(":")
+    end
+
+    def build_account_name(protocol, asset)
+      protocol_name = protocol[:name].to_s
+      symbol = asset[:symbol].to_s.upcase
+
+      case asset[:title].to_s.downcase
+      when "deposit", "supplied"
+        "#{symbol} (#{protocol_name} Staking)"
+      when "reward", "yield"
+        "#{symbol} (#{protocol_name} Rewards)"
+      else
+        label = asset[:title].to_s.presence || "Position"
+        "#{symbol} (#{protocol_name} #{label})"
+      end
+    end
+
+    # Returns true on success, false on failure (so the caller can track active positions correctly).
+    def upsert_account!(address:, blockchain:, protocol:, investment:, asset:, account_id:)
+      coinstats_account = coinstats_item.coinstats_accounts.find_or_initialize_by(
+        account_id: account_id,
+        wallet_address: address
+      )
+
+      # The DeFi API returns asset.price as a TotalValueDto (total position value, not per-token price).
+      # Store it as `balance` so inferred_current_balance uses it directly instead of quantity * price.
+      # Guard against a missing USD key falling back to the whole hash (which would raise on .to_f).
+      total_balance_usd = if asset[:price].is_a?(Hash)
+        price_hash = asset[:price].with_indifferent_access
+        (price_hash[:USD] || price_hash["USD"] || 0).to_f
+      else
+        asset[:price].to_f
+      end
+
+      # Convert the USD balance to the family's base currency for consistent portfolio reporting.
+      # convert_usd_balance returns the actual currency used — it may fall back to "USD" if the
+      # exchange rate is unavailable, so we use the returned currency rather than assuming success.
+      balance, actual_currency = convert_usd_balance(total_balance_usd, family_currency)
+      quantity = asset[:amount].to_f
+      per_token_price = quantity > 0 ? balance / quantity : 0
+
+      snapshot = {
+        source: "defi",
+        id: account_id,
+        address: address,
+        blockchain: blockchain,
+        protocol_id: protocol[:id],
+        protocol_name: protocol[:name],
+        protocol_logo: protocol[:logo],
+        investment_type: investment[:name],
+        coinId: asset[:coinId],
+        symbol: asset[:symbol],
+        name: asset[:symbol].to_s.upcase,
+        amount: asset[:amount],
+        balance: balance,
+        priceUsd: per_token_price,
+        asset_title: asset[:title],
+        currency: actual_currency,
+        institution_logo: protocol[:logo]
+      }.compact
+
+      coinstats_account.name = build_account_name(protocol, asset) unless coinstats_account.persisted?
+      coinstats_account.currency = actual_currency
+      coinstats_account.raw_payload = snapshot
+      coinstats_account.current_balance = coinstats_account.inferred_current_balance(snapshot)
+      coinstats_account.institution_metadata = { logo: protocol[:logo] }.compact
+      coinstats_account.save!
+
+      ensure_local_account!(coinstats_account)
+      true
+    rescue => e
+      Rails.logger.warn "CoinstatsItem::DefiAccountManager - Failed to upsert account #{account_id}: #{e.message}"
+      false
+    end
+
+    # Sets balance to zero for DeFi accounts no longer present in the API response.
+    def zero_out_inactive_accounts!(address, blockchain, active_defi_ids)
+      coinstats_item.coinstats_accounts.where(wallet_address: address).each do |account|
+        raw = account.raw_payload.to_h.with_indifferent_access
+        next unless raw[:source] == "defi"
+        next unless raw[:blockchain].to_s.casecmp?(blockchain.to_s)
+        next if active_defi_ids.include?(account.account_id)
+
+        account.update!(current_balance: 0, raw_payload: raw.merge(amount: 0, balance: 0, priceUsd: 0))
+      end
+    end
+
+    def family_currency
+      coinstats_item.family.currency.presence || "USD"
+    end
+
+    # Converts a USD amount to the target currency using Money exchange rates.
+    # Returns [amount, currency] so the caller always knows what currency the amount is in.
+    # Falls back to [usd_amount, "USD"] if conversion is unavailable.
+    def convert_usd_balance(usd_amount, target_currency)
+      return [ usd_amount, "USD" ] if target_currency == "USD" || usd_amount.zero?
+
+      [ Money.new(usd_amount, "USD").exchange_to(target_currency).amount, target_currency ]
+    rescue => e
+      Rails.logger.warn "CoinstatsItem::DefiAccountManager - FX conversion USD->#{target_currency} failed: #{e.message}"
+      [ usd_amount, "USD" ]
+    end
+end
diff --git a/app/models/coinstats_item/importer.rb b/app/models/coinstats_item/importer.rb
index 9f48dd71a..b3e35250d 100644
--- a/app/models/coinstats_item/importer.rb
+++ b/app/models/coinstats_item/importer.rb
@@ -38,6 +38,9 @@ class CoinstatsItem::Importer
     wallet_accounts = linked_accounts.select(&:wallet_source?)
     exchange_accounts = linked_accounts.select(&:exchange_source?)
 
+    failed_defi_wallet_keys = sync_defi_for_wallets!(wallet_accounts)
+    accounts_failed += failed_defi_wallet_keys.size
+
     bulk_balance_data = fetch_balances_for_accounts(wallet_accounts)
     bulk_transactions_data = fetch_transactions_for_accounts(wallet_accounts)
     portfolio_coins_data = fetch_portfolio_coins_for_exchange(exchange_accounts)
@@ -52,6 +55,12 @@ class CoinstatsItem::Importer
               portfolio_coins_data: portfolio_coins_data,
               portfolio_transactions_data: portfolio_transactions_data
             )
+          elsif coinstats_account.defi_source?
+            # DeFi/staking accounts are kept up to date by sync_defi_for_wallets! above.
+            # Mark as failed if the wallet sync for this account's address didn't succeed.
+            raw = coinstats_account.raw_payload.to_h.with_indifferent_access
+            wallet_key = "#{raw[:blockchain]}:#{raw[:address]}".downcase
+            { success: !failed_defi_wallet_keys.include?(wallet_key), transactions_count: 0 }
           else
             update_wallet_account(
               coinstats_account,
@@ -576,4 +585,36 @@ class CoinstatsItem::Importer
     def family_currency
       coinstats_item.family.currency.presence || "USD"
     end
+
+    # Syncs DeFi/staking positions for all unique wallet addresses by delegating
+    # to DefiAccountManager, which owns discovery, upsert, and zero-out logic.
+    # Returns a Set of "blockchain:address" keys for wallets that failed to sync,
+    # so the caller can accurately mark individual DeFi accounts as failed.
+    def sync_defi_for_wallets!(wallet_accounts)
+      # Include existing DeFi accounts as address sources so staking positions stay
+      # current even if the parent wallet account has been removed.
+      defi_accounts = coinstats_item.coinstats_accounts.joins(:account_provider).select(&:defi_source?)
+
+      unique_wallets = (wallet_accounts + defi_accounts).uniq(&:id).filter_map do |account|
+        raw = account.raw_payload.to_h.with_indifferent_access
+        next unless raw[:address].present? && raw[:blockchain].present?
+
+        { address: raw[:address], blockchain: raw[:blockchain] }
+      end.uniq { |w| [ w[:address].downcase, w[:blockchain].downcase ] }
+
+      return Set.new if unique_wallets.empty?
+
+      manager = CoinstatsItem::DefiAccountManager.new(coinstats_item)
+      failed_wallet_keys = Set.new
+
+      unique_wallets.each do |wallet|
+        result = manager.sync_wallet!(address: wallet[:address], blockchain: wallet[:blockchain], provider: coinstats_provider)
+        failed_wallet_keys << "#{wallet[:blockchain]}:#{wallet[:address]}".downcase unless result
+      end
+
+      failed_wallet_keys
+    rescue => e
+      Rails.logger.warn "CoinstatsItem::Importer - DeFi sync failed: #{e.message}"
+      Set.new
+    end
 end
diff --git a/app/models/concerns/accountable.rb b/app/models/concerns/accountable.rb
index 9324e34ab..f008fea5e 100644
--- a/app/models/concerns/accountable.rb
+++ b/app/models/concerns/accountable.rb
@@ -58,8 +58,29 @@ module Accountable
       classification == "asset" ? "up" : "down"
     end
 
+    def singular_display_name
+      I18n.t("accounts.types.#{name.underscore}", default: legacy_singular_display_name)
+    end
+
     def display_name
-      self.name.pluralize.titleize
+      I18n.t("accounts.types_plural.#{name.underscore}", default: -> { legacy_display_name })
+    end
+
+    def legacy_display_name
+      return singular_display_name if name.in?([ "Depository", "Crypto" ])
+
+      singular_display_name.pluralize
+    end
+
+    def legacy_singular_display_name
+      case name
+      when "Depository"
+        "Cash"
+      when "Crypto"
+        "Crypto"
+      else
+        name.underscore.humanize
+      end
     end
 
     # Sums the balances of all active accounts of this type, converting foreign currencies to the family's currency.
@@ -80,6 +101,10 @@ module Accountable
     end
   end
 
+  def singular_display_name
+    self.class.singular_display_name
+  end
+
   def display_name
     self.class.display_name
   end
diff --git a/app/models/concerns/encryptable.rb b/app/models/concerns/encryptable.rb
index 0ec5ae923..a04c773de 100644
--- a/app/models/concerns/encryptable.rb
+++ b/app/models/concerns/encryptable.rb
@@ -6,11 +6,7 @@ module Encryptable
     # This allows encryption to be optional - if not configured, sensitive fields
     # are stored in plaintext (useful for development or legacy deployments).
     def encryption_ready?
-      creds_ready = Rails.application.credentials.active_record_encryption.present?
-      env_ready = ENV["ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY"].present? &&
-                  ENV["ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY"].present? &&
-                  ENV["ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT"].present?
-      creds_ready || env_ready
+      ActiveRecordEncryptionConfig.explicitly_configured?
     end
   end
 end
diff --git a/app/models/concerns/monetizable.rb b/app/models/concerns/monetizable.rb
index e80fcb5f6..b5eb83886 100644
--- a/app/models/concerns/monetizable.rb
+++ b/app/models/concerns/monetizable.rb
@@ -7,7 +7,7 @@ module Monetizable
         define_method("#{field}_money") do |**args|
           value = self.send(field, **args)
 
-          return nil if value.nil? || monetizable_currency.nil?
+          return nil if value.blank? || monetizable_currency.nil?
 
           Money.new(value, monetizable_currency)
         end
diff --git a/app/models/credit_card.rb b/app/models/credit_card.rb
index 05bf7746a..4f42beaee 100644
--- a/app/models/credit_card.rb
+++ b/app/models/credit_card.rb
@@ -1,6 +1,8 @@
 class CreditCard < ApplicationRecord
   include Accountable
 
+  DEFAULT_SUBTYPE = "credit_card"
+
   SUBTYPES = {
     "credit_card" => { short: "Credit Card", long: "Credit Card" }
   }.freeze
diff --git a/app/models/crypto.rb b/app/models/crypto.rb
index 6f3f5c0cd..fdff70c74 100644
--- a/app/models/crypto.rb
+++ b/app/models/crypto.rb
@@ -34,9 +34,5 @@ class Crypto < ApplicationRecord
     def icon
       "bitcoin"
     end
-
-    def display_name
-      "Crypto"
-    end
   end
 end
diff --git a/app/models/data_enrichment.rb b/app/models/data_enrichment.rb
index 5c720cc1f..d14b47eb5 100644
--- a/app/models/data_enrichment.rb
+++ b/app/models/data_enrichment.rb
@@ -1,5 +1,19 @@
 class DataEnrichment < ApplicationRecord
   belongs_to :enrichable, polymorphic: true
 
-  enum :source, { rule: "rule", plaid: "plaid", simplefin: "simplefin", lunchflow: "lunchflow", synth: "synth", ai: "ai", enable_banking: "enable_banking", coinstats: "coinstats", mercury: "mercury", indexa_capital: "indexa_capital" }
+  enum :source, {
+    rule: "rule",
+    plaid: "plaid",
+    simplefin: "simplefin",
+    lunchflow: "lunchflow",
+    synth: "synth",
+    ai: "ai",
+    enable_banking: "enable_banking",
+    coinstats: "coinstats",
+    mercury: "mercury",
+    brex: "brex",
+    indexa_capital: "indexa_capital",
+    sophtron: "sophtron",
+    ibkr: "ibkr"
+  }
 end
diff --git a/app/models/debug_log_entry.rb b/app/models/debug_log_entry.rb
new file mode 100644
index 000000000..fa2949b89
--- /dev/null
+++ b/app/models/debug_log_entry.rb
@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+class DebugLogEntry < ApplicationRecord
+  LEVELS = %w[debug info warn error].freeze
+
+  belongs_to :family, optional: true
+  belongs_to :account, optional: true
+  belongs_to :user, optional: true
+  belongs_to :account_provider, optional: true
+
+  validates :category, :level, :message, :source, presence: true
+  validates :level, inclusion: { in: LEVELS }
+
+  scope :recent, -> { order(created_at: :desc) }
+  scope :with_category, ->(category) { category.present? ? where(category: category) : all }
+  scope :with_level, ->(level) { level.present? ? where(level: level) : all }
+  scope :with_source, ->(source) { source.present? ? where(source: source) : all }
+  scope :with_provider_key, ->(provider_key) { provider_key.present? ? where(provider_key: provider_key) : all }
+
+  class << self
+    def log!(category:, level:, message:, source:, metadata: {}, family: nil, family_id: nil,
+             account: nil, account_id: nil, user: nil, user_id: nil,
+             account_provider: nil, account_provider_id: nil, provider_key: nil, provider: nil)
+      create!(
+        category:,
+        level:,
+        message:,
+        source:,
+        metadata: normalize_metadata(metadata),
+        family: resolve_family(family, family_id, account, account_id, user, user_id, account_provider, account_provider_id),
+        account: resolve_account(account, account_id, account_provider, account_provider_id),
+        user: resolve_user(user, user_id),
+        account_provider: resolve_account_provider(account_provider, account_provider_id),
+        provider_key: normalize_provider_key(provider_key, provider)
+      )
+    end
+
+    def capture(...)
+      log!(...)
+    rescue => e
+      Rails.logger.error("DebugLogEntry.capture failed: #{e.class}: #{e.message}")
+      nil
+    end
+
+    private
+      def normalize_metadata(metadata)
+        return {} if metadata.blank?
+        return metadata.deep_stringify_keys if metadata.respond_to?(:deep_stringify_keys)
+
+        { value: metadata.to_s }
+      end
+
+      def normalize_provider_key(provider_key, provider)
+        return provider_key.to_s if provider_key.present?
+        return if provider.blank?
+
+        provider_name = provider.is_a?(String) || provider.is_a?(Symbol) ? provider.to_s : provider.class.name.demodulize
+        provider_name.to_s.underscore
+      end
+
+      def resolve_family(family, family_id, account, account_id, user, user_id, account_provider, account_provider_id)
+        family ||
+          find_record(Family, family_id) ||
+          resolve_account(account, account_id, account_provider, account_provider_id)&.family ||
+          resolve_user(user, user_id)&.family
+      end
+
+      def resolve_account(account, account_id, account_provider, account_provider_id)
+        account ||
+          find_record(Account, account_id) ||
+          resolve_account_provider(account_provider, account_provider_id)&.account
+      end
+
+      def resolve_user(user, user_id)
+        user || find_record(User, user_id)
+      end
+
+      def resolve_account_provider(account_provider, account_provider_id)
+        account_provider || find_record(AccountProvider, account_provider_id)
+      end
+
+      def find_record(klass, id)
+        return if id.blank?
+
+        klass.find_by(id: id)
+      end
+  end
+end
diff --git a/app/models/depository.rb b/app/models/depository.rb
index b788a6d4e..0ebeda390 100644
--- a/app/models/depository.rb
+++ b/app/models/depository.rb
@@ -1,6 +1,8 @@
 class Depository < ApplicationRecord
   include Accountable
 
+  DEFAULT_SUBTYPE = "checking"
+
   SUBTYPES = {
     "checking" => { short: "Checking", long: "Checking" },
     "savings" => { short: "Savings", long: "Savings" },
@@ -10,10 +12,6 @@ class Depository < ApplicationRecord
   }.freeze
 
   class << self
-    def display_name
-      "Cash"
-    end
-
     def color
       "#875BF7"
     end
diff --git a/app/models/enable_banking_account.rb b/app/models/enable_banking_account.rb
index a94815d0e..91bf07539 100644
--- a/app/models/enable_banking_account.rb
+++ b/app/models/enable_banking_account.rb
@@ -62,38 +62,65 @@ class EnableBankingAccount < ApplicationRecord
     type_mappings[account_type.upcase] || account_type.titleize
   end
 
+  CASH_ACCOUNT_TYPE_MAP = {
+    "CACC" => { type: "Depository", subtype: "checking" },
+    "SVGS" => { type: "Depository", subtype: "savings" },
+    "CARD" => { type: "CreditCard", subtype: "credit_card" },
+    "CRCD" => { type: "CreditCard", subtype: "credit_card" },
+    "LOAN" => { type: "Loan",       subtype: nil },
+    "MORT" => { type: "Loan",       subtype: "mortgage" },
+    "ODFT" => { type: "Depository", subtype: "checking" },
+    "TRAN" => { type: "Depository", subtype: "checking" },
+    "SALA" => { type: "Depository", subtype: "checking" },
+    "MOMA" => { type: "Depository", subtype: "savings" },
+    "NREX" => { type: "Depository", subtype: "checking" },
+    "TAXE" => { type: "Depository", subtype: "checking" },
+    "TRAS" => { type: "Depository", subtype: "checking" },
+    "ONDP" => { type: "Depository", subtype: "savings" },
+    "CASH" => { type: "Depository", subtype: "checking" },
+    "OTHR" => nil
+  }.freeze
+
+  def suggested_account_type
+    CASH_ACCOUNT_TYPE_MAP[account_type&.upcase]&.dig(:type)
+  end
+
+  def suggested_subtype
+    CASH_ACCOUNT_TYPE_MAP[account_type&.upcase]&.dig(:subtype)
+  end
+
   def upsert_enable_banking_snapshot!(account_snapshot)
-    # Convert to symbol keys or handle both string and symbol keys
     snapshot = account_snapshot.with_indifferent_access
 
-    # Map Enable Banking field names to our field names
-    # Enable Banking API returns: { uid, iban, account_id: { iban }, currency, cash_account_type, ... }
-    # account_id can be a hash with iban, or an array of account identifiers
     raw_account_id = snapshot[:account_id]
     account_id_data = if raw_account_id.is_a?(Hash)
       raw_account_id
     elsif raw_account_id.is_a?(Array) && raw_account_id.first.is_a?(Hash)
-      # If it's an array of hashes, find the one with iban
       raw_account_id.find { |item| item[:iban].present? } || {}
     else
       {}
     end
 
+    credit_limit_amount = snapshot.dig(:credit_limit, :amount)
+
     update!(
-      current_balance: nil, # Balance fetched separately via /accounts/{uid}/balances
+      current_balance: nil,
       currency: parse_currency(snapshot[:currency]) || "EUR",
       name: build_account_name(snapshot),
-      # account_id stores the API UUID for fetching balances/transactions
       account_id: snapshot[:uid],
-      # uid is the stable identifier (identification_hash) for matching accounts across sessions
       uid: snapshot[:identification_hash] || snapshot[:uid],
       iban: account_id_data[:iban] || snapshot[:iban],
       account_type: snapshot[:cash_account_type] || snapshot[:account_type],
       account_status: "active",
       provider: "enable_banking",
+      product: snapshot[:product],
+      credit_limit: parse_decimal_safe(credit_limit_amount),
+      identification_hashes: snapshot[:identification_hashes] || [],
       institution_metadata: {
         name: enable_banking_item&.aspsp_name,
-        aspsp_name: enable_banking_item&.aspsp_name
+        aspsp_name: enable_banking_item&.aspsp_name,
+        bic: snapshot.dig(:account_servicer, :bic_fi),
+        servicer_name: snapshot.dig(:account_servicer, :name)
       }.compact,
       raw_payload: account_snapshot
     )
@@ -134,4 +161,11 @@ class EnableBankingAccount < ApplicationRecord
     def log_invalid_currency(currency_value)
       Rails.logger.warn("Invalid currency code '#{currency_value}' for EnableBanking account #{id}, defaulting to EUR")
     end
+
+    def parse_decimal_safe(value)
+      return nil if value.blank?
+      BigDecimal(value.to_s)
+    rescue ArgumentError, TypeError
+      nil
+    end
 end
diff --git a/app/models/enable_banking_account/processor.rb b/app/models/enable_banking_account/processor.rb
index ada55916f..a6b546f0a 100644
--- a/app/models/enable_banking_account/processor.rb
+++ b/app/models/enable_banking_account/processor.rb
@@ -1,4 +1,5 @@
 class EnableBankingAccount::Processor
+  class ProcessingError < StandardError; end
   include CurrencyNormalizable
 
   attr_reader :enable_banking_account
@@ -37,23 +38,53 @@ class EnableBankingAccount::Processor
 
       account = enable_banking_account.current_account
       balance = enable_banking_account.current_balance || 0
+      available_credit = nil
 
-      # For credit cards, compute balance based on credit limit
-      if account.accountable_type == "CreditCard"
-        available_credit = account.accountable.available_credit || 0
-        balance = available_credit - balance
-      # For liability accounts, ensure positive balances
-      elsif account.accountable_type == "Loan"
-        balance = -balance
+      # For liability accounts, ensure balance sign is correct.
+      # DELIBERATE UX DECISION: For CreditCards, we display the available credit (credit_limit - outstanding debt)
+      # rather than the raw outstanding debt. Do not revert this behavior, as future maintainers should understand
+      # users expect to see how much credit they have left rather than their debt balance.
+      # The 'available_credit' calculation overrides the 'balance' variable.
+      if account.accountable_type == "Loan"
+        balance = balance.abs
+      elsif account.accountable_type == "CreditCard"
+        if enable_banking_account.credit_limit.present?
+          available = enable_banking_account.credit_limit - balance.abs
+          available_credit = [ available, 0 ].max
+          balance = available_credit
+          unless account.accountable.present?
+            Rails.logger.warn "EnableBankingAccount::Processor - CreditCard accountable missing for account #{account.id}"
+          end
+        elsif account.accountable&.available_credit.present?
+          # Fallback: no credit_limit from API — compute it using available_credit defined at account level
+          Rails.logger.info "Using stored available_credit fallback for account #{account.id}"
+          available_credit = account.accountable.available_credit
+          outstanding = balance.abs
+          balance = [ available_credit - outstanding, 0 ].max
+        else
+          # Fallback: no credit_limit from API — display raw outstanding balance
+          # We cannot derive available credit without knowing the limit; leave balance unchanged.
+        end
       end
 
       currency = parse_currency(enable_banking_account.currency) || account.currency || "EUR"
 
-      account.update!(
-        balance: balance,
-        cash_balance: balance,
-        currency: currency
-      )
+      # Wrap both writes in a transaction so a failure on either rolls back both.
+      ActiveRecord::Base.transaction do
+        if account.accountable.present? && account.accountable.respond_to?(:available_credit=)
+          account.accountable.update!(available_credit: available_credit)
+        end
+        account.update!(currency: currency, cash_balance: balance)
+
+        # Use set_current_balance to create a current_anchor valuation entry.
+        # This enables Balance::ReverseCalculator, which works backward from the
+        # bank-reported balance — eliminating spurious cash adjustment spikes.
+        result = account.set_current_balance(balance)
+        raise ProcessingError, "Failed to set current balance: #{result.error}" unless result.success?
+      end
+
+      # TODO: pass explicit window_start_date to sync_later to avoid full history recalculation on every sync
+      # Currently relies on set_current_balance's implicit sync trigger; window params would require refactor
     end
 
     def process_transactions
diff --git a/app/models/enable_banking_account/transactions/processor.rb b/app/models/enable_banking_account/transactions/processor.rb
index 9791ad96f..2809c6f9e 100644
--- a/app/models/enable_banking_account/transactions/processor.rb
+++ b/app/models/enable_banking_account/transactions/processor.rb
@@ -15,14 +15,77 @@ class EnableBankingAccount::Transactions::Processor
     Rails.logger.info "EnableBankingAccount::Transactions::Processor - Processing #{total_count} transactions for enable_banking_account #{enable_banking_account.id}"
 
     imported_count = 0
+    skipped_count = 0
     failed_count = 0
     errors = []
 
+    shared_adapter = if enable_banking_account.current_account.present?
+      Account::ProviderImportAdapter.new(enable_banking_account.current_account)
+    end
+
+    # Pre-fetch external_ids that must not be re-imported.
+    # One query per category per sync; O(1) Set lookup per transaction — avoids N+1.
+    excluded_ids = if enable_banking_account.current_account
+      account_id = enable_banking_account.current_account.id
+
+      # 1. Manually merged: pending entries the user explicitly merged into a posted transaction.
+      #    Uses a lateral join to extract merged_from_external_id from the manual_merge JSON
+      #    (handles both Array current format and legacy Hash format via jsonb_typeof).
+      manually_merged_ids = Transaction.joins(:entry)
+                                       .where(entries: { account_id: account_id })
+                                       .where("transactions.extra ? 'manual_merge'")
+                                       .joins(
+                                         Arel.sql(<<~SQL.squish)
+                                           CROSS JOIN LATERAL jsonb_array_elements(
+                                             CASE jsonb_typeof(transactions.extra->'manual_merge')
+                                             WHEN 'array'  THEN transactions.extra->'manual_merge'
+                                             WHEN 'object' THEN jsonb_build_array(transactions.extra->'manual_merge')
+                                             ELSE '[]'::jsonb
+                                             END
+                                           ) AS merge_elem
+                                         SQL
+                                       )
+                                       .pluck(Arel.sql("merge_elem->>'merged_from_external_id'"))
+                                       .compact
+                                       .to_set
+
+      # 2. Auto-claimed: pending entries that were automatically matched to a booked transaction
+      #    by the amount/date heuristic. Their old external_ids are stored in
+      #    extra["auto_claimed_pending_ids"] so they are not re-imported as new pending entries
+      #    on subsequent syncs (the stored raw payload still contains the old pending data).
+      auto_claimed_ids = Transaction.joins(:entry)
+                                    .where(entries: { account_id: account_id })
+                                    .where("transactions.extra ? 'auto_claimed_pending_ids'")
+                                    .joins(
+                                      Arel.sql(<<~SQL.squish)
+                                        CROSS JOIN LATERAL jsonb_array_elements_text(
+                                          transactions.extra->'auto_claimed_pending_ids'
+                                        ) AS claimed_id
+                                      SQL
+                                    )
+                                    .pluck(Arel.sql("claimed_id"))
+                                    .compact
+                                    .to_set
+
+      manually_merged_ids | auto_claimed_ids
+    else
+      Set.new
+    end
+
     enable_banking_account.raw_transactions_payload.each_with_index do |transaction_data, index|
       begin
+        ext_id = EnableBankingEntry::Processor.compute_external_id(transaction_data)
+
+        if ext_id && excluded_ids.include?(ext_id)
+          Rails.logger.info("EnableBankingAccount::Transactions::Processor - Skipping re-import of manually merged pending transaction: #{ext_id}")
+          skipped_count += 1
+          next
+        end
+
         result = EnableBankingEntry::Processor.new(
           transaction_data,
-          enable_banking_account: enable_banking_account
+          enable_banking_account: enable_banking_account,
+          import_adapter: shared_adapter
         ).process
 
         if result.nil?
@@ -51,6 +114,7 @@ class EnableBankingAccount::Transactions::Processor
       success: failed_count == 0,
       total: total_count,
       imported: imported_count,
+      skipped: skipped_count,
       failed: failed_count,
       errors: errors
     }
diff --git a/app/models/enable_banking_entry/processor.rb b/app/models/enable_banking_entry/processor.rb
index 643991491..4f41b21f8 100644
--- a/app/models/enable_banking_entry/processor.rb
+++ b/app/models/enable_banking_entry/processor.rb
@@ -10,14 +10,43 @@ class EnableBankingEntry::Processor
   #   transaction_amount: { amount, currency },
   #   creditor_name, debtor_name, remittance_information, ...
   # }
-  def initialize(enable_banking_transaction, enable_banking_account:)
+  def self.compute_external_id(raw_transaction_data)
+    data = raw_transaction_data.with_indifferent_access
+    id = data[:transaction_id].presence || data[:entry_reference].presence
+    return "enable_banking_#{id}" if id
+
+    # Some ASPSPs omit both transaction_id and entry_reference (both are optional
+    # in PSD2). Generate a deterministic content-based ID so these transactions
+    # can still be imported idempotently. Uses the same fields as the importer's
+    # dedup key so the two strategies stay in sync.
+    date = data[:booking_date].presence || data[:value_date].presence || data[:transaction_date]
+    amount = data.dig(:transaction_amount, :amount).presence || data[:amount]
+    currency = data.dig(:transaction_amount, :currency).presence || data[:currency]
+    direction = data[:credit_debit_indicator]
+    creditor = data.dig(:creditor, :name).presence || data[:creditor_name]
+    debtor = data.dig(:debtor, :name).presence || data[:debtor_name]
+    remittance = data[:remittance_information]
+    remittance_key = remittance.is_a?(Array) ? remittance.compact.map(&:to_s).sort.join("|") : remittance.to_s
+
+    content = [ date, amount, currency, direction, creditor, debtor, remittance_key ].map(&:to_s).join("\x1F")
+    return nil if content.gsub("\x1F", "").blank?
+
+    "enable_banking_content_#{Digest::MD5.hexdigest(content)}"
+  end
+
+  def initialize(enable_banking_transaction, enable_banking_account:, import_adapter: nil)
     @enable_banking_transaction = enable_banking_transaction
     @enable_banking_account = enable_banking_account
+    @import_adapter = import_adapter
   end
 
   def process
+    # Cache a safe diagnostic id upfront — used in all logging paths so rescue
+    # blocks never call the potentially-raising private external_id method.
+    safe_id = self.class.compute_external_id(@enable_banking_transaction) || "unknown"
+
     unless account.present?
-      Rails.logger.warn "EnableBankingEntry::Processor - No linked account for enable_banking_account #{enable_banking_account.id}, skipping transaction #{external_id}"
+      Rails.logger.warn "EnableBankingEntry::Processor - No linked account for enable_banking_account #{enable_banking_account.id}, skipping transaction #{safe_id}"
       return nil
     end
 
@@ -30,16 +59,17 @@ class EnableBankingEntry::Processor
         name: name,
         source: "enable_banking",
         merchant: merchant,
-        notes: notes
+        notes: notes,
+        extra: extra
       )
     rescue ArgumentError => e
-      Rails.logger.error "EnableBankingEntry::Processor - Validation error for transaction #{external_id}: #{e.message}"
+      Rails.logger.error "EnableBankingEntry::Processor - Validation error for transaction #{safe_id}: #{e.message}"
       raise
     rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotSaved => e
-      Rails.logger.error "EnableBankingEntry::Processor - Failed to save transaction #{external_id}: #{e.message}"
+      Rails.logger.error "EnableBankingEntry::Processor - Failed to save transaction #{safe_id}: #{e.message}"
       raise StandardError.new("Failed to import transaction: #{e.message}")
     rescue => e
-      Rails.logger.error "EnableBankingEntry::Processor - Unexpected error processing transaction #{external_id}: #{e.class} - #{e.message}"
+      Rails.logger.error "EnableBankingEntry::Processor - Unexpected error processing transaction #{safe_id}: #{e.class} - #{e.message}"
       Rails.logger.error e.backtrace.join("\n")
       raise StandardError.new("Unexpected error importing transaction: #{e.message}")
     end
@@ -62,50 +92,41 @@ class EnableBankingEntry::Processor
     end
 
     def external_id
-      id = data[:transaction_id].presence || data[:entry_reference].presence
-      raise ArgumentError, "Enable Banking transaction missing required field 'transaction_id'" unless id
-      "enable_banking_#{id}"
+      id = self.class.compute_external_id(data)
+      raise ArgumentError, "Enable Banking transaction missing required identifier (transaction_id, entry_reference, or identifiable content)" unless id
+      id
     end
 
     def name
       # Build name from available Enable Banking transaction fields
       # Priority: counterparty name > bank_transaction_code description > remittance_information
 
-      # Determine counterparty based on transaction direction
-      # For outgoing payments (DBIT), counterparty is the creditor (who we paid)
-      # For incoming payments (CRDT), counterparty is the debtor (who paid us)
-      counterparty = if credit_debit_indicator == "CRDT"
-        data.dig(:debtor, :name) || data[:debtor_name]
-      else
-        data.dig(:creditor, :name) || data[:creditor_name]
-      end
+      counterparty = counterparty_name
+      return counterparty if counterparty.present? && !technical_card_counterparty?(counterparty)
 
-      return counterparty if counterparty.present?
+      # Some institutions (e.g. Wise) use technical CARD-* identifiers as counterparties
+      # Prefer remittance_information first in that case since it contains the real merchant label for Wise
+      if technical_card_counterparty?(counterparty)
+        remittance = primary_remittance_information
+        return remittance.truncate(100) if remittance.present?
+      end
 
       # Fall back to bank_transaction_code description
       bank_tx_description = data.dig(:bank_transaction_code, :description)
       return bank_tx_description if bank_tx_description.present?
 
       # Fall back to remittance_information
-      remittance = data[:remittance_information]
-      return remittance.first.truncate(100) if remittance.is_a?(Array) && remittance.first.present?
+      remittance = primary_remittance_information
+      return remittance.truncate(100) if remittance.present?
 
       # Final fallback: use transaction type indicator
       credit_debit_indicator == "CRDT" ? "Incoming Transfer" : "Outgoing Transfer"
     end
 
     def merchant
-      # For outgoing payments (DBIT), merchant is the creditor (who we paid)
-      # For incoming payments (CRDT), merchant is the debtor (who paid us)
-      merchant_name = if credit_debit_indicator == "CRDT"
-        data.dig(:debtor, :name) || data[:debtor_name]
-      else
-        data.dig(:creditor, :name) || data[:creditor_name]
-      end
-
-      return nil unless merchant_name.present?
-
-      merchant_name = merchant_name.to_s.strip
+      # Use the counterparty when it is human readable; otherwise fall back to remittance
+      # for CARD-* transactions where the remittance often contains the actual merchant
+      merchant_name = merchant_name_candidate
       return nil if merchant_name.blank?
 
       merchant_id = Digest::MD5.hexdigest(merchant_name.downcase)
@@ -123,10 +144,34 @@ class EnableBankingEntry::Processor
     end
 
     def notes
-      remittance = data[:remittance_information]
-      return nil unless remittance.is_a?(Array) && remittance.any?
+      parts = []
 
-      remittance.join("\n")
+      remittance = data[:remittance_information]
+      if remittance.is_a?(Array) && remittance.any?
+        parts << remittance.join("\n")
+      elsif remittance.is_a?(String) && remittance.present?
+        parts << remittance
+      end
+
+      parts << data[:note] if data[:note].present?
+
+      parts.join("\n\n").presence
+    end
+
+    def extra
+      eb = {}
+
+      if data[:exchange_rate].present?
+        eb[:fx_rate]              = data.dig(:exchange_rate, :exchange_rate)
+        eb[:fx_unit_currency]     = data.dig(:exchange_rate, :unit_currency)
+        eb[:fx_instructed_amount] = data.dig(:exchange_rate, :instructed_amount, :amount)
+      end
+
+      eb[:merchant_category_code] = data[:merchant_category_code] if data[:merchant_category_code].present?
+      eb[:pending] = true if data[:_pending] == true
+
+      eb.compact!
+      eb.empty? ? nil : { enable_banking: eb }
     end
 
     def amount_value
@@ -143,8 +188,9 @@ class EnableBankingEntry::Processor
           BigDecimal("0")
         end
 
-        # CRDT (credit) = money coming in = positive
-        # DBIT (debit) = money going out = negative
+        # Sure convention: positive = outflow (expense/debit from account), negative = inflow (income/credit)
+        # Enable Banking: DBIT = debit from account (outflow), CRDT = credit to account (inflow)
+        # Therefore: DBIT → +absolute_amount, CRDT → -absolute_amount
         credit_debit_indicator == "CRDT" ? -absolute_amount : absolute_amount
       rescue ArgumentError => e
         Rails.logger.error "Failed to parse Enable Banking transaction amount: #{raw_amount.inspect} - #{e.message}"
@@ -156,10 +202,43 @@ class EnableBankingEntry::Processor
       data[:credit_debit_indicator]
     end
 
+    def counterparty_name
+      # Determine counterparty based on transaction direction
+      # For outgoing payments (DBIT), counterparty is the creditor (who we paid)
+      # For incoming payments (CRDT), counterparty is the debtor (who paid us)
+      if credit_debit_indicator == "CRDT"
+        data.dig(:debtor, :name).presence || data[:debtor_name].presence
+      else
+        data.dig(:creditor, :name).presence || data[:creditor_name].presence
+      end
+    end
+
+    def technical_card_counterparty?(value)
+      # Some providers expose card transactions with CARD-<digits> placeholders instead of a real counterparty name
+      value.to_s.strip.match?(/\ACARD-\d+\z/i)
+    end
+
+    def primary_remittance_information
+      remittance = data[:remittance_information]
+      Array.wrap(remittance)
+        .map { |value| value.to_s.strip.presence }
+        .compact
+        .first
+    end
+
+    def merchant_name_candidate
+      counterparty = counterparty_name.to_s.strip
+      return counterparty if counterparty.present? && !technical_card_counterparty?(counterparty)
+      # For technical CARD-* counterparties, reuse remittance as the best merchant candidate
+      remittance = primary_remittance_information
+      return remittance.truncate(100, omission: "") if remittance.present? && technical_card_counterparty?(counterparty)
+
+      nil
+    end
+
     def amount
-      # Enable Banking uses PSD2 Berlin Group convention: negative = debit (outflow), positive = credit (inflow)
-      # Sure uses the same convention: negative = expense, positive = income
-      # Therefore, use the amount as-is from the API without inversion
+      # Sure convention: positive = outflow (debit/expense), negative = inflow (credit/income)
+      # amount_value already applies this: DBIT → +absolute, CRDT → -absolute
       amount_value
     end
 
@@ -169,7 +248,8 @@ class EnableBankingEntry::Processor
     end
 
     def log_invalid_currency(currency_value)
-      Rails.logger.warn("Invalid currency code '#{currency_value}' in Enable Banking transaction #{external_id}, falling back to account currency")
+      safe_id = self.class.compute_external_id(data) || "unknown"
+      Rails.logger.warn("Invalid currency code '#{currency_value}' in Enable Banking transaction #{safe_id}, falling back to account currency")
     end
 
     def date
diff --git a/app/models/enable_banking_item.rb b/app/models/enable_banking_item.rb
index d1e8684c9..7f3b6a540 100644
--- a/app/models/enable_banking_item.rb
+++ b/app/models/enable_banking_item.rb
@@ -48,24 +48,63 @@ class EnableBankingItem < ApplicationRecord
     !session_valid?
   end
 
+  # TODO: implement data retention policy for last_psu_ip (GDPR/CCPA — nullify after session expiry or 90 days)
+
+  validate :psu_type_in_aspsp_types
+
+  def psu_type_in_aspsp_types
+    return if psu_type.blank? || aspsp_psu_types.blank?
+    unless aspsp_psu_types.include?(psu_type)
+      errors.add(:psu_type, "must be one of the ASPSP supported types")
+    end
+  end
+
   # Start the OAuth authorization flow
-  # Returns a redirect URL for the user
-  def start_authorization(aspsp_name:, redirect_url:, state: nil)
+  # @param aspsp_name [String] Name of the selected ASPSP
+  # @param redirect_url [String] Callback URL
+  # @param state [String, nil] State parameter (passed through to callback)
+  # @param psu_type [String] "personal" or "business"
+  # @param aspsp_data [Hash, nil] Full ASPSP object from GET /aspsps (used to store metadata)
+  # @param language [String, nil] Two-letter language code
+  # @return [String] Redirect URL for the user
+  def start_authorization(aspsp_name:, redirect_url:, state: nil, psu_type: "personal",
+                          aspsp_data: nil, language: nil)
     provider = enable_banking_provider
     raise StandardError.new("Enable Banking provider is not configured") unless provider
 
+    validated_psu_type = psu_type
+
+    # Store ASPSP metadata before calling provider so it's available even if auth fails
+    if aspsp_data.present?
+      aspsp_data = aspsp_data.with_indifferent_access
+      first_auth_method = aspsp_data.dig(:auth_methods, 0) || aspsp_data.dig("auth_methods", 0)
+      aspsp_types = aspsp_data[:psu_types] || []
+      update!(
+        aspsp_required_psu_headers: aspsp_data[:required_psu_headers] || [],
+        aspsp_maximum_consent_validity: aspsp_data[:maximum_consent_validity],
+        aspsp_auth_approach: first_auth_method&.dig(:approach) || first_auth_method&.dig("approach"),
+        aspsp_psu_types: aspsp_types
+      )
+      validated_psu_type = psu_type.present? && aspsp_types.include?(psu_type) ? psu_type : nil
+    end
+
     result = provider.start_authorization(
       aspsp_name: aspsp_name,
       aspsp_country: country_code,
       redirect_url: redirect_url,
-      state: state
+      state: state,
+      psu_type: validated_psu_type,
+      maximum_consent_validity: aspsp_maximum_consent_validity,
+      language: language
     )
 
-    # Store the authorization ID for later use
-    update!(
+    attributes = {
       authorization_id: result[:authorization_id],
       aspsp_name: aspsp_name
-    )
+    }
+    attributes[:psu_type] = validated_psu_type if validated_psu_type.present?
+
+    update!(attributes)
 
     result[:url]
   end
@@ -250,14 +289,13 @@ class EnableBankingItem < ApplicationRecord
   private
 
     def parse_session_expiry(session_result)
-      # Enable Banking sessions typically last 90 days
-      # The exact expiry depends on the ASPSP consent
       if session_result[:access].present? && session_result[:access][:valid_until].present?
-        Time.parse(session_result[:access][:valid_until])
+        parsed = Time.zone.parse(session_result[:access][:valid_until])
+        parsed || 90.days.from_now
       else
         90.days.from_now
       end
-    rescue => e
+    rescue ArgumentError, TypeError => e
       Rails.logger.warn "EnableBankingItem #{id} - Failed to parse session expiry: #{e.message}"
       90.days.from_now
     end
diff --git a/app/models/enable_banking_item/importer.rb b/app/models/enable_banking_item/importer.rb
index 9facd18d2..696b4f673 100644
--- a/app/models/enable_banking_item/importer.rb
+++ b/app/models/enable_banking_item/importer.rb
@@ -3,6 +3,14 @@ class EnableBankingItem::Importer
   # Enable Banking typically returns ~100 transactions per page, so 100 pages = ~10,000 transactions
   MAX_PAGINATION_PAGES = 100
 
+  NETWORK_ERRORS = [
+    ::SocketError,
+    ::Errno::ECONNREFUSED,
+    ::Timeout::Error,
+    ::Net::ReadTimeout,
+    ::Net::OpenTimeout
+  ].freeze
+
   attr_reader :enable_banking_item, :enable_banking_provider
 
   def initialize(enable_banking_item, enable_banking_provider:)
@@ -13,12 +21,12 @@ class EnableBankingItem::Importer
   def import
     unless enable_banking_item.session_valid?
       enable_banking_item.update!(status: :requires_update)
-      return { success: false, error: "Session expired or invalid", accounts_updated: 0, transactions_imported: 0 }
+      return { success: false, error: I18n.t("enable_banking_items.errors.session_invalid"), accounts_updated: 0, transactions_imported: 0 }
     end
 
     session_data = fetch_session_data
     unless session_data
-      error_msg = @session_error || "Failed to fetch session data"
+      error_msg = @session_error || I18n.t("enable_banking_items.errors.unexpected")
       return { success: false, error: error_msg, accounts_updated: 0, transactions_imported: 0 }
     end
 
@@ -29,6 +37,8 @@ class EnableBankingItem::Importer
       Rails.logger.error "EnableBankingItem::Importer - Failed to store session snapshot: #{e.message}"
     end
 
+    sync_uids_from_accounts_data(session_data[:accounts])
+
     # Update accounts from session
     accounts_updated = 0
     accounts_failed = 0
@@ -66,6 +76,7 @@ class EnableBankingItem::Importer
           end
         rescue => e
           accounts_failed += 1
+          @sync_error = promote_session_invalid(@sync_error, handle_sync_error(e))
           Rails.logger.error "EnableBankingItem::Importer - Failed to update account #{uid}: #{e.message}"
         end
       end
@@ -79,16 +90,22 @@ class EnableBankingItem::Importer
 
     linked_accounts_query.each do |enable_banking_account|
       begin
-        fetch_and_update_balance(enable_banking_account)
+        unless fetch_and_update_balance(enable_banking_account)
+          transactions_failed += 1
+          # @sync_error already set in fetch_and_update_balance
+          next
+        end
 
         result = fetch_and_store_transactions(enable_banking_account)
         if result[:success]
           transactions_imported += result[:transactions_count]
         else
           transactions_failed += 1
+          @sync_error = promote_session_invalid(@sync_error, result[:error])
         end
       rescue => e
         transactions_failed += 1
+        @sync_error = promote_session_invalid(@sync_error, handle_sync_error(e))
         Rails.logger.error "EnableBankingItem::Importer - Failed to process account #{enable_banking_account.uid}: #{e.message}"
       end
     end
@@ -100,46 +117,48 @@ class EnableBankingItem::Importer
       transactions_imported: transactions_imported,
       transactions_failed: transactions_failed
     }
-    if !result[:success] && (accounts_failed > 0 || transactions_failed > 0)
-      parts = []
-      parts << "#{accounts_failed} #{'account'.pluralize(accounts_failed)} failed" if accounts_failed > 0
-      parts << "#{transactions_failed} #{'transaction'.pluralize(transactions_failed)} failed" if transactions_failed > 0
-      result[:error] = parts.join(", ")
-    end
+
+    result[:error] = @sync_error || I18n.t("enable_banking_items.errors.unexpected") if !result[:success]
     result
   end
 
   private
 
-    def extract_friendly_error_message(exception)
-      [ exception, exception.cause ].compact.each do |ex|
-        case ex
-        when SocketError then return "DNS resolution failed: check your network/DNS configuration"
-        when Net::OpenTimeout, Net::ReadTimeout then return "Connection timed out: the Enable Banking API may be unreachable"
-        when Errno::ECONNREFUSED then return "Connection refused: the Enable Banking API is unreachable"
-        end
+    def handle_sync_error(exception)
+      # Check the underlying cause first, then the exception itself
+      exceptions = [ exception.cause, exception ].compact
+
+      provider_error = exceptions.find { |ex| ex.is_a?(Provider::EnableBanking::EnableBankingError) }
+
+      # Handle session expiration status update
+      if provider_error && [ :unauthorized, :not_found ].include?(provider_error.error_type)
+        enable_banking_item.update!(status: :requires_update)
+        return I18n.t("enable_banking_items.errors.session_invalid")
       end
 
-      msg = exception.message.to_s
-      return "DNS resolution failed: check your network/DNS configuration" if msg.include?("getaddrinfo") || msg.match?(/name or service not known/i)
-      return "Connection timed out: the Enable Banking API may be unreachable" if msg.include?("execution expired") || msg.include?("timeout") || msg.match?(/timed out/i)
-      return "Connection refused: the Enable Banking API is unreachable" if msg.include?("ECONNREFUSED") || msg.match?(/connection refused/i)
+      is_network_error = exceptions.any? do |ex|
+        NETWORK_ERRORS.any? { |err| ex.is_a?(err) } ||
+          (ex.is_a?(Provider::EnableBanking::EnableBankingError) && [ :request_failed, :timeout ].include?(ex.error_type))
+      end
 
-      msg
+      if is_network_error
+        I18n.t("enable_banking_items.errors.network_unreachable")
+      elsif provider_error
+        I18n.t("enable_banking_items.errors.api_error")
+      else
+        I18n.t("enable_banking_items.errors.unexpected")
+      end
     end
 
     def fetch_session_data
       enable_banking_provider.get_session(session_id: enable_banking_item.session_id)
     rescue Provider::EnableBanking::EnableBankingError => e
-      if e.error_type == :unauthorized || e.error_type == :not_found
-        enable_banking_item.update!(status: :requires_update)
-      end
       Rails.logger.error "EnableBankingItem::Importer - Enable Banking API error: #{e.message}"
-      @session_error = extract_friendly_error_message(e)
+      @session_error = handle_sync_error(e)
       nil
     rescue => e
       Rails.logger.error "EnableBankingItem::Importer - Unexpected error fetching session: #{e.class} - #{e.message}"
-      @session_error = extract_friendly_error_message(e)
+      @session_error = handle_sync_error(e)
       nil
     end
 
@@ -147,7 +166,7 @@ class EnableBankingItem::Importer
       # Use identification_hash as the stable identifier across sessions
       uid = account_data[:identification_hash] || account_data[:uid]
 
-      enable_banking_account = enable_banking_item.enable_banking_accounts.find_by(uid: uid.to_s)
+      enable_banking_account = find_enable_banking_account_by_hash(uid)
       return unless enable_banking_account
 
       enable_banking_account.upsert_enable_banking_snapshot!(account_data)
@@ -155,113 +174,187 @@ class EnableBankingItem::Importer
     end
 
     def fetch_and_update_balance(enable_banking_account)
-      balance_data = enable_banking_provider.get_account_balances(account_id: enable_banking_account.api_account_id)
+      balance_data = enable_banking_provider.get_account_balances(
+        account_id: enable_banking_account.api_account_id,
+        psu_headers: enable_banking_item.build_psu_headers
+      )
 
-      # Enable Banking returns an array of balances
+      # Enable Banking returns an array of balances. We prioritize types based on reliability.
+      # closingBooked (CLBD) > interimAvailable (ITAV) > expected (XPCD)
       balances = balance_data[:balances] || []
-      return if balances.empty?
+      return true if balances.empty?
 
-      # Find the most relevant balance (prefer "ITAV" or "CLAV" types)
-      balance = balances.find { |b| b[:balance_type] == "ITAV" } ||
-                balances.find { |b| b[:balance_type] == "CLAV" } ||
-                balances.find { |b| b[:balance_type] == "ITBD" } ||
-                balances.find { |b| b[:balance_type] == "CLBD" } ||
-                balances.first
+      priority_types = [ "CLBD", "ITAV", "XPCD", "CLAV", "ITBD" ]
+      balance = nil
+
+      priority_types.each do |type|
+        balance = balances.find { |b| b[:balance_type] == type }
+        break if balance
+      end
+
+      balance ||= balances.first
 
       if balance.present?
         amount = balance.dig(:balance_amount, :amount) || balance[:amount]
         currency = balance.dig(:balance_amount, :currency) || balance[:currency]
 
         if amount.present?
+          indicator = balance[:credit_debit_indicator]
+          parsed_amount = amount.to_d
+
+          # Enable Banking uses positive amounts for both credit and debit.
+          # DBIT indicates a negative balance (money owed/withdrawn).
+          parsed_amount = -parsed_amount if indicator == "DBIT"
+
           enable_banking_account.update!(
-            current_balance: amount.to_d,
+            current_balance: parsed_amount,
             currency: currency.presence || enable_banking_account.currency
           )
         end
       end
+      true
     rescue Provider::EnableBanking::EnableBankingError => e
+      @sync_error = promote_session_invalid(@sync_error, handle_sync_error(e))
       Rails.logger.error "EnableBankingItem::Importer - Error fetching balance for account #{enable_banking_account.uid}: #{e.message}"
+      false
+    end
+
+    def promote_session_invalid(existing, new)
+      return new if existing.nil?
+      return new if new == I18n.t("enable_banking_items.errors.session_invalid")
+      existing
+    end
+
+    def include_pending?
+      Setting.syncs_include_pending
     end
 
     def fetch_and_store_transactions(enable_banking_account)
       start_date = determine_sync_start_date(enable_banking_account)
+      include_pending = include_pending?
 
-      all_transactions = []
-      continuation_key = nil
-      previous_continuation_key = nil
-      page_count = 0
+      all_transactions = fetch_paginated_transactions(
+        enable_banking_account,
+        start_date: start_date,
+        transaction_status: "BOOK",
+        psu_headers: enable_banking_item.build_psu_headers
+      )
 
-      # Paginate through all transactions with safeguards against infinite loops
-      loop do
-        page_count += 1
-
-        # Safeguard: prevent infinite loops from excessive pagination
-        if page_count > MAX_PAGINATION_PAGES
-          Rails.logger.error(
-            "EnableBankingItem::Importer - Pagination limit exceeded for account #{enable_banking_account.uid}. " \
-            "Stopped after #{MAX_PAGINATION_PAGES} pages (#{all_transactions.count} transactions). " \
-            "Last continuation_key: #{continuation_key.inspect}"
+      pending_transactions = []
+      if include_pending
+        # Also fetch pending transactions (visible for 1-3 days before they become BOOK) if setting is enabled
+        begin
+          pending_transactions = fetch_paginated_transactions(
+            enable_banking_account,
+            start_date: start_date,
+            transaction_status: "PDNG",
+            psu_headers: enable_banking_item.build_psu_headers
           )
-          break
+        rescue Provider::EnableBanking::EnableBankingError => e
+          raise unless e.error_type == :validation_error && e.message.include?("transactionStatus")
+          Rails.logger.warn "EnableBankingItem::Importer - ASPSP does not support PDNG transaction status for account #{enable_banking_account.uid}, skipping pending transactions. API error: #{e.message}"
         end
-
-        transactions_data = enable_banking_provider.get_account_transactions(
-          account_id: enable_banking_account.api_account_id,
-          date_from: start_date,
-          continuation_key: continuation_key
-        )
-
-        transactions = transactions_data[:transactions] || []
-        all_transactions.concat(transactions)
-
-        previous_continuation_key = continuation_key
-        continuation_key = transactions_data[:continuation_key]
-
-        # Safeguard: detect repeated continuation_key (provider returning same key)
-        if continuation_key.present? && continuation_key == previous_continuation_key
-          Rails.logger.error(
-            "EnableBankingItem::Importer - Repeated continuation_key detected for account #{enable_banking_account.uid}. " \
-            "Breaking loop after #{page_count} pages (#{all_transactions.count} transactions). " \
-            "Repeated key: #{continuation_key.inspect}, last response had #{transactions.count} transactions"
-          )
-          break
-        end
-
-        break if continuation_key.blank?
       end
 
+      book_fingerprints = all_transactions
+        .map { |tx| EnableBankingEntry::Processor.compute_external_id(tx) }
+        .compact.to_set
+
+      # Also index all booked entry_references so a pending row that lacks
+      # transaction_id can still be matched when the settled BOOK row adds one
+      # (fingerprints differ; entry_reference stays the same across settlement).
+      book_entry_refs = all_transactions
+        .map { |tx| tx.with_indifferent_access[:entry_reference].presence }
+        .compact.to_set
+
+      pending_transactions.reject! do |tx|
+        tx_ia = tx.with_indifferent_access
+        fp = EnableBankingEntry::Processor.compute_external_id(tx_ia)
+        entry_ref = tx_ia[:entry_reference].presence
+        (fp.present? && book_fingerprints.include?(fp)) ||
+          (entry_ref.present? && book_entry_refs.include?(entry_ref))
+      end
+
+      all_transactions = all_transactions + tag_as_pending(pending_transactions)
+
       # Deduplicate API response: Enable Banking sometimes returns the same logical
       # transaction with different entry_reference IDs in the same response.
       # Remove content-level duplicates before storing. (Issue #954)
       all_transactions = deduplicate_api_transactions(all_transactions)
 
+      # Post-fetch safety filter: some ASPSPs ignore date_from or return extra transactions
+      all_transactions = filter_transactions_by_date(all_transactions, start_date)
+
       transactions_count = all_transactions.count
 
-      if all_transactions.any?
-        existing_transactions = enable_banking_account.raw_transactions_payload.to_a
-        existing_ids = existing_transactions.map { |tx|
+      existing_transactions = enable_banking_account.raw_transactions_payload.to_a
+
+      removed_pending = false
+
+      unless include_pending
+        removed_pending = existing_transactions.reject! do |tx|
           tx = tx.with_indifferent_access
-          tx[:transaction_id].presence || tx[:entry_reference].presence
+          tx.dig(:extra, :enable_banking, :pending) || tx[:_pending]
+        end
+      end
+
+      if all_transactions.any?
+
+        # C4: Remove stored PDNG entries that have now settled as BOOK.
+        # Two match strategies run in parallel:
+        # 1. Fingerprint: covers same-ID rows and ID-less rows matched by content.
+        # 2. Entry-reference cross-match: covers the case where a pending row had
+        #    no transaction_id but the settled BOOK row gained one — fingerprints
+        #    diverge (enable_banking_<ref> vs enable_banking_<txn_id>) but the
+        #    shared entry_reference is a reliable settlement signal.
+        book_fingerprints = all_transactions
+          .reject { |tx| tx.with_indifferent_access[:_pending] }
+          .map { |tx| EnableBankingEntry::Processor.compute_external_id(tx) }
+          .compact.to_set
+
+        book_entry_refs = all_transactions
+          .reject { |tx| tx.with_indifferent_access[:_pending] }
+          .map { |tx| tx.with_indifferent_access[:entry_reference].presence }
+          .compact.to_set
+
+        if include_pending
+          removed_pending ||= existing_transactions.reject! do |tx|
+            tx = tx.with_indifferent_access
+            pending_flag = tx.dig(:extra, :enable_banking, :pending) || tx[:_pending]
+            next false unless pending_flag
+
+            fp = EnableBankingEntry::Processor.compute_external_id(tx)
+            entry_ref = tx[:entry_reference].presence
+            (fp.present? && book_fingerprints.include?(fp)) ||
+              (entry_ref.present? && book_entry_refs.include?(entry_ref))
+          end
+        end
+
+        existing_ids = existing_transactions.map { |tx|
+          EnableBankingEntry::Processor.compute_external_id(tx)
         }.compact.to_set
 
         new_transactions = all_transactions.select do |tx|
-          # Use transaction_id if present, otherwise fall back to entry_reference
-          tx_id = tx[:transaction_id].presence || tx[:entry_reference].presence
-          tx_id.present? && !existing_ids.include?(tx_id)
+          ext_id = EnableBankingEntry::Processor.compute_external_id(tx)
+          ext_id.present? && !existing_ids.include?(ext_id)
         end
 
-        if new_transactions.any?
+        if new_transactions.any? || removed_pending
           enable_banking_account.upsert_enable_banking_transactions_snapshot!(existing_transactions + new_transactions)
         end
+      elsif removed_pending
+        enable_banking_account.upsert_enable_banking_transactions_snapshot!(
+          existing_transactions
+        )
       end
 
       { success: true, transactions_count: transactions_count }
     rescue Provider::EnableBanking::EnableBankingError => e
       Rails.logger.error "EnableBankingItem::Importer - Error fetching transactions for account #{enable_banking_account.uid}: #{e.message}"
-      { success: false, transactions_count: 0, error: e.message }
+      { success: false, transactions_count: 0, error: handle_sync_error(e) }
     rescue => e
       Rails.logger.error "EnableBankingItem::Importer - Unexpected error fetching transactions for account #{enable_banking_account.uid}: #{e.class} - #{e.message}"
-      { success: false, transactions_count: 0, error: e.message }
+      { success: false, transactions_count: 0, error: handle_sync_error(e) }
     end
 
     # Deduplicate transactions from the Enable Banking API response.
@@ -308,6 +401,8 @@ class EnableBankingItem::Importer
     # unique. credit_debit_indicator (CRDT/DBIT) is included because
     # transaction_amount.amount is always positive — without it, a payment
     # and a same-day refund of the same amount would produce identical keys.
+    # status (BOOK/PDNG) is intentionally excluded: the same logical transaction
+    # may appear as PDNG then BOOK across imports and must not create duplicates.
     # Known limitation: when transaction_id is nil for both, pure content
     # comparison applies. This means two genuinely distinct transactions
     # with identical content (same date, amount, direction, creditor, etc.)
@@ -315,18 +410,113 @@ class EnableBankingItem::Importer
     # omit transaction_id rarely produce such exact duplicates in the same
     # API response; timestamps or remittance info usually differ. (Issue #954)
     def build_transaction_content_key(tx)
-      date = tx[:booking_date].presence || tx[:value_date]
+      date = tx[:booking_date].presence || tx[:value_date].presence || tx[:transaction_date]
       amount = tx.dig(:transaction_amount, :amount).presence || tx[:amount]
       currency = tx.dig(:transaction_amount, :currency).presence || tx[:currency]
       creditor = tx.dig(:creditor, :name).presence || tx[:creditor_name]
       debtor = tx.dig(:debtor, :name).presence || tx[:debtor_name]
       remittance = tx[:remittance_information]
       remittance_key = remittance.is_a?(Array) ? remittance.compact.map(&:to_s).sort.join("|") : remittance.to_s
-      status = tx[:status]
       tid = tx[:transaction_id]
       direction = tx[:credit_debit_indicator]
 
-      [ date, amount, currency, creditor, debtor, remittance_key, status, tid, direction ].map(&:to_s).join("\x1F")
+      [ date, amount, currency, creditor, debtor, remittance_key, tid, direction ].map(&:to_s).join("\x1F")
+    end
+
+    class PaginationTruncatedError < StandardError; end
+
+    def fetch_paginated_transactions(enable_banking_account, start_date:, transaction_status:, psu_headers: {})
+      all_transactions = []
+      continuation_key = nil
+      previous_continuation_key = nil
+      page_count = 0
+
+      loop do
+        page_count += 1
+
+        if page_count > MAX_PAGINATION_PAGES
+          msg = "EnableBankingItem::Importer - Pagination limit exceeded for account #{enable_banking_account.uid} (status=#{transaction_status}). Stopped after #{MAX_PAGINATION_PAGES} pages."
+          raise PaginationTruncatedError, msg
+        end
+
+        transactions_data = enable_banking_provider.get_account_transactions(
+          account_id: enable_banking_account.api_account_id,
+          date_from: start_date,
+          continuation_key: continuation_key,
+          transaction_status: transaction_status,
+          psu_headers: psu_headers
+        )
+
+        transactions = transactions_data[:transactions] || []
+        all_transactions.concat(transactions)
+
+        previous_continuation_key = continuation_key
+        continuation_key = transactions_data[:continuation_key]
+
+        if continuation_key.present? && continuation_key == previous_continuation_key
+          msg = "EnableBankingItem::Importer - Repeated continuation_key detected for account #{enable_banking_account.uid} (status=#{transaction_status}). Breaking after #{page_count} pages."
+          raise PaginationTruncatedError, msg
+        end
+
+        break if continuation_key.blank?
+      end
+
+      all_transactions
+    rescue PaginationTruncatedError => e
+      # Log as warning and return collected partial data instead of failing entirely.
+      # This ensures accounts with huge history don't lose all synced data.
+      Rails.logger.warn(e.message)
+      all_transactions
+    end
+
+    def filter_transactions_by_date(transactions, start_date)
+      return transactions unless start_date
+
+      transactions.reject do |tx|
+        tx = tx.with_indifferent_access
+        date_str = tx[:booking_date] || tx[:value_date] || tx[:transaction_date]
+        next false if date_str.blank?  # Keep if no date (cannot determine)
+
+        begin
+          Date.parse(date_str.to_s) < start_date
+        rescue ArgumentError
+          false  # Keep if date is unparseable
+        end
+      end
+    end
+
+    def tag_as_pending(transactions)
+      transactions.map { |tx| tx.merge(_pending: true) }
+    end
+
+    def find_enable_banking_account_by_hash(hash_value)
+      return nil if hash_value.blank?
+
+      # First: exact uid match (primary identification_hash)
+      account = enable_banking_item.enable_banking_accounts.find_by(uid: hash_value.to_s)
+      return account if account
+
+      # Second: search in identification_hashes array (PostgreSQL JSONB contains operator)
+      enable_banking_item.enable_banking_accounts
+        .where("identification_hashes @> ?", [ hash_value.to_s ].to_json)
+        .first
+    end
+
+    def sync_uids_from_accounts_data(accounts_data)
+      return if accounts_data.blank?
+
+      accounts_data.each do |ad|
+        next unless ad.is_a?(Hash)
+        ad = ad.with_indifferent_access
+        identification_hash = ad[:identification_hash]
+        current_uid = ad[:uid]
+        next if identification_hash.blank? || current_uid.blank?
+
+        eb_acc = find_enable_banking_account_by_hash(identification_hash)
+        next unless eb_acc
+        # Update the API account_id (UUID) if it has changed (UIDs are session-scoped)
+        eb_acc.update!(account_id: current_uid) if eb_acc.account_id != current_uid
+      end
     end
 
     def determine_sync_start_date(enable_banking_account)
diff --git a/app/models/enable_banking_item/provided.rb b/app/models/enable_banking_item/provided.rb
index bd57d2795..1466d79cb 100644
--- a/app/models/enable_banking_item/provided.rb
+++ b/app/models/enable_banking_item/provided.rb
@@ -9,4 +9,22 @@ module EnableBankingItem::Provided
       client_certificate: client_certificate
     )
   end
+
+  # Build PSU context headers for data endpoint calls.
+  # The Enable Banking API spec mandates: "either all required PSU headers or none".
+  # We can only provide Psu-Ip-Address (from last_psu_ip stored at request time).
+  # If the ASPSP requires other PSU headers we cannot satisfy server-side, we send none
+  # to avoid a PSU_HEADER_NOT_PROVIDED error for partially-supplied headers.
+  def build_psu_headers
+    return {} if aspsp_required_psu_headers.blank?
+
+    required = aspsp_required_psu_headers.map(&:downcase)
+
+    # Only attempt to satisfy the headers if the only required one is Psu-Ip-Address
+    # (the one we can populate from stored data)
+    satisfiable = required.all? { |h| h == "psu-ip-address" }
+    return {} unless satisfiable && last_psu_ip.present?
+
+    { "Psu-Ip-Address" => last_psu_ip }
+  end
 end
diff --git a/app/models/entry.rb b/app/models/entry.rb
index 48b216f36..84c2719f2 100644
--- a/app/models/entry.rb
+++ b/app/models/entry.rb
@@ -1,6 +1,9 @@
 class Entry < ApplicationRecord
   include Monetizable, Enrichable
 
+  TRUTHY_VALUES = [ true, "true", "1", 1 ].freeze
+  private_constant :TRUTHY_VALUES
+
   attr_accessor :unsplitting
 
   monetize :amount
@@ -48,27 +51,20 @@ class Entry < ApplicationRecord
   # Pending transaction scopes - check Transaction.extra for provider pending flags
   # Works with any provider that stores pending status in extra["provider_name"]["pending"]
   scope :pending, -> {
+    conditions = Transaction::PENDING_PROVIDERS.map { |p| "(transactions.extra -> '#{p}' ->> 'pending')::boolean = true" }
     joins("INNER JOIN transactions ON transactions.id = entries.entryable_id AND entries.entryable_type = 'Transaction'")
-      .where(<<~SQL.squish)
-        (transactions.extra -> 'simplefin' ->> 'pending')::boolean = true
-        OR (transactions.extra -> 'plaid' ->> 'pending')::boolean = true
-        OR (transactions.extra -> 'lunchflow' ->> 'pending')::boolean = true
-      SQL
+      .where(conditions.join(" OR "))
   }
 
   scope :excluding_pending, -> {
     # For non-Transaction entries (Trade, Valuation), always include
-    # For Transaction entries, exclude if pending flag is true
+    # For Transaction entries, exclude if any provider marks it pending
     where(<<~SQL.squish)
       entries.entryable_type != 'Transaction'
       OR NOT EXISTS (
         SELECT 1 FROM transactions t
         WHERE t.id = entries.entryable_id
-        AND (
-          (t.extra -> 'simplefin' ->> 'pending')::boolean = true
-          OR (t.extra -> 'plaid' ->> 'pending')::boolean = true
-          OR (t.extra -> 'lunchflow' ->> 'pending')::boolean = true
-        )
+        AND (#{Transaction::PENDING_CHECK_SQL})
       )
     SQL
   }
@@ -148,6 +144,10 @@ class Entry < ApplicationRecord
   def self.reconcile_pending_duplicates(account: nil, dry_run: false, date_window: 8, amount_tolerance: 0.25)
     stats = { checked: 0, reconciled: 0, details: [] }
 
+    not_pending_sql = Transaction::PENDING_PROVIDERS
+      .map { |p| "(transactions.extra -> '#{p}' ->> 'pending')::boolean IS NOT TRUE" }
+      .join(" AND ")
+
     # Get pending entries to check
     scope = Entry.pending.where(excluded: false)
     scope = scope.where(account: account) if account
@@ -164,11 +164,7 @@ class Entry < ApplicationRecord
         .where(currency: pending_entry.currency)
         .where(amount: pending_entry.amount)
         .where(date: pending_entry.date..(pending_entry.date + date_window.days)) # Posted must be ON or AFTER pending date
-        .where(<<~SQL.squish)
-          (transactions.extra -> 'simplefin' ->> 'pending')::boolean IS NOT TRUE
-          AND (transactions.extra -> 'plaid' ->> 'pending')::boolean IS NOT TRUE
-          AND (transactions.extra -> 'lunchflow' ->> 'pending')::boolean IS NOT TRUE
-        SQL
+        .where(not_pending_sql)
         .limit(2) # Only need to know if 0, 1, or 2+ candidates
         .to_a # Load limited records to avoid COUNT(*) on .size
 
@@ -211,11 +207,7 @@ class Entry < ApplicationRecord
         .where(currency: pending_entry.currency)
         .where(date: pending_entry.date..(pending_entry.date + fuzzy_date_window.days)) # Posted ON or AFTER pending
         .where("ABS(entries.amount) BETWEEN ? AND ?", min_amount, max_amount)
-        .where(<<~SQL.squish)
-          (transactions.extra -> 'simplefin' ->> 'pending')::boolean IS NOT TRUE
-          AND (transactions.extra -> 'plaid' ->> 'pending')::boolean IS NOT TRUE
-          AND (transactions.extra -> 'lunchflow' ->> 'pending')::boolean IS NOT TRUE
-        SQL
+        .where(not_pending_sql)
 
       # Match by name similarity (first 3 words)
       name_words = pending_entry.name.downcase.gsub(/[^a-z0-9\s]/, "").split.first(3).join(" ")
@@ -253,10 +245,12 @@ class Entry < ApplicationRecord
                 pending_transaction.update!(
                   extra: existing_extra.merge(
                     "potential_posted_match" => {
-                      "entry_id" => fuzzy_match.id,
-                      "reason" => "fuzzy_amount_match",
+                      "entry_id"      => fuzzy_match.id,
+                      "reason"        => "fuzzy_amount_match",
                       "posted_amount" => fuzzy_match.amount.to_s,
-                      "detected_at" => Date.current.to_s
+                      "confidence"    => "medium",
+                      "dismissed"     => false,
+                      "detected_at"   => Date.current.to_s
                     }
                   )
                 )
@@ -370,7 +364,7 @@ class Entry < ApplicationRecord
 
   # Splits this entry into child entries. Marks parent as excluded.
   #
-  # @param splits [Array<Hash>] array of { name:, amount:, category_id: } hashes
+  # @param splits [Array<Hash>] array of { name:, amount:, category_id:, excluded: } hashes
   # @return [Array<Entry>] the created child entries
   def split!(splits)
     total = splits.sum { |s| s[:amount].to_d }
@@ -392,6 +386,7 @@ class Entry < ApplicationRecord
           name: split_attrs[:name],
           amount: split_attrs[:amount],
           currency: currency,
+          excluded: TRUTHY_VALUES.include?(split_attrs[:excluded]),
           entryable: child_transaction
         )
       end
@@ -440,6 +435,7 @@ class Entry < ApplicationRecord
       bulk_attributes = {
         date: bulk_update_params[:date],
         notes: bulk_update_params[:notes],
+        name: bulk_update_params[:name],
         entryable_attributes: {
           category_id: bulk_update_params[:category_id],
           merchant_id: bulk_update_params[:merchant_id]
@@ -459,6 +455,7 @@ class Entry < ApplicationRecord
           if bulk_attributes.present?
             attrs = bulk_attributes.dup
             attrs.delete(:date) if entry.split_child?
+            attrs.delete(:entryable_attributes) unless entry.transaction?
 
             if attrs.present?
               attrs[:entryable_attributes] = attrs[:entryable_attributes].dup if attrs[:entryable_attributes].present?
diff --git a/app/models/exchange_rate/importer.rb b/app/models/exchange_rate/importer.rb
index a077401b3..bd1533b57 100644
--- a/app/models/exchange_rate/importer.rb
+++ b/app/models/exchange_rate/importer.rb
@@ -2,6 +2,8 @@ class ExchangeRate::Importer
   MissingExchangeRateError = Class.new(StandardError)
   MissingStartRateError = Class.new(StandardError)
 
+  PROVISIONAL_LOOKBACK_DAYS = 5
+
   def initialize(exchange_rate_provider:, from:, to:, start_date:, end_date:, clear_cache: false)
     @exchange_rate_provider = exchange_rate_provider
     @from = from
@@ -11,10 +13,10 @@ class ExchangeRate::Importer
     @clear_cache = clear_cache
   end
 
-  # Constructs a daily series of rates for the given currency pair for date range
   def import_provider_rates
     if !clear_cache && all_rates_exist?
       Rails.logger.info("No new rates to sync for #{from} to #{to} between #{start_date} and #{end_date}, skipping")
+      backfill_inverse_rates_if_needed
       return
     end
 
@@ -25,6 +27,24 @@ class ExchangeRate::Importer
 
     prev_rate_value = start_rate_value
 
+    # Always find the earliest valid provider rate for pair metadata tracking.
+    # record_first_provider_rate_on's atomic guard prevents moving the date forward.
+    earliest_valid_provider_date = provider_rates.values
+      .select { |r| r.rate.present? && r.rate.to_f > 0 }
+      .min_by(&:date)&.date
+
+    # When no anchor rate exists, advance the loop start to the earliest provider rate
+    loop_start_date = fill_start_date
+    if prev_rate_value.blank? && earliest_valid_provider_date
+      earliest_rate = provider_rates[earliest_valid_provider_date]
+      Rails.logger.info(
+        "#{from}->#{to}: no provider rate on or before #{start_date}; " \
+        "advancing gapfill start to earliest valid provider date #{earliest_valid_provider_date}"
+      )
+      prev_rate_value = earliest_rate.rate
+      loop_start_date = earliest_valid_provider_date
+    end
+
     unless prev_rate_value.present?
       error = MissingStartRateError.new("Could not find a start rate for #{from} to #{to} between #{start_date} and #{end_date}")
       Rails.logger.error(error.message)
@@ -32,20 +52,18 @@ class ExchangeRate::Importer
       return
     end
 
-    gapfilled_rates = effective_start_date.upto(end_date).map do |date|
+    # Gapfill with LOCF strategy (last observation carried forward):
+    # when the provider returns nothing for weekends/holidays, carry the previous rate.
+    gapfilled_rates = loop_start_date.upto(end_date).map do |date|
       db_rate_value = db_rates[date]&.rate
       provider_rate_value = provider_rates[date]&.rate
 
-      chosen_rate = if clear_cache
-        provider_rate_value || db_rate_value   # overwrite when possible
+      chosen_rate = if provider_rate_value.present? && provider_rate_value.to_f > 0
+        provider_rate_value
+      elsif db_rate_value.present? && db_rate_value.to_f > 0
+        db_rate_value
       else
-        db_rate_value || provider_rate_value   # fill gaps
-      end
-
-      # Gapfill with LOCF strategy (last observation carried forward)
-      # Treat nil or zero rates as invalid and use previous rate
-      if chosen_rate.nil? || chosen_rate.to_f <= 0
-        chosen_rate = prev_rate_value
+        prev_rate_value
       end
 
       prev_rate_value = chosen_rate
@@ -59,11 +77,43 @@ class ExchangeRate::Importer
     end
 
     upsert_rows(gapfilled_rates)
+
+    # Compute and upsert inverse rates (e.g., EUR→USD from USD→EUR) to avoid
+    # separate API calls for the reverse direction.
+    inverse_rates = gapfilled_rates.filter_map do |row|
+      next if row[:rate].to_f <= 0
+
+      {
+        from_currency: row[:to_currency],
+        to_currency: row[:from_currency],
+        date: row[:date],
+        rate: (BigDecimal("1") / BigDecimal(row[:rate].to_s)).round(12)
+      }
+    end
+
+    upsert_rows(inverse_rates)
+
+    # Backfill inverse rows for any forward rates that existed in the DB
+    # before the loop range (i.e. dates not covered by gapfilled_rates).
+    backfill_inverse_rates_if_needed
+
+    if earliest_valid_provider_date.present?
+      ExchangeRatePair.record_first_provider_rate_on(
+        from: from, to: to, date: earliest_valid_provider_date,
+        provider_name: current_provider_name
+      )
+    end
   end
 
   private
     attr_reader :exchange_rate_provider, :from, :to, :start_date, :end_date, :clear_cache
 
+    # Resolves the provider name the same way as ExchangeRate::Provided.provider:
+    # ENV takes precedence over the DB Setting to stay consistent in env-configured deployments.
+    def current_provider_name
+      @current_provider_name ||= (ENV["EXCHANGE_RATE_PROVIDER"].presence || Setting.exchange_rate_provider).to_s
+    end
+
     def upsert_rows(rows)
       batch_size = 200
 
@@ -82,34 +132,82 @@ class ExchangeRate::Importer
       total_upsert_count
     end
 
-    # Since provider may not return values on weekends and holidays, we grab the first rate from the provider that is on or before the start date
     def start_rate_value
-      provider_rate_value = provider_rates.select { |date, _| date <= start_date }.max_by { |date, _| date }&.last
-      db_rate_value = db_rates[start_date]&.rate
-      provider_rate_value || db_rate_value
+      if fill_start_date == start_date
+        provider_rate_value = latest_valid_provider_rate(before_or_on: start_date)
+        db_rate_value = db_rates[start_date]&.rate
+
+        return provider_rate_value if provider_rate_value.present?
+        return db_rate_value if db_rate_value.present? && db_rate_value.to_f > 0
+        return nil
+      end
+
+      cutoff_date = fill_start_date
+
+      provider_rate_value = latest_valid_provider_rate(before: cutoff_date)
+      return provider_rate_value if provider_rate_value.present?
+
+      ExchangeRate
+        .where(from_currency: from, to_currency: to)
+        .where("date < ?", cutoff_date)
+        .where("rate > 0")
+        .order(date: :desc)
+        .limit(1)
+        .pick(:rate)
+    end
+
+    # Scans provider_rates for the most recent entry with a positive rate,
+    # rather than just picking the latest row (which could be zero/nil).
+    def latest_valid_provider_rate(before_or_on: nil, before: nil)
+      cutoff = before_or_on || before
+      comparator = before_or_on ? :<= : :<
+
+      provider_rates
+        .select { |date, r| date.send(comparator, cutoff) && r.rate.present? && r.rate.to_f > 0 }
+        .max_by { |date, _| date }&.last&.rate
+    end
+
+    def clamped_start_date
+      @clamped_start_date ||= begin
+        listed = exchange_rate_pair.first_provider_rate_on
+        listed.present? && listed > start_date ? listed : start_date
+      end
+    end
+
+    def exchange_rate_pair
+      @exchange_rate_pair ||= ExchangeRatePair.for_pair(from: from, to: to, provider_name: current_provider_name)
+    end
+
+    def fill_start_date
+      @fill_start_date ||= [ provider_fetch_start_date, effective_start_date ].max
+    end
+
+    def provider_fetch_start_date
+      @provider_fetch_start_date ||= begin
+        base = effective_start_date - PROVISIONAL_LOOKBACK_DAYS.days
+        max_days = exchange_rate_provider.respond_to?(:max_history_days) ? exchange_rate_provider.max_history_days : nil
+
+        if max_days && (end_date - base).to_i > max_days
+          clamped = end_date - max_days.days
+          Rails.logger.info(
+            "#{exchange_rate_provider.class.name} max history is #{max_days} days; " \
+            "clamping #{from}->#{to} start_date from #{base} to #{clamped}"
+          )
+          clamped
+        else
+          base
+        end
+      end
     end
 
-    # No need to fetch/upsert rates for dates that we already have in the DB
     def effective_start_date
       return start_date if clear_cache
 
-      first_missing_date = nil
-
-      start_date.upto(end_date) do |date|
-        unless db_rates.key?(date)
-          first_missing_date = date
-          break
-        end
-      end
-
-      first_missing_date || end_date
+      (clamped_start_date..end_date).detect { |d| !db_rates.key?(d) } || end_date
     end
 
     def provider_rates
       @provider_rates ||= begin
-        # Always fetch with a 5 day buffer to ensure we have a starting rate (for weekends and holidays)
-        provider_fetch_start_date = effective_start_date - 5.days
-
         provider_response = exchange_rate_provider.fetch_exchange_rates(
           from: from,
           to: to,
@@ -118,6 +216,7 @@ class ExchangeRate::Importer
         )
 
         if provider_response.success?
+          Rails.logger.debug("Fetched #{provider_response.data.size} rates from #{exchange_rate_provider.class.name} for #{from}/#{to} between #{provider_fetch_start_date} and #{end_date}")
           provider_response.data.index_by(&:date)
         else
           message = "#{exchange_rate_provider.class.name} could not fetch exchange rate pair from: #{from} to: #{to} between: #{effective_start_date} and: #{Date.current}.  Provider error: #{provider_response.error.message}"
@@ -128,16 +227,37 @@ class ExchangeRate::Importer
       end
     end
 
+    def backfill_inverse_rates_if_needed
+      existing_inverse_dates = ExchangeRate.where(from_currency: to, to_currency: from, date: clamped_start_date..end_date).pluck(:date).to_set
+      return if existing_inverse_dates.size >= expected_count
+
+      inverse_rows = db_rates.filter_map do |_date, rate|
+        next if existing_inverse_dates.include?(rate.date)
+        next if rate.rate.to_f <= 0
+
+        {
+          from_currency: to,
+          to_currency: from,
+          date: rate.date,
+          rate: (BigDecimal("1") / BigDecimal(rate.rate.to_s)).round(12)
+        }
+      end
+
+      upsert_rows(inverse_rows) if inverse_rows.any?
+    end
+
     def all_rates_exist?
       db_count == expected_count
     end
 
     def expected_count
-      (start_date..end_date).count
+      (clamped_start_date..end_date).count
     end
 
     def db_count
-      db_rates.count
+      ExchangeRate
+        .where(from_currency: from, to_currency: to, date: clamped_start_date..end_date)
+        .count
     end
 
     def db_rates
@@ -148,8 +268,7 @@ class ExchangeRate::Importer
     end
 
     # Normalizes an end date so that it never exceeds today's date in the
-    # America/New_York timezone. If the caller passes a future date we clamp
-    # it to today so that upstream provider calls remain valid and predictable.
+    # America/New_York timezone.
     def normalize_end_date(requested_end_date)
       today_est = Date.current.in_time_zone("America/New_York").to_date
       [ requested_end_date, today_est ].min
diff --git a/app/models/exchange_rate/provided.rb b/app/models/exchange_rate/provided.rb
index 8a3f88af3..157d793a9 100644
--- a/app/models/exchange_rate/provided.rb
+++ b/app/models/exchange_rate/provided.rb
@@ -58,6 +58,11 @@ module ExchangeRate::Provided
     def rates_for(currencies, to:, date: Date.current)
       currencies.uniq.each_with_object({}) do |currency, map|
         rate = find_or_fetch_rate(from: currency, to: to, date: date)
+        if rate.nil?
+          Rails.logger.warn("No exchange rate found for #{currency}/#{to} on #{date}, using 1")
+        elsif rate.date != date
+          Rails.logger.debug("FX rate #{currency}/#{to}: using #{rate.date} for #{date} (gap=#{(date - rate.date).to_i}d)")
+        end
         map[currency] = rate&.rate || 1
       end
     end
@@ -69,14 +74,37 @@ module ExchangeRate::Provided
         return 0
       end
 
-      ExchangeRate::Importer.new(
-        exchange_rate_provider: provider,
-        from: from,
-        to: to,
-        start_date: start_date,
-        end_date: end_date,
-        clear_cache: clear_cache
-      ).import_provider_rates
+      # Prevent concurrent syncs from fetching the same currency pair for overlapping
+      # date ranges. The lock is scoped to (pair + start_date) so that a broader range
+      # (e.g. daily job needing older history) is not blocked by a narrower account sync.
+      #
+      # Uses an owner-token pattern: the lock value is a unique token so the ensure
+      # block only deletes its own lock, not one acquired by a different worker after
+      # expiry. TTL is 5 minutes to cover worst-case throttle + rate-limit retry waits
+      # (~3 minutes with TwelveData).
+      lock_key = "exchange_rate_import:#{from}:#{to}:#{start_date}"
+      lock_token = SecureRandom.uuid
+      acquired = Rails.cache.write(lock_key, lock_token, expires_in: 5.minutes, unless_exist: true)
+
+      unless acquired
+        Rails.logger.info("Skipping exchange rate import for #{from}/#{to} from #{start_date} — already in progress")
+        return 0
+      end
+
+      begin
+        ExchangeRate::Importer.new(
+          exchange_rate_provider: provider,
+          from: from,
+          to: to,
+          start_date: start_date,
+          end_date: end_date,
+          clear_cache: clear_cache
+        ).import_provider_rates
+      ensure
+        # Only delete the lock if we still own it (it hasn't expired and been
+        # re-acquired by another worker).
+        Rails.cache.delete(lock_key) if Rails.cache.read(lock_key) == lock_token
+      end
     end
   end
 end
diff --git a/app/models/exchange_rate_pair.rb b/app/models/exchange_rate_pair.rb
new file mode 100644
index 000000000..2da5f72be
--- /dev/null
+++ b/app/models/exchange_rate_pair.rb
@@ -0,0 +1,42 @@
+class ExchangeRatePair < ApplicationRecord
+  validates :from_currency, :to_currency, presence: true
+
+  def self.for_pair(from:, to:, provider_name: nil)
+    pair = find_or_create_by!(from_currency: from, to_currency: to)
+    current_provider = provider_name || resolve_provider_name
+
+    if pair.provider_name != current_provider && pair.first_provider_rate_on.present?
+      ExchangeRatePair
+        .where(id: pair.id)
+        .where.not(provider_name: current_provider)
+        .update_all(first_provider_rate_on: nil, provider_name: current_provider, updated_at: Time.current)
+      pair.reload
+    end
+
+    pair
+  rescue ActiveRecord::RecordNotUnique
+    find_by!(from_currency: from, to_currency: to)
+  end
+
+  # Resolves the runtime provider name the same way as ExchangeRate::Provided.provider:
+  # ENV takes precedence over the DB Setting.
+  def self.resolve_provider_name
+    (ENV["EXCHANGE_RATE_PROVIDER"].presence || Setting.exchange_rate_provider).to_s
+  end
+
+  def self.record_first_provider_rate_on(from:, to:, date:, provider_name: nil)
+    return if date.blank?
+
+    current_provider = provider_name || resolve_provider_name
+    pair = for_pair(from: from, to: to, provider_name: current_provider)
+
+    ExchangeRatePair
+      .where(id: pair.id)
+      .where("first_provider_rate_on IS NULL OR first_provider_rate_on > ?", date)
+      .update_all(
+        first_provider_rate_on: date,
+        provider_name: current_provider,
+        updated_at: Time.current
+      )
+  end
+end
diff --git a/app/models/family.rb b/app/models/family.rb
index a287c8957..73a3da1ef 100644
--- a/app/models/family.rb
+++ b/app/models/family.rb
@@ -1,8 +1,8 @@
 class Family < ApplicationRecord
   include Syncable, AutoTransferMatchable, Subscribeable, VectorSearchable
   include PlaidConnectable, SimplefinConnectable, LunchflowConnectable, EnableBankingConnectable
-  include CoinbaseConnectable, BinanceConnectable, CoinstatsConnectable, SnaptradeConnectable, MercuryConnectable
-  include IndexaCapitalConnectable
+  include CoinbaseConnectable, BinanceConnectable, KrakenConnectable, CoinstatsConnectable, SnaptradeConnectable, MercuryConnectable, BrexConnectable, SophtronConnectable
+  include IndexaCapitalConnectable, IbkrConnectable
 
   DATE_FORMATS = [
     [ "MM-DD-YYYY", "%m-%d-%Y" ],
@@ -28,6 +28,7 @@ class Family < ApplicationRecord
 
   has_many :imports, dependent: :destroy
   has_many :family_exports, dependent: :destroy
+  has_many :account_statements, dependent: :destroy
 
   has_many :entries, through: :accounts
   has_many :transactions, through: :accounts
@@ -53,13 +54,55 @@ class Family < ApplicationRecord
   validates :assistant_type, inclusion: { in: ASSISTANT_TYPES }
   validates :default_account_sharing, inclusion: { in: SHARING_DEFAULTS }
 
+  before_validation :normalize_enabled_currencies!
+
+  def primary_currency_code
+    normalize_currency_code(currency) || "USD"
+  end
+
+  def custom_enabled_currencies?
+    enabled_currencies.present?
+  end
+
+  def enabled_currency_codes(extra: [])
+    selected_codes = if custom_enabled_currencies?
+      [ primary_currency_code, *Array(enabled_currencies) ]
+    else
+      Money::Currency.as_options.map(&:iso_code)
+    end
+
+    normalize_currency_codes([ *selected_codes, *Array(extra) ])
+  end
+
+  def enabled_currency_objects(extra: [])
+    enabled_currency_codes(extra:).map { |code| Money::Currency.new(code) }
+  end
+
+  def secondary_enabled_currency_objects(extra: [])
+    enabled_currency_objects(extra:).reject { |currency| currency.iso_code == primary_currency_code }
+  end
+
 
   def moniker_label
-    moniker.presence || "Family"
+    case moniker.presence
+    when nil, "Family"
+      I18n.t("shared.family_moniker.singular", default: "Family")
+    when "Group"
+      I18n.t("shared.family_moniker.group_singular", default: "Group")
+    else
+      moniker
+    end
   end
 
   def moniker_label_plural
-    moniker_label == "Group" ? "Groups" : "Families"
+    case moniker.presence
+    when nil, "Family"
+      I18n.t("shared.family_moniker.plural", default: "Families")
+    when "Group"
+      I18n.t("shared.family_moniker.group_plural", default: "Groups")
+    else
+      "#{moniker}s"
+    end
   end
 
   def share_all_by_default?
@@ -300,4 +343,29 @@ class Family < ApplicationRecord
   def self_hoster?
     Rails.application.config.app_mode.self_hosted?
   end
+
+  private
+    def normalize_enabled_currencies!
+      if enabled_currencies.blank?
+        self.enabled_currencies = nil
+        return
+      end
+
+      normalized_codes = normalize_currency_codes([ primary_currency_code, *Array(enabled_currencies) ])
+      all_codes = Money::Currency.as_options.map(&:iso_code)
+      all_selected = normalized_codes.size == all_codes.size && (normalized_codes - all_codes).empty?
+      self.enabled_currencies = all_selected ? nil : normalized_codes
+    end
+
+    def normalize_currency_codes(values)
+      Array(values).filter_map { |value| normalize_currency_code(value) }.uniq
+    end
+
+    def normalize_currency_code(value)
+      return if value.blank?
+
+      Money::Currency.new(value).iso_code
+    rescue Money::Currency::UnknownCurrencyError, ArgumentError
+      nil
+    end
 end
diff --git a/app/models/family/brex_connectable.rb b/app/models/family/brex_connectable.rb
new file mode 100644
index 000000000..49fe3e560
--- /dev/null
+++ b/app/models/family/brex_connectable.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Family::BrexConnectable
+  extend ActiveSupport::Concern
+
+  included do
+    has_many :brex_items, dependent: :destroy
+  end
+
+  def can_connect_brex?
+    true
+  end
+
+  def create_brex_item!(token:, base_url: nil, item_name: nil)
+    brex_item = brex_items.create!(
+      name: item_name.presence || I18n.t("brex_items.default_connection_name"),
+      token: token,
+      base_url: base_url
+    )
+
+    brex_item.sync_later
+
+    brex_item
+  end
+
+  def has_brex_credentials?
+    brex_items.active.with_credentials.exists?
+  end
+end
diff --git a/app/models/family/data_exporter.rb b/app/models/family/data_exporter.rb
index dc0ffae13..0435e1ec3 100644
--- a/app/models/family/data_exporter.rb
+++ b/app/models/family/data_exporter.rb
@@ -2,6 +2,8 @@ require "zip"
 require "csv"
 
 class Family::DataExporter
+  EXPORT_VERSION = 2
+
   def initialize(family)
     @family = family
   end
@@ -9,6 +11,10 @@ class Family::DataExporter
   def generate_export
     # Create a StringIO to hold the zip data in memory
     zip_data = Zip::OutputStream.write_buffer do |zipfile|
+      # Add export version marker for downstream tooling
+      zipfile.put_next_entry("version.txt")
+      zipfile.write generate_version_txt
+
       # Add accounts.csv
       zipfile.put_next_entry("accounts.csv")
       zipfile.write generate_accounts_csv
@@ -29,6 +35,10 @@ class Family::DataExporter
       zipfile.put_next_entry("rules.csv")
       zipfile.write generate_rules_csv
 
+      # Add attachment manifest metadata. Binary file payloads are not included.
+      zipfile.put_next_entry("attachments.json")
+      zipfile.write generate_attachments_manifest
+
       # Add all.ndjson
       zipfile.put_next_entry("all.ndjson")
       zipfile.write generate_ndjson
@@ -40,6 +50,11 @@ class Family::DataExporter
   end
 
   private
+    def generate_version_txt
+      <<~TEXT
+        export_version: #{EXPORT_VERSION}
+      TEXT
+    end
 
     def generate_accounts_csv
       CSV.generate do |csv|
@@ -66,17 +81,16 @@ class Family::DataExporter
 
         # Only export transactions from accounts belonging to this family
         # Exclude split parents (export children instead)
-        @family.transactions
+        exportable_transactions
           .includes(:category, :tags, entry: :account)
-          .merge(Entry.excluding_split_parents)
           .find_each do |transaction|
             csv << [
-              transaction.entry.date.iso8601,
+              transaction.entry.date&.iso8601,
               transaction.entry.account.name,
               transaction.entry.amount.to_s,
               transaction.entry.name,
               transaction.category&.name,
-              transaction.tags.pluck(:name).join(","),
+              transaction.tags.map { |tag| escape_legacy_tag_name(tag.name) }.join(","),
               transaction.entry.notes,
               transaction.entry.currency
             ]
@@ -84,6 +98,10 @@ class Family::DataExporter
       end
     end
 
+    def escape_legacy_tag_name(name)
+      name.to_s.gsub(/[\\,|]/) { |char| "\\#{char}" }
+    end
+
     def generate_trades_csv
       CSV.generate do |csv|
         csv << [ "date", "account_name", "ticker", "quantity", "price", "amount", "currency" ]
@@ -93,7 +111,7 @@ class Family::DataExporter
           .includes(:security, entry: :account)
           .find_each do |trade|
             csv << [
-              trade.entry.date.iso8601,
+              trade.entry.date&.iso8601,
               trade.entry.account.name,
               trade.security.ticker,
               trade.qty.to_s,
@@ -139,6 +157,69 @@ class Family::DataExporter
       end
     end
 
+    def generate_attachments_manifest
+      {
+        version: 1,
+        binary_included: false,
+        attachments: attachment_manifest_items
+      }.to_json
+    end
+
+    def attachment_manifest_items
+      (transaction_attachment_manifest_items + family_document_attachment_manifest_items)
+        .sort_by { |item| [ item[:record_type], item[:record_id].to_s, item[:filename].to_s, item[:id].to_s ] }
+    end
+
+    def transaction_attachment_manifest_items
+      @family.transactions
+        .with_attached_attachments
+        .includes(:attachments_attachments, entry: :account)
+        .flat_map do |transaction|
+          transaction.attachments.map do |attachment|
+            attachment_manifest_item(
+              attachment,
+              record_type: "Transaction",
+              record_id: transaction.id,
+              extra: {
+                entry_id: transaction.entry.id,
+                account_id: transaction.entry.account_id
+              }
+            )
+          end
+        end
+    end
+
+    def family_document_attachment_manifest_items
+      @family.family_documents.with_attached_file.filter_map do |document|
+        next unless document.file.attached?
+
+        attachment_manifest_item(
+          document.file.attachment,
+          record_type: "FamilyDocument",
+          record_id: document.id,
+          extra: {
+            status: document.status
+          }
+        )
+      end
+    end
+
+    def attachment_manifest_item(attachment, record_type:, record_id:, extra: {})
+      blob = attachment.blob
+      {
+        id: attachment.id,
+        record_type: record_type,
+        record_id: record_id,
+        name: attachment.name,
+        filename: blob.filename.to_s,
+        content_type: blob.content_type,
+        byte_size: blob.byte_size,
+        checksum: blob.checksum,
+        binary_included: false,
+        created_at: attachment.created_at
+      }.merge(extra)
+    end
+
     def generate_ndjson
       lines = []
 
@@ -154,6 +235,39 @@ class Family::DataExporter
         }.to_json
       end
 
+      Balance.joins(:account)
+        .where(accounts: { family_id: @family.id })
+        .chronological
+        .each do |balance|
+        lines << {
+          type: "Balance",
+          data: {
+            id: balance.id,
+            account_id: balance.account_id,
+            date: balance.date,
+            balance: balance.balance,
+            currency: balance.currency,
+            cash_balance: balance.cash_balance,
+            start_cash_balance: balance.start_cash_balance,
+            start_non_cash_balance: balance.start_non_cash_balance,
+            cash_inflows: balance.cash_inflows,
+            cash_outflows: balance.cash_outflows,
+            non_cash_inflows: balance.non_cash_inflows,
+            non_cash_outflows: balance.non_cash_outflows,
+            net_market_flows: balance.net_market_flows,
+            cash_adjustments: balance.cash_adjustments,
+            non_cash_adjustments: balance.non_cash_adjustments,
+            flows_factor: balance.flows_factor,
+            start_balance: balance.start_balance,
+            end_cash_balance: balance.end_cash_balance,
+            end_non_cash_balance: balance.end_non_cash_balance,
+            end_balance: balance.end_balance,
+            created_at: balance.created_at,
+            updated_at: balance.updated_at
+          }
+        }.to_json
+      end
+
       # Export categories
       @family.categories.find_each do |category|
         lines << {
@@ -178,8 +292,16 @@ class Family::DataExporter
         }.to_json
       end
 
+      # Export recurring transactions after accounts and merchants so import can remap dependencies.
+      @family.recurring_transactions.includes(:account, :merchant).find_each do |recurring_transaction|
+        lines << {
+          type: "RecurringTransaction",
+          data: serialize_recurring_transaction_for_export(recurring_transaction)
+        }.to_json
+      end
+
       # Export transactions with full data (exclude split parents, export children instead)
-      @family.transactions.includes(:category, :merchant, :tags, entry: :account).merge(Entry.excluding_split_parents).find_each do |transaction|
+      exportable_transactions.includes(:category, :merchant, :tags, entry: :account).find_each do |transaction|
         lines << {
           type: "Transaction",
           data: {
@@ -202,6 +324,35 @@ class Family::DataExporter
         }.to_json
       end
 
+      # Export transfer decisions after transactions so import can remap both sides.
+      family_transfers.find_each do |transfer|
+        lines << {
+          type: "Transfer",
+          data: {
+            id: transfer.id,
+            inflow_transaction_id: transfer.inflow_transaction_id,
+            outflow_transaction_id: transfer.outflow_transaction_id,
+            status: transfer.status,
+            notes: transfer.notes,
+            created_at: transfer.created_at,
+            updated_at: transfer.updated_at
+          }
+        }.to_json
+      end
+
+      family_rejected_transfers.find_each do |rejected_transfer|
+        lines << {
+          type: "RejectedTransfer",
+          data: {
+            id: rejected_transfer.id,
+            inflow_transaction_id: rejected_transfer.inflow_transaction_id,
+            outflow_transaction_id: rejected_transfer.outflow_transaction_id,
+            created_at: rejected_transfer.created_at,
+            updated_at: rejected_transfer.updated_at
+          }
+        }.to_json
+      end
+
       # Export trades with full data
       @family.trades.includes(:security, entry: :account).find_each do |trade|
         lines << {
@@ -212,6 +363,8 @@ class Family::DataExporter
             account_id: trade.entry.account_id,
             security_id: trade.security_id,
             ticker: trade.security.ticker,
+            security_name: trade.security.name,
+            exchange_operating_mic: trade.security.exchange_operating_mic,
             date: trade.entry.date,
             qty: trade.qty,
             price: trade.price,
@@ -223,6 +376,35 @@ class Family::DataExporter
         }.to_json
       end
 
+      # Export holding snapshots for backup and portfolio verification.
+      @family.holdings.includes(:account, :security).find_each do |holding|
+        lines << {
+          type: "Holding",
+          data: {
+            id: holding.id,
+            account_id: holding.account_id,
+            security_id: holding.security_id,
+            ticker: holding.security.ticker,
+            security_name: holding.security.name,
+            exchange_operating_mic: holding.security.exchange_operating_mic,
+            exchange_mic: holding.security.exchange_mic,
+            exchange_acronym: holding.security.exchange_acronym,
+            country_code: holding.security.country_code,
+            kind: holding.security.kind,
+            website_url: holding.security.website_url,
+            date: holding.date,
+            qty: holding.qty,
+            price: holding.price,
+            amount: holding.amount,
+            currency: holding.currency,
+            cost_basis: holding.cost_basis,
+            cost_basis_source: holding.cost_basis_source,
+            cost_basis_locked: holding.cost_basis_locked,
+            security_locked: holding.security_locked
+          }
+        }.to_json
+      end
+
       # Export valuations
       @family.entries.valuations.includes(:account, :entryable).find_each do |entry|
         lines << {
@@ -235,6 +417,7 @@ class Family::DataExporter
             amount: entry.amount,
             currency: entry.currency,
             name: entry.name,
+            kind: entry.entryable.kind,
             created_at: entry.created_at,
             updated_at: entry.updated_at
           }
@@ -269,6 +452,50 @@ class Family::DataExporter
       lines.join("\n")
     end
 
+    def exportable_transactions
+      @family.transactions.merge(Entry.excluding_split_parents)
+    end
+
+    def family_transaction_ids
+      @family_transaction_ids ||= exportable_transactions.select(:id)
+    end
+
+    def family_transfers
+      Transfer.where(
+        inflow_transaction_id: family_transaction_ids,
+        outflow_transaction_id: family_transaction_ids
+      )
+    end
+
+    def family_rejected_transfers
+      RejectedTransfer.where(
+        inflow_transaction_id: family_transaction_ids,
+        outflow_transaction_id: family_transaction_ids
+      )
+    end
+
+    def serialize_recurring_transaction_for_export(recurring_transaction)
+      {
+        id: recurring_transaction.id,
+        account_id: recurring_transaction.account_id,
+        merchant_id: recurring_transaction.merchant_id,
+        amount: recurring_transaction.amount,
+        currency: recurring_transaction.currency,
+        expected_day_of_month: recurring_transaction.expected_day_of_month,
+        last_occurrence_date: recurring_transaction.last_occurrence_date,
+        next_expected_date: recurring_transaction.next_expected_date,
+        status: recurring_transaction.status,
+        occurrence_count: recurring_transaction.occurrence_count,
+        name: recurring_transaction.name,
+        manual: recurring_transaction.manual,
+        expected_amount_min: recurring_transaction.expected_amount_min,
+        expected_amount_max: recurring_transaction.expected_amount_max,
+        expected_amount_avg: recurring_transaction.expected_amount_avg,
+        created_at: recurring_transaction.created_at,
+        updated_at: recurring_transaction.updated_at
+      }
+    end
+
     def serialize_rule_for_export(rule)
       {
         name: rule.name,
@@ -281,11 +508,14 @@ class Family::DataExporter
     end
 
     def serialize_condition(condition)
+      operand = resolve_condition_operand(condition)
       data = {
         condition_type: condition.condition_type,
         operator: condition.operator,
-        value: resolve_condition_value(condition)
+        value: operand[:value]
       }
+      value_ref = operand[:value_ref]
+      data[:value_ref] = value_ref if value_ref.present?
 
       if condition.compound? && condition.sub_conditions.any?
         data[:sub_conditions] = condition.sub_conditions.map { |sub| serialize_condition(sub) }
@@ -295,52 +525,79 @@ class Family::DataExporter
     end
 
     def serialize_action(action)
-      {
+      operand = resolve_action_operand(action)
+      data = {
         action_type: action.action_type,
-        value: resolve_action_value(action)
+        value: operand[:value]
       }
+      value_ref = operand[:value_ref]
+      data[:value_ref] = value_ref if value_ref.present?
+
+      data
     end
 
-    def resolve_condition_value(condition)
-      return condition.value unless condition.value.present?
+    def resolve_condition_operand(condition)
+      return rule_operand(condition.value) unless condition.value.present?
 
       # Map category UUIDs to names for portability
-      if condition.condition_type == "transaction_category" && condition.value.present?
-        category = @family.categories.find_by(id: condition.value)
-        return category&.name || condition.value
+      if condition.condition_type == "transaction_category"
+        return rule_operand(condition.value, type: "Category", relation: @family.categories)
       end
 
       # Map merchant UUIDs to names for portability
-      if condition.condition_type == "transaction_merchant" && condition.value.present?
-        merchant = @family.merchants.find_by(id: condition.value)
-        return merchant&.name || condition.value
+      if condition.condition_type == "transaction_merchant"
+        return rule_operand(condition.value, type: "Merchant", relation: @family.merchants)
       end
 
-      condition.value
+      rule_operand(condition.value)
     end
 
-    def resolve_action_value(action)
-      return action.value unless action.value.present?
+    def resolve_action_operand(action)
+      return rule_operand(action.value) unless action.value.present?
 
       # Map category UUIDs to names for portability
-      if action.action_type == "set_transaction_category" && action.value.present?
-        category = @family.categories.find_by(id: action.value) || @family.categories.find_by(name: action.value)
-        return category&.name || action.value
+      if action.action_type == "set_transaction_category"
+        return rule_operand(action.value, type: "Category", relation: @family.categories, fallback_to_name: true)
       end
 
       # Map merchant UUIDs to names for portability
-      if action.action_type == "set_transaction_merchant" && action.value.present?
-        merchant = @family.merchants.find_by(id: action.value) || @family.merchants.find_by(name: action.value)
-        return merchant&.name || action.value
+      if action.action_type == "set_transaction_merchant"
+        return rule_operand(action.value, type: "Merchant", relation: @family.merchants, fallback_to_name: true)
       end
 
       # Map tag UUIDs to names for portability
-      if action.action_type == "set_transaction_tags" && action.value.present?
-        tag = @family.tags.find_by(id: action.value) || @family.tags.find_by(name: action.value)
-        return tag&.name || action.value
+      if action.action_type == "set_transaction_tags"
+        return rule_operand(action.value, type: "Tag", relation: @family.tags, fallback_to_name: true)
       end
 
-      action.value
+      rule_operand(action.value)
+    end
+
+    def rule_operand(value, type: nil, relation: nil, fallback_to_name: false)
+      record = relation && resolve_rule_operand_record(relation, value, fallback_to_name: fallback_to_name)
+
+      {
+        value: record&.name || value,
+        value_ref: record ? rule_value_ref(type, record) : nil
+      }
+    end
+
+    def resolve_rule_operand_record(relation, value, fallback_to_name:)
+      return relation.find_by(id: value) if uuid_like?(value)
+
+      relation.find_by(name: value) if fallback_to_name
+    end
+
+    def rule_value_ref(type, record)
+      {
+        type: type,
+        id: record.id,
+        name: record.name
+      }
+    end
+
+    def uuid_like?(value)
+      UuidFormat.valid?(value)
     end
 
     def serialize_conditions_for_csv(conditions)
diff --git a/app/models/family/data_importer.rb b/app/models/family/data_importer.rb
index 4b6f2339b..8ee468dc8 100644
--- a/app/models/family/data_importer.rb
+++ b/app/models/family/data_importer.rb
@@ -1,5 +1,7 @@
+require "set"
+
 class Family::DataImporter
-  SUPPORTED_TYPES = %w[Account Category Tag Merchant Transaction Trade Valuation Budget BudgetCategory Rule].freeze
+  SUPPORTED_TYPES = %w[Account Balance Category Tag Merchant RecurringTransaction Transaction Transfer RejectedTransfer Trade Holding Valuation Budget BudgetCategory Rule].freeze
   ACCOUNTABLE_TYPES = Accountable::TYPES.freeze
 
   def initialize(family, ndjson_content)
@@ -10,24 +12,34 @@ class Family::DataImporter
       categories: {},
       tags: {},
       merchants: {},
+      recurring_transactions: {},
+      transactions: {},
       budgets: {},
       securities: {}
     }
+    @security_cache = {}
     @created_accounts = []
     @created_entries = []
   end
 
   def import!
     records = parse_ndjson
+    @oldest_import_entry_dates_by_account = oldest_import_entry_dates_by_account(records)
+    @imported_opening_anchor_account_ids = imported_opening_anchor_account_ids(records["Valuation"] || [])
 
     Import.transaction do
       # Import in dependency order
       import_accounts(records["Account"] || [])
+      import_balances(records["Balance"] || [])
       import_categories(records["Category"] || [])
       import_tags(records["Tag"] || [])
       import_merchants(records["Merchant"] || [])
+      import_recurring_transactions(records["RecurringTransaction"] || [])
       import_transactions(records["Transaction"] || [])
+      import_transfers(records["Transfer"] || [])
+      import_rejected_transfers(records["RejectedTransfer"] || [])
       import_trades(records["Trade"] || [])
+      import_holdings(records["Holding"] || [])
       import_valuations(records["Valuation"] || [])
       import_budgets(records["Budget"] || [])
       import_budget_categories(records["BudgetCategory"] || [])
@@ -92,15 +104,20 @@ class Family::DataImporter
           institution_name: data["institution_name"],
           institution_domain: data["institution_domain"],
           notes: data["notes"],
-          status: "active"
+          status: importable_account_status(data["status"])
         )
 
         account.save!
 
-        # Set opening balance if we have a historical balance
-        if data["balance"].present?
+        # Set opening balance if we have a historical balance and the import
+        # does not provide an explicit opening-anchor valuation for this account.
+        if data["balance"].present? && !@imported_opening_anchor_account_ids.include?(old_id)
           manager = Account::OpeningBalanceManager.new(account)
-          manager.set_opening_balance(balance: data["balance"].to_d)
+          result = manager.set_opening_balance(
+            balance: data["balance"].to_d,
+            date: opening_balance_date_for(old_id, data)
+          )
+          log_failed_opening_balance_import(account, old_id, result) unless result.success?
         end
 
         @id_mappings[:accounts][old_id] = account.id
@@ -108,6 +125,53 @@ class Family::DataImporter
       end
     end
 
+    def importable_account_status(status)
+      status.to_s.in?(%w[active disabled draft]) ? status.to_s : "active"
+    end
+
+    def import_balances(records)
+      records.each do |record|
+        data = record["data"] || {}
+        new_account_id = @id_mappings[:accounts][data["account_id"]]
+        balance_date = parse_import_date(data["date"])
+        next if new_account_id.blank? || balance_date.blank? || data["balance"].blank?
+
+        account = @family.accounts.find(new_account_id)
+        currency = data["currency"].presence || account.currency
+        balance = account.balances.find_or_initialize_by(date: balance_date, currency: currency)
+
+        balance.assign_attributes(imported_balance_attributes(data))
+        balance.save!
+      end
+    end
+
+    def imported_balance_attributes(data)
+      attributes = {
+        balance: data["balance"].to_d,
+        cash_balance: optional_decimal(data["cash_balance"]),
+        start_cash_balance: optional_decimal(data["start_cash_balance"]),
+        start_non_cash_balance: optional_decimal(data["start_non_cash_balance"]),
+        cash_inflows: optional_decimal(data["cash_inflows"]),
+        cash_outflows: optional_decimal(data["cash_outflows"]),
+        non_cash_inflows: optional_decimal(data["non_cash_inflows"]),
+        non_cash_outflows: optional_decimal(data["non_cash_outflows"]),
+        net_market_flows: optional_decimal(data["net_market_flows"]),
+        cash_adjustments: optional_decimal(data["cash_adjustments"]),
+        non_cash_adjustments: optional_decimal(data["non_cash_adjustments"])
+      }.compact
+
+      attributes[:flows_factor] = balance_flows_factor_for(data["flows_factor"]) if data["flows_factor"].present?
+      attributes
+    end
+
+    def optional_decimal(value)
+      value.presence&.to_d
+    end
+
+    def balance_flows_factor_for(value)
+      value.to_i.in?([ -1, 1 ]) ? value.to_i : 1
+    end
+
     def import_categories(records)
       # First pass: create all categories without parent relationships
       parent_mappings = {}
@@ -174,9 +238,72 @@ class Family::DataImporter
       end
     end
 
+    def import_recurring_transactions(records)
+      records.each do |record|
+        data = record["data"]
+        old_id = data["id"]
+
+        new_account_id = remap_optional_id(:accounts, data["account_id"])
+        next if data["account_id"].present? && new_account_id.blank?
+
+        new_merchant_id = remap_optional_id(:merchants, data["merchant_id"])
+        next if data["merchant_id"].present? && new_merchant_id.blank?
+
+        expected_day_of_month = recurring_expected_day_for(data["expected_day_of_month"])
+        next unless expected_day_of_month
+        last_occurrence_date = parse_import_date(data["last_occurrence_date"])
+        next_expected_date = parse_import_date(data["next_expected_date"])
+        next unless last_occurrence_date && next_expected_date
+
+        recurring_transaction = @family.recurring_transactions.build(
+          account_id: new_account_id,
+          merchant_id: new_merchant_id,
+          amount: data["amount"].to_d,
+          currency: data["currency"] || @family.currency,
+          expected_day_of_month: expected_day_of_month,
+          last_occurrence_date: last_occurrence_date,
+          next_expected_date: next_expected_date,
+          status: recurring_transaction_status_for(data["status"]),
+          occurrence_count: data["occurrence_count"].to_i,
+          name: data["name"],
+          manual: boolean_import_value(data, "manual", default: false),
+          expected_amount_min: data["expected_amount_min"]&.to_d,
+          expected_amount_max: data["expected_amount_max"]&.to_d,
+          expected_amount_avg: data["expected_amount_avg"]&.to_d
+        )
+
+        recurring_transaction.save!
+        @id_mappings[:recurring_transactions][old_id] = recurring_transaction.id
+      end
+    end
+
+    def remap_optional_id(mapping_key, old_id)
+      return if old_id.blank?
+
+      @id_mappings[mapping_key][old_id]
+    end
+
+    def recurring_transaction_status_for(status)
+      status.to_s.in?(RecurringTransaction.statuses.keys) ? status.to_s : "active"
+    end
+
+    def recurring_expected_day_for(value)
+      return if value.blank?
+
+      expected_day = value.to_i
+      expected_day if expected_day.between?(1, 31)
+    end
+
+    def boolean_import_value(data, key, default:)
+      return default unless data.key?(key)
+
+      ActiveModel::Type::Boolean.new.cast(data[key])
+    end
+
     def import_transactions(records)
       records.each do |record|
         data = record["data"]
+        old_id = data["id"]
 
         # Map account ID
         new_account_id = @id_mappings[:accounts][data["account_id"]]
@@ -227,9 +354,49 @@ class Family::DataImporter
         end
 
         @created_entries << entry
+        @id_mappings[:transactions][old_id] = transaction.id
       end
     end
 
+    def import_transfers(records)
+      records.each do |record|
+        data = record["data"]
+        inflow_transaction_id = @id_mappings[:transactions][data["inflow_transaction_id"]]
+        outflow_transaction_id = @id_mappings[:transactions][data["outflow_transaction_id"]]
+        next unless inflow_transaction_id && outflow_transaction_id
+
+        Transfer.find_or_create_by!(
+          inflow_transaction_id: inflow_transaction_id,
+          outflow_transaction_id: outflow_transaction_id
+        ) do |transfer|
+          transfer.status = transfer_status_for(data["status"])
+          transfer.notes = data["notes"]
+        end
+      end
+    end
+
+    def import_rejected_transfers(records)
+      records.each do |record|
+        data = record["data"]
+        inflow_transaction_id = @id_mappings[:transactions][data["inflow_transaction_id"]]
+        outflow_transaction_id = @id_mappings[:transactions][data["outflow_transaction_id"]]
+        next unless inflow_transaction_id && outflow_transaction_id
+
+        RejectedTransfer.find_or_create_by!(
+          inflow_transaction_id: inflow_transaction_id,
+          outflow_transaction_id: outflow_transaction_id
+        )
+      end
+    end
+
+    def transfer_status_for(status)
+      status = status.to_s
+      return status if Transfer.statuses.key?(status)
+
+      Rails.logger.debug("Unknown transfer status #{status.inspect}; defaulting to pending") if status.present?
+      "pending"
+    end
+
     def import_trades(records)
       records.each do |record|
         data = record["data"]
@@ -244,7 +411,13 @@ class Family::DataImporter
         ticker = data["ticker"]
         next unless ticker.present?
 
-        security = find_or_create_security(ticker, data["currency"])
+        security = find_or_create_security(
+          ticker,
+          data["currency"],
+          old_security_id: data["security_id"],
+          name: data["security_name"],
+          exchange_operating_mic: data["exchange_operating_mic"]
+        )
 
         trade = Trade.new(
           security: security,
@@ -267,6 +440,51 @@ class Family::DataImporter
       end
     end
 
+    def import_holdings(records)
+      accounts_by_id = @family.accounts.where(id: records.filter_map { |record| @id_mappings[:accounts][record.dig("data", "account_id")] }).index_by(&:id)
+
+      records.each do |record|
+        data = record["data"]
+
+        new_account_id = @id_mappings[:accounts][data["account_id"]]
+        next unless new_account_id
+
+        account = accounts_by_id[new_account_id]
+        next unless account
+
+        ticker = data["ticker"]
+        next unless ticker.present?
+
+        security = find_or_create_security(
+          ticker,
+          data["currency"],
+          old_security_id: data["security_id"],
+          name: data["security_name"],
+          exchange_operating_mic: data["exchange_operating_mic"],
+          exchange_mic: data["exchange_mic"],
+          exchange_acronym: data["exchange_acronym"],
+          country_code: data["country_code"],
+          kind: data["kind"],
+          website_url: data["website_url"]
+        )
+
+        holding_date = Date.parse(data["date"].to_s)
+        holding_currency = data["currency"] || account.currency
+        holding_attributes = {
+          qty: data["qty"].to_d,
+          price: data["price"].to_d,
+          amount: data["amount"].to_d,
+          currency: holding_currency,
+          cost_basis: data["cost_basis"]&.to_d,
+          cost_basis_source: importable_cost_basis_source(data["cost_basis_source"]),
+          cost_basis_locked: truthy?(data["cost_basis_locked"]) || false,
+          security_locked: truthy?(data["security_locked"]) || false
+        }
+
+        upsert_imported_holding!(account, security, holding_date, holding_currency, holding_attributes)
+      end
+    end
+
     def import_valuations(records)
       records.each do |record|
         data = record["data"]
@@ -277,7 +495,7 @@ class Family::DataImporter
 
         account = @family.accounts.find(new_account_id)
 
-        valuation = Valuation.new
+        valuation = Valuation.new(kind: valuation_kind_for(data["kind"]))
 
         entry = Entry.new(
           account: account,
@@ -293,6 +511,63 @@ class Family::DataImporter
       end
     end
 
+    def oldest_import_entry_dates_by_account(records)
+      dates_by_account = {}
+
+      # Account-level opening balances must precede every imported account
+      # activity, including standalone valuation snapshots.
+      %w[Balance Transaction Trade Holding Valuation].each do |type|
+        records[type].to_a.each do |record|
+          data = record["data"] || {}
+          account_id = data["account_id"]
+          date = parse_import_date(data["date"])
+          next if account_id.blank? || date.blank?
+
+          dates_by_account[account_id] = [ dates_by_account[account_id], date ].compact.min
+        end
+      end
+
+      dates_by_account
+    end
+
+    def imported_opening_anchor_account_ids(records)
+      records.each_with_object(Set.new) do |record, account_ids|
+        data = record["data"] || {}
+        next unless data["kind"].to_s == "opening_anchor"
+        next if data["account_id"].blank?
+
+        account_ids.add(data["account_id"])
+      end
+    end
+
+    def opening_balance_date_for(old_id, data)
+      explicit_date = parse_import_date(
+        data["opening_balance_date"] || data["opening_balance_on"]
+      )
+
+      max_allowed_date = @oldest_import_entry_dates_by_account[old_id]&.prev_day
+      [ explicit_date, max_allowed_date ].compact.min
+    end
+
+    def log_failed_opening_balance_import(account, old_id, result)
+      Rails.logger.warn(
+        "Failed to import opening balance for account #{account.id} from source account #{old_id}: #{result.error}"
+      )
+    end
+
+    def valuation_kind_for(value)
+      kind = value.to_s
+      Valuation.kinds.key?(kind) ? kind : "reconciliation"
+    end
+
+    def parse_import_date(value)
+      return if value.blank?
+
+      Date.parse(value.to_s)
+    rescue Date::Error
+      nil
+    end
+
     def import_budgets(records)
       records.each do |record|
         data = record["data"]
@@ -396,7 +671,7 @@ class Family::DataImporter
 
     def resolve_rule_condition_value(condition_data)
       condition_type = condition_data["condition_type"]
-      value = condition_data["value"]
+      value = rule_operand_value(condition_data)
 
       return value unless value.present?
 
@@ -424,7 +699,7 @@ class Family::DataImporter
 
     def resolve_rule_action_value(action_data)
       action_type = action_data["action_type"]
-      value = action_data["value"]
+      value = rule_operand_value(action_data)
 
       return value unless value.present?
 
@@ -457,18 +732,110 @@ class Family::DataImporter
       value
     end
 
-    def find_or_create_security(ticker, currency)
+    def rule_operand_value(data)
+      raw_value = data["value"]
+      value = raw_value.is_a?(String) ? raw_value.presence : raw_value
+      value_ref_name = data.dig("value_ref", "name")
+
+      return value_ref_name if value.is_a?(String) && uuid_like?(value) && value_ref_name.present?
+      return value unless value.nil?
+
+      value_ref_name
+    end
+
+    def uuid_like?(value)
+      UuidFormat.valid?(value)
+    end
+
+    def importable_cost_basis_source(value)
+      source = value.to_s
+      Holding::COST_BASIS_SOURCES.include?(source) ? source : nil
+    end
+
+    def truthy?(value)
+      ActiveModel::Type::Boolean.new.cast(value)
+    end
+
+    def find_or_create_security(ticker, currency, old_security_id: nil, **attributes)
       # Check cache first
-      cache_key = "#{ticker}:#{currency}"
-      return @id_mappings[:securities][cache_key] if @id_mappings[:securities][cache_key]
+      normalized_ticker = ticker.to_s.upcase
+      exchange_operating_mic = attributes[:exchange_operating_mic].presence&.upcase
+      cache_key = "#{normalized_ticker}:#{exchange_operating_mic}:#{currency}"
 
-      security = Security.find_by(ticker: ticker.upcase)
-      security ||= Security.create!(
-        ticker: ticker.upcase,
-        name: ticker.upcase
-      )
+      if @security_cache[cache_key]
+        security = @security_cache[cache_key]
+        apply_security_metadata(security, normalized_ticker, attributes)
+        return security
+      end
 
-      @id_mappings[:securities][cache_key] = security
+      if old_security_id.present? && @id_mappings[:securities][old_security_id]
+        security = Security.find(@id_mappings[:securities][old_security_id])
+        apply_security_metadata(security, normalized_ticker, attributes)
+        @security_cache[cache_key] = security
+        return security
+      end
+
+      security = find_security_by_identity(normalized_ticker, exchange_operating_mic)
+      apply_security_metadata(security, normalized_ticker, attributes)
+
+      @security_cache[cache_key] = security
+      @id_mappings[:securities][old_security_id] = security.id if old_security_id.present?
       security
     end
+
+    def find_security_by_identity(ticker, exchange_operating_mic)
+      if exchange_operating_mic.present?
+        return Security.find_or_initialize_by(ticker: ticker, exchange_operating_mic: exchange_operating_mic)
+      end
+
+      # Without an exchange MIC, matching by ticker is a best-effort restore path and can merge same-ticker securities from different venues.
+      Security.find_by(ticker: ticker, exchange_operating_mic: nil) ||
+        Security.where(ticker: ticker).order(:created_at).first ||
+        Security.new(ticker: ticker)
+    end
+
+    def apply_security_metadata(security, ticker, attributes)
+      assign_if_blank_or_placeholder(security, :name, attributes[:name].presence, placeholder: ticker)
+      assign_if_blank(security, :exchange_operating_mic, attributes[:exchange_operating_mic].presence&.upcase)
+      assign_if_blank(security, :exchange_mic, attributes[:exchange_mic].presence)
+      assign_if_blank(security, :exchange_acronym, attributes[:exchange_acronym].presence)
+      assign_if_blank(security, :country_code, attributes[:country_code].presence)
+      assign_if_blank(security, :website_url, attributes[:website_url].presence)
+      security.kind = security_kind_for(attributes[:kind]) if security.new_record? || security.kind.blank?
+
+      security.save! if security.new_record? || security.changed?
+    end
+
+    def assign_if_blank(record, attribute, value)
+      return if value.blank?
+      return if record.public_send(attribute).present?
+
+      record.public_send("#{attribute}=", value)
+    end
+
+    def assign_if_blank_or_placeholder(record, attribute, value, placeholder:)
+      return if value.blank?
+
+      current_value = record.public_send(attribute)
+      return if current_value.present? && current_value != placeholder
+
+      record.public_send("#{attribute}=", value)
+    end
+
+    def upsert_imported_holding!(account, security, date, currency, attributes)
+      holding = account.holdings.find_or_initialize_by(security: security, date: date, currency: currency)
+      holding.assign_attributes(attributes)
+
+      begin
+        Holding.transaction(requires_new: true) { holding.save! }
+      rescue ActiveRecord::RecordNotUnique
+        existing = account.holdings.find_by!(security: security, date: date, currency: currency)
+        existing.update!(attributes)
+      end
+    end
+
+    def security_kind_for(value)
+      kind = value.to_s
+      Security::KINDS.include?(kind) ? kind : Security::KINDS.first
+    end
 end
diff --git a/app/models/family/ibkr_connectable.rb b/app/models/family/ibkr_connectable.rb
new file mode 100644
index 000000000..bebfcb1e8
--- /dev/null
+++ b/app/models/family/ibkr_connectable.rb
@@ -0,0 +1,22 @@
+module Family::IbkrConnectable
+  extend ActiveSupport::Concern
+
+  included do
+    has_many :ibkr_items, dependent: :destroy
+  end
+
+  def can_connect_ibkr?
+    true
+  end
+
+  def create_ibkr_item!(query_id:, token:, item_name: nil)
+    ibkr_item = ibkr_items.create!(
+      name: item_name.presence || "Interactive Brokers",
+      query_id: query_id,
+      token: token
+    )
+
+    ibkr_item.sync_later
+    ibkr_item
+  end
+end
diff --git a/app/models/family/kraken_connectable.rb b/app/models/family/kraken_connectable.rb
new file mode 100644
index 000000000..6bc02d235
--- /dev/null
+++ b/app/models/family/kraken_connectable.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Family::KrakenConnectable
+  extend ActiveSupport::Concern
+
+  included do
+    has_many :kraken_items, dependent: :destroy
+  end
+
+  def can_connect_kraken?
+    true
+  end
+
+  def create_kraken_item!(api_key:, api_secret:, item_name: nil)
+    item = kraken_items.create!(
+      name: item_name || "Kraken",
+      api_key: api_key,
+      api_secret: api_secret
+    )
+
+    item.set_kraken_institution_defaults!
+    item.sync_later
+    item
+  end
+
+  def has_kraken_credentials?
+    kraken_items.active.any?(&:credentials_configured?)
+  end
+end
diff --git a/app/models/family/mercury_connectable.rb b/app/models/family/mercury_connectable.rb
index d0bf9fe27..31f3998e8 100644
--- a/app/models/family/mercury_connectable.rb
+++ b/app/models/family/mercury_connectable.rb
@@ -23,6 +23,6 @@ module Family::MercuryConnectable
   end
 
   def has_mercury_credentials?
-    mercury_items.where.not(token: nil).exists?
+    mercury_items.active.any?(&:credentials_configured?)
   end
 end
diff --git a/app/models/family/sophtron_connectable.rb b/app/models/family/sophtron_connectable.rb
new file mode 100644
index 000000000..cc1fb3b0c
--- /dev/null
+++ b/app/models/family/sophtron_connectable.rb
@@ -0,0 +1,31 @@
+module Family::SophtronConnectable
+  extend ActiveSupport::Concern
+
+  included do
+    has_many :sophtron_items, dependent: :destroy
+  end
+
+  def can_connect_sophtron?
+    # Families can now configure their own Sophtron credentials
+    true
+  end
+
+  def create_sophtron_item!(user_id:, access_key:, base_url: nil, item_name: nil)
+    sophtron_item = sophtron_items.create!(
+      name: item_name || "Sophtron Connection",
+      user_id: user_id,
+      access_key: access_key,
+      base_url: base_url
+    )
+
+    sophtron_item
+  end
+
+  def has_sophtron_credentials?
+    sophtron_items.where.not(user_id: [ nil, "" ], access_key: [ nil, "" ]).exists?
+  end
+
+  def configured_sophtron_item
+    sophtron_items.where.not(user_id: [ nil, "" ], access_key: [ nil, "" ]).ordered.first
+  end
+end
diff --git a/app/models/family/syncer.rb b/app/models/family/syncer.rb
index 858ed9bc4..7873c5ff0 100644
--- a/app/models/family/syncer.rb
+++ b/app/models/family/syncer.rb
@@ -17,7 +17,10 @@ class Family::Syncer
     coinbase_items
     coinstats_items
     mercury_items
+    brex_items
+    binance_items
     snaptrade_items
+    sophtron_items
   ].freeze
 
   def initialize(family)
diff --git a/app/models/holding.rb b/app/models/holding.rb
index 0b18b3e9c..ac8c37c26 100644
--- a/app/models/holding.rb
+++ b/app/models/holding.rb
@@ -38,7 +38,7 @@ class Holding < ApplicationRecord
     return nil unless amount
     return 0 if amount.zero?
 
-    account.balance.zero? ? 1 : amount / account.balance * 100
+    account.balance.zero? ? 1 : amount_in_account_currency / account.balance * 100
   end
 
   # Returns average cost per share, or nil if unknown.
@@ -256,6 +256,14 @@ class Holding < ApplicationRecord
   end
 
   private
+    def amount_in_account_currency
+      return amount if currency == account.currency
+
+      Money.new(amount, currency).exchange_to(account.currency, date: date).amount
+    rescue Money::ConversionError
+      amount
+    end
+
     def calculate_trend
       return nil unless amount_money
       return nil if avg_cost.nil? # Can't calculate trend without cost basis (0 is valid for airdrops)
diff --git a/app/models/holding/forward_calculator.rb b/app/models/holding/forward_calculator.rb
index ecb59e826..8be1eec34 100644
--- a/app/models/holding/forward_calculator.rb
+++ b/app/models/holding/forward_calculator.rb
@@ -18,7 +18,7 @@ class Holding::ForwardCalculator
         trades = portfolio_cache.get_trades(date: date)
         update_cost_basis_tracker(trades)
         next_portfolio = transform_portfolio(current_portfolio, trades, direction: :forward)
-        holdings += build_holdings(next_portfolio, date)
+        holdings.concat(build_holdings(next_portfolio, date))
         current_portfolio = next_portfolio
       end
 
@@ -89,7 +89,11 @@ class Holding::ForwardCalculator
 
         # Convert trade price to account currency if needed
         trade_price = Money.new(trade.price, trade.currency)
-        converted_price = trade_price.exchange_to(account.currency, fallback_rate: 1).amount
+        begin
+          converted_price = trade_price.exchange_to(account.currency).amount
+        rescue Money::ConversionError
+          converted_price = trade.price
+        end
 
         tracker[:total_cost] += converted_price * trade.qty
         tracker[:total_qty] += trade.qty
diff --git a/app/models/holding/gapfillable.rb b/app/models/holding/gapfillable.rb
index 45c05089d..7088cba80 100644
--- a/app/models/holding/gapfillable.rb
+++ b/app/models/holding/gapfillable.rb
@@ -9,10 +9,11 @@ module Holding::Gapfillable
         next if security_holdings.empty?
 
         sorted = security_holdings.sort_by(&:date)
+        holdings_by_date = security_holdings.index_by(&:date)
         previous_holding = sorted.first
 
         sorted.first.date.upto(Date.current) do |date|
-          holding = security_holdings.find { |h| h.date == date }
+          holding = holdings_by_date[date]
 
           if holding
             filled_holdings << holding
diff --git a/app/models/holding/materializer.rb b/app/models/holding/materializer.rb
index e4ad1737c..5832e2033 100644
--- a/app/models/holding/materializer.rb
+++ b/app/models/holding/materializer.rb
@@ -22,10 +22,10 @@ class Holding::Materializer
     # securities are still needed to derive sane balance charts between sync snapshots.
     cleanup_shadowed_calculated_holdings
 
-    # Also remove calculated rows on the provider's latest snapshot date when those
-    # securities are no longer present in the provider payload. This keeps "current"
-    # holdings/balance composition aligned with the provider snapshot while preserving
-    # older calculated history.
+    # Also remove non-provider rows on the provider's latest snapshot date for securities
+    # that appear in the provider snapshot. The provider snapshot is authoritative for
+    # those securities on that day, even when it is denominated in a different currency
+    # than the account or the reverse-calculated holdings.
     cleanup_stale_calculated_rows_on_latest_provider_snapshot
 
     # Reload holdings association to clear any cached stale data
@@ -152,17 +152,12 @@ class Holding::Materializer
         .where(date: provider_snapshot_date)
         .distinct
         .pluck(:security_id)
+      return if provider_security_ids.empty?
 
-      scope = account.holdings
-        .where(account_provider_id: nil, date: provider_snapshot_date)
+      deleted_count = account.holdings
+        .where(account_provider_id: nil, date: provider_snapshot_date, security_id: provider_security_ids)
+        .delete_all
 
-      scope = if provider_security_ids.any?
-        scope.where.not(security_id: provider_security_ids)
-      else
-        scope
-      end
-
-      deleted_count = scope.delete_all
       Rails.logger.info("Cleaned up #{deleted_count} stale calculated holdings on latest provider snapshot date") if deleted_count > 0
     end
 
@@ -171,7 +166,7 @@ class Holding::Materializer
     end
 
     def purge_stale_holdings
-      portfolio_security_ids = account.entries.trades.map { |entry| entry.entryable.security_id }.uniq
+      portfolio_security_ids = account.trades.distinct.pluck(:security_id)
 
       # Never delete provider-sourced holdings - they're authoritative from the provider
       # If there are no securities in the portfolio, only delete non-provider holdings
diff --git a/app/models/holding/portfolio_cache.rb b/app/models/holding/portfolio_cache.rb
index 6763d1fd1..4ea52920e 100644
--- a/app/models/holding/portfolio_cache.rb
+++ b/app/models/holding/portfolio_cache.rb
@@ -18,7 +18,7 @@ class Holding::PortfolioCache
     if date.blank?
       trades
     else
-      trades.select { |t| t.date == date }
+      trades_by_date[date]&.dup || []
     end
   end
 
@@ -26,17 +26,24 @@ class Holding::PortfolioCache
     security = @security_cache[security_id]
     raise SecurityNotFound.new(security_id, account.id) unless security
 
-    if source.present?
-      price = security[:prices].select { |p| p.price.date == date && p.source == source }.min_by(&:priority)&.price
+    price_with_priority = if source.present?
+      security[:prices_by_date_and_source][[ date, source ]]
     else
-      price = security[:prices].select { |p| p.price.date == date }.min_by(&:priority)&.price
+      security[:prices_by_date][date]
     end
 
+    return nil unless price_with_priority
+
+    price = price_with_priority.price
     return nil unless price
 
     price_money = Money.new(price.price, price.currency)
 
-    converted_amount = price_money.exchange_to(account.currency, fallback_rate: 1).amount
+    begin
+      converted_amount = price_money.exchange_to(account.currency, date: date).amount
+    rescue Money::ConversionError
+      converted_amount = price.price
+    end
 
     Security::Price.new(
       security_id: security_id,
@@ -57,20 +64,28 @@ class Holding::PortfolioCache
       @trades ||= account.entries.includes(entryable: :security).trades.chronological.to_a
     end
 
+    def trades_by_date
+      @trades_by_date ||= trades.group_by(&:date)
+    end
+
+    def trades_by_security_id
+      @trades_by_security_id ||= trades.group_by { |t| t.entryable.security_id }
+    end
+
     def holdings
       @holdings ||= account.holdings.chronological.to_a
     end
 
+    def holdings_by_security_id
+      @holdings_by_security_id ||= holdings.group_by(&:security_id)
+    end
+
     def collect_unique_securities
-      unique_securities_from_trades = trades.map(&:entryable).map(&:security).uniq
-      unique_securities_from_trades = unique_securities_from_trades.select { |s| @security_ids.include?(s.id) } if @security_ids
+      ids = trades_by_security_id.keys
+      ids |= holdings_by_security_id.keys if use_holdings
+      ids &= @security_ids if @security_ids
 
-      return unique_securities_from_trades unless use_holdings
-
-      unique_securities_from_holdings = holdings.map(&:security).uniq
-      unique_securities_from_holdings = unique_securities_from_holdings.select { |s| @security_ids.include?(s.id) } if @security_ids
-
-      (unique_securities_from_trades + unique_securities_from_holdings).uniq
+      Security.where(id: ids).to_a
     end
 
     # Loads all known prices for all securities in the account with priority based on source:
@@ -83,11 +98,18 @@ class Holding::PortfolioCache
 
       Rails.logger.info "Preloading #{securities.size} securities for account #{account.id}"
 
+      security_ids = securities.map(&:id)
+
+      # Bulk-load all DB prices for all securities in one query, grouped by security_id
+      db_prices_by_security_id = Security::Price
+        .where(security_id: security_ids, date: account.start_date..Date.current)
+        .group_by(&:security_id)
+
       securities.each do |security|
         Rails.logger.info "Loading security: ID=#{security.id} Ticker=#{security.ticker}"
 
         # High priority prices from DB (synced from provider)
-        db_prices = security.prices.where(date: account.start_date..Date.current).map do |price|
+        db_prices = (db_prices_by_security_id[security.id] || []).map do |price|
           PriceWithPriority.new(
             price: price,
             priority: 1,
@@ -96,8 +118,7 @@ class Holding::PortfolioCache
         end
 
         # Medium priority prices from trades
-        trade_prices = trades
-          .select { |t| t.entryable.security_id == security.id }
+        trade_prices = (trades_by_security_id[security.id] || [])
           .map do |trade|
             PriceWithPriority.new(
               price: Security::Price.new(
@@ -113,7 +134,7 @@ class Holding::PortfolioCache
 
         # Low priority prices from holdings (if applicable)
         holding_prices = if use_holdings
-          holdings.select { |h| h.security_id == security.id }.map do |holding|
+          (holdings_by_security_id[security.id] || []).map do |holding|
             PriceWithPriority.new(
               price: Security::Price.new(
                 security: security,
@@ -129,9 +150,18 @@ class Holding::PortfolioCache
           []
         end
 
+        all_prices = db_prices + trade_prices + holding_prices
+
+        # Index by date for O(1) lookup in get_price instead of O(N) linear scan
+        prices_by_date = all_prices.group_by { |p| p.price.date }
+          .transform_values { |ps| ps.min_by(&:priority) }
+        prices_by_date_and_source = all_prices.group_by { |p| [ p.price.date, p.source ] }
+          .transform_values { |ps| ps.min_by(&:priority) }
+
         @security_cache[security.id] = {
           security: security,
-          prices: db_prices + trade_prices + holding_prices
+          prices_by_date: prices_by_date,
+          prices_by_date_and_source: prices_by_date_and_source
         }
       end
     end
diff --git a/app/models/holding/reverse_calculator.rb b/app/models/holding/reverse_calculator.rb
index d9ed2efe0..0df96a616 100644
--- a/app/models/holding/reverse_calculator.rb
+++ b/app/models/holding/reverse_calculator.rb
@@ -35,7 +35,7 @@ class Holding::ReverseCalculator
         previous_portfolio = transform_portfolio(current_portfolio, today_trades, direction: :reverse)
 
         # If current day, always use holding prices (since that's what Plaid gives us).  For historical values, use market data (since Plaid doesn't supply historical prices)
-        holdings += build_holdings(current_portfolio, date, price_source: date == Date.current ? "holding" : nil)
+        holdings.concat(build_holdings(current_portfolio, date, price_source: date == Date.current ? "holding" : nil))
         current_portfolio = previous_portfolio
       end
 
@@ -79,41 +79,46 @@ class Holding::ReverseCalculator
       end.compact
     end
 
-    # Pre-compute cost basis for all securities at all dates using forward pass through trades
-    # Stores: { security_id => { date => cost_basis } }
     def precompute_cost_basis
-      @cost_basis_by_date = Hash.new { |h, k| h[k] = {} }
+      @cost_basis_snapshots = Hash.new { |h, k| h[k] = [] }
       tracker = Hash.new { |h, k| h[k] = { total_cost: BigDecimal("0"), total_qty: BigDecimal("0") } }
 
-      trades = portfolio_cache.get_trades.sort_by(&:date)
-      trade_index = 0
+      portfolio_cache.get_trades.sort_by(&:date).each do |trade_entry|
+        trade = trade_entry.entryable
+        next unless trade.qty > 0
 
-      account.start_date.upto(Date.current).each do |date|
-        # Process all trades up to and including this date
-        while trade_index < trades.size && trades[trade_index].date <= date
-          trade_entry = trades[trade_index]
-          trade = trade_entry.entryable
-
-          if trade.qty > 0 # Only track buys
-            security_id = trade.security_id
-            trade_price = Money.new(trade.price, trade.currency)
-            converted_price = trade_price.exchange_to(account.currency, fallback_rate: 1).amount
-
-            tracker[security_id][:total_cost] += converted_price * trade.qty
-            tracker[security_id][:total_qty] += trade.qty
-          end
-          trade_index += 1
+        security_id = trade.security_id
+        trade_price = Money.new(trade.price, trade.currency)
+        begin
+          converted_price = trade_price.exchange_to(account.currency).amount
+        rescue Money::ConversionError
+          converted_price = trade.price
         end
 
-        # Store current cost basis snapshot for each security at this date
-        tracker.each do |security_id, data|
-          next if data[:total_qty].zero?
-          @cost_basis_by_date[security_id][date] = data[:total_cost] / data[:total_qty]
-        end
+        tracker[security_id][:total_cost] += converted_price * trade.qty
+        tracker[security_id][:total_qty] += trade.qty
+
+        @cost_basis_snapshots[security_id] << [
+          trade_entry.date,
+          tracker[security_id][:total_cost] / tracker[security_id][:total_qty]
+        ]
       end
     end
 
     def cost_basis_for(security_id, date)
-      @cost_basis_by_date.dig(security_id, date)
+      snapshots = @cost_basis_snapshots[security_id]
+      return nil if snapshots.empty?
+
+      lo, hi, result = 0, snapshots.size - 1, nil
+      while lo <= hi
+        mid = (lo + hi) / 2
+        if snapshots[mid][0] <= date
+          result = snapshots[mid][1]
+          lo = mid + 1
+        else
+          hi = mid - 1
+        end
+      end
+      result
     end
 end
diff --git a/app/models/ibkr_account.rb b/app/models/ibkr_account.rb
new file mode 100644
index 000000000..eb491f96a
--- /dev/null
+++ b/app/models/ibkr_account.rb
@@ -0,0 +1,78 @@
+class IbkrAccount < ApplicationRecord
+  include CurrencyNormalizable, Encryptable
+  include IbkrAccount::DataHelpers
+
+  if encryption_ready?
+    encrypts :raw_holdings_payload
+    encrypts :raw_activities_payload
+    encrypts :raw_cash_report_payload
+    encrypts :raw_equity_summary_payload
+  end
+
+  belongs_to :ibkr_item
+
+  has_one :account_provider, as: :provider, dependent: :destroy
+  has_one :account, through: :account_provider, source: :account
+  has_one :linked_account, through: :account_provider, source: :account
+
+  validates :name, :currency, presence: true
+  validates :ibkr_account_id, uniqueness: { scope: :ibkr_item_id, allow_nil: true }
+
+  def current_account
+    account || linked_account
+  end
+
+  def ensure_account_provider!(account = nil)
+    if account_provider.present?
+      account_provider.update!(account: account) if account && account_provider.account_id != account.id
+      return account_provider
+    end
+
+    acct = account || current_account
+    return nil unless acct
+
+    provider = AccountProvider
+      .find_or_initialize_by(provider_type: "IbkrAccount", provider_id: id)
+      .tap do |record|
+        record.account = acct
+        record.save!
+      end
+
+    reload_account_provider
+    provider
+  rescue => e
+    Rails.logger.warn("IbkrAccount##{id}: failed to ensure AccountProvider link: #{e.class} - #{e.message}")
+    nil
+  end
+
+  def upsert_from_ibkr_statement!(account_data)
+    data = account_data.with_indifferent_access
+
+    update!(
+      ibkr_account_id: data[:ibkr_account_id],
+      name: data[:name],
+      currency: parse_currency(data[:currency]) || "USD",
+      current_balance: data[:current_balance],
+      cash_balance: data[:cash_balance],
+      institution_metadata: {
+        provider_name: "Interactive Brokers",
+        statement_from_date: data.dig(:statement, :from_date),
+        statement_to_date: data.dig(:statement, :to_date)
+      }.compact,
+      report_date: data[:report_date],
+      raw_holdings_payload: data[:open_positions] || [],
+      raw_activities_payload: {
+        trades: data[:trades] || [],
+        cash_transactions: data[:cash_transactions] || []
+      },
+      raw_cash_report_payload: data[:cash_report] || [],
+      raw_equity_summary_payload: data[:equity_summary_in_base] || [],
+      last_holdings_sync: Time.current,
+      last_activities_sync: Time.current
+    )
+  end
+
+  def ibkr_provider
+    ibkr_item.ibkr_provider
+  end
+end
diff --git a/app/models/ibkr_account/activities_processor.rb b/app/models/ibkr_account/activities_processor.rb
new file mode 100644
index 000000000..e2f906d07
--- /dev/null
+++ b/app/models/ibkr_account/activities_processor.rb
@@ -0,0 +1,220 @@
+class IbkrAccount::ActivitiesProcessor
+  include IbkrAccount::DataHelpers
+
+  SUPPORTED_CASH_TRANSACTION_TYPES = [ "DEPOSITS/WITHDRAWALS", "DIVIDENDS" ].freeze
+
+  def initialize(ibkr_account)
+    @ibkr_account = ibkr_account
+  end
+
+  def process
+    return { trades: 0, transactions: 0 } unless account.present?
+
+    activities = (@ibkr_account.raw_activities_payload || {}).with_indifferent_access
+    trades = Array(activities[:trades])
+    cash_transactions = Array(activities[:cash_transactions])
+
+    trade_results = trades.map { |trade| process_trade(trade.with_indifferent_access) }
+    trades_count = trade_results.count { |r| r[:imported] }
+    fee_count    = trade_results.sum   { |r| r[:fees] }
+
+    cash_count = cash_transactions.sum { |t| process_cash_transaction(t.with_indifferent_access) ? 1 : 0 }
+
+    { trades: trades_count, transactions: cash_count + fee_count }
+  end
+
+  private
+
+    def account
+      @ibkr_account.current_account
+    end
+
+    def import_adapter
+      @import_adapter ||= Account::ProviderImportAdapter.new(account)
+    end
+
+    def process_trade(row)
+      return { imported: false, fees: 0 } unless supported_trade?(row)
+
+      security = resolve_security(row)
+      return { imported: false, fees: 0 } unless security
+
+      quantity = parse_decimal(row[:quantity])
+      native_price = parse_decimal(row[:trade_price])
+      return { imported: false, fees: 0 } if quantity.nil? || native_price.nil?
+
+      buy_sell = row[:buy_sell].to_s.upcase
+      signed_quantity = buy_sell == "SELL" ? -quantity.abs : quantity.abs
+      native_amount = buy_sell == "SELL" ? -(native_price * quantity.abs) : (native_price * quantity.abs)
+      currency = extract_currency(row, fallback: @ibkr_account.currency)
+      date = trade_date_for(row)
+      external_id = "ibkr_trade_#{row[:trade_id]}"
+
+      import_adapter.import_trade(
+        external_id: external_id,
+        security: security,
+        quantity: signed_quantity,
+        price: native_price,
+        amount: native_amount,
+        currency: currency,
+        date: date,
+        name: build_trade_name(security.ticker, signed_quantity),
+        source: "ibkr",
+        activity_label: buy_sell == "SELL" ? "Sell" : "Buy",
+        exchange_rate: parse_decimal(row[:fx_rate_to_base])&.to_f
+      )
+
+      fees = import_commission_transaction(row, security, date) ? 1 : 0
+      { imported: true, fees: fees }
+    rescue => e
+      Rails.logger.error("IbkrAccount::ActivitiesProcessor - Failed to process trade #{row[:trade_id]}: #{e.message}")
+      { imported: false, fees: 0 }
+    end
+
+    def process_cash_transaction(row)
+      return false unless supported_cash_transaction?(row)
+
+      amount = parse_decimal(row[:amount])
+      return false if amount.nil? || amount.zero?
+
+      label, signed_amount = classify_cash_transaction(row, amount)
+      return false unless label
+      currency = extract_currency(row, fallback: @ibkr_account.currency)
+      security = resolve_security_for_cash_transaction(row)
+
+      import_adapter.import_transaction(
+        external_id: "ibkr_cash_#{row[:transaction_id]}",
+        amount: signed_amount,
+        currency: currency,
+        date: parse_date(row[:report_date]),
+        name: build_cash_transaction_name(row, label, security),
+        source: "ibkr",
+        investment_activity_label: label,
+        extra: {
+          exchange_rate: parse_decimal(row[:fx_rate_to_base])&.to_f,
+          security_id: security&.id,
+          ibkr: {
+            transaction_id: row[:transaction_id],
+            type: row[:type],
+            conid: row[:conid],
+            amount: row[:amount],
+            currency: row[:currency],
+            fx_rate_to_base: row[:fx_rate_to_base],
+            report_date: row[:report_date]
+          }.compact
+        }
+      )
+
+      true
+    rescue => e
+      Rails.logger.error("IbkrAccount::ActivitiesProcessor - Failed to process cash transaction #{row[:transaction_id]}: #{e.message}")
+      false
+    end
+
+    def import_commission_transaction(row, security, date)
+      commission = parse_decimal(row[:ib_commission])
+      return false if commission.nil? || commission.zero?
+
+      currency = row[:ib_commission_currency].to_s.upcase.presence || @ibkr_account.currency
+      ticker = security&.ticker || row[:symbol]
+
+      result = import_adapter.import_transaction(
+        external_id: "ibkr_trade_fee_#{row[:trade_id]}",
+        amount: commission.abs,
+        currency: currency,
+        date: date,
+        name: "Trade Commission for #{ticker}",
+        source: "ibkr",
+        investment_activity_label: "Fee",
+        extra: {
+          exchange_rate: parse_decimal(row[:fx_rate_to_base])&.to_f,
+          security_id: security&.id,
+          ibkr: {
+            trade_id: row[:trade_id],
+            transaction_id: row[:transaction_id],
+            ib_commission: row[:ib_commission],
+            ib_commission_currency: row[:ib_commission_currency],
+            fx_rate_to_base: row[:fx_rate_to_base]
+          }.compact
+        }
+      )
+
+      !!result
+    end
+
+    def build_trade_name(ticker, signed_quantity)
+      action = signed_quantity.negative? ? "Sell" : "Buy"
+      "#{action} #{signed_quantity.abs} shares of #{ticker}"
+    end
+
+    def supported_trade?(row)
+      row[:asset_category].to_s == "STK" &&
+        row[:buy_sell].present? &&
+        row[:conid].present? &&
+        row[:currency].present? &&
+        row[:quantity].present? &&
+        row[:symbol].present? &&
+        row[:trade_date].present? &&
+        row[:trade_id].present? &&
+        row[:trade_price].present? &&
+        row[:transaction_id].present? &&
+        fx_rate_available?(row)
+    end
+
+    def supported_cash_transaction?(row)
+      type = row[:type].to_s.upcase.strip
+      return false unless SUPPORTED_CASH_TRANSACTION_TYPES.include?(type)
+      return false unless row[:transaction_id].present? && row[:amount].present? && row[:currency].present? && row[:report_date].present?
+      return false unless fx_rate_available?(row)
+
+      type != "DIVIDENDS" || row[:conid].present?
+    end
+
+    # supported_cash_transaction? ensures only known types reach here; no else branch needed
+    def classify_cash_transaction(row, amount)
+      type = row[:type].to_s.upcase.strip
+
+      case type
+      when "DEPOSITS/WITHDRAWALS"
+        amount.positive? ? [ "Contribution", -amount.abs ] : [ "Withdrawal", amount.abs ]
+      when "DIVIDENDS"
+        [ "Dividend", -amount.abs ]
+      end
+    end
+
+    def build_cash_transaction_name(row, label, security = nil)
+      return label unless label == "Dividend"
+
+      ticker = security&.ticker || security_symbol_for_conid(row[:conid]) || row[:conid]
+      "Dividend from #{ticker}"
+    end
+
+    def resolve_security_for_cash_transaction(row)
+      symbol = security_symbol_for_conid(row[:conid])
+      return nil if symbol.blank?
+
+      resolve_security({ symbol: symbol })
+    end
+
+    def security_symbol_for_conid(conid)
+      return nil if conid.blank?
+
+      holding_symbol = Array(@ibkr_account.raw_holdings_payload).find do |holding|
+        holding.with_indifferent_access[:conid].to_s == conid.to_s
+      end&.with_indifferent_access&.dig(:symbol)
+      return holding_symbol if holding_symbol.present?
+
+      activities = (@ibkr_account.raw_activities_payload || {}).with_indifferent_access
+      Array(activities[:trades]).find do |trade|
+        trade.with_indifferent_access[:conid].to_s == conid.to_s
+      end&.with_indifferent_access&.dig(:symbol)
+    end
+
+    def fx_rate_available?(row)
+      source_currency = extract_currency(row, fallback: nil)
+      return false if source_currency.blank?
+      return true if source_currency == @ibkr_account.currency
+
+      row[:fx_rate_to_base].present?
+    end
+end
diff --git a/app/models/ibkr_account/data_helpers.rb b/app/models/ibkr_account/data_helpers.rb
new file mode 100644
index 000000000..6135557a2
--- /dev/null
+++ b/app/models/ibkr_account/data_helpers.rb
@@ -0,0 +1,81 @@
+module IbkrAccount::DataHelpers
+  extend ActiveSupport::Concern
+
+  private
+
+    def parse_decimal(value)
+      return nil if value.nil?
+
+      normalized = value.is_a?(String) ? value.delete(",").strip : value.to_s
+      return nil if normalized.blank? || normalized == "-"
+
+      # Convert accounting parentheses notation: "(1234.56)" → "-1234.56"
+      normalized = "-#{normalized[1..-2]}" if normalized.start_with?("(") && normalized.end_with?(")")
+
+      BigDecimal(normalized)
+    rescue ArgumentError
+      nil
+    end
+
+    def parse_date(value)
+      return nil if value.blank?
+
+      case value
+      when Date
+        value
+      when Time, DateTime, ActiveSupport::TimeWithZone
+        value.to_date
+      else
+        normalized = value.to_s.tr(";", " ")
+        Time.zone.parse(normalized)&.to_date || Date.parse(normalized)
+      end
+    rescue ArgumentError, TypeError
+      nil
+    end
+
+    def parse_datetime(value)
+      return nil if value.blank?
+
+      case value
+      when Time, DateTime, ActiveSupport::TimeWithZone
+        value.in_time_zone
+      when Date
+        value.in_time_zone
+      else
+        Time.zone.parse(value.to_s.tr(";", " "))
+      end
+    rescue ArgumentError, TypeError
+      nil
+    end
+
+    def resolve_security(row)
+      data = row.with_indifferent_access
+      ticker = data[:symbol].to_s.strip.upcase
+      return nil if ticker.blank?
+
+      Security.find_by(ticker: ticker) || create_security_from_row(ticker)
+    rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotUnique
+      Security.find_by(ticker: ticker)
+    end
+
+    def trade_date_for(row)
+      data = row.with_indifferent_access
+      parsed_trade_date = parse_date(data[:trade_date])
+      return parsed_trade_date if parsed_trade_date
+
+      Rails.logger.warn(
+        "IbkrAccount::DataHelpers - Missing or invalid trade_date, falling back to Date.current. " \
+        "trade_id=#{data[:trade_id].inspect}"
+      )
+      Date.current
+    end
+
+    def extract_currency(row, fallback: nil)
+      value = row.with_indifferent_access[:currency]
+      value.present? ? value.to_s.upcase : fallback
+    end
+
+    def create_security_from_row(ticker)
+      Security.create!(ticker: ticker, name: ticker)
+    end
+end
diff --git a/app/models/ibkr_account/historical_balances_sync.rb b/app/models/ibkr_account/historical_balances_sync.rb
new file mode 100644
index 000000000..4d302d7ba
--- /dev/null
+++ b/app/models/ibkr_account/historical_balances_sync.rb
@@ -0,0 +1,139 @@
+class IbkrAccount::HistoricalBalancesSync
+  include IbkrAccount::DataHelpers
+
+  attr_reader :ibkr_account
+
+  def initialize(ibkr_account)
+    @ibkr_account = ibkr_account
+  end
+
+  def sync!
+    return unless account.present?
+    return if normalized_rows.empty?
+
+    account.balances.upsert_all(
+      balance_rows,
+      unique_by: %i[account_id date currency]
+    )
+  end
+
+  private
+
+    def account
+      ibkr_account.current_account
+    end
+
+    def account_currency
+      ibkr_account.currency.to_s.upcase
+    end
+
+    def normalized_rows
+      @normalized_rows ||= begin
+        # Batch-load the materializer's already-computed balances so we can
+        # preserve its cash split rather than reading cash from the equity summary.
+        # Real IBKR Flex exports do not reliably include a cash/stock breakdown in
+        # EquitySummaryByReportDateInBase — only the total is consistently present.
+        existing_balances = account.balances
+          .where(currency: account.currency)
+          .index_by(&:date)
+
+        trading_day_rows = Array(ibkr_account.raw_equity_summary_payload)
+          .filter_map do |row|
+            next unless row.is_a?(Hash)
+
+            data = row.with_indifferent_access
+            currency = data[:currency].presence&.upcase
+
+            # BASE_SUMMARY rows aggregate across all currencies — not a per-date balance
+            next if currency == "BASE_SUMMARY"
+            # Reject rows with an explicit wrong currency; absent currency is accepted
+            # (some Flex configurations omit it and the row is implicitly in base currency)
+            next if currency.present? && currency != account_currency
+
+            date = parse_date(data[:report_date])
+            next unless date
+
+            total = parse_decimal(data[:total])
+            if total.nil?
+              Rails.logger.warn(
+                "IbkrAccount::HistoricalBalancesSync - Skipping equity summary row with missing or unparseable total " \
+                "for date=#{data[:report_date].inspect} account=#{account.id}"
+              )
+              next
+            end
+
+            # Use the materializer's cash_balance as ground truth for the cash split.
+            # This is consistent with how the reverse calculator handles present-day
+            # weekends and holidays — derive cash from holdings, not from IBKR's field.
+            cash = existing_balances[date]&.cash_balance || BigDecimal("0")
+
+            { date: date, total: total, cash: cash, non_cash: total - cash }
+          end
+          .sort_by { |r| r[:date] }
+
+        fill_gaps(trading_day_rows, existing_balances)
+      end
+    end
+
+    # IBKR does not emit rows for weekends and some holidays. The reverse
+    # calculator fills those dates using only imported holdings — which only
+    # cover the current snapshot — so it cannot reconstruct the correct
+    # non-cash value for historical gap dates. We carry the most recent
+    # IBKR total forward to every missing calendar day and pair it with the
+    # materializer's already-correct cash for that date.
+    #
+    # The range is extended to the account's current anchor date so that days
+    # after the last equity summary row (e.g. a Saturday sync where the payload
+    # ends on Friday) are also covered and not left with the materializer's
+    # stale total=cash value.
+    def fill_gaps(rows, existing_balances)
+      return [] if rows.empty?
+
+      by_date    = rows.index_by { |r| r[:date] }
+      first_date = rows.first[:date]
+      anchor_date = [ account.current_anchor_date || Date.current, Date.current ].min
+      last_date   = [ rows.last[:date], anchor_date ].max
+
+      last_total = nil
+      (first_date..last_date).filter_map do |date|
+        if by_date[date]
+          last_total = by_date[date][:total]
+          by_date[date]
+        else
+          next unless last_total
+          cash = existing_balances[date]&.cash_balance || BigDecimal("0")
+          { date: date, total: last_total, cash: cash, non_cash: last_total - cash }
+        end
+      end
+    end
+
+    def balance_rows
+      current_time = Time.current
+
+      normalized_rows.each_with_index.map do |row, index|
+        previous_row = index.zero? ? nil : normalized_rows[index - 1]
+        start_cash_balance     = previous_row ? previous_row[:cash]     : row[:cash]
+        start_non_cash_balance = previous_row ? previous_row[:non_cash] : row[:non_cash]
+
+        {
+          account_id: account.id,
+          date: row[:date],
+          balance: row[:total],
+          cash_balance: row[:cash],
+          currency: account.currency,
+          start_cash_balance: start_cash_balance,
+          start_non_cash_balance: start_non_cash_balance,
+          cash_inflows: 0,
+          cash_outflows: 0,
+          non_cash_inflows: 0,
+          non_cash_outflows: 0,
+          net_market_flows: 0,
+          cash_adjustments: row[:cash] - start_cash_balance,
+          non_cash_adjustments: row[:non_cash] - start_non_cash_balance,
+          flows_factor: 1,
+          created_at: current_time,
+          updated_at: current_time
+        }
+      end
+    end
+end
diff --git a/app/models/ibkr_account/holdings_processor.rb b/app/models/ibkr_account/holdings_processor.rb
new file mode 100644
index 000000000..8d5ebc704
--- /dev/null
+++ b/app/models/ibkr_account/holdings_processor.rb
@@ -0,0 +1,116 @@
+class IbkrAccount::HoldingsProcessor
+  include IbkrAccount::DataHelpers
+
+  def initialize(ibkr_account)
+    @ibkr_account = ibkr_account
+  end
+
+  def process
+    return unless account.present?
+
+    grouped_positions.each do |(_, _, report_date), group|
+      process_group(group, report_date)
+    end
+  end
+
+  private
+
+    def account
+      @ibkr_account.current_account
+    end
+
+    def import_adapter
+      @import_adapter ||= Account::ProviderImportAdapter.new(account)
+    end
+
+    def grouped_positions
+      Array(@ibkr_account.raw_holdings_payload).each_with_object({}) do |position, groups|
+        data = position.with_indifferent_access
+        next unless supported_position?(data)
+
+        # conid is guaranteed present by supported_position?, so no fallbacks needed
+        currency = extract_currency(data, fallback: @ibkr_account.currency)
+        report_date = parse_date(data[:report_date]) || @ibkr_account.report_date || Date.current
+        key = [ data[:conid], currency, report_date ]
+        groups[key] ||= []
+        groups[key] << data
+      end
+    end
+
+    def process_group(rows, report_date)
+      sample = rows.first
+      security = resolve_security(sample)
+      return unless security
+
+      price = parse_decimal(sample[:mark_price])
+      # quantity and cost_basis are derived from the same set of valid lots so
+      # they are always consistent — a lot with an unparseable cost_basis_price
+      # is excluded from both counts rather than inflating qty while shrinking basis.
+      aggregate = valid_lots(rows)
+      return unless price && aggregate
+
+      quantity   = aggregate[:quantity]
+      cost_basis = aggregate[:cost_basis]
+      amount = quantity * price
+      currency = extract_currency(sample, fallback: @ibkr_account.currency)
+      external_id = [ "ibkr", @ibkr_account.ibkr_account_id, sample[:conid], report_date, currency ].join("_")
+
+      import_adapter.import_holding(
+        security: security,
+        quantity: quantity,
+        amount: amount,
+        currency: currency,
+        date: report_date,
+        price: price,
+        cost_basis: cost_basis,
+        external_id: external_id,
+        source: "ibkr",
+        account_provider_id: @ibkr_account.account_provider&.id,
+        delete_future_holdings: false
+      )
+    end
+
+    # Aggregates only the lots that have both a parseable position and cost_basis_price.
+    # Returns { quantity:, cost_basis: } so the caller uses a consistent lot set for
+    # both values — a lot skipped here is excluded from quantity too, preventing the
+    # case where qty covers more shares than the cost basis was computed from.
+    def valid_lots(rows)
+      total_quantity = BigDecimal("0")
+      total_cost = BigDecimal("0")
+
+      rows.each do |row|
+        row_quantity   = parse_decimal(row[:position])
+        row_cost_basis = parse_decimal(row[:cost_basis_price])
+
+        unless row_quantity && row_cost_basis
+          Rails.logger.warn(
+            "IbkrAccount::HoldingsProcessor - Skipping lot with missing position or cost_basis_price " \
+            "for conid=#{row[:conid].inspect}"
+          )
+          next
+        end
+
+        total_quantity += row_quantity.abs
+        total_cost     += row_quantity.abs * row_cost_basis
+      end
+
+      return nil if total_quantity.zero?
+
+      { quantity: total_quantity, cost_basis: total_cost / total_quantity }
+    end
+
+    def supported_position?(row)
+      row[:asset_category].to_s == "STK" &&
+        row[:side].to_s == "Long" &&
+        row[:conid].present? &&
+        row[:security_id].present? &&
+        row[:security_id_type].present? &&
+        row[:symbol].present? &&
+        row[:currency].present? &&
+        row[:fx_rate_to_base].present? &&
+        row[:position].present? &&
+        row[:mark_price].present? &&
+        row[:cost_basis_price].present? &&
+        row[:report_date].present?
+    end
+end
diff --git a/app/models/ibkr_account/processor.rb b/app/models/ibkr_account/processor.rb
new file mode 100644
index 000000000..0a924d4a7
--- /dev/null
+++ b/app/models/ibkr_account/processor.rb
@@ -0,0 +1,63 @@
+class IbkrAccount::Processor
+  attr_reader :ibkr_account
+
+  def initialize(ibkr_account)
+    @ibkr_account = ibkr_account
+  end
+
+  def process
+    return unless account.present?
+
+    update_account_balance!
+    IbkrAccount::HoldingsProcessor.new(ibkr_account).process
+    IbkrAccount::ActivitiesProcessor.new(ibkr_account).process
+    repair_default_opening_anchor!
+
+    account.broadcast_sync_complete
+  end
+
+  private
+
+    def account
+      @account ||= ibkr_account.current_account
+    end
+
+    def update_account_balance!
+      total_balance = ibkr_account.current_balance || ibkr_account.cash_balance || 0
+      cash_balance = ibkr_account.cash_balance || 0
+
+      account.assign_attributes(
+        balance: total_balance,
+        cash_balance: cash_balance,
+        currency: ibkr_account.currency
+      )
+      account.save!
+      account.set_current_balance(total_balance)
+    end
+
+    def repair_default_opening_anchor!
+      return unless account&.linked_to?("IbkrAccount")
+      return unless account.has_opening_anchor?
+
+      opening_anchor_entry = account.valuations.opening_anchor.includes(:entry).first&.entry
+      return unless opening_anchor_entry
+      return unless opening_anchor_entry.created_at.to_date == account.created_at.to_date
+      return unless account.entries.where.not(entryable_type: "Valuation").exists?
+
+      imported_current_balance = (ibkr_account.current_balance || ibkr_account.cash_balance || 0).to_d
+      return unless opening_anchor_entry.amount.to_d == imported_current_balance
+
+      result = Account::OpeningBalanceManager.new(account).set_opening_balance(
+        balance: 0,
+        date: opening_anchor_entry.date
+      )
+
+      # Don't raise — broadcast_sync_complete must still run after a repair failure.
+      if result.error
+        Rails.logger.error(
+          "IbkrAccount::Processor - Failed to repair opening anchor for account #{account.id}: #{result.error}"
+        )
+        Sentry.capture_message(result.error)
+      end
+    end
+end
diff --git a/app/models/ibkr_item.rb b/app/models/ibkr_item.rb
new file mode 100644
index 000000000..aca60d1b2
--- /dev/null
+++ b/app/models/ibkr_item.rb
@@ -0,0 +1,124 @@
+class IbkrItem < ApplicationRecord
+  include Syncable, Provided, Unlinking, Encryptable
+
+  enum :status, { good: "good", requires_update: "requires_update" }, default: :good
+
+  if encryption_ready?
+    encrypts :query_id, deterministic: true
+    encrypts :token
+    encrypts :raw_payload
+  end
+
+  belongs_to :family
+  has_one_attached :logo, dependent: :purge_later
+
+  has_many :ibkr_accounts, dependent: :destroy
+
+  validates :name, presence: true
+  validates :query_id, presence: true, on: :create
+  validates :token, presence: true, on: :create
+
+  scope :active, -> { where(scheduled_for_deletion: false) }
+  scope :syncable, -> { active.where.not(query_id: [ nil, "" ]).where.not(token: nil) }
+  scope :ordered, -> { order(created_at: :desc) }
+  scope :needs_update, -> { where(status: :requires_update) }
+
+  def destroy_later
+    update!(scheduled_for_deletion: true)
+    DestroyJob.perform_later(self)
+  end
+
+  def credentials_configured?
+    query_id.present? && token.present?
+  end
+
+  def import_latest_ibkr_data
+    provider = ibkr_provider
+    raise StandardError, "IBKR provider is not configured" unless provider
+
+    IbkrItem::Importer.new(self, ibkr_provider: provider).import
+  rescue => e
+    Rails.logger.error("IbkrItem #{id} - Failed to import data: #{e.message}")
+    raise
+  end
+
+  def process_accounts
+    return [] if ibkr_accounts.empty?
+
+    linked_ibkr_accounts.includes(account_provider: :account).each_with_object([]) do |ibkr_account, results|
+      account = ibkr_account.current_account
+      next unless account
+      next if account.pending_deletion? || account.disabled?
+
+      begin
+        result = IbkrAccount::Processor.new(ibkr_account).process
+        results << { ibkr_account_id: ibkr_account.id, success: true, result: result }
+      rescue => e
+        Rails.logger.error("IbkrItem #{id} - Failed to process account #{ibkr_account.id}: #{e.message}")
+        results << { ibkr_account_id: ibkr_account.id, success: false, error: e.message }
+      end
+    end
+  end
+
+  def schedule_account_syncs(parent_sync: nil, window_start_date: nil, window_end_date: nil)
+    accounts.reject { |account| account.pending_deletion? || account.disabled? }.each_with_object([]) do |account, results|
+      begin
+        account.sync_later(
+          parent_sync: parent_sync,
+          window_start_date: window_start_date,
+          window_end_date: window_end_date
+        )
+        results << { account_id: account.id, success: true }
+      rescue => e
+        Rails.logger.error("IbkrItem #{id} - Failed to schedule sync for account #{account.id}: #{e.message}")
+        results << { account_id: account.id, success: false, error: e.message }
+      end
+    end
+  end
+
+  def upsert_ibkr_snapshot!(payload)
+    update!(raw_payload: payload, status: :good)
+  end
+
+  def accounts
+    ibkr_accounts.includes(account_provider: :account).filter_map(&:current_account).uniq
+  end
+
+  def linked_ibkr_accounts
+    ibkr_accounts.joins(:account_provider)
+  end
+
+  def linked_accounts_count
+    ibkr_accounts.joins(:account_provider).count
+  end
+
+  def unlinked_accounts_count
+    ibkr_accounts.left_joins(:account_provider).where(account_providers: { id: nil }).count
+  end
+
+  def total_accounts_count
+    ibkr_accounts.count
+  end
+
+  def has_completed_initial_setup?
+    accounts.any?
+  end
+
+  def sync_status_summary
+    total_accounts = total_accounts_count
+    linked_count = linked_accounts_count
+    unlinked_count = unlinked_accounts_count
+
+    if total_accounts.zero?
+      I18n.t("ibkr_items.sync_status.no_accounts")
+    elsif unlinked_count.zero?
+      I18n.t("ibkr_items.sync_status.all_linked", count: linked_count)
+    else
+      I18n.t("ibkr_items.sync_status.partial", linked: linked_count, unlinked: unlinked_count)
+    end
+  end
+
+  def institution_display_name
+    I18n.t("ibkr_items.defaults.name")
+  end
+end
diff --git a/app/models/ibkr_item/importer.rb b/app/models/ibkr_item/importer.rb
new file mode 100644
index 000000000..30a5916da
--- /dev/null
+++ b/app/models/ibkr_item/importer.rb
@@ -0,0 +1,33 @@
+class IbkrItem::Importer
+  attr_reader :ibkr_item, :ibkr_provider
+
+  def initialize(ibkr_item, ibkr_provider:)
+    @ibkr_item = ibkr_item
+    @ibkr_provider = ibkr_provider
+  end
+
+  def import
+    xml_body = ibkr_provider.download_statement
+    parsed_report = IbkrItem::ReportParser.new(xml_body).parse
+
+    accounts_imported = 0
+    ibkr_item.transaction do
+      ibkr_item.upsert_ibkr_snapshot!(parsed_report[:metadata].merge("fetched_at" => Time.current.iso8601))
+
+      parsed_report[:accounts].each do |account_data|
+        next if account_data[:ibkr_account_id].blank?
+
+        ibkr_account = ibkr_item.ibkr_accounts.find_or_initialize_by(ibkr_account_id: account_data[:ibkr_account_id])
+        ibkr_account.upsert_from_ibkr_statement!(account_data)
+        accounts_imported += 1
+      end
+
+      ibkr_item.update!(status: :good)
+    end
+
+    {
+      success: true,
+      accounts_imported: accounts_imported
+    }
+  end
+end
diff --git a/app/models/ibkr_item/provided.rb b/app/models/ibkr_item/provided.rb
new file mode 100644
index 000000000..55c6d43fb
--- /dev/null
+++ b/app/models/ibkr_item/provided.rb
@@ -0,0 +1,9 @@
+module IbkrItem::Provided
+  extend ActiveSupport::Concern
+
+  def ibkr_provider
+    return nil unless credentials_configured?
+
+    Provider::IbkrFlex.new(query_id: query_id, token: token)
+  end
+end
diff --git a/app/models/ibkr_item/report_parser.rb b/app/models/ibkr_item/report_parser.rb
new file mode 100644
index 000000000..edab81812
--- /dev/null
+++ b/app/models/ibkr_item/report_parser.rb
@@ -0,0 +1,143 @@
+class IbkrItem::ReportParser
+  include IbkrAccount::DataHelpers
+
+  class ParseError < StandardError; end
+
+  POSITION_VALUE_CONTAINER_NAMES = %w[ChangeInPositionValues].freeze
+  POSITION_VALUE_ROW_NAMES = %w[ChangeInPositionValue].freeze
+  CASH_REPORT_CONTAINER_NAMES = %w[CashReport CashReports].freeze
+  CASH_REPORT_ROW_NAMES = %w[CashReport CashReportCurrency CashReportRow].freeze
+  EQUITY_SUMMARY_CONTAINER_NAMES = %w[EquitySummaryInBase].freeze
+  EQUITY_SUMMARY_ROW_NAMES = %w[EquitySummaryByReportDateInBase].freeze
+  OPEN_POSITION_CONTAINER_NAMES = %w[OpenPositions].freeze
+  OPEN_POSITION_ROW_NAMES = %w[OpenPosition].freeze
+  TRADES_CONTAINER_NAMES = %w[Trades].freeze
+  TRADE_ROW_NAMES = %w[Trade].freeze
+  CASH_TRANSACTION_CONTAINER_NAMES = %w[CashTransactions].freeze
+  CASH_TRANSACTION_ROW_NAMES = %w[CashTransaction].freeze
+
+  def initialize(xml_body)
+    @document = Nokogiri::XML(xml_body.to_s) { |config| config.strict.noblanks }
+  rescue Nokogiri::XML::SyntaxError => e
+    raise ParseError, "Invalid IBKR Flex XML: #{e.message}"
+  end
+
+  def parse
+    validate_document!
+
+    {
+      metadata: root_metadata,
+      accounts: flex_statements.map { |statement| parse_statement(statement) }
+    }
+  end
+
+  private
+
+    def validate_document!
+      raise ParseError, "Invalid IBKR Flex XML: missing FlexQueryResponse root." unless @document.at_xpath("//FlexQueryResponse")
+      raise ParseError, "Invalid IBKR Flex XML: no FlexStatement nodes found." if flex_statements.empty?
+    end
+
+    def flex_statements
+      @document.xpath("//FlexStatement")
+    end
+
+    def root_metadata
+      node_attributes(@document.at_xpath("//FlexQueryResponse"))
+    end
+
+    def parse_statement(statement)
+      statement_data = node_attributes(statement)
+      account_information = node_attributes(statement.at_xpath("./AccountInformation"))
+      position_values = section_rows(statement, POSITION_VALUE_CONTAINER_NAMES, POSITION_VALUE_ROW_NAMES)
+      cash_report = section_rows(statement, CASH_REPORT_CONTAINER_NAMES, CASH_REPORT_ROW_NAMES)
+      equity_summary_in_base = section_rows(statement, EQUITY_SUMMARY_CONTAINER_NAMES, EQUITY_SUMMARY_ROW_NAMES)
+      open_positions = section_rows(statement, OPEN_POSITION_CONTAINER_NAMES, OPEN_POSITION_ROW_NAMES)
+      trades = section_rows(statement, TRADES_CONTAINER_NAMES, TRADE_ROW_NAMES)
+      cash_transactions = section_rows(statement, CASH_TRANSACTION_CONTAINER_NAMES, CASH_TRANSACTION_ROW_NAMES)
+      account_id = account_information["account_id"].presence || statement_data["account_id"]
+
+      raise ParseError, "Invalid IBKR Flex XML: missing account identifier in FlexStatement." if account_id.blank?
+
+      currency = account_information["currency"].presence&.upcase || "USD"
+      report_date = open_positions.filter_map { |row| parse_date(row["report_date"]) }.max ||
+        equity_summary_in_base.filter_map { |row| parse_date(row["report_date"]) }.max ||
+        parse_date(statement_data["to_date"]) ||
+        Date.current
+
+      {
+        ibkr_account_id: account_id,
+        name: account_id,
+        currency: currency,
+        cash_balance: extract_cash_balance(cash_report, currency),
+        current_balance: extract_total_balance(position_values, cash_report, currency),
+        report_date: report_date,
+        statement: statement_data,
+        cash_report: cash_report,
+        equity_summary_in_base: equity_summary_in_base,
+        open_positions: open_positions,
+        trades: trades,
+        cash_transactions: cash_transactions,
+        raw_payload: {
+          statement: statement_data,
+          cash_report: cash_report,
+          equity_summary_in_base: equity_summary_in_base,
+          open_positions: open_positions,
+          trades: trades,
+          cash_transactions: cash_transactions
+        }
+      }
+    end
+
+    def section_rows(statement, container_names, row_names)
+      rows = []
+
+      container_names.each do |container_name|
+        statement.xpath("./#{container_name}").each do |container|
+          children = container.element_children
+
+          if children.any?
+            rows.concat(children.select { |child| row_names.include?(child.name) })
+          elsif row_names.include?(container.name)
+            rows << container
+          end
+        end
+      end
+
+      if rows.empty?
+        row_names.each do |row_name|
+          rows.concat(statement.xpath("./#{row_name}"))
+        end
+      end
+
+      rows.map { |row| node_attributes(row) }.reject(&:blank?)
+    end
+
+    def node_attributes(node)
+      return {} unless node
+
+      node.attribute_nodes.each_with_object({}) do |attribute, result|
+        result[attribute.name.underscore] = attribute.value
+      end
+    end
+
+    def extract_cash_balance(cash_rows, account_currency)
+      base_summary = cash_rows.find { |row| row["currency"] == "BASE_SUMMARY" }
+      account_row = cash_rows.find { |row| row["currency"] == account_currency }
+      row = base_summary || account_row
+
+      parse_decimal(row&.fetch("ending_cash", nil)) || BigDecimal("0")
+    end
+
+    def extract_current_balance(position_values, account_currency)
+      base_summary = position_values.find { |row| row["currency"] == "BASE_SUMMARY" }
+      account_row = position_values.find { |row| row["currency"] == account_currency }
+      row = base_summary || account_row
+
+      parse_decimal(row&.fetch("end_of_period_value", nil)) || BigDecimal("0")
+    end
+
+    def extract_total_balance(position_values, cash_rows, account_currency)
+      extract_current_balance(position_values, account_currency) + extract_cash_balance(cash_rows, account_currency)
+    end
+end
diff --git a/app/models/ibkr_item/sync_complete_event.rb b/app/models/ibkr_item/sync_complete_event.rb
new file mode 100644
index 000000000..46ebe39ac
--- /dev/null
+++ b/app/models/ibkr_item/sync_complete_event.rb
@@ -0,0 +1,22 @@
+class IbkrItem::SyncCompleteEvent
+  attr_reader :ibkr_item
+
+  def initialize(ibkr_item)
+    @ibkr_item = ibkr_item
+  end
+
+  def broadcast
+    ibkr_item.accounts.each do |account|
+      account.broadcast_sync_complete
+    end
+
+    ibkr_item.broadcast_replace_to(
+      ibkr_item.family,
+      target: "ibkr_item_#{ibkr_item.id}",
+      partial: "ibkr_items/ibkr_item",
+      locals: { ibkr_item: ibkr_item }
+    )
+
+    ibkr_item.family.broadcast_sync_complete
+  end
+end
diff --git a/app/models/ibkr_item/syncer.rb b/app/models/ibkr_item/syncer.rb
new file mode 100644
index 000000000..003c26855
--- /dev/null
+++ b/app/models/ibkr_item/syncer.rb
@@ -0,0 +1,68 @@
+class IbkrItem::Syncer
+  include SyncStats::Collector
+
+  attr_reader :ibkr_item
+
+  def initialize(ibkr_item)
+    @ibkr_item = ibkr_item
+  end
+
+  def perform_sync(sync)
+    sync.update!(status_text: "Checking IBKR credentials...") if sync.respond_to?(:status_text)
+    unless ibkr_item.credentials_configured?
+      ibkr_item.update!(status: :requires_update)
+      raise Provider::IbkrFlex::ConfigurationError, "IBKR credentials are missing."
+    end
+
+    sync.update!(status_text: "Importing IBKR accounts...") if sync.respond_to?(:status_text)
+    ibkr_item.import_latest_ibkr_data
+
+    sync.update!(status_text: "Checking account configuration...") if sync.respond_to?(:status_text)
+    collect_setup_stats(sync, provider_accounts: ibkr_item.ibkr_accounts.to_a)
+
+    unlinked_accounts = ibkr_item.ibkr_accounts.left_joins(:account_provider).where(account_providers: { id: nil })
+    linked_accounts = ibkr_item.ibkr_accounts.joins(:account).merge(Account.visible)
+
+    if unlinked_accounts.any?
+      ibkr_item.update!(pending_account_setup: true)
+      sync.update!(status_text: "#{unlinked_accounts.count} IBKR account(s) need setup...") if sync.respond_to?(:status_text)
+    else
+      ibkr_item.update!(pending_account_setup: false)
+    end
+
+    if linked_accounts.any?
+      sync.update!(status_text: "Processing holdings and activity...") if sync.respond_to?(:status_text)
+      ibkr_item.process_accounts
+
+      sync.update!(status_text: "Calculating balances...") if sync.respond_to?(:status_text)
+      ibkr_item.schedule_account_syncs(
+        parent_sync: sync,
+        window_start_date: sync.window_start_date,
+        window_end_date: sync.window_end_date
+      )
+
+      account_ids = linked_accounts.includes(:account).filter_map { |provider_account| provider_account.account&.id }
+      collect_transaction_stats(sync, account_ids: account_ids, source: "ibkr") if account_ids.any?
+      collect_trades_stats(sync, account_ids: account_ids, source: "ibkr") if account_ids.any?
+      collect_holdings_stats(sync, holdings_count: count_holdings, label: "processed")
+    end
+
+    collect_health_stats(sync, errors: nil)
+  rescue Provider::IbkrFlex::AuthenticationError, Provider::IbkrFlex::ConfigurationError => e
+    ibkr_item.update!(status: :requires_update)
+    collect_health_stats(sync, errors: [ { message: e.message, category: "auth_error" } ])
+    raise
+  rescue => e
+    collect_health_stats(sync, errors: [ { message: e.message, category: "sync_error" } ])
+    raise
+  end
+
+  def perform_post_sync
+  end
+
+  private
+
+    def count_holdings
+      ibkr_item.ibkr_accounts.sum { |account| Array(account.raw_holdings_payload).size }
+    end
+end
diff --git a/app/models/ibkr_item/unlinking.rb b/app/models/ibkr_item/unlinking.rb
new file mode 100644
index 000000000..ddc827a56
--- /dev/null
+++ b/app/models/ibkr_item/unlinking.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module IbkrItem::Unlinking
+  extend ActiveSupport::Concern
+
+  def unlink_all!(dry_run: false)
+    results = []
+
+    ibkr_accounts.find_each do |provider_account|
+      links = AccountProvider.where(provider_type: "IbkrAccount", provider_id: provider_account.id).to_a
+      link_ids = links.map(&:id)
+      result = {
+        provider_account_id: provider_account.id,
+        name: provider_account.name,
+        provider_link_ids: link_ids
+      }
+      results << result
+
+      next if dry_run
+
+      begin
+        ActiveRecord::Base.transaction do
+          Holding.where(account_provider_id: link_ids).update_all(account_provider_id: nil) if link_ids.any?
+          links.each(&:destroy!)
+        end
+      rescue => e
+        Rails.logger.warn(
+          "IbkrItem Unlinker: failed to fully unlink provider account ##{provider_account.id} " \
+          "(links=#{link_ids.inspect}): #{e.class} - #{e.message}"
+        )
+        result[:error] = e.message
+      end
+    end
+
+    results
+  end
+end
diff --git a/app/models/import.rb b/app/models/import.rb
index 941a6ead6..71887faed 100644
--- a/app/models/import.rb
+++ b/app/models/import.rb
@@ -2,6 +2,7 @@ class Import < ApplicationRecord
   MaxRowCountExceededError = Class.new(StandardError)
   MappingError = Class.new(StandardError)
 
+  # Shared CSV upload/content limit for web and API imports, including preflight.
   MAX_CSV_SIZE = 10.megabytes
   MAX_PDF_SIZE = 25.megabytes
   ALLOWED_CSV_MIME_TYPES = %w[text/csv text/plain application/vnd.ms-excel application/csv].freeze
@@ -9,10 +10,17 @@ class Import < ApplicationRecord
 
   DOCUMENT_TYPES = %w[bank_statement credit_card_statement investment_statement financial_document contract other].freeze
 
-  TYPES = %w[TransactionImport TradeImport AccountImport MintImport CategoryImport RuleImport PdfImport QifImport SureImport].freeze
+  TYPES = %w[TransactionImport TradeImport AccountImport MintImport ActualImport CategoryImport RuleImport PdfImport QifImport SureImport].freeze
   SIGNAGE_CONVENTIONS = %w[inflows_positive inflows_negative]
   SEPARATORS = [ [ "Comma (,)", "," ], [ "Semicolon (;)", ";" ] ].freeze
 
+  def self.separator_options
+    [
+      [ I18n.t("activerecord.attributes.import.col_seps.comma"), "," ],
+      [ I18n.t("activerecord.attributes.import.col_seps.semicolon"), ";" ]
+    ]
+  end
+
   NUMBER_FORMATS = {
     "1,234.56" => { separator: ".", delimiter: "," },  # US/UK/Asia
     "1.234,56" => { separator: ",", delimiter: "." },  # Most of Europe
@@ -24,6 +32,10 @@ class Import < ApplicationRecord
     Date.new(1970, 1, 1)..Date.today.next_year(5)
   end
 
+  def self.max_csv_size
+    MAX_CSV_SIZE
+  end
+
   AMOUNT_TYPE_STRATEGIES = %w[signed_amount custom_column].freeze
 
   belongs_to :family
@@ -202,21 +214,22 @@ class Import < ApplicationRecord
   def generate_rows_from_csv
     rows.destroy_all
 
-    mapped_rows = csv_rows.map do |row|
+    mapped_rows = csv_rows.map.with_index(1) do |row, index|
       {
-        account: row[account_col_label].to_s,
-        date: row[date_col_label].to_s,
-        qty: sanitize_number(row[qty_col_label]).to_s,
-        ticker: row[ticker_col_label].to_s,
-        exchange_operating_mic: row[exchange_operating_mic_col_label].to_s,
-        price: sanitize_number(row[price_col_label]).to_s,
-        amount: sanitize_number(row[amount_col_label]).to_s,
-        currency: (row[currency_col_label] || default_currency).to_s,
-        name: (row[name_col_label] || default_row_name).to_s,
-        category: row[category_col_label].to_s,
-        tags: row[tags_col_label].to_s,
-        entity_type: row[entity_type_col_label].to_s,
-        notes: row[notes_col_label].to_s
+        source_row_number: index,
+        account: csv_value(row, account_col_label, "account", "account_name").to_s,
+        date: csv_value(row, date_col_label, "date").to_s,
+        qty: sanitize_number(csv_value(row, qty_col_label, "qty", "quantity")).to_s,
+        ticker: csv_value(row, ticker_col_label, "ticker").to_s,
+        exchange_operating_mic: csv_value(row, exchange_operating_mic_col_label, "exchange_operating_mic").to_s,
+        price: sanitize_number(csv_value(row, price_col_label, "price")).to_s,
+        amount: sanitize_number(csv_value(row, amount_col_label, "amount", "balance")).to_s,
+        currency: (csv_value(row, currency_col_label, "currency") || default_currency).to_s,
+        name: (csv_value(row, name_col_label, "name") || default_row_name).to_s,
+        category: csv_value(row, category_col_label, "category").to_s,
+        tags: csv_value(row, tags_col_label, "tags").to_s,
+        entity_type: csv_value(row, entity_type_col_label, "entity_type", "account_type", "type").to_s,
+        notes: csv_value(row, notes_col_label, "notes").to_s
       }
     end
 
@@ -258,6 +271,10 @@ class Import < ApplicationRecord
     uploaded? && rows_count > 0
   end
 
+  def configured_for_status_detail?
+    configured?
+  end
+
   def cleaned?
     configured? && rows.all?(&:valid?)
   end
@@ -266,6 +283,23 @@ class Import < ApplicationRecord
     cleaned? && mappings.all?(&:valid?)
   end
 
+  def cleaned_from_validation_stats?(invalid_rows_count:)
+    configured? && invalid_rows_count.zero?
+  end
+
+  def publishable_from_validation_stats?(invalid_rows_count:)
+    cleaned_from_validation_stats?(invalid_rows_count: invalid_rows_count) && mappings.all?(&:valid?)
+  end
+
+  def mapping_status_counts
+    mappable_ids = mappings.pluck(:mappable_id)
+
+    {
+      mappings_count: mappable_ids.size,
+      unassigned_mappings_count: mappable_ids.count(&:nil?)
+    }
+  end
+
   def revertable?
     complete? || revert_failed?
   end
@@ -354,6 +388,55 @@ class Import < ApplicationRecord
       account&.currency || family.currency
     end
 
+    def csv_value(row, label, *aliases)
+      return if label.blank?
+
+      [ label, *aliases ].each do |candidate|
+        header = header_for(candidate)
+        next if header.blank?
+
+        value = row[header]
+        return value if value.present?
+      end
+
+      nil
+    end
+
+    def header_for(candidate)
+      return if candidate.blank?
+
+      normalized_csv_headers[normalize_header(candidate)]
+    end
+
+    def normalized_csv_headers
+      @normalized_csv_headers ||= begin
+        grouped_headers = Array(csv_headers)
+          .filter_map do |header|
+            normalized = normalize_header(header)
+            next if normalized.blank?
+
+            [ normalized, header ]
+          end
+          .group_by(&:first)
+
+        duplicate_headers = grouped_headers.values.filter_map do |headers|
+          originals = headers.map(&:last).uniq
+          originals if originals.many?
+        end
+
+        if duplicate_headers.any?
+          errors.add(:base, :duplicate_headers, columns: duplicate_headers.map { |headers| headers.join(", ") }.join("; "))
+          raise ActiveRecord::RecordInvalid, self
+        end
+
+        grouped_headers.transform_values { |headers| headers.first.last }
+      end
+    end
+
+    def normalize_header(header)
+      header.to_s.strip.downcase.gsub(/\*/, "").gsub(/[\s-]+/, "_")
+    end
+
     def parsed_csv
       return @parsed_csv if defined?(@parsed_csv)
 
diff --git a/app/models/import/preflight.rb b/app/models/import/preflight.rb
new file mode 100644
index 000000000..69051eac3
--- /dev/null
+++ b/app/models/import/preflight.rb
@@ -0,0 +1,454 @@
+# frozen_string_literal: true
+
+class Import::Preflight
+  Response = Struct.new(:status, :payload, keyword_init: true)
+
+  class PreflightError < StandardError
+    attr_reader :status, :payload
+
+    def initialize(response)
+      @status = response.status
+      @payload = response.payload
+      super(response.payload[:message])
+    end
+  end
+
+  CONFIG_PARAM_KEYS = %i[
+    date_col_label
+    amount_col_label
+    name_col_label
+    category_col_label
+    tags_col_label
+    notes_col_label
+    account_col_label
+    qty_col_label
+    ticker_col_label
+    price_col_label
+    entity_type_col_label
+    currency_col_label
+    exchange_operating_mic_col_label
+    date_format
+    number_format
+    signage_convention
+    col_sep
+    amount_type_strategy
+    amount_type_inflow_value
+    rows_to_skip
+  ].freeze
+
+  PARAM_KEYS = ([
+    :type,
+    :account_id,
+    :file,
+    :raw_file_content
+  ] + CONFIG_PARAM_KEYS).freeze
+
+  UNSUPPORTED_PREFLIGHT_IMPORT_TYPES = %w[PdfImport QifImport].freeze
+  IMPORT_TYPES = (Import::TYPES - UNSUPPORTED_PREFLIGHT_IMPORT_TYPES).freeze
+
+  def initialize(family:, params:)
+    @family = family
+    @params = params.to_h.symbolize_keys
+  end
+
+  def call
+    type = preflight_import_type
+    return invalid_import_type_response unless type
+
+    type == "SureImport" ? sure_import_response : csv_import_response(type)
+  rescue PreflightError => e
+    Response.new(status: e.status, payload: e.payload)
+  end
+
+  private
+    attr_reader :family, :params
+
+    def preflight_import_type
+      type = params[:type].to_s
+      return "TransactionImport" if type.blank?
+
+      type if IMPORT_TYPES.include?(type)
+    end
+
+    def invalid_import_type_response
+      Response.new(
+        status: :unprocessable_entity,
+        payload: {
+          error: "invalid_import_type",
+          message: "type must be one of: #{IMPORT_TYPES.join(', ')}"
+        }
+      )
+    end
+
+    def sure_import_response
+      upload_attributes = sure_import_upload_attributes
+      return missing_sure_content_response unless upload_attributes
+
+      content, filename, content_type = upload_attributes
+      Response.new(
+        status: :ok,
+        payload: {
+          data: sure_import_preflight_payload(content, filename, content_type)
+        }
+      )
+    end
+
+    def csv_import_response(type)
+      upload_attributes = csv_upload_attributes
+      return missing_csv_content_response unless upload_attributes
+
+      content, filename, content_type = upload_attributes
+      import = family.imports.build(import_config_params.merge(type: type, raw_file_str: content))
+      import.account = preflight_account if params[:account_id].present?
+      apply_import_defaults(import)
+
+      return unsupported_import_type_response unless import.requires_csv_workflow?
+
+      unless import.valid?
+        return Response.new(
+          status: :ok,
+          payload: {
+            data: csv_preflight_payload(
+              import: import,
+              type: type,
+              filename: filename,
+              content_type: content_type,
+              content: content,
+              parsed_rows_count: 0,
+              csv_headers: [],
+              missing_required_headers: [],
+              errors: validation_errors(import),
+              warnings: []
+            )
+          }
+        )
+      end
+
+      csv_content = csv_content_for(import, content)
+      csv = Import.parse_csv_str(csv_content, col_sep: import.col_sep)
+      parsed_rows_count = csv.length
+      csv_headers = Array(csv.headers).compact
+      missing_required_headers = missing_required_headers(import, csv_headers)
+      errors = validation_errors(import)
+
+      if missing_required_headers.any?
+        errors << {
+          code: "missing_required_headers",
+          message: "Missing required columns: #{missing_required_headers.join(', ')}"
+        }
+      end
+
+      if parsed_rows_count.zero?
+        errors << {
+          code: "no_data_rows",
+          message: "No data rows were found."
+        }
+      end
+
+      warnings = []
+      warnings << "Row count exceeds this import type's publish limit." if parsed_rows_count > import.max_row_count
+
+      Response.new(
+        status: :ok,
+        payload: {
+          data: csv_preflight_payload(
+            import: import,
+            type: type,
+            filename: filename,
+            content_type: content_type,
+            content: content,
+            parsed_rows_count: parsed_rows_count,
+            csv_headers: csv_headers,
+            missing_required_headers: missing_required_headers,
+            errors: errors,
+            warnings: warnings
+          )
+        }
+      )
+    end
+
+    def import_config_params
+      params.slice(*CONFIG_PARAM_KEYS)
+    end
+
+    def preflight_account
+      raise ActiveRecord::RecordNotFound unless Api::V1::BaseController.valid_uuid?(params[:account_id])
+
+      family.accounts.find(params[:account_id])
+    end
+
+    def csv_upload_attributes
+      if params[:file].present?
+        csv_file_upload_attributes(params[:file])
+      elsif params[:raw_file_content].present?
+        csv_raw_content_attributes(params[:raw_file_content].to_s)
+      end
+    end
+
+    def csv_file_upload_attributes(file)
+      raise_response csv_file_too_large_response if file.size > Import.max_csv_size
+      raise_response invalid_csv_file_type_response unless Import::ALLOWED_CSV_MIME_TYPES.include?(file.content_type)
+
+      [
+        file.read,
+        file.original_filename.presence || "import.csv",
+        file.content_type.presence || "text/csv"
+      ]
+    end
+
+    def csv_raw_content_attributes(content)
+      raise_response csv_content_too_large_response if content.bytesize > Import.max_csv_size
+
+      [ content, "import.csv", "text/csv" ]
+    end
+
+    def sure_import_upload_attributes
+      if params[:file].present?
+        sure_import_file_upload_attributes(params[:file])
+      elsif params[:raw_file_content].present?
+        sure_import_raw_content_attributes(params[:raw_file_content].to_s)
+      end
+    end
+
+    def sure_import_file_upload_attributes(file)
+      raise_response sure_file_too_large_response if file.size > SureImport.max_ndjson_size
+
+      extension = File.extname(file.original_filename.to_s).downcase
+      unless SureImport::ALLOWED_NDJSON_CONTENT_TYPES.include?(file.content_type) || extension.in?(%w[.ndjson .json])
+        raise_response invalid_sure_file_type_response
+      end
+
+      [
+        file.read,
+        file.original_filename.presence || "sure-import.ndjson",
+        file.content_type.presence || "application/x-ndjson"
+      ]
+    end
+
+    def sure_import_raw_content_attributes(content)
+      raise_response sure_content_too_large_response if content.bytesize > SureImport.max_ndjson_size
+
+      [ content, "sure-import.ndjson", "application/x-ndjson" ]
+    end
+
+    def sure_import_preflight_payload(content, filename, content_type)
+      line_counts = Hash.new(0)
+      errors = []
+      valid_rows_count = 0
+      nonblank_rows_count = 0
+
+      content.each_line.with_index(1) do |line, line_number|
+        next if line.strip.blank?
+
+        nonblank_rows_count += 1
+        record = JSON.parse(line)
+
+        unless record.is_a?(Hash)
+          errors << {
+            code: "invalid_ndjson_record",
+            message: "Line #{line_number} must be a JSON object."
+          }
+          next
+        end
+
+        if record["type"].blank? || !record.key?("data")
+          errors << {
+            code: "invalid_ndjson_record",
+            message: "Line #{line_number} must include type and data."
+          }
+          next
+        end
+
+        valid_rows_count += 1
+        line_counts[record["type"]] += 1
+      rescue JSON::ParserError => e
+        errors << {
+          code: "invalid_json",
+          message: "Line #{line_number} is not valid JSON: #{e.message}"
+        }
+      end
+
+      if nonblank_rows_count.zero?
+        errors << {
+          code: "no_data_rows",
+          message: "No data rows were found."
+        }
+      end
+
+      entity_counts = SureImport.dry_run_totals_from_line_type_counts(line_counts)
+      unsupported_types = line_counts.keys - SureImport.importable_ndjson_types
+      warnings = []
+      warnings << "No importable records were found." if nonblank_rows_count.positive? && entity_counts.values.sum.zero?
+      warnings << "Some records use unsupported types: #{unsupported_types.join(', ')}" if unsupported_types.any?
+      warnings << "Row count exceeds this import type's publish limit." if nonblank_rows_count > SureImport.max_row_count
+
+      {
+        type: "SureImport",
+        valid: errors.empty?,
+        content: content_payload(filename, content_type, content),
+        stats: {
+          rows_count: nonblank_rows_count,
+          valid_rows_count: valid_rows_count,
+          invalid_rows_count: nonblank_rows_count - valid_rows_count,
+          entity_counts: entity_counts,
+          record_type_counts: line_counts
+        },
+        errors: errors,
+        warnings: warnings
+      }
+    end
+
+    def content_payload(filename, content_type, content)
+      {
+        filename: filename,
+        content_type: content_type,
+        byte_size: content.bytesize
+      }
+    end
+
+    def csv_content_for(import, content)
+      return content unless import.rows_to_skip.to_i.positive?
+
+      content.lines.drop(import.rows_to_skip.to_i).join
+    end
+
+    def apply_import_defaults(import)
+      return unless import.class.respond_to?(:default_column_mappings)
+
+      import.class.default_column_mappings.each do |attribute, value|
+        import.public_send("#{attribute}=", value) if import.public_send(attribute).blank?
+      end
+    end
+
+    def validation_errors(import)
+      import.errors.full_messages.map { |message| { code: "validation_failed", message: message } }
+    end
+
+    def csv_preflight_payload(import:, type:, filename:, content_type:, content:, parsed_rows_count:, csv_headers:, missing_required_headers:, errors:, warnings:)
+      {
+        type: type,
+        valid: errors.empty?,
+        content: content_payload(filename, content_type, content),
+        stats: {
+          rows_count: parsed_rows_count
+        },
+        headers: csv_headers,
+        required_headers: required_header_labels(import),
+        missing_required_headers: missing_required_headers,
+        errors: errors,
+        warnings: warnings
+      }
+    end
+
+    def required_header_labels(import)
+      import.required_column_keys.filter_map do |key|
+        import.respond_to?("#{key}_col_label") ? import.public_send("#{key}_col_label").presence || key.to_s : key.to_s
+      end
+    end
+
+    def missing_required_headers(import, headers)
+      normalized_headers = Array(headers).compact.to_h { |header| [ normalized_header(header), header ] }
+
+      required_header_labels(import).reject do |header|
+        normalized_headers.key?(normalized_header(header))
+      end
+    end
+
+    def normalized_header(header)
+      header.to_s.strip.downcase.gsub(/\*/, "").gsub(/[\s-]+/, "_")
+    end
+
+    def missing_csv_content_response
+      Response.new(
+        status: :unprocessable_entity,
+        payload: {
+          error: "missing_content",
+          message: "Provide a CSV file or raw_file_content."
+        }
+      )
+    end
+
+    def missing_sure_content_response
+      Response.new(
+        status: :unprocessable_entity,
+        payload: {
+          error: "missing_content",
+          message: "Provide a Sure NDJSON file or raw_file_content."
+        }
+      )
+    end
+
+    def csv_file_too_large_response
+      Response.new(
+        status: :unprocessable_entity,
+        payload: {
+          error: "file_too_large",
+          message: "File is too large. Maximum size is #{Import.max_csv_size / 1.megabyte}MB."
+        }
+      )
+    end
+
+    def csv_content_too_large_response
+      Response.new(
+        status: :unprocessable_entity,
+        payload: {
+          error: "content_too_large",
+          message: "Content is too large. Maximum size is #{Import.max_csv_size / 1.megabyte}MB."
+        }
+      )
+    end
+
+    def invalid_csv_file_type_response
+      Response.new(
+        status: :unprocessable_entity,
+        payload: {
+          error: "invalid_file_type",
+          message: "Invalid file type. Please upload a CSV file."
+        }
+      )
+    end
+
+    def sure_file_too_large_response
+      Response.new(
+        status: :unprocessable_entity,
+        payload: {
+          error: "file_too_large",
+          message: "File is too large. Maximum size is #{SureImport.max_ndjson_size / 1.megabyte}MB."
+        }
+      )
+    end
+
+    def sure_content_too_large_response
+      Response.new(
+        status: :unprocessable_entity,
+        payload: {
+          error: "content_too_large",
+          message: "Content is too large. Maximum size is #{SureImport.max_ndjson_size / 1.megabyte}MB."
+        }
+      )
+    end
+
+    def invalid_sure_file_type_response
+      Response.new(
+        status: :unprocessable_entity,
+        payload: {
+          error: "invalid_file_type",
+          message: "Invalid file type. Please upload a Sure NDJSON file."
+        }
+      )
+    end
+
+    def raise_response(response)
+      raise PreflightError, response
+    end
+
+    def unsupported_import_type_response
+      Response.new(
+        status: :unprocessable_entity,
+        payload: {
+          error: "unsupported_import_type",
+          message: "Preflight supports CSV import types and SureImport."
+        }
+      )
+    end
+end
diff --git a/app/models/import/row.rb b/app/models/import/row.rb
index 6b68626bd..56375a593 100644
--- a/app/models/import/row.rb
+++ b/app/models/import/row.rb
@@ -8,13 +8,13 @@ class Import::Row < ApplicationRecord
   validate :required_columns
   validate :currency_is_valid
 
-  scope :ordered, -> { order(:id) }
+  scope :ordered, -> { order(:source_row_number, :id) }
 
   def tags_list
     if tags.blank?
       [ "" ]
     else
-      tags.split("|").map(&:strip)
+      split_tags(tags).map(&:strip)
     end
   end
 
@@ -37,6 +37,58 @@ class Import::Row < ApplicationRecord
   end
 
   private
+    # Supports historical comma-delimited exports and pipe-delimited templates.
+    # Backslash escapes comma, pipe, and backslash so tag names can contain either delimiter.
+    def split_tags(value)
+      split_escaped_tags(value, tag_delimiter_for(value))
+    end
+
+    def tag_delimiter_for(value)
+      return "," if unescaped_delimiter?(value, ",")
+      return "|" if unescaped_delimiter?(value, "|")
+
+      ","
+    end
+
+    def unescaped_delimiter?(value, delimiter)
+      escaping = false
+
+      value.each_char do |char|
+        if escaping
+          escaping = false
+        elsif char == "\\"
+          escaping = true
+        elsif char == delimiter
+          return true
+        end
+      end
+
+      false
+    end
+
+    def split_escaped_tags(value, delimiter)
+      tag_names = []
+      current = +""
+      escaping = false
+
+      value.each_char do |char|
+        if escaping
+          current << (char.in?([ delimiter, ",", "|", "\\" ]) ? char : "\\#{char}")
+          escaping = false
+        elsif char == "\\"
+          escaping = true
+        elsif char == delimiter
+          tag_names << current
+          current = +""
+        else
+          current << char
+        end
+      end
+
+      current << "\\" if escaping
+      tag_names << current
+    end
+
     # In the Sure system, positive quantities == "inflows"
     def apply_trade_signage_convention(value)
       value * (import.signage_convention == "inflows_positive" ? 1 : -1)
diff --git a/app/models/income_statement.rb b/app/models/income_statement.rb
index f885e3f81..6082f8e74 100644
--- a/app/models/income_statement.rb
+++ b/app/models/income_statement.rb
@@ -30,14 +30,23 @@ class IncomeStatement
   end
 
   def expense_totals(period: Period.current_month)
-    build_period_total(classification: "expense", period: period)
+    # Memoized per instance so callers that also invoke `net_category_totals`
+    @expense_totals_by_period ||= {}
+    @expense_totals_by_period[period_cache_key(period)] ||=
+      build_period_total(classification: "expense", period: period)
   end
 
   def income_totals(period: Period.current_month)
-    build_period_total(classification: "income", period: period)
+    @income_totals_by_period ||= {}
+    @income_totals_by_period[period_cache_key(period)] ||=
+      build_period_total(classification: "income", period: period)
   end
 
   def net_category_totals(period: Period.current_month)
+    @net_category_totals_by_period ||= {}
+    cached = @net_category_totals_by_period[period_cache_key(period)]
+    return cached if cached
+
     expense = expense_totals(period: period)
     income = income_totals(period: period)
 
@@ -87,7 +96,7 @@ class IncomeStatement
       CategoryTotal.new(category: r[:category], total: r[:total], currency: family.currency, weight: weight)
     end
 
-    NetCategoryTotals.new(
+    @net_category_totals_by_period[period_cache_key(period)] = NetCategoryTotals.new(
       net_expense_categories: net_expense_categories,
       net_income_categories: net_income_categories,
       total_net_expense: total_net_expense,
@@ -126,6 +135,10 @@ class IncomeStatement
       @categories ||= family.categories.all.to_a
     end
 
+    def period_cache_key(period)
+      [ period.start_date, period.end_date ]
+    end
+
     def build_period_total(classification:, period:)
       # Exclude pending transactions from budget calculations
       totals = totals_query(transactions_scope: family.transactions.visible.excluding_pending.in_period(period), date_range: period.date_range).select { |t| t.classification == classification }
diff --git a/app/models/income_statement/category_stats.rb b/app/models/income_statement/category_stats.rb
index f9757da16..4dc40af05 100644
--- a/app/models/income_statement/category_stats.rb
+++ b/app/models/income_statement/category_stats.rb
@@ -45,6 +45,10 @@ class IncomeStatement::CategoryStats
       @budget_excluded_kinds_sql ||= Transaction::BUDGET_EXCLUDED_KINDS.map { |k| "'#{k}'" }.join(", ")
     end
 
+    def pending_providers_sql
+      Transaction.pending_providers_sql("t")
+    end
+
     def exclude_tax_advantaged_sql
       ids = @family.tax_advantaged_account_ids
       return "" if ids.empty?
@@ -62,8 +66,8 @@ class IncomeStatement::CategoryStats
           SELECT
             c.id as category_id,
             date_trunc(:interval, ae.date) as period,
-            CASE WHEN t.kind = 'investment_contribution' THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END as classification,
-            SUM(CASE WHEN t.kind = 'investment_contribution' THEN ABS(ae.amount * COALESCE(er.rate, 1)) ELSE ae.amount * COALESCE(er.rate, 1) END) as total
+            CASE WHEN t.kind IN ('investment_contribution', 'loan_payment') THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END as classification,
+            SUM(CASE WHEN t.kind IN ('investment_contribution', 'loan_payment') THEN ABS(ae.amount * COALESCE(er.rate, 1)) ELSE ae.amount * COALESCE(er.rate, 1) END) as total
           FROM transactions t
           JOIN entries ae ON ae.entryable_id = t.id AND ae.entryable_type = 'Transaction'
           JOIN accounts a ON a.id = ae.account_id
@@ -76,11 +80,10 @@ class IncomeStatement::CategoryStats
           WHERE a.family_id = :family_id
             AND t.kind NOT IN (#{budget_excluded_kinds_sql})
             AND ae.excluded = false
-            AND (t.extra -> 'simplefin' ->> 'pending')::boolean IS DISTINCT FROM true
-            AND (t.extra -> 'plaid' ->> 'pending')::boolean IS DISTINCT FROM true
+            #{pending_providers_sql}
             #{exclude_tax_advantaged_sql}
             #{scope_to_account_ids_sql}
-          GROUP BY c.id, period, CASE WHEN t.kind = 'investment_contribution' THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END
+          GROUP BY c.id, period, CASE WHEN t.kind IN ('investment_contribution', 'loan_payment') THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END
         )
         SELECT
           category_id,
diff --git a/app/models/income_statement/family_stats.rb b/app/models/income_statement/family_stats.rb
index d172d4ebf..c3925025f 100644
--- a/app/models/income_statement/family_stats.rb
+++ b/app/models/income_statement/family_stats.rb
@@ -44,6 +44,10 @@ class IncomeStatement::FamilyStats
       @budget_excluded_kinds_sql ||= Transaction::BUDGET_EXCLUDED_KINDS.map { |k| "'#{k}'" }.join(", ")
     end
 
+    def pending_providers_sql
+      Transaction.pending_providers_sql("t")
+    end
+
     def exclude_tax_advantaged_sql
       ids = @family.tax_advantaged_account_ids
       return "" if ids.empty?
@@ -60,8 +64,8 @@ class IncomeStatement::FamilyStats
         WITH period_totals AS (
           SELECT
             date_trunc(:interval, ae.date) as period,
-            CASE WHEN t.kind = 'investment_contribution' THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END as classification,
-            SUM(CASE WHEN t.kind = 'investment_contribution' THEN ABS(ae.amount * COALESCE(er.rate, 1)) ELSE ae.amount * COALESCE(er.rate, 1) END) as total
+            CASE WHEN t.kind IN ('investment_contribution', 'loan_payment') THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END as classification,
+            SUM(CASE WHEN t.kind IN ('investment_contribution', 'loan_payment') THEN ABS(ae.amount * COALESCE(er.rate, 1)) ELSE ae.amount * COALESCE(er.rate, 1) END) as total
           FROM transactions t
           JOIN entries ae ON ae.entryable_id = t.id AND ae.entryable_type = 'Transaction'
           JOIN accounts a ON a.id = ae.account_id
@@ -73,11 +77,10 @@ class IncomeStatement::FamilyStats
           WHERE a.family_id = :family_id
             AND t.kind NOT IN (#{budget_excluded_kinds_sql})
             AND ae.excluded = false
-            AND (t.extra -> 'simplefin' ->> 'pending')::boolean IS DISTINCT FROM true
-            AND (t.extra -> 'plaid' ->> 'pending')::boolean IS DISTINCT FROM true
+            #{pending_providers_sql}
             #{exclude_tax_advantaged_sql}
             #{scope_to_account_ids_sql}
-          GROUP BY period, CASE WHEN t.kind = 'investment_contribution' THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END
+          GROUP BY period, CASE WHEN t.kind IN ('investment_contribution', 'loan_payment') THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END
         )
         SELECT
           classification,
diff --git a/app/models/income_statement/totals.rb b/app/models/income_statement/totals.rb
index 54fb56732..81920038f 100644
--- a/app/models/income_statement/totals.rb
+++ b/app/models/income_statement/totals.rb
@@ -60,8 +60,8 @@ class IncomeStatement::Totals
         SELECT
           c.id as category_id,
           c.parent_id as parent_category_id,
-          CASE WHEN at.kind = 'investment_contribution' THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END as classification,
-          ABS(SUM(CASE WHEN at.kind = 'investment_contribution' THEN ABS(ae.amount * COALESCE(er.rate, 1)) ELSE ae.amount * COALESCE(er.rate, 1) END)) as total,
+          CASE WHEN at.kind IN ('investment_contribution', 'loan_payment') THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END as classification,
+          ABS(SUM(CASE WHEN at.kind IN ('investment_contribution', 'loan_payment') THEN ABS(ae.amount * COALESCE(er.rate, 1)) ELSE ae.amount * COALESCE(er.rate, 1) END)) as total,
           COUNT(ae.id) as transactions_count,
           false as is_uncategorized_investment
         FROM (#{@transactions_scope.to_sql}) at
@@ -79,7 +79,7 @@ class IncomeStatement::Totals
           AND a.status IN ('draft', 'active')
           #{exclude_tax_advantaged_sql}
           #{include_finance_accounts_sql}
-        GROUP BY c.id, c.parent_id, CASE WHEN at.kind = 'investment_contribution' THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END;
+        GROUP BY c.id, c.parent_id, CASE WHEN at.kind IN ('investment_contribution', 'loan_payment') THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END;
       SQL
     end
 
@@ -88,8 +88,8 @@ class IncomeStatement::Totals
         SELECT
           c.id as category_id,
           c.parent_id as parent_category_id,
-          CASE WHEN at.kind = 'investment_contribution' THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END as classification,
-          ABS(SUM(CASE WHEN at.kind = 'investment_contribution' THEN ABS(ae.amount * COALESCE(er.rate, 1)) ELSE ae.amount * COALESCE(er.rate, 1) END)) as total,
+          CASE WHEN at.kind IN ('investment_contribution', 'loan_payment') THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END as classification,
+          ABS(SUM(CASE WHEN at.kind IN ('investment_contribution', 'loan_payment') THEN ABS(ae.amount * COALESCE(er.rate, 1)) ELSE ae.amount * COALESCE(er.rate, 1) END)) as total,
           COUNT(ae.id) as entry_count,
           false as is_uncategorized_investment
         FROM (#{@transactions_scope.to_sql}) at
@@ -111,7 +111,7 @@ class IncomeStatement::Totals
           AND a.status IN ('draft', 'active')
           #{exclude_tax_advantaged_sql}
           #{include_finance_accounts_sql}
-        GROUP BY c.id, c.parent_id, CASE WHEN at.kind = 'investment_contribution' THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END
+        GROUP BY c.id, c.parent_id, CASE WHEN at.kind IN ('investment_contribution', 'loan_payment') THEN 'expense' WHEN ae.amount < 0 THEN 'income' ELSE 'expense' END
       SQL
     end
 
diff --git a/app/models/indexa_capital_account/data_helpers.rb b/app/models/indexa_capital_account/data_helpers.rb
index b7a86b8cd..db9283788 100644
--- a/app/models/indexa_capital_account/data_helpers.rb
+++ b/app/models/indexa_capital_account/data_helpers.rb
@@ -39,6 +39,25 @@ module IndexaCapitalAccount::DataHelpers
       nil
     end
 
+    # Extract the canonical security key from an Indexa fiscal-results row.
+    # Indexa's response shape varies between endpoints (and across time), so
+    # try the nested instrument hash first, then a few flat fallbacks. Both
+    # HoldingsProcessor and Processor#calculate_holdings_value go through
+    # this helper so they can't disagree on which rows refer to the same
+    # security.
+    def extract_instrument_key(data)
+      return nil unless data.respond_to?(:[])
+
+      hash = data.respond_to?(:with_indifferent_access) ? data.with_indifferent_access : data
+      instrument = hash[:instrument]
+      if instrument.is_a?(Hash)
+        nested = instrument.with_indifferent_access
+        return nested[:identifier] || nested[:isin_code] || nested[:isin]
+      end
+
+      hash[:identifier] || hash[:isin_code] || hash[:isin] || hash[:symbol] || hash[:ticker]
+    end
+
     def parse_date(date_value)
       return nil if date_value.nil?
 
diff --git a/app/models/indexa_capital_account/holdings_processor.rb b/app/models/indexa_capital_account/holdings_processor.rb
index f39f8677b..7a63fcea2 100644
--- a/app/models/indexa_capital_account/holdings_processor.rb
+++ b/app/models/indexa_capital_account/holdings_processor.rb
@@ -13,11 +13,26 @@ class IndexaCapitalAccount::HoldingsProcessor
     holdings_data = @indexa_capital_account.raw_holdings_payload
     return if holdings_data.blank?
 
-    Rails.logger.info "IndexaCapitalAccount::HoldingsProcessor - Processing #{holdings_data.size} holdings"
+    # The importer normalises to total_fiscal_results (one aggregated row
+    # per security). Defensively dedupe in case a future variant feeds the
+    # per-tax-lot fiscal_results array through here — same key extraction
+    # as Processor#calculate_holdings_value via the shared DataHelpers
+    # method, so the two can't disagree on which rows refer to the same
+    # security.
+    per_security = {}
+    holdings_data.each do |holding_data|
+      data = holding_data.respond_to?(:with_indifferent_access) ? holding_data.with_indifferent_access : holding_data
+      key = extract_instrument_key(data)
+      next if key.blank?
 
-    holdings_data.each_with_index do |holding_data, idx|
-      Rails.logger.info "IndexaCapitalAccount::HoldingsProcessor - Processing holding #{idx + 1}/#{holdings_data.size}"
-      process_holding(holding_data.with_indifferent_access)
+      per_security[key] = data
+    end
+
+    Rails.logger.info "IndexaCapitalAccount::HoldingsProcessor - Processing #{per_security.size} holdings (from #{holdings_data.size} input rows)"
+
+    per_security.each_value.with_index do |data, idx|
+      Rails.logger.info "IndexaCapitalAccount::HoldingsProcessor - Processing holding #{idx + 1}/#{per_security.size}"
+      process_holding(data)
     rescue => e
       Rails.logger.error "IndexaCapitalAccount::HoldingsProcessor - Failed to process holding #{idx + 1}: #{e.class} - #{e.message}"
       Rails.logger.error e.backtrace.first(5).join("\n") if e.backtrace
@@ -45,7 +60,7 @@ class IndexaCapitalAccount::HoldingsProcessor
     #   profit_loss → unrealized P&L
     #   subscription_date → purchase date
     def process_holding(data)
-      ticker = extract_ticker(data)
+      ticker = extract_instrument_key(data)
       return if ticker.blank?
 
       Rails.logger.info "IndexaCapitalAccount::HoldingsProcessor - Processing holding for ticker: #{ticker}"
@@ -80,19 +95,6 @@ class IndexaCapitalAccount::HoldingsProcessor
       update_holding_cost_basis(security, cost_price) if cost_price.present?
     end
 
-    # Extract ISIN from instrument data as ticker
-    def extract_ticker(data)
-      # Indexa Capital uses ISIN codes nested under instrument
-      instrument = data[:instrument]
-      if instrument.is_a?(Hash)
-        instrument = instrument.with_indifferent_access
-        return instrument[:identifier] || instrument[:isin]
-      end
-
-      # Fallback to flat fields
-      data[:isin] || data[:identifier] || data[:symbol] || data[:ticker]
-    end
-
     # Override security name extraction for Indexa Capital
     def extract_security_name(symbol_data, fallback_ticker)
       symbol_data = symbol_data.with_indifferent_access if symbol_data.respond_to?(:with_indifferent_access)
diff --git a/app/models/indexa_capital_account/processor.rb b/app/models/indexa_capital_account/processor.rb
index b128f0557..8a5d95186 100644
--- a/app/models/indexa_capital_account/processor.rb
+++ b/app/models/indexa_capital_account/processor.rb
@@ -70,22 +70,48 @@ class IndexaCapitalAccount::Processor
     end
 
     def calculate_total_balance
-      # Calculate total from holdings + cash for accuracy
+      # Trust the API's reported balance when available — Indexa's holdings payload
+      # contains time-series snapshots (one row per security per date), so summing
+      # the raw entries double-counts. Fall back to a per-security latest-snapshot
+      # sum + cash only when the API total is missing.
+      if indexa_capital_account.current_balance.present?
+        Rails.logger.info "IndexaCapitalAccount::Processor - Using API total: #{indexa_capital_account.current_balance}"
+        return indexa_capital_account.current_balance
+      end
+
       holdings_value = calculate_holdings_value
       cash_value = indexa_capital_account.cash_balance || 0
-
       calculated_total = holdings_value + cash_value
+      Rails.logger.info "IndexaCapitalAccount::Processor - Using calculated total (API balance missing): holdings=#{holdings_value} + cash=#{cash_value} = #{calculated_total}"
+      calculated_total
+    end
 
-      # Use calculated total if we have holdings, otherwise trust API value
-      if holdings_value > 0
-        Rails.logger.info "IndexaCapitalAccount::Processor - Using calculated total: holdings=#{holdings_value} + cash=#{cash_value} = #{calculated_total}"
-        calculated_total
-      elsif indexa_capital_account.current_balance.present?
-        Rails.logger.info "IndexaCapitalAccount::Processor - Using API total: #{indexa_capital_account.current_balance}"
-        indexa_capital_account.current_balance
-      else
-        calculated_total
+    def calculate_holdings_value
+      holdings_data = indexa_capital_account.raw_holdings_payload || []
+      return 0 if holdings_data.empty?
+
+      # The importer normalises to total_fiscal_results (one aggregated row
+      # per security) so a plain sum is correct. We still defensively dedupe
+      # by instrument key in case a future provider variant feeds the
+      # per-tax-lot fiscal_results array through here — the last value wins,
+      # consistent with how HoldingsProcessor upserts holdings.
+      per_security = {}
+      holdings_data.each do |holding|
+        instrument = extract_instrument_key(holding)
+        next if instrument.blank?
+
+        data = holding.respond_to?(:with_indifferent_access) ? holding.with_indifferent_access : holding
+        amount = parse_decimal(data[:amount])
+        unless amount
+          titles = parse_decimal(data[:titles] || data[:quantity] || data[:units]) || 0
+          price = parse_decimal(data[:price]) || 0
+          amount = titles * price
+        end
+
+        per_security[instrument] = amount || 0
       end
+
+      per_security.values.sum
     end
 
     def calculate_cash_balance
@@ -95,22 +121,4 @@ class IndexaCapitalAccount::Processor
       Rails.logger.info "IndexaCapitalAccount::Processor - Cash balance from API: #{cash.inspect}"
       cash || BigDecimal("0")
     end
-
-    def calculate_holdings_value
-      holdings_data = indexa_capital_account.raw_holdings_payload || []
-      return 0 if holdings_data.empty?
-
-      holdings_data.sum do |holding|
-        data = holding.is_a?(Hash) ? holding.with_indifferent_access : {}
-        # Indexa Capital: amount = total market value, or titles * price
-        amount = parse_decimal(data[:amount])
-        if amount
-          amount
-        else
-          titles = parse_decimal(data[:titles] || data[:quantity] || data[:units]) || 0
-          price = parse_decimal(data[:price]) || 0
-          titles * price
-        end
-      end
-    end
 end
diff --git a/app/models/indexa_capital_item.rb b/app/models/indexa_capital_item.rb
index ccea401b4..53bd562a8 100644
--- a/app/models/indexa_capital_item.rb
+++ b/app/models/indexa_capital_item.rb
@@ -176,6 +176,6 @@ class IndexaCapitalItem < ApplicationRecord
     def credentials_present_on_create
       return if credentials_configured?
 
-      errors.add(:base, "Either INDEXA_API_TOKEN env var or username/document/password credentials are required")
+      errors.add(:base, :credentials_required)
     end
 end
diff --git a/app/models/indexa_capital_item/importer.rb b/app/models/indexa_capital_item/importer.rb
index 0980919b8..2b2368710 100644
--- a/app/models/indexa_capital_item/importer.rb
+++ b/app/models/indexa_capital_item/importer.rb
@@ -108,12 +108,20 @@ class IndexaCapitalItem::Importer
 
       begin
         holdings_data = indexa_capital_provider.get_holdings(account_number: account_number)
-
         stats["api_requests"] = stats.fetch("api_requests", 0) + 1
 
-        # The API returns fiscal-results which may be a hash with an array inside
         holdings_array = normalize_holdings_response(holdings_data)
 
+        # Pension plans return empty fiscal-results. Fall back to the portfolio
+        # endpoint, which exposes positions for both mutual fund and pension
+        # accounts in a uniform shape we can adapt to the same structure.
+        if holdings_array.empty?
+          Rails.logger.info "IndexaCapitalItem::Importer - fiscal-results empty for #{account_number}, falling back to /portfolio"
+          portfolio_data = indexa_capital_provider.get_portfolio(account_number: account_number)
+          stats["api_requests"] = stats.fetch("api_requests", 0) + 1
+          holdings_array = positions_from_portfolio(portfolio_data)
+        end
+
         if holdings_array.any?
           holdings_hashes = holdings_array.map { |h| sdk_object_to_hash(h) }
           indexa_capital_account.upsert_holdings_snapshot!(holdings_hashes)
@@ -125,13 +133,40 @@ class IndexaCapitalItem::Importer
       end
     end
 
-    # fiscal-results response may be an array or a hash containing an array
+    # Adapt /accounts/{id}/portfolio positions into the shape that
+    # HoldingsProcessor expects (i.e. the same field set as a
+    # total_fiscal_results row). Adds a derived cost_price (per-share cost)
+    # since portfolio rows only carry cost_amount.
+    def positions_from_portfolio(portfolio_data)
+      data = portfolio_data.is_a?(Hash) ? portfolio_data.with_indifferent_access : {}
+      Array(data[:instrument_accounts]).flat_map do |account|
+        Array(account.is_a?(Hash) ? account.with_indifferent_access[:positions] : nil).map do |pos|
+          row = (pos.is_a?(Hash) ? pos.with_indifferent_access : {}).dup
+          titles = row[:titles].to_d if row[:titles]
+          cost_amount = row[:cost_amount].to_d if row[:cost_amount]
+          if row[:cost_price].blank? && titles && titles.nonzero? && cost_amount
+            row[:cost_price] = (cost_amount / titles).to_s
+          end
+          row
+        end
+      end
+    end
+
+    # fiscal-results response may be an array or a hash containing an array.
+    # Prefer total_fiscal_results: it contains one aggregated row per security
+    # with current titles/amount/cost. fiscal_results is per tax lot and also
+    # includes historical rebalance events (e.g. virtual sells/buys that
+    # generated tax events), so summing/iterating it over-counts the position.
     def normalize_holdings_response(data)
       return data if data.is_a?(Array)
       return [] if data.nil?
 
-      # Try common response shapes
-      data[:fiscal_results] || data[:results] || data[:positions] || data[:data] || []
+      data[:total_fiscal_results].presence ||
+        data[:fiscal_results] ||
+        data[:results] ||
+        data[:positions] ||
+        data[:data] ||
+        []
     end
 
     def prune_removed_accounts(upstream_account_ids)
diff --git a/app/models/indexa_capital_item/sync_complete_event.rb b/app/models/indexa_capital_item/sync_complete_event.rb
new file mode 100644
index 000000000..103315132
--- /dev/null
+++ b/app/models/indexa_capital_item/sync_complete_event.rb
@@ -0,0 +1,22 @@
+class IndexaCapitalItem::SyncCompleteEvent
+  attr_reader :indexa_capital_item
+
+  def initialize(indexa_capital_item)
+    @indexa_capital_item = indexa_capital_item
+  end
+
+  def broadcast
+    indexa_capital_item.accounts.each do |account|
+      account.broadcast_sync_complete
+    end
+
+    indexa_capital_item.broadcast_replace_to(
+      indexa_capital_item.family,
+      target: "indexa_capital_item_#{indexa_capital_item.id}",
+      partial: "indexa_capital_items/indexa_capital_item",
+      locals: { indexa_capital_item: indexa_capital_item }
+    )
+
+    indexa_capital_item.family.broadcast_sync_complete
+  end
+end
diff --git a/app/models/investment.rb b/app/models/investment.rb
index 3d18a8334..ffb6331b3 100644
--- a/app/models/investment.rb
+++ b/app/models/investment.rb
@@ -50,14 +50,45 @@ class Investment < ApplicationRecord
     "smsf" => { short: "SMSF", long: "Self-Managed Super Fund", region: "au", tax_treatment: :tax_deferred },
 
     # === Europe ===
+    "assurance_vie" => { short: "AV", long: "Assurance Vie", region: "eu", tax_treatment: :tax_advantaged },
     "pea" => { short: "PEA", long: "Plan d'Épargne en Actions", region: "eu", tax_treatment: :tax_advantaged },
     "pillar_3a" => { short: "Pillar 3a", long: "Private Pension (Pillar 3a)", region: "eu", tax_treatment: :tax_deferred },
     "riester" => { short: "Riester", long: "Riester-Rente", region: "eu", tax_treatment: :tax_deferred },
 
+    # === India ===
+    # Pensions & insurance
+    "nps" => { short: "NPS", long: "National Pension System", region: "in", tax_treatment: :tax_advantaged },
+    "apy" => { short: "APY", long: "Atal Pension Yojana", region: "in", tax_treatment: :tax_advantaged },
+    "life_insurance" => { short: "Life Insurance", long: "Life Insurance", region: "in", tax_treatment: :tax_advantaged },
+    # Equity / market-linked
+    "indian_stocks" => { short: "Indian Stocks", long: "Indian Stocks (Demat)", region: "in", tax_treatment: :taxable },
+    "indian_equity" => { short: "Indian Equity", long: "Indian Equity", region: "in", tax_treatment: :taxable },
+    "indian_etf" => { short: "Indian ETF", long: "Indian ETF", region: "in", tax_treatment: :taxable },
+    # Fixed-income / small-savings
+    "ppf" => { short: "PPF", long: "Public Provident Fund", region: "in", tax_treatment: :tax_exempt },
+    "ssy" => { short: "SSY", long: "Sukanya Samriddhi Yojana", region: "in", tax_treatment: :tax_exempt },
+    "nsc" => { short: "NSC", long: "National Savings Certificate", region: "in", tax_treatment: :tax_advantaged },
+    "scss" => { short: "SCSS", long: "Senior Citizens' Savings Scheme", region: "in", tax_treatment: :taxable },
+    "fd" => { short: "FD", long: "Fixed Deposit", region: "in", tax_treatment: :taxable },
+    "rd" => { short: "RD", long: "Recurring Deposit", region: "in", tax_treatment: :taxable },
+    "pomis" => { short: "POMIS", long: "Post Office Monthly Income Scheme", region: "in", tax_treatment: :taxable },
+    "kvp" => { short: "KVP", long: "Kisan Vikas Patra", region: "in", tax_treatment: :taxable },
+    # Bonds
+    "g_sec" => { short: "G-Sec", long: "Government Securities (G-Secs)", region: "in", tax_treatment: :taxable },
+    "sdl" => { short: "SDL", long: "State Development Loans (SDLs)", region: "in", tax_treatment: :taxable },
+    "corporate_bond" => { short: "Corporate Bond", long: "Corporate Bond", region: "in", tax_treatment: :taxable },
+    "infrastructure_bond" => { short: "Infra Bond", long: "Infrastructure Bond", region: "in", tax_treatment: :tax_advantaged },
+    "tax_free_bond" => { short: "Tax-Free Bond", long: "Tax-Free Bond", region: "in", tax_treatment: :tax_exempt },
+    # India-specific gold instruments
+    "gold_etf" => { short: "Gold ETF", long: "Gold ETF", region: "in", tax_treatment: :taxable },
+    "gold_mf" => { short: "Gold MF", long: "Gold Mutual Fund", region: "in", tax_treatment: :taxable },
+    "sgb" => { short: "SGB", long: "Sovereign Gold Bond", region: "in", tax_treatment: :tax_advantaged },
+
     # === Generic (available everywhere) ===
     "pension" => { short: "Pension", long: "Pension", region: nil, tax_treatment: :tax_deferred },
     "retirement" => { short: "Retirement", long: "Retirement Account", region: nil, tax_treatment: :tax_deferred },
     "mutual_fund" => { short: "Mutual Fund", long: "Mutual Fund", region: nil, tax_treatment: :taxable },
+    "gold" => { short: "Gold", long: "Gold (physical or digital)", region: nil, tax_treatment: :taxable },
     "angel" => { short: "Angel", long: "Angel Investment", region: nil, tax_treatment: :taxable },
     "trust" => { short: "Trust", long: "Trust", region: nil, tax_treatment: :taxable },
     "other" => { short: "Other", long: "Other Investment", region: nil, tax_treatment: :taxable }
@@ -91,7 +122,8 @@ class Investment < ApplicationRecord
       "CAD" => "ca",
       "AUD" => "au",
       "EUR" => "eu",
-      "CHF" => "eu"
+      "CHF" => "eu",
+      "INR" => "in"
     }.freeze
 
     # Returns subtypes grouped by region for use with grouped_options_for_select
@@ -101,8 +133,12 @@ class Investment < ApplicationRecord
       grouped = SUBTYPES.group_by { |_, v| v[:region] }
 
       # Build region order: user's region first (if known), then Generic, then others
-      other_regions = %w[us uk ca au eu] - [ user_region ].compact
-      region_order = [ user_region, nil, *other_regions ].compact.uniq
+      other_regions = %w[us uk ca au eu in] - [ user_region ].compact
+      region_order = if user_region
+        [ user_region, nil, *other_regions ].uniq
+      else
+        [ nil, *other_regions ].uniq
+      end
 
       region_order.filter_map do |region|
         next unless grouped[region]
diff --git a/app/models/investment_statement.rb b/app/models/investment_statement.rb
index 4475f1fce..e4f79fee1 100644
--- a/app/models/investment_statement.rb
+++ b/app/models/investment_statement.rb
@@ -38,7 +38,7 @@ class InvestmentStatement
 
   # Total portfolio value across all investment accounts
   def portfolio_value
-    investment_accounts.sum(&:balance)
+    investment_accounts.sum { |a| convert_to_family_currency(a.balance, a.currency) }
   end
 
   def portfolio_value_money
@@ -47,7 +47,7 @@ class InvestmentStatement
 
   # Total cash in investment accounts
   def cash_balance
-    investment_accounts.sum(&:cash_balance)
+    investment_accounts.sum { |a| convert_to_family_currency(a.cash_balance, a.currency) }
   end
 
   def cash_balance_money
@@ -63,55 +63,60 @@ class InvestmentStatement
     Money.new(holdings_value, family.currency)
   end
 
-  # All current holdings across investment accounts
+  # All current holdings across investment accounts. Holdings are returned in
+  # their native currency; callers that aggregate across accounts must convert
+  # to family currency via convert_to_family_currency.
   def current_holdings
     return Holding.none unless investment_accounts.any?
 
-    account_ids = investment_accounts.pluck(:id)
-
     # Get the latest holding for each security per account
     Holding
-      .where(account_id: account_ids)
-      .where(currency: family.currency)
+      .where(account_id: investment_account_ids)
       .where.not(qty: 0)
       .where(
         id: Holding
-          .where(account_id: account_ids)
-          .where(currency: family.currency)
+          .where(account_id: investment_account_ids)
           .select("DISTINCT ON (holdings.account_id, holdings.security_id) holdings.id")
           .order(Arel.sql("holdings.account_id, holdings.security_id, holdings.date DESC"))
       )
       .includes(:security, :account)
-      .order(amount: :desc)
   end
 
-  # Top holdings by value
+  # Top holdings by family-currency value
   def top_holdings(limit: 5)
-    current_holdings.limit(limit)
+    current_holdings
+      .to_a
+      .sort_by { |h| -convert_to_family_currency(h.amount, h.currency) }
+      .first(limit)
   end
 
-  # Portfolio allocation by security type/sector (simplified for now)
+  # Portfolio allocation by security. Weights and amounts are computed in the
+  # family's currency so cross-currency holdings compare correctly.
   def allocation
-    holdings = current_holdings.to_a
-    total = holdings.sum(&:amount)
+    converted = current_holdings.to_a.map do |holding|
+      [ holding, convert_to_family_currency(holding.amount, holding.currency) ]
+    end
 
+    total = converted.sum { |_, value| value }
     return [] if total.zero?
 
-    holdings.map do |holding|
-      HoldingAllocation.new(
-        security: holding.security,
-        amount: holding.amount_money,
-        weight: (holding.amount / total * 100).round(2),
-        trend: holding.trend
-      )
-    end
+    converted
+      .sort_by { |_, value| -value }
+      .map do |holding, value|
+        HoldingAllocation.new(
+          security: holding.security,
+          amount: Money.new(value, family.currency),
+          weight: (value / total * 100).round(2),
+          trend: holding.trend
+        )
+      end
   end
 
-  # Unrealized gains across all holdings
+  # Unrealized gains across all holdings, summed in family currency
   def unrealized_gains
     current_holdings.sum do |holding|
       trend = holding.trend
-      trend ? trend.value : 0
+      trend ? convert_to_family_currency(trend.value, holding.currency) : 0
     end
   end
 
@@ -138,21 +143,12 @@ class InvestmentStatement
     holdings_with_cost_basis = holdings.select(&:avg_cost)
     return nil if holdings_with_cost_basis.empty?
 
-    current = holdings_with_cost_basis.sum(&:amount)
-    previous = holdings_with_cost_basis.sum { |h| h.qty * h.avg_cost.amount }
-
-    Trend.new(current: current, previous: previous)
-  end
-
-  # Day change across portfolio
-  def day_change
-    holdings = current_holdings.to_a
-    changes = holdings.map(&:day_change).compact
-
-    return nil if changes.empty?
-
-    current = changes.sum { |t| t.current.is_a?(Money) ? t.current.amount : t.current }
-    previous = changes.sum { |t| t.previous.is_a?(Money) ? t.previous.amount : t.previous }
+    current = holdings_with_cost_basis.sum do |h|
+      convert_to_family_currency(h.amount, h.currency)
+    end
+    previous = holdings_with_cost_basis.sum do |h|
+      convert_to_family_currency(h.qty * h.avg_cost.amount, h.currency)
+    end
 
     Trend.new(
       current: Money.new(current, family.currency),
@@ -160,6 +156,27 @@ class InvestmentStatement
     )
   end
 
+  # Day change across portfolio, summed in family currency
+  def day_change
+    changes = current_holdings.to_a.filter_map do |h|
+      t = h.day_change
+      next nil unless t
+      curr = t.current.is_a?(Money) ? t.current.amount : t.current
+      prev = t.previous.is_a?(Money) ? t.previous.amount : t.previous
+      [
+        convert_to_family_currency(curr, h.currency),
+        convert_to_family_currency(prev, h.currency)
+      ]
+    end
+
+    return nil if changes.empty?
+
+    Trend.new(
+      current: Money.new(changes.sum { |c, _| c }, family.currency),
+      previous: Money.new(changes.sum { |_, p| p }, family.currency)
+    )
+  end
+
   # Investment accounts
   def investment_accounts
     @investment_accounts ||= begin
@@ -170,6 +187,33 @@ class InvestmentStatement
   end
 
   private
+    # Today's rates for every currency present on the family's investment
+    # accounts and their holdings. Mirrors BalanceSheet::AccountTotals#exchange_rates.
+    def exchange_rates
+      @exchange_rates ||= begin
+        account_currencies = investment_accounts.map(&:currency)
+        holding_currencies = Holding.where(account_id: investment_account_ids).distinct.pluck(:currency)
+        foreign = (account_currencies + holding_currencies)
+                    .compact
+                    .uniq
+                    .reject { |c| c == family.currency }
+        ExchangeRate.rates_for(foreign, to: family.currency, date: Date.current)
+      end
+    end
+
+    # Unwrap Money first because this codebase's Money (lib/money.rb) ignores
+    # the currency arg of `Money.new` when the payload is already a Money, and
+    # `Money * numeric` preserves the source currency — so multiplying a
+    # foreign-currency Money by a rate would FX-scale the amount but keep the
+    # wrong currency label, corrupting downstream sums.
+    def convert_to_family_currency(amount, from_currency)
+      return amount if amount.nil?
+      numeric = amount.is_a?(Money) ? amount.amount : amount
+      return numeric if from_currency == family.currency
+      rate = exchange_rates[from_currency] || 1
+      numeric * rate
+    end
+
     def all_time_totals
       @all_time_totals ||= totals(period: Period.all_time)
     end
diff --git a/app/models/kraken_account.rb b/app/models/kraken_account.rb
new file mode 100644
index 000000000..e968f1e48
--- /dev/null
+++ b/app/models/kraken_account.rb
@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+class KrakenAccount < ApplicationRecord
+  include Encryptable
+
+  STABLECOINS = %w[USDT USDC DAI PYUSD USDP TUSD USDG].freeze
+  FIAT_CURRENCIES = %w[USD EUR GBP CAD AUD CHF JPY AED].freeze
+
+  if encryption_ready?
+    encrypts :raw_payload
+    encrypts :raw_transactions_payload
+  end
+
+  belongs_to :kraken_item
+
+  has_one :account_provider, as: :provider, dependent: :destroy
+  has_one :account, through: :account_provider, source: :account
+
+  validates :name, :account_id, :account_type, :currency, presence: true
+
+  def current_account
+    account
+  end
+
+  def ensure_account_provider!(target_account = nil)
+    acct = target_account || current_account
+    return nil unless acct
+
+    AccountProvider
+      .find_or_initialize_by(provider_type: "KrakenAccount", provider_id: id)
+      .tap do |ap|
+        ap.account = acct
+        ap.save!
+      end
+  rescue StandardError => e
+    Rails.logger.warn("KrakenAccount #{id}: failed to link account provider - #{e.class}: #{e.message}")
+    nil
+  end
+end
diff --git a/app/models/kraken_account/asset_normalizer.rb b/app/models/kraken_account/asset_normalizer.rb
new file mode 100644
index 000000000..7ad0a9e1c
--- /dev/null
+++ b/app/models/kraken_account/asset_normalizer.rb
@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+class KrakenAccount::AssetNormalizer
+  SUFFIX_PATTERN = /(\.[A-Z])\z/
+  FIAT_PREFIXES = {
+    "ZUSD" => "USD",
+    "ZEUR" => "EUR",
+    "ZGBP" => "GBP",
+    "ZCAD" => "CAD",
+    "ZAUD" => "AUD",
+    "ZCHF" => "CHF",
+    "ZJPY" => "JPY"
+  }.freeze
+  SYMBOL_FALLBACKS = {
+    "XBT" => "BTC",
+    "XXBT" => "BTC",
+    "XETH" => "ETH",
+    "ZUSD" => "USD"
+  }.freeze
+
+  def initialize(asset_metadata = {})
+    @asset_metadata = asset_metadata || {}
+  end
+
+  def normalize(raw_asset)
+    raw = raw_asset.to_s.upcase
+    suffix = raw[SUFFIX_PATTERN, 1]
+    raw_base = suffix ? raw.delete_suffix(suffix) : raw
+
+    metadata = metadata_for(raw, raw_base)
+    base_symbol = metadata_symbol(metadata, raw_base)
+    normalized_base = normalize_base_symbol(base_symbol)
+    symbol = suffix.present? ? "#{normalized_base}#{suffix}" : normalized_base
+
+    {
+      raw_asset: raw,
+      raw_base: raw_base,
+      symbol: symbol,
+      price_symbol: normalized_base,
+      suffix: suffix,
+      metadata: metadata
+    }
+  end
+
+  private
+
+    attr_reader :asset_metadata
+
+    def metadata_for(raw, raw_base)
+      asset_metadata[raw] || asset_metadata[raw_base] || asset_metadata.values.find do |metadata|
+        candidate = metadata_symbol(metadata, raw_base)
+        [ raw, raw_base ].include?(candidate.to_s.upcase)
+      end
+    end
+
+    def metadata_symbol(metadata, fallback)
+      return fallback unless metadata.is_a?(Hash)
+
+      metadata["altname"].presence || metadata["display_name"].presence || fallback
+    end
+
+    def normalize_base_symbol(symbol)
+      value = symbol.to_s.upcase
+      value = FIAT_PREFIXES[value] if FIAT_PREFIXES.key?(value)
+      SYMBOL_FALLBACKS[value] || value
+    end
+end
diff --git a/app/models/kraken_account/holdings_processor.rb b/app/models/kraken_account/holdings_processor.rb
new file mode 100644
index 000000000..d0a589ca4
--- /dev/null
+++ b/app/models/kraken_account/holdings_processor.rb
@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+class KrakenAccount::HoldingsProcessor
+  include KrakenAccount::UsdConverter
+
+  def initialize(kraken_account)
+    @kraken_account = kraken_account
+  end
+
+  def process
+    return unless account&.accountable_type == "Crypto"
+
+    raw_assets.each { |asset| process_asset(asset) }
+  rescue StandardError => e
+    Rails.logger.error "KrakenAccount::HoldingsProcessor - error: #{e.message}"
+    nil
+  end
+
+  private
+
+    attr_reader :kraken_account
+
+    def target_currency
+      kraken_account.kraken_item&.family&.currency
+    end
+
+    def account
+      kraken_account.current_account
+    end
+
+    def raw_assets
+      kraken_account.raw_payload&.dig("assets") || []
+    end
+
+    def process_asset(asset)
+      symbol = asset["symbol"] || asset[:symbol]
+      price_symbol = asset["price_symbol"] || asset[:price_symbol] || symbol
+      total = (asset["balance"] || asset[:balance] || 0).to_d
+      price_usd = asset["price_usd"] || asset[:price_usd]
+      source = asset["source"] || asset[:source] || "spot"
+
+      return if symbol.blank? || total.zero? || price_usd.blank?
+
+      security = resolve_security(symbol)
+      return unless security
+
+      amount_usd = total * price_usd.to_d
+      amount, amount_stale, amount_rate_date = convert_from_usd(amount_usd, date: Date.current)
+      price, price_stale, price_rate_date = convert_from_usd(price_usd.to_d, date: Date.current)
+      log_stale_rate(symbol, "amount", amount_rate_date) if amount_stale
+      log_stale_rate(symbol, "price", price_rate_date) if price_stale
+
+      import_adapter.import_holding(
+        security: security,
+        quantity: total,
+        amount: amount,
+        currency: target_currency,
+        date: Date.current,
+        price: price,
+        cost_basis: nil,
+        external_id: "kraken_#{symbol}_#{source}_#{Date.current}",
+        account_provider_id: kraken_account.account_provider&.id,
+        source: "kraken",
+        delete_future_holdings: false
+      )
+    rescue StandardError => e
+      Rails.logger.error "KrakenAccount::HoldingsProcessor - failed asset symbol=#{symbol.presence || "unknown"}: #{e.message}"
+    end
+
+    def import_adapter
+      @import_adapter ||= Account::ProviderImportAdapter.new(account)
+    end
+
+    def resolve_security(symbol)
+      ticker = symbol.to_s.include?(":") ? symbol.to_s : "CRYPTO:#{symbol}"
+      KrakenAccount::SecurityResolver.resolve(ticker, symbol)
+    end
+
+    def log_stale_rate(symbol, field, rate_date)
+      Rails.logger.warn(
+        "KrakenAccount::HoldingsProcessor - stale FX rate for #{field} symbol=#{symbol} rate_date=#{rate_date || "unknown"}"
+      )
+    end
+end
diff --git a/app/models/kraken_account/processor.rb b/app/models/kraken_account/processor.rb
new file mode 100644
index 000000000..483ac1f1e
--- /dev/null
+++ b/app/models/kraken_account/processor.rb
@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+class KrakenAccount::Processor
+  include KrakenAccount::UsdConverter
+
+  attr_reader :kraken_account
+
+  def initialize(kraken_account)
+    @kraken_account = kraken_account
+  end
+
+  def process
+    return unless kraken_account.current_account.present?
+
+    KrakenAccount::HoldingsProcessor.new(kraken_account).process
+    process_account!
+    process_trades
+  end
+
+  private
+
+    def target_currency
+      kraken_account.kraken_item&.family&.currency
+    end
+
+    def process_account!
+      account = kraken_account.current_account
+      amount, stale, rate_date = convert_from_usd((kraken_account.current_balance || 0).to_d, date: Date.current)
+
+      account.update!(
+        balance: amount,
+        cash_balance: 0,
+        currency: target_currency
+      )
+
+      kraken_account.update!(extra: kraken_account.extra.to_h.deep_merge(build_stale_extra(stale, rate_date, Date.current)))
+    end
+
+    def process_trades
+      raw_trades.each do |txid, trade|
+        process_trade(txid, trade)
+      end
+    rescue StandardError => e
+      Rails.logger.error "KrakenAccount::Processor - trade processing failed: #{e.message}"
+    end
+
+    def raw_trades
+      kraken_account.raw_transactions_payload&.dig("trades") || {}
+    end
+
+    def process_trade(txid, trade)
+      account = kraken_account.current_account
+      return unless account
+
+      external_id = "kraken_trade_#{txid}"
+      return if account.entries.exists?(external_id: external_id, source: "kraken")
+
+      type = trade["type"].to_s.downcase
+      return unless %w[buy sell].include?(type)
+
+      pair = trade["pair"].to_s
+      base_symbol, quote_symbol = infer_pair_symbols(pair, trade)
+      return if base_symbol.blank?
+
+      qty = trade["vol"].to_d
+      return if qty.zero?
+
+      price = trade["price"].to_d
+      cost = trade["cost"].presence&.to_d
+      cost ||= (qty * price).round(8)
+      fee = trade["fee"].presence&.to_d || 0
+      currency = quote_symbol.presence || "USD"
+      date = Time.zone.at(trade["time"].to_d).to_date
+      security = KrakenAccount::SecurityResolver.resolve("CRYPTO:#{base_symbol}", base_symbol)
+      return unless security
+
+      entry_amount = type == "buy" ? -cost : cost
+      trade_qty = type == "buy" ? qty : -qty
+      label = type == "buy" ? "Buy" : "Sell"
+
+      account.entries.create!(
+        date: date,
+        name: "#{label} #{qty.round(8)} #{base_symbol}",
+        amount: entry_amount,
+        currency: currency,
+        external_id: external_id,
+        source: "kraken",
+        notes: trade["ordertxid"].presence,
+        entryable: Trade.new(
+          security: security,
+          qty: trade_qty,
+          price: price,
+          currency: currency,
+          fee: fee,
+          investment_activity_label: label
+        )
+      )
+    rescue StandardError => e
+      Rails.logger.error "KrakenAccount::Processor - failed to process trade #{txid}: #{e.message}"
+    end
+
+    def infer_pair_symbols(pair, trade)
+      pair_metadata = kraken_account.raw_payload&.dig("pair_metadata") || {}
+      metadata = pair_metadata[pair] || pair_metadata.values.find { |candidate| candidate["altname"].to_s == pair }
+      normalizer = KrakenAccount::AssetNormalizer.new(kraken_account.raw_payload&.dig("asset_metadata") || {})
+
+      if metadata
+        base = normalizer.normalize(metadata["base"])[:symbol]
+        quote = normalizer.normalize(metadata["quote"])[:symbol]
+        return [ base, quote ]
+      end
+
+      altname = trade["pair"].to_s
+      %w[USDT USDC USD EUR GBP BTC ETH].each do |quote|
+        next unless altname.end_with?(quote)
+
+        return [ normalizer.normalize(altname.delete_suffix(quote))[:symbol], quote ]
+      end
+
+      [ altname, "USD" ]
+    end
+end
diff --git a/app/models/kraken_account/security_resolver.rb b/app/models/kraken_account/security_resolver.rb
new file mode 100644
index 000000000..036f9f986
--- /dev/null
+++ b/app/models/kraken_account/security_resolver.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class KrakenAccount::SecurityResolver
+  EXCHANGE_MIC = "XKRA"
+
+  def self.resolve(ticker, symbol)
+    Security::Resolver.new(ticker).resolve
+  rescue StandardError => e
+    Rails.logger.warn "KrakenAccount::SecurityResolver - resolver failed for #{ticker}: #{e.message}"
+    Security.find_or_initialize_by(ticker: ticker, exchange_operating_mic: EXCHANGE_MIC).tap do |security|
+      security.name = symbol if security.name.blank?
+      security.offline = true unless security.offline
+      security.save! if security.changed?
+    end
+  end
+end
diff --git a/app/models/kraken_account/usd_converter.rb b/app/models/kraken_account/usd_converter.rb
new file mode 100644
index 000000000..054c587f0
--- /dev/null
+++ b/app/models/kraken_account/usd_converter.rb
@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module KrakenAccount::UsdConverter
+  private
+
+    def convert_from_usd(amount, date: Date.current)
+      return [ amount.to_d, false, nil ] if target_currency == "USD"
+
+      rate = ExchangeRate.find_or_fetch_rate(from: "USD", to: target_currency, date: date)
+      return [ amount.to_d, true, nil ] if rate.nil?
+
+      converted = Money.new(amount, "USD").exchange_to(target_currency, custom_rate: rate.rate).amount
+      stale = rate.date != date
+      rate_date = stale ? rate.date : nil
+
+      [ converted, stale, rate_date ]
+    end
+
+    def build_stale_extra(stale, rate_date, target_date)
+      kraken_meta = if stale
+        {
+          "stale_rate" => true,
+          "rate_date_used" => rate_date&.to_s,
+          "rate_target_date" => target_date&.to_s
+        }
+      else
+        { "stale_rate" => false }
+      end
+
+      { "kraken" => kraken_meta }
+    end
+end
diff --git a/app/models/kraken_item.rb b/app/models/kraken_item.rb
new file mode 100644
index 000000000..2c47d5f8b
--- /dev/null
+++ b/app/models/kraken_item.rb
@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+class KrakenItem < ApplicationRecord
+  include Syncable, Provided, Unlinking, Encryptable
+
+  enum :status, { good: "good", requires_update: "requires_update" }, default: :good
+
+  if encryption_ready?
+    encrypts :api_key, deterministic: true
+    encrypts :api_secret
+    encrypts :raw_payload
+  end
+
+  validates :name, presence: true
+  validates :api_key, presence: true
+  validates :api_secret, presence: true
+
+  belongs_to :family
+  has_one_attached :logo, dependent: :purge_later
+
+  has_many :kraken_accounts, dependent: :destroy
+  has_many :accounts, through: :kraken_accounts
+
+  scope :active, -> { where(scheduled_for_deletion: false) }
+  scope :syncable, -> { active }
+  scope :ordered, -> { order(created_at: :desc) }
+  scope :needs_update, -> { where(status: :requires_update) }
+  scope :credentials_configured, -> { where.not(api_key: [ nil, "" ]).where.not(api_secret: nil) }
+
+  before_validation :strip_credentials
+
+  def destroy_later
+    update!(scheduled_for_deletion: true)
+    DestroyJob.perform_later(self)
+  end
+
+  def import_latest_kraken_data
+    provider = kraken_provider
+    raise StandardError, "Kraken credentials not configured" unless provider
+
+    KrakenItem::Importer.new(self, kraken_provider: provider).import
+  rescue StandardError => e
+    Rails.logger.error "KrakenItem #{id} - Failed to import: #{e.full_message}"
+    raise
+  end
+
+  def process_accounts
+    return [] if kraken_accounts.empty?
+
+    results = []
+    kraken_accounts.joins(:account).merge(Account.visible).each do |kraken_account|
+      begin
+        result = KrakenAccount::Processor.new(kraken_account).process
+        results << { kraken_account_id: kraken_account.id, success: true, result: result }
+      rescue StandardError => e
+        Rails.logger.error "KrakenItem #{id} - Failed to process account #{kraken_account.id}: #{e.full_message}"
+        results << { kraken_account_id: kraken_account.id, success: false, error: e.message }
+      end
+    end
+
+    results
+  end
+
+  def schedule_account_syncs(parent_sync: nil, window_start_date: nil, window_end_date: nil)
+    return [] if accounts.empty?
+
+    accounts.visible.map do |account|
+      account.sync_later(
+        parent_sync: parent_sync,
+        window_start_date: window_start_date,
+        window_end_date: window_end_date
+      )
+      { account_id: account.id, success: true }
+    rescue StandardError => e
+      Rails.logger.error "KrakenItem #{id} - Failed to schedule sync for account #{account.id}: #{e.full_message}"
+      { account_id: account.id, success: false, error: e.message }
+    end
+  end
+
+  def upsert_kraken_snapshot!(payload)
+    update!(raw_payload: payload)
+  end
+
+  def has_completed_initial_setup?
+    accounts.any?
+  end
+
+  def sync_status_summary
+    total = total_accounts_count
+    linked = linked_accounts_count
+    unlinked = unlinked_accounts_count
+
+    if total.zero?
+      I18n.t("kraken_items.kraken_item.sync_status.no_accounts")
+    elsif unlinked.zero?
+      I18n.t("kraken_items.kraken_item.sync_status.all_synced", count: linked)
+    else
+      I18n.t("kraken_items.kraken_item.sync_status.partial_sync", linked_count: linked, unlinked_count: unlinked)
+    end
+  end
+
+  def linked_accounts_count
+    kraken_accounts.joins(:account_provider).count
+  end
+
+  def unlinked_accounts_count
+    kraken_accounts.left_joins(:account_provider).where(account_providers: { id: nil }).count
+  end
+
+  def total_accounts_count
+    kraken_accounts.count
+  end
+
+  def stale_rate_accounts
+    kraken_accounts
+      .joins(:account)
+      .where(accounts: { status: "active" })
+      .where("kraken_accounts.extra -> 'kraken' ->> 'stale_rate' = 'true'")
+  end
+
+  def institution_display_name
+    institution_name.presence || institution_domain.presence || name
+  end
+
+  def credentials_configured?
+    api_key.to_s.strip.present? && api_secret.to_s.strip.present?
+  end
+
+  def next_nonce!
+    with_lock do
+      candidate = Process.clock_gettime(Process::CLOCK_REALTIME, :nanosecond)
+      candidate = last_nonce.to_i + 1 if candidate <= last_nonce.to_i
+      update!(last_nonce: candidate)
+      candidate.to_s
+    end
+  end
+
+  def set_kraken_institution_defaults!
+    update!(
+      institution_name: "Kraken",
+      institution_domain: "kraken.com",
+      institution_url: "https://www.kraken.com",
+      institution_color: "#5841D8"
+    )
+  end
+
+  private
+
+    def strip_credentials
+      self.api_key = api_key.to_s.strip if api_key_changed? && !api_key.nil?
+      self.api_secret = api_secret.to_s.strip if api_secret_changed? && !api_secret.nil?
+    end
+end
diff --git a/app/models/kraken_item/importer.rb b/app/models/kraken_item/importer.rb
new file mode 100644
index 000000000..38944fe0f
--- /dev/null
+++ b/app/models/kraken_item/importer.rb
@@ -0,0 +1,187 @@
+# frozen_string_literal: true
+
+class KrakenItem::Importer
+  MAX_TRADE_PAGES = 200
+  TRADE_PAGE_SIZE = 50
+
+  attr_reader :kraken_item, :kraken_provider
+
+  def initialize(kraken_item, kraken_provider:)
+    @kraken_item = kraken_item
+    @kraken_provider = kraken_provider
+  end
+
+  def import
+    api_key_info = kraken_provider.get_api_key_info
+
+    asset_metadata = kraken_provider.get_asset_info || {}
+    pair_metadata = kraken_provider.get_asset_pairs || {}
+    balances = kraken_provider.get_extended_balance || {}
+    assets = parse_assets(balances, asset_metadata)
+    trades = fetch_trades
+
+    total_usd = assets.sum { |asset| asset[:amount_usd].to_d }.round(2)
+    kraken_account = upsert_kraken_account(
+      assets: assets,
+      balances: balances,
+      trades: trades,
+      asset_metadata: asset_metadata,
+      pair_metadata: pair_metadata,
+      api_key_info: api_key_info,
+      total_usd: total_usd
+    )
+
+    kraken_item.upsert_kraken_snapshot!({
+      "api_key_info" => api_key_info,
+      "balances" => balances,
+      "asset_metadata" => asset_metadata,
+      "pair_metadata" => pair_metadata,
+      "imported_at" => Time.current.iso8601
+    })
+
+    { success: true, account_id: kraken_account.id, assets_imported: assets.size, trades_imported: trades.size, total_usd: total_usd }
+  rescue Provider::Kraken::PermissionError => e
+    kraken_item.update!(status: :requires_update)
+    raise e
+  end
+
+  private
+    def parse_assets(balances, asset_metadata)
+      normalizer = KrakenAccount::AssetNormalizer.new(asset_metadata)
+
+      balances.filter_map do |raw_asset, balance_data|
+        parsed = normalizer.normalize(raw_asset)
+        balance = balance_data.fetch("balance", "0").to_d
+        credit = balance_data.fetch("credit", "0").to_d
+        credit_used = balance_data.fetch("credit_used", "0").to_d
+        hold_trade = balance_data.fetch("hold_trade", "0").to_d
+        available = balance + credit - credit_used - hold_trade
+
+        next if balance.zero? && hold_trade.zero?
+
+        price_usd, price_status = price_for(parsed[:price_symbol])
+        amount_usd = price_usd ? (balance * price_usd).round(2) : 0.to_d
+
+        parsed.merge(
+          balance: balance.to_s("F"),
+          available: available.to_s("F"),
+          hold_trade: hold_trade.to_s("F"),
+          price_usd: price_usd&.to_s("F"),
+          amount_usd: amount_usd.to_s("F"),
+          price_status: price_status,
+          source: "spot"
+        )
+      end
+    end
+
+    def price_for(symbol)
+      return [ 1.to_d, "exact" ] if symbol == "USD" || KrakenAccount::STABLECOINS.include?(symbol)
+
+      if KrakenAccount::FIAT_CURRENCIES.include?(symbol)
+        rate = ExchangeRate.find_or_fetch_rate(from: symbol, to: "USD", date: Date.current)
+        return [ rate.rate.to_d, rate.date == Date.current ? "exact" : "stale" ] if rate
+
+        return [ nil, "missing" ]
+      end
+
+      ticker_price = ticker_price_for(symbol)
+      return [ ticker_price, "exact" ] if ticker_price
+
+      [ nil, "missing" ]
+    rescue StandardError => e
+      Rails.logger.warn "KrakenItem::Importer - could not price #{symbol}: #{e.message}"
+      [ nil, "missing" ]
+    end
+
+    def ticker_price_for(symbol)
+      pair_candidates_for(symbol).each do |pair|
+        response = kraken_provider.get_ticker(pair)
+        ticker_payload = response&.values&.first
+        price = ticker_payload&.dig("c", 0)
+        return price.to_d if price.present?
+      rescue Provider::Kraken::ApiError
+        next
+      end
+
+      nil
+    end
+
+    def pair_candidates_for(symbol)
+      kraken_symbol = symbol == "BTC" ? "XBT" : symbol
+      [
+        "#{kraken_symbol}USD",
+        "#{symbol}USD",
+        "X#{kraken_symbol}ZUSD",
+        "#{kraken_symbol}USDT",
+        "#{symbol}USDT"
+      ].uniq
+    end
+
+    def fetch_trades
+      start_time = kraken_item.sync_start_date&.to_i
+      offset = 0
+      all_trades = {}
+
+      MAX_TRADE_PAGES.times do
+        result = kraken_provider.get_trades_history(start: start_time, offset: offset)
+        trades = result.to_h.fetch("trades", {})
+        duplicate_trade_ids = all_trades.keys & trades.keys
+        if duplicate_trade_ids.any?
+          Rails.logger.warn("KrakenItem::Importer - #{duplicate_trade_ids.size} duplicate trade ids from Kraken page ignored")
+        end
+        all_trades.merge!(trades.except(*duplicate_trade_ids))
+
+        count = result.to_h["count"].to_i
+        break if trades.size < TRADE_PAGE_SIZE
+
+        offset += trades.size
+        break if count.positive? && offset >= count
+      end
+
+      all_trades
+    end
+
+    def upsert_kraken_account(assets:, balances:, trades:, asset_metadata:, pair_metadata:, api_key_info:, total_usd:)
+      kraken_item.kraken_accounts.find_or_initialize_by(account_id: "combined").tap do |account|
+        account.assign_attributes(
+          name: kraken_item.institution_name.presence || "Kraken",
+          account_type: "combined",
+          currency: "USD",
+          current_balance: total_usd,
+          institution_metadata: institution_metadata(assets),
+          raw_payload: {
+            "balances" => balances,
+            "assets" => assets.map(&:stringify_keys),
+            "asset_metadata" => asset_metadata,
+            "pair_metadata" => pair_metadata,
+            "api_key_info" => api_key_info,
+            "fetched_at" => Time.current.iso8601
+          },
+          raw_transactions_payload: {
+            "trades" => trades,
+            "fetched_at" => Time.current.iso8601
+          },
+          extra: account.extra.to_h.deep_merge(price_metadata(assets))
+        )
+        account.save!
+      end
+    end
+
+    def institution_metadata(assets)
+      {
+        "name" => "Kraken",
+        "domain" => "kraken.com",
+        "url" => "https://www.kraken.com",
+        "color" => "#5841D8",
+        "asset_count" => assets.size,
+        "assets" => assets.map { |asset| asset[:symbol] }
+      }
+    end
+
+    def price_metadata(assets)
+      missing = assets.select { |asset| asset[:price_status] == "missing" }.map { |asset| asset[:symbol] }
+      stale = assets.select { |asset| asset[:price_status] == "stale" }.map { |asset| asset[:symbol] }
+
+      { "kraken" => { "missing_prices" => missing, "stale_prices" => stale } }
+    end
+end
diff --git a/app/models/kraken_item/provided.rb b/app/models/kraken_item/provided.rb
new file mode 100644
index 000000000..830a6fd11
--- /dev/null
+++ b/app/models/kraken_item/provided.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module KrakenItem::Provided
+  extend ActiveSupport::Concern
+
+  def kraken_provider
+    return nil unless credentials_configured?
+
+    Provider::Kraken.new(
+      api_key: api_key.to_s.strip,
+      api_secret: api_secret.to_s.strip,
+      nonce_generator: -> { next_nonce! }
+    )
+  end
+end
diff --git a/app/models/kraken_item/sync_complete_event.rb b/app/models/kraken_item/sync_complete_event.rb
new file mode 100644
index 000000000..a2b07d69e
--- /dev/null
+++ b/app/models/kraken_item/sync_complete_event.rb
@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+class KrakenItem::SyncCompleteEvent
+  def initialize(kraken_item)
+    raise ArgumentError, "kraken_item is required" unless kraken_item.respond_to?(:family) && kraken_item.respond_to?(:id)
+
+    @kraken_item = kraken_item
+  end
+
+  def broadcast
+    Turbo::StreamsChannel.broadcast_replace_to(
+      @kraken_item.family,
+      target: ActionView::RecordIdentifier.dom_id(@kraken_item),
+      partial: "kraken_items/kraken_item",
+      locals: { kraken_item: @kraken_item }
+    )
+  rescue StandardError => e
+    Rails.logger.warn("KrakenItem::SyncCompleteEvent failed for #{@kraken_item.id}: #{e.class}")
+  end
+end
diff --git a/app/models/kraken_item/syncer.rb b/app/models/kraken_item/syncer.rb
new file mode 100644
index 000000000..80b066d36
--- /dev/null
+++ b/app/models/kraken_item/syncer.rb
@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+class KrakenItem::Syncer
+  include SyncStats::Collector
+
+  attr_reader :kraken_item
+
+  def initialize(kraken_item)
+    @kraken_item = kraken_item
+  end
+
+  def perform_sync(sync)
+    sync.update!(status_text: I18n.t("kraken_item.syncer.checking_credentials")) if sync.respond_to?(:status_text)
+    unless kraken_item.credentials_configured?
+      kraken_item.update!(status: :requires_update)
+      mark_failed(sync, I18n.t("kraken_item.syncer.credentials_invalid"))
+      return
+    end
+
+    sync.update!(status_text: I18n.t("kraken_item.syncer.importing_accounts")) if sync.respond_to?(:status_text)
+    kraken_item.import_latest_kraken_data
+    kraken_item.update!(status: :good) if kraken_item.requires_update?
+
+    sync.update!(status_text: I18n.t("kraken_item.syncer.checking_configuration")) if sync.respond_to?(:status_text)
+    collect_setup_stats(sync, provider_accounts: kraken_item.kraken_accounts.to_a)
+
+    unlinked = kraken_item.kraken_accounts.left_joins(:account_provider).where(account_providers: { id: nil })
+    linked = kraken_item.kraken_accounts.joins(:account_provider).joins(:account).merge(Account.visible)
+
+    if unlinked.any?
+      kraken_item.update!(pending_account_setup: true)
+      sync.update!(status_text: I18n.t("kraken_item.syncer.accounts_need_setup", count: unlinked.count)) if sync.respond_to?(:status_text)
+    else
+      kraken_item.update!(pending_account_setup: false)
+    end
+
+    return unless linked.any?
+
+    sync.update!(status_text: I18n.t("kraken_item.syncer.processing_accounts")) if sync.respond_to?(:status_text)
+    kraken_item.process_accounts
+
+    sync.update!(status_text: I18n.t("kraken_item.syncer.calculating_balances")) if sync.respond_to?(:status_text)
+    kraken_item.schedule_account_syncs(
+      parent_sync: sync,
+      window_start_date: sync.window_start_date,
+      window_end_date: sync.window_end_date
+    )
+
+    account_ids = linked.map { |kraken_account| kraken_account.current_account&.id }.compact
+    if account_ids.any?
+      collect_transaction_stats(sync, account_ids: account_ids, source: "kraken")
+      collect_trades_stats(sync, account_ids: account_ids, source: "kraken")
+    end
+  rescue Provider::Kraken::AuthenticationError, Provider::Kraken::PermissionError, Provider::Kraken::OTPRequiredError => e
+    kraken_item.update!(status: :requires_update)
+    mark_failed(sync, e.message)
+    raise
+  rescue StandardError => e
+    Rails.logger.error "KrakenItem::Syncer - unexpected error during sync: #{e.message}\n#{e.backtrace&.first(5)&.join("\n")}"
+    mark_failed(sync, e.message)
+    raise
+  end
+
+  def perform_post_sync
+  end
+
+  private
+
+    def mark_failed(sync, error_message)
+      sync.start! if sync.respond_to?(:may_start?) && sync.may_start?
+
+      if sync.respond_to?(:may_fail?) && sync.may_fail?
+        sync.fail!
+      elsif sync.respond_to?(:status)
+        sync.update!(status: :failed)
+      end
+
+      sync.update!(error: error_message) if sync.respond_to?(:error)
+      sync.update!(status_text: error_message) if sync.respond_to?(:status_text)
+    end
+end
diff --git a/app/models/kraken_item/unlinking.rb b/app/models/kraken_item/unlinking.rb
new file mode 100644
index 000000000..d3ef80bb7
--- /dev/null
+++ b/app/models/kraken_item/unlinking.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module KrakenItem::Unlinking
+  extend ActiveSupport::Concern
+
+  def unlink_all!(dry_run: false)
+    results = []
+    links_by_provider_id = AccountProvider
+      .where(provider_type: KrakenAccount.name, provider_id: kraken_accounts.select(:id))
+      .group_by { |link| link.provider_id.to_s }
+
+    kraken_accounts.find_each do |provider_account|
+      links = links_by_provider_id[provider_account.id.to_s] || []
+      link_ids = links.map(&:id)
+      result = {
+        provider_account_id: provider_account.id,
+        name: provider_account.name,
+        provider_link_ids: link_ids
+      }
+      results << result
+
+      next if dry_run
+
+      begin
+        ActiveRecord::Base.transaction do
+          Holding.where(account_provider_id: link_ids).update_all(account_provider_id: nil) if link_ids.any?
+          links.each(&:destroy!)
+        end
+      rescue StandardError => e
+        Rails.logger.warn("KrakenItem Unlinker: failed to unlink ##{provider_account.id}: #{e.class} - #{e.message}")
+        result[:error] = e.message
+      end
+    end
+
+    results
+  end
+end
diff --git a/app/models/loan.rb b/app/models/loan.rb
index ec56d65b8..980c19885 100644
--- a/app/models/loan.rb
+++ b/app/models/loan.rb
@@ -8,6 +8,8 @@ class Loan < ApplicationRecord
     "other" => { short: "Other Loan", long: "Other Loan" }
   }.freeze
 
+  validates :subtype, inclusion: { in: SUBTYPES.keys }, allow_blank: true
+
   def monthly_payment
     return nil if term_months.nil? || interest_rate.nil? || rate_type.nil? || rate_type != "fixed"
     return Money.new(0, account.currency) if account.loan.original_balance.amount.zero? || term_months.zero?
diff --git a/app/models/lunchflow_item.rb b/app/models/lunchflow_item.rb
index ba9830c6b..94cf078e7 100644
--- a/app/models/lunchflow_item.rb
+++ b/app/models/lunchflow_item.rb
@@ -1,6 +1,8 @@
 class LunchflowItem < ApplicationRecord
   include Syncable, Provided, Unlinking, Encryptable
 
+  DEFAULT_BASE_URL = "https://lunchflow.app/api/v1".freeze
+
   enum :status, { good: "good", requires_update: "requires_update" }, default: :good
 
   # Encrypt sensitive credentials and raw payloads if ActiveRecord encryption is configured
@@ -154,6 +156,17 @@ class LunchflowItem < ApplicationRecord
   end
 
   def effective_base_url
-    base_url.presence || "https://lunchflow.app/api/v1"
+    return DEFAULT_BASE_URL if base_url.blank?
+
+    uri = URI.parse(base_url)
+    return DEFAULT_BASE_URL unless uri.is_a?(URI::HTTPS)
+    return DEFAULT_BASE_URL unless uri.host == "lunchflow.app"
+    return DEFAULT_BASE_URL unless [ "", "/", "/api/v1", "/api/v1/" ].include?(uri.path)
+    return DEFAULT_BASE_URL unless uri.query.blank?
+    return DEFAULT_BASE_URL unless uri.fragment.blank?
+
+    DEFAULT_BASE_URL
+  rescue URI::InvalidURIError
+    DEFAULT_BASE_URL
   end
 end
diff --git a/app/models/market_data_importer.rb b/app/models/market_data_importer.rb
index d1ac7d7d7..d590859fe 100644
--- a/app/models/market_data_importer.rb
+++ b/app/models/market_data_importer.rb
@@ -17,7 +17,7 @@ class MarketDataImporter
 
   # Syncs historical security prices (and details)
   def import_security_prices
-    unless Security.provider
+    unless Security.providers.any?
       Rails.logger.warn("No provider configured for MarketDataImporter.import_security_prices, skipping sync")
       return
     end
@@ -76,9 +76,6 @@ class MarketDataImporter
            .each do |(source, target), date|
         key = [ source, target ]
         pair_dates[key] = [ pair_dates[key], date ].compact.min
-
-        inverse_key = [ target, source ]
-        pair_dates[inverse_key] = [ pair_dates[inverse_key], date ].compact.min
       end
 
       # 2. ACCOUNT-BASED PAIRS – use the account's oldest entry date
@@ -94,9 +91,6 @@ class MarketDataImporter
 
         key = [ account.source, account.target ]
         pair_dates[key] = [ pair_dates[key], chosen_date ].compact.min
-
-        inverse_key = [ account.target, account.source ]
-        pair_dates[inverse_key] = [ pair_dates[inverse_key], chosen_date ].compact.min
       end
 
       # Convert to array of hashes for ease of use
diff --git a/app/models/mercury_item.rb b/app/models/mercury_item.rb
index eb062b2b9..5869156fb 100644
--- a/app/models/mercury_item.rb
+++ b/app/models/mercury_item.rb
@@ -168,7 +168,7 @@ class MercuryItem < ApplicationRecord
   end
 
   def credentials_configured?
-    token.present?
+    token.to_s.strip.present?
   end
 
   def effective_base_url
diff --git a/app/models/message.rb b/app/models/message.rb
index 4bf5e9c00..736ac8785 100644
--- a/app/models/message.rb
+++ b/app/models/message.rb
@@ -8,9 +8,9 @@ class Message < ApplicationRecord
     failed: "failed"
   }
 
-  validates :content, presence: true
+  validates :content, presence: true, unless: :pending?
 
-  after_create_commit -> { broadcast_append_to chat, target: "messages" }, if: :broadcast?
+  after_create_commit -> { broadcast_append_to chat, target: chat.messages_target }, if: :broadcast?
   after_update_commit -> { broadcast_update_to chat }, if: :broadcast?
 
   scope :ordered, -> { order(created_at: :asc) }
diff --git a/app/models/mint_import.rb b/app/models/mint_import.rb
index 932353d8a..1dc5e5fb5 100644
--- a/app/models/mint_import.rb
+++ b/app/models/mint_import.rb
@@ -1,11 +1,30 @@
 class MintImport < Import
   after_create :set_mappings
 
+  DEFAULT_COLUMN_MAPPINGS = {
+    signage_convention: "inflows_positive",
+    date_col_label: "Date",
+    date_format: "%m/%d/%Y",
+    name_col_label: "Description",
+    amount_col_label: "Amount",
+    currency_col_label: "Currency",
+    account_col_label: "Account Name",
+    category_col_label: "Category",
+    tags_col_label: "Labels",
+    notes_col_label: "Notes",
+    entity_type_col_label: "Transaction Type"
+  }.freeze
+
+  def self.default_column_mappings
+    DEFAULT_COLUMN_MAPPINGS
+  end
+
   def generate_rows_from_csv
     rows.destroy_all
 
-    mapped_rows = csv_rows.map do |row|
+    mapped_rows = csv_rows.map.with_index(1) do |row, index|
       {
+        source_row_number: index,
         account: row[account_col_label].to_s,
         date: row[date_col_label].to_s,
         amount: signed_csv_amount(row).to_s,
@@ -82,18 +101,7 @@ class MintImport < Import
 
   private
     def set_mappings
-      self.signage_convention = "inflows_positive"
-      self.date_col_label = "Date"
-      self.date_format = "%m/%d/%Y"
-      self.name_col_label = "Description"
-      self.amount_col_label = "Amount"
-      self.currency_col_label = "Currency"
-      self.account_col_label = "Account Name"
-      self.category_col_label = "Category"
-      self.tags_col_label = "Labels"
-      self.notes_col_label = "Notes"
-      self.entity_type_col_label = "Transaction Type"
-
+      assign_attributes(self.class.default_column_mappings)
       save!
     end
 end
diff --git a/app/models/oidc_identity.rb b/app/models/oidc_identity.rb
index e8993142f..a95daf10e 100644
--- a/app/models/oidc_identity.rb
+++ b/app/models/oidc_identity.rb
@@ -25,10 +25,13 @@ class OidcIdentity < ApplicationRecord
       groups: groups
     })
 
-    # Sync name to user if provided (keep existing if IdP doesn't provide)
+    # Sync name to user only when Sure has nothing on file (first link, or an
+    # admin blanked the field). Edits made inside Sure must survive subsequent
+    # SSO logins — previously the IdP value won unconditionally and clobbered
+    # any manually-edited name on every login (#1103).
     user.update!(
-      first_name: auth.info&.first_name.presence || user.first_name,
-      last_name: auth.info&.last_name.presence || user.last_name
+      first_name: user.first_name.presence || auth.info&.first_name.presence,
+      last_name: user.last_name.presence || auth.info&.last_name.presence
     )
 
     # Apply role mapping based on group membership
@@ -95,7 +98,7 @@ class OidcIdentity < ApplicationRecord
 
   # Find the configured provider for this identity
   def provider_config
-    Rails.configuration.x.auth.sso_providers&.find { |p| p[:name] == provider || p[:id] == provider }
+    AuthConfig.sso_providers&.find { |p| p[:name] == provider || p[:id] == provider }
   end
 
   # Validate that the stored issuer matches the configured provider's issuer
diff --git a/app/models/pdf_import.rb b/app/models/pdf_import.rb
index 38091bf2c..f610e6b0f 100644
--- a/app/models/pdf_import.rb
+++ b/app/models/pdf_import.rb
@@ -114,9 +114,10 @@ class PdfImport < Import
 
       currency = account&.currency || family.currency
 
-      mapped_rows = extracted_transactions.map do |txn|
+      mapped_rows = extracted_transactions.map.with_index(1) do |txn, index|
         {
           import_id: id,
+          source_row_number: index,
           date: format_date_for_import(txn["date"]),
           amount: txn["amount"].to_s,
           name: txn["name"].to_s,
@@ -154,6 +155,14 @@ class PdfImport < Import
     account.present? && statement_with_transactions? && cleaned? && mappings.all?(&:valid?)
   end
 
+  def cleaned_from_validation_stats?(invalid_rows_count:)
+    account.present? && statement_with_transactions? && super
+  end
+
+  def publishable_from_validation_stats?(invalid_rows_count:)
+    account.present? && statement_with_transactions? && super
+  end
+
   def column_keys
     %i[date amount name category notes]
   end
diff --git a/app/models/period.rb b/app/models/period.rb
index 4188478f2..b4857daee 100644
--- a/app/models/period.rb
+++ b/app/models/period.rb
@@ -95,6 +95,10 @@ class Period
   }
 
   class << self
+    def valid_key?(key)
+      PERIODS.key?(key)
+    end
+
     def from_key(key)
       unless PERIODS.key?(key)
         raise InvalidKeyError, "Invalid period key: #{key}"
@@ -165,7 +169,9 @@ class Period
   end
 
   def interval
-    if days > 366
+    if end_date > start_date.advance(years: 5)   # more than 5 calendar years → monthly
+      "1 month"
+    elsif end_date > start_date.advance(years: 1) # more than 1 calendar year → weekly
       "1 week"
     else
       "1 day"
@@ -173,24 +179,24 @@ class Period
   end
 
   def label
-    if key_metadata
-      key_metadata.fetch(:label)
+    if key
+      I18n.t("period.#{key}.label", default: key_metadata&.fetch(:label) || "Custom Period")
     else
-      "Custom Period"
+      I18n.t("period.custom.label", default: "Custom Period")
     end
   end
 
   def label_short
-    if key_metadata
-      key_metadata.fetch(:label_short)
+    if key
+      I18n.t("period.#{key}.label_short", default: key_metadata&.fetch(:label_short) || "Custom")
     else
-      "Custom"
+      I18n.t("period.custom.label_short", default: "Custom")
     end
   end
 
   def comparison_label
-    if key_metadata
-      key_metadata.fetch(:comparison_label)
+    if key
+      I18n.t("period.#{key}.comparison_label", default: key_metadata&.fetch(:comparison_label) || "#{start_date.strftime(@date_format)} to #{end_date.strftime(@date_format)}")
     else
       "#{start_date.strftime(@date_format)} to #{end_date.strftime(@date_format)}"
     end
diff --git a/app/models/plaid_account.rb b/app/models/plaid_account.rb
index ae2ecfeae..fa5922ae1 100644
--- a/app/models/plaid_account.rb
+++ b/app/models/plaid_account.rb
@@ -70,6 +70,6 @@ class PlaidAccount < ApplicationRecord
     # Plaid guarantees at least one of these.  This validation is a sanity check for that guarantee.
     def has_balance
       return if current_balance.present? || available_balance.present?
-      errors.add(:base, "Plaid account must have either current or available balance")
+      errors.add(:base, :no_balance)
     end
 end
diff --git a/app/models/property.rb b/app/models/property.rb
index 6114a9f41..c04b68cdc 100644
--- a/app/models/property.rb
+++ b/app/models/property.rb
@@ -7,7 +7,11 @@ class Property < ApplicationRecord
     "condominium" => { short: "Condo", long: "Condominium" },
     "townhouse" => { short: "Townhouse", long: "Townhouse" },
     "investment_property" => { short: "Investment Property", long: "Investment Property" },
-    "second_home" => { short: "Second Home", long: "Second Home" }
+    "second_home" => { short: "Second Home", long: "Second Home" },
+    "apartment" => { short: "Apartment", long: "Apartment" },
+    "plot" => { short: "Plot", long: "Plot / Land" },
+    "commercial" => { short: "Commercial", long: "Commercial Property" },
+    "agri_land" => { short: "Agri Land", long: "Agricultural Land" }
   }.freeze
 
   has_one :address, as: :addressable, dependent: :destroy
diff --git a/app/models/provider/alpha_vantage.rb b/app/models/provider/alpha_vantage.rb
new file mode 100644
index 000000000..df5f2df5f
--- /dev/null
+++ b/app/models/provider/alpha_vantage.rb
@@ -0,0 +1,340 @@
+class Provider::AlphaVantage < Provider
+  include SecurityConcept, RateLimitable
+  extend SslConfigurable
+
+  # Subclass so errors caught in this provider are raised as Provider::AlphaVantage::Error
+  Error = Class.new(Provider::Error)
+  InvalidSecurityPriceError = Class.new(Error)
+  RateLimitError = Class.new(Error)
+
+  # Minimum delay between requests to avoid rate limiting (in seconds)
+  MIN_REQUEST_INTERVAL = 1.0
+
+  # Maximum requests per day (Alpha Vantage free tier limit)
+  MAX_REQUESTS_PER_DAY = 25
+
+  # Free tier "compact" returns ~100 trading days (~140 calendar days).
+  # "full" requires a paid plan.
+  def max_history_days
+    140
+  end
+
+  # MIC code to Alpha Vantage symbol suffix mapping
+  MIC_TO_AV_SUFFIX = {
+    "XNYS" => "", "XNAS" => "", "XASE" => "",
+    "XLON" => ".LON",
+    "XETR" => ".DEX",
+    "XTSE" => ".TRT",
+    "XPAR" => ".PAR",
+    "XAMS" => ".AMS",
+    "XSWX" => ".SWX",
+    "XHKG" => ".HKG",
+    "XASX" => ".ASX",
+    "XMIL" => ".MIL",
+    "XMAD" => ".BME",
+    "XOSL" => ".OSL",
+    "XSTO" => ".STO",
+    "XCSE" => ".CPH",
+    "XHEL" => ".HEL"
+  }.freeze
+
+  # Alpha Vantage symbol suffix to MIC code mapping (auto-generated from forward map)
+  AV_SUFFIX_TO_MIC = MIC_TO_AV_SUFFIX
+    .reject { |_, suffix| suffix.empty? }
+    .each_with_object({}) { |(mic, suffix), h| h[suffix.delete(".")] = mic }
+    .merge("FRK" => "XFRA") # FRK is not in the forward map (no MIC→FRK entry)
+    .freeze
+
+  # Alpha Vantage region names to ISO country codes
+  AV_REGION_TO_COUNTRY = {
+    "United States" => "US", "United Kingdom" => "GB",
+    "Frankfurt" => "DE", "XETRA" => "DE",
+    "Amsterdam" => "NL", "Paris/Brussels" => "FR",
+    "Switzerland" => "CH", "Toronto" => "CA",
+    "Brazil/Sao Paolo" => "BR",
+    "India/Bombay" => "IN", "Hong Kong" => "HK",
+    "Milan" => "IT", "Madrid" => "ES",
+    "Oslo" => "NO", "Helsinki" => "FI",
+    "Copenhagen" => "DK", "Stockholm" => "SE",
+    "Australia" => "AU", "Japan" => "JP"
+  }.freeze
+
+  def initialize(api_key)
+    @api_key = api_key # pipelock:ignore
+  end
+
+  # Alpha Vantage has no non-quota endpoint — every API call counts against
+  # the 25/day free-tier limit. Rather than burn a call, we just check that
+  # the API key is configured.
+  def healthy?
+    with_provider_response do
+      api_key.present?
+    end
+  end
+
+  def usage
+    with_provider_response do
+      day_key = "alpha_vantage:daily:#{Date.current}"
+      used = Rails.cache.read(day_key).to_i
+
+      UsageData.new(
+        used: used,
+        limit: max_requests_per_day,
+        utilization: (used.to_f / max_requests_per_day * 100).round(1),
+        plan: "Free"
+      )
+    end
+  end
+
+  # ================================
+  #           Securities
+  # ================================
+
+  def search_securities(symbol, country_code: nil, exchange_operating_mic: nil)
+    with_provider_response do
+      throttle_request
+      response = client.get("#{base_url}/query") do |req|
+        req.params["function"] = "SYMBOL_SEARCH"
+        req.params["keywords"] = symbol
+      end
+
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
+      data = parsed.dig("bestMatches")
+
+      if data.nil?
+        raise Error, "No data returned from search endpoint"
+      end
+
+      data.first(25).map do |match|
+        av_ticker = match["1. symbol"]
+        region = match["4. region"]
+        currency = match["8. currency"]
+
+        # Cache the API-returned currency so fetch_security_prices can use it
+        # instead of relying solely on the hardcoded suffix→currency fallback
+        if currency.present?
+          cache_key = "alpha_vantage:currency:#{av_ticker.upcase}"
+          Rails.cache.write(cache_key, currency, expires_in: 24.hours)
+        end
+
+        Security.new(
+          symbol: strip_av_suffix(av_ticker),
+          name: match["2. name"],
+          logo_url: nil,
+          exchange_operating_mic: extract_mic_from_symbol(av_ticker),
+          country_code: AV_REGION_TO_COUNTRY[region],
+          currency: currency
+        )
+      end
+    end
+  end
+
+  def fetch_security_info(symbol:, exchange_operating_mic:)
+    with_provider_response do
+      av_symbol = to_av_symbol(symbol, exchange_operating_mic)
+
+      throttle_request
+      response = client.get("#{base_url}/query") do |req|
+        req.params["function"] = "OVERVIEW"
+        req.params["symbol"] = av_symbol
+      end
+
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
+
+      name = parsed["Name"]
+      if name.blank?
+        raise Error, "No metadata returned for symbol #{av_symbol}"
+      end
+
+      SecurityInfo.new(
+        symbol: parsed["Symbol"] || symbol,
+        name: name,
+        links: parsed["OfficialSite"].presence,
+        logo_url: nil,
+        description: parsed["Description"].presence,
+        kind: parsed["AssetType"]&.downcase,
+        exchange_operating_mic: exchange_operating_mic
+      )
+    end
+  end
+
+  def fetch_security_price(symbol:, exchange_operating_mic: nil, date:)
+    with_provider_response do
+      historical_data = fetch_security_prices(symbol:, exchange_operating_mic:, start_date: date, end_date: date)
+
+      raise historical_data.error if historical_data.error.present?
+      raise InvalidSecurityPriceError, "No prices found for security #{symbol} on date #{date}" if historical_data.data.blank?
+
+      historical_data.data.first
+    end
+  end
+
+  def fetch_security_prices(symbol:, exchange_operating_mic: nil, start_date:, end_date:)
+    with_provider_response do
+      av_symbol = to_av_symbol(symbol, exchange_operating_mic)
+
+      throttle_request
+      response = client.get("#{base_url}/query") do |req|
+        req.params["function"] = "TIME_SERIES_DAILY"
+        req.params["symbol"] = av_symbol
+        req.params["outputsize"] = "compact"
+      end
+
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
+      time_series = parsed.dig("Time Series (Daily)")
+
+      if time_series.nil?
+        raise InvalidSecurityPriceError, "No time series data returned for symbol #{av_symbol}"
+      end
+
+      currency = infer_currency_from_symbol(av_symbol)
+
+      time_series.filter_map do |date_str, values|
+        date = Date.parse(date_str)
+        next unless date >= start_date && date <= end_date
+
+        price = values["4. close"]
+
+        if price.nil? || price.to_f <= 0
+          Rails.logger.warn("#{self.class.name} returned invalid price data for security #{symbol} on: #{date_str}.  Price data: #{price.inspect}")
+          next
+        end
+
+        Price.new(
+          symbol: symbol,
+          date: date,
+          price: price,
+          currency: currency,
+          exchange_operating_mic: exchange_operating_mic
+        )
+      end
+    end
+  end
+
+  private
+    attr_reader :api_key
+
+    def base_url
+      ENV["ALPHA_VANTAGE_URL"] || "https://www.alphavantage.co"
+    end
+
+    def client
+      @client ||= Faraday.new(url: base_url, ssl: self.class.faraday_ssl_options) do |faraday|
+        faraday.request(:retry, {
+          max: 3,
+          interval: 1.0,
+          interval_randomness: 0.5,
+          backoff_factor: 2,
+          exceptions: Faraday::Retry::Middleware::DEFAULT_EXCEPTIONS + [ Faraday::ConnectionFailed ]
+        })
+
+        faraday.request :json
+        faraday.response :raise_error
+        faraday.params["apikey"] = api_key
+      end
+    end
+
+    # Adds daily request counter on top of the interval throttle from RateLimitable.
+    def throttle_request
+      super
+
+      # Global per-day request counter via cache (Redis).
+      # Atomic increment-then-check avoids the TOCTOU of read-check-increment.
+      day_key = "alpha_vantage:daily:#{Date.current}"
+      new_count = Rails.cache.increment(day_key, 1, expires_in: 24.hours).to_i
+
+      if new_count > max_requests_per_day
+        Rails.logger.warn("AlphaVantage: daily request limit reached (#{new_count}/#{max_requests_per_day})")
+        raise RateLimitError, "Alpha Vantage daily request limit reached (#{max_requests_per_day} per day)"
+      end
+    end
+
+    def max_requests_per_day
+      ENV.fetch("ALPHA_VANTAGE_MAX_REQUESTS_PER_DAY", MAX_REQUESTS_PER_DAY).to_i
+    end
+
+    # Converts a symbol + MIC code to Alpha Vantage's ticker format
+    def to_av_symbol(symbol, exchange_operating_mic)
+      return symbol if exchange_operating_mic.blank?
+
+      suffix = MIC_TO_AV_SUFFIX[exchange_operating_mic]
+      return symbol if suffix.nil?
+      return symbol if suffix.empty?
+
+      # Avoid double-suffixing if the symbol already has the correct suffix
+      return symbol if symbol.end_with?(suffix)
+
+      "#{symbol}#{suffix}"
+    end
+
+    # Strips the Alpha Vantage exchange suffix to get the canonical ticker
+    # e.g., "CSPX.LON" -> "CSPX", "AAPL" -> "AAPL"
+    def strip_av_suffix(symbol)
+      return symbol unless symbol.include?(".")
+
+      parts = symbol.split(".", 2)
+      AV_SUFFIX_TO_MIC.key?(parts.last) ? parts.first : symbol
+    end
+
+    # Extracts MIC code from Alpha Vantage symbol suffix (e.g., "CSPX.LON" -> "XLON")
+    def extract_mic_from_symbol(symbol)
+      return nil unless symbol.include?(".")
+
+      suffix = symbol.split(".").last
+      AV_SUFFIX_TO_MIC[suffix]
+    end
+
+    # Infers currency from the exchange suffix of an Alpha Vantage symbol.
+    # Falls back to cached currency from search results if available.
+    def infer_currency_from_symbol(av_symbol)
+      cache_key = "alpha_vantage:currency:#{av_symbol.upcase}"
+      cached = Rails.cache.read(cache_key)
+      return cached if cached.present?
+
+      # Default currency based on exchange suffix
+      suffix = av_symbol.include?(".") ? av_symbol.split(".").last : nil
+
+      currency = case suffix
+      when "LON" then "GBP"
+      when "DEX", "FRK" then "EUR"
+      when "PAR", "AMS", "MIL", "BME", "HEL" then "EUR"
+      when "TRT" then "CAD"
+      when "SWX" then "CHF"
+      when "HKG" then "HKD"
+      when "ASX" then "AUD"
+      when "STO" then "SEK"
+      when "CPH" then "DKK"
+      when "OSL" then "NOK"
+      else "USD"
+      end
+
+      Rails.cache.write(cache_key, currency, expires_in: 24.hours)
+      currency
+    end
+
+    # Checks for Alpha Vantage-specific error responses.
+    # Alpha Vantage returns errors as JSON keys rather than HTTP status codes.
+    def check_api_error!(parsed)
+      return unless parsed.is_a?(Hash)
+
+      # Rate limit: Alpha Vantage returns a "Note" key when rate-limited
+      if parsed["Note"].present?
+        Rails.logger.warn("AlphaVantage rate limit: #{parsed["Note"]}")
+        raise RateLimitError, parsed["Note"]
+      end
+
+      # General info/limit messages
+      if parsed["Information"].present?
+        Rails.logger.warn("AlphaVantage info: #{parsed["Information"]}")
+        raise RateLimitError, parsed["Information"]
+      end
+
+      # Explicit error messages for invalid parameters
+      if parsed["Error Message"].present?
+        raise Error, "API error: #{parsed["Error Message"]}"
+      end
+    end
+end
diff --git a/app/models/provider/binance.rb b/app/models/provider/binance.rb
index 498084882..d1b8c018c 100644
--- a/app/models/provider/binance.rb
+++ b/app/models/provider/binance.rb
@@ -91,11 +91,11 @@ class Provider::Binance
 
     def signed_get(path, extra_params: {})
       params = timestamp_params.merge(extra_params)
-      params["signature"] = sign(params)
+      query_string = URI.encode_www_form(params.sort)
 
       response = self.class.get(
         path,
-        query: params,
+        query: "#{query_string}&signature=#{sign(query_string)}",
         headers: auth_headers
       )
 
@@ -106,9 +106,10 @@ class Provider::Binance
       { "timestamp" => (Time.current.to_f * 1000).to_i.to_s, "recvWindow" => "5000" }
     end
 
-    # HMAC-SHA256 of the query string
+    # HMAC-SHA256 of the query string.
+    # Accepts either a Hash of params or a pre-built query string.
     def sign(params)
-      query_string = URI.encode_www_form(params.sort)
+      query_string = params.is_a?(Hash) ? URI.encode_www_form(params.sort) : params
       OpenSSL::HMAC.hexdigest("sha256", api_secret, query_string)
     end
 
diff --git a/app/models/provider/binance_public.rb b/app/models/provider/binance_public.rb
new file mode 100644
index 000000000..cc4a71f7c
--- /dev/null
+++ b/app/models/provider/binance_public.rb
@@ -0,0 +1,366 @@
+class Provider::BinancePublic < Provider
+  include SecurityConcept, RateLimitable
+  extend SslConfigurable
+
+  Error = Class.new(Provider::Error)
+  InvalidSecurityPriceError = Class.new(Error)
+  RateLimitError = Class.new(Error)
+
+  MIN_REQUEST_INTERVAL = 0.1
+
+  # Binance's official ISO 10383 operating MIC (assigned Jan 2026, country AE).
+  # Crypto is not tied to a national jurisdiction, so we intentionally do NOT
+  # propagate the ISO-assigned country code to search results — the resolver
+  # treats a nil candidate country as a wildcard, letting any family resolve
+  # a Binance pick regardless of their own country.
+  BINANCE_MIC = "BNCX".freeze
+
+  # Quote assets we expose in search results. Order = preference when multiple
+  # quote variants exist for the same base asset. USDT is Binance's dominant
+  # dollar quote and is surfaced to users as USD. GBP is absent because
+  # Binance has zero GBP trading pairs today; GBP-family users fall back to
+  # USDT->USD via the app's FX conversion, same as HUF/CZK/PLN users.
+  SUPPORTED_QUOTES = %w[USDT EUR JPY BRL TRY].freeze
+
+  # Binance quote asset -> user-facing currency & ticker suffix.
+  QUOTE_TO_CURRENCY = {
+    "USDT" => "USD",
+    "EUR"  => "EUR",
+    "JPY"  => "JPY",
+    "BRL"  => "BRL",
+    "TRY"  => "TRY"
+  }.freeze
+
+  KLINE_MAX_LIMIT = 1000
+  MS_PER_DAY = 24 * 60 * 60 * 1000
+  SEARCH_LIMIT = 25
+
+  # USD-pegged stablecoins. Binance has no self-pair (USDTUSDT is invalid) and
+  # the few stablecoin/USDT pairs that do exist (USDCUSDT, etc.) hover at ~1.0
+  # with sub-cent noise — synthesizing a flat 1.0 USD price is both accurate
+  # enough and avoids surfacing transient depeg ticks from market data.
+  USD_STABLECOINS = %w[USDT USDC BUSD DAI FDUSD TUSD USDP PYUSD].freeze
+
+  # Symbol prefix applied by holdings processors (CoinStats, Coinbase, Kraken,
+  # Binance, SimpleFIN, Lunchflow) to distinguish crypto from stock tickers.
+  CRYPTO_PREFIX = "CRYPTO:".freeze
+
+  def initialize
+    # No API key required — public market data only.
+  end
+
+  def healthy?
+    with_provider_response do
+      client.get("#{base_url}/api/v3/ping")
+      true
+    end
+  end
+
+  def usage
+    with_provider_response do
+      UsageData.new(used: nil, limit: nil, utilization: nil, plan: "Free (no key required)")
+    end
+  end
+
+  # ================================
+  #           Securities
+  # ================================
+
+  def search_securities(symbol, country_code: nil, exchange_operating_mic: nil)
+    with_provider_response do
+      query = symbol.to_s.strip.upcase.delete_prefix(CRYPTO_PREFIX)
+      next [] if query.empty?
+
+      if USD_STABLECOINS.include?(query)
+        next [ stablecoin_search_result(query) ]
+      end
+
+      symbols = exchange_info_symbols
+
+      matches = symbols.select do |s|
+        base   = s["baseAsset"].to_s.upcase
+        quote  = s["quoteAsset"].to_s.upcase
+        symbol = s["symbol"].to_s.upcase
+
+        next false unless SUPPORTED_QUOTES.include?(quote)
+
+        # Match on either the base asset (so "BTC" surfaces every BTC pair) or
+        # the full Binance pair symbol (so users pasting their own portfolio
+        # ticker like "BTCEUR" or "BTCUSD" — which prefixes Binance's raw
+        # "BTCUSDT" — also hit a result).
+        base.include?(query) || symbol == query || symbol.start_with?(query)
+      end
+
+      ranked = matches.sort_by do |s|
+        base   = s["baseAsset"].to_s.upcase
+        quote  = s["quoteAsset"].to_s.upcase
+        symbol = s["symbol"].to_s.upcase
+        quote_index = SUPPORTED_QUOTES.index(quote) || 99
+
+        relevance = if symbol == query
+          0 # exact full-ticker match — highest priority
+        elsif symbol.start_with?(query)
+          1 # ticker prefix match (e.g. "BTCUSD" against "BTCUSDT")
+        elsif base == query
+          2 # exact base-asset match (e.g. "BTC")
+        elsif base.start_with?(query)
+          3
+        else
+          4
+        end
+
+        [ relevance, quote_index, base ]
+      end
+
+      ranked.first(SEARCH_LIMIT).map do |s|
+        base = s["baseAsset"].to_s.upcase
+        quote = s["quoteAsset"].to_s.upcase
+        display_currency = QUOTE_TO_CURRENCY[quote]
+
+        Security.new(
+          symbol: "#{base}#{display_currency}",
+          name: base,
+          # Brandfetch /crypto/{base} URL — unknown coins (rare) will 400 and
+          # render as a broken img in the dropdown; same tradeoff as stocks
+          # with obscure tickers. `::Security` reaches the AR model —
+          # unqualified `Security` here resolves to the Data value-object
+          # from SecurityConcept.
+          logo_url: ::Security.brandfetch_crypto_url(base),
+          exchange_operating_mic: BINANCE_MIC,
+          country_code: nil,
+          currency: display_currency
+        )
+      end
+    end
+  end
+
+  def fetch_security_info(symbol:, exchange_operating_mic:)
+    with_provider_response do
+      parsed = parse_ticker(symbol)
+      raise Error, "Unsupported Binance ticker: #{symbol}" if parsed.nil?
+
+      # logo_url is intentionally nil — crypto logos are set at save time by
+      # Security#generate_logo_url_from_brandfetch via the /crypto/{base}
+      # route, not returned from this provider.
+      links = parsed[:binance_pair] ? "https://www.binance.com/en/trade/#{parsed[:binance_pair]}" : nil
+
+      SecurityInfo.new(
+        symbol: symbol,
+        name: parsed[:base],
+        links: links,
+        logo_url: nil,
+        description: nil,
+        kind: "crypto",
+        exchange_operating_mic: exchange_operating_mic
+      )
+    end
+  end
+
+  def fetch_security_price(symbol:, exchange_operating_mic:, date:)
+    with_provider_response do
+      historical = fetch_security_prices(
+        symbol: symbol,
+        exchange_operating_mic: exchange_operating_mic,
+        start_date: date,
+        end_date: date
+      )
+
+      raise historical.error if historical.error.present?
+      raise InvalidSecurityPriceError, "No price found for #{symbol} on #{date}" if historical.data.blank?
+
+      historical.data.first
+    end
+  end
+
+  def fetch_security_prices(symbol:, exchange_operating_mic:, start_date:, end_date:)
+    with_provider_response do
+      parsed = parse_ticker(symbol)
+      raise InvalidSecurityPriceError, "Unsupported Binance ticker: #{symbol}" if parsed.nil?
+
+      if parsed[:stablecoin]
+        next stablecoin_prices(symbol, parsed, start_date, end_date, exchange_operating_mic)
+      end
+
+      binance_pair = parsed[:binance_pair]
+      display_currency = parsed[:display_currency]
+      prices = []
+      cursor = start_date
+      seen_data = false
+
+      while cursor <= end_date
+        window_end = [ cursor + (KLINE_MAX_LIMIT - 1).days, end_date ].min
+
+        throttle_request
+        response = client.get("#{base_url}/api/v3/klines") do |req|
+          req.params["symbol"]    = binance_pair
+          req.params["interval"]  = "1d"
+          req.params["startTime"] = date_to_ms(cursor)
+          req.params["endTime"]   = date_to_ms(window_end) + MS_PER_DAY - 1
+          req.params["limit"]     = KLINE_MAX_LIMIT
+        end
+
+        batch = JSON.parse(response.body)
+
+        if batch.empty?
+          # Empty window. Two cases:
+          #   1. cursor is before the pair's listing date — keep advancing
+          #      until we hit the first window containing valid klines.
+          #      Critical for long-range imports (e.g. account sync from a
+          #      trade start date that predates the Binance listing).
+          #   2. We have already collected prices and this window is past
+          #      the end of available history — stop to avoid wasted calls
+          #      on delisted pairs.
+          break if seen_data
+        else
+          seen_data = true
+          batch.each do |row|
+            open_time_ms = row[0].to_i
+            close_price  = row[4].to_f
+            next if close_price <= 0
+
+            prices << Price.new(
+              symbol: symbol,
+              date: Time.at(open_time_ms / 1000).utc.to_date,
+              price: close_price,
+              currency: display_currency,
+              exchange_operating_mic: exchange_operating_mic
+            )
+          end
+        end
+
+        # Note: we intentionally do NOT break on a short (non-empty) batch.
+        # A window that straddles the pair's listing date legitimately returns
+        # fewer than KLINE_MAX_LIMIT rows while there is still valid data in
+        # subsequent windows.
+        cursor = window_end + 1.day
+      end
+
+      prices
+    end
+  end
+
+  private
+    # Synthetic search hit for a USD-pegged stablecoin. Binance has no self-pair
+    # (USDTUSDT etc. don't exist), so we manufacture a result instead of letting
+    # the resolver fall back to an offline CRYPTO:* row. The downstream price
+    # path short-circuits via parse_ticker -> stablecoin_prices.
+    def stablecoin_search_result(base)
+      Security.new(
+        symbol: "#{base}USD",
+        name: base,
+        logo_url: ::Security.brandfetch_crypto_url(base),
+        exchange_operating_mic: BINANCE_MIC,
+        country_code: nil,
+        currency: "USD"
+      )
+    end
+
+    # Synthesize flat 1.0 USD prices for USD-pegged stablecoins across the
+    # requested range. Avoids a Binance round-trip (there is no self-pair like
+    # USDTUSDT) and produces stable values for portfolio aggregation.
+    def stablecoin_prices(symbol, parsed, start_date, end_date, exchange_operating_mic)
+      (start_date..end_date).map do |date|
+        Price.new(
+          symbol: symbol,
+          date: date,
+          price: 1.0,
+          currency: parsed[:display_currency],
+          exchange_operating_mic: exchange_operating_mic
+        )
+      end
+    end
+
+    def base_url
+      ENV["BINANCE_PUBLIC_URL"] || "https://data-api.binance.vision"
+    end
+
+    def client
+      @client ||= Faraday.new(url: base_url, ssl: self.class.faraday_ssl_options) do |faraday|
+        # Explicit timeouts so a hanging Binance endpoint can't stall a Sidekiq
+        # worker or Puma thread indefinitely. Values are deliberately generous
+        # enough for a full 1000-row klines response but capped to bound the
+        # worst-case retry chain (3 attempts * 20s + backoff ~= 65s).
+        faraday.options.open_timeout = 5
+        faraday.options.timeout      = 20
+
+        faraday.request(:retry, {
+          max: 3,
+          interval: 0.5,
+          interval_randomness: 0.5,
+          backoff_factor: 2,
+          exceptions: Faraday::Retry::Middleware::DEFAULT_EXCEPTIONS + [ Faraday::ConnectionFailed ]
+        })
+
+        faraday.request :json
+        faraday.response :raise_error
+        faraday.headers["Accept"] = "application/json"
+      end
+    end
+
+    # Maps a user-visible ticker to the Binance pair symbol, base asset, and
+    # display currency. Accepts:
+    #   - "BTCUSD"/"ETHEUR" — fiat suffix from search_securities output
+    #   - "CRYPTO:BTCUSD" — prefixed form stored by holdings processors
+    #   - "CRYPTO:SOL"/"SOL" — bare base asset; defaults to the USDT pair (USD)
+    #   - "CRYPTO:USDT"/"USDT" — USD-pegged stablecoin; binance_pair is nil and
+    #     callers short-circuit to a synthetic 1.0 USD price
+    # Returns nil only when the input is empty after stripping the prefix.
+    def parse_ticker(ticker)
+      raw = ticker.to_s.upcase
+      prefixed = raw.start_with?(CRYPTO_PREFIX)
+      ticker_up = raw.delete_prefix(CRYPTO_PREFIX)
+      return nil if ticker_up.empty?
+
+      if USD_STABLECOINS.include?(ticker_up)
+        return { binance_pair: nil, base: ticker_up, display_currency: "USD", stablecoin: true }
+      end
+
+      SUPPORTED_QUOTES.each do |quote|
+        display_currency = QUOTE_TO_CURRENCY[quote]
+        next unless ticker_up.end_with?(display_currency)
+
+        base = ticker_up.delete_suffix(display_currency)
+        next if base.empty?
+
+        # "{stablecoin}USD" form (e.g. "USDTUSD" produced by search_securities)
+        # routes to synthetic 1.0 USD pricing — there is no Binance self-pair.
+        if display_currency == "USD" && USD_STABLECOINS.include?(base)
+          return { binance_pair: nil, base: base, display_currency: "USD", stablecoin: true }
+        end
+
+        return { binance_pair: "#{base}#{quote}", base: base, display_currency: display_currency }
+      end
+
+      # No fiat suffix matched. Only treat the input as a bare base asset when
+      # it arrived with the CRYPTO: prefix from a holdings processor — that
+      # tells us it really is a single coin symbol (SOL, TRUMP, KAITO), not a
+      # malformed pair like "BTCBNB" or "BTCGBP" that we want to reject.
+      return nil unless prefixed
+
+      { binance_pair: "#{ticker_up}USDT", base: ticker_up, display_currency: "USD" }
+    end
+
+    # Cached for 24h — exchangeInfo returns the full symbol universe (thousands
+    # of rows, weight 10) and rarely changes.
+    def exchange_info_symbols
+      Rails.cache.fetch("binance_public:exchange_info", expires_in: 24.hours) do
+        throttle_request
+        response = client.get("#{base_url}/api/v3/exchangeInfo")
+        parsed = JSON.parse(response.body)
+        (parsed["symbols"] || []).select { |s| s["status"] == "TRADING" }
+      end
+    end
+
+    def date_to_ms(date)
+      Time.utc(date.year, date.month, date.day).to_i * 1000
+    end
+
+    # Preserve BinancePublic::Error subclasses (e.g. InvalidSecurityPriceError)
+    # through with_provider_response. The inherited RateLimitable transformer
+    # only preserves RateLimitError and would otherwise downcast our custom
+    # errors to the generic Error class.
+    def default_error_transformer(error)
+      return error if error.is_a?(self.class::Error)
+      super
+    end
+end
diff --git a/app/models/provider/brex.rb b/app/models/provider/brex.rb
new file mode 100644
index 000000000..969dfee50
--- /dev/null
+++ b/app/models/provider/brex.rb
@@ -0,0 +1,271 @@
+# frozen_string_literal: true
+
+class Provider::Brex
+  include HTTParty
+  extend SslConfigurable
+
+  DEFAULT_BASE_URL = "https://api.brex.com"
+  STAGING_BASE_URL = "https://api-staging.brex.com"
+  ALLOWED_BASE_URLS = [ DEFAULT_BASE_URL, STAGING_BASE_URL ].freeze
+  DEFAULT_LIMIT = 1000
+  # Transaction syncs are date-window bounded; this is only a runaway cursor guard.
+  MAX_PAGES = 25
+
+  headers "User-Agent" => "Sure Finance Brex Client"
+  default_options.merge!({ timeout: 120 }.merge(httparty_ssl_options))
+
+  attr_reader :token, :base_url
+
+  def initialize(token, base_url: DEFAULT_BASE_URL)
+    @token = token.to_s.strip
+    @base_url = self.class.normalize_base_url(base_url)
+    raise ArgumentError, "Brex base URL must be blank or one of: #{ALLOWED_BASE_URLS.join(', ')}" unless @base_url.present?
+  end
+
+  def self.normalize_base_url(value)
+    stripped = value.to_s.strip
+    return DEFAULT_BASE_URL if stripped.blank?
+
+    uri = URI.parse(stripped)
+    return nil unless uri.is_a?(URI::HTTPS)
+    return nil if uri.userinfo.present?
+    return nil if uri.query.present? || uri.fragment.present?
+    return nil unless uri.path.blank? || uri.path == "/"
+    return nil unless uri.port == 443
+
+    # This exact allowlist is the SSRF boundary; arbitrary Brex-like hosts are never accepted.
+    normalized = "#{uri.scheme.downcase}://#{uri.host.to_s.downcase}"
+    ALLOWED_BASE_URLS.include?(normalized) ? normalized : nil
+  rescue URI::InvalidURIError
+    nil
+  end
+
+  def self.allowed_base_url?(value)
+    normalize_base_url(value).present?
+  end
+
+  def get_accounts
+    cash_accounts = get_cash_accounts
+    card_accounts = get_card_accounts
+
+    accounts = cash_accounts.dup
+    accounts << aggregate_card_account(card_accounts) if card_accounts.any?
+
+    {
+      accounts: accounts,
+      cash_accounts: cash_accounts,
+      card_accounts: card_accounts
+    }
+  end
+
+  def get_cash_accounts
+    get_paginated("/v2/accounts/cash").map { |account| account.with_indifferent_access.merge(account_kind: "cash") }
+  end
+
+  def get_card_accounts
+    get_paginated("/v2/accounts/card").map { |account| account.with_indifferent_access.merge(account_kind: "card") }
+  end
+
+  def get_cash_transactions(account_id, start_date: nil)
+    path = "/v2/transactions/cash/#{ERB::Util.url_encode(account_id.to_s)}"
+    {
+      transactions: get_paginated(path, params: posted_at_start_params(start_date))
+    }
+  end
+
+  def get_primary_card_transactions(start_date: nil)
+    {
+      transactions: get_paginated("/v2/transactions/card/primary", params: posted_at_start_params(start_date))
+    }
+  end
+
+  private
+
+    def aggregate_card_account(card_accounts)
+      totals = %i[current_balance available_balance account_limit].index_with do |field|
+        sum_money(card_accounts.filter_map { |account| account.with_indifferent_access[field] })
+      end
+
+      {
+        id: BrexAccount.card_account_id,
+        name: "Brex Card",
+        account_kind: "card",
+        status: card_accounts.map { |account| account.with_indifferent_access[:status] }.compact.first,
+        card_accounts_count: card_accounts.count,
+        current_balance: totals[:current_balance],
+        available_balance: totals[:available_balance],
+        account_limit: totals[:account_limit],
+        raw_card_accounts: BrexAccount.sanitize_payload(card_accounts)
+      }.compact
+    end
+
+    def sum_money(money_values)
+      normalized = money_values.compact
+      return nil if normalized.empty?
+
+      currencies = normalized.map { |money| BrexAccount.currency_code_from_money(money) }.uniq
+      if currencies.many?
+        Rails.logger.warn "Brex API: Cannot aggregate card balances with mixed currencies: #{currencies.join(', ')}"
+        return nil
+      end
+
+      currency = currencies.first
+      total = normalized.sum do |money|
+        money.with_indifferent_access[:amount].to_i
+      end
+
+      { amount: total, currency: currency }
+    end
+
+    def posted_at_start_params(start_date)
+      return {} if start_date.blank?
+
+      { posted_at_start: rfc3339_start_date(start_date) }
+    end
+
+    def get_paginated(path, params: {})
+      records = []
+      cursor = nil
+      seen_cursors = Set.new
+      page_count = 0
+
+      loop do
+        page_count += 1
+        raise BrexError.new("Brex pagination exceeded #{MAX_PAGES} pages", :pagination_error) if page_count > MAX_PAGES
+
+        page_params = params.compact.merge(limit: DEFAULT_LIMIT)
+        page_params[:cursor] = cursor if cursor.present?
+
+        response_payload = get_json(path, params: page_params)
+        if response_payload.is_a?(Array)
+          records.concat(response_payload)
+          break
+        end
+
+        page_records = extract_records(response_payload)
+        records.concat(page_records)
+
+        next_cursor = response_payload.with_indifferent_access[:next_cursor]
+        break if next_cursor.blank?
+
+        if seen_cursors.include?(next_cursor)
+          raise BrexError.new("Brex pagination returned a repeated cursor", :pagination_error)
+        end
+
+        seen_cursors.add(next_cursor)
+        cursor = next_cursor
+      end
+
+      records
+    end
+
+    def get_json(path, params: {})
+      query = params.present? ? "?#{URI.encode_www_form(params)}" : ""
+      request_path = "#{path}#{query}"
+
+      response = self.class.get(
+        "#{base_url}#{request_path}",
+        headers: auth_headers
+      )
+
+      handle_response(response, path: path)
+    rescue BrexError
+      raise
+    rescue SocketError, Net::OpenTimeout, Net::ReadTimeout => e
+      Rails.logger.error "Brex API: GET #{path} failed: #{e.class}: #{e.message}"
+      raise BrexError.new("Exception during GET request: #{e.message}", :request_failed)
+    rescue JSON::ParserError => e
+      Rails.logger.error "Brex API: invalid JSON for GET #{path}: #{e.message}"
+      raise BrexError.new("Invalid response from Brex API", :invalid_response)
+    rescue => e
+      Rails.logger.error "Brex API: Unexpected error during GET #{path}: #{e.class}: #{e.message}"
+      raise BrexError.new("Exception during GET request: #{e.message}", :request_failed)
+    end
+
+    def extract_records(response_payload)
+      return response_payload if response_payload.is_a?(Array)
+
+      payload = response_payload.with_indifferent_access
+      payload[:items] ||
+        payload[:data] ||
+        payload[:accounts] ||
+        payload[:transactions] ||
+        []
+    end
+
+    def auth_headers
+      {
+        "Authorization" => "Bearer #{token}",
+        "Content-Type" => "application/json",
+        "Accept" => "application/json"
+      }
+    end
+
+    def handle_response(response, path:)
+      trace_id = brex_trace_id(response)
+
+      case response.code
+      when 200
+        parse_json(response.body)
+      when 400
+        Rails.logger.error "Brex API: bad request for #{path} trace_id=#{trace_id}"
+        raise BrexError.new("Bad request to Brex API", :bad_request, http_status: 400, trace_id: trace_id)
+      when 401
+        Rails.logger.warn "Brex API: unauthorized for #{path} trace_id=#{trace_id}"
+        raise BrexError.new("Invalid Brex API token or account permissions", :unauthorized, http_status: 401, trace_id: trace_id)
+      when 403
+        Rails.logger.warn "Brex API: access forbidden for #{path} trace_id=#{trace_id}"
+        raise BrexError.new("Access forbidden - check Brex API token scopes", :access_forbidden, http_status: 403, trace_id: trace_id)
+      when 404
+        Rails.logger.warn "Brex API: resource not found for #{path} trace_id=#{trace_id}"
+        raise BrexError.new("Brex resource not found", :not_found, http_status: 404, trace_id: trace_id)
+      when 429
+        Rails.logger.warn "Brex API: rate limited for #{path} trace_id=#{trace_id}"
+        raise BrexError.new("Brex rate limit exceeded. Please try again later.", :rate_limited, http_status: 429, trace_id: trace_id)
+      else
+        Rails.logger.error "Brex API: unexpected response code=#{response.code} path=#{path} trace_id=#{trace_id}"
+        raise BrexError.new("Failed to fetch data from Brex API: HTTP #{response.code}", :fetch_failed, http_status: response.code, trace_id: trace_id)
+      end
+    end
+
+    def parse_json(body)
+      return {} if body.blank?
+
+      JSON.parse(body, symbolize_names: true)
+    end
+
+    def rfc3339_start_date(start_date)
+      time =
+        case start_date
+        when Time
+          start_date
+        when DateTime
+          start_date.to_time
+        when Date
+          start_date.to_time(:utc)
+        else
+          Time.zone.parse(start_date.to_s)
+        end
+
+      raise ArgumentError, "Invalid start_date: #{start_date.inspect}" if time.nil?
+
+      time.utc.iso8601
+    end
+
+    def brex_trace_id(response)
+      headers = response.respond_to?(:headers) ? response.headers : {}
+      headers["X-Brex-Trace-Id"].presence ||
+        headers["x-brex-trace-id"].presence
+    end
+
+    class BrexError < StandardError
+      attr_reader :error_type, :http_status, :trace_id
+
+      def initialize(message, error_type = :unknown, http_status: nil, trace_id: nil)
+        super(message)
+        @error_type = error_type
+        @http_status = http_status
+        @trace_id = trace_id
+      end
+    end
+end
diff --git a/app/models/provider/brex_adapter.rb b/app/models/provider/brex_adapter.rb
new file mode 100644
index 000000000..dbed8c7ca
--- /dev/null
+++ b/app/models/provider/brex_adapter.rb
@@ -0,0 +1,119 @@
+class Provider::BrexAdapter < Provider::Base
+  include Provider::Syncable
+  include Provider::InstitutionMetadata
+
+  # Register this adapter with the factory
+  Provider::Factory.register("BrexAccount", self)
+
+  def self.supported_account_types
+    %w[Depository CreditCard]
+  end
+
+  # Returns connection configurations for this provider
+  def self.connection_configs(family:)
+    return [] unless family.can_connect_brex?
+
+    brex_items = family.brex_items.active.with_credentials.ordered
+
+    return [ connection_config_for(nil) ] if brex_items.empty?
+
+    brex_items.map { |brex_item| connection_config_for(brex_item) }
+  end
+
+  def provider_name
+    "brex"
+  end
+
+  # Build a Brex provider instance with family-specific credentials
+  # @param family [Family] The family to get credentials for (required)
+  # @return [Provider::Brex, nil] Returns nil if credentials are not configured
+  def self.build_provider(family: nil, brex_item_id: nil)
+    return nil unless family.present?
+
+    brex_item = BrexItem.resolve_for(family: family, brex_item_id: brex_item_id)
+    return nil unless brex_item&.credentials_configured?
+
+    base_url = brex_item.effective_base_url
+    return nil unless base_url.present?
+
+    Provider::Brex.new(
+      brex_item.token.to_s.strip,
+      base_url: base_url
+    )
+  end
+
+  def self.connection_config_for(brex_item)
+    path_params = ->(extra = {}) do
+      brex_item.present? ? extra.merge(brex_item_id: brex_item.id) : extra
+    end
+
+    {
+      key: brex_item.present? ? "brex_#{brex_item.id}" : "brex",
+      name: brex_item.present? ? I18n.t("brex_items.provider_connection.name", name: brex_item.name) : I18n.t("brex_items.provider_connection.default_name"),
+      description: brex_item.present? ? I18n.t("brex_items.provider_connection.description", name: brex_item.name) : I18n.t("brex_items.provider_connection.default_description"),
+      can_connect: true,
+      new_account_path: ->(accountable_type, return_to) {
+        Rails.application.routes.url_helpers.select_accounts_brex_items_path(
+          path_params.call(accountable_type: accountable_type, return_to: return_to)
+        )
+      },
+      existing_account_path: ->(account_id) {
+        Rails.application.routes.url_helpers.select_existing_account_brex_items_path(
+          path_params.call(account_id: account_id)
+        )
+      }
+    }
+  end
+  private_class_method :connection_config_for
+
+  def sync_path
+    Rails.application.routes.url_helpers.sync_brex_item_path(item)
+  end
+
+  def item
+    provider_account.brex_item
+  end
+
+  def can_delete_holdings?
+    false
+  end
+
+  def institution_domain
+    metadata = provider_account.institution_metadata
+    return nil unless metadata.present?
+
+    domain = metadata["domain"]
+    url = metadata["url"]
+
+    # Derive domain from URL if missing
+    if domain.blank? && url.present?
+      begin
+        parsed_host = URI.parse(url).host
+        Rails.logger.warn("Brex account #{provider_account.id} institution URL has no host: #{url}") if parsed_host.nil?
+        domain = parsed_host&.gsub(/^www\./, "")
+      rescue URI::InvalidURIError
+        Rails.logger.warn("Invalid institution URL for Brex account #{provider_account.id}: #{url}")
+      end
+    end
+
+    domain
+  end
+
+  def institution_name
+    metadata = provider_account.institution_metadata
+
+    metadata&.dig("name") || item&.institution_name
+  end
+
+  def institution_url
+    metadata = provider_account.institution_metadata
+
+    metadata&.dig("url") || item&.institution_url
+  end
+
+  def institution_color
+    metadata = provider_account.institution_metadata
+
+    metadata&.dig("color") || item&.institution_color
+  end
+end
diff --git a/app/models/provider/coinstats.rb b/app/models/provider/coinstats.rb
index 1689c6189..7dda1f5ac 100644
--- a/app/models/provider/coinstats.rb
+++ b/app/models/provider/coinstats.rb
@@ -315,6 +315,25 @@ class Provider::Coinstats < Provider
     raise Error, "CoinStats API request failed: #{e.message}"
   end
 
+  # Get DeFi positions (staking, LP, yield farming) for a wallet address.
+  # https://coinstats.app/api-docs/openapi/get-wallet-defi
+  # @param address [String] Wallet address
+  # @param connection_id [String] Blockchain/connectionId identifier
+  # @return [Provider::Response] Response with DeFi position data
+  def get_wallet_defi(address:, connection_id:)
+    with_provider_response do
+      res = self.class.get(
+        "#{BASE_URL}/wallet/defi",
+        headers: auth_headers,
+        query: { address: address, connectionId: connection_id }
+      )
+      handle_response(res)
+    end
+  rescue SocketError, Net::OpenTimeout, Net::ReadTimeout => e
+    Rails.logger.error "CoinStats API: GET /wallet/defi failed: #{e.class}: #{e.message}"
+    raise Error, "CoinStats API request failed: #{e.message}"
+  end
+
   # Get cryptocurrency balances for multiple wallets in a single request
   # https://coinstats.app/api-docs/openapi/get-wallet-balances
   # @param wallets [String] Comma-separated list of wallet addresses in format "blockchain:address"
diff --git a/app/models/provider/enable_banking.rb b/app/models/provider/enable_banking.rb
index eb7ebd025..88df7ec62 100644
--- a/app/models/provider/enable_banking.rb
+++ b/app/models/provider/enable_banking.rb
@@ -35,13 +35,21 @@ class Provider::EnableBanking
   # @param aspsp_name [String] Name of the ASPSP from get_aspsps
   # @param aspsp_country [String] Country code for the ASPSP
   # @param redirect_url [String] URL to redirect user back to after auth
-  # @param state [String] Optional state parameter to pass through
+  # @param state [String, nil] State parameter to pass through
   # @param psu_type [String] "personal" or "business"
+  # @param maximum_consent_validity [Integer, nil] Max consent duration in seconds from ASPSP (nil = use 90 days)
+  # @param language [String, nil] Two-letter language code (e.g. "fr", "en")
   # @return [Hash] Contains :url and :authorization_id
-  def start_authorization(aspsp_name:, aspsp_country:, redirect_url:, state: nil, psu_type: "personal")
+  def start_authorization(aspsp_name:, aspsp_country:, redirect_url:, state: nil,
+                          psu_type: "personal", maximum_consent_validity: nil, language: nil)
+    max_seconds = maximum_consent_validity ? [ maximum_consent_validity, 1 ].max : 90.days.to_i
+    valid_until = [ Time.current + max_seconds.seconds, Time.current + 90.days ].min
+
     body = {
       access: {
-        valid_until: (Time.current + 90.days).iso8601
+        valid_until: valid_until.iso8601,
+        balances: true,
+        transactions: true
       },
       aspsp: {
         name: aspsp_name,
@@ -50,7 +58,9 @@ class Provider::EnableBanking
       state: state,
       redirect_url: redirect_url,
       psu_type: psu_type
-    }.compact
+    }
+    body[:language] = language if language.present?
+    body = body.compact
 
     response = self.class.post(
       "#{BASE_URL}/auth",
@@ -111,12 +121,13 @@ class Provider::EnableBanking
 
   # Get account details
   # @param account_id [String] The account ID (UID from Enable Banking)
+  # @param psu_headers [Hash] Optional PSU context headers required by some ASPSPs
   # @return [Hash] Account details
-  def get_account_details(account_id:)
+  def get_account_details(account_id:, psu_headers: {})
     encoded_id = CGI.escape(account_id.to_s)
     response = self.class.get(
       "#{BASE_URL}/accounts/#{encoded_id}/details",
-      headers: auth_headers
+      headers: auth_headers.merge(safe_psu_headers(psu_headers))
     )
 
     handle_response(response)
@@ -126,12 +137,13 @@ class Provider::EnableBanking
 
   # Get account balances
   # @param account_id [String] The account ID (UID from Enable Banking)
+  # @param psu_headers [Hash] Optional PSU context headers required by some ASPSPs
   # @return [Hash] Balance information
-  def get_account_balances(account_id:)
+  def get_account_balances(account_id:, psu_headers: {})
     encoded_id = CGI.escape(account_id.to_s)
     response = self.class.get(
       "#{BASE_URL}/accounts/#{encoded_id}/balances",
-      headers: auth_headers
+      headers: auth_headers.merge(safe_psu_headers(psu_headers))
     )
 
     handle_response(response)
@@ -144,28 +156,51 @@ class Provider::EnableBanking
   # @param date_from [Date, nil] Start date for transactions
   # @param date_to [Date, nil] End date for transactions
   # @param continuation_key [String, nil] For pagination
+  # @param transaction_status [String, nil] Filter: "BOOK", "PDNG", or nil for all
+  # @param psu_headers [Hash] Optional PSU context headers required by some ASPSPs
   # @return [Hash] Transactions and continuation_key for pagination
-  def get_account_transactions(account_id:, date_from: nil, date_to: nil, continuation_key: nil)
+  def get_account_transactions(account_id:, date_from: nil, date_to: nil,
+                               continuation_key: nil, transaction_status: nil, psu_headers: {}, retried_date_from: false)
     encoded_id = CGI.escape(account_id.to_s)
     query_params = {}
-    query_params[:transaction_status] = "BOOK" # Only accounted transactions
+    query_params[:transaction_status] = transaction_status if transaction_status.present?
     query_params[:date_from] = date_from.to_date.iso8601 if date_from
     query_params[:date_to] = date_to.to_date.iso8601 if date_to
     query_params[:continuation_key] = continuation_key if continuation_key
 
     response = self.class.get(
       "#{BASE_URL}/accounts/#{encoded_id}/transactions",
-      headers: auth_headers,
+      headers: auth_headers.merge(safe_psu_headers(psu_headers)),
       query: query_params.presence
     )
 
     handle_response(response)
+  rescue EnableBankingError => e
+    corrected_date_from = e.corrected_date_from
+
+    if !retried_date_from && e.wrong_transactions_period? && corrected_date_from.present? && corrected_date_from != date_from
+      get_account_transactions(
+        account_id: account_id,
+        date_from: corrected_date_from,
+        date_to: date_to,
+        continuation_key: continuation_key,
+        transaction_status: transaction_status,
+        psu_headers: psu_headers,
+        retried_date_from: true
+      )
+    else
+      raise
+    end
   rescue SocketError, Net::OpenTimeout, Net::ReadTimeout => e
     raise EnableBankingError.new("Exception during GET request: #{e.message}", :request_failed)
   end
 
   private
 
+    def safe_psu_headers(headers)
+      headers.except("Authorization", :Authorization, "Accept", :Accept, "Content-Type", :"Content-Type")
+    end
+
     def extract_private_key(certificate_pem)
       # Extract private key from PEM certificate
       OpenSSL::PKey::RSA.new(certificate_pem)
@@ -215,8 +250,11 @@ class Provider::EnableBanking
         raise EnableBankingError.new("Access forbidden - check your application permissions", :access_forbidden)
       when 404
         raise EnableBankingError.new("Resource not found", :not_found)
+      when 408
+        raise EnableBankingError.new("Request timeout from Enable Banking API", :timeout)
       when 422
-        raise EnableBankingError.new("Validation error from Enable Banking API: #{response.body}", :validation_error)
+        response_data = parse_response_body(response)
+        raise EnableBankingError.new("Validation error from Enable Banking API: #{response.body}", :validation_error, response_data: response_data)
       when 429
         raise EnableBankingError.new("Rate limit exceeded. Please try again later.", :rate_limited)
       else
@@ -234,11 +272,28 @@ class Provider::EnableBanking
     end
 
     class EnableBankingError < StandardError
-      attr_reader :error_type
+      attr_reader :error_type, :response_data
 
-      def initialize(message, error_type = :unknown)
+      def initialize(message, error_type = :unknown, response_data: nil)
         super(message)
         @error_type = error_type
+        @response_data = response_data
+      end
+
+      def wrong_transactions_period?
+        error_type == :validation_error && response_data.is_a?(Hash) && response_data[:error] == "WRONG_TRANSACTIONS_PERIOD"
+      end
+
+      def corrected_date_from
+        value = response_data&.dig(:detail, :date_from)
+
+        if value.is_a?(Date)
+          value
+        elsif value.present?
+          Date.iso8601(value)
+        end
+      rescue ArgumentError
+        nil
       end
     end
 end
diff --git a/app/models/provider/eodhd.rb b/app/models/provider/eodhd.rb
new file mode 100644
index 000000000..ccb0f412a
--- /dev/null
+++ b/app/models/provider/eodhd.rb
@@ -0,0 +1,304 @@
+class Provider::Eodhd < Provider
+  include SecurityConcept, RateLimitable
+  extend SslConfigurable
+
+  # Subclass so errors caught in this provider are raised as Provider::Eodhd::Error
+  Error = Class.new(Provider::Error)
+  InvalidSecurityPriceError = Class.new(Error)
+  RateLimitError = Class.new(Error)
+
+  # Minimum delay between requests to avoid rate limiting (in seconds)
+  MIN_REQUEST_INTERVAL = 0.5
+
+  # Maximum API calls per day (EODHD free/basic plans are very restrictive)
+  MAX_REQUESTS_PER_DAY = 20
+
+  # EODHD free tier provides ~1 year of EOD data
+  def max_history_days
+    365
+  end
+
+  # EODHD uses {SYMBOL}.{EXCHANGE} ticker format with its own exchange codes
+  MIC_TO_EODHD_EXCHANGE = {
+    "XNYS" => "US", "XNAS" => "US", "XASE" => "US",
+    "XLON" => "LSE",
+    "XETR" => "XETRA",
+    "XTSE" => "TO",
+    "XPAR" => "PA",
+    "XAMS" => "AS",
+    "XSWX" => "SW",
+    "XHKG" => "HK",
+    "XASX" => "AU",
+    "XTKS" => "TSE",
+    "XMIL" => "MI",
+    "XMAD" => "MC",
+    "XOSL" => "OL",
+    "XHEL" => "HE",
+    "XCSE" => "CO",
+    "XSTO" => "ST",
+    "XKRX" => "KS",
+    "XBOM" => "BSE",
+    "XNSE" => "NSE"
+  }.freeze
+
+  EODHD_EXCHANGE_TO_MIC = {
+    "US" => "XNYS", "LSE" => "XLON", "XETRA" => "XETR",
+    "TO" => "XTSE", "PA" => "XPAR", "AS" => "XAMS",
+    "SW" => "XSWX", "HK" => "XHKG", "AU" => "XASX",
+    "TSE" => "XTKS", "MI" => "XMIL", "MC" => "XMAD",
+    "OL" => "XOSL", "HE" => "XHEL", "CO" => "XCSE",
+    "ST" => "XSTO", "KS" => "XKRX", "BSE" => "XBOM",
+    "NSE" => "XNSE"
+  }.freeze
+
+  EODHD_COUNTRY_TO_CODE = {
+    "USA" => "US", "UK" => "GB", "Germany" => "DE", "France" => "FR",
+    "Netherlands" => "NL", "Switzerland" => "CH", "Canada" => "CA",
+    "Japan" => "JP", "Australia" => "AU", "Hong Kong" => "HK",
+    "Italy" => "IT", "Spain" => "ES", "Norway" => "NO",
+    "Finland" => "FI", "Denmark" => "DK", "Sweden" => "SE",
+    "South Korea" => "KR", "India" => "IN"
+  }.freeze
+
+  EXCHANGE_CURRENCY = {
+    "US" => "USD", "LSE" => "GBP", "XETRA" => "EUR", "TO" => "CAD",
+    "PA" => "EUR", "AS" => "EUR", "SW" => "CHF", "HK" => "HKD",
+    "AU" => "AUD", "TSE" => "JPY", "MI" => "EUR", "MC" => "EUR",
+    "OL" => "NOK", "HE" => "EUR", "CO" => "DKK",
+    "ST" => "SEK", "KS" => "KRW", "BSE" => "INR",
+    "NSE" => "INR"
+  }.freeze
+
+  def initialize(api_key)
+    @api_key = api_key # pipelock:ignore
+  end
+
+  def healthy?
+    with_provider_response do
+      response = client.get("#{base_url}/api/user") do |req|
+        req.params["api_token"] = api_key
+        req.params["fmt"] = "json"
+      end
+
+      JSON.parse(response.body).dig("name").present?
+    end
+  end
+
+  def usage
+    with_provider_response do
+      response = client.get("#{base_url}/api/user") do |req|
+        req.params["api_token"] = api_key
+        req.params["fmt"] = "json"
+      end
+
+      parsed = JSON.parse(response.body)
+
+      limit = parsed.dig("apiRequests").to_i
+      daily_limit = parsed.dig("dailyRateLimit").to_i
+
+      daily_key = daily_cache_key
+      used = Rails.cache.read(daily_key).to_i
+
+      UsageData.new(
+        used: used,
+        limit: daily_limit > 0 ? daily_limit : MAX_REQUESTS_PER_DAY,
+        utilization: daily_limit > 0 ? (used.to_f / daily_limit * 100) : (used.to_f / MAX_REQUESTS_PER_DAY * 100),
+        plan: parsed.dig("subscriptionType") || "unknown"
+      )
+    end
+  end
+
+  # ================================
+  #           Securities
+  # ================================
+
+  def search_securities(symbol, country_code: nil, exchange_operating_mic: nil)
+    with_provider_response do
+      enforce_daily_limit!
+      throttle_request
+
+      response = client.get("#{base_url}/api/search/#{CGI.escape(symbol)}") do |req|
+        req.params["api_token"] = api_key
+        req.params["fmt"] = "json"
+      end
+
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
+
+      unless parsed.is_a?(Array)
+        raise Error, "Unexpected response format from search API"
+      end
+
+      parsed.first(25).map do |security|
+        eodhd_exchange = security.dig("Exchange")
+        mic = EODHD_EXCHANGE_TO_MIC[eodhd_exchange]
+        country = EODHD_COUNTRY_TO_CODE[security.dig("Country")]
+        code = security.dig("Code")
+        currency = security.dig("Currency")
+
+        # Cache the API-returned currency so fetch_security_prices can use it
+        if currency.present? && mic.present?
+          cache_key = "eodhd:currency:#{code.upcase}:#{mic}"
+          Rails.cache.write(cache_key, currency, expires_in: 24.hours)
+        end
+
+        Security.new(
+          symbol: code,
+          name: security.dig("Name"),
+          logo_url: nil,
+          exchange_operating_mic: mic,
+          country_code: country,
+          currency: currency
+        )
+      end
+    end
+  end
+
+  def fetch_security_info(symbol:, exchange_operating_mic:)
+    with_provider_response do
+      enforce_daily_limit!
+      throttle_request
+
+      ticker = eodhd_symbol(symbol, exchange_operating_mic)
+
+      response = client.get("#{base_url}/api/fundamentals/#{CGI.escape(ticker)}") do |req|
+        req.params["api_token"] = api_key
+        req.params["fmt"] = "json"
+      end
+
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
+
+      general = parsed.dig("General") || {}
+
+      SecurityInfo.new(
+        symbol: symbol,
+        name: general.dig("Name"),
+        links: general.dig("WebURL"),
+        logo_url: general.dig("LogoURL"),
+        description: general.dig("Description"),
+        kind: general.dig("Type"),
+        exchange_operating_mic: exchange_operating_mic
+      )
+    end
+  end
+
+  def fetch_security_price(symbol:, exchange_operating_mic: nil, date:)
+    with_provider_response do
+      historical_data = fetch_security_prices(symbol:, exchange_operating_mic:, start_date: date, end_date: date)
+
+      raise historical_data.error if historical_data.error.present?
+      raise InvalidSecurityPriceError, "No prices found for security #{symbol} on date #{date}" if historical_data.data.blank?
+
+      historical_data.data.first
+    end
+  end
+
+  def fetch_security_prices(symbol:, exchange_operating_mic: nil, start_date:, end_date:)
+    with_provider_response do
+      enforce_daily_limit!
+      throttle_request
+
+      ticker = eodhd_symbol(symbol, exchange_operating_mic)
+
+      response = client.get("#{base_url}/api/eod/#{CGI.escape(ticker)}") do |req|
+        req.params["api_token"] = api_key
+        req.params["fmt"] = "json"
+        req.params["from"] = start_date.to_s
+        req.params["to"] = end_date.to_s
+      end
+
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
+
+      unless parsed.is_a?(Array)
+        raise InvalidSecurityPriceError, "Unexpected response format from EOD API"
+      end
+
+      # Prefer cached currency from search results; fall back to hardcoded map
+      cache_key = "eodhd:currency:#{symbol.upcase}:#{exchange_operating_mic}"
+      eodhd_exchange = MIC_TO_EODHD_EXCHANGE[exchange_operating_mic]
+      currency = Rails.cache.read(cache_key) || EXCHANGE_CURRENCY[eodhd_exchange]
+
+      parsed.map do |resp|
+        price = resp.dig("close")
+        date = resp.dig("date")
+
+        if price.nil? || price.to_f <= 0
+          Rails.logger.warn("#{self.class.name} returned invalid price data for security #{symbol} on: #{date}.  Price data: #{price.inspect}")
+          next
+        end
+
+        Price.new(
+          symbol: symbol,
+          date: date.to_date,
+          price: price,
+          currency: currency,
+          exchange_operating_mic: exchange_operating_mic
+        )
+      end.compact
+    end
+  end
+
+  private
+    attr_reader :api_key
+
+    def base_url
+      ENV["EODHD_URL"] || "https://eodhd.com"
+    end
+
+    def client
+      @client ||= Faraday.new(url: base_url, ssl: self.class.faraday_ssl_options) do |faraday|
+        faraday.request(:retry, {
+          max: 3,
+          interval: 1.0,
+          interval_randomness: 0.5,
+          backoff_factor: 2,
+          exceptions: Faraday::Retry::Middleware::DEFAULT_EXCEPTIONS + [ Faraday::ConnectionFailed ]
+        })
+
+        faraday.request :json
+        faraday.response :raise_error
+      end
+    end
+
+    # Builds the EODHD ticker format: {SYMBOL}.{EXCHANGE}
+    def eodhd_symbol(symbol, exchange_operating_mic)
+      eodhd_exchange = MIC_TO_EODHD_EXCHANGE[exchange_operating_mic] if exchange_operating_mic.present?
+
+      if eodhd_exchange.present?
+        "#{symbol}.#{eodhd_exchange}"
+      elsif exchange_operating_mic.present?
+        "#{symbol}.#{exchange_operating_mic}"
+      else
+        "#{symbol}.US"
+      end
+    end
+
+    # Cache key for tracking daily API usage
+    def daily_cache_key
+      "eodhd:daily:#{Date.current}"
+    end
+
+    # Enforces the daily rate limit. Raises RateLimitError if the limit is exhausted.
+    # Uses atomic increment-then-check to avoid TOCTOU races between concurrent workers.
+    def enforce_daily_limit!
+      new_count = Rails.cache.increment(daily_cache_key, 1, expires_in: 24.hours).to_i
+
+      if new_count > max_requests_per_day
+        raise RateLimitError, "EODHD daily rate limit of #{max_requests_per_day} requests exhausted"
+      end
+    end
+
+    # throttle_request and min_request_interval provided by RateLimitable
+
+    def max_requests_per_day
+      ENV.fetch("EODHD_MAX_REQUESTS_PER_DAY", MAX_REQUESTS_PER_DAY).to_i
+    end
+
+    def check_api_error!(parsed)
+      return unless parsed.is_a?(Hash) && parsed["error"].present?
+
+      raise Error, "API error: #{parsed["error"]}"
+    end
+end
diff --git a/app/models/provider/exchange_rate_concept.rb b/app/models/provider/exchange_rate_concept.rb
index 744204a27..dc120ba6a 100644
--- a/app/models/provider/exchange_rate_concept.rb
+++ b/app/models/provider/exchange_rate_concept.rb
@@ -10,4 +10,12 @@ module Provider::ExchangeRateConcept
   def fetch_exchange_rates(from:, to:, start_date:, end_date:)
     raise NotImplementedError, "Subclasses must implement #fetch_exchange_rates"
   end
+
+  # Maximum number of calendar days of historical FX data the provider can
+  # return. Returns nil when the provider has no known limit (unbounded).
+  # Callers should clamp start_date when non-nil to avoid requesting data
+  # beyond this window. Override in subclasses with provider-specific limits.
+  def max_history_days
+    nil
+  end
 end
diff --git a/app/models/provider/ibkr_adapter.rb b/app/models/provider/ibkr_adapter.rb
new file mode 100644
index 000000000..639831937
--- /dev/null
+++ b/app/models/provider/ibkr_adapter.rb
@@ -0,0 +1,59 @@
+class Provider::IbkrAdapter < Provider::Base
+  include Provider::Syncable
+  include Provider::InstitutionMetadata
+
+  Provider::Factory.register("IbkrAccount", self)
+
+  def self.supported_account_types
+    %w[Investment]
+  end
+
+  def self.connection_configs(family:)
+    return [] unless family.can_connect_ibkr?
+
+    [ {
+      key: "ibkr",
+      name: I18n.t("providers.ibkr.name"),
+      description: I18n.t("providers.ibkr.connection_description"),
+      can_connect: true,
+      new_account_path: ->(_accountable_type, _return_to) {
+        Rails.application.routes.url_helpers.select_accounts_ibkr_items_path
+      },
+      existing_account_path: ->(account_id) {
+        Rails.application.routes.url_helpers.select_existing_account_ibkr_items_path(account_id: account_id)
+      }
+    } ]
+  end
+
+  def provider_name
+    "ibkr"
+  end
+
+  def sync_path
+    Rails.application.routes.url_helpers.sync_ibkr_item_path(item)
+  end
+
+  def item
+    provider_account.ibkr_item
+  end
+
+  def can_delete_holdings?
+    false
+  end
+
+  def institution_domain
+    "interactivebrokers.com"
+  end
+
+  def institution_name
+    I18n.t("providers.ibkr.institution_name")
+  end
+
+  def institution_url
+    "https://www.interactivebrokers.com"
+  end
+
+  def institution_color
+    "#D32F2F"
+  end
+end
diff --git a/app/models/provider/ibkr_flex.rb b/app/models/provider/ibkr_flex.rb
new file mode 100644
index 000000000..16da5b803
--- /dev/null
+++ b/app/models/provider/ibkr_flex.rb
@@ -0,0 +1,144 @@
+class Provider::IbkrFlex
+  include HTTParty
+  extend SslConfigurable
+
+  class Error < StandardError; end
+  class AuthenticationError < Error; end
+  class ConfigurationError < Error; end
+  class ApiError < Error
+    attr_reader :status_code, :response_body, :error_code
+
+    def initialize(message, status_code: nil, response_body: nil, error_code: nil)
+      super(message)
+      @status_code = status_code
+      @response_body = response_body
+      @error_code = error_code
+    end
+  end
+
+  base_uri "https://ndcdyn.interactivebrokers.com/AccountManagement/FlexWebService"
+  headers "User-Agent" => "Sure Finance IBKR Flex Client"
+  default_options.merge!({ timeout: 120 }.merge(httparty_ssl_options))
+
+  MAX_RETRIES = 3
+  INITIAL_RETRY_DELAY = 2
+  MAX_RETRY_DELAY = 30
+  POLL_INTERVAL = 3
+  MAX_POLL_ATTEMPTS = 20
+  PENDING_ERROR_CODES = %w[1004 1019].freeze
+
+  RETRYABLE_ERRORS = [
+    SocketError,
+    Net::OpenTimeout,
+    Net::ReadTimeout,
+    Errno::ECONNRESET,
+    Errno::ECONNREFUSED,
+    Errno::ETIMEDOUT,
+    EOFError
+  ].freeze
+
+  attr_reader :query_id, :token
+
+  def initialize(query_id:, token:)
+    raise ConfigurationError, "query_id is required" if query_id.blank?
+    raise ConfigurationError, "token is required" if token.blank?
+
+    @query_id = query_id.to_s.strip
+    @token = token.to_s.strip
+  end
+
+  def download_statement
+    reference_code = request_reference_code
+    poll_statement(reference_code)
+  end
+
+  private
+
+    def request_reference_code
+      response = with_retries("SendRequest") do
+        self.class.get("/SendRequest", query: { t: token, q: query_id, v: 3 })
+      end
+
+      xml = parse_xml(response.body)
+      error = response_error(xml, response)
+      raise error if error
+
+      reference_code = xml.at_xpath("//ReferenceCode")&.text.to_s.strip
+      raise ApiError.new("IBKR Flex did not return a reference code.", status_code: response.code, response_body: response.body) if reference_code.blank?
+
+      reference_code
+    end
+
+    def poll_statement(reference_code)
+      attempts = 0
+
+      loop do
+        attempts += 1
+        response = with_retries("GetStatement") do
+          self.class.get("/GetStatement", query: { t: token, q: reference_code, v: 3 })
+        end
+
+        xml = parse_xml(response.body)
+        return response.body if xml.at_xpath("//FlexQueryResponse")
+
+        error = response_error(xml, response)
+        if error.is_a?(ApiError) && PENDING_ERROR_CODES.include?(error.error_code.to_s)
+          raise ApiError.new("IBKR Flex statement is still being generated.", error_code: error.error_code) if attempts >= MAX_POLL_ATTEMPTS
+
+          sleep(POLL_INTERVAL)
+          next
+        end
+
+        raise(error || ApiError.new("IBKR Flex returned an unexpected response.", status_code: response.code, response_body: response.body))
+      end
+    end
+
+    def response_error(xml, response)
+      error_code = xml.at_xpath("//ErrorCode")&.text.to_s.strip.presence
+      error_message = xml.at_xpath("//ErrorMessage")&.text.to_s.strip.presence
+
+      return nil if error_code.blank? && response.success?
+
+      message = error_message.presence || "IBKR Flex request failed"
+
+      case error_code
+      when "1012", "1015"
+        AuthenticationError.new(message)
+      when "1014"
+        ConfigurationError.new(message)
+      else
+        ApiError.new(message, status_code: response.code, response_body: response.body, error_code: error_code)
+      end
+    end
+
+    def parse_xml(body)
+      Nokogiri::XML(body.to_s)
+    end
+
+    def with_retries(operation_name, max_retries: MAX_RETRIES)
+      retries = 0
+
+      begin
+        yield
+      rescue *RETRYABLE_ERRORS => e
+        retries += 1
+
+        if retries <= max_retries
+          delay = calculate_retry_delay(retries)
+          Rails.logger.warn(
+            "IBKR Flex: #{operation_name} failed (attempt #{retries}/#{max_retries}): #{e.class}: #{e.message}. Retrying in #{delay}s..."
+          )
+          sleep(delay)
+          retry
+        end
+
+        raise ApiError.new("Network error after #{max_retries} retries: #{e.message}")
+      end
+    end
+
+    def calculate_retry_delay(retry_count)
+      base_delay = INITIAL_RETRY_DELAY * (2**(retry_count - 1))
+      jitter = base_delay * rand * 0.25
+      [ base_delay + jitter, MAX_RETRY_DELAY ].min
+    end
+end
diff --git a/app/models/provider/indexa_capital.rb b/app/models/provider/indexa_capital.rb
index ad7fc6ca6..52174def6 100644
--- a/app/models/provider/indexa_capital.rb
+++ b/app/models/provider/indexa_capital.rb
@@ -55,6 +55,21 @@ class Provider::IndexaCapital
     end
   end
 
+  # GET /accounts/{account_number}/portfolio → current snapshot with positions.
+  # Used as a fallback when fiscal-results is empty (e.g. pension plans, where
+  # Indexa returns {fiscal_results: [], total_fiscal_results: []} but exposes
+  # the same positions through this endpoint).
+  def get_portfolio(account_number:)
+    sanitize_account_number!(account_number)
+    with_retries("get_portfolio") do
+      response = self.class.get(
+        "#{base_url}/accounts/#{account_number}/portfolio",
+        headers: auth_headers
+      )
+      handle_response(response)
+    end
+  end
+
   # GET /accounts/{account_number}/performance → latest portfolio total_amount
   def get_account_balance(account_number:)
     sanitize_account_number!(account_number)
diff --git a/app/models/provider/kraken.rb b/app/models/provider/kraken.rb
new file mode 100644
index 000000000..38a2db6ca
--- /dev/null
+++ b/app/models/provider/kraken.rb
@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+class Provider::Kraken
+  include HTTParty
+  extend SslConfigurable
+
+  class Error < StandardError; end
+  class AuthenticationError < Error; end
+  class PermissionError < Error; end
+  class RateLimitError < Error; end
+  class NonceError < Error; end
+  class OTPRequiredError < Error; end
+  class ApiError < Error; end
+
+  BASE_URL = "https://api.kraken.com"
+  PRIVATE_PREFIX = "/0/private"
+  PUBLIC_PREFIX = "/0/public"
+
+  base_uri BASE_URL
+  default_options.merge!({ timeout: 30 }.merge(httparty_ssl_options))
+
+  attr_reader :api_key, :api_secret
+
+  def initialize(api_key:, api_secret:, nonce_generator: nil)
+    @api_key = api_key # pipelock:ignore user-supplied Kraken credential kept in memory for signed requests
+    @api_secret = api_secret # pipelock:ignore user-supplied Kraken credential kept in memory for signed requests
+    @nonce_generator = nonce_generator || -> { Process.clock_gettime(Process::CLOCK_REALTIME, :nanosecond).to_s }
+  end
+
+  def get_api_key_info
+    private_post("GetApiKeyInfo")
+  end
+
+  def get_extended_balance
+    private_post("BalanceEx")
+  end
+
+  def get_trades_history(start: nil, offset: nil)
+    params = {}
+    params["start"] = start.to_i.to_s if start.present?
+    params["ofs"] = offset.to_i.to_s if offset.present?
+
+    private_post("TradesHistory", params)
+  end
+
+  def get_asset_info(asset: nil)
+    params = {}
+    params["asset"] = asset if asset.present?
+    public_get("Assets", params)
+  end
+
+  def get_asset_pairs(pair: nil)
+    params = {}
+    params["pair"] = pair if pair.present?
+    public_get("AssetPairs", params)
+  end
+
+  def get_ticker(pair)
+    public_get("Ticker", "pair" => pair)
+  end
+
+  def get_ohlc(pair, interval: 1440, since: nil)
+    params = { "pair" => pair, "interval" => interval.to_s }
+    params["since"] = since.to_i.to_s if since.present?
+    public_get("OHLC", params)
+  end
+
+  private
+
+    attr_reader :nonce_generator
+
+    def public_get(method, params = {})
+      response = self.class.get("#{PUBLIC_PREFIX}/#{method}", query: params)
+      handle_response(response)
+    end
+
+    def private_post(method, params = {})
+      path = "#{PRIVATE_PREFIX}/#{method}"
+      request_params = { "nonce" => nonce_generator.call.to_s }.merge(stringify_params(params))
+      body = URI.encode_www_form(request_params)
+
+      response = self.class.post(
+        path,
+        body: body,
+        headers: auth_headers(path, request_params).merge("Content-Type" => "application/x-www-form-urlencoded")
+      )
+
+      handle_response(response)
+    end
+
+    def stringify_params(params)
+      params.each_with_object({}) { |(key, value), hash| hash[key.to_s] = value.to_s }
+    end
+
+    def auth_headers(path, params)
+      {
+        "API-Key" => api_key,
+        "API-Sign" => sign(path, params)
+      }
+    end
+
+    def sign(path, params)
+      encoded_payload = URI.encode_www_form(params)
+      nonce = params.fetch("nonce").to_s
+      digest = OpenSSL::Digest::SHA256.digest(nonce + encoded_payload)
+      hmac = OpenSSL::HMAC.digest("sha512", Base64.decode64(api_secret), path + digest)
+      Base64.strict_encode64(hmac)
+    end
+
+    def handle_response(response)
+      parsed = response.parsed_response
+
+      unless response.code.between?(200, 299)
+        raise ApiError, "Kraken API request failed: #{response.code}"
+      end
+
+      unless parsed.is_a?(Hash)
+        raise ApiError, "Malformed Kraken API response"
+      end
+
+      unless parsed.key?("error")
+        raise ApiError, "Malformed Kraken API response: missing error"
+      end
+
+      errors = Array(parsed["error"]).reject(&:blank?)
+      raise classified_error(errors) if errors.any?
+
+      unless parsed.key?("result")
+        raise ApiError, "Malformed Kraken API response: missing result"
+      end
+
+      parsed["result"]
+    end
+
+    def classified_error(errors)
+      message = errors.join(", ")
+
+      case message
+      when /Invalid key|Invalid signature|Temporary lockout/i
+        AuthenticationError.new(message)
+      when /Invalid nonce/i
+        NonceError.new(message)
+      when /Permission denied|Invalid permissions/i
+        PermissionError.new(message)
+      when /Rate limit exceeded|Too many requests|limit exceeded|Throttled/i
+        RateLimitError.new(message)
+      when /otp|2fa|two.factor/i
+        OTPRequiredError.new(message)
+      else
+        ApiError.new(message)
+      end
+    end
+end
diff --git a/app/models/provider/kraken_adapter.rb b/app/models/provider/kraken_adapter.rb
new file mode 100644
index 000000000..c932a9efb
--- /dev/null
+++ b/app/models/provider/kraken_adapter.rb
@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+class Provider::KrakenAdapter < Provider::Base
+  include Provider::Syncable
+  include Provider::InstitutionMetadata
+
+  Provider::Factory.register("KrakenAccount", self)
+
+  def self.supported_account_types
+    %w[Crypto]
+  end
+
+  def self.connection_configs(family:)
+    return [] unless family.can_connect_kraken?
+
+    kraken_items = family.kraken_items.active.credentials_configured.ordered.select(&:credentials_configured?)
+    return [ connection_config_for(nil) ] if kraken_items.empty?
+
+    kraken_items.map { |kraken_item| connection_config_for(kraken_item) }
+  end
+
+  def self.build_provider(family: nil, kraken_item_id: nil)
+    return nil unless family.present?
+
+    kraken_item = resolve_kraken_item(family, kraken_item_id)
+    return nil unless kraken_item&.credentials_configured?
+
+    kraken_item.kraken_provider
+  end
+
+  def provider_name
+    "kraken"
+  end
+
+  def sync_path
+    return unless item
+
+    Rails.application.routes.url_helpers.sync_kraken_item_path(item)
+  end
+
+  def item
+    provider_account.kraken_item
+  end
+
+  def can_delete_holdings?
+    false
+  end
+
+  def institution_domain
+    institution_metadata_value("domain")
+  end
+
+  def institution_name
+    institution_metadata_value("name")
+  end
+
+  def institution_url
+    institution_metadata_value("url")
+  end
+
+  def institution_color
+    institution_metadata_value("color")
+  end
+
+  def self.connection_config_for(kraken_item)
+    path_params = ->(extra = {}) do
+      kraken_item.present? ? extra.merge(kraken_item_id: kraken_item.id) : extra
+    end
+
+    {
+      key: kraken_item.present? ? "kraken_#{kraken_item.id}" : "kraken",
+      name: kraken_item.present? ? I18n.t("kraken_items.provider_connection.name", name: kraken_item.name) : I18n.t("kraken_items.provider_connection.default_name"),
+      description: kraken_item.present? ? I18n.t("kraken_items.provider_connection.description", name: kraken_item.name) : I18n.t("kraken_items.provider_connection.default_description"),
+      can_connect: true,
+      new_account_path: ->(accountable_type, return_to) {
+        Rails.application.routes.url_helpers.select_accounts_kraken_items_path(
+          path_params.call(accountable_type: accountable_type, return_to: return_to)
+        )
+      },
+      existing_account_path: ->(account_id) {
+        Rails.application.routes.url_helpers.select_existing_account_kraken_items_path(
+          path_params.call(account_id: account_id)
+        )
+      }
+    }
+  end
+  private_class_method :connection_config_for
+
+  def self.resolve_kraken_item(family, kraken_item_id)
+    if kraken_item_id.present?
+      item = family.kraken_items.active.credentials_configured.find_by(id: kraken_item_id)
+      return item if item&.credentials_configured?
+
+      return nil
+    end
+
+    credentialed_items = family.kraken_items.active.credentials_configured.ordered.select(&:credentials_configured?)
+    return credentialed_items.first if credentialed_items.one?
+
+    nil
+  end
+  private_class_method :resolve_kraken_item
+
+  private
+
+    def institution_metadata_value(key)
+      metadata = provider_account.institution_metadata || {}
+      metadata[key] || item&.public_send("institution_#{key}")
+    end
+end
diff --git a/app/models/provider/llm_concept.rb b/app/models/provider/llm_concept.rb
index 46e6dcd84..52550111f 100644
--- a/app/models/provider/llm_concept.rb
+++ b/app/models/provider/llm_concept.rb
@@ -40,6 +40,7 @@ module Provider::LlmConcept
     instructions: nil,
     functions: [],
     function_results: [],
+    messages: nil,
     streamer: nil,
     previous_response_id: nil,
     session_id: nil,
diff --git a/app/models/provider/mercury_adapter.rb b/app/models/provider/mercury_adapter.rb
index e1a70b839..96f6666ba 100644
--- a/app/models/provider/mercury_adapter.rb
+++ b/app/models/provider/mercury_adapter.rb
@@ -15,23 +15,11 @@ class Provider::MercuryAdapter < Provider::Base
   def self.connection_configs(family:)
     return [] unless family.can_connect_mercury?
 
-    [ {
-      key: "mercury",
-      name: "Mercury",
-      description: "Connect to your bank via Mercury",
-      can_connect: true,
-      new_account_path: ->(accountable_type, return_to) {
-        Rails.application.routes.url_helpers.select_accounts_mercury_items_path(
-          accountable_type: accountable_type,
-          return_to: return_to
-        )
-      },
-      existing_account_path: ->(account_id) {
-        Rails.application.routes.url_helpers.select_existing_account_mercury_items_path(
-          account_id: account_id
-        )
-      }
-    } ]
+    mercury_items = family.mercury_items.active.ordered.select(&:credentials_configured?)
+
+    return [ connection_config_for(nil) ] if mercury_items.empty?
+
+    mercury_items.map { |mercury_item| connection_config_for(mercury_item) }
   end
 
   def provider_name
@@ -41,19 +29,54 @@ class Provider::MercuryAdapter < Provider::Base
   # Build a Mercury provider instance with family-specific credentials
   # @param family [Family] The family to get credentials for (required)
   # @return [Provider::Mercury, nil] Returns nil if credentials are not configured
-  def self.build_provider(family: nil)
+  def self.build_provider(family: nil, mercury_item_id: nil)
     return nil unless family.present?
 
-    # Get family-specific credentials
-    mercury_item = family.mercury_items.where.not(token: nil).first
+    mercury_item = resolve_mercury_item(family, mercury_item_id)
     return nil unless mercury_item&.credentials_configured?
 
     Provider::Mercury.new(
-      mercury_item.token,
+      mercury_item.token.to_s.strip,
       base_url: mercury_item.effective_base_url
     )
   end
 
+  def self.connection_config_for(mercury_item)
+    path_params = ->(extra = {}) do
+      mercury_item.present? ? extra.merge(mercury_item_id: mercury_item.id) : extra
+    end
+
+    {
+      key: mercury_item.present? ? "mercury_#{mercury_item.id}" : "mercury",
+      name: mercury_item.present? ? I18n.t("mercury_items.provider_connection.name", name: mercury_item.name) : I18n.t("mercury_items.provider_connection.default_name"),
+      description: mercury_item.present? ? I18n.t("mercury_items.provider_connection.description", name: mercury_item.name) : I18n.t("mercury_items.provider_connection.default_description"),
+      can_connect: true,
+      new_account_path: ->(accountable_type, return_to) {
+        Rails.application.routes.url_helpers.select_accounts_mercury_items_path(
+          path_params.call(accountable_type: accountable_type, return_to: return_to)
+        )
+      },
+      existing_account_path: ->(account_id) {
+        Rails.application.routes.url_helpers.select_existing_account_mercury_items_path(
+          path_params.call(account_id: account_id)
+        )
+      }
+    }
+  end
+  private_class_method :connection_config_for
+
+  def self.resolve_mercury_item(family, mercury_item_id)
+    if mercury_item_id.present?
+      item = family.mercury_items.active.find_by(id: mercury_item_id)
+      return item if item&.credentials_configured?
+
+      return nil
+    end
+
+    family.mercury_items.active.ordered.find(&:credentials_configured?)
+  end
+  private_class_method :resolve_mercury_item
+
   def sync_path
     Rails.application.routes.url_helpers.sync_mercury_item_path(item)
   end
diff --git a/app/models/provider/metadata.rb b/app/models/provider/metadata.rb
new file mode 100644
index 000000000..4c8263b8a
--- /dev/null
+++ b/app/models/provider/metadata.rb
@@ -0,0 +1,25 @@
+class Provider
+  module Metadata
+    REGISTRY = {
+      simplefin:      { region: "US",      kind: "Bank",       maturity: :stable, logo_text: "SF", logo_bg: "bg-blue-600" },
+      lunchflow:      { region: "US",      kind: "Bank",       maturity: :stable, logo_text: "LF", logo_bg: "bg-orange-500" },
+      enable_banking: { region: "EU",      kind: "Bank",       maturity: :beta,   logo_text: "EB", logo_bg: "bg-purple-600" },
+      coinstats:      { region: "Global",  kind: "Crypto",     maturity: :beta,   logo_text: "CS", logo_bg: "bg-pink-600" },
+      mercury:        { region: "US",      kind: "Bank",       maturity: :beta,   logo_text: "ME", logo_bg: "bg-cyan-600" },
+      brex:           { region: "US",      kind: "Bank",       maturity: :beta,   logo_text: "BX", logo_bg: "bg-emerald-600" },
+      coinbase:       { region: "Global",  kind: "Crypto",     maturity: :beta,   logo_text: "CB", logo_bg: "bg-blue-500" },
+      binance:        { region: "Global",  kind: "Crypto",     maturity: :beta,   logo_text: "BI", logo_bg: "bg-yellow-600" },
+      kraken:         { region: "Global",  kind: "Crypto",     maturity: :beta,   logo_text: "KR", logo_bg: "bg-violet-600" },
+      snaptrade:      { region: "US / CA", kind: "Investment", maturity: :beta,   logo_text: "ST", logo_bg: "bg-green-600" },
+      ibkr:           { region: "Global",  kind: "Investment", maturity: :beta,   logo_text: "IB", logo_bg: "bg-red-600" },
+      indexa_capital: { region: "ES",      kind: "Investment", maturity: :alpha,  logo_text: "IC", logo_bg: "bg-red-600" },
+      sophtron:       { region: "US",      kind: "Bank",       maturity: :alpha,  logo_text: "SO", logo_bg: "bg-teal-600" },
+      plaid:          { region: "US",      kind: "Bank",       tier: "Paid", maturity: :stable, logo_text: "PL", logo_bg: "bg-indigo-600" },
+      plaid_eu:       { name: "Plaid EU", region: "EU",        kind: "Bank",       tier: "Paid", maturity: :stable, logo_text: "PL", logo_bg: "bg-indigo-600" }
+    }.freeze
+
+    def self.for(provider_key)
+      REGISTRY[provider_key.to_sym] || { logo_text: provider_key.to_s.first(2).upcase, logo_bg: "bg-gray-500" }
+    end
+  end
+end
diff --git a/app/models/provider/mfapi.rb b/app/models/provider/mfapi.rb
new file mode 100644
index 000000000..0e597891f
--- /dev/null
+++ b/app/models/provider/mfapi.rb
@@ -0,0 +1,168 @@
+class Provider::Mfapi < Provider
+  include SecurityConcept, RateLimitable
+  extend SslConfigurable
+
+  Error = Class.new(Provider::Error)
+  InvalidSecurityPriceError = Class.new(Error)
+  RateLimitError = Class.new(Error)
+
+  # Minimum delay between requests
+  MIN_REQUEST_INTERVAL = 0.5
+
+  def initialize
+    # No API key required
+  end
+
+  def healthy?
+    with_provider_response do
+      response = client.get("#{base_url}/mf/125497/latest")
+      parsed = JSON.parse(response.body)
+      parsed.dig("meta", "scheme_name").present?
+    end
+  end
+
+  def usage
+    with_provider_response do
+      UsageData.new(
+        used: nil,
+        limit: nil,
+        utilization: nil,
+        plan: "Free (no key required)"
+      )
+    end
+  end
+
+  # ================================
+  #           Securities
+  # ================================
+
+  def search_securities(symbol, country_code: nil, exchange_operating_mic: nil)
+    with_provider_response do
+      throttle_request
+      response = client.get("#{base_url}/mf/search") do |req|
+        req.params["q"] = symbol
+      end
+
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
+
+      unless parsed.is_a?(Array)
+        raise Error, "Unexpected response format from search endpoint"
+      end
+
+      parsed.first(25).map do |fund|
+        Security.new(
+          symbol: fund["schemeCode"].to_s,
+          name: fund["schemeName"],
+          logo_url: nil,
+          exchange_operating_mic: "XBOM",
+          country_code: "IN",
+          currency: "INR"
+        )
+      end
+    end
+  end
+
+  def fetch_security_info(symbol:, exchange_operating_mic:)
+    with_provider_response do
+      throttle_request
+      response = client.get("#{base_url}/mf/#{CGI.escape(symbol)}/latest")
+
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
+
+      meta = parsed["meta"] || {}
+
+      SecurityInfo.new(
+        symbol: symbol,
+        name: meta["scheme_name"],
+        links: nil,
+        logo_url: nil,
+        description: [ meta["fund_house"], meta["scheme_category"] ].compact.join(" - "),
+        kind: "mutual fund",
+        exchange_operating_mic: exchange_operating_mic
+      )
+    end
+  end
+
+  def fetch_security_price(symbol:, exchange_operating_mic: nil, date:)
+    with_provider_response do
+      historical_data = fetch_security_prices(symbol:, exchange_operating_mic:, start_date: date - 7.days, end_date: date)
+
+      raise historical_data.error if historical_data.error.present?
+      raise InvalidSecurityPriceError, "No NAV found for scheme #{symbol} on or before #{date}" if historical_data.data.blank?
+
+      # Find exact date or closest previous
+      historical_data.data.select { |p| p.date <= date }.max_by(&:date) || historical_data.data.first
+    end
+  end
+
+  def fetch_security_prices(symbol:, exchange_operating_mic: nil, start_date:, end_date:)
+    with_provider_response do
+      throttle_request
+      response = client.get("#{base_url}/mf/#{CGI.escape(symbol)}") do |req|
+        req.params["startDate"] = start_date.to_s
+        req.params["endDate"] = end_date.to_s
+      end
+
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
+
+      nav_data = parsed["data"]
+
+      if nav_data.nil? || !nav_data.is_a?(Array)
+        raise InvalidSecurityPriceError, "No NAV data returned for scheme #{symbol}"
+      end
+
+      nav_data.filter_map do |entry|
+        nav = entry["nav"]
+        date_str = entry["date"]
+
+        next if nav.nil? || nav.to_f <= 0 || date_str.blank?
+
+        # MFAPI returns dates as DD-MM-YYYY
+        date = Date.strptime(date_str, "%d-%m-%Y")
+
+        Price.new(
+          symbol: symbol,
+          date: date,
+          price: nav.to_f,
+          currency: "INR",
+          exchange_operating_mic: exchange_operating_mic
+        )
+      end
+    end
+  end
+
+  private
+
+    def base_url
+      ENV["MFAPI_URL"] || "https://api.mfapi.in"
+    end
+
+    def client
+      @client ||= Faraday.new(url: base_url, ssl: self.class.faraday_ssl_options) do |faraday|
+        faraday.request(:retry, {
+          max: 3,
+          interval: 1.0,
+          interval_randomness: 0.5,
+          backoff_factor: 2,
+          exceptions: Faraday::Retry::Middleware::DEFAULT_EXCEPTIONS + [ Faraday::ConnectionFailed ]
+        })
+
+        faraday.request :json
+        faraday.response :raise_error
+        faraday.headers["Accept"] = "application/json"
+      end
+    end
+
+    # throttle_request and min_request_interval provided by RateLimitable
+
+    def check_api_error!(parsed)
+      return unless parsed.is_a?(Hash)
+
+      if parsed["status"] == "ERROR" || parsed["status"] == "FAIL"
+        raise Error, "API error: #{parsed['message'] || parsed['status']}"
+      end
+    end
+end
diff --git a/app/models/provider/openai.rb b/app/models/provider/openai.rb
index 60c103a9e..0c04f63e1 100644
--- a/app/models/provider/openai.rb
+++ b/app/models/provider/openai.rb
@@ -4,31 +4,29 @@ class Provider::Openai < Provider
   # Subclass so errors caught in this provider are raised as Provider::Openai::Error
   Error = Class.new(Provider::Error)
 
-  # Supported OpenAI model prefixes (e.g., "gpt-4" matches "gpt-4", "gpt-4.1", "gpt-4-turbo", etc.)
-  DEFAULT_OPENAI_MODEL_PREFIXES = %w[gpt-4 gpt-5 o1 o3]
-  DEFAULT_MODEL = "gpt-4.1"
-
-  # Models that support PDF/vision input (not all OpenAI models have vision capabilities)
+  DEFAULT_MODEL = "gpt-4.1".freeze
+  SUPPORTED_MODELS = %w[gpt-4 gpt-5 o1 o3].freeze
   VISION_CAPABLE_MODEL_PREFIXES = %w[gpt-4o gpt-4-turbo gpt-4.1 gpt-5 o1 o3].freeze
 
-  # Returns the effective model that would be used by the provider
-  # Uses the same logic as Provider::Registry and the initializer
+  # Returns the effective model that would be used by the provider.
+  # Priority: explicit ENV > Setting > DEFAULT_MODEL.
   def self.effective_model
-    configured_model = ENV.fetch("OPENAI_MODEL", Setting.openai_model)
-    configured_model.presence || DEFAULT_MODEL
+    ENV.fetch("OPENAI_MODEL") { Setting.openai_model }.presence || DEFAULT_MODEL
   end
 
   def initialize(access_token, uri_base: nil, model: nil)
     client_options = { access_token: access_token }
-    client_options[:uri_base] = uri_base if uri_base.present?
+    llm_uri_base = uri_base.presence
+    llm_model = model.presence
+    client_options[:uri_base] = llm_uri_base if llm_uri_base.present?
     client_options[:request_timeout] = ENV.fetch("OPENAI_REQUEST_TIMEOUT", 60).to_i
 
     @client = ::OpenAI::Client.new(**client_options)
-    @uri_base = uri_base
-    if custom_provider? && model.blank?
+    @uri_base = llm_uri_base
+    if custom_provider? && llm_model.blank?
       raise Error, "Model is required when using a custom OpenAI‑compatible provider"
     end
-    @default_model = model.presence || DEFAULT_MODEL
+    @default_model = llm_model.presence || self.class.effective_model
   end
 
   def supports_model?(model)
@@ -36,7 +34,18 @@ class Provider::Openai < Provider
     return true if custom_provider?
 
     # Otherwise, check if model starts with any supported OpenAI prefix
-    DEFAULT_OPENAI_MODEL_PREFIXES.any? { |prefix| model.start_with?(prefix) }
+    SUPPORTED_MODELS.any? { |prefix| model.start_with?(prefix) }
+  end
+
+  def supports_responses_endpoint?
+    return @supports_responses_endpoint if defined?(@supports_responses_endpoint)
+
+    env_override = ENV["OPENAI_SUPPORTS_RESPONSES_ENDPOINT"]
+    if env_override.to_s.present?
+      return @supports_responses_endpoint = ActiveModel::Type::Boolean.new.cast(env_override)
+    end
+
+    @supports_responses_endpoint = !custom_provider?
   end
 
   def provider_name
@@ -47,7 +56,7 @@ class Provider::Openai < Provider
     if custom_provider?
       @default_model.present? ? "configured model: #{@default_model}" : "any model"
     else
-      "models starting with: #{DEFAULT_OPENAI_MODEL_PREFIXES.join(', ')}"
+      "models starting with: #{SUPPORTED_MODELS.join(", ")}"
     end
   end
 
@@ -55,9 +64,43 @@ class Provider::Openai < Provider
     @uri_base.present?
   end
 
+  # Token-budget knobs. Precedence: ENV > Setting > default. Defaults match
+  # Ollama's historical 2048-token baseline so local small-context models work
+  # out of the box. Users on larger-context cloud models can raise via ENV or
+  # via the Self-Hosting settings page.
+  def context_window
+    positive_budget(ENV["LLM_CONTEXT_WINDOW"], Setting.llm_context_window, 2048)
+  end
+
+  def max_response_tokens
+    positive_budget(ENV["LLM_MAX_RESPONSE_TOKENS"], Setting.llm_max_response_tokens, 512)
+  end
+
+  def system_prompt_reserve
+    positive_budget(ENV["LLM_SYSTEM_PROMPT_RESERVE"], nil, 256)
+  end
+
+  def max_history_tokens
+    explicit = ENV["LLM_MAX_HISTORY_TOKENS"].presence&.to_i
+    return explicit if explicit&.positive?
+    [ context_window - max_response_tokens - system_prompt_reserve, 256 ].max
+  end
+
+  # Budget available for a one-shot (non-chat) request's full input,
+  # excluding reserved response tokens AND the system/instructions prompt.
+  # Drives the batch slicer for the auto_categorize / auto_detect_merchants /
+  # enhance_provider_merchants calls — each ships ~200–400 tokens of
+  # instructions + JSON schema that aren't counted in `fixed_tokens`.
+  def max_input_tokens
+    [ context_window - max_response_tokens - system_prompt_reserve, 256 ].max
+  end
+
+  def max_items_per_call
+    positive_budget(ENV["LLM_MAX_ITEMS_PER_CALL"], Setting.llm_max_items_per_call, 25)
+  end
+
   def auto_categorize(transactions: [], user_categories: [], model: "", family: nil, json_mode: nil)
     with_provider_response do
-      raise Error, "Too many transactions to auto-categorize. Max is 25 per request." if transactions.size > 25
       if user_categories.blank?
         family_id = family&.id || "unknown"
         Rails.logger.error("Cannot auto-categorize transactions for family #{family_id}: no categories available")
@@ -71,16 +114,20 @@ class Provider::Openai < Provider
         input: { transactions: transactions, user_categories: user_categories }
       )
 
-      result = AutoCategorizer.new(
-        client,
-        model: effective_model,
-        transactions: transactions,
-        user_categories: user_categories,
-        custom_provider: custom_provider?,
-        langfuse_trace: trace,
-        family: family,
-        json_mode: json_mode
-      ).auto_categorize
+      batches = slice_for_context(transactions, fixed: user_categories)
+
+      result = batches.flat_map do |batch|
+        AutoCategorizer.new(
+          client,
+          model: effective_model,
+          transactions: batch,
+          user_categories: user_categories,
+          custom_provider: custom_provider?,
+          langfuse_trace: trace,
+          family: family,
+          json_mode: json_mode
+        ).auto_categorize
+      end
 
       upsert_langfuse_trace(trace: trace, output: result.map(&:to_h))
 
@@ -90,8 +137,6 @@ class Provider::Openai < Provider
 
   def auto_detect_merchants(transactions: [], user_merchants: [], model: "", family: nil, json_mode: nil)
     with_provider_response do
-      raise Error, "Too many transactions to auto-detect merchants. Max is 25 per request." if transactions.size > 25
-
       effective_model = model.presence || @default_model
 
       trace = create_langfuse_trace(
@@ -99,16 +144,20 @@ class Provider::Openai < Provider
         input: { transactions: transactions, user_merchants: user_merchants }
       )
 
-      result = AutoMerchantDetector.new(
-        client,
-        model: effective_model,
-        transactions: transactions,
-        user_merchants: user_merchants,
-        custom_provider: custom_provider?,
-        langfuse_trace: trace,
-        family: family,
-        json_mode: json_mode
-      ).auto_detect_merchants
+      batches = slice_for_context(transactions, fixed: user_merchants)
+
+      result = batches.flat_map do |batch|
+        AutoMerchantDetector.new(
+          client,
+          model: effective_model,
+          transactions: batch,
+          user_merchants: user_merchants,
+          custom_provider: custom_provider?,
+          langfuse_trace: trace,
+          family: family,
+          json_mode: json_mode
+        ).auto_detect_merchants
+      end
 
       upsert_langfuse_trace(trace: trace, output: result.map(&:to_h))
 
@@ -118,8 +167,6 @@ class Provider::Openai < Provider
 
   def enhance_provider_merchants(merchants: [], model: "", family: nil, json_mode: nil)
     with_provider_response do
-      raise Error, "Too many merchants to enhance. Max is 25 per request." if merchants.size > 25
-
       effective_model = model.presence || @default_model
 
       trace = create_langfuse_trace(
@@ -127,15 +174,19 @@ class Provider::Openai < Provider
         input: { merchants: merchants }
       )
 
-      result = ProviderMerchantEnhancer.new(
-        client,
-        model: effective_model,
-        merchants: merchants,
-        custom_provider: custom_provider?,
-        langfuse_trace: trace,
-        family: family,
-        json_mode: json_mode
-      ).enhance_merchants
+      batches = slice_for_context(merchants)
+
+      result = batches.flat_map do |batch|
+        ProviderMerchantEnhancer.new(
+          client,
+          model: effective_model,
+          merchants: batch,
+          custom_provider: custom_provider?,
+          langfuse_trace: trace,
+          family: family,
+          json_mode: json_mode
+        ).enhance_merchants
+      end
 
       upsert_langfuse_trace(trace: trace, output: result.map(&:to_h))
 
@@ -171,7 +222,8 @@ class Provider::Openai < Provider
         pdf_content: pdf_content,
         custom_provider: custom_provider?,
         langfuse_trace: trace,
-        family: family
+        family: family,
+        max_response_tokens: max_response_tokens
       ).process
 
       upsert_langfuse_trace(trace: trace, output: result.to_h)
@@ -207,25 +259,17 @@ class Provider::Openai < Provider
     instructions: nil,
     functions: [],
     function_results: [],
+    messages: nil,
     streamer: nil,
     previous_response_id: nil,
     session_id: nil,
     user_identifier: nil,
     family: nil
   )
-    if custom_provider?
-      generic_chat_response(
-        prompt: prompt,
-        model: model,
-        instructions: instructions,
-        functions: functions,
-        function_results: function_results,
-        streamer: streamer,
-        session_id: session_id,
-        user_identifier: user_identifier,
-        family: family
-      )
-    else
+    if supports_responses_endpoint?
+      # Native path uses the Responses API which chains history via
+      # `previous_response_id`; it does NOT need (and must not receive)
+      # inline message history in the input payload.
       native_chat_response(
         prompt: prompt,
         model: model,
@@ -238,12 +282,48 @@ class Provider::Openai < Provider
         user_identifier: user_identifier,
         family: family
       )
+    else
+      generic_chat_response(
+        prompt: prompt,
+        model: model,
+        instructions: instructions,
+        functions: functions,
+        function_results: function_results,
+        messages: messages,
+        streamer: streamer,
+        session_id: session_id,
+        user_identifier: user_identifier,
+        family: family
+      )
     end
   end
 
   private
     attr_reader :client
 
+    # Returns the first positive integer among env, setting, default. Treats
+    # zero or negative values as "unset" and falls through — a 0-token budget
+    # is never what the user meant.
+    def positive_budget(env_value, setting_value, default)
+      from_env = env_value.to_s.strip.to_i
+      return from_env if from_env.positive?
+      return setting_value.to_i if setting_value.to_i.positive?
+      default
+    end
+
+    # Routes one-shot (non-chat) inputs through the BatchSlicer so large
+    # caller batches are split to fit the model's context window. `fixed` is
+    # the portion of the prompt that stays constant across every sub-batch
+    # (e.g. user_categories, user_merchants), used for fixed-tokens accounting.
+    def slice_for_context(items, fixed: nil)
+      BatchSlicer.call(
+        Array(items),
+        max_items: max_items_per_call,
+        max_tokens: max_input_tokens,
+        fixed_tokens: fixed ? Assistant::TokenEstimator.estimate(fixed) : 0
+      )
+    end
+
     def native_chat_response(
       prompt:,
       model:,
@@ -278,7 +358,7 @@ class Provider::Openai < Provider
           nil
         end
 
-        input_payload = chat_config.build_input(prompt)
+        input_payload = chat_config.build_input(prompt: prompt)
 
         begin
           raw_response = client.responses.create(parameters: {
@@ -293,7 +373,16 @@ class Provider::Openai < Provider
           # If streaming, Ruby OpenAI does not return anything, so to normalize this method's API, we search
           # for the "response chunk" in the stream and return it (it is already parsed)
           if stream_proxy.present?
+            error_chunk = collected_chunks.find { |chunk| chunk.type == "error" }
             response_chunk = collected_chunks.find { |chunk| chunk.type == "response" }
+
+            if response_chunk.nil?
+              raise Error.new(
+                build_stream_error_message(error_chunk),
+                details: error_chunk&.data&.details
+              )
+            end
+
             response = response_chunk.data
             usage = response_chunk.usage
             Rails.logger.debug("Stream response usage: #{usage.inspect}")
@@ -344,6 +433,7 @@ class Provider::Openai < Provider
       instructions: nil,
       functions: [],
       function_results: [],
+      messages: nil,
       streamer: nil,
       session_id: nil,
       user_identifier: nil,
@@ -353,7 +443,8 @@ class Provider::Openai < Provider
         messages = build_generic_messages(
           prompt: prompt,
           instructions: instructions,
-          function_results: function_results
+          function_results: function_results,
+          messages: messages
         )
 
         tools = build_generic_tools(functions)
@@ -412,16 +503,24 @@ class Provider::Openai < Provider
       end
     end
 
-    def build_generic_messages(prompt:, instructions: nil, function_results: [])
-      messages = []
+    def build_generic_messages(prompt:, instructions: nil, function_results: [], messages: nil)
+      payload = []
 
       # Add system message if instructions present
       if instructions.present?
-        messages << { role: "system", content: instructions }
+        payload << { role: "system", content: instructions }
       end
 
-      # Add user prompt
-      messages << { role: "user", content: prompt }
+      # Add conversation history or user prompt. History is trimmed to fit the
+      # configured token budget so small-context local models (Ollama, LM Studio,
+      # LocalAI) don't silently truncate. tool_call/tool_result pairs are
+      # preserved atomically by HistoryTrimmer.
+      if messages.present?
+        trimmed = Assistant::HistoryTrimmer.new(messages, max_tokens: max_history_tokens).call
+        payload.concat(trimmed)
+      elsif prompt.present?
+        payload << { role: "user", content: prompt }
+      end
 
       # If there are function results, we need to add the assistant message that made the tool calls
       # followed by the tool messages with the results
@@ -442,7 +541,7 @@ class Provider::Openai < Provider
           }
         end
 
-        messages << {
+        payload << {
           role: "assistant",
           content: "",  # Some OpenAI-compatible APIs require string, not null
           tool_calls: tool_calls
@@ -462,7 +561,7 @@ class Provider::Openai < Provider
             output.to_json
           end
 
-          messages << {
+          payload << {
             role: "tool",
             tool_call_id: fn_result[:call_id],
             name: fn_result[:name],
@@ -471,7 +570,7 @@ class Provider::Openai < Provider
         end
       end
 
-      messages
+      payload
     end
 
     def build_generic_tools(functions)
@@ -654,4 +753,27 @@ class Provider::Openai < Provider
     rescue => e
       "(message unavailable: #{e.class})"
     end
+
+    # Builds a useful error message when the OpenAI Responses stream ended
+    # without delivering a `response.completed` event. Uses upstream details
+    # when present (e.g. `response.failed`, `response.incomplete`, top-level
+    # `error`) and falls back to a generic message that hints at the most
+    # common causes.
+    def build_stream_error_message(error_chunk)
+      if error_chunk&.data&.message.present?
+        upstream = error_chunk.data
+        prefix = case upstream.event
+        when "response.incomplete" then "OpenAI response was incomplete"
+        when "response.failed"     then "OpenAI response failed"
+        else                            "OpenAI returned an error"
+        end
+        code_suffix = upstream.code.present? ? " [#{upstream.code}]" : ""
+        "#{prefix}#{code_suffix}: #{upstream.message}"
+      else
+        "OpenAI stream ended without a completion event. " \
+        "This usually means the upstream call was cut short — common causes: " \
+        "expired previous_response_id (Responses API state TTL), context-length overflow, " \
+        "or a transient OpenAI error."
+      end
+    end
 end
diff --git a/app/models/provider/openai/batch_slicer.rb b/app/models/provider/openai/batch_slicer.rb
new file mode 100644
index 000000000..577ddba5d
--- /dev/null
+++ b/app/models/provider/openai/batch_slicer.rb
@@ -0,0 +1,45 @@
+class Provider::Openai::BatchSlicer
+  class ContextOverflowError < StandardError; end
+
+  # Splits `items` into sub-batches that respect both a hard item cap and a
+  # token-budget cap. Used by auto_categorize / auto_detect_merchants /
+  # enhance_provider_merchants so callers can pass larger batches and have the
+  # provider fan them out to fit small-context models.
+  def self.call(items, max_items:, max_tokens:, fixed_tokens: 0)
+    items = Array(items)
+    return [] if items.empty?
+
+    available = max_tokens.to_i - fixed_tokens.to_i
+    if available <= 0
+      raise ContextOverflowError,
+            "Fixed prompt tokens (#{fixed_tokens}) exceed context budget (#{max_tokens})"
+    end
+
+    batches = []
+    current = []
+    current_tokens = 0
+
+    items.each do |item|
+      item_tokens = Assistant::TokenEstimator.estimate(item)
+      if item_tokens > available
+        raise ContextOverflowError,
+              "Single item requires ~#{item_tokens} tokens, which exceeds available budget (#{available})"
+      end
+
+      would_exceed_items  = current.size >= max_items.to_i
+      would_exceed_tokens = current_tokens + item_tokens > available
+
+      if would_exceed_items || would_exceed_tokens
+        batches << current unless current.empty?
+        current = []
+        current_tokens = 0
+      end
+
+      current << item
+      current_tokens += item_tokens
+    end
+
+    batches << current unless current.empty?
+    batches
+  end
+end
diff --git a/app/models/provider/openai/chat_config.rb b/app/models/provider/openai/chat_config.rb
index 5e98a66ce..65e683de4 100644
--- a/app/models/provider/openai/chat_config.rb
+++ b/app/models/provider/openai/chat_config.rb
@@ -16,7 +16,9 @@ class Provider::Openai::ChatConfig
     end
   end
 
-  def build_input(prompt)
+  def build_input(prompt: nil)
+    input_messages = prompt.present? ? [ { role: "user", content: prompt } ] : []
+
     results = function_results.map do |fn_result|
       # Handle nil explicitly to avoid serializing to "null"
       output = fn_result[:output]
@@ -36,7 +38,7 @@ class Provider::Openai::ChatConfig
     end
 
     [
-      { role: "user", content: prompt },
+      *input_messages,
       *results
     ]
   end
diff --git a/app/models/provider/openai/chat_stream_parser.rb b/app/models/provider/openai/chat_stream_parser.rb
index dcfe44207..294a317a8 100644
--- a/app/models/provider/openai/chat_stream_parser.rb
+++ b/app/models/provider/openai/chat_stream_parser.rb
@@ -1,6 +1,8 @@
 class Provider::Openai::ChatStreamParser
   Error = Class.new(StandardError)
 
+  StreamErrorData = Data.define(:event, :message, :code, :details)
+
   def initialize(object)
     @object = object
   end
@@ -15,6 +17,21 @@ class Provider::Openai::ChatStreamParser
       raw_response = object.dig("response")
       usage = raw_response.dig("usage")
       Chunk.new(type: "response", data: parse_response(raw_response), usage: usage)
+    when "response.failed"
+      Chunk.new(type: "error", data: build_response_error("response.failed"), usage: nil)
+    when "response.incomplete"
+      Chunk.new(type: "error", data: build_response_error("response.incomplete"), usage: nil)
+    when "error"
+      Chunk.new(
+        type: "error",
+        data: StreamErrorData.new(
+          event: "error",
+          message: object.dig("message").presence || "OpenAI stream returned an error event",
+          code: object.dig("code"),
+          details: object
+        ),
+        usage: nil
+      )
     end
   end
 
@@ -26,4 +43,22 @@ class Provider::Openai::ChatStreamParser
     def parse_response(response)
       Provider::Openai::ChatParser.new(response).parsed
     end
+
+    def build_response_error(event)
+      raw_response = object.dig("response") || {}
+      error_message =
+        raw_response.dig("error", "message").presence ||
+        raw_response.dig("incomplete_details", "reason").presence ||
+        "OpenAI stream ended with #{event}"
+      code =
+        raw_response.dig("error", "code") ||
+        raw_response.dig("incomplete_details", "reason")
+
+      StreamErrorData.new(
+        event: event,
+        message: error_message,
+        code: code,
+        details: raw_response
+      )
+    end
 end
diff --git a/app/models/provider/openai/pdf_processor.rb b/app/models/provider/openai/pdf_processor.rb
index f65510e87..1cb63e773 100644
--- a/app/models/provider/openai/pdf_processor.rb
+++ b/app/models/provider/openai/pdf_processor.rb
@@ -1,15 +1,16 @@
 class Provider::Openai::PdfProcessor
   include Provider::Openai::Concerns::UsageRecorder
 
-  attr_reader :client, :model, :pdf_content, :custom_provider, :langfuse_trace, :family
+  attr_reader :client, :model, :pdf_content, :custom_provider, :langfuse_trace, :family, :max_response_tokens
 
-  def initialize(client, model: "", pdf_content: nil, custom_provider: false, langfuse_trace: nil, family: nil)
+  def initialize(client, model: "", pdf_content: nil, custom_provider: false, langfuse_trace: nil, family: nil, max_response_tokens:)
     @client = client
     @model = model
     @pdf_content = pdf_content
     @custom_provider = custom_provider
     @langfuse_trace = langfuse_trace
     @family = family
+    @max_response_tokens = max_response_tokens
   end
 
   def process
@@ -175,7 +176,7 @@ class Provider::Openai::PdfProcessor
           { role: "system", content: instructions + "\n\nIMPORTANT: Respond with valid JSON only, no markdown or other formatting." },
           { role: "user", content: content }
         ],
-        max_tokens: 4096
+        max_tokens: max_response_tokens
       }
 
       response = client.chat(parameters: params)
diff --git a/app/models/provider/plaid_adapter.rb b/app/models/provider/plaid_adapter.rb
index ac4fd8187..f75c5d97f 100644
--- a/app/models/provider/plaid_adapter.rb
+++ b/app/models/provider/plaid_adapter.rb
@@ -80,13 +80,6 @@ class Provider::PlaidAdapter < Provider::Base
 
   # Configuration for Plaid US
   configure do
-    description <<~DESC
-      Setup instructions:
-      1. Visit the [Plaid Dashboard](https://dashboard.plaid.com/team/keys) to get your API credentials
-      2. Your Client ID and Secret Key are required to enable Plaid bank sync for US/CA banks
-      3. For production use, set environment to 'production', for testing use 'sandbox'
-    DESC
-
     field :client_id,
           label: "Client ID",
           required: false,
diff --git a/app/models/provider/plaid_eu_adapter.rb b/app/models/provider/plaid_eu_adapter.rb
index 497bb13c4..6db5331a0 100644
--- a/app/models/provider/plaid_eu_adapter.rb
+++ b/app/models/provider/plaid_eu_adapter.rb
@@ -19,13 +19,6 @@ class Provider::PlaidEuAdapter
 
   # Configuration for Plaid EU
   configure do
-    description <<~DESC
-      Setup instructions:
-      1. Visit the [Plaid Dashboard](https://dashboard.plaid.com/team/keys) to get your API credentials
-      2. Your Client ID and Secret Key are required to enable Plaid bank sync for European banks
-      3. For production use, set environment to 'production', for testing use 'sandbox'
-    DESC
-
     field :client_id,
           label: "Client ID",
           required: false,
diff --git a/app/models/provider/rate_limitable.rb b/app/models/provider/rate_limitable.rb
new file mode 100644
index 000000000..f1c1ca2d2
--- /dev/null
+++ b/app/models/provider/rate_limitable.rb
@@ -0,0 +1,59 @@
+# Shared concern for providers that need interval-based request throttling
+# and a standard error transformation pattern.
+#
+# Providers that include this concern get:
+# - `throttle_request`: sleeps to enforce MIN_REQUEST_INTERVAL between calls
+# - `min_request_interval`: reads from ENV with fallback to the class constant
+# - `default_error_transformer`: maps Faraday/rate-limit errors to provider-scoped types
+#
+# The including class MUST define:
+# - `MIN_REQUEST_INTERVAL` (Float) — default seconds between requests
+# - `Error` (Class)           — provider-scoped error class
+# - `RateLimitError` (Class)  — provider-scoped rate-limit error class
+#
+# And MAY define a `PROVIDER_ENV_PREFIX` constant (e.g. "ALPHA_VANTAGE") used
+# to derive the ENV key for the min request interval override.  When omitted
+# the prefix is derived from the class name (Provider::AlphaVantage → "ALPHA_VANTAGE").
+module Provider::RateLimitable
+  extend ActiveSupport::Concern
+
+  private
+    # Enforces a minimum interval between consecutive requests on this instance.
+    # Subclasses that need additional rate-limit layers (daily counters, hourly
+    # counters) should call `super` or invoke this via `throttle_interval` and
+    # add their own checks.
+    def throttle_request
+      @last_request_time ||= Time.at(0)
+      elapsed = Time.current - @last_request_time
+      sleep_time = min_request_interval - elapsed
+      sleep(sleep_time) if sleep_time > 0
+      @last_request_time = Time.current
+    end
+
+    def min_request_interval
+      ENV.fetch("#{provider_env_prefix}_MIN_REQUEST_INTERVAL", self.class::MIN_REQUEST_INTERVAL).to_f
+    end
+
+    def provider_env_prefix
+      self.class.const_defined?(:PROVIDER_ENV_PREFIX) ? self.class::PROVIDER_ENV_PREFIX : self.class.name.demodulize.underscore.upcase
+    end
+
+    # Standard error transformation: maps common Faraday errors to provider-scoped
+    # error classes.  Providers with extra error types (e.g. AuthenticationError)
+    # should override and call `super` for the default cases.
+    def default_error_transformer(error)
+      case error
+      when self.class::RateLimitError
+        error
+      when Faraday::TooManyRequestsError
+        self.class::RateLimitError.new(
+          "#{self.class.name.demodulize} rate limit exceeded",
+          details: error.response&.dig(:body)
+        )
+      when Faraday::Error
+        self.class::Error.new(error.message, details: error.response&.dig(:body))
+      else
+        self.class::Error.new(error.message)
+      end
+    end
+end
diff --git a/app/models/provider/registry.rb b/app/models/provider/registry.rb
index aa7a443c5..4782c1ee1 100644
--- a/app/models/provider/registry.rb
+++ b/app/models/provider/registry.rb
@@ -81,6 +81,38 @@ class Provider::Registry
       def yahoo_finance
         Provider::YahooFinance.new
       end
+
+      def tiingo
+        api_key = ENV["TIINGO_API_KEY"].presence || Setting.tiingo_api_key # pipelock:ignore
+
+        return nil unless api_key.present?
+
+        Provider::Tiingo.new(api_key)
+      end
+
+      def eodhd
+        api_key = ENV["EODHD_API_KEY"].presence || Setting.eodhd_api_key # pipelock:ignore
+
+        return nil unless api_key.present?
+
+        Provider::Eodhd.new(api_key)
+      end
+
+      def alpha_vantage
+        api_key = ENV["ALPHA_VANTAGE_API_KEY"].presence || Setting.alpha_vantage_api_key # pipelock:ignore
+
+        return nil unless api_key.present?
+
+        Provider::AlphaVantage.new(api_key)
+      end
+
+      def mfapi
+        Provider::Mfapi.new
+      end
+
+      def binance_public
+        Provider::BinancePublic.new
+      end
   end
 
   def initialize(concept)
@@ -92,6 +124,11 @@ class Provider::Registry
     available_providers.map { |p| self.class.send(p) }.compact
   end
 
+  # Returns the list of provider key names (symbols) registered for this concept.
+  def provider_keys
+    available_providers
+  end
+
   def get_provider(name)
     provider_method = available_providers.find { |p| p == name.to_sym }
 
@@ -108,7 +145,7 @@ class Provider::Registry
       when :exchange_rates
         %i[twelve_data yahoo_finance]
       when :securities
-        %i[twelve_data yahoo_finance]
+        %i[twelve_data yahoo_finance tiingo eodhd alpha_vantage mfapi binance_public]
       when :llm
         %i[openai]
       else
diff --git a/app/models/provider/security_concept.rb b/app/models/provider/security_concept.rb
index fbc408c33..37fbd3efe 100644
--- a/app/models/provider/security_concept.rb
+++ b/app/models/provider/security_concept.rb
@@ -1,7 +1,14 @@
 module Provider::SecurityConcept
   extend ActiveSupport::Concern
 
-  Security = Data.define(:symbol, :name, :logo_url, :exchange_operating_mic, :country_code)
+  # NOTE: This `Security` is a lightweight Data value object used for search results.
+  # Inside provider classes that `include SecurityConcept`, unqualified `Security`
+  # resolves to this Data class — NOT to `::Security` (the ActiveRecord model).
+  Security = Data.define(:symbol, :name, :logo_url, :exchange_operating_mic, :country_code, :currency) do
+    def initialize(symbol:, name:, logo_url:, exchange_operating_mic:, country_code:, currency: nil)
+      super
+    end
+  end
   SecurityInfo = Data.define(:symbol, :name, :links, :logo_url, :description, :kind, :exchange_operating_mic)
   Price = Data.define(:symbol, :date, :price, :currency, :exchange_operating_mic)
 
@@ -20,4 +27,11 @@ module Provider::SecurityConcept
   def fetch_security_prices(symbol:, exchange_operating_mic:, start_date:, end_date:)
     raise NotImplementedError, "Subclasses must implement #fetch_security_prices"
   end
+
+  # Maximum number of calendar days of historical data the provider can return.
+  # Callers should clamp start_date to avoid requesting data beyond this window.
+  # Override in subclasses with provider-specific limits.
+  def max_history_days
+    nil # nil means no known limit
+  end
 end
diff --git a/app/models/provider/sophtron.rb b/app/models/provider/sophtron.rb
new file mode 100644
index 000000000..69261133f
--- /dev/null
+++ b/app/models/provider/sophtron.rb
@@ -0,0 +1,473 @@
+# Sophtron API client for account aggregation.
+#
+# Sophtron uses two API shapes:
+# - V2 REST endpoints for customer provisioning.
+# - V1 RPC-style endpoints for institution connection, jobs, MFA, accounts, and transactions.
+class Provider::Sophtron < Provider
+  include HTTParty
+
+  DEFAULT_BASE_URL = "https://api.sophtron.com/api"
+  USER_AGENT = "Sure Finance Sophtron Client"
+  FAILURE_JOB_STATUSES = %w[Completed Timeout Failed Failure Error].freeze
+
+  headers "User-Agent" => USER_AGENT
+  default_options.merge!(verify: true, ssl_verify_mode: OpenSSL::SSL::VERIFY_PEER, timeout: 120)
+
+  Error = Class.new(Provider::Error) do
+    attr_reader :error_type
+
+    def initialize(message, error_type = :unknown, details: nil)
+      @error_type = error_type
+      super(message, details: details)
+    end
+  end
+
+  attr_reader :user_id, :access_key, :base_url
+
+  def initialize(user_id, access_key, base_url: DEFAULT_BASE_URL)
+    @user_id = user_id
+    @access_key = access_key
+    @base_url = normalize_base_url(base_url)
+    super()
+  end
+
+  def auth_header_for(method, api_path)
+    auth_path = self.class.auth_path(api_path)
+    plain_key = "#{method.to_s.upcase}\n#{auth_path}"
+    key_bytes = Base64.decode64(access_key.to_s)
+    raise ArgumentError, "decoded key is empty" if key_bytes.blank?
+    signature = OpenSSL::HMAC.digest(OpenSSL::Digest.new("sha256"), key_bytes, plain_key)
+    "FIApiAUTH:#{user_id}:#{Base64.strict_encode64(signature)}:#{auth_path}"
+  rescue ArgumentError => e
+    raise Error.new("Invalid Sophtron Access Key: #{e.message}", :invalid_access_key)
+  end
+
+  def self.auth_path(api_path)
+    path = URI.parse(api_path.to_s).path
+    last_segment = path.to_s.split("/").last.to_s
+    "/#{last_segment}".downcase
+  rescue URI::InvalidURIError
+    last_segment = api_path.to_s.split("?").first.to_s.split("/").last.to_s
+    "/#{last_segment}".downcase
+  end
+
+  def self.job_success?(job)
+    job = job.with_indifferent_access
+    job[:SuccessFlag] == true || job[:success_flag] == true || job[:LastStatus].to_s == "AccountsReady" || job[:last_status].to_s == "AccountsReady"
+  end
+
+  def self.job_failed?(job)
+    job = job.with_indifferent_access
+    success_flag = job.key?(:SuccessFlag) ? job[:SuccessFlag] : job[:success_flag]
+    last_status = job[:LastStatus] || job[:last_status]
+    success_flag == false && failure_job_status?(last_status)
+  end
+
+  def self.job_completed?(job)
+    job = job.with_indifferent_access
+    (job[:LastStatus] || job[:last_status]).to_s == "Completed" && !job_failed?(job)
+  end
+
+  def self.failure_job_status?(last_status)
+    status = last_status.to_s
+    FAILURE_JOB_STATUSES.include?(status) || status.match?(/timeout|fail|error/i)
+  end
+
+  def self.job_requires_input?(job)
+    job = job.with_indifferent_access
+    job[:SecurityQuestion].present? ||
+      job[:security_question].present? ||
+      job[:TokenMethod].present? ||
+      job[:token_method].present? ||
+      job_token_input_required?(job) ||
+      job[:TokenRead].present? ||
+      job[:token_read].present? ||
+      job[:CaptchaImage].present? ||
+      job[:captcha_image].present?
+  end
+
+  def self.job_token_input_required?(job)
+    job = job.with_indifferent_access
+    token_input = job[:TokenInput] || job[:token_input]
+    token_input.blank? && (
+      job[:TokenSentFlag] == true ||
+      job[:token_sent_flag] == true ||
+      job[:TokenInputName].present? ||
+      job[:token_input_name].present? ||
+      job[:LastStep].to_s == "TokenInput" ||
+      job[:last_step].to_s == "TokenInput"
+    )
+  end
+
+  def self.parse_json_array(value)
+    return [] if value.blank?
+    return value if value.is_a?(Array)
+
+    parsed = JSON.parse(value.to_s)
+    parsed.is_a?(Array) ? parsed : Array(parsed)
+  rescue JSON::ParserError
+    Array(value)
+  end
+
+  def self.response_data!(response)
+    return response unless response.respond_to?(:success?) && response.respond_to?(:data)
+    return response.data if response.success?
+
+    raise response.error || Error.new("Sophtron provider response did not include data", :invalid_response)
+  end
+
+  # GET /api/Institution/HealthCheckAuth
+  def health_check_auth
+    with_provider_response do
+      request(:get, "/Institution/HealthCheckAuth", parse_json: false)
+    end
+  end
+
+  # GET /api/v2/customers
+  def list_customers
+    with_provider_response do
+      parsed = request(:get, "/v2/customers")
+      extract_array_response(parsed, :customers, :Customers)
+    end
+  end
+
+  # POST /api/v2/customers
+  def create_customer(unique_id:, name:, source: "Sure")
+    with_provider_response do
+      request(
+        :post,
+        "/v2/customers",
+        body: {
+          UniqueID: unique_id,
+          Name: name,
+          Source: source
+        }
+      )
+    end
+  end
+
+  # POST /api/Institution/GetInstitutionByName
+  def search_institutions(institution_name)
+    with_provider_response do
+      parsed = request(
+        :post,
+        "/Institution/GetInstitutionByName",
+        body: { InstitutionName: institution_name.to_s }
+      )
+      extract_array_response(parsed, :institutions, :Institutions)
+    end
+  end
+
+  # POST /api/UserInstitution/GetUserInstitutionsByUser
+  def list_user_institutions
+    with_provider_response do
+      parsed = request(
+        :post,
+        "/UserInstitution/GetUserInstitutionsByUser",
+        body: { UserID: user_id }
+      )
+      extract_array_response(parsed, :user_institutions, :UserInstitutions)
+    end
+  end
+
+  # POST /api/UserInstitution/CreateUserInstitution
+  def create_user_institution(institution_id:, username:, password:, pin: "")
+    with_provider_response do
+      request(
+        :post,
+        "/UserInstitution/CreateUserInstitution",
+        body: {
+          UserID: user_id,
+          InstitutionID: institution_id,
+          UserName: username,
+          Password: password,
+          PIN: pin.to_s
+        }
+      )
+    end
+  end
+
+  # POST /api/Job/GetJobInformationByID
+  def get_job_information(job_id)
+    with_provider_response do
+      fetch_job_information(job_id)
+    end
+  end
+
+  # POST /api/Job/UpdateJobSecurityAnswer
+  def update_job_security_answer(job_id, answers)
+    security_answer = answers.is_a?(String) ? answers : Array(answers).to_json
+
+    with_provider_response do
+      request(
+        :post,
+        "/Job/UpdateJobSecurityAnswer",
+        body: { JobID: job_id, SecurityAnswer: security_answer }
+      )
+    end
+  end
+
+  # POST /api/Job/UpdateJobTokenInput
+  def update_job_token_input(job_id, token_choice: nil, token_input: nil, verify_phone_flag: nil)
+    with_provider_response do
+      request(
+        :post,
+        "/Job/UpdateJobTokenInput",
+        body: {
+          JobID: job_id,
+          TokenChoice: token_choice,
+          TokenInput: token_input,
+          VerifyPhoneFlag: verify_phone_flag
+        }
+      )
+    end
+  end
+
+  # POST /api/Job/UpdateJobCaptcha
+  def update_job_captcha(job_id, captcha_input)
+    with_provider_response do
+      request(
+        :post,
+        "/Job/UpdateJobCaptcha",
+        body: { JobID: job_id, CaptchaInput: captcha_input }
+      )
+    end
+  end
+
+  # POST /api/UserInstitution/GetUserInstitutionAccounts
+  def get_user_institution_accounts(user_institution_id)
+    with_provider_response do
+      fetch_user_institution_accounts(user_institution_id)
+    end
+  end
+
+  def get_accounts(user_institution_id)
+    with_provider_response do
+      accounts = fetch_user_institution_accounts(user_institution_id)
+      normalized = accounts.map { |account| normalize_account(account, user_institution_id: user_institution_id) }
+      { accounts: normalized, total: normalized.size }
+    end
+  end
+
+  # POST /api/UserInstitutionAccount/RefreshUserInstitutionAccount
+  def refresh_account(account_id)
+    with_provider_response do
+      request(
+        :post,
+        "/UserInstitutionAccount/RefreshUserInstitutionAccount",
+        body: { AccountID: account_id }
+      )
+    end
+  end
+
+  # POST /api/Transaction/GetTransactionsByTransactionDate
+  def get_account_transactions(account_id, start_date: nil, end_date: nil)
+    with_provider_response do
+      parsed = request(
+        :post,
+        "/Transaction/GetTransactionsByTransactionDate",
+        body: {
+          AccountID: account_id,
+          StartDate: (start_date || 120.days.ago).to_date.to_s,
+          EndDate: (end_date || Date.tomorrow).to_date.to_s
+        }
+      )
+
+      raw_transactions = extract_array_response(parsed, :transactions, :Transactions)
+      transactions = raw_transactions.map { |transaction| normalize_transaction(transaction, account_id) }
+
+      { transactions: transactions, total: transactions.size }
+    end
+  end
+
+  def poll_job(job_id, **)
+    get_job_information(job_id)
+  end
+
+  private
+
+    def default_error_transformer(error)
+      return error if error.is_a?(Error)
+
+      super
+    end
+
+    def fetch_job_information(job_id)
+      request(
+        :post,
+        "/Job/GetJobInformationByID",
+        body: { JobID: job_id }
+      )
+    end
+
+    def fetch_user_institution_accounts(user_institution_id)
+      parsed = request(
+        :post,
+        "/UserInstitution/GetUserInstitutionAccounts",
+        body: { UserInstitutionID: user_institution_id }
+      )
+      extract_array_response(parsed, :accounts, :Accounts)
+    end
+
+    def extract_array_response(parsed, *keys)
+      return parsed if parsed.is_a?(Array)
+      return [] if parsed.respond_to?(:empty?) && parsed.empty?
+
+      if parsed.respond_to?(:with_indifferent_access)
+        parsed = parsed.with_indifferent_access
+        keys.each do |key|
+          return Array(parsed[key]) if parsed.key?(key)
+        end
+      end
+
+      raise Error.new("Invalid Sophtron response format", :invalid_response, details: parsed)
+    end
+
+    def request(method, api_path, body: nil, parse_json: true)
+      options = { headers: auth_headers(method: method, api_path: api_path) }
+      options[:body] = body.to_json if body
+
+      response = self.class.public_send(method, "#{base_url}#{api_path}", options)
+      handle_response(response, parse_json: parse_json)
+    rescue Error
+      raise
+    rescue SocketError, Net::OpenTimeout, Net::ReadTimeout => e
+      raise Error.new("Sophtron request failed: #{e.message}", :request_failed)
+    rescue StandardError => e
+      raise Error.new("Sophtron request failed: #{e.message}", :request_failed)
+    end
+
+    def auth_headers(method:, api_path:)
+      {
+        "Authorization" => auth_header_for(method, api_path),
+        "Content-Type" => "application/json",
+        "Accept" => "application/json"
+      }
+    end
+
+    def handle_response(response, parse_json: true)
+      body = response.body.to_s
+
+      case response.code.to_i
+      when 200, 201, 204
+        return {} if body.strip.blank?
+
+        parse_json ? JSON.parse(body, symbolize_names: true) : parse_optional_json(body)
+      when 400
+        raise Error.new("Bad request to Sophtron API: #{body}", :bad_request, details: body)
+      when 401
+        raise Error.new("Invalid Sophtron User ID or Access Key", :unauthorized, details: body)
+      when 403
+        raise Error.new("Access forbidden by Sophtron", :access_forbidden, details: body)
+      when 404
+        raise Error.new("Sophtron resource not found", :not_found, details: body)
+      when 429
+        raise Error.new("Sophtron rate limit exceeded. Please try again later.", :rate_limited, details: body)
+      else
+        raise Error.new(
+          "Sophtron API request failed: #{response.code} #{response.message} - #{body}",
+          :fetch_failed,
+          details: body
+        )
+      end
+    rescue JSON::ParserError => e
+      raise Error.new("Invalid JSON response from Sophtron API: #{e.message}", :invalid_response, details: body)
+    end
+
+    def parse_optional_json(body)
+      JSON.parse(body, symbolize_names: true)
+    rescue JSON::ParserError
+      body
+    end
+
+    def normalize_base_url(value)
+      url = value.presence || DEFAULT_BASE_URL
+      url = url.to_s.chomp("/")
+      url = url.delete_suffix("/v2") if url.end_with?("/v2")
+
+      parsed = URI.parse(url)
+      parsed.path.to_s.end_with?("/api") ? url : "#{url}/api"
+    rescue URI::InvalidURIError
+      DEFAULT_BASE_URL
+    end
+
+    def normalize_account(account, user_institution_id:)
+      account = account.with_indifferent_access
+      account_id = first_present(account, :AccountID, :account_id, :id)
+      account_name = first_present(account, :AccountName, :account_name, :name)
+      account_number = first_present(account, :AccountNumber, :account_number)
+      currency = first_present(account, :BalanceCurrency, :balance_currency, :Currency, :currency).presence || "USD"
+
+      {
+        id: account_id,
+        account_id: account_id,
+        account_name: account_name,
+        name: account_name,
+        account_type: first_present(account, :AccountType, :account_type, :type).presence || "unknown",
+        sub_type: first_present(account, :AccountSubType, :account_sub_type, :SubType, :sub_type).presence || "unknown",
+        balance: first_present(account, :AccountBalance, :account_balance, :Balance, :balance),
+        balance_currency: currency,
+        currency: currency,
+        account_number_mask: mask_account_number(account_number),
+        status: first_present(account, :AccountStatus, :account_status, :Status, :status).presence || "active",
+        user_institution_id: user_institution_id,
+        institution_name: first_present(account, :InstitutionName, :institution_name),
+        raw_payload: account.to_h
+      }.with_indifferent_access
+    end
+
+    def normalize_transaction(transaction, account_id)
+      transaction = transaction.with_indifferent_access
+
+      {
+        id: first_present(transaction, :TransactionID, :TransactionId, :transaction_id, :transactionId, :ID, :id),
+        accountId: account_id,
+        type: first_present(transaction, :Type, :type).presence || "unknown",
+        status: first_present(transaction, :Status, :status).presence || "completed",
+        amount: first_present(transaction, :Amount, :amount).presence || 0,
+        currency: first_present(transaction, :Currency, :currency).presence || "USD",
+        date: first_present(transaction, :TransactionDate, :transaction_date, :Date, :date),
+        merchant: first_present(transaction, :Merchant, :merchant).presence || extract_merchant(first_present(transaction, :Description, :description)).presence || "",
+        description: first_present(transaction, :Description, :description).presence || ""
+      }.with_indifferent_access
+    end
+
+    def first_present(hash, *keys)
+      keys.each do |key|
+        value = hash[key]
+        return value if value.present?
+      end
+
+      nil
+    end
+
+    def mask_account_number(account_number)
+      return nil if account_number.blank?
+
+      last_four = account_number.to_s.gsub(/\s+/, "").last(4)
+      last_four.present? ? "****#{last_four}" : nil
+    end
+
+    def extract_merchant(line)
+      return nil if line.nil?
+
+      line = line.to_s.strip
+      return nil if line.empty?
+
+      if line =~ /INSUFFICIENT FUNDS FEE/i
+        "Bank Fee: Insufficient Funds"
+      elsif line =~ /OVERDRAFT PROTECTION/i
+        "Bank Transfer: Overdraft Protection"
+      elsif line =~ /AUTO PAY WF HOME MTG/i
+        "Wells Fargo Home Mortgage"
+      elsif line =~ /PAYDAY LOAN/i
+        "Payday Loan"
+      elsif line =~ /CHECKCARD \d{4}\s+(.+?)(?=\s{2,}|x{3,}|\s+\S+\s+[A-Z]{2}\b)/i
+        Regexp.last_match(1).strip
+      elsif line =~ /^(.+?)(?=\s+\d{2}\/\d{2}|\s+#)/
+        Regexp.last_match(1).strip.gsub(/\s+POS$/i, "").strip
+      else
+        line[0..25].strip
+      end
+    end
+end
diff --git a/app/models/provider/sophtron_adapter.rb b/app/models/provider/sophtron_adapter.rb
new file mode 100644
index 000000000..144bdd482
--- /dev/null
+++ b/app/models/provider/sophtron_adapter.rb
@@ -0,0 +1,114 @@
+class Provider::SophtronAdapter < Provider::Base
+  include Provider::Syncable
+  include Provider::InstitutionMetadata
+
+  # Register this adapter with the factory
+  Provider::Factory.register("SophtronAccount", self)
+
+  # Define which account types this provider supports
+  def self.supported_account_types
+    %w[Depository CreditCard Loan Investment]
+  end
+
+  # Returns connection configurations for this provider
+  def self.connection_configs(family:)
+    return [] unless family.can_connect_sophtron?
+
+    [ {
+      key: "sophtron",
+      name: "Sophtron",
+      description: "Connect to your bank via Sophtron's secure API aggregation service.",
+      can_connect: true,
+      new_account_path: ->(accountable_type, return_to) {
+        Rails.application.routes.url_helpers.select_accounts_sophtron_items_path(
+          accountable_type: accountable_type,
+          return_to: return_to,
+          connect_new_institution: true
+        )
+      },
+      existing_account_path: ->(account_id) {
+        Rails.application.routes.url_helpers.select_existing_account_sophtron_items_path(
+          account_id: account_id
+        )
+      }
+    } ]
+  end
+
+  def provider_name
+    "sophtron"
+  end
+
+  # Build a Sophtron provider instance with family-specific credentials
+  # Sophtron is now fully per-family - no global credentials supported
+  # @param family [Family] The family to get credentials for (required)
+  # @return [Provider::Sophtron, nil] Returns nil if User ID and Access key is not configured
+  def self.build_provider(family: nil)
+    return nil unless family.present?
+
+    # Get family-specific credentials
+    sophtron_item = family.configured_sophtron_item
+    return nil unless sophtron_item&.credentials_configured?
+
+    Provider::Sophtron.new(
+      sophtron_item.user_id,
+      sophtron_item.access_key,
+      base_url: sophtron_item.effective_base_url
+    )
+  end
+
+  def sync_path
+    Rails.application.routes.url_helpers.sync_sophtron_item_path(item)
+  end
+
+  def item
+    provider_account.sophtron_item
+  end
+
+  def can_delete_holdings?
+    false
+  end
+
+  def institution_domain
+    # Sophtron may provide institution metadata in account data
+    metadata = provider_account.institution_metadata
+    return nil unless metadata.present?
+
+    domain = metadata["domain"]
+    url = metadata["url"]
+
+    # Derive domain from URL if missing
+    if domain.blank? && url.present?
+      begin
+        domain = URI.parse(url).host&.gsub(/^www\./, "")
+      rescue URI::InvalidURIError
+        Rails.logger.warn("Invalid institution URL for Sophtron account #{provider_account.id}: #{url}")
+      end
+    end
+
+    domain
+  end
+
+  def institution_name
+    metadata = provider_account.institution_metadata || {}
+    return nil unless metadata.present?
+
+    metadata_name = metadata["name"].presence || metadata["institution_name"].presence
+    return metadata_name if metadata_name.present?
+
+    metadata_user_institution_id = metadata["user_institution_id"].presence || metadata["UserInstitutionID"].presence
+    return item&.institution_name if metadata_user_institution_id.present? && metadata_user_institution_id == item&.user_institution_id
+
+    nil
+  end
+
+  def institution_url
+    metadata = provider_account.institution_metadata
+    return nil unless metadata.present?
+
+    metadata["url"] || item&.institution_url
+  end
+
+  def institution_color
+    item&.institution_color
+  end
+end
diff --git a/app/models/provider/tiingo.rb b/app/models/provider/tiingo.rb
new file mode 100644
index 000000000..97c998e96
--- /dev/null
+++ b/app/models/provider/tiingo.rb
@@ -0,0 +1,294 @@
+class Provider::Tiingo < Provider
+  include SecurityConcept, RateLimitable
+  extend SslConfigurable
+
+  # Subclass so errors caught in this provider are raised as Provider::Tiingo::Error
+  Error = Class.new(Provider::Error)
+  InvalidSecurityPriceError = Class.new(Error)
+  RateLimitError = Class.new(Error)
+
+  # Minimum delay between requests to avoid rate limiting (in seconds)
+  MIN_REQUEST_INTERVAL = 1.5
+
+  # Maximum unique symbols per month (Tiingo free tier limit)
+  MAX_SYMBOLS_PER_MONTH = 500
+
+  # Maximum requests per hour
+  MAX_REQUESTS_PER_HOUR = 1000
+
+  # Tiingo exchange names to MIC codes
+  TIINGO_EXCHANGE_TO_MIC = {
+    "NASDAQ" => "XNAS",
+    "NYSE" => "XNYS",
+    "NYSE ARCA" => "XARC",
+    "NYSE MKT" => "XASE",
+    "BATS" => "BATS",
+    "LSE" => "XLON",
+    "SHE" => "XSHE",
+    "SHG" => "XSHG",
+    "OTCMKTS" => "XOTC",
+    "OTCD" => "XOTC",
+    "PINK" => "XOTC"
+  }.freeze
+
+  # Tiingo asset types to normalized kinds
+  TIINGO_ASSET_TYPE_MAP = {
+    "Stock" => "common stock",
+    "ETF" => "etf",
+    "Mutual Fund" => "mutual fund"
+  }.freeze
+
+  def initialize(api_key)
+    @api_key = api_key # pipelock:ignore
+  end
+
+  def healthy?
+    with_provider_response do
+      response = client.get("#{base_url}/tiingo/daily/AAPL")
+      parsed = JSON.parse(response.body)
+      parsed.dig("ticker").present?
+    end
+  end
+
+  def usage
+    with_provider_response do
+      count_key = "tiingo:symbol_count:#{Date.current.strftime('%Y-%m')}"
+      symbols_used = Rails.cache.read(count_key).to_i
+
+      UsageData.new(
+        used: symbols_used,
+        limit: MAX_SYMBOLS_PER_MONTH,
+        utilization: (symbols_used.to_f / MAX_SYMBOLS_PER_MONTH * 100).round(1),
+        plan: "Free"
+      )
+    end
+  end
+
+  # ================================
+  #           Securities
+  # ================================
+
+  def search_securities(symbol, country_code: nil, exchange_operating_mic: nil)
+    with_provider_response do
+      throttle_request
+
+      response = client.get("#{base_url}/tiingo/utilities/search") do |req|
+        req.params["query"] = symbol
+      end
+
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
+
+      unless parsed.is_a?(Array)
+        raise Error, "Unexpected response format from search endpoint"
+      end
+
+      parsed.first(25).map do |security|
+        ticker = security["ticker"]
+        currency = security["priceCurrency"]
+
+        # Cache the API-returned currency so fetch_security_prices can use it
+        # without making a second search request
+        if currency.present? && ticker.present?
+          Rails.cache.write("tiingo:currency:#{ticker.upcase}", currency, expires_in: 24.hours)
+        end
+
+        Security.new(
+          symbol: ticker,
+          name: security["name"],
+          logo_url: nil,
+          exchange_operating_mic: map_exchange_to_mic(security["exchange"]),
+          country_code: security["countryCode"].presence || country_code,
+          currency: currency
+        )
+      end
+    end
+  end
+
+  def fetch_security_info(symbol:, exchange_operating_mic:)
+    with_provider_response do
+      throttle_request
+      track_symbol(symbol)
+
+      response = client.get("#{base_url}/tiingo/daily/#{CGI.escape(symbol)}")
+
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
+
+      # The daily metadata endpoint returns exchangeCode (e.g., "NYSE ARCA", "OTCD")
+      resolved_mic = exchange_operating_mic.presence || map_exchange_to_mic(parsed["exchangeCode"])
+
+      SecurityInfo.new(
+        symbol: parsed["ticker"] || symbol,
+        name: parsed["name"],
+        links: nil,
+        logo_url: nil,
+        description: parsed["description"],
+        kind: nil,
+        exchange_operating_mic: resolved_mic
+      )
+    end
+  end
+
+  def fetch_security_price(symbol:, exchange_operating_mic: nil, date:)
+    with_provider_response do
+      historical_data = fetch_security_prices(symbol:, exchange_operating_mic:, start_date: date, end_date: date)
+
+      raise historical_data.error if historical_data.error.present?
+      raise InvalidSecurityPriceError, "No prices found for security #{symbol} on date #{date}" if historical_data.data.blank?
+
+      historical_data.data.first
+    end
+  end
+
+  def fetch_security_prices(symbol:, exchange_operating_mic: nil, start_date:, end_date:)
+    with_provider_response do
+      throttle_request
+      track_symbol(symbol)
+
+      response = client.get("#{base_url}/tiingo/daily/#{CGI.escape(symbol)}/prices") do |req|
+        req.params["startDate"] = start_date.to_s
+        req.params["endDate"] = end_date.to_s
+      end
+
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
+
+      unless parsed.is_a?(Array)
+        error_message = parsed.is_a?(Hash) ? (parsed["detail"] || "Unexpected response format") : "Unexpected response format"
+        raise InvalidSecurityPriceError, "API error: #{error_message}"
+      end
+
+      # Prefer cached currency from search results to avoid a second API call
+      cache_key = "tiingo:currency:#{symbol.upcase}"
+      currency = Rails.cache.read(cache_key) || fetch_currency_for_symbol(symbol)
+
+      parsed.map do |resp|
+        price = resp["close"]
+        date = resp["date"]
+
+        if price.nil? || price.to_f <= 0
+          Rails.logger.warn("#{self.class.name} returned invalid price data for security #{symbol} on: #{date}.  Price data: #{price.inspect}")
+          next
+        end
+
+        Price.new(
+          symbol: symbol,
+          date: Date.parse(date),
+          price: price,
+          currency: currency,
+          exchange_operating_mic: exchange_operating_mic
+        )
+      end.compact
+    end
+  end
+
+  private
+    attr_reader :api_key
+
+    def base_url
+      ENV["TIINGO_URL"] || "https://api.tiingo.com"
+    end
+
+    def client
+      @client ||= Faraday.new(url: base_url, ssl: self.class.faraday_ssl_options) do |faraday|
+        faraday.request(:retry, {
+          max: 3,
+          interval: 1.0,
+          interval_randomness: 0.5,
+          backoff_factor: 2,
+          exceptions: Faraday::Retry::Middleware::DEFAULT_EXCEPTIONS + [ Faraday::ConnectionFailed ]
+        })
+
+        faraday.request :json
+        faraday.response :raise_error
+        faraday.headers["Authorization"] = "Token #{api_key}"
+        faraday.headers["Content-Type"] = "application/json"
+      end
+    end
+
+    # Adds hourly request counter on top of the interval throttle from RateLimitable.
+    def throttle_request
+      super
+
+      # Global per-hour request counter via cache (Redis).
+      # Atomic increment-then-check avoids the TOCTOU of read-check-increment.
+      hour_key = "tiingo:requests:#{Time.current.to_i / 3600}"
+      new_count = Rails.cache.increment(hour_key, 1, expires_in: 7200.seconds).to_i
+
+      if new_count >= max_requests_per_hour
+        raise RateLimitError, "Tiingo hourly request limit reached (#{new_count}/#{max_requests_per_hour})"
+      end
+    end
+
+    # Tracks unique symbols queried per month to stay within Tiingo's 500 symbols/month limit.
+    # Uses atomic set-if-absent (Redis SETNX) to eliminate the read-then-write race
+    # where two concurrent workers could both see the symbol as untracked and both
+    # increment the counter.
+    def track_symbol(symbol)
+      symbol_key = "tiingo:symbol:#{Date.current.strftime('%Y-%m')}:#{symbol.upcase}"
+      count_key  = "tiingo:symbol_count:#{Date.current.strftime('%Y-%m')}"
+
+      # Atomic write-if-absent: returns false when the key already exists (Redis SETNX).
+      # Only the first worker to claim this symbol will proceed to increment the counter.
+      return unless Rails.cache.write(symbol_key, true, expires_in: 35.days, unless_exist: true)
+
+      new_count = Rails.cache.increment(count_key, 1, expires_in: 35.days).to_i
+
+      if new_count >= MAX_SYMBOLS_PER_MONTH
+        Rails.cache.decrement(count_key, 1)
+        Rails.cache.delete(symbol_key)
+        raise RateLimitError, "Tiingo unique symbol limit reached (#{MAX_SYMBOLS_PER_MONTH} per month)"
+      end
+    end
+
+    # min_request_interval provided by RateLimitable
+
+    def max_requests_per_hour
+      ENV.fetch("TIINGO_MAX_REQUESTS_PER_HOUR", MAX_REQUESTS_PER_HOUR).to_i
+    end
+
+    # Fetches the price currency for a symbol via the search endpoint.
+    # Only called as a fallback when the cache (populated by search_securities)
+    # doesn't have the currency. Raises on failure to avoid silently mislabeling
+    # non-USD instruments as USD.
+    def fetch_currency_for_symbol(symbol)
+      throttle_request
+
+      response = client.get("#{base_url}/tiingo/utilities/search") do |req|
+        req.params["query"] = symbol
+      end
+
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
+
+      if parsed.is_a?(Array)
+        match = parsed.find { |s| s["ticker"]&.upcase == symbol.upcase }
+        currency = match&.dig("priceCurrency")
+
+        if currency.present?
+          Rails.cache.write("tiingo:currency:#{symbol.upcase}", currency, expires_in: 24.hours)
+          return currency
+        end
+      end
+
+      raise Error, "Could not determine currency for #{symbol} from Tiingo search"
+    end
+
+    def map_exchange_to_mic(exchange_name)
+      return nil if exchange_name.blank?
+      TIINGO_EXCHANGE_TO_MIC[exchange_name.strip] || exchange_name.strip
+    end
+
+    def check_api_error!(parsed)
+      return unless parsed.is_a?(Hash) && parsed["detail"].present?
+
+      detail = parsed["detail"]
+
+      if detail.downcase.include?("rate limit") || detail.downcase.include?("too many")
+        raise RateLimitError, detail
+      end
+
+      raise Error, "API error: #{detail}"
+    end
+end
diff --git a/app/models/provider/twelve_data.rb b/app/models/provider/twelve_data.rb
index d360e5189..ba332dfe5 100644
--- a/app/models/provider/twelve_data.rb
+++ b/app/models/provider/twelve_data.rb
@@ -6,6 +6,10 @@ class Provider::TwelveData < Provider
   Error = Class.new(Provider::Error)
   InvalidExchangeRateError = Class.new(Error)
   InvalidSecurityPriceError = Class.new(Error)
+  RateLimitError = Class.new(Error)
+
+  # Minimum delay between requests to avoid rate limiting (in seconds)
+  MIN_REQUEST_INTERVAL = 1.0
 
   # Pattern to detect plan upgrade errors in API responses
   PLAN_UPGRADE_PATTERN = /available starting with (\w+)/i
@@ -59,20 +63,23 @@ class Provider::TwelveData < Provider
 
   def fetch_exchange_rate(from:, to:, date:)
     with_provider_response do
+      throttle_request
       response = client.get("#{base_url}/exchange_rate") do |req|
         req.params["symbol"] = "#{from}/#{to}"
         req.params["date"] = date.to_s
       end
 
-      rate = JSON.parse(response.body).dig("rate")
+      parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
 
-      Rate.new(date: date.to_date, from:, to:, rate: rate)
+      Rate.new(date: date.to_date, from:, to:, rate: parsed.dig("rate"))
     end
   end
 
   def fetch_exchange_rates(from:, to:, start_date:, end_date:)
     with_provider_response do
       # Try to fetch the currency pair via the time_series API (consumes 1 credit) - this might not return anything as the API does not provide time series data for all possible currency pairs
+      throttle_request
       response = client.get("#{base_url}/time_series") do |req|
         req.params["symbol"] = "#{from}/#{to}"
         req.params["start_date"] = start_date.to_s
@@ -81,11 +88,13 @@ class Provider::TwelveData < Provider
       end
 
       parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
       data = parsed.dig("values")
 
       # If currency pair is not available, try to fetch via the time_series/cross API (consumes 5 credits)
       if data.nil?
         Rails.logger.info("#{self.class.name}: Currency pair #{from}/#{to} not available, fetching via time_series/cross API")
+        throttle_request(credits: 5)
         response = client.get("#{base_url}/time_series/cross") do |req|
           req.params["base"] = from
           req.params["quote"] = to
@@ -95,6 +104,7 @@ class Provider::TwelveData < Provider
         end
 
         parsed = JSON.parse(response.body)
+        check_api_error!(parsed)
         data = parsed.dig("values")
       end
 
@@ -123,12 +133,14 @@ class Provider::TwelveData < Provider
 
   def search_securities(symbol, country_code: nil, exchange_operating_mic: nil)
     with_provider_response do
+      throttle_request
       response = client.get("#{base_url}/symbol_search") do |req|
         req.params["symbol"] = symbol
         req.params["outputsize"] = 25
       end
 
       parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
       data = parsed.dig("data")
 
       if data.nil?
@@ -137,7 +149,7 @@ class Provider::TwelveData < Provider
         raise Error, "API error (code: #{error_code}): #{error_message}"
       end
 
-      data.map do |security|
+      data.reject { |row| crypto_row?(row) }.map do |security|
         country = ISO3166::Country.find_country_by_any_name(security.dig("country"))
 
         Security.new(
@@ -145,7 +157,8 @@ class Provider::TwelveData < Provider
           name: security.dig("instrument_name"),
           logo_url: nil,
           exchange_operating_mic: security.dig("mic_code"),
-          country_code: country ? country.alpha2 : nil
+          country_code: country ? country.alpha2 : nil,
+          currency: security.dig("currency")
         )
       end
     end
@@ -153,19 +166,23 @@ class Provider::TwelveData < Provider
 
   def fetch_security_info(symbol:, exchange_operating_mic:)
     with_provider_response do
+      throttle_request
       response = client.get("#{base_url}/profile") do |req|
         req.params["symbol"] = symbol
         req.params["mic_code"] = exchange_operating_mic
       end
 
       profile = JSON.parse(response.body)
+      check_api_error!(profile)
 
+      throttle_request
       response = client.get("#{base_url}/logo") do |req|
         req.params["symbol"] = symbol
         req.params["mic_code"] = exchange_operating_mic
       end
 
       logo = JSON.parse(response.body)
+      check_api_error!(logo)
 
       SecurityInfo.new(
         symbol: symbol,
@@ -183,7 +200,8 @@ class Provider::TwelveData < Provider
     with_provider_response do
       historical_data = fetch_security_prices(symbol:, exchange_operating_mic:, start_date: date, end_date: date)
 
-      raise ProviderError, "No prices found for security #{symbol} on date #{date}" if historical_data.data.empty?
+      raise historical_data.error if historical_data.error.present?
+      raise InvalidSecurityPriceError, "No prices found for security #{symbol} on date #{date}" if historical_data.data.blank?
 
       historical_data.data.first
     end
@@ -191,6 +209,7 @@ class Provider::TwelveData < Provider
 
   def fetch_security_prices(symbol:, exchange_operating_mic: nil, start_date:, end_date:)
     with_provider_response do
+      throttle_request
       response = client.get("#{base_url}/time_series") do |req|
         req.params["symbol"] = symbol
         req.params["mic_code"] = exchange_operating_mic
@@ -200,6 +219,7 @@ class Provider::TwelveData < Provider
       end
 
       parsed = JSON.parse(response.body)
+      check_api_error!(parsed)
       values = parsed.dig("values")
 
       if values.nil?
@@ -230,6 +250,16 @@ class Provider::TwelveData < Provider
   private
     attr_reader :api_key
 
+    # TwelveData tags crypto symbols with `instrument_type: "Digital Currency"` and
+    # `mic_code: "DIGITAL_CURRENCY"`, and returns an empty `currency` field for them.
+    # We exclude them so crypto is handled exclusively by Provider::BinancePublic —
+    # TD's empty currency would otherwise cascade into Security::Price rows defaulting
+    # to USD, silently mispricing EUR/GBP crypto holdings.
+    def crypto_row?(row)
+      row["instrument_type"].to_s.casecmp?("Digital Currency") ||
+        row["mic_code"].to_s.casecmp?("DIGITAL_CURRENCY")
+    end
+
     def base_url
       ENV["TWELVE_DATA_URL"] || "https://api.twelvedata.com"
     end
@@ -237,10 +267,11 @@ class Provider::TwelveData < Provider
     def client
       @client ||= Faraday.new(url: base_url, ssl: self.class.faraday_ssl_options) do |faraday|
         faraday.request(:retry, {
-          max: 2,
-          interval: 0.05,
+          max: 3,
+          interval: 1.0,
           interval_randomness: 0.5,
-          backoff_factor: 2
+          backoff_factor: 2,
+          exceptions: Faraday::Retry::Middleware::DEFAULT_EXCEPTIONS + [ Faraday::ConnectionFailed ]
         })
 
         faraday.request :json
@@ -248,4 +279,69 @@ class Provider::TwelveData < Provider
         faraday.headers["Authorization"] = "apikey #{api_key}"
       end
     end
+
+    # Paces API requests to stay within TwelveData's rate limits. Sleeps inline
+    # because the API physically cannot be called faster — this is unavoidable
+    # with a rate-limited provider. The 5-minute cache lock TTL in
+    # ExchangeRate::Provided accounts for worst-case throttle waits.
+    def throttle_request(credits: 1)
+      # Layer 1: Per-instance minimum interval between calls
+      @last_request_time ||= Time.at(0)
+      elapsed = Time.current - @last_request_time
+      sleep_time = min_request_interval - elapsed
+      sleep(sleep_time) if sleep_time > 0
+
+      # Layer 2: Global per-minute credit counter via cache (Redis in prod).
+      # Read current usage first — if adding these credits would exceed the limit,
+      # wait for the next minute BEFORE incrementing. This ensures credits are
+      # charged to the minute the request actually fires in, not a stale minute
+      # we slept through (which would undercount the new minute's usage).
+      minute_key = "twelve_data:credits:#{Time.current.to_i / 60}"
+      current_count = Rails.cache.read(minute_key).to_i
+
+      if current_count + credits > max_requests_per_minute
+        wait_seconds = 60 - (Time.current.to_i % 60) + 1
+        Rails.logger.info("TwelveData: #{current_count + credits}/#{max_requests_per_minute} credits this minute, waiting #{wait_seconds}s")
+        sleep(wait_seconds)
+      end
+
+      # Charge credits to the minute the request actually fires in
+      active_minute_key = "twelve_data:credits:#{Time.current.to_i / 60}"
+      Rails.cache.increment(active_minute_key, credits, expires_in: 120.seconds)
+
+      # Set timestamp after all waits so the next call's 1s pacing is measured
+      # from when this request actually fires, not from before the minute wait.
+      @last_request_time = Time.current
+    end
+
+    def min_request_interval
+      ENV.fetch("TWELVE_DATA_MIN_REQUEST_INTERVAL", MIN_REQUEST_INTERVAL).to_f
+    end
+
+    def max_requests_per_minute
+      ENV.fetch("TWELVE_DATA_MAX_REQUESTS_PER_MINUTE", 7).to_i
+    end
+
+    def check_api_error!(parsed)
+      return unless parsed.is_a?(Hash) && parsed["code"].present?
+
+      if parsed["code"] == 429
+        raise RateLimitError, parsed["message"] || "Rate limit exceeded"
+      end
+
+      raise Error, "API error (code: #{parsed["code"]}): #{parsed["message"] || "Unknown error"}"
+    end
+
+    def default_error_transformer(error)
+      case error
+      when RateLimitError
+        error
+      when Faraday::TooManyRequestsError
+        RateLimitError.new("TwelveData rate limit exceeded", details: error.response&.dig(:body))
+      when Faraday::Error
+        self.class::Error.new(error.message, details: error.response&.dig(:body))
+      else
+        self.class::Error.new(error.message)
+      end
+    end
 end
diff --git a/app/models/provider/yahoo_finance.rb b/app/models/provider/yahoo_finance.rb
index d4a992184..36a983f93 100644
--- a/app/models/provider/yahoo_finance.rb
+++ b/app/models/provider/yahoo_finance.rb
@@ -1,3 +1,5 @@
+require "set"
+
 class Provider::YahooFinance < Provider
   include ExchangeRateConcept, SecurityConcept
   extend SslConfigurable
@@ -20,6 +22,10 @@ class Provider::YahooFinance < Provider
   # Maximum lookback window for historical data (configurable)
   MAX_LOOKBACK_WINDOW = 10.years
 
+  def max_history_days
+    (MAX_LOOKBACK_WINDOW / 1.day).to_i
+  end
+
   # Minimum delay between requests to avoid rate limiting (in seconds)
   MIN_REQUEST_INTERVAL = 0.5
 
@@ -161,6 +167,8 @@ class Provider::YahooFinance < Provider
           )
         end
 
+        securities = deduplicate_dual_listings(securities) unless exchange_operating_mic.present?
+
         cache_result(cache_key, securities)
         securities
       end
@@ -171,6 +179,8 @@ class Provider::YahooFinance < Provider
 
   def fetch_security_info(symbol:, exchange_operating_mic:)
     with_provider_response do
+      symbol = normalize_symbol(symbol, exchange_operating_mic)
+
       # quoteSummary endpoint requires cookie/crumb authentication
       throttle_request
       cookie, crumb = fetch_cookie_and_crumb
@@ -223,6 +233,7 @@ class Provider::YahooFinance < Provider
 
   def fetch_security_price(symbol:, exchange_operating_mic: nil, date:)
     with_provider_response do
+      symbol = normalize_symbol(symbol, exchange_operating_mic)
       cache_key = "security_price_#{symbol}_#{exchange_operating_mic}_#{date}"
       if cached_result = get_cached_result(cache_key)
         cached_result
@@ -259,6 +270,7 @@ class Provider::YahooFinance < Provider
 
   def fetch_security_prices(symbol:, exchange_operating_mic: nil, start_date:, end_date:)
     with_provider_response do
+      symbol = normalize_symbol(symbol, exchange_operating_mic)
       validate_date_params!(start_date, end_date)
       # Convert dates to Unix timestamps using UTC to ensure consistent epoch boundaries across timezones
       period1 = start_date.to_time.utc.to_i
@@ -281,7 +293,9 @@ class Provider::YahooFinance < Provider
       closes = quotes["close"] || []
 
       # Get currency from metadata
-      raw_currency = chart_data.dig("meta", "currency") || "USD"
+      meta_exchange = chart_data.dig("meta", "exchangeName") || ""
+      raw_currency = chart_data.dig("meta", "currency")
+      raw_currency ||= default_currency_for_exchange(meta_exchange) || "USD"
 
       prices = []
       timestamps.each_with_index do |timestamp, index|
@@ -317,6 +331,15 @@ class Provider::YahooFinance < Provider
     #      Currency Normalization
     # ================================
 
+    # Per-exchange configuration for Yahoo Finance.  Each entry maps an ISO
+    # MIC code to its Yahoo-specific symbol suffix, the default currency when
+    # Yahoo omits one, and an optional dual-listing group with a preference
+    # rank (lower = preferred).  Adding a new market is a one-line hash entry.
+    EXCHANGE_CONFIG = {
+      "XNSE" => { yahoo_suffix: ".NS", default_currency: "INR", dual_list_group: :india, preference_rank: 0 },
+      "XBOM" => { yahoo_suffix: ".BO", default_currency: "INR", dual_list_group: :india, preference_rank: 1 }
+    }.freeze
+
     # Yahoo Finance sometimes returns currencies in minor units (pence, cents)
     # This is not part of ISO 4217 but is a convention used by financial data providers
     # Mapping of Yahoo Finance minor unit codes to standard currency codes and conversion multipliers
@@ -336,6 +359,42 @@ class Provider::YahooFinance < Provider
       end
     end
 
+    # Appends the Yahoo Finance symbol suffix for exchanges that require one
+    # (e.g. XNSE → ".NS", XBOM → ".BO").  Already-suffixed symbols pass through.
+    def normalize_symbol(symbol, exchange_operating_mic)
+      suffix = EXCHANGE_CONFIG.dig(exchange_operating_mic, :yahoo_suffix)
+      return symbol if suffix.nil? || symbol.end_with?(suffix)
+      "#{symbol}#{suffix}"
+    end
+
+    # Returns the default currency for a Yahoo exchange name (e.g. "NSE" → "INR")
+    # by resolving through map_exchange_mic → EXCHANGE_CONFIG.  Returns nil for
+    # unknown exchanges so callers can fall back to their own default.
+    def default_currency_for_exchange(yahoo_exchange_name)
+      mic = map_exchange_mic(yahoo_exchange_name)
+      EXCHANGE_CONFIG.dig(mic, :default_currency)
+    end
+
+    # De-duplicates dual-listed securities that share the same company name
+    # and dual_list_group (e.g. NSE + BSE for India), keeping the exchange
+    # with the lowest preference_rank.  Preserves Yahoo's original relevance
+    # ordering by removing duplicates in-place rather than reordering.
+    def deduplicate_dual_listings(securities)
+      dominated = Set.new
+
+      securities
+        .select { |s| EXCHANGE_CONFIG.dig(s.exchange_operating_mic, :dual_list_group) }
+        .group_by { |s| [ EXCHANGE_CONFIG[s.exchange_operating_mic][:dual_list_group], s.name.to_s.strip.downcase ] }
+        .each_value do |group|
+          next unless group.size > 1
+          preferred = group.min_by { |s| EXCHANGE_CONFIG[s.exchange_operating_mic][:preference_rank] }
+          group.each { |s| dominated << s.object_id unless s.equal?(preferred) }
+        end
+
+      return securities if dominated.empty?
+      securities.reject { |s| dominated.include?(s.object_id) }
+    end
+
     # ================================
     #           Validation
     # ================================
@@ -438,7 +497,7 @@ class Provider::YahooFinance < Provider
           date: Time.at(timestamp).utc.to_date,
           from: from,
           to: to,
-          rate: (1.0 / close_rate.to_f).round(8)
+          rate: (BigDecimal("1") / BigDecimal(close_rate.to_s)).round(12)
         )
       end
 
@@ -772,6 +831,10 @@ class Provider::YahooFinance < Provider
         "XJPX" # Japan Exchange Group
       when "ASX"
         "XASX" # Australian Securities Exchange
+      when "NSE", "NSI"
+        "XNSE" # National Stock Exchange of India
+      when "BSE", "BOM"
+        "XBOM" # BSE (Bombay Stock Exchange)
       else
         exchange_code.upcase
       end
diff --git a/app/models/provider_connection_status.rb b/app/models/provider_connection_status.rb
new file mode 100644
index 000000000..0563d6f77
--- /dev/null
+++ b/app/models/provider_connection_status.rb
@@ -0,0 +1,251 @@
+# frozen_string_literal: true
+
+class ProviderConnectionStatus
+  PROVIDERS = [
+    { key: "plaid", type: "PlaidItem", association: :plaid_items, accounts: :plaid_accounts },
+    { key: "simplefin", type: "SimplefinItem", association: :simplefin_items, accounts: :simplefin_accounts },
+    { key: "lunchflow", type: "LunchflowItem", association: :lunchflow_items, accounts: :lunchflow_accounts },
+    { key: "enable_banking", type: "EnableBankingItem", association: :enable_banking_items, accounts: :enable_banking_accounts },
+    { key: "coinbase", type: "CoinbaseItem", association: :coinbase_items, accounts: :coinbase_accounts },
+    { key: "binance", type: "BinanceItem", association: :binance_items, accounts: :binance_accounts },
+    { key: "kraken", type: "KrakenItem", association: :kraken_items, accounts: :kraken_accounts },
+    { key: "coinstats", type: "CoinstatsItem", association: :coinstats_items, accounts: :coinstats_accounts },
+    { key: "snaptrade", type: "SnaptradeItem", association: :snaptrade_items, accounts: :snaptrade_accounts, linked_accounts: :linked_accounts },
+    { key: "ibkr", type: "IbkrItem", association: :ibkr_items, accounts: :ibkr_accounts },
+    { key: "mercury", type: "MercuryItem", association: :mercury_items, accounts: :mercury_accounts },
+    { key: "brex", type: "BrexItem", association: :brex_items, accounts: :brex_accounts },
+    { key: "sophtron", type: "SophtronItem", association: :sophtron_items, accounts: :sophtron_accounts },
+    { key: "indexa_capital", type: "IndexaCapitalItem", association: :indexa_capital_items, accounts: :indexa_capital_accounts }
+  ].freeze
+
+  class << self
+    def for_family(family)
+      PROVIDERS.flat_map do |provider|
+        relation = family.public_send(provider[:association])
+        items = relation.includes(association_includes_for(relation, provider)).ordered.to_a
+        sync_contexts = sync_contexts_for(provider[:type], items)
+
+        items.map do |item|
+          new(provider, item, sync_contexts.fetch(item.id, {})).to_h
+        end
+      end
+    end
+
+    private
+
+      def association_includes_for(relation, provider)
+        includes = [ { provider[:accounts] => :account_provider } ]
+        includes << provider[:linked_accounts] if provider[:linked_accounts]
+        includes << :accounts if relation.klass.reflect_on_association(:accounts)
+        includes
+      end
+
+      def sync_contexts_for(provider_type, items)
+        item_ids = items.map(&:id)
+        return {} if item_ids.empty?
+
+        latest_syncs = latest_syncs_for(provider_type, item_ids)
+        latest_completed_syncs = latest_syncs_for(provider_type, item_ids, scope: Sync.completed)
+        syncing_item_ids = Sync.visible
+                              .where(syncable_type: provider_type, syncable_id: item_ids)
+                              .distinct
+                              .pluck(:syncable_id)
+
+        item_ids.index_with do |item_id|
+          {
+            latest_sync: latest_syncs[item_id],
+            latest_completed_sync: latest_completed_syncs[item_id],
+            syncing: syncing_item_ids.include?(item_id)
+          }
+        end
+      end
+
+      def latest_syncs_for(provider_type, item_ids, scope: Sync.all)
+        ranked_syncs = scope.where(syncable_type: provider_type, syncable_id: item_ids)
+                            .select(
+                              "syncs.*, " \
+                              "ROW_NUMBER() OVER (PARTITION BY syncable_id ORDER BY created_at DESC, id DESC) AS sync_rank"
+                            )
+
+        Sync.from(ranked_syncs, :syncs).where("sync_rank = 1").index_by(&:syncable_id)
+      end
+  end
+
+  def initialize(provider, item, sync_context = {})
+    @provider = provider
+    @item = item
+    @sync_context = sync_context
+  end
+
+  def to_h
+    {
+      id: item.id,
+      provider: provider[:key],
+      provider_type: provider[:type],
+      name: item_value(:name, provider[:key].humanize),
+      status: item_value(:status),
+      requires_update: item_boolean(:requires_update?),
+      credentials_configured: credentials_configured?,
+      scheduled_for_deletion: item_boolean(:scheduled_for_deletion?),
+      pending_account_setup: pending_account_setup?,
+      institution: institution_payload,
+      accounts: accounts_payload,
+      sync: sync_payload,
+      created_at: item.created_at,
+      updated_at: item.updated_at
+    }
+  end
+
+  private
+
+    attr_reader :provider, :item, :sync_context
+
+    def credentials_configured?
+      item_boolean(:credentials_configured?)
+    end
+
+    def pending_account_setup?
+      item_boolean(:pending_account_setup?)
+    end
+
+    def institution_payload
+      {
+        name: item_value(:institution_display_name, item_value(:name, provider[:key].humanize)),
+        domain: item_value(:institution_domain),
+        url: item_value(:institution_url)
+      }
+    end
+
+    def accounts_payload
+      @accounts_payload ||= begin
+        total = provider_account_count
+        linked = linked_account_count
+
+        {
+          total_count: total,
+          linked_count: linked,
+          unlinked_count: [ total - linked, 0 ].max
+        }
+      end
+    end
+
+    def provider_account_count
+      records = provider_account_records
+      return records.size if records
+      return item.total_accounts_count if item.respond_to?(:total_accounts_count)
+
+      0
+    end
+
+    def linked_account_count
+      records = provider_account_records
+      return records.count { |provider_account| linked_provider_account?(provider_account) } if records
+      return item.linked_accounts_count if item.respond_to?(:linked_accounts_count)
+
+      if provider[:linked_accounts] && item.respond_to?(provider[:linked_accounts])
+        return item.public_send(provider[:linked_accounts]).size
+      end
+
+      return item.accounts.size if item.respond_to?(:accounts)
+
+      0
+    end
+
+    def provider_account_records
+      return unless item.respond_to?(provider[:accounts])
+
+      @provider_account_records ||= item.public_send(provider[:accounts]).to_a
+    end
+
+    def linked_provider_account?(provider_account)
+      return false unless provider_account.respond_to?(:account_provider)
+
+      association = provider_account.association(:account_provider)
+      association.loaded? ? association.target.present? : provider_account.account_provider.present?
+    end
+
+    def sync_payload
+      {
+        syncing: syncing?,
+        status_summary: sync_status_summary,
+        last_synced_at: latest_completed_sync&.completed_at,
+        latest: latest_sync_payload(latest_sync)
+      }
+    end
+
+    def sync_status_summary
+      stats = latest_completed_sync_stats
+      counts = accounts_payload
+      total = stats.fetch("total_accounts", counts[:total_count]).to_i
+      linked = stats.fetch("linked_accounts", counts[:linked_count]).to_i
+      unlinked = stats.fetch("unlinked_accounts", [ total - linked, 0 ].max).to_i
+
+      if total.zero?
+        "No accounts found"
+      elsif unlinked.zero?
+        "#{linked} #{'account'.pluralize(linked)} synced"
+      else
+        "#{linked} synced, #{unlinked} need setup"
+      end
+    end
+
+    def syncing?
+      return sync_context[:syncing] if sync_context.key?(:syncing)
+
+      item_boolean(:syncing?)
+    end
+
+    def latest_sync
+      sync_context[:latest_sync]
+    end
+
+    def latest_completed_sync
+      sync_context[:latest_completed_sync]
+    end
+
+    def latest_completed_sync_stats
+      stats = latest_completed_sync&.sync_stats
+      return stats.stringify_keys if stats.is_a?(Hash)
+      return {} unless stats.is_a?(String)
+
+      parsed = JSON.parse(stats)
+      parsed.is_a?(Hash) ? parsed.stringify_keys : {}
+    rescue JSON::ParserError
+      {}
+    end
+
+    def latest_sync_payload(sync)
+      return unless sync
+
+      {
+        id: sync.id,
+        status: sync.status,
+        created_at: sync.created_at,
+        syncing_at: sync.syncing_at,
+        completed_at: sync.completed_at,
+        failed_at: sync.failed_at,
+        error: sync_error_payload(sync)
+      }
+    end
+
+    def sync_error_payload(sync)
+      return unless sync.failed? || sync.stale?
+
+      # Provider health treats stale connections as actionable even when the
+      # generic sync API suppresses stale-without-error payloads.
+      {
+        present: true,
+        message: sync.stale? ? "Sync became stale before completion" : "Sync failed"
+      }
+    end
+
+    def item_boolean(method_name)
+      item_value(method_name, false) == true
+    end
+
+    def item_value(method_name, default = nil)
+      return default unless item.respond_to?(method_name)
+
+      item.public_send(method_name)
+    end
+end
diff --git a/app/models/provider_merchant.rb b/app/models/provider_merchant.rb
index 110a2535c..5cfb2fdf9 100644
--- a/app/models/provider_merchant.rb
+++ b/app/models/provider_merchant.rb
@@ -1,5 +1,5 @@
 class ProviderMerchant < Merchant
-  enum :source, { plaid: "plaid", simplefin: "simplefin", lunchflow: "lunchflow", synth: "synth", ai: "ai", enable_banking: "enable_banking", coinstats: "coinstats", mercury: "mercury", indexa_capital: "indexa_capital" }
+  enum :source, { plaid: "plaid", simplefin: "simplefin", lunchflow: "lunchflow", synth: "synth", ai: "ai", enable_banking: "enable_banking", coinstats: "coinstats", mercury: "mercury", brex: "brex", indexa_capital: "indexa_capital", sophtron: "sophtron" }
 
   validates :name, uniqueness: { scope: [ :source ] }
   validates :source, presence: true
diff --git a/app/models/qif_import.rb b/app/models/qif_import.rb
index 90a867d28..a0590cb21 100644
--- a/app/models/qif_import.rb
+++ b/app/models/qif_import.rb
@@ -73,6 +73,10 @@ class QifImport < Import
     account.present? && super
   end
 
+  def publishable_from_validation_stats?(invalid_rows_count:)
+    account.present? && super
+  end
+
   # Returns true if import! will move the opening anchor back to cover transactions
   # that predate the current anchor date. Used to show a notice in the confirm step.
   def will_adjust_opening_anchor?
@@ -162,8 +166,9 @@ class QifImport < Import
     def generate_transaction_rows
       transactions = QifParser.parse(raw_file_str, date_format: qif_date_format)
 
-      mapped_rows = transactions.map do |trn|
+      mapped_rows = transactions.map.with_index(1) do |trn, index|
         {
+          source_row_number:       index,
           date:                   trn.date.to_s,
           amount:                 trn.amount.to_s,
           currency:               default_currency.to_s,
@@ -189,11 +194,12 @@ class QifImport < Import
     def generate_investment_rows
       inv_transactions = QifParser.parse_investment_transactions(raw_file_str, date_format: qif_date_format)
 
-      mapped_rows = inv_transactions.map do |trn|
+      mapped_rows = inv_transactions.map.with_index(1) do |trn, index|
         if QifParser::TRADE_ACTIONS.include?(trn.action)
           qty = trade_qty_for(trn.action, trn.qty)
 
           {
+            source_row_number:       index,
             date:                   trn.date.to_s,
             ticker:                 trn.security_ticker.to_s,
             qty:                    qty.to_s,
@@ -210,6 +216,7 @@ class QifImport < Import
           }
         else
           {
+            source_row_number:       index,
             date:                   trn.date.to_s,
             amount:                 trn.amount.to_s,
             currency:               default_currency.to_s,
diff --git a/app/models/recurring_transaction.rb b/app/models/recurring_transaction.rb
index eb2784ef5..090d31549 100644
--- a/app/models/recurring_transaction.rb
+++ b/app/models/recurring_transaction.rb
@@ -3,6 +3,7 @@ class RecurringTransaction < ApplicationRecord
 
   belongs_to :family
   belongs_to :account, optional: true
+  belongs_to :destination_account, optional: true, class_name: "Account"
   belongs_to :merchant, optional: true
 
   monetize :amount
@@ -15,12 +16,15 @@ class RecurringTransaction < ApplicationRecord
   validates :amount, presence: true
   validates :currency, presence: true
   validates :expected_day_of_month, presence: true, numericality: { greater_than: 0, less_than_or_equal_to: 31 }
+  validates :status, presence: true, inclusion: { in: statuses.keys }
+  validates :occurrence_count, numericality: { only_integer: true, greater_than_or_equal_to: 0 }
   validate :merchant_or_name_present
   validate :amount_variance_consistency
+  validate :transfer_endpoints_consistent
 
   def merchant_or_name_present
     if merchant_id.blank? && name.blank?
-      errors.add(:base, "Either merchant or name must be present")
+      errors.add(:base, :merchant_or_name_required)
     end
   end
 
@@ -34,10 +38,50 @@ class RecurringTransaction < ApplicationRecord
     end
   end
 
+  # When this row represents a recurring transfer, both endpoints must be
+  # present, belong to the same family, and not be the same account.
+  def transfer_endpoints_consistent
+    return if destination_account_id.blank?
+
+    if account_id.blank?
+      errors.add(:account, "must be present on a recurring transfer")
+    elsif account.blank?
+      # account_id references a row that was destroyed. Mirror the
+      # destination_account.blank? branch so the source side surfaces a
+      # normal validation error too.
+      errors.add(:account, "must exist")
+    elsif destination_account.blank?
+      # destination_account_id references a row that was destroyed (or never
+      # existed). Surface as a normal validation error instead of letting
+      # the FK fire on save.
+      errors.add(:destination_account, "must exist")
+    elsif account_id == destination_account_id
+      errors.add(:destination_account, "cannot be the same as the source account")
+    elsif account.family_id != destination_account.family_id
+      errors.add(:destination_account, "must belong to the same family as the source account")
+    end
+  end
+
+  def transfer?
+    destination_account_id.present?
+  end
+
   scope :for_family, ->(family) { where(family: family) }
   scope :expected_soon, -> { active.where("next_expected_date <= ?", 1.month.from_now) }
   scope :accessible_by, ->(user) {
-    where(account_id: Account.accessible_by(user).select(:id)).or(where(account_id: nil))
+    accessible_account_ids = Account.accessible_by(user).select(:id)
+    # A recurring row is accessible when:
+    #   * its account_id is in the user's accessible set or null (legacy rows
+    #     with no account scoping survive), AND
+    #   * its destination_account_id is also accessible OR null (so a recurring
+    #     transfer never leaks into the list of a user without access to BOTH
+    #     endpoints).
+    where(account_id: accessible_account_ids)
+      .or(where(account_id: nil))
+      .merge(
+        where(destination_account_id: accessible_account_ids)
+          .or(where(destination_account_id: nil))
+      )
   }
 
   # Class methods for identification and cleanup
@@ -56,6 +100,44 @@ class RecurringTransaction < ApplicationRecord
     Cleaner.new(family).cleanup_stale_transactions
   end
 
+  # Create a manual recurring transfer from an existing Transfer pair.
+  # Mirrors `create_from_transaction` but populates source + destination
+  # accounts and skips merchant / variance lookup -- transfers are
+  # account-pair-shaped, not merchant-shaped.
+  def self.create_from_transfer(transfer)
+    outflow_entry = transfer.outflow_transaction&.entry
+    inflow_entry  = transfer.inflow_transaction&.entry
+
+    raise ArgumentError, "transfer is missing one of its entries" unless outflow_entry && inflow_entry
+
+    source_account      = outflow_entry.account
+    destination_account = inflow_entry.account
+    family              = source_account.family
+
+    expected_day = outflow_entry.date.day
+    next_expected = calculate_next_expected_date_from_today(expected_day)
+
+    create!(
+      family: family,
+      account: source_account,
+      destination_account: destination_account,
+      merchant_id: nil,
+      # Transfer#name yields "Payment to ..." for liability destinations
+      # and "Transfer to ..." otherwise, matching Transfer::Creator's
+      # name_prefix logic so the recurring row reads consistently with
+      # the originating Transfer.
+      name: transfer.name,
+      amount: outflow_entry.amount, # positive (outflow), per Sure sign convention
+      currency: outflow_entry.currency,
+      expected_day_of_month: expected_day,
+      last_occurrence_date: outflow_entry.date,
+      next_expected_date: next_expected,
+      status: "active",
+      occurrence_count: 1,
+      manual: true
+    )
+  end
+
   # Create a manual recurring transaction from an existing transaction
   # Automatically calculates amount variance from past 6 months of matching transactions
   def self.create_from_transaction(transaction, date_variance: 2)
@@ -311,7 +393,10 @@ class RecurringTransaction < ApplicationRecord
       amount_min: expected_amount_min,
       amount_max: expected_amount_max,
       amount_avg: expected_amount_avg,
-      has_variance: has_amount_variance?
+      has_variance: has_amount_variance?,
+      transfer: transfer?,
+      source_account: account,
+      destination_account: destination_account
     )
   end
 
diff --git a/app/models/recurring_transaction/cleaner.rb b/app/models/recurring_transaction/cleaner.rb
index 4aecbb343..dd22dcb89 100644
--- a/app/models/recurring_transaction/cleaner.rb
+++ b/app/models/recurring_transaction/cleaner.rb
@@ -7,11 +7,21 @@ class RecurringTransaction
     end
 
     # Mark recurring transactions as inactive if they haven't occurred recently
-    # Uses 2 months for automatic recurring, 6 months for manual recurring
+    # Uses 2 months for automatic recurring, 6 months for manual recurring.
+    #
+    # Transfer rows (destination_account_id present) are skipped: their
+    # `matching_transactions` helper looks at single-account name/amount
+    # which never matches a Transfer pair, so the Cleaner would
+    # incorrectly mark a still-recurring transfer inactive at the
+    # 6-month threshold. Issue #1590 tracks pair-detection-aware
+    # matching for recurring transfers.
     def cleanup_stale_transactions
       stale_count = 0
 
-      family.recurring_transactions.active.find_each do |recurring_transaction|
+      family.recurring_transactions
+            .active
+            .where(destination_account_id: nil)
+            .find_each do |recurring_transaction|
         next unless recurring_transaction.should_be_inactive?
 
         # Determine threshold based on manual flag
diff --git a/app/models/recurring_transaction/identifier.rb b/app/models/recurring_transaction/identifier.rb
index 82834c26a..bcb6656d4 100644
--- a/app/models/recurring_transaction/identifier.rb
+++ b/app/models/recurring_transaction/identifier.rb
@@ -10,14 +10,20 @@ class RecurringTransaction
     def identify_recurring_patterns
       three_months_ago = 3.months.ago.to_date
 
-      # Get all transactions from the last 3 months
+      # Skip transfer-kind transactions: they're one half of a Transfer pair, so grouping them
+      # under their single account would produce incoherent recurring "patterns" that don't
+      # represent the underlying account-pair flow. Recurring transfers are tracked on a
+      # different shape (RecurringTransaction with destination_account_id). Filtering at the
+      # SQL level avoids loading and discarding transfer entries for a busy family.
       entries_with_transactions = family.entries
+        .joins("INNER JOIN transactions ON transactions.id = entries.entryable_id")
         .where(entryable_type: "Transaction")
         .where("entries.date >= ?", three_months_ago)
+        .where.not("transactions.kind": Transaction::TRANSFER_KINDS)
         .includes(:entryable)
         .to_a
 
-      # Group by merchant (if present) or name, along with amount (preserve sign) and currency
+      # Group by merchant (if present) or name, along with amount (preserve sign) and currency.
       grouped_transactions = entries_with_transactions
         .select { |entry| entry.entryable.is_a?(Transaction) }
         .group_by do |entry|
@@ -140,9 +146,17 @@ class RecurringTransaction
       recurring_patterns.size
     end
 
-    # Update variance for existing manual recurring transactions
+    # Update variance for existing manual recurring transactions.
+    #
+    # Transfer rows (destination_account_id present) are skipped: their
+    # variance / occurrence tracking would need pair-detection across
+    # both endpoints rather than the single-account name/merchant match
+    # the helper performs. Issue #1590 tracks the proper Cleaner-aware
+    # matching for recurring transfers.
     def update_manual_recurring_transactions(since_date)
-      family.recurring_transactions.where(manual: true, status: "active").find_each do |recurring|
+      family.recurring_transactions
+            .where(manual: true, status: "active", destination_account_id: nil)
+            .find_each do |recurring|
         # Find matching transactions in the recent period
         matching_entries = RecurringTransaction.find_matching_transaction_entries(
           family: family,
diff --git a/app/models/rule.rb b/app/models/rule.rb
index b53f80f83..d5b89eef0 100644
--- a/app/models/rule.rb
+++ b/app/models/rule.rb
@@ -140,14 +140,14 @@ class Rule < ApplicationRecord
       return if new_record? && !actions.empty?
 
       if actions.reject(&:marked_for_destruction?).empty?
-        errors.add(:base, "must have at least one action")
+        errors.add(:base, :min_actions)
       end
     end
 
     def no_duplicate_actions
       action_types = actions.reject(&:marked_for_destruction?).map(&:action_type)
 
-      errors.add(:base, "Rule cannot have duplicate actions #{action_types.inspect}") if action_types.uniq.count != action_types.count
+      errors.add(:base, :duplicate_actions, types: action_types.inspect) if action_types.uniq.count != action_types.count
     end
 
     # Validation: To keep rules simple and easy to understand, we don't allow nested compound conditions.
@@ -157,7 +157,7 @@ class Rule < ApplicationRecord
       conditions.each do |condition|
         if condition.compound?
           if condition.sub_conditions.any? { |sub_condition| sub_condition.compound? }
-            errors.add(:base, "Compound conditions cannot be nested")
+            errors.add(:base, :nested_conditions)
           end
         end
       end
diff --git a/app/models/rule_import.rb b/app/models/rule_import.rb
index 48ae775fc..31cf4025a 100644
--- a/app/models/rule_import.rb
+++ b/app/models/rule_import.rb
@@ -52,10 +52,11 @@ class RuleImport < Import
   def generate_rows_from_csv
     rows.destroy_all
 
-    csv_rows.each do |row|
+    csv_rows.each.with_index(1) do |row, index|
       normalized_row = normalize_rule_row(row)
 
       rows.create!(
+        source_row_number: index,
         name: normalized_row[:name].to_s.strip,
         resource_type: normalized_row[:resource_type].to_s.strip,
         active: parse_boolean(normalized_row[:active]),
@@ -114,7 +115,7 @@ class RuleImport < Import
 
       # Validate resource type
       unless resource_type == "transaction"
-        errors.add(:base, "Unsupported resource type: #{resource_type}")
+        errors.add(:base, :unsupported_resource_type, resource_type: resource_type)
         raise ActiveRecord::RecordInvalid.new(self)
       end
 
@@ -123,13 +124,13 @@ class RuleImport < Import
         conditions_data = parse_json_safely(row.conditions, "conditions")
         actions_data = parse_json_safely(row.actions, "actions")
       rescue JSON::ParserError => e
-        errors.add(:base, "Invalid JSON in conditions or actions: #{e.message}")
+        errors.add(:base, :invalid_json, message: e.message)
         raise ActiveRecord::RecordInvalid.new(self)
       end
 
       # Validate we have at least one action
       if actions_data.empty?
-        errors.add(:base, "Rule must have at least one action")
+        errors.add(:base, :min_actions)
         raise ActiveRecord::RecordInvalid.new(self)
       end
 
diff --git a/app/models/rule_run.rb b/app/models/rule_run.rb
index 8f0ac759f..3028de44a 100644
--- a/app/models/rule_run.rb
+++ b/app/models/rule_run.rb
@@ -27,6 +27,10 @@ class RuleRun < ApplicationRecord
     status == "failed"
   end
 
+  def transactions_blocked
+    [ transactions_processed - transactions_modified, 0 ].max
+  end
+
   # Thread-safe method to complete a job and update the run
   def complete_job!(modified_count: 0)
     with_lock do
diff --git a/app/models/security.rb b/app/models/security.rb
index 35b0e8bdd..b4268fc5e 100644
--- a/app/models/security.rb
+++ b/app/models/security.rb
@@ -1,6 +1,9 @@
 class Security < ApplicationRecord
   include Provided, PlanRestrictionTracker
 
+  # Transient attribute for search results -- not persisted
+  attr_accessor :search_currency
+
   # ISO 10383 MIC codes mapped to user-friendly exchange names
   # Source: https://www.iso20022.org/market-identifier-codes
   # Data stored in config/exchanges.yml
@@ -8,8 +11,25 @@ class Security < ApplicationRecord
 
   KINDS = %w[standard cash].freeze
 
+  # Known securities provider keys — derived from the registry so adding a new
+  # provider to Registry#available_providers automatically allows it here.
+  # Evaluated at runtime (not boot) so runtime-enabled providers are accepted.
+  def self.valid_price_providers
+    Provider::Registry.for_concept(:securities).provider_keys.map(&:to_s)
+  end
+
+  # Builds the Brandfetch crypto URL for a base asset (e.g. "BTC"). Returns
+  # nil when Brandfetch isn't configured.
+  def self.brandfetch_crypto_url(base_asset)
+    return nil if base_asset.blank?
+    return nil unless Setting.brand_fetch_client_id.present?
+    size = Setting.brand_fetch_logo_size
+    "https://cdn.brandfetch.io/crypto/#{base_asset}/icon/fallback/lettermark/w/#{size}/h/#{size}?c=#{Setting.brand_fetch_client_id}"
+  end
+
   before_validation :upcase_symbols
   before_save :generate_logo_url_from_brandfetch, if: :should_generate_logo?
+  before_save :reset_first_provider_price_on_if_provider_changed
 
   has_many :trades, dependent: :nullify, class_name: "Trade"
   has_many :prices, dependent: :destroy
@@ -17,10 +37,17 @@ class Security < ApplicationRecord
   validates :ticker, presence: true
   validates :ticker, uniqueness: { scope: :exchange_operating_mic, case_sensitive: false }
   validates :kind, inclusion: { in: KINDS }
+  validates :price_provider, inclusion: { in: ->(_) { Security.valid_price_providers } }, allow_nil: true
 
   scope :online, -> { where(offline: false) }
   scope :standard, -> { where(kind: "standard") }
 
+  # Parses the combobox ID format "SYMBOL|EXCHANGE|PROVIDER" into a hash.
+  def self.parse_combobox_id(value)
+    parts = value.to_s.split("|", 3)
+    { ticker: parts[0].presence, exchange_operating_mic: parts[1].presence, price_provider: parts[2].presence }
+  end
+
   # Lazily finds or creates a synthetic cash security for an account.
   # Used as fallback when creating an interest Trade without a user-selected security.
   def self.cash_for(account)
@@ -35,6 +62,38 @@ class Security < ApplicationRecord
     kind == "cash"
   end
 
+  # True when this security represents a crypto asset. Today the only signal
+  # is the Binance ISO MIC — when we add a second crypto provider, extend
+  # this check rather than duplicating the test at every call site.
+  def crypto?
+    exchange_operating_mic == Provider::BinancePublic::BINANCE_MIC
+  end
+
+  # Strips the display-currency suffix from a crypto ticker (BTCUSD -> BTC,
+  # ETHEUR -> ETH). Returns nil for non-crypto securities or when the ticker
+  # doesn't end in a supported quote.
+  def crypto_base_asset
+    return nil unless crypto?
+    Provider::BinancePublic::QUOTE_TO_CURRENCY.each_value do |suffix|
+      next unless ticker.end_with?(suffix)
+      base = ticker.delete_suffix(suffix)
+      return base unless base.empty?
+    end
+    nil
+  end
+
+  # Single source of truth for which logo URL the UI should render. Crypto
+  # and stocks share the same shape: prefer a freshly computed Brandfetch
+  # URL (honors current client_id + size) and fall back to any stored
+  # logo_url for the provider-returns-its-own-URL case (e.g. Tiingo S3).
+  def display_logo_url
+    if crypto?
+      self.class.brandfetch_crypto_url(crypto_base_asset).presence || logo_url.presence
+    else
+      brandfetch_icon_url.presence || logo_url.presence
+    end
+  end
+
   # Returns user-friendly exchange name for a MIC code
   def self.exchange_name_for(mic)
     return nil if mic.blank?
@@ -57,7 +116,9 @@ class Security < ApplicationRecord
       name: name,
       logo_url: logo_url,
       exchange_operating_mic: exchange_operating_mic,
-      country_code: country_code
+      country_code: country_code,
+      price_provider: price_provider,
+      currency: search_currency
     )
   end
 
@@ -92,8 +153,7 @@ class Security < ApplicationRecord
 
     def should_generate_logo?
       return false if cash?
-      url = brandfetch_icon_url
-      return false unless url.present?
+      return false unless Setting.brand_fetch_client_id.present?
 
       return true if logo_url.blank?
       return false unless logo_url.include?("cdn.brandfetch.io")
@@ -102,6 +162,22 @@ class Security < ApplicationRecord
     end
 
     def generate_logo_url_from_brandfetch
-      self.logo_url = brandfetch_icon_url
+      self.logo_url = if crypto?
+        self.class.brandfetch_crypto_url(crypto_base_asset)
+      else
+        brandfetch_icon_url
+      end
+    end
+
+    # When a user remaps a security to a different provider (via the holdings
+    # remap combobox or Security::Resolver), the previously-discovered
+    # first_provider_price_on belongs to the OLD provider and may no longer
+    # reflect what the new provider can serve. Reset it so the next sync's
+    # fallback rediscovers the correct earliest date for the new provider.
+    # Skip when the caller explicitly set both columns in the same save.
+    def reset_first_provider_price_on_if_provider_changed
+      return unless price_provider_changed?
+      return if first_provider_price_on_changed?
+      self.first_provider_price_on = nil
     end
 end
diff --git a/app/models/security/combobox_option.rb b/app/models/security/combobox_option.rb
index 0123023f4..18a491427 100644
--- a/app/models/security/combobox_option.rb
+++ b/app/models/security/combobox_option.rb
@@ -1,10 +1,10 @@
 class Security::ComboboxOption
   include ActiveModel::Model
 
-  attr_accessor :symbol, :name, :logo_url, :exchange_operating_mic, :country_code
+  attr_accessor :symbol, :name, :logo_url, :exchange_operating_mic, :country_code, :price_provider, :currency
 
   def id
-    "#{symbol}|#{exchange_operating_mic}"
+    "#{symbol}|#{exchange_operating_mic}|#{price_provider}"
   end
 
   def exchange_name
diff --git a/app/models/security/health_checker.rb b/app/models/security/health_checker.rb
index 74e5a8d50..c24428c46 100644
--- a/app/models/security/health_checker.rb
+++ b/app/models/security/health_checker.rb
@@ -66,11 +66,21 @@ class Security::HealthChecker
     attr_reader :security
 
     def provider
-      Security.provider
+      security.price_data_provider
+    end
+
+    # Some providers (e.g., Alpha Vantage) have very low daily limits and no
+    # lightweight endpoint — each health check burns a full API call that
+    # fetches ~100 data points. Skip health checks for those providers to
+    # avoid exhausting their quota on monitoring alone.
+    def skip_health_check?
+      provider.present? && provider.respond_to?(:max_history_days) &&
+        provider.is_a?(Provider::AlphaVantage)
     end
 
     def latest_provider_price
       return nil unless provider.present?
+      return true if skip_health_check? # treat as healthy — quota too precious
 
       response = provider.fetch_security_price(
         symbol: security.ticker,
@@ -111,6 +121,7 @@ class Security::HealthChecker
       Security.transaction do
         security.update!(
           offline: true,
+          offline_reason: "health_check_failed",
           failed_fetch_count: MAX_CONSECUTIVE_FAILURES + 1,
           failed_fetch_at: Time.current
         )
diff --git a/app/models/security/price/importer.rb b/app/models/security/price/importer.rb
index 9d57332b6..082ef0262 100644
--- a/app/models/security/price/importer.rb
+++ b/app/models/security/price/importer.rb
@@ -30,21 +30,52 @@ class Security::Price::Importer
     prev_price_value = start_price_value
     prev_currency = prev_price_currency || db_price_currency || "USD"
 
+    # Fallback for holdings that predate the asset's listing on the provider
+    # (e.g. a 2018 BTCEUR trade vs. Binance's 2020-01-03 listing date, or a
+    # 2023 RDDT trade vs. the 2024-03-21 IPO on Yahoo/Twelve Data). We can't
+    # anchor a price on or before start_date, but provider_prices has real
+    # data later in the range — advance fill_start_date to the earliest
+    # available provider date and use that price as the LOCF anchor. Days
+    # before that are intentionally left out of the DB (honest gap) rather
+    # than backfilled from a future price.
+    advanced_first_price_on = nil
+
+    if prev_price_value.blank?
+      # Filter for valid rows BEFORE picking the earliest — otherwise a
+      # single listing-day / halt-day row with a nil or zero price would
+      # cause us to fall through to the MissingStartPriceError bail even
+      # when plenty of valid prices exist later in the window.
+      earliest_provider_price = provider_prices.values
+        .select { |p| p.price.present? && p.price.to_f > 0 }
+        .min_by(&:date)
+
+      if earliest_provider_price
+        Rails.logger.info(
+          "#{security.ticker}: no provider price on or before #{start_date}; " \
+          "advancing gapfill start to earliest valid provider date #{earliest_provider_price.date}"
+        )
+        prev_price_value        = earliest_provider_price.price
+        prev_currency           = earliest_provider_price.currency || prev_currency
+        @fill_start_date        = earliest_provider_price.date
+        advanced_first_price_on = earliest_provider_price.date
+      end
+    end
+
     unless prev_price_value.present?
-      Rails.logger.error("Could not find a start price for #{security.ticker} on or before #{start_date}")
+      Rails.logger.error("Could not find a start price for #{security.ticker} on or before #{fill_start_date}")
 
       Sentry.capture_exception(MissingStartPriceError.new("Could not determine start price for ticker")) do |scope|
         scope.set_tags(security_id: security.id)
         scope.set_context("security", {
           id: security.id,
-          start_date: start_date
+          start_date: fill_start_date
         })
       end
 
       return 0
     end
 
-    gapfilled_prices = effective_start_date.upto(end_date).map do |date|
+    gapfilled_prices = fill_start_date.upto(end_date).map do |date|
       db_price             = db_prices[date]
       db_price_value       = db_price&.price
       provider_price       = provider_prices[date]
@@ -95,21 +126,59 @@ class Security::Price::Importer
       }
     end
 
-    upsert_rows(gapfilled_prices)
+    result = upsert_rows(gapfilled_prices)
+
+    # Persist the advanced start date so subsequent syncs can clamp
+    # expected_count and short-circuit via all_prices_exist? instead of
+    # re-iterating the full (start_date..end_date) range every time.
+    #
+    # Update when the column is currently blank, OR when we've discovered
+    # an EARLIER date than the stored one — the latter covers the
+    # clear_cache-driven case where a provider has extended its backward
+    # coverage (e.g. Binance backfilling older BTCEUR history) and we
+    # want subsequent syncs to reflect the new earlier clamp. We never
+    # move the column forward from a previously-discovered earlier value,
+    # since that would silently hide older rows already in the DB.
+    if advanced_first_price_on.present? &&
+       (security.first_provider_price_on.blank? ||
+        advanced_first_price_on < security.first_provider_price_on)
+      security.update_column(:first_provider_price_on, advanced_first_price_on)
+    end
+
+    result
   end
 
   private
     attr_reader :security, :security_provider, :start_date, :end_date, :clear_cache
 
+    # The start date sent to the provider API, clamped to the provider's max
+    # lookback window when applicable. Computed independently of provider_prices
+    # so fill_start_date can reference it without relying on method call order.
+    def provider_fetch_start_date
+      @provider_fetch_start_date ||= begin
+        base = effective_start_date - PROVISIONAL_LOOKBACK_DAYS.days
+        max_days = security_provider.respond_to?(:max_history_days) ? security_provider.max_history_days : nil
+
+        if max_days && (end_date - base).to_i > max_days
+          clamped = end_date - max_days.days
+          Rails.logger.info(
+            "#{security_provider.class.name} max history is #{max_days} days; " \
+            "clamping #{security.ticker} start_date from #{base} to #{clamped}"
+          )
+          clamped
+        else
+          base
+        end
+      end
+    end
+
     def provider_prices
       @provider_prices ||= begin
-        provider_fetch_start_date = effective_start_date - PROVISIONAL_LOOKBACK_DAYS.days
-
         response = security_provider.fetch_security_prices(
           symbol: security.ticker,
           exchange_operating_mic: security.exchange_operating_mic,
           start_date: provider_fetch_start_date,
-          end_date:   end_date
+          end_date: end_date
         )
 
         if response.success?
@@ -127,10 +196,20 @@ class Security::Price::Importer
             )
           end
 
-          Sentry.capture_exception(MissingSecurityPriceError.new("Could not fetch prices for ticker"), level: :warning) do |scope|
-            scope.set_tags(security_id: security.id)
-            scope.set_context("security", { id: security.id, start_date: start_date, end_date: end_date })
-          end
+          DebugLogEntry.capture(
+            category: "security_price_fetch",
+            level: "warn",
+            message: "Could not fetch prices for ticker",
+            source: self.class.name,
+            provider: security_provider,
+            metadata: {
+              security_id: security.id,
+              ticker: security.ticker,
+              start_date: start_date,
+              end_date: end_date,
+              provider_error: error_message
+            }
+          )
 
           @provider_error = error_message
           {}
@@ -147,7 +226,16 @@ class Security::Price::Importer
 
     def all_prices_exist?
       return false if has_refetchable_provisional_prices?
-      db_prices.count == expected_count
+
+      # Count only prices in the clamped range so pre-listing / pre-IPO gaps
+      # don't perpetually trip the "expected_count mismatch" re-sync. Query
+      # directly rather than via db_prices (which stays at the full range to
+      # preserve any user-entered rows pre-listing).
+      persisted_count = Security::Price
+        .where(security_id: security.id, date: clamped_start_date..end_date)
+        .count
+
+      persisted_count == expected_count
     end
 
     def has_refetchable_provisional_prices?
@@ -157,27 +245,53 @@ class Security::Price::Importer
     end
 
     def expected_count
-      (start_date..end_date).count
+      (clamped_start_date..end_date).count
+    end
+
+    # Effective start date after clamping to the security's known first
+    # provider-available price date. Unlike start_date, this shrinks when the
+    # provider's history (e.g. Binance BTCEUR listed 2020-01-03, RDDT IPO
+    # 2024-03-21) begins after the user's original start_date. Falls through
+    # to start_date for any security that has never tripped the fallback.
+    def clamped_start_date
+      @clamped_start_date ||= begin
+        listed = security.first_provider_price_on
+        listed.present? && listed > start_date ? listed : start_date
+      end
     end
 
     # Skip over ranges that already exist unless clearing cache
-    # Also includes dates with refetchable provisional prices
+    # Also includes dates with refetchable provisional prices.
+    #
+    # Iterates from clamped_start_date (not start_date) so pre-listing /
+    # pre-IPO gaps don't perpetually trip "first missing date = start_date"
+    # and cause every incremental sync to re-fetch + re-upsert the full
+    # post-listing range. clear_cache bypasses the clamp so a user-triggered
+    # refresh can rediscover earlier provider history.
     def effective_start_date
       return start_date if clear_cache
 
-      refetchable_dates = Security::Price.where(security_id: security.id, date: start_date..end_date)
+      refetchable_dates = Security::Price.where(security_id: security.id, date: clamped_start_date..end_date)
                                          .refetchable_provisional(lookback_days: PROVISIONAL_LOOKBACK_DAYS)
                                          .pluck(:date)
                                          .to_set
 
-      (start_date..end_date).detect do |d|
+      (clamped_start_date..end_date).detect do |d|
         !db_prices.key?(d) || refetchable_dates.include?(d)
       end || end_date
     end
 
+    # The date the gap-fill loop starts from. When the provider's history was
+    # clamped (e.g. Alpha Vantage 140 days), we start from the clamped window
+    # instead of the original effective_start_date to avoid writing hundreds of
+    # LOCF-filled prices for dates the provider can't actually serve.
+    def fill_start_date
+      @fill_start_date ||= [ provider_fetch_start_date, effective_start_date ].max
+    end
+
     def start_price_value
       # When processing full range (first sync), use original behavior
-      if effective_start_date == start_date
+      if fill_start_date == start_date
         provider_price_value = provider_prices.select { |date, _| date <= start_date }
                                               .max_by { |date, _| date }
                                               &.last&.price
@@ -188,9 +302,8 @@ class Security::Price::Importer
         return nil
       end
 
-      # For partial range (effective_start_date > start_date), use recent data
-      # This prevents stale prices from old trade dates propagating to current gap-fills
-      cutoff_date = effective_start_date
+      # For partial range or clamped range, use the most recent data before fill_start_date
+      cutoff_date = fill_start_date
 
       # First try provider prices (most recent before cutoff)
       provider_price_value = provider_prices
diff --git a/app/models/security/provided.rb b/app/models/security/provided.rb
index e412244a9..1d7805422 100644
--- a/app/models/security/provided.rb
+++ b/app/models/security/provided.rb
@@ -4,50 +4,187 @@ module Security::Provided
   SecurityInfoMissingError = Class.new(StandardError)
 
   class_methods do
-    def provider
-      provider = ENV["SECURITIES_PROVIDER"].presence || Setting.securities_provider
-      registry = Provider::Registry.for_concept(:securities)
-      registry.get_provider(provider.to_sym)
+    # Returns all enabled and configured securities providers
+    def providers
+      Setting.enabled_securities_providers.filter_map do |name|
+        Provider::Registry.for_concept(:securities).get_provider(name.to_sym)
+      rescue Provider::Registry::Error
+        nil
+      end
     end
 
+    # Backward compat: first enabled provider
+    def provider
+      providers.first
+    end
+
+    # Get a specific provider by key name (e.g., "finnhub", "twelve_data")
+    # Returns nil if the provider is disabled in settings or not configured.
+    def provider_for(name)
+      return nil if name.blank?
+      return nil unless Setting.enabled_securities_providers.include?(name.to_s)
+      Provider::Registry.for_concept(:securities).get_provider(name.to_sym)
+    rescue Provider::Registry::Error
+      nil
+    end
+
+    # Cache duration for search results (avoids burning through provider rate limits)
+    SEARCH_CACHE_TTL = 5.minutes
+
+    # Maximum number of results returned to the combobox dropdown
+    MAX_SEARCH_RESULTS = 30
+
+    # Per-provider timeout so one slow provider can't stall the entire search
+    PROVIDER_SEARCH_TIMEOUT = 8.seconds
+
     def search_provider(symbol, country_code: nil, exchange_operating_mic: nil)
-      return [] if provider.nil? || symbol.blank?
+      return [] if symbol.blank?
+
+      active_providers = providers.compact
+      return [] if active_providers.empty?
 
       params = {
         country_code: country_code,
         exchange_operating_mic: exchange_operating_mic
       }.compact_blank
 
-      response = provider.search_securities(symbol, **params)
-
-      if response.success?
-        securities = response.data.map do |provider_security|
-          # Need to map to domain model so Combobox can display via to_combobox_option
-          Security.new(
-            ticker: provider_security.symbol,
-            name: provider_security.name,
-            logo_url: provider_security.logo_url,
-            exchange_operating_mic: provider_security.exchange_operating_mic,
-            country_code: provider_security.country_code
-          )
+      # Query all providers concurrently so the total wall time is max(provider
+      # latencies) instead of sum. Each future runs in the concurrent-ruby thread
+      # pool, keeping Puma threads unblocked during individual provider sleeps.
+      futures = active_providers.map do |prov|
+        Concurrent::Promises.future(prov) do |provider|
+          fetch_provider_results(provider, symbol, params)
         end
-
-        # Sort results to prioritize user's country if provided
-        if country_code.present?
-          user_country = country_code.upcase
-          securities.sort_by do |s|
-            [
-              s.country_code&.upcase == user_country ? 0 : 1, # User's country first
-              s.ticker.upcase == symbol.upcase ? 0 : 1        # Exact ticker match second
-            ]
-          end
-        else
-          securities
-        end
-      else
-        []
       end
+
+      # Collect results from each future individually with a shared deadline.
+      # Unlike zip (which is all-or-nothing), this keeps results from fast
+      # providers even when a slow one times out.
+      deadline = Time.current + PROVIDER_SEARCH_TIMEOUT
+      results_array = futures.map do |future|
+        remaining = [ (deadline - Time.current), 0 ].max
+        future.value(remaining)
+      end
+
+      all_results = []
+      seen_keys = Set.new
+
+      results_array.each_with_index do |provider_results, idx|
+        next if provider_results.nil?
+
+        provider_key = provider_key_for(active_providers[idx])
+
+        provider_results.each do |ps|
+          # Dedup key includes provider so the same ticker on the same exchange can
+          # appear once per provider — the user picks which provider's price feed
+          # they want and that choice is stored in price_provider.
+          dedup_key = "#{ps[:symbol]}|#{ps[:exchange_operating_mic]}|#{provider_key}".upcase
+          next if seen_keys.include?(dedup_key)
+          seen_keys.add(dedup_key)
+
+          security = Security.new(
+            ticker: ps[:symbol],
+            name: ps[:name],
+            logo_url: ps[:logo_url],
+            exchange_operating_mic: ps[:exchange_operating_mic],
+            country_code: ps[:country_code],
+            search_currency: ps[:currency],
+            price_provider: provider_key
+          )
+          all_results << security
+        end
+      end
+
+      if all_results.empty? && active_providers.any?
+        Rails.logger.warn("Security search: all #{active_providers.size} providers returned no results for '#{symbol}'")
+      end
+
+      rank_search_results(all_results, symbol, country_code).first(MAX_SEARCH_RESULTS)
     end
+
+    private
+      def provider_key_for(provider_instance)
+        provider_instance.class.name.demodulize.underscore
+      end
+
+      # Fetches (or reads from cache) search results for a single provider.
+      # Designed to run inside a Concurrent::Promises.future.
+      def fetch_provider_results(prov, symbol, params)
+        provider_key = provider_key_for(prov)
+        cache_key = "security_search:#{provider_key}:#{symbol.upcase}:#{Digest::SHA256.hexdigest(params.sort_by { |k, _| k }.to_json)}"
+
+        Rails.cache.fetch(cache_key, expires_in: SEARCH_CACHE_TTL, skip_nil: true) do
+          response = prov.search_securities(symbol, **params)
+          next nil unless response.success?
+
+          response.data.map do |ps|
+            { symbol: ps.symbol, name: ps.name, logo_url: ps.logo_url,
+              exchange_operating_mic: ps.exchange_operating_mic, country_code: ps.country_code,
+              currency: ps.respond_to?(:currency) ? ps.currency : nil }
+          end
+        end
+      rescue => e
+        Rails.logger.warn("Security search failed for #{provider_key}: #{e.message}")
+        nil
+      end
+
+      # Scores and sorts search results so the most relevant matches appear first.
+      # Scoring criteria (lower = better):
+      #   0: exact ticker match
+      #   1: ticker starts with query
+      #   2: name contains query
+      #   3: everything else
+      # Within the same relevance tier, user's country is preferred.
+      def rank_search_results(results, symbol, country_code)
+        query = symbol.upcase
+        user_country = country_code&.upcase
+
+        results.sort_by do |s|
+          ticker_up = s.ticker.upcase
+          relevance = if ticker_up == query
+            0
+          elsif ticker_up.start_with?(query)
+            1
+          elsif s.name&.upcase&.include?(query)
+            2
+          else
+            3
+          end
+
+          country_match = (user_country.present? && s.country_code&.upcase == user_country) ? 0 : 1
+
+          [ relevance, country_match, ticker_up ]
+        end
+      end
+  end
+
+  # Public method: resolves the provider for this specific security.
+  # Uses the security's assigned price_provider if available and configured.
+  # Falls back to the first enabled provider only when no specific provider
+  # was ever assigned. When an assigned provider becomes unavailable, returns
+  # nil so the security is skipped rather than queried against an incompatible
+  # provider (e.g. MFAPI scheme codes sent to TwelveData).
+  def price_data_provider
+    if price_provider.present?
+      assigned = self.class.provider_for(price_provider)
+      return assigned if assigned.present?
+      return nil # assigned provider is unavailable — don't silently fall back
+    end
+    self.class.providers.first
+  end
+
+  # Returns the health status of this security's provider link.
+  # Delegates to price_data_provider to avoid duplicating provider lookup logic.
+  def provider_status
+    resolved = price_data_provider
+
+    # Had a specific provider assigned but it's now unavailable
+    return :provider_unavailable if resolved.nil? && price_provider.present?
+
+    return :offline if offline?
+    return :no_provider if resolved.nil?
+    return :stale if failed_fetch_count.to_i > 0
+    :ok
   end
 
   def find_or_fetch_price(date: Date.current, cache: true)
@@ -59,8 +196,8 @@ module Security::Provided
     return nil if offline?
 
     # Make sure we have a data provider before fetching
-    return nil unless provider.present?
-    response = provider.fetch_security_price(
+    return nil unless price_data_provider.present?
+    response = price_data_provider.fetch_security_price(
       symbol: ticker,
       exchange_operating_mic: exchange_operating_mic,
       date: date
@@ -79,7 +216,7 @@ module Security::Provided
   end
 
   def import_provider_details(clear_cache: false)
-    unless provider.present?
+    unless price_data_provider.present?
       Rails.logger.warn("No provider configured for Security.import_provider_details")
       return
     end
@@ -88,44 +225,49 @@ module Security::Provided
       return
     end
 
-    response = provider.fetch_security_info(
+    response = price_data_provider.fetch_security_info(
       symbol: ticker,
       exchange_operating_mic: exchange_operating_mic
     )
 
     if response.success?
-      update(
-        name: response.data.name,
-        logo_url: response.data.logo_url,
-        website_url: response.data.links
-      )
+      # Only overwrite fields the provider actually returned, so providers that
+      # don't support metadata (e.g. Alpha Vantage) won't blank existing values.
+      attrs = {}
+      attrs[:name]        = response.data.name    if response.data.name.present?
+      attrs[:logo_url]    = response.data.logo_url if response.data.logo_url.present?
+      attrs[:website_url] = response.data.links   if response.data.links.present?
+      update(attrs) if attrs.any?
     else
-      Rails.logger.warn("Failed to fetch security info for #{ticker} from #{provider.class.name}: #{response.error.message}")
-      Sentry.capture_exception(SecurityInfoMissingError.new("Failed to get security info"), level: :warning) do |scope|
-        scope.set_tags(security_id: self.id)
-        scope.set_context("security", { id: self.id, provider_error: response.error.message })
-      end
+      Rails.logger.warn("Failed to fetch security info for #{ticker} from #{price_data_provider.class.name}: #{response.error.message}")
+      DebugLogEntry.capture(
+        category: "security_metadata_fetch",
+        level: "warn",
+        message: "Failed to get security info",
+        source: self.class.name,
+        provider: price_data_provider,
+        metadata: {
+          security_id: self.id,
+          ticker: ticker,
+          provider_error: response.error.message
+        }
+      )
     end
   end
 
   def import_provider_prices(start_date:, end_date:, clear_cache: false)
-    unless provider.present?
+    unless price_data_provider.present?
       Rails.logger.warn("No provider configured for Security.import_provider_prices")
       return 0
     end
 
     importer = Security::Price::Importer.new(
       security: self,
-      security_provider: provider,
+      security_provider: price_data_provider,
       start_date: start_date,
       end_date: end_date,
       clear_cache: clear_cache
     )
     [ importer.import_provider_prices, importer.provider_error ]
   end
-
-  private
-    def provider
-      self.class.provider
-    end
 end
diff --git a/app/models/security/resolver.rb b/app/models/security/resolver.rb
index 2ec7fb701..4d0521b2d 100644
--- a/app/models/security/resolver.rb
+++ b/app/models/security/resolver.rb
@@ -1,8 +1,9 @@
 class Security::Resolver
-  def initialize(symbol, exchange_operating_mic: nil, country_code: nil)
+  def initialize(symbol, exchange_operating_mic: nil, country_code: nil, price_provider: nil)
     @symbol = validate_symbol!(symbol)
     @exchange_operating_mic = exchange_operating_mic
     @country_code = country_code
+    @price_provider = validated_price_provider(price_provider)
   end
 
   # Attempts several paths to resolve a security:
@@ -20,13 +21,22 @@ class Security::Resolver
   end
 
   private
-    attr_reader :symbol, :exchange_operating_mic, :country_code
+    attr_reader :symbol, :exchange_operating_mic, :country_code, :price_provider
 
     def validate_symbol!(symbol)
       raise ArgumentError, "Symbol is required and cannot be blank" if symbol.blank?
       symbol.strip.upcase
     end
 
+    # Only accept price_provider values that are known and currently enabled.
+    # Prevents tampered combobox values from persisting invalid provider names.
+    def validated_price_provider(value)
+      return nil if value.blank?
+      return nil unless Security.valid_price_providers.include?(value.to_s)
+      return nil unless Setting.enabled_securities_providers.include?(value.to_s)
+      value.to_s
+    end
+
     def offline_security
       security = Security.find_or_initialize_by(
         ticker: symbol,
@@ -44,13 +54,26 @@ class Security::Resolver
     end
 
     def exact_match_from_db
-      Security.find_by(
+      security = Security.find_by(
         {
           ticker: symbol,
           exchange_operating_mic: exchange_operating_mic,
           country_code: country_code.presence
         }.compact
       )
+
+      return nil unless security
+
+      # When the caller provides an explicit provider (e.g. user selected from
+      # search results), honor that choice. Automated syncs (Plaid, SimpleFIN)
+      # pass price_provider: nil and will not overwrite.
+      if price_provider.present? && security.price_provider != price_provider
+        security.update!(price_provider: price_provider)
+      end
+
+      reactivate_if_provider_available!(security)
+
+      security
     end
 
     # If provided a ticker + exchange (and optionally, a country code), we can find exact matches
@@ -59,11 +82,11 @@ class Security::Resolver
       return nil unless exchange_operating_mic.present?
 
       match = provider_search_result.find do |s|
-        ticker_matches = s.ticker.upcase.to_s == symbol.upcase.to_s
-        exchange_matches = s.exchange_operating_mic.upcase.to_s == exchange_operating_mic.upcase.to_s
+        ticker_matches = s.ticker&.upcase.to_s == symbol.upcase.to_s
+        exchange_matches = s.exchange_operating_mic&.upcase.to_s == exchange_operating_mic.upcase.to_s
 
         if country_code && exchange_operating_mic
-          ticker_matches && exchange_matches && s.country_code&.upcase.to_s == country_code.upcase.to_s
+          ticker_matches && exchange_matches && country_matches?(s.country_code)
         else
           ticker_matches && exchange_matches
         end
@@ -78,8 +101,10 @@ class Security::Resolver
       filtered_candidates = provider_search_result
 
       # If a country code is specified, we MUST find a match with the same code
+      # — but nil candidate country is treated as a wildcard (e.g. crypto from
+      # Binance, which isn't tied to a jurisdiction).
       if country_code.present?
-        filtered_candidates = filtered_candidates.select { |s| s.country_code&.upcase.to_s == country_code.upcase.to_s }
+        filtered_candidates = filtered_candidates.select { |s| country_matches?(s.country_code) }
       end
 
       # 1. Prefer exact ticker matches (MSTR before MSTRX when searching for "MSTR")
@@ -88,8 +113,8 @@ class Security::Resolver
       # 4. Rank by exchange_operating_mic relevance (lower index in the list is more relevant)
       sorted_candidates = filtered_candidates.sort_by do |s|
         [
-          s.ticker.upcase.to_s == symbol.upcase.to_s ? 0 : 1,
-          exchange_operating_mic.present? && s.exchange_operating_mic.upcase.to_s == exchange_operating_mic.upcase.to_s ? 0 : 1,
+          s.ticker&.upcase.to_s == symbol.upcase.to_s ? 0 : 1,
+          exchange_operating_mic.present? && s.exchange_operating_mic&.upcase.to_s == exchange_operating_mic.upcase.to_s ? 0 : 1,
           sorted_country_codes_by_relevance.index(s.country_code&.upcase.to_s) || sorted_country_codes_by_relevance.length,
           sorted_exchange_operating_mics_by_relevance.index(s.exchange_operating_mic&.upcase.to_s) || sorted_exchange_operating_mics_by_relevance.length
         ]
@@ -109,11 +134,44 @@ class Security::Resolver
       )
 
       security.country_code = match.country_code
+
+      # Set provider when explicitly provided (user selection) or when the
+      # record is new / has no provider yet. Automated syncs pass nil and
+      # will not overwrite an existing choice.
+      effective_provider = price_provider.presence ||
+        (match.respond_to?(:price_provider) ? match.price_provider.presence : nil)
+
+      if effective_provider.present?
+        security.price_provider = effective_provider
+      end
+
       security.save!
 
+      reactivate_if_provider_available!(security)
+
       security
     end
 
+    # If a security was marked offline (e.g. its provider was temporarily
+    # removed in settings) but now has a valid, enabled provider, bring it
+    # back online so the MarketDataImporter picks it up again.
+    def reactivate_if_provider_available!(security)
+      return unless security.offline?
+      return unless security.offline_reason == "provider_disabled"
+      return unless security.price_data_provider.present?
+
+      security.update!(offline: false, offline_reason: nil, failed_fetch_count: 0, failed_fetch_at: nil)
+    end
+
+    # Candidate country matches when it equals the resolver's country OR when
+    # the provider didn't report a country at all (e.g. crypto from Binance).
+    # A nil candidate country is a legitimate "no jurisdiction" signal, not a
+    # missing field, so we trust the user's provider + exchange pick.
+    def country_matches?(candidate_country)
+      return true if candidate_country.blank?
+      candidate_country.upcase == country_code.upcase
+    end
+
     def provider_search_result
       params = {
         exchange_operating_mic: exchange_operating_mic,
diff --git a/app/models/setting.rb b/app/models/setting.rb
index b62d4073d..c5aa08d7e 100644
--- a/app/models/setting.rb
+++ b/app/models/setting.rb
@@ -10,6 +10,14 @@ class Setting < RailsSettings::Base
   field :openai_uri_base, type: :string, default: ENV["OPENAI_URI_BASE"]
   field :openai_model, type: :string, default: ENV["OPENAI_MODEL"]
   field :openai_json_mode, type: :string, default: ENV["LLM_JSON_MODE"]
+
+  # LLM token budget (applies to every outbound LLM call: chat, auto-categorize,
+  # merchant detection, enhance-merchants, PDF processing). Defaults track
+  # Ollama's historical 2048-token baseline so local small-context models work
+  # out of the box. ENV overrides Setting at read time in Provider::Openai.
+  field :llm_context_window, type: :integer, default: ENV["LLM_CONTEXT_WINDOW"]&.to_i
+  field :llm_max_response_tokens, type: :integer, default: ENV["LLM_MAX_RESPONSE_TOKENS"]&.to_i
+  field :llm_max_items_per_call, type: :integer, default: ENV["LLM_MAX_ITEMS_PER_CALL"]&.to_i
   field :external_assistant_url, type: :string
   field :external_assistant_token, type: :string
   field :external_assistant_agent_id, type: :string
@@ -18,7 +26,11 @@ class Setting < RailsSettings::Base
 
   BRAND_FETCH_LOGO_SIZE_STANDARD = 40
   BRAND_FETCH_LOGO_SIZE_HIGH_RES = 120
-  BRAND_FETCH_URL_PATTERN = %r{(https://cdn\.brandfetch\.io/[^/]+/icon/fallback/lettermark/)w/\d+/h/\d+(\?c=.+)}
+  # Matches both legacy single-segment URLs (`/apple.com/icon/...`) and
+  # explicit type-routed URLs introduced 2026 (`/crypto/BTC/icon/...`,
+  # `/domain/apple.com/icon/...`). `[^?]+` reaches across the extra slash
+  # so transform_brand_fetch_url can rewrite the size params on both shapes.
+  BRAND_FETCH_URL_PATTERN = %r{(https://cdn\.brandfetch\.io/[^?]+/icon/fallback/lettermark/)w/\d+/h/\d+(\?c=.+)}
 
   def self.brand_fetch_logo_size
     brand_fetch_high_res_logos ? BRAND_FETCH_LOGO_SIZE_HIGH_RES : BRAND_FETCH_LOGO_SIZE_STANDARD
@@ -36,6 +48,83 @@ class Setting < RailsSettings::Base
   field :exchange_rate_provider, type: :string, default: ENV.fetch("EXCHANGE_RATE_PROVIDER", "twelve_data")
   field :securities_provider, type: :string, default: ENV.fetch("SECURITIES_PROVIDER", "twelve_data")
 
+  # Multi-provider: comma-separated list of enabled securities providers
+  field :securities_providers, type: :string, default: ENV.fetch("SECURITIES_PROVIDERS", "")
+
+  # New provider API keys (encrypted at rest — see EncryptedSettingFields below)
+  field :tiingo_api_key, type: :string, default: ENV["TIINGO_API_KEY"]
+  field :eodhd_api_key, type: :string, default: ENV["EODHD_API_KEY"]
+  field :alpha_vantage_api_key, type: :string, default: ENV["ALPHA_VANTAGE_API_KEY"]
+
+  # Transparent encryption for API key fields.  The `field` macro defines the
+  # raw getter/setter on the class.  By prepending this module we intercept
+  # reads (decrypt) and writes (encrypt) while `super` delegates to the
+  # original getter/setter generated by rails-settings-cached.
+  #
+  # Backward-compatible: if decryption fails (e.g. the value was stored before
+  # encryption was enabled) the raw value is returned as-is.
+  module EncryptedSettingFields
+    ENCRYPTED_FIELDS = %i[
+      twelve_data_api_key
+      tiingo_api_key
+      eodhd_api_key
+      alpha_vantage_api_key
+      openai_access_token
+      external_assistant_token
+    ].freeze
+
+    ENCRYPTED_FIELDS.each do |field_name|
+      define_method(field_name) do
+        raw = super()
+        decrypt_setting(raw)
+      end
+
+      define_method(:"#{field_name}=") do |value|
+        super(encrypt_setting(value))
+      end
+    end
+
+    private
+
+      def setting_encryptor
+        @setting_encryptor ||= begin
+          key = ActiveSupport::KeyGenerator.new(
+            Rails.application.secret_key_base
+          ).generate_key("setting_encryption", 32)
+          ActiveSupport::MessageEncryptor.new(key)
+        end
+      end
+
+      def encrypt_setting(value)
+        return value if value.blank?
+        setting_encryptor.encrypt_and_sign(value)
+      end
+
+      def decrypt_setting(value)
+        return value if value.blank?
+        setting_encryptor.decrypt_and_verify(value)
+      rescue ActiveSupport::MessageVerifier::InvalidSignature,
+             ActiveSupport::MessageEncryptor::InvalidMessage
+        # Value was stored before encryption was enabled — return as-is.
+        # It will be re-encrypted on next write.
+        value
+      end
+  end
+
+  class << self
+    prepend EncryptedSettingFields
+  end
+
+  def self.enabled_securities_providers
+    plural = ENV["SECURITIES_PROVIDERS"].presence || securities_providers.presence
+    if plural.present?
+      plural.to_s.split(",").map(&:strip).reject(&:blank?)
+    else
+      # Backward compat: fall back to singular setting
+      [ ENV["SECURITIES_PROVIDER"].presence || securities_provider ].compact
+    end
+  end
+
   # Sync settings - check both provider env vars for default
   # Only defaults to true if neither provider explicitly disables pending
   SYNCS_INCLUDE_PENDING_DEFAULT = begin
diff --git a/app/models/simplefin_account.rb b/app/models/simplefin_account.rb
index 8b89db432..049834667 100644
--- a/app/models/simplefin_account.rb
+++ b/app/models/simplefin_account.rb
@@ -26,6 +26,13 @@ class SimplefinAccount < ApplicationRecord
     linked_account || account
   end
 
+  # Summary of transaction activity derived from raw_transactions_payload.
+  # Used by the setup UI and ReplacementDetector to distinguish live vs dormant
+  # accounts without re-parsing the payload at every call site.
+  def activity_summary
+    ActivitySummary.new(raw_transactions_payload)
+  end
+
   # Ensure there is an AccountProvider link for this SimpleFin account and its current Account.
   # Safe and idempotent; returns the AccountProvider or nil if no account is associated yet.
   def ensure_account_provider!
@@ -130,6 +137,6 @@ class SimplefinAccount < ApplicationRecord
     end
     def has_balance
       return if current_balance.present? || available_balance.present?
-      errors.add(:base, "SimpleFin account must have either current or available balance")
+      errors.add(:base, :no_balance)
     end
 end
diff --git a/app/models/simplefin_account/activity_summary.rb b/app/models/simplefin_account/activity_summary.rb
new file mode 100644
index 000000000..7179593f6
--- /dev/null
+++ b/app/models/simplefin_account/activity_summary.rb
@@ -0,0 +1,67 @@
+class SimplefinAccount
+  # Value object summarising the activity state of a SimpleFIN account's raw
+  # transactions payload. Used by the setup UI to help users distinguish live
+  # from dormant accounts, and by the ReplacementDetector to spot cards that
+  # have likely been replaced.
+  class ActivitySummary
+    DEFAULT_WINDOW_DAYS = 60
+
+    def initialize(transactions)
+      @transactions = Array(transactions).compact
+    end
+
+    def last_transacted_at
+      return @last_transacted_at if defined?(@last_transacted_at)
+      @last_transacted_at = @transactions.filter_map { |tx| transacted_at(tx) }.max
+    end
+
+    def days_since_last_activity(now: Time.current)
+      return nil unless last_transacted_at
+      ((now.to_i - last_transacted_at.to_i) / 86_400).floor
+    end
+
+    def recent_transaction_count(days: DEFAULT_WINDOW_DAYS)
+      cutoff = days.days.ago
+      @transactions.count { |tx| (ts = transacted_at(tx)) && ts >= cutoff }
+    end
+
+    def recently_active?(days: DEFAULT_WINDOW_DAYS)
+      recent_transaction_count(days: days).positive?
+    end
+
+    def dormant?(days: DEFAULT_WINDOW_DAYS)
+      !recently_active?(days: days)
+    end
+
+    def transaction_count
+      @transactions.size
+    end
+
+    private
+      # Extract a Time for sorting/windowing. Prefer transacted_at (SimpleFIN
+      # authored timestamp), fall back to posted. Zero values mean "unknown"
+      # in SimpleFIN (e.g., pending transactions have posted=0) and are ignored.
+      # Note: integer 0 is truthy in Ruby, so a plain `|| fallback` short-circuits
+      # and never falls back. Use explicit helper so transacted_at=0 properly
+      # yields to posted.
+      def transacted_at(tx)
+        return nil unless tx.is_a?(Hash) || tx.respond_to?(:[])
+        value = timestamp_value(fetch(tx, "transacted_at")) ||
+                timestamp_value(fetch(tx, "posted"))
+        return nil unless value
+        Time.at(value)
+      rescue StandardError
+        nil
+      end
+
+      def timestamp_value(raw)
+        return nil if raw.blank?
+        value = raw.to_i
+        value.zero? ? nil : value
+      end
+
+      def fetch(tx, key)
+        tx[key] || tx[key.to_sym]
+      end
+  end
+end
diff --git a/app/models/simplefin_account/investments/holdings_processor.rb b/app/models/simplefin_account/investments/holdings_processor.rb
index 3274b4b9d..29bf62155 100644
--- a/app/models/simplefin_account/investments/holdings_processor.rb
+++ b/app/models/simplefin_account/investments/holdings_processor.rb
@@ -47,7 +47,8 @@ class SimplefinAccount::Investments::HoldingsProcessor
         # which would cause the system to display average cost as current price. (GH #1182)
         qty = parse_decimal(any_of(simplefin_holding, %w[shares quantity qty units]))
         market_value = parse_decimal(any_of(simplefin_holding, %w[market_value current_value]))
-        cost_basis = parse_decimal(any_of(simplefin_holding, %w[cost_basis basis total_cost value]))
+        raw_cost_basis, cost_basis_source_key = cost_basis_from(simplefin_holding)
+        cost_basis = normalize_cost_basis(raw_cost_basis, qty, cost_basis_source_key, institution_reports_total_basis?)
 
         # Derive price from market_value when possible; otherwise fall back to any price field
         fallback_price = parse_decimal(any_of(simplefin_holding, %w[purchase_price price unit_price average_cost avg_cost]))
@@ -112,6 +113,63 @@ class SimplefinAccount::Investments::HoldingsProcessor
       simplefin_account.raw_holdings_payload || []
     end
 
+    def cost_basis_from(simplefin_holding)
+      %w[cost_basis basis total_cost value].each do |key|
+        raw = simplefin_holding[key]
+        next if raw.nil? || raw.to_s.strip.empty?
+
+        return [ parse_decimal(raw), key ]
+      end
+
+      [ nil, nil ]
+    end
+
+    # Sure stores holding cost_basis as per-share average cost. SimpleFIN
+    # brokerages are inconsistent about which field carries which shape:
+    #
+    #   - total_cost / value: always a total position cost per the SimpleFIN
+    #     spec and observed payloads; divide by qty unconditionally.
+    #   - cost_basis / basis: the spec calls this per-share, and most
+    #     brokerages comply. Keep these values unchanged by default.
+    #
+    # Exception: a small allowlist of brokerages (Vanguard, Fidelity) is
+    # known to populate cost_basis with the total position cost in violation
+    # of the spec (#1718, #1182). For those connections only, divide by qty.
+    #
+    # An earlier revision of this fix used a magnitude heuristic
+    # (share_price × √qty midpoint). It was withdrawn because a legitimate
+    # per-share basis on a holding with a large unrealized loss
+    # (e.g. 100 shares with basis $100 now worth $5) trips the midpoint and
+    # gets mis-divided to $1/share — corrupting compliant providers. The
+    # allowlist trades some manual maintenance for that safety.
+    def normalize_cost_basis(raw_cost_basis, qty, source_key, total_basis_institution = false)
+      return nil if raw_cost_basis.nil?
+
+      if %w[total_cost value].include?(source_key) ||
+         (total_basis_institution && %w[cost_basis basis].include?(source_key))
+        return nil unless qty.to_d.positive?
+        return raw_cost_basis / qty
+      end
+
+      raw_cost_basis
+    end
+
+    # Institutions known to populate the SimpleFIN `cost_basis` / `basis`
+    # field with the total position cost rather than the per-share value the
+    # spec requires. Matched as case-insensitive substrings against the
+    # account's stored org name and domain.
+    TOTAL_BASIS_INSTITUTIONS = %w[vanguard fidelity].freeze
+
+    def institution_reports_total_basis?
+      org = simplefin_account.respond_to?(:org_data) ? simplefin_account.org_data : nil
+      return false if org.blank?
+
+      candidates = [ org["name"], org[:name], org["domain"], org[:domain] ].compact.map(&:to_s).map(&:downcase)
+      return false if candidates.empty?
+
+      TOTAL_BASIS_INSTITUTIONS.any? { |needle| candidates.any? { |c| c.include?(needle) } }
+    end
+
     def resolve_security(symbol, description)
       # Normalize crypto tickers to a distinct namespace so they don't collide with equities
       sym = symbol.to_s.upcase
diff --git a/app/models/simplefin_account/processor.rb b/app/models/simplefin_account/processor.rb
index f9ef87641..98cba6497 100644
--- a/app/models/simplefin_account/processor.rb
+++ b/app/models/simplefin_account/processor.rb
@@ -80,57 +80,90 @@ class SimplefinAccount::Processor
 
       balance = observed
       if is_liability
-        # 1) Try transaction-history heuristic when enabled
-        begin
-          result = SimplefinAccount::Liabilities::OverpaymentAnalyzer
-            .new(simplefin_account, observed_balance: observed)
-            .call
+        # Loans report principal outstanding as a positive balance from the
+        # bank's perspective. The OverpaymentAnalyzer is designed for credit-
+        # like liabilities (where charges/payments distinguish debt vs.
+        # credit) and returns :unknown for loans with no transaction
+        # history, which then falls through to a fallback that negates the
+        # observed value — inverting the meaning so the loan ends up
+        # _adding_ to net worth instead of subtracting from it. Trust the
+        # bank's sign for Loans and skip the heuristic.
+        if account.accountable_type == "Loan"
+          balance = observed.abs
+          Rails.logger.info(
+            "SimpleFIN liability sign: classification=loan sfa=#{simplefin_account.id}"
+          )
+          Rails.logger.debug(
+            "SimpleFIN liability sign (loan) amounts: sfa=#{simplefin_account.id} " \
+            "observed=#{observed.to_s('F')} stored=#{balance.to_s('F')}"
+          )
+          Sentry.add_breadcrumb(Sentry::Breadcrumb.new(
+            category: "simplefin",
+            message: "liability_sign=loan",
+            data: { sfa_id: simplefin_account.id }
+          )) rescue nil
+        else
+          # 1) Try transaction-history heuristic when enabled
+          begin
+            result = SimplefinAccount::Liabilities::OverpaymentAnalyzer
+              .new(simplefin_account, observed_balance: observed)
+              .call
 
-          case result.classification
-          when :credit
-            balance = -observed.abs
-            Rails.logger.info(
-              "SimpleFIN overpayment heuristic: classified as credit for sfa=#{simplefin_account.id}, " \
-              "observed=#{observed.to_s('F')} metrics=#{result.metrics.slice(:charges_total, :payments_total, :tx_count).inspect}"
-            )
-            Sentry.add_breadcrumb(Sentry::Breadcrumb.new(
-              category: "simplefin",
-              message: "liability_sign=credit",
-              data: { sfa_id: simplefin_account.id, observed: observed.to_s("F") }
-            )) rescue nil
-          when :debt
-            balance = observed.abs
-            Rails.logger.info(
-              "SimpleFIN overpayment heuristic: classified as debt for sfa=#{simplefin_account.id}, " \
-              "observed=#{observed.to_s('F')} metrics=#{result.metrics.slice(:charges_total, :payments_total, :tx_count).inspect}"
-            )
-            Sentry.add_breadcrumb(Sentry::Breadcrumb.new(
-              category: "simplefin",
-              message: "liability_sign=debt",
-              data: { sfa_id: simplefin_account.id, observed: observed.to_s("F") }
-            )) rescue nil
-          else
-            # 2) Fall back to existing sign-only logic (log unknown for observability)
-            begin
-              obs = {
-                reason: result.reason,
-                tx_count: result.metrics[:tx_count],
-                charges_total: result.metrics[:charges_total],
-                payments_total: result.metrics[:payments_total],
-                observed: observed.to_s("F")
-              }.compact
-              Rails.logger.info("SimpleFIN overpayment heuristic: unknown; falling back #{obs.inspect}")
-            rescue
-              # no-op
+            case result.classification
+            when :credit
+              balance = -observed.abs
+              Rails.logger.info(
+                "SimpleFIN overpayment heuristic: classified as credit for sfa=#{simplefin_account.id} " \
+                "tx_count=#{result.metrics[:tx_count]}"
+              )
+              Rails.logger.debug(
+                "SimpleFIN overpayment heuristic (credit) amounts: sfa=#{simplefin_account.id} " \
+                "observed=#{observed.to_s('F')} metrics=#{result.metrics.slice(:charges_total, :payments_total, :tx_count).inspect}"
+              )
+              Sentry.add_breadcrumb(Sentry::Breadcrumb.new(
+                category: "simplefin",
+                message: "liability_sign=credit",
+                data: { sfa_id: simplefin_account.id }
+              )) rescue nil
+            when :debt
+              balance = observed.abs
+              Rails.logger.info(
+                "SimpleFIN overpayment heuristic: classified as debt for sfa=#{simplefin_account.id} " \
+                "tx_count=#{result.metrics[:tx_count]}"
+              )
+              Rails.logger.debug(
+                "SimpleFIN overpayment heuristic (debt) amounts: sfa=#{simplefin_account.id} " \
+                "observed=#{observed.to_s('F')} metrics=#{result.metrics.slice(:charges_total, :payments_total, :tx_count).inspect}"
+              )
+              Sentry.add_breadcrumb(Sentry::Breadcrumb.new(
+                category: "simplefin",
+                message: "liability_sign=debt",
+                data: { sfa_id: simplefin_account.id }
+              )) rescue nil
+            else
+              # 2) Fall back to existing sign-only logic (log unknown for observability)
+              begin
+                Rails.logger.info(
+                  "SimpleFIN overpayment heuristic: unknown for sfa=#{simplefin_account.id} " \
+                  "reason=#{result.reason} tx_count=#{result.metrics[:tx_count]}; falling back"
+                )
+                Rails.logger.debug(
+                  "SimpleFIN overpayment heuristic (unknown) amounts: sfa=#{simplefin_account.id} " \
+                  "observed=#{observed.to_s('F')} " \
+                  "charges_total=#{result.metrics[:charges_total]} payments_total=#{result.metrics[:payments_total]}"
+                )
+              rescue
+                # no-op
+              end
+              balance = normalize_liability_balance(observed, bal, avail)
             end
+          rescue NameError
+            # Analyzer not loaded; keep legacy behavior
+            balance = normalize_liability_balance(observed, bal, avail)
+          rescue => e
+            Rails.logger.warn("SimpleFIN overpayment heuristic error for sfa=#{simplefin_account.id}: #{e.class} - #{e.message}")
             balance = normalize_liability_balance(observed, bal, avail)
           end
-        rescue NameError
-          # Analyzer not loaded; keep legacy behavior
-          balance = normalize_liability_balance(observed, bal, avail)
-        rescue => e
-          Rails.logger.warn("SimpleFIN overpayment heuristic error for sfa=#{simplefin_account.id}: #{e.class} - #{e.message}")
-          balance = normalize_liability_balance(observed, bal, avail)
         end
       end
 
diff --git a/app/models/simplefin_item/importer.rb b/app/models/simplefin_item/importer.rb
index c1a567aae..450e7883e 100644
--- a/app/models/simplefin_item/importer.rb
+++ b/app/models/simplefin_item/importer.rb
@@ -50,6 +50,10 @@ class SimplefinItem::Importer
       # This allows the item to recover automatically when a bank's auth issue is resolved
       # in SimpleFIN Bridge, without requiring the user to manually reconnect.
       maybe_clear_requires_update_status
+
+      # Detect likely card-replacement scenarios (e.g., fraud replacement).
+      # Persist suggestions on sync_stats so the UI can render a relink prompt.
+      detect_replacement_candidates
     rescue RateLimitedError => e
       stats["rate_limited"] = true
       stats["rate_limited_at"] = Time.current.iso8601
@@ -326,6 +330,29 @@ class SimplefinItem::Importer
       sync.update_columns(sync_stats: merged) # avoid callbacks/validations during tight loops
     end
 
+    # Run the replacement detector on the current simplefin_item and stash
+    # suggestions on sync_stats for the UI to render. The detector is best-
+    # effort; any error is logged but never fails the whole sync.
+    def detect_replacement_candidates
+      suggestions = SimplefinItem::ReplacementDetector.new(simplefin_item).call
+      return if suggestions.empty?
+
+      stats["replacement_suggestions"] = suggestions
+      persist_stats!
+      Rails.logger.info(
+        "SimpleFIN: detected #{suggestions.size} replacement suggestion(s) for item ##{simplefin_item.id}"
+      )
+      ActiveSupport::Notifications.instrument(
+        "simplefin.replacement_suggestions",
+        item_id: simplefin_item.id,
+        count: suggestions.size
+      )
+    rescue => e
+      Rails.logger.warn(
+        "SimpleFIN: replacement detector failed for item ##{simplefin_item.id}: #{e.class} - #{e.message}"
+      )
+    end
+
     # Reset status to good if no auth errors occurred in this sync.
     # This allows automatic recovery when a bank's auth issue is resolved in SimpleFIN Bridge.
     def maybe_clear_requires_update_status
@@ -937,33 +964,17 @@ class SimplefinItem::Importer
     # Record non-fatal provider errors into sync stats without raising, so the
     # rest of the accounts can continue to import. This is used when the
     # response contains both :accounts and :errors.
+    #
+    # NOTE: per-institution partial errors (e.g. one bank's auth expired inside
+    # a SimpleFIN Bridge connection that spans many institutions) are recorded
+    # for observability but must NOT flip the whole simplefin_item to
+    # requires_update - that would block sync for every other institution on
+    # the same connection. The top-level handle_errors path is the correct
+    # place to flag the item when the SimpleFIN token itself is dead.
     def record_errors(errors)
       arr = Array(errors)
       return if arr.empty?
 
-      # Determine if these errors indicate the item needs an update (e.g. 2FA)
-      needs_update = arr.any? do |error|
-        if error.is_a?(String)
-          down = error.downcase
-          down.include?("reauth") || down.include?("auth") || down.include?("two-factor") || down.include?("2fa") || down.include?("forbidden") || down.include?("unauthorized")
-        else
-          code = error[:code].to_s.downcase
-          type = error[:type].to_s.downcase
-          code.include?("auth") || code.include?("token") || type.include?("auth")
-        end
-      end
-
-      if needs_update
-        Rails.logger.warn("SimpleFin: marking item ##{simplefin_item.id} requires_update due to auth-related provider errors")
-        simplefin_item.update!(status: :requires_update)
-        ActiveSupport::Notifications.instrument(
-          "simplefin.item_requires_update",
-          item_id: simplefin_item.id,
-          reason: "provider_errors_partial",
-          count: arr.size
-        )
-      end
-
       Rails.logger.info("SimpleFin: recording #{arr.size} non-fatal provider error(s) with partial data present")
       ActiveSupport::Notifications.instrument(
         "simplefin.provider_errors",
diff --git a/app/models/simplefin_item/replacement_detector.rb b/app/models/simplefin_item/replacement_detector.rb
new file mode 100644
index 000000000..0f0838aa0
--- /dev/null
+++ b/app/models/simplefin_item/replacement_detector.rb
@@ -0,0 +1,135 @@
+class SimplefinItem
+  # Detects cases where a linked SimpleFIN account looks like it has been
+  # replaced by a new unlinked SimpleFIN account at the same institution
+  # (typical for credit-card fraud replacement: the bank closes the old card
+  # and issues a new one, so SimpleFIN returns both for a transition window).
+  #
+  # Heuristic:
+  #   * dormant_sfa:  linked to a Sure account, no activity in 45+ days,
+  #                   AND near-zero current balance.
+  #   * active_sfa:   unlinked, recently active (transactions in last 30 days),
+  #                   belongs to the same simplefin_item,
+  #                   same account_type and same organisation name as dormant_sfa.
+  #   * pair:         exactly one active_sfa matches. Two or more candidates
+  #                   are considered ambiguous and skipped to avoid a wrong
+  #                   auto-suggestion.
+  #
+  # The detector does NOT mutate any records. It returns a plain array of
+  # suggestion hashes which the caller (Importer) persists on sync_stats so
+  # the UI can render a prompt.
+  class ReplacementDetector
+    DORMANCY_DAYS = 45
+    ACTIVE_WINDOW_DAYS = 30
+    NEAR_ZERO_BALANCE = BigDecimal("1.00")
+
+    # Fraud-replacement is overwhelmingly a credit-card pattern (old card closed,
+    # new card issued with same institution/metadata). Checking/savings-account
+    # replacement exists but has very different UX cues (e.g., users get a new
+    # account number in advance). Scope narrowly for now; broaden later with
+    # account-type-aware copy if demand materialises.
+    SUPPORTED_ACCOUNT_TYPES = %w[credit credit_card creditcard].freeze
+
+    def initialize(simplefin_item)
+      @simplefin_item = simplefin_item
+    end
+
+    # @return [Array<Hash>] suggestions. Empty when no replacements detected.
+    def call
+      sfas = @simplefin_item.simplefin_accounts
+                            .includes(:linked_account, :account)
+                            .to_a
+                            .select { |sfa| supported_type?(sfa) }
+      active_unlinked = sfas.select { |sfa| unlinked?(sfa) && active?(sfa) }
+      return [] if active_unlinked.empty?
+
+      # First pass: for each dormant candidate, find unambiguous matching actives
+      # (exactly one). Rejects "one dormant → many actives" collisions.
+      candidates = sfas.filter_map do |dormant|
+        next unless linked?(dormant) && dormant_with_zero_balance?(dormant)
+        matches = active_unlinked.select { |sfa| same_institution_and_type?(dormant, sfa) }
+        next if matches.size != 1
+        [ dormant, matches.first ]
+      end
+
+      # Second pass: reject "many dormants → one active" collisions. If two
+      # dormant accounts both claim the same active, we can't safely auto-suggest
+      # either — relinking both would move the provider away from the first.
+      active_counts = candidates.each_with_object(Hash.new(0)) { |(_d, a), h| h[a.id] += 1 }
+      candidates.filter_map do |dormant, active|
+        next if active_counts[active.id] > 1
+        build_suggestion(dormant: dormant, active: active)
+      end
+    end
+
+    private
+      def supported_type?(sfa)
+        SUPPORTED_ACCOUNT_TYPES.include?(canonical_account_type(sfa))
+      end
+
+      # Canonicalize for both gating (supported_type?) and matching
+      # (type_matches?) so variants like "credit card" and "credit_card"
+      # round-trip to the same key.
+      def canonical_account_type(sfa)
+        sfa.account_type.to_s.downcase.gsub(/\s+/, "_")
+      end
+
+      def linked?(sfa)
+        sfa.current_account.present?
+      end
+
+      def unlinked?(sfa)
+        sfa.current_account.blank?
+      end
+
+      def dormant_with_zero_balance?(sfa)
+        # Require evidence of prior activity. An empty payload carries no signal
+        # (e.g., a brand-new card just linked) and must not trigger a replacement
+        # suggestion. Matches the likely-closed gate used by the setup UI.
+        return false if sfa.activity_summary.last_transacted_at.blank?
+        return false unless sfa.activity_summary.dormant?(days: DORMANCY_DAYS)
+        # Missing current_balance is "unknown," not "zero." Treat it as evidence
+        # against replacement rather than for it.
+        return false if sfa.current_balance.nil?
+        sfa.current_balance.to_d.abs <= NEAR_ZERO_BALANCE
+      end
+
+      def active?(sfa)
+        sfa.activity_summary.recently_active?(days: ACTIVE_WINDOW_DAYS)
+      end
+
+      def same_institution_and_type?(a, b)
+        type_matches?(a, b) && org_matches?(a, b)
+      end
+
+      def type_matches?(a, b)
+        canonical_account_type(a) == canonical_account_type(b)
+      end
+
+      # Require BOTH sides to have a non-blank org name. SimpleFIN sometimes omits
+      # org_data.name; "" casecmp? "" would otherwise treat unrelated accounts as
+      # co-institutional, producing false replacement suggestions.
+      def org_matches?(a, b)
+        name_a = org_name(a)
+        name_b = org_name(b)
+        return false if name_a.blank? || name_b.blank?
+        name_a.casecmp?(name_b)
+      end
+
+      def org_name(sfa)
+        name = sfa.org_data.is_a?(Hash) ? (sfa.org_data["name"] || sfa.org_data[:name]) : nil
+        name.to_s.strip
+      end
+
+      def build_suggestion(dormant:, active:)
+        {
+          "dormant_sfa_id" => dormant.id,
+          "active_sfa_id" => active.id,
+          "sure_account_id" => dormant.current_account&.id,
+          "institution_name" => org_name(dormant),
+          "dormant_account_name" => dormant.name,
+          "active_account_name" => active.name,
+          "confidence" => "high"
+        }
+      end
+  end
+end
diff --git a/app/models/snaptrade_account/activities_processor.rb b/app/models/snaptrade_account/activities_processor.rb
index 141a24496..96b35cbb4 100644
--- a/app/models/snaptrade_account/activities_processor.rb
+++ b/app/models/snaptrade_account/activities_processor.rb
@@ -247,9 +247,9 @@ class SnaptradeAccount::ActivitiesProcessor
     def normalize_cash_amount(amount, activity_type)
       case activity_type
       when "WITHDRAWAL", "TRANSFER_OUT", "FEE", "TAX"
-        -amount.abs  # These should be negative (money out)
+        amount.abs   # Money out should be positive in Sure
       when "CONTRIBUTION", "TRANSFER_IN", "DIVIDEND", "DIV", "INTEREST", "CASH"
-        amount.abs   # These should be positive (money in)
+        -amount.abs  # Money in should be negative in Sure
       else
         amount
       end
diff --git a/app/models/snaptrade_account/processor.rb b/app/models/snaptrade_account/processor.rb
index b5edcb5e8..a20893e63 100644
--- a/app/models/snaptrade_account/processor.rb
+++ b/app/models/snaptrade_account/processor.rb
@@ -71,6 +71,11 @@ class SnaptradeAccount::Processor
     end
 
     def calculate_total_balance
+      if use_api_total_balance?
+        Rails.logger.debug "SnaptradeAccount::Processor - Using API total for multi-currency holdings for snaptrade_account=#{snaptrade_account.id}"
+        return snaptrade_account.current_balance || 0
+      end
+
       # Calculate total from holdings + cash for accuracy
       # SnapTrade's current_balance can sometimes be stale or just the cash value
       holdings_value = calculate_holdings_value
@@ -109,4 +114,24 @@ class SnaptradeAccount::Processor
         units * price
       end
     end
+
+    def use_api_total_balance?
+      return false unless snaptrade_account.current_balance.present?
+
+      holdings_currencies.any? { |currency| currency.present? && currency != snaptrade_account.currency }
+    end
+
+    def holdings_currencies
+      Array(snaptrade_account.raw_holdings_payload).filter_map do |holding|
+        data = holding.respond_to?(:with_indifferent_access) ? holding.with_indifferent_access : {}
+        extract_currency(data, extract_symbol_data(data), snaptrade_account.currency)
+      end.uniq
+    end
+
+    def extract_symbol_data(data)
+      symbol_wrapper = data[:symbol].is_a?(Hash) ? data[:symbol].with_indifferent_access : {}
+      raw_symbol_data = symbol_wrapper[:symbol]
+
+      raw_symbol_data.is_a?(Hash) ? raw_symbol_data.with_indifferent_access : {}
+    end
 end
diff --git a/app/models/snaptrade_item.rb b/app/models/snaptrade_item.rb
index f99c763f6..367836e42 100644
--- a/app/models/snaptrade_item.rb
+++ b/app/models/snaptrade_item.rb
@@ -35,6 +35,7 @@ class SnaptradeItem < ApplicationRecord
   has_many :linked_accounts, through: :snaptrade_accounts
 
   scope :active, -> { where(scheduled_for_deletion: false) }
+  scope :credentials_configured, -> { active.where.not(client_id: [ nil, "" ]).where.not(consumer_key: [ nil, "" ]) }
   # Syncable = active + fully configured (user registered with SnapTrade API)
   # Items without user registration will fail sync, so exclude them from auto-sync
   scope :syncable, -> { active.where.not(snaptrade_user_id: [ nil, "" ]).where.not(snaptrade_user_secret: [ nil, "" ]) }
diff --git a/app/models/snaptrade_item/provided.rb b/app/models/snaptrade_item/provided.rb
index 5ffb43906..c8d104f43 100644
--- a/app/models/snaptrade_item/provided.rb
+++ b/app/models/snaptrade_item/provided.rb
@@ -160,13 +160,14 @@ module SnaptradeItem::Provided
     return [] unless credentials_configured? && user_registered?
 
     all_users = list_all_users
-    all_users.reject { |uid| uid == snaptrade_user_id }
+    all_users.select { |uid| uid != snaptrade_user_id && uid.start_with?("family_#{family_id}_") }
   end
 
   # Delete an orphaned SnapTrade user and all their connections
   def delete_orphaned_user(user_id)
     return false unless credentials_configured?
     return false if user_id == snaptrade_user_id # Don't delete current user
+    return false unless user_id.start_with?("family_#{family_id}_")
 
     snaptrade_provider.delete_user(user_id: user_id)
     true
diff --git a/app/models/sophtron_account.rb b/app/models/sophtron_account.rb
new file mode 100644
index 000000000..8179b7b84
--- /dev/null
+++ b/app/models/sophtron_account.rb
@@ -0,0 +1,179 @@
+# Represents a single bank account from Sophtron.
+#
+# A SophtronAccount stores account-level data fetched from the Sophtron API,
+# including balances, account type, and raw transaction data. It can be linked
+# to a Maybe Account through the account_provider association.
+#
+# @attr [String] name Account name from Sophtron
+# @attr [String] account_id Sophtron's unique identifier for this account
+# @attr [String] customer_id Sophtron customer ID this account belongs to
+# @attr [String] member_id Sophtron member ID
+# @attr [String] currency Three-letter currency code (e.g., 'USD')
+# @attr [Decimal] balance Current account balance
+# @attr [Decimal] available_balance Available balance (for credit accounts)
+# @attr [String] account_type Type of account (e.g., 'checking', 'savings')
+# @attr [String] account_sub_type Detailed account subtype
+# @attr [JSONB] raw_payload Raw account data from Sophtron API
+# @attr [JSONB] raw_transactions_payload Raw transaction data from Sophtron API
+# @attr [DateTime] last_updated When Sophtron last updated this account
+class SophtronAccount < ApplicationRecord
+  include CurrencyNormalizable
+
+  belongs_to :sophtron_item
+
+  # Association to link this Sophtron account to a Maybe Account
+  has_one :account_provider, as: :provider, dependent: :destroy
+  has_one :account, through: :account_provider, source: :account
+  has_one :linked_account, through: :account_provider, source: :account
+
+  scope :requires_manual_sync, -> { where(manual_sync: true) }
+  scope :automatic_sync, -> { where(manual_sync: false) }
+
+  validates :name, :currency, presence: true
+  validate :has_balance
+  # Returns the linked Maybe Account for this Sophtron account.
+  #
+  # @return [Account, nil] The linked Maybe Account, or nil if not linked
+  def current_account
+    account
+  end
+
+  def institution_name
+    institution_metadata.to_h["name"].presence || sophtron_item&.institution_name
+  end
+
+  def institution_user_institution_id
+    institution_metadata.to_h["user_institution_id"].presence || sophtron_item&.user_institution_id
+  end
+
+  def institution_key
+    institution_user_institution_id.presence || institution_name
+  end
+
+  # Updates this SophtronAccount with fresh data from the Sophtron API.
+  #
+  # Maps Sophtron field names to our database schema and saves the changes.
+  # Stores the complete raw payload for reference.
+  #
+  # @param account_snapshot [Hash] Raw account data from Sophtron API
+  # @return [Boolean] true if save was successful
+  # @raise [ActiveRecord::RecordInvalid] if validation fails
+  def upsert_sophtron_snapshot!(account_snapshot)
+    # Convert to symbol keys or handle both string and symbol keys
+    snapshot = account_snapshot.with_indifferent_access
+    account_id = first_present(snapshot, :account_id, :id, :AccountID)
+    account_name = first_present(snapshot, :account_name, :name, :AccountName)
+    account_number = first_present(snapshot, :account_number, :AccountNumber)
+    currency = first_present(snapshot, :balance_currency, :currency, :BalanceCurrency, :Currency)
+    balance = first_present(snapshot, :balance, :account_balance, :AccountBalance, :Balance)
+    available_balance = first_present(snapshot, :"available-balance", :available_balance, :AvailableBalance)
+    account_type = first_present(snapshot, :account_type, :type, :AccountType)
+    account_sub_type = first_present(snapshot, :sub_type, :account_sub_type, :AccountSubType, :SubType)
+    last_updated = first_present(snapshot, :last_updated, :LastUpdated)
+    institution_name = first_present(snapshot, :institution_name, :InstitutionName).presence || sophtron_item&.institution_name
+    user_institution_id = first_present(snapshot, :user_institution_id, :UserInstitutionID).presence || sophtron_item&.user_institution_id
+
+    # Map Sophtron field names to our field names
+    assign_attributes(
+      name: account_name,
+      account_id: account_id,
+      currency: parse_currency(currency) || "USD",
+      balance: parse_balance(balance),
+      available_balance: parse_balance(available_balance),
+      account_type: account_type.presence || "unknown",
+      account_sub_type: account_sub_type.presence || "unknown",
+      last_updated: parse_balance_date(last_updated),
+      account_status: first_present(snapshot, :account_status, :status, :AccountStatus, :Status),
+      account_number_mask: snapshot[:account_number_mask].presence || mask_account_number(account_number),
+      institution_metadata: {
+        name: institution_name,
+        user_institution_id: user_institution_id
+      }.compact,
+      raw_payload: account_snapshot,
+      customer_id: first_present(snapshot, :customer_id, :CustomerID) || customer_id,
+      member_id: first_present(snapshot, :member_id, :MemberID) || member_id
+    )
+    self.manual_sync = true if new_record? && sophtron_item&.manual_sync?
+
+    save!
+  end
+
+  # Stores raw transaction data from the Sophtron API.
+  #
+  # This method saves the raw transaction payload which will later be
+  # processed by SophtronAccount::Transactions::Processor to create
+  # actual Transaction records.
+  #
+  # @param transactions_snapshot [Array<Hash>] Array of raw transaction data
+  # @return [Boolean] true if save was successful
+  # @raise [ActiveRecord::RecordInvalid] if validation fails
+  def upsert_sophtron_transactions_snapshot!(transactions_snapshot)
+    assign_attributes(
+      raw_transactions_payload: transactions_snapshot
+    )
+
+    save!
+  end
+
+  private
+
+    def log_invalid_currency(currency_value)
+      Rails.logger.warn("Invalid currency code '#{currency_value}' for Sophtron account #{id}, defaulting to USD")
+    end
+
+
+    def parse_balance(balance_value)
+      return nil if balance_value.nil?
+
+      case balance_value
+      when String
+        BigDecimal(balance_value)
+      when Numeric
+        BigDecimal(balance_value.to_s)
+      else
+        nil
+      end
+    rescue ArgumentError
+      nil
+    end
+
+    def parse_balance_date(balance_date_value)
+      return nil if balance_date_value.nil?
+
+      case balance_date_value
+      when String
+        Time.parse(balance_date_value)
+      when Numeric
+        t = balance_date_value
+        t = (t / 1000.0) if t > 1_000_000_000_000 # likely ms epoch
+        Time.at(t)
+      when Time, DateTime
+        balance_date_value
+      else
+        nil
+      end
+    rescue ArgumentError, TypeError
+      Rails.logger.warn("Invalid balance date for Sophtron account: #{balance_date_value}")
+      nil
+    end
+    def has_balance
+      return if balance.present? || available_balance.present?
+      errors.add(:base, :no_balance)
+    end
+
+    def first_present(hash, *keys)
+      keys.each do |key|
+        value = hash[key]
+        return value if value.present?
+      end
+
+      nil
+    end
+
+    def mask_account_number(account_number)
+      return nil if account_number.blank?
+
+      last_four = account_number.to_s.gsub(/\s+/, "").last(4)
+      last_four.present? ? "****#{last_four}" : nil
+    end
+end
diff --git a/app/models/sophtron_account/processor.rb b/app/models/sophtron_account/processor.rb
new file mode 100644
index 000000000..fcd88fedb
--- /dev/null
+++ b/app/models/sophtron_account/processor.rb
@@ -0,0 +1,119 @@
+# Processes a SophtronAccount to update Maybe Account and Transaction records.
+#
+# This processor is responsible for:
+# 1. Updating the linked Maybe Account's balance from Sophtron data
+# 2. Processing stored transactions to create Maybe Transaction records
+#
+# The processor handles currency normalization and sign conventions for
+# different account types (e.g., credit cards use inverted signs).
+class SophtronAccount::Processor
+  include CurrencyNormalizable
+
+  attr_reader :sophtron_account
+
+  # Initializes a new processor for a Sophtron account.
+  #
+  # @param sophtron_account [SophtronAccount] The account to process
+  def initialize(sophtron_account)
+    @sophtron_account = sophtron_account
+  end
+
+  # Processes the account to update balances and transactions.
+  #
+  # This method:
+  # - Validates that the account is linked to a Maybe Account
+  # - Updates the Maybe Account's balance from Sophtron data
+  # - Processes all stored transactions to create Transaction records
+  #
+  # @return [Hash, nil] Transaction processing result hash or nil if no linked account
+  # @raise [StandardError] if processing fails (errors are logged and reported to Sentry)
+  def process
+    unless sophtron_account.current_account.present?
+      Rails.logger.info "SophtronAccount::Processor - No linked account for sophtron_account #{sophtron_account.id}, skipping processing"
+      return
+    end
+
+    Rails.logger.info "SophtronAccount::Processor - Processing sophtron_account #{sophtron_account.id} (account #{sophtron_account.account_id})"
+    begin
+      process_account!
+    rescue StandardError => e
+      Rails.logger.error "SophtronAccount::Processor - Failed to process account #{sophtron_account.id}: #{e.message}"
+      Rails.logger.error "Backtrace: #{e.backtrace.join("\n")}"
+      report_exception(e, "account")
+      raise
+    end
+
+    process_transactions
+  end
+
+  private
+
+    # Updates the linked Maybe Account's balance from Sophtron data.
+    #
+    # Handles sign conventions for different account types:
+    # - CreditCard and Loan accounts use inverted signs (negated)
+    # - Other account types use Sophtron's native sign convention
+    #
+    # @return [void]
+    # @raise [ActiveRecord::RecordInvalid] if the account update fails
+    def process_account!
+      if sophtron_account.current_account.blank?
+        Rails.logger.error("Sophtron account #{sophtron_account.id} has no associated Account")
+        return
+      end
+
+      # Update account balance from latest Sophtron data
+      account = sophtron_account.current_account
+      balance = sophtron_account.balance || sophtron_account.available_balance || 0
+
+      # Sophtron balance convention matches our app convention:
+      # - Positive balance = debt (you owe money)
+      # - Negative balance = credit balance (bank owes you, e.g., overpayment)
+      # No sign conversion needed - pass through as-is (same as Plaid)
+      #
+      # Exception: CreditCard and Loan accounts return inverted signs
+      # Provider returns negative for positive balance, so we negate it
+      if account.accountable_type == "CreditCard" || account.accountable_type == "Loan"
+        balance = -balance
+      end
+
+      # Normalize currency with fallback chain: parsed sophtron currency -> existing account currency -> USD
+      currency = parse_currency(sophtron_account.currency) || account.currency || "USD"
+      # Update account balance
+      account.update!(
+        balance: balance,
+        cash_balance: balance,
+        currency: currency
+      )
+    end
+
+    # Processes all stored transactions for this account.
+    #
+    # Delegates to SophtronAccount::Transactions::Processor to convert
+    # raw transaction data into Maybe Transaction records.
+    #
+    # @return [void]
+    # @raise [StandardError] if transaction processing fails
+    def process_transactions
+      SophtronAccount::Transactions::Processor.new(sophtron_account).process
+    rescue StandardError => e
+      Rails.logger.error "SophtronAccount::Processor - Failed to process transactions for sophtron_account #{sophtron_account.id}: #{e.message}"
+      Rails.logger.error "Backtrace: #{e.backtrace.join("\n")}"
+      report_exception(e, "transactions")
+      raise
+    end
+
+    # Reports an exception to Sentry with Sophtron account context.
+    #
+    # @param error [Exception] The error to report
+    # @param context [String] Additional context (e.g., 'account', 'transactions')
+    # @return [void]
+    def report_exception(error, context)
+      Sentry.capture_exception(error) do |scope|
+        scope.set_tags(
+          sophtron_account_id: sophtron_account.id,
+          context: context
+        )
+      end
+    end
+end
diff --git a/app/models/sophtron_account/transactions/processor.rb b/app/models/sophtron_account/transactions/processor.rb
new file mode 100644
index 000000000..20ca58eb7
--- /dev/null
+++ b/app/models/sophtron_account/transactions/processor.rb
@@ -0,0 +1,98 @@
+# Processes raw transaction data to create Maybe Transaction records.
+#
+# This processor takes the raw transaction payload stored in a SophtronAccount
+# and converts each transaction into a Maybe Transaction record using
+# SophtronEntry::Processor. It processes transactions individually to avoid
+# database lock issues when handling large transaction volumes.
+#
+# The processor is resilient to errors - if one transaction fails, it logs
+# the error and continues processing the remaining transactions.
+class SophtronAccount::Transactions::Processor
+  attr_reader :sophtron_account
+
+  # Initializes a new transaction processor.
+  #
+  # @param sophtron_account [SophtronAccount] The account whose transactions to process
+  def initialize(sophtron_account)
+    @sophtron_account = sophtron_account
+  end
+
+  # Processes all transactions in the raw_transactions_payload.
+  #
+  # Each transaction is processed individually to avoid database lock contention.
+  # Errors are caught and logged, allowing the process to continue with remaining
+  # transactions.
+  #
+  # @return [Hash] Processing results with the following keys:
+  #   - :success [Boolean] true if all transactions processed successfully
+  #   - :total [Integer] Total number of transactions found
+  #   - :imported [Integer] Number of transactions successfully imported
+  #   - :failed [Integer] Number of transactions that failed
+  #   - :errors [Array<Hash>] Details of any errors encountered
+  # @example
+  #   result = processor.process
+  #   # => { success: true, total: 100, imported: 98, failed: 2, errors: [...] }
+  def process
+    unless sophtron_account.raw_transactions_payload.present?
+      Rails.logger.info "SophtronAccount::Transactions::Processor - No transactions in raw_transactions_payload for sophtron_account #{sophtron_account.id}"
+      return { success: true, total: 0, imported: 0, failed: 0, errors: [] }
+    end
+
+    total_count = sophtron_account.raw_transactions_payload.count
+    Rails.logger.info "SophtronAccount::Transactions::Processor - Processing #{total_count} transactions for sophtron_account #{sophtron_account.id}"
+
+    imported_count = 0
+    failed_count = 0
+    errors = []
+
+    # Each entry is processed inside a transaction, but to avoid locking up the DB when
+    # there are hundreds or thousands of transactions, we process them individually.
+    sophtron_account.raw_transactions_payload.each_with_index do |transaction_data, index|
+      begin
+        result = SophtronEntry::Processor.new(
+          transaction_data,
+          sophtron_account: sophtron_account
+        ).process
+
+        if result.nil?
+          # Transaction was skipped (e.g., no linked account)
+          failed_count += 1
+          errors << { index: index, transaction_id: transaction_data[:id], error: "No linked account" }
+        else
+          imported_count += 1
+        end
+      rescue ArgumentError => e
+        # Validation error - log and continue
+        failed_count += 1
+        transaction_id = transaction_data.try(:[], :id) || transaction_data.try(:[], "id") || "unknown"
+        error_message = "Validation error: #{e.message}"
+        Rails.logger.error "SophtronAccount::Transactions::Processor - #{error_message} (transaction #{transaction_id})"
+        errors << { index: index, transaction_id: transaction_id, error: error_message }
+      rescue => e
+        # Unexpected error - log with full context and continue
+        failed_count += 1
+        transaction_id = transaction_data.try(:[], :id) || transaction_data.try(:[], "id") || "unknown"
+        error_message = "#{e.class}: #{e.message}"
+        Rails.logger.error "SophtronAccount::Transactions::Processor - Error processing transaction #{transaction_id}: #{error_message}"
+        Rails.logger.error e.backtrace.join("\n")
+        errors << { index: index, transaction_id: transaction_id, error: error_message }
+      end
+    end
+
+    result = {
+      success: failed_count == 0,
+      total: total_count,
+      imported: imported_count,
+      failed: failed_count,
+      errors: errors
+    }
+
+    if failed_count > 0
+      Rails.logger.warn "SophtronAccount::Transactions::Processor - Completed with #{failed_count} failures out of #{total_count} transactions"
+    else
+      Rails.logger.info "SophtronAccount::Transactions::Processor - Successfully processed #{imported_count} transactions"
+    end
+
+    result
+  end
+end
diff --git a/app/models/sophtron_entry/processor.rb b/app/models/sophtron_entry/processor.rb
new file mode 100644
index 000000000..2ca30c124
--- /dev/null
+++ b/app/models/sophtron_entry/processor.rb
@@ -0,0 +1,229 @@
+require "digest/md5"
+
+# Processes a single Sophtron transaction and creates/updates a Maybe Transaction.
+#
+# This processor takes raw transaction data from the Sophtron API and converts it
+# into a Maybe Transaction record using the Account::ProviderImportAdapter.
+# It handles currency normalization, merchant matching, and data validation.
+#
+# Expected transaction structure from Sophtron:
+# {
+#   id: String,
+#   accountId: String,
+#   amount: Numeric,
+#   currency: String,
+#   date: String/Date,
+#   merchant: String,
+#   description: String
+# }
+class SophtronEntry::Processor
+  include CurrencyNormalizable
+
+  # Initializes a new processor for a Sophtron transaction.
+  #
+  # @param sophtron_transaction [Hash] Raw transaction data from Sophtron API
+  # @param sophtron_account [SophtronAccount] The account this transaction belongs to
+  def initialize(sophtron_transaction, sophtron_account:)
+    @sophtron_transaction = sophtron_transaction
+    @sophtron_account = sophtron_account
+  end
+
+  # Processes the transaction and creates/updates a Maybe Transaction record.
+  #
+  # This method validates the transaction data, creates or finds a merchant,
+  # and uses the ProviderImportAdapter to import the transaction into Maybe.
+  # It respects user overrides through the enrichment pattern.
+  #
+  # @return [Entry, nil] The created/updated Entry, or nil if account not linked
+  # @raise [ArgumentError] if required transaction fields are missing
+  # @raise [StandardError] if the transaction cannot be saved
+  def process
+    # Validate that we have a linked account before processing
+    unless account.present?
+      Rails.logger.warn "SophtronEntry::Processor - No linked account for sophtron_account #{sophtron_account.id}, skipping transaction #{external_id}"
+      return nil
+    end
+
+    # Wrap import in error handling to catch validation and save errors
+    begin
+      import_adapter.import_transaction(
+        external_id: external_id,
+        amount: amount,
+        currency: currency,
+        date: date,
+        name: name,
+        source: "sophtron",
+        merchant: merchant,
+        notes: notes
+      )
+    rescue ArgumentError => e
+      # Re-raise validation errors (missing required fields, invalid data)
+      Rails.logger.error "SophtronEntry::Processor - Validation error for transaction #{external_id}: #{e.message}"
+      raise
+    rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotSaved => e
+      # Handle database save errors
+      Rails.logger.error "SophtronEntry::Processor - Failed to save transaction #{external_id}: #{e.message}"
+      raise StandardError.new("Failed to import transaction: #{e.message}")
+    rescue => e
+      # Catch unexpected errors with full context
+      Rails.logger.error "SophtronEntry::Processor - Unexpected error processing transaction #{external_id}: #{e.class} - #{e.message}"
+      Rails.logger.error e.backtrace.join("\n")
+      raise StandardError.new("Unexpected error importing transaction: #{e.message}")
+    end
+  end
+
+  private
+    attr_reader :sophtron_transaction, :sophtron_account
+
+    # Returns the import adapter for this transaction's account.
+    #
+    # @return [Account::ProviderImportAdapter] Adapter for importing transactions
+    def import_adapter
+      @import_adapter ||= Account::ProviderImportAdapter.new(account)
+    end
+
+    # Returns the linked Maybe Account for this transaction.
+    #
+    # @return [Account, nil] The linked account
+    def account
+      @account ||= sophtron_account.current_account
+    end
+
+    # Returns the transaction data with indifferent access.
+    #
+    # @return [ActiveSupport::HashWithIndifferentAccess] Normalized transaction data
+    def data
+      @data ||= sophtron_transaction.with_indifferent_access
+    end
+
+    # Generates a unique external ID for this transaction.
+    #
+    # Prefixes the Sophtron transaction ID with 'sophtron_' to avoid conflicts
+    # with other providers.
+    #
+    # @return [String] The external ID (e.g., 'sophtron_12345')
+    # @raise [ArgumentError] if the transaction ID is missing
+    def external_id
+      id = data[:id].presence
+      raise ArgumentError, "Sophtron transaction missing required field 'id'" unless id
+      "sophtron_#{id}"
+    end
+
+    # Extracts the transaction name from the data.
+    #
+    # Falls back to "Unknown transaction" if merchant is not present.
+    #
+    # @return [String] The transaction name
+    def name
+      data[:merchant].presence || t("sophtron_items.sophtron_entry.processor.unknown_transaction")
+    end
+
+    # Extracts optional notes/description from the transaction.
+    #
+    # @return [String, nil] Transaction description
+    def notes
+      data[:description].presence
+    end
+
+    # Finds or creates a merchant for this transaction.
+    #
+    # Creates a deterministic merchant ID using MD5 hash of the merchant name.
+    # This ensures the same merchant name always maps to the same merchant record.
+    #
+    # @return [Merchant, nil] The merchant object, or nil if merchant data is missing
+    def merchant
+      return nil unless data[:merchant].present?
+
+      # Create a stable merchant ID from the merchant name
+      # Using digest to ensure uniqueness while keeping it deterministic
+      merchant_name = data[:merchant].to_s.strip
+      return nil if merchant_name.blank?
+
+      merchant_id = Digest::MD5.hexdigest(merchant_name.downcase)
+
+      @merchant ||= begin
+        import_adapter.find_or_create_merchant(
+          provider_merchant_id: "sophtron_merchant_#{merchant_id}",
+          name: merchant_name,
+          source: "sophtron"
+        )
+      rescue ActiveRecord::RecordInvalid => e
+        Rails.logger.error "SophtronEntry::Processor - Failed to create merchant '#{merchant_name}': #{e.message}"
+        nil
+      end
+    end
+
+    # Parses and converts the transaction amount.
+    #
+    # Sophtron uses standard banking convention (negative = expense, positive = income)
+    # while Maybe uses inverted signs (positive = expense, negative = income).
+    # This method negates the amount to convert between conventions.
+    #
+    # @return [BigDecimal] The converted amount
+    # @raise [ArgumentError] if the amount cannot be parsed
+    def amount
+      parsed_amount = case data[:amount]
+      when String
+        BigDecimal(data[:amount])
+      when Numeric
+        BigDecimal(data[:amount].to_s)
+      else
+        BigDecimal("0")
+      end
+
+      # Sophtron likely uses standard convention where negative is expense, positive is income
+      # Maybe expects opposite convention (expenses positive, income negative)
+      # So we negate the amount to convert from Sophtron to Maybe format
+      -parsed_amount
+    rescue ArgumentError => e
+      Rails.logger.error "Failed to parse Sophtron transaction amount: #{data[:amount].inspect} - #{e.message}"
+      raise
+    end
+
+    # Extracts and normalizes the currency code.
+    #
+    # Falls back to the account currency, then USD if not specified.
+    #
+    # @return [String] Three-letter currency code (e.g., 'USD')
+    def currency
+      parse_currency(data[:currency]) || account&.currency || "USD"
+    end
+
+    # Logs invalid currency codes.
+    #
+    # @param currency_value [String] The invalid currency code
+    # @return [void]
+    def log_invalid_currency(currency_value)
+      Rails.logger.warn("Invalid currency code '#{currency_value}' in Sophtron transaction #{external_id}, falling back to account currency")
+    end
+
+    # Parses the transaction date from various formats.
+    #
+    # Handles:
+    # - String dates (ISO format)
+    # - Unix timestamps (Integer/Float)
+    # - Time/DateTime objects
+    # - Date objects
+    #
+    # @return [Date] The parsed transaction date
+    # @raise [ArgumentError] if the date cannot be parsed
+    def date
+      case data[:date]
+      when String
+        Date.parse(data[:date])
+      when Integer, Float
+        # Unix timestamp
+        Time.at(data[:date]).to_date
+      when Time, DateTime
+        data[:date].to_date
+      when Date
+        data[:date]
+      else
+        Rails.logger.error("Sophtron transaction has invalid date value: #{data[:date].inspect}")
+        raise ArgumentError, "Invalid date format: #{data[:date].inspect}"
+      end
+    rescue ArgumentError, TypeError => e
+      Rails.logger.error("Failed to parse Sophtron transaction date '#{data[:date]}': #{e.message}")
+      raise ArgumentError, "Unable to parse transaction date: #{data[:date].inspect}"
+    end
+end
diff --git a/app/models/sophtron_item.rb b/app/models/sophtron_item.rb
new file mode 100644
index 000000000..aa6194681
--- /dev/null
+++ b/app/models/sophtron_item.rb
@@ -0,0 +1,416 @@
+# Represents a Sophtron integration item for a family.
+#
+# A SophtronItem stores Sophtron API credentials and manages the connection
+# to a family's Sophtron account. It can have multiple associated SophtronAccounts,
+# which represent individual bank accounts linked through Sophtron.
+#
+# @attr [String] name The display name for this Sophtron connection
+# @attr [String] user_id Sophtron User ID (encrypted if encryption is configured)
+# @attr [String] access_key Sophtron Access Key (encrypted if encryption is configured)
+# @attr [String] base_url Base URL for Sophtron API (optional, defaults to production)
+# @attr [String] status Current status: 'good' or 'requires_update'
+# @attr [Boolean] scheduled_for_deletion Whether the item is scheduled for deletion
+# @attr [DateTime] last_synced_at When the last successful sync occurred
+class SophtronItem < ApplicationRecord
+  include Syncable, Provided, Unlinking
+
+  INITIAL_LOAD_LOOKBACK_DAYS = 120
+  MAX_TRANSACTION_HISTORY_YEARS = 3
+
+  enum :status, { good: "good", requires_update: "requires_update" }, default: :good
+
+  # Helper to detect if ActiveRecord Encryption is configured for this app.
+  #
+  # Checks both Rails credentials and environment variables for encryption keys.
+  #
+  # @return [Boolean] true if encryption is properly configured
+  def self.encryption_ready?
+    creds_ready = Rails.application.credentials.active_record_encryption.present?
+    env_ready = ENV["ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY"].present? &&
+                ENV["ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY"].present? &&
+                ENV["ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT"].present?
+    creds_ready || env_ready
+  end
+
+  # Encrypt sensitive credentials if ActiveRecord encryption is configured (credentials OR env vars)
+  if encryption_ready?
+    encrypts :user_id, deterministic: true
+    encrypts :access_key, deterministic: true
+  end
+
+  validates :name, presence: true
+  validates :user_id, presence: true, on: :create
+  validates :access_key, presence: true, on: :create
+
+  belongs_to :family
+  belongs_to :current_job_sophtron_account, class_name: "SophtronAccount", optional: true
+  has_one_attached :logo
+
+  has_many :sophtron_accounts, dependent: :destroy
+  has_many :accounts, through: :sophtron_accounts
+
+  scope :active, -> { where(scheduled_for_deletion: false) }
+  scope :syncable, -> { active }
+  scope :ordered, -> { order(created_at: :desc) }
+  scope :needs_update, -> { where(status: :requires_update) }
+
+  def destroy_later
+    update!(scheduled_for_deletion: true)
+    DestroyJob.perform_later(self)
+  end
+
+  # Imports the latest account and transaction data from Sophtron.
+  #
+  # This method fetches all accounts and transactions from the Sophtron API
+  # and updates the local database accordingly. It will:
+  # - Fetch all accounts associated with the Sophtron connection
+  # - Create new SophtronAccount records for newly discovered accounts
+  # - Update existing linked accounts with latest data
+  # - Fetch and store transactions for all linked accounts
+  #
+  # @return [Hash] Import results with counts of accounts and transactions imported
+  # @raise [StandardError] if the Sophtron provider is not configured
+  # @raise [Provider::Sophtron::Error] if the Sophtron API returns an error
+  def import_latest_sophtron_data(sync: nil)
+    provider = sophtron_provider
+    unless provider
+      Rails.logger.error "SophtronItem #{id} - Cannot import: Sophtron provider is not configured (missing API key)"
+      raise StandardError.new("Sophtron provider is not configured")
+    end
+
+    SophtronItem::Importer.new(self, sophtron_provider: provider, sync: sync).import
+  rescue => e
+    Rails.logger.error "SophtronItem #{id} - Failed to import data: #{e.message}"
+    raise
+  end
+
+  def linked_visible_sophtron_accounts
+    sophtron_accounts.joins(:account).merge(Account.visible)
+  end
+
+  def automatic_sync_sophtron_accounts
+    return linked_visible_sophtron_accounts.none if manual_sync?
+
+    linked_visible_sophtron_accounts.automatic_sync
+  end
+
+  def manual_sync_required?
+    manual_sync? || sophtron_accounts.requires_manual_sync.exists?
+  end
+
+  def manual_sync_sophtron_accounts
+    linked_accounts = sophtron_accounts.joins(:account_provider).order(:created_at, :id)
+    manual_accounts = linked_accounts.requires_manual_sync
+
+    return manual_accounts if manual_accounts.exists?
+
+    manual_sync? ? linked_accounts : linked_accounts.none
+  end
+
+  def connected_institution_options
+    sophtron_accounts.order(:created_at, :id).filter_map do |sophtron_account|
+      institution_key = sophtron_account.institution_key
+      next if institution_key.blank?
+
+      {
+        institution_key: institution_key,
+        name: sophtron_account.institution_name.presence || institution_display_name
+      }
+    end.uniq { |institution| institution[:institution_key].to_s }
+  end
+
+  def manual_sync_required_for_institution?(institution_key)
+    institution_accounts = sophtron_accounts.select do |sophtron_account|
+      sophtron_account.institution_key.to_s == institution_key.to_s
+    end
+
+    return manual_sync? if institution_accounts.empty?
+
+    institution_accounts.any?(&:manual_sync?) || (manual_sync? && !sophtron_accounts.requires_manual_sync.exists?)
+  end
+
+  def process_accounts(sophtron_accounts_scope: linked_visible_sophtron_accounts)
+    return [] if sophtron_accounts_scope.empty?
+
+    results = []
+    # Only process accounts that are linked and have active status
+    sophtron_accounts_scope.each do |sophtron_account|
+      begin
+        result = SophtronAccount::Processor.new(sophtron_account).process
+        results << { sophtron_account_id: sophtron_account.id, success: true, result: result }
+      rescue => e
+        Rails.logger.error "SophtronItem #{id} - Failed to process account #{sophtron_account.id}: #{e.message}"
+        results << { sophtron_account_id: sophtron_account.id, success: false, error: e.message }
+        # Continue processing other accounts even if one fails
+      end
+    end
+
+    results
+  end
+
+  def schedule_account_syncs(parent_sync: nil, window_start_date: nil, window_end_date: nil, sophtron_accounts_scope: linked_visible_sophtron_accounts)
+    linked_accounts = sophtron_accounts_scope.includes(:account_provider).filter_map(&:current_account)
+    return [] if linked_accounts.empty?
+
+    results = []
+    # Only schedule syncs for active accounts
+    linked_accounts.each do |account|
+      begin
+        account.sync_later(
+          parent_sync: parent_sync,
+          window_start_date: window_start_date,
+          window_end_date: window_end_date
+        )
+        results << { account_id: account.id, success: true }
+      rescue => e
+        Rails.logger.error "SophtronItem #{id} - Failed to schedule sync for account #{account.id}: #{e.message}"
+        results << { account_id: account.id, success: false, error: e.message }
+        # Continue scheduling other accounts even if one fails
+      end
+    end
+
+    results
+  end
+
+  def start_initial_load_later
+    active_sync = syncs.visible.ordered.first
+
+    sync_later(window_start_date: initial_load_window_start_date)
+
+    return unless active_sync&.reload&.syncing?
+
+    SophtronInitialLoadJob.set(wait: SophtronInitialLoadJob::RETRY_DELAY).perform_later(self)
+  end
+
+  def initial_load_window_start_date
+    configured_start = sync_start_date&.to_date
+    default_start = INITIAL_LOAD_LOOKBACK_DAYS.days.ago.to_date
+    max_history_start = MAX_TRANSACTION_HISTORY_YEARS.years.ago.to_date
+
+    [ configured_start || default_start, max_history_start ].max
+  end
+
+  def upsert_sophtron_snapshot!(accounts_snapshot)
+    assign_attributes(
+      raw_payload: accounts_snapshot
+    )
+
+    save!
+  end
+
+  def ensure_customer!(provider: sophtron_provider)
+    return customer_id if customer_id.present?
+    raise Provider::Sophtron::Error.new("Sophtron provider is not configured", :configuration_error) unless provider
+
+    matching_customer = find_matching_customer(Provider::Sophtron.response_data!(provider.list_customers))
+    customer_payload = matching_customer || Provider::Sophtron.response_data!(
+      provider.create_customer(
+        unique_id: generated_customer_unique_id,
+        name: generated_customer_name,
+        source: "Sure"
+      )
+    )
+
+    # Some Sophtron endpoints may return an empty body on success; re-list to find
+    # the customer we just created if the create response does not include an id.
+    if extract_customer_id(customer_payload).blank?
+      customer_payload = find_matching_customer(Provider::Sophtron.response_data!(provider.list_customers))
+    end
+
+    extracted_customer_id = extract_customer_id(customer_payload)
+    raise Provider::Sophtron::Error.new("Sophtron customer response did not include CustomerID", :invalid_response) if extracted_customer_id.blank?
+
+    update!(
+      customer_id: extracted_customer_id,
+      customer_name: extract_customer_name(customer_payload).presence || generated_customer_name,
+      raw_customer_payload: customer_payload
+    )
+
+    customer_id
+  end
+
+  def connected_to_institution?
+    user_institution_id.present? && current_job_id.blank? && good? && !failed_connection_job?
+  end
+
+  def failed_connection_job?
+    payload = raw_job_payload || {}
+    payload = payload.with_indifferent_access if payload.respond_to?(:with_indifferent_access)
+
+    success_flag = if payload.respond_to?(:key?) && payload.key?(:SuccessFlag)
+      payload[:SuccessFlag]
+    elsif payload.respond_to?(:key?)
+      payload[:success_flag]
+    end
+
+    last_status = job_status.presence ||
+      (payload[:LastStatus] if payload.respond_to?(:[])) ||
+      (payload[:last_status] if payload.respond_to?(:[]))
+
+    success_flag == false && Provider::Sophtron.failure_job_status?(last_status)
+  end
+
+  def upsert_job_snapshot!(job_payload)
+    job_payload = job_payload.with_indifferent_access
+
+    update!(
+      job_status: job_payload[:LastStatus] || job_payload[:last_status],
+      raw_job_payload: job_payload
+    )
+  end
+
+  def fetch_remote_accounts(force: false)
+    cache_key = "sophtron_accounts_#{family.id}_#{id}_#{user_institution_id}"
+    cached = Rails.cache.read(cache_key)
+    return cached if cached.present? && !force
+
+    accounts_data = Provider::Sophtron.response_data!(sophtron_provider.get_accounts(user_institution_id))
+    accounts = accounts_data[:accounts] || []
+    Rails.cache.write(cache_key, accounts, expires_in: 5.minutes)
+    persist_remote_sophtron_accounts(accounts)
+    accounts
+  end
+
+  def persist_remote_sophtron_accounts(accounts)
+    Array(accounts).each do |account_data|
+      account_data = account_data.with_indifferent_access
+      next if account_data[:account_name].blank?
+
+      upsert_sophtron_account(account_data)
+    rescue ActiveRecord::RecordInvalid => e
+      Rails.logger.warn("Skipping Sophtron account #{self.class.external_account_id(account_data)}: #{e.message}")
+    end
+  end
+
+  def reject_already_linked(accounts)
+    linked_account_ids = sophtron_accounts.joins(:account_provider).pluck(:account_id).map(&:to_s)
+    Array(accounts).reject { |account| linked_account_ids.include?(self.class.external_account_id(account).to_s) }
+  end
+
+  def upsert_sophtron_account(account_data)
+    sophtron_accounts.find_or_initialize_by(
+      account_id: self.class.external_account_id(account_data).to_s
+    ).tap do |sophtron_account|
+      sophtron_account.upsert_sophtron_snapshot!(account_data)
+    end
+  end
+
+  def build_mfa_challenge(job)
+    job = job.with_indifferent_access
+    {
+      security_questions: Provider::Sophtron.parse_json_array(job[:SecurityQuestion] || job[:security_question]),
+      token_methods: Provider::Sophtron.parse_json_array(job[:TokenMethod] || job[:token_method]),
+      token_sent: Provider::Sophtron.job_token_input_required?(job),
+      token_read: job[:TokenRead] || job[:token_read],
+      captcha_image: job[:CaptchaImage] || job[:captcha_image]
+    }
+  end
+
+  def self.external_account_id(account_data)
+    account_data.with_indifferent_access[:account_id] || account_data.with_indifferent_access[:id]
+  end
+
+  def has_completed_initial_setup?
+    # Setup is complete if we have any linked accounts
+    accounts.any?
+  end
+
+  def sync_status_summary
+    # Use centralized count helper methods for consistency
+    total_accounts = total_accounts_count
+    linked_count = linked_accounts_count
+    unlinked_count = unlinked_accounts_count
+
+    if total_accounts == 0
+      "No accounts found"
+    elsif unlinked_count == 0
+      "#{linked_count} #{'account'.pluralize(linked_count)} synced"
+    else
+      "#{linked_count} synced, #{unlinked_count} need setup"
+    end
+  end
+
+  def linked_accounts_count
+    sophtron_accounts.joins(:account_provider).count
+  end
+
+  def unlinked_accounts_count
+    sophtron_accounts.left_joins(:account_provider).where(account_providers: { id: nil }).count
+  end
+
+  def total_accounts_count
+    sophtron_accounts.count
+  end
+
+  def institution_display_name
+    # Try to get institution name from stored metadata
+    institution_name.presence || institution_domain.presence || name
+  end
+
+  def provider_display_name
+    I18n.t("sophtron_items.defaults.name", default: "Sophtron Connection")
+  end
+
+  def connected_institutions
+    # Get unique institutions from all accounts
+    sophtron_accounts.includes(:account)
+                      .where.not(institution_metadata: nil)
+                      .map { |acc| acc.institution_metadata }
+                      .uniq { |inst| inst["name"] || inst["institution_name"] }
+  end
+
+  def institution_summary
+    institutions = connected_institutions
+    case institutions.count
+    when 0
+      "No institutions connected"
+    when 1
+      institutions.first["name"] || institutions.first["institution_name"] || "1 institution"
+    else
+      "#{institutions.count} institutions"
+    end
+  end
+
+  def credentials_configured?
+    user_id.present? &&
+    access_key.present?
+  end
+
+  def effective_base_url
+    base_url.presence || Provider::Sophtron::DEFAULT_BASE_URL
+  end
+
+  def generated_customer_unique_id
+    "sure-family-#{family.id}"
+  end
+
+  def generated_customer_name
+    "Sure family #{family.id}"
+  end
+
+  private
+
+    def find_matching_customer(customers)
+      customers = Array(customers)
+
+      customers.find do |customer|
+        extract_customer_id(customer).to_s == generated_customer_unique_id
+      end || customers.find do |customer|
+        extract_customer_name(customer).to_s == generated_customer_name
+      end
+    end
+
+    def extract_customer_id(customer_payload)
+      return nil unless customer_payload.respond_to?(:with_indifferent_access)
+
+      customer_payload = customer_payload.with_indifferent_access
+      customer_payload[:CustomerID] || customer_payload[:customer_id] || customer_payload[:id]
+    end
+
+    def extract_customer_name(customer_payload)
+      return nil unless customer_payload.respond_to?(:with_indifferent_access)
+
+      customer_payload = customer_payload.with_indifferent_access
+      customer_payload[:CustomerName] || customer_payload[:customer_name] || customer_payload[:name]
+    end
+end
diff --git a/app/models/sophtron_item/importer.rb b/app/models/sophtron_item/importer.rb
new file mode 100644
index 000000000..403024cf6
--- /dev/null
+++ b/app/models/sophtron_item/importer.rb
@@ -0,0 +1,460 @@
+require "set"
+
+# Imports account and transaction data from Sophtron API.
+#
+# This class orchestrates the complete import process for a SophtronItem:
+# 1. Fetches all accounts from Sophtron
+# 2. Updates existing linked accounts with latest data
+# 3. Creates SophtronAccount records for newly discovered accounts
+# 4. Fetches and stores transactions for all linked accounts
+# 5. Updates account balances
+#
+# The importer maintains a separation between "discovered" accounts (any account
+# returned by the Sophtron API) and "linked" accounts (accounts the user has
+# explicitly connected to Maybe Accounts). This allows users to selectively
+# import accounts of their choosing.
+class SophtronItem::Importer
+  INCREMENTAL_SYNC_BUFFER_DAYS = 60
+
+  attr_reader :sophtron_item, :sophtron_provider, :sync
+
+  # Initializes a new importer.
+  #
+  # @param sophtron_item [SophtronItem] The Sophtron item to import data for
+  # @param sophtron_provider [Provider::Sophtron] Configured Sophtron API client
+  # @param sync [Sync, nil] Optional sync record whose window should guide import scope
+  def initialize(sophtron_item, sophtron_provider:, sync: nil)
+    @sophtron_item = sophtron_item
+    @sophtron_provider = sophtron_provider
+    @sync = sync
+  end
+
+  # Performs the complete import process for this Sophtron item.
+  #
+  # This method:
+  # - Fetches all accounts from Sophtron API
+  # - Stores raw account data snapshot
+  # - Updates existing linked accounts
+  # - Creates records for newly discovered accounts
+  # - Fetches transactions for all linked accounts
+  # - Updates account balances
+  #
+  # @return [Hash] Import results with the following keys:
+  #   - :success [Boolean] Overall success status
+  #   - :accounts_updated [Integer] Number of existing accounts updated
+  #   - :accounts_created [Integer] Number of new account records created
+  #   - :accounts_failed [Integer] Number of accounts that failed to import
+  #   - :transactions_imported [Integer] Total number of transactions imported
+  #   - :transactions_failed [Integer] Number of accounts with transaction import failures
+  # @example
+  #   result = importer.import
+  #   # => { success: true, accounts_updated: 2, accounts_created: 1,
+  #   #      accounts_failed: 0, transactions_imported: 150, transactions_failed: 0 }
+  def import
+    Rails.logger.info "SophtronItem::Importer - Starting import for item #{sophtron_item.id}"
+    unless sophtron_item.user_institution_id.present?
+      error_message = "Sophtron institution connection is incomplete"
+      Rails.logger.warn "SophtronItem::Importer - Item #{sophtron_item.id} has no Sophtron UserInstitutionID"
+      sophtron_item.update!(
+        status: :requires_update,
+        last_connection_error: error_message
+      )
+
+      return {
+        success: false,
+        error: error_message,
+        accounts_updated: 0,
+        accounts_created: 0,
+        accounts_failed: 0,
+        transactions_imported: 0,
+        transactions_failed: 0
+      }
+    end
+
+    # Step 1: Fetch all accounts from Sophtron
+    accounts_data = fetch_accounts_data
+    unless accounts_data
+      Rails.logger.error "SophtronItem::Importer - Failed to fetch accounts data for item #{sophtron_item.id}"
+      return { success: false, error: "Failed to fetch accounts data", accounts_imported: 0, transactions_imported: 0 }
+    end
+
+    # Store raw payload
+    begin
+      sophtron_item.upsert_sophtron_snapshot!(accounts_data)
+    rescue => e
+      Rails.logger.error "SophtronItem::Importer - Failed to store accounts snapshot: #{e.message}"
+      # Continue with import even if snapshot storage fails
+    end
+
+    # Step 2: Update linked accounts and create records for new accounts from API
+    accounts_updated = 0
+    accounts_created = 0
+    accounts_failed = 0
+
+    if accounts_data[:accounts].present?
+      # Get linked sophtron account IDs (ones actually imported/used by the user)
+      linked_account_ids = sophtron_item.sophtron_accounts
+                                         .joins(:account_provider)
+                                         .pluck(:account_id)
+                                         .map(&:to_s)
+      # Get all existing sophtron account IDs (linked or not)
+      all_existing_ids = sophtron_item.sophtron_accounts.pluck(:account_id).map(&:to_s)
+      accounts_data[:accounts].each do |account_data|
+        account_id = (account_data[:account_id] || account_data[:id])&.to_s
+        next unless account_id.present?
+        account_name = account_data[:account_name] || account_data[:name]
+        next if account_name.blank?
+        if linked_account_ids.include?(account_id)
+          # Update existing linked accounts
+          begin
+            import_account(account_data)
+            accounts_updated += 1
+          rescue => e
+            accounts_failed += 1
+            Rails.logger.error "SophtronItem::Importer - Failed to update account #{account_id}: #{e.message}"
+          end
+        elsif !all_existing_ids.include?(account_id)
+          # Create new unlinked sophtron_account records for accounts we haven't seen before
+          # This allows users to link them later via "Setup new accounts"
+          begin
+            sophtron_account = sophtron_item.sophtron_accounts.build(
+              account_id: account_id,
+              name: account_name,
+              currency: account_data[:currency] || "USD"
+            )
+            sophtron_account.upsert_sophtron_snapshot!(account_data)
+            accounts_created += 1
+            Rails.logger.info "SophtronItem::Importer - Created new unlinked account record for #{account_id}"
+          rescue => e
+            accounts_failed += 1
+            Rails.logger.error "SophtronItem::Importer - Failed to create account #{account_id}: #{e.message}"
+          end
+        end
+      end
+    end
+
+    Rails.logger.info "SophtronItem::Importer - Updated #{accounts_updated} accounts, created #{accounts_created} new (#{accounts_failed} failed)"
+
+    # Step 3: Fetch transactions only for linked accounts with active status
+    transactions_imported = 0
+    transactions_failed = 0
+
+    linked_accounts = sophtron_item.automatic_sync_sophtron_accounts
+    linked_accounts.each do |sophtron_account|
+      begin
+        result = fetch_and_store_transactions(sophtron_account)
+        if result[:success]
+          transactions_imported += result[:transactions_count]
+        else
+          transactions_failed += 1
+          break if result[:requires_update]
+        end
+      rescue => e
+        transactions_failed += 1
+        Rails.logger.error "SophtronItem::Importer - Failed to fetch/store transactions for account #{sophtron_account.account_id}: #{e.message}"
+        # Continue with other accounts even if one fails
+      end
+    end
+
+    Rails.logger.info "SophtronItem::Importer - Completed import for item #{sophtron_item.id}: #{accounts_updated} accounts updated, #{accounts_created} new accounts discovered, #{transactions_imported} transactions"
+
+    {
+      success: accounts_failed == 0 && transactions_failed == 0,
+      accounts_updated: accounts_updated,
+      accounts_created: accounts_created,
+      accounts_failed: accounts_failed,
+      transactions_imported: transactions_imported,
+      transactions_failed: transactions_failed
+    }
+  end
+
+  def import_transactions_after_refresh(sophtron_account)
+    fetch_and_store_transactions(sophtron_account, refresh: false)
+  end
+
+  private
+
+    def fetch_accounts_data
+      begin
+        accounts_data = Provider::Sophtron.response_data!(sophtron_provider.get_accounts(sophtron_item.user_institution_id))
+      rescue Provider::Sophtron::Error => e
+        # Handle authentication errors by marking item as requiring update
+        if e.error_type == :unauthorized || e.error_type == :access_forbidden
+          begin
+            sophtron_item.update!(status: :requires_update)
+          rescue => update_error
+            Rails.logger.error "SophtronItem::Importer - Failed to update item status: #{update_error.message}"
+          end
+        end
+        Rails.logger.error "SophtronItem::Importer - Sophtron API error: #{e.message}"
+        return nil
+      rescue JSON::ParserError => e
+        Rails.logger.error "SophtronItem::Importer - Failed to parse Sophtron API response: #{e.message}"
+        return nil
+      rescue => e
+        Rails.logger.error "SophtronItem::Importer - Unexpected error fetching accounts: #{e.class} - #{e.message}"
+        Rails.logger.error e.backtrace.join("\n")
+        return nil
+      end
+
+      # Validate response structure
+      unless accounts_data.is_a?(Hash)
+        Rails.logger.error "SophtronItem::Importer - Invalid accounts_data format: expected Hash, got #{accounts_data.class}"
+        return nil
+      end
+
+      # Handle errors if present in response
+      if accounts_data[:error].present?
+        handle_error(accounts_data[:error])
+        return nil
+      end
+
+      accounts_data
+    end
+
+    # Imports and updates a single account from Sophtron data.
+    #
+    # This method only updates existing SophtronAccount records that were
+    # previously created. It does not create new accounts during sync.
+    #
+    # @param account_data [Hash] Raw account data from Sophtron API
+    # @return [void]
+    # @raise [ArgumentError] if account_data is invalid or account_id is missing
+    # @raise [StandardError] if the account cannot be saved
+    def import_account(account_data)
+      # Validate account data structure
+      unless account_data.is_a?(Hash)
+        Rails.logger.error "SophtronItem::Importer - Invalid account_data format: expected Hash, got #{account_data.class}"
+        raise ArgumentError, "Invalid account data format"
+      end
+
+      account_id = (account_data[:account_id] || account_data[:id])&.to_s
+
+      # Validate required account_id
+      if account_id.blank?
+        Rails.logger.warn "SophtronItem::Importer - Skipping account with missing ID"
+        raise ArgumentError, "Account ID is required"
+      end
+
+      # Only find existing accounts, don't create new ones during sync
+      sophtron_account = sophtron_item.sophtron_accounts.find_by(
+        account_id: account_id
+      )
+
+      # Skip if account wasn't previously selected
+      unless sophtron_account
+        return
+      end
+
+      begin
+        sophtron_account.upsert_sophtron_snapshot!(account_data)
+        sophtron_account.save!
+      rescue ActiveRecord::RecordInvalid => e
+        Rails.logger.error "SophtronItem::Importer - Failed to save sophtron_account: #{e.message}"
+        raise StandardError.new("Failed to save account: #{e.message}")
+      end
+    end
+
+    # Fetches and stores transactions for a Sophtron account.
+    #
+    # This method:
+    # 1. Determines the appropriate sync start date
+    # 2. Fetches transactions from the Sophtron API
+    # 3. Deduplicates against existing transactions
+    # 4. Stores new transactions in raw_transactions_payload
+    # 5. Updates the account balance
+    #
+    # @param sophtron_account [SophtronAccount] The account to fetch transactions for
+    # @return [Hash] Result with keys:
+    #   - :success [Boolean] Whether the fetch was successful
+    #   - :transactions_count [Integer] Number of transactions fetched
+    #   - :error [String, nil] Error message if failed
+    def fetch_and_store_transactions(sophtron_account, refresh: true)
+      start_date = determine_sync_start_date(sophtron_account)
+      Rails.logger.info "SophtronItem::Importer - Fetching transactions for account #{sophtron_account.account_id} from #{start_date}"
+
+      begin
+        if refresh && !initial_transaction_fetch?(sophtron_account)
+          refresh_result = refresh_account_before_transaction_fetch(sophtron_account)
+          return refresh_result if refresh_result.present?
+        end
+
+        # Fetch transactions
+        transactions_data = Provider::Sophtron.response_data!(
+          sophtron_provider.get_account_transactions(
+            sophtron_account.account_id,
+            start_date: start_date
+          )
+        )
+
+        # Validate response structure
+        unless transactions_data.is_a?(Hash)
+          Rails.logger.error "SophtronItem::Importer - Invalid transactions_data format for account #{sophtron_account.account_id}"
+          return { success: false, transactions_count: 0, error: "Invalid response format" }
+        end
+
+        transactions = transactions_data[:transactions]
+        unless transactions.is_a?(Array)
+          Rails.logger.error "SophtronItem::Importer - Missing transactions array for account #{sophtron_account.account_id}"
+          return { success: false, transactions_count: 0, error: "Missing transactions array" }
+        end
+
+        transactions_count = transactions.count
+        Rails.logger.info "SophtronItem::Importer - Fetched #{transactions_count} transactions for account #{sophtron_account.account_id}"
+
+        # Store transactions in the account
+        if transactions.any?
+          begin
+            existing_transactions = sophtron_account.raw_transactions_payload.to_a
+
+            # Build set of existing transaction IDs for efficient lookup
+            existing_ids = existing_transactions.map do |tx|
+              tx.with_indifferent_access[:id]
+            end.to_set
+
+            # Filter to ONLY truly new transactions (skip duplicates)
+            # Transactions are immutable on the bank side, so we don't need to update them
+            new_transactions = transactions.select do |tx|
+              next false unless tx.is_a?(Hash)
+
+              tx_id = tx.with_indifferent_access[:id]
+              tx_id.present? && !existing_ids.include?(tx_id)
+            end
+
+            if new_transactions.any?
+              Rails.logger.info "SophtronItem::Importer - Storing #{new_transactions.count} new transactions (#{existing_transactions.count} existing, #{transactions.count - new_transactions.count} duplicates skipped) for account #{sophtron_account.account_id}"
+              sophtron_account.upsert_sophtron_transactions_snapshot!(existing_transactions + new_transactions)
+            else
+              Rails.logger.info "SophtronItem::Importer - No new transactions to store (all #{transactions.count} were duplicates) for account #{sophtron_account.account_id}"
+              sophtron_account.upsert_sophtron_transactions_snapshot!(existing_transactions) if sophtron_account.raw_transactions_payload.nil?
+            end
+          rescue => e
+            Rails.logger.error "SophtronItem::Importer - Failed to store transactions for account #{sophtron_account.account_id}: #{e.message}"
+            return { success: false, transactions_count: 0, error: "Failed to store transactions: #{e.message}" }
+          end
+        else
+          Rails.logger.info "SophtronItem::Importer - No transactions to store for account #{sophtron_account.account_id}"
+          sophtron_account.upsert_sophtron_transactions_snapshot!([]) if sophtron_account.raw_transactions_payload.nil?
+        end
+
+        { success: true, transactions_count: transactions_count }
+      rescue Provider::Sophtron::Error => e
+        requires_update = e.error_type.in?([ :unauthorized, :access_forbidden ])
+        sophtron_item.update!(status: :requires_update) if requires_update
+        Rails.logger.error "SophtronItem::Importer - Sophtron API error for account #{sophtron_account.id}: #{e.message}"
+        { success: false, transactions_count: 0, error: e.message, requires_update: requires_update }
+      rescue JSON::ParserError => e
+        Rails.logger.error "SophtronItem::Importer - Failed to parse transaction response for account #{sophtron_account.id}: #{e.message}"
+        { success: false, transactions_count: 0, error: "Failed to parse response" }
+      rescue => e
+        Rails.logger.error "SophtronItem::Importer - Unexpected error fetching transactions for account #{sophtron_account.id}: #{e.class} - #{e.message}"
+        Rails.logger.error e.backtrace.join("\n")
+        { success: false, transactions_count: 0, error: "Unexpected error: #{e.message}" }
+      end
+    end
+
+    def refresh_account_before_transaction_fetch(sophtron_account)
+      refresh_response = Provider::Sophtron.response_data!(sophtron_provider.refresh_account(sophtron_account.account_id))
+      job_id = refresh_response.with_indifferent_access[:JobID] || refresh_response.with_indifferent_access[:job_id]
+      return nil if job_id.blank?
+
+      job = Provider::Sophtron.response_data!(sophtron_provider.get_job_information(job_id))
+      sophtron_item.upsert_job_snapshot!(job)
+
+      if Provider::Sophtron.job_requires_input?(job)
+        sophtron_item.update!(
+          status: :requires_update,
+          current_job_id: job_id,
+          last_connection_error: "Sophtron refresh requires MFA"
+        )
+        return { success: false, transactions_count: 0, error: "Sophtron refresh requires MFA", requires_update: true }
+      end
+
+      if Provider::Sophtron.job_failed?(job)
+        return { success: false, transactions_count: 0, error: "Sophtron refresh failed" }
+      end
+
+      unless Provider::Sophtron.job_success?(job) || Provider::Sophtron.job_completed?(job)
+        SophtronRefreshPollJob.set(wait: SophtronRefreshPollJob::POLL_INTERVAL).perform_later(
+          sophtron_account,
+          job_id: job_id,
+          sync: sync
+        )
+
+        return { success: true, transactions_count: 0, refresh_pending: true }
+      end
+
+      nil
+    rescue Provider::Sophtron::Error => e
+      requires_update = e.error_type.in?([ :unauthorized, :access_forbidden ])
+      sophtron_item.update!(status: :requires_update) if requires_update
+      Rails.logger.error "SophtronItem::Importer - Sophtron API error refreshing account #{sophtron_account.id}: #{e.message}"
+      { success: false, transactions_count: 0, error: e.message, requires_update: requires_update }
+    end
+
+    # Determines the appropriate start date for fetching transactions.
+    #
+    # Logic:
+    # - For accounts with stored transactions: uses last sync date minus a buffer
+    # - For new accounts: uses the sync window or provider default initial lookback
+    #
+    # This captures late-arriving transactions while keeping history bounded.
+    #
+    # @param sophtron_account [SophtronAccount] The account to determine start date for
+    # @return [Date] The start date for transaction sync
+    def determine_sync_start_date(sophtron_account)
+      configured_start = sync&.window_start_date || sophtron_item.sync_start_date&.to_date
+      max_history_start = SophtronItem::MAX_TRANSACTION_HISTORY_YEARS.years.ago.to_date
+      floor_start = configured_start ? [ configured_start, max_history_start ].max : nil
+
+      if !initial_transaction_fetch?(sophtron_account)
+        # Account has been synced before, use item-level logic with buffer
+        # For subsequent syncs, fetch from last sync date with a buffer
+        if sophtron_item.last_synced_at
+          [ sophtron_item.last_synced_at.to_date - INCREMENTAL_SYNC_BUFFER_DAYS, floor_start ].compact.max
+        else
+          # Fallback if item hasn't been synced but account has transactions
+          floor_start || sophtron_item.initial_load_window_start_date
+        end
+      else
+        # Account has no stored transactions - this is a first sync for this account
+        # Use the configured sync window if present, otherwise the provider's default initial lookback.
+        floor_start || sophtron_item.initial_load_window_start_date
+      end
+    end
+
+    def initial_transaction_fetch?(sophtron_account)
+      sophtron_account.raw_transactions_payload.nil? && sophtron_item.last_synced_at.blank?
+    end
+
+    # Handles API errors and marks the item for re-authentication if needed.
+    #
+    # Authentication-related errors cause the item status to be set to
+    # :requires_update, prompting the user to re-enter credentials.
+    #
+    # @param error_message [String] The error message from the API
+    # @return [void]
+    # @raise [Provider::Sophtron::Error] Always raises an error with the message
+    def handle_error(error_message)
+      # Mark item as requiring update for authentication-related errors
+      error_msg_lower = error_message.to_s.downcase
+      needs_update = error_msg_lower.include?("authentication") ||
+                     error_msg_lower.include?("unauthorized") ||
+                     error_msg_lower.include?("user id") ||
+                     error_msg_lower.include?("access key")
+
+      if needs_update
+        begin
+          sophtron_item.update!(status: :requires_update)
+        rescue => e
+          Rails.logger.error "SophtronItem::Importer - Failed to update item status: #{e.message}"
+        end
+      end
+
+      Rails.logger.error "SophtronItem::Importer - API error: #{error_message}"
+      raise Provider::Sophtron::Error.new(
+        "Sophtron API error: #{error_message}",
+        :api_error
+      )
+    end
+end
diff --git a/app/models/sophtron_item/provided.rb b/app/models/sophtron_item/provided.rb
new file mode 100644
index 000000000..f18b0281f
--- /dev/null
+++ b/app/models/sophtron_item/provided.rb
@@ -0,0 +1,9 @@
+module SophtronItem::Provided
+  extend ActiveSupport::Concern
+
+  def sophtron_provider
+    return nil unless credentials_configured?
+
+    Provider::Sophtron.new(user_id, access_key, base_url: effective_base_url)
+  end
+end
diff --git a/app/models/sophtron_item/sync_complete_event.rb b/app/models/sophtron_item/sync_complete_event.rb
new file mode 100644
index 000000000..9bb83089c
--- /dev/null
+++ b/app/models/sophtron_item/sync_complete_event.rb
@@ -0,0 +1,25 @@
+class SophtronItem::SyncCompleteEvent
+  attr_reader :sophtron_item
+
+  def initialize(sophtron_item)
+    @sophtron_item = sophtron_item
+  end
+
+  def broadcast
+    # Update UI with latest account data
+    sophtron_item.accounts.each do |account|
+      account.broadcast_sync_complete
+    end
+
+    # Update the Sophtron item view
+    sophtron_item.broadcast_replace_to(
+      sophtron_item.family,
+      target: "sophtron_item_#{sophtron_item.id}",
+      partial: "sophtron_items/sophtron_item",
+      locals: { sophtron_item: sophtron_item }
+    )
+
+    # Let family handle sync notifications
+    sophtron_item.family.broadcast_sync_complete
+  end
+end
diff --git a/app/models/sophtron_item/syncer.rb b/app/models/sophtron_item/syncer.rb
new file mode 100644
index 000000000..2c21be53f
--- /dev/null
+++ b/app/models/sophtron_item/syncer.rb
@@ -0,0 +1,137 @@
+# Orchestrates the complete sync process for a SophtronItem.
+#
+# The syncer coordinates multiple phases:
+# 1. Import accounts and transactions from Sophtron API
+# 2. Check account setup status and collect statistics
+# 3. Process transactions for linked accounts
+# 4. Schedule balance calculations
+# 5. Collect sync statistics and health metrics
+#
+# This follows the same pattern as other provider syncers (SimpleFIN, Plaid)
+# and integrates with the Syncable concern.
+class SophtronItem::Syncer
+  include SyncStats::Collector
+
+  attr_reader :sophtron_item
+
+  # Initializes a new syncer for a Sophtron item.
+  #
+  # @param sophtron_item [SophtronItem] The item to sync
+  def initialize(sophtron_item)
+    @sophtron_item = sophtron_item
+  end
+
+  # Performs the complete sync process.
+  #
+  # This method orchestrates all phases of the sync:
+  # - Imports fresh data from Sophtron API
+  # - Updates linked accounts and creates new account records
+  # - Processes transactions for linked accounts only
+  # - Schedules balance calculations
+  # - Collects statistics and health metrics
+  #
+  # @param sync [Sync] The sync record to track progress and status
+  # @return [void]
+  # @raise [StandardError] if any phase of the sync fails
+  def perform_sync(sync)
+    # Phase 1: Import data from Sophtron API
+    sync.update!(status_text: t("sophtron_items.syncer.importing_accounts")) if sync.respond_to?(:status_text)
+    import_result = sophtron_item.import_latest_sophtron_data(sync: sync)
+    import_errors = import_errors_for(import_result)
+
+    # Phase 2: Check account setup status and collect sync statistics
+    sync.update!(status_text: t("sophtron_items.syncer.checking_account_configuration")) if sync.respond_to?(:status_text)
+    collect_setup_stats(sync, provider_accounts: sophtron_item.sophtron_accounts)
+
+    # Check for unlinked accounts
+    linked_accounts = sophtron_item.automatic_sync_sophtron_accounts
+    unlinked_accounts = sophtron_item.sophtron_accounts.left_joins(:account_provider).where(account_providers: { id: nil })
+
+    # Set pending_account_setup if there are unlinked accounts
+    unlinked_count = unlinked_accounts.count
+    if unlinked_count.positive?
+      sophtron_item.update!(pending_account_setup: true)
+      sync.update!(status_text: t("sophtron_items.syncer.accounts_need_setup", count: unlinked_count)) if sync.respond_to?(:status_text)
+    else
+      sophtron_item.update!(pending_account_setup: false)
+    end
+
+    # Phase 3: Process transactions for linked accounts only
+    if linked_accounts.any?
+      sync.update!(status_text: t("sophtron_items.syncer.processing_transactions")) if sync.respond_to?(:status_text)
+      mark_import_started(sync)
+      Rails.logger.info "SophtronItem::Syncer - Processing #{linked_accounts.count} linked accounts"
+      sophtron_item.process_accounts(sophtron_accounts_scope: linked_accounts)
+      Rails.logger.info "SophtronItem::Syncer - Finished processing accounts"
+
+      # Phase 4: Schedule balance calculations for linked accounts
+      sync.update!(status_text: t("sophtron_items.syncer.calculating_balances")) if sync.respond_to?(:status_text)
+      sophtron_item.schedule_account_syncs(
+        parent_sync: sync,
+        window_start_date: sync.window_start_date,
+        window_end_date: sync.window_end_date,
+        sophtron_accounts_scope: linked_accounts
+      )
+
+      # Phase 5: Collect transaction statistics
+      account_ids = linked_accounts.includes(:account_provider).filter_map { |la| la.current_account&.id }
+      collect_transaction_stats(sync, account_ids: account_ids, source: "sophtron")
+    else
+      sync.update!(status_text: t("sophtron_items.syncer.manual_sync_required")) if sophtron_item.manual_sync_required? && sync.respond_to?(:status_text)
+      Rails.logger.info "SophtronItem::Syncer - No linked accounts to process"
+    end
+
+    # Mark sync health
+    if import_errors.present?
+      collect_health_stats(sync, errors: import_errors)
+      raise StandardError.new(import_errors.map { |error| error[:message] }.join(", "))
+    else
+      collect_health_stats(sync, errors: nil)
+    end
+  rescue => e
+    collect_health_stats(sync, errors: [ { message: e.message, category: "sync_error" } ]) unless sync_errors_recorded?(sync)
+    raise
+  end
+
+  # Performs post-sync cleanup or actions.
+  #
+  # Currently a no-op for Sophtron items. Reserved for future use.
+  #
+  # @return [void]
+  def perform_post_sync
+    # no-op
+  end
+
+  private
+
+    def import_errors_for(import_result)
+      return [] if import_result.blank? || import_result[:success]
+
+      if import_result[:error].present?
+        return [ { message: import_result[:error], category: "sync_error" } ]
+      end
+
+      errors = []
+      if import_result[:accounts_failed].to_i.positive?
+        errors << {
+          message: "#{import_result[:accounts_failed]} #{'account'.pluralize(import_result[:accounts_failed])} failed to import",
+          category: "account_import"
+        }
+      end
+
+      if import_result[:transactions_failed].to_i.positive?
+        errors << {
+          message: "#{import_result[:transactions_failed]} #{'account'.pluralize(import_result[:transactions_failed])} failed to import transactions",
+          category: "transaction_import"
+        }
+      end
+
+      errors.presence || [ { message: "Sophtron import failed", category: "sync_error" } ]
+    end
+
+    def sync_errors_recorded?(sync)
+      return false unless sync.respond_to?(:sync_stats)
+
+      sync.sync_stats.to_h["total_errors"].to_i.positive?
+    end
+end
diff --git a/app/models/sophtron_item/unlinking.rb b/app/models/sophtron_item/unlinking.rb
new file mode 100644
index 000000000..998c31b15
--- /dev/null
+++ b/app/models/sophtron_item/unlinking.rb
@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module SophtronItem::Unlinking
+  # Concern that encapsulates unlinking logic for a Sophtron item.
+  # Mirrors the SimplefinItem::Unlinking behavior.
+  extend ActiveSupport::Concern
+
+  # Idempotently removes all connections between this Sophtron item and local accounts.
+  #
+  # This method:
+  # - Finds all AccountProvider links for each SophtronAccount
+  # - Detaches any Holdings associated with those links
+  # - Destroys the AccountProvider links
+  # - Returns detailed results for observability
+  #
+  # This mirrors the SimplefinItem::Unlinking behavior.
+  #
+  # @param dry_run [Boolean] If true, only report what would be unlinked without making changes
+  # @return [Array<Hash>] Results for each account with keys:
+  #   - :sfa_id [Integer] The SophtronAccount ID
+  #   - :name [String] The account name
+  #   - :provider_link_ids [Array<Integer>] IDs of AccountProvider links found
+  # @example
+  #   item.unlink_all!(dry_run: true)  # Preview what would be unlinked
+  #   item.unlink_all!                 # Actually unlink all accounts
+  def unlink_all!(dry_run: false)
+    results = []
+
+    sophtron_accounts.find_each do |sfa|
+      links = AccountProvider.where(provider_type: "SophtronAccount", provider_id: sfa.id).to_a
+      link_ids = links.map(&:id)
+      result = {
+        sfa_id: sfa.id,
+        name: sfa.name,
+        provider_link_ids: link_ids
+      }
+      results << result
+
+      next if dry_run
+
+      begin
+        ActiveRecord::Base.transaction do
+          # Detach holdings for any provider links found
+          if link_ids.any?
+            Holding.where(account_provider_id: link_ids).update_all(account_provider_id: nil)
+          end
+
+          # Destroy all provider links
+          links.each do |ap|
+            ap.destroy!
+          end
+        end
+      rescue => e
+        Rails.logger.warn(
+          "SophtronItem Unlinker: failed to fully unlink SophtronAccount ##{sfa.id} (links=#{link_ids.inspect}): #{e.class} - #{e.message}"
+        )
+        # Record error for observability; continue with other accounts
+        result[:error] = e.message
+      end
+    end
+
+    results
+  end
+end
diff --git a/app/models/sso_provider.rb b/app/models/sso_provider.rb
index f9f2ef7c4..b5c9fe25b 100644
--- a/app/models/sso_provider.rb
+++ b/app/models/sso_provider.rb
@@ -90,7 +90,7 @@ class SsoProvider < ApplicationRecord
       idp_sso_url = settings&.dig("idp_sso_url")
 
       if idp_metadata_url.blank? && idp_sso_url.blank?
-        errors.add(:settings, "Either IdP Metadata URL or IdP SSO URL is required for SAML providers")
+        errors.add(:settings, :saml_url_required)
       end
 
       # If using manual config, require certificate
@@ -99,17 +99,17 @@ class SsoProvider < ApplicationRecord
         idp_fingerprint = settings&.dig("idp_cert_fingerprint")
 
         if idp_cert.blank? && idp_fingerprint.blank?
-          errors.add(:settings, "Either IdP Certificate or Certificate Fingerprint is required when not using metadata URL")
+          errors.add(:settings, :saml_cert_required)
         end
       end
 
       # Validate URL formats if provided
       if idp_metadata_url.present? && !valid_url?(idp_metadata_url)
-        errors.add(:settings, "IdP Metadata URL must be a valid URL")
+        errors.add(:settings, :metadata_url_invalid)
       end
 
       if idp_sso_url.present? && !valid_url?(idp_sso_url)
-        errors.add(:settings, "IdP SSO URL must be a valid URL")
+        errors.add(:settings, :sso_url_invalid)
       end
     end
 
diff --git a/app/models/sso_provider_tester.rb b/app/models/sso_provider_tester.rb
index 7b27f08b7..9a66cc003 100644
--- a/app/models/sso_provider_tester.rb
+++ b/app/models/sso_provider_tester.rb
@@ -63,11 +63,14 @@ class SsoProviderTester
           )
         end
 
-        # Check if issuer matches
-        if discovery["issuer"] != provider.issuer && discovery["issuer"] != provider.issuer.chomp("/")
+        # Check if issuer matches exactly. OIDC discovery requires the configured
+        # issuer string to be identical to the issuer returned by the provider.
+        if discovery["issuer"] != provider.issuer
+          hint = trailing_slash_hint(provider.issuer, discovery["issuer"])
+
           return Result.new(
             success?: false,
-            message: "Issuer mismatch: expected #{provider.issuer}, got #{discovery["issuer"]}",
+            message: [ "Issuer mismatch: expected #{provider.issuer}, got #{discovery["issuer"]}", hint ].compact.join(". "),
             details: { expected: provider.issuer, actual: discovery["issuer"] }
           )
         end
@@ -204,4 +207,10 @@ class SsoProviderTester
     def faraday_client
       @faraday_client ||= Faraday.new(ssl: self.class.faraday_ssl_options)
     end
+
+    def trailing_slash_hint(expected, actual)
+      return unless expected.to_s.chomp("/") == actual.to_s.chomp("/")
+
+      "trailing slash mismatch. This usually means the issuer URL differs only by a trailing slash. Update the configured issuer to exactly match the discovery document"
+    end
 end
diff --git a/app/models/sure_import.rb b/app/models/sure_import.rb
index 05d927c4d..0fab88a27 100644
--- a/app/models/sure_import.rb
+++ b/app/models/sure_import.rb
@@ -1,5 +1,23 @@
 class SureImport < Import
   MAX_NDJSON_SIZE = 10.megabytes
+  IMPORTABLE_NDJSON_TYPES = {
+    "Account" => :accounts,
+    "Balance" => :balances,
+    "Category" => :categories,
+    "Tag" => :tags,
+    "Merchant" => :merchants,
+    "RecurringTransaction" => :recurring_transactions,
+    "Transaction" => :transactions,
+    "Transfer" => :transfers,
+    "RejectedTransfer" => :rejected_transfers,
+    "Trade" => :trades,
+    "Holding" => :holdings,
+    "Valuation" => :valuations,
+    "Budget" => :budgets,
+    "BudgetCategory" => :budget_categories,
+    "Rule" => :rules
+  }.freeze
+  VERIFICATION_STATUSES = %w[not_verified matched mismatch failed reverted].freeze
   ALLOWED_NDJSON_CONTENT_TYPES = %w[
     application/x-ndjson
     application/ndjson
@@ -11,6 +29,14 @@ class SureImport < Import
   has_one_attached :ndjson_file, dependent: :purge_later
 
   class << self
+    def max_row_count
+      100_000
+    end
+
+    def max_ndjson_size
+      MAX_NDJSON_SIZE
+    end
+
     # Counts JSON lines by top-level "type" (used for dry-run summaries and row limits).
     def ndjson_line_type_counts(content)
       return {} unless content.present?
@@ -21,7 +47,7 @@ class SureImport < Import
 
         begin
           record = JSON.parse(line)
-          counts[record["type"]] += 1 if record["type"]
+          counts[record["type"]] += 1 if record.is_a?(Hash) && record["type"] && record.key?("data")
         rescue JSON::ParserError
           # Skip invalid lines
         end
@@ -30,19 +56,25 @@ class SureImport < Import
     end
 
     def dry_run_totals_from_ndjson(content)
-      counts = ndjson_line_type_counts(content)
-      {
-        accounts: counts["Account"] || 0,
-        categories: counts["Category"] || 0,
-        tags: counts["Tag"] || 0,
-        merchants: counts["Merchant"] || 0,
-        transactions: counts["Transaction"] || 0,
-        trades: counts["Trade"] || 0,
-        valuations: counts["Valuation"] || 0,
-        budgets: counts["Budget"] || 0,
-        budget_categories: counts["BudgetCategory"] || 0,
-        rules: counts["Rule"] || 0
-      }
+      dry_run_totals_from_line_type_counts(ndjson_line_type_counts(content))
+    end
+
+    def dry_run_totals_from_line_type_counts(counts)
+      IMPORTABLE_NDJSON_TYPES.to_h do |record_type, entity_key|
+        [ entity_key, counts[record_type] || 0 ]
+      end
+    end
+
+    def expected_record_counts_from_ndjson(content)
+      expected_record_counts_from_line_type_counts(ndjson_line_type_counts(content))
+    end
+
+    def expected_record_counts_from_line_type_counts(counts)
+      dry_run_totals_from_line_type_counts(counts).transform_keys(&:to_s)
+    end
+
+    def importable_ndjson_types
+      IMPORTABLE_NDJSON_TYPES.keys
     end
 
     def valid_ndjson_first_line?(str)
@@ -53,7 +85,7 @@ class SureImport < Import
 
       begin
         record = JSON.parse(first_line)
-        record.key?("type") && record.key?("data")
+        record.is_a?(Hash) && record.key?("type") && record.key?("data")
       rescue JSON::ParserError
         false
       end
@@ -87,11 +119,18 @@ class SureImport < Import
   end
 
   def import!
+    sync_ndjson_counts!
+    before_counts = readback_count_snapshot
     importer = Family::DataImporter.new(family, ndjson_blob_string)
     result = importer.import!
 
     result[:accounts].each { |account| accounts << account }
     result[:entries].each { |entry| entries << entry }
+
+    record_readback_verification!(before_counts:)
+  rescue => error
+    record_failed_readback_verification!(before_counts:, error:)
+    raise
   end
 
   def uploaded?
@@ -112,21 +151,155 @@ class SureImport < Import
     cleaned? && dry_run.values.sum.positive?
   end
 
+  def cleaned_from_validation_stats?(invalid_rows_count:)
+    configured? && invalid_rows_count.zero?
+  end
+
+  def publishable_from_validation_stats?(invalid_rows_count:)
+    cleaned_from_validation_stats?(invalid_rows_count: invalid_rows_count) && dry_run.values.sum.positive?
+  end
+
   def max_row_count
-    100_000
+    self.class.max_row_count
   end
 
   # Row total for max-row enforcement (counts every parsed line with a "type", including unsupported types).
   def sync_ndjson_rows_count!
     return unless ndjson_file.attached?
 
-    total = self.class.ndjson_line_type_counts(ndjson_blob_string).values.sum
-    update_column(:rows_count, total)
+    sync_ndjson_counts!
+  end
+
+  def verification_payload
+    {
+      expected_record_counts: normalized_expected_record_counts,
+      readback: normalized_readback_verification
+    }
+  end
+
+  def verification_status
+    status = normalized_readback_verification["status"]
+    status.in?(VERIFICATION_STATUSES) ? status : "not_verified"
+  end
+
+  def reset_readback_verification!
+    update_columns(
+      readback_verification: {
+        "status" => "reverted",
+        "checked_at" => Time.current.iso8601
+      },
+      updated_at: Time.current
+    )
+  end
+
+  def revert
+    super
+    reset_readback_verification! if pending?
   end
 
   private
 
+    def sync_ndjson_counts!
+      line_counts = self.class.ndjson_line_type_counts(ndjson_blob_string)
+
+      update_columns(
+        rows_count: line_counts.values.sum,
+        expected_record_counts: self.class.expected_record_counts_from_line_type_counts(line_counts),
+        readback_verification: {},
+        updated_at: Time.current
+      )
+    end
+
+    def record_readback_verification!(before_counts:)
+      update_columns(
+        readback_verification: build_readback_verification(before_counts:, status_for_mismatch: "mismatch"),
+        updated_at: Time.current
+      )
+    end
+
+    def record_failed_readback_verification!(before_counts:, error:)
+      return unless before_counts
+
+      update_columns(
+        readback_verification: build_readback_verification(before_counts:, status_for_mismatch: "failed").merge(
+          "status" => "failed",
+          "error" => error.message
+        ),
+        updated_at: Time.current
+      )
+    rescue => verification_error
+      Rails.logger.warn("Failed to record Sure import readback verification for import #{id}: #{verification_error.message}")
+    end
+
+    def build_readback_verification(before_counts:, status_for_mismatch:)
+      after_counts = readback_count_snapshot
+      actual_delta_counts = delta_counts(before_counts, after_counts)
+      expected_counts = normalized_expected_record_counts
+      checked_counts = (actual_delta_counts.keys | expected_counts.keys).index_with do |key|
+        expected_counts.fetch(key, 0).to_i
+      end
+      mismatches = checked_counts.each_with_object({}) do |(key, expected_count), result|
+        actual_count = actual_delta_counts.fetch(key, 0)
+        next if actual_count == expected_count.to_i
+
+        result[key] = {
+          "expected" => expected_count.to_i,
+          "actual" => actual_count
+        }
+      end
+
+      {
+        "status" => mismatches.empty? ? "matched" : status_for_mismatch,
+        "checked_at" => Time.current.iso8601,
+        "expected_record_counts" => expected_counts,
+        "before_counts" => before_counts,
+        "after_counts" => after_counts,
+        "actual_delta_counts" => actual_delta_counts,
+        "checked_counts" => checked_counts,
+        "mismatches" => mismatches
+      }
+    end
+
+    def readback_count_snapshot
+      {
+        accounts: family.accounts.count,
+        balances: Balance.joins(:account).where(accounts: { family_id: family.id }).count,
+        categories: family.categories.count,
+        tags: family.tags.count,
+        merchants: family.merchants.count,
+        recurring_transactions: family.recurring_transactions.count,
+        transactions: family.entries.where(entryable_type: "Transaction").count,
+        transfers: Transfer.joins(inflow_transaction: { entry: :account }).where(accounts: { family_id: family.id }).count,
+        rejected_transfers: RejectedTransfer.joins(inflow_transaction: { entry: :account }).where(accounts: { family_id: family.id }).count,
+        trades: family.entries.where(entryable_type: "Trade").count,
+        holdings: family.holdings.count,
+        valuations: family.entries.where(entryable_type: "Valuation").count,
+        budgets: family.budgets.count,
+        budget_categories: family.budget_categories.count,
+        rules: family.rules.count
+      }.transform_keys(&:to_s).transform_values(&:to_i)
+    end
+
+    def delta_counts(before_counts, after_counts)
+      after_counts.each_with_object({}) do |(key, after_count), result|
+        result[key] = after_count.to_i - before_counts.fetch(key, 0).to_i
+      end
+    end
+
+    def normalized_expected_record_counts
+      (expected_record_counts || {}).to_h.transform_keys(&:to_s).transform_values(&:to_i)
+    end
+
+    def normalized_readback_verification
+      (readback_verification || {}).to_h.deep_stringify_keys
+    end
+
     def ndjson_blob_string
-      ndjson_file.download.force_encoding(Encoding::UTF_8)
+      blob_id = ndjson_file.blob&.id
+
+      return @ndjson_blob_string if defined?(@ndjson_blob_string) && @ndjson_blob_id == blob_id
+
+      @ndjson_blob_id = blob_id
+      @ndjson_blob_string = ndjson_file.download.force_encoding(Encoding::UTF_8)
     end
 end
diff --git a/app/models/sync.rb b/app/models/sync.rb
index d1ba07a26..e2ec1f28a 100644
--- a/app/models/sync.rb
+++ b/app/models/sync.rb
@@ -15,7 +15,7 @@ class Sync < ApplicationRecord
   belongs_to :parent, class_name: "Sync", optional: true
   has_many :children, class_name: "Sync", foreign_key: :parent_id, dependent: :destroy
 
-  scope :ordered, -> { order(created_at: :desc) }
+  scope :ordered, -> { order(created_at: :desc, id: :desc) }
   scope :incomplete, -> { where("syncs.status IN (?)", %w[pending syncing]) }
   scope :visible, -> { incomplete.where("syncs.created_at > ?", VISIBLE_FOR.ago) }
 
@@ -57,6 +57,52 @@ class Sync < ApplicationRecord
     def clean
       incomplete.where("syncs.created_at < ?", STALE_AFTER.ago).find_each(&:mark_stale!)
     end
+
+    def for_family(family, resource_owner: nil)
+      query = where(syncable_type: "Family", syncable_id: family.id)
+      query = query.or(where(syncable_type: "Account", syncable_id: account_syncable_ids(family, resource_owner)))
+
+      family_syncable_associations.each do |association|
+        query = query.or(
+          where(syncable_type: association.klass.name, syncable_id: family.public_send(association.name).select(:id))
+        )
+      end
+
+      query
+    end
+
+    private
+      def account_syncable_ids(family, resource_owner)
+        (resource_owner ? resource_owner.accessible_accounts : family.accounts)
+          .where(family_id: family.id)
+          .select(:id)
+      end
+
+      def family_syncable_associations
+        Family.reflect_on_all_associations(:has_many).select do |association|
+          association.name.to_s.end_with?("_items") &&
+            association.klass.included_modules.include?(Syncable)
+        rescue NameError
+          false
+        end
+      end
+  end
+
+  def in_progress?
+    pending? || syncing?
+  end
+
+  def terminal?
+    completed? || failed? || stale?
+  end
+
+  def api_error_payload
+    return unless failed? || stale?
+    return if stale? && error.blank?
+
+    {
+      message: stale? ? "Sync became stale before completion" : "Sync failed"
+    }
   end
 
   def perform
@@ -204,6 +250,8 @@ class Sync < ApplicationRecord
     end
 
     def update_family_sync_timestamp
+      return unless family.persisted?
+
       family.touch(:latest_sync_activity_at)
     end
 
diff --git a/app/models/trade.rb b/app/models/trade.rb
index dbdb90f31..a0c6df58a 100644
--- a/app/models/trade.rb
+++ b/app/models/trade.rb
@@ -14,6 +14,27 @@ class Trade < ApplicationRecord
   validates :price, :currency, presence: true
   validates :investment_activity_label, inclusion: { in: ACTIVITY_LABELS }, allow_nil: true
 
+  def exchange_rate
+    extra&.dig("exchange_rate")
+  end
+
+  def exchange_rate=(value)
+    if value.blank?
+      self.extra = (extra || {}).merge("exchange_rate" => nil, "exchange_rate_invalid" => false)
+    else
+      begin
+        normalized_value = Float(value)
+        raise ArgumentError unless normalized_value.finite?
+
+        self.extra = (extra || {}).merge("exchange_rate" => normalized_value, "exchange_rate_invalid" => false)
+      rescue ArgumentError, TypeError
+        self.extra = (extra || {}).merge("exchange_rate" => value, "exchange_rate_invalid" => true)
+      end
+    end
+  end
+
+  validate :exchange_rate_must_be_valid
+
   # Trade types for categorization
   def buy?
     qty.positive?
@@ -57,6 +78,17 @@ class Trade < ApplicationRecord
 
   private
 
+    def exchange_rate_must_be_valid
+      if extra&.dig("exchange_rate_invalid")
+        errors.add(:exchange_rate, "must be a number")
+      elsif exchange_rate.present?
+        numeric_rate = Float(exchange_rate) rescue nil
+        if numeric_rate.nil? || !numeric_rate.finite? || numeric_rate <= 0
+          errors.add(:exchange_rate, "must be greater than 0")
+        end
+      end
+    end
+
     def calculate_realized_gain_loss
       return nil unless sell?
 
diff --git a/app/models/trade/create_form.rb b/app/models/trade/create_form.rb
index 54c78111e..37cf3a44e 100644
--- a/app/models/trade/create_form.rb
+++ b/app/models/trade/create_form.rb
@@ -22,11 +22,13 @@ class Trade::CreateForm
   private
     # Users can either look up a ticker from a provider or enter a manual, "offline" ticker (that we won't fetch prices for)
     def security
-      ticker_symbol, exchange_operating_mic = ticker.present? ? ticker.split("|") : [ manual_ticker, nil ]
+      parsed = ticker.present? ? Security.parse_combobox_id(ticker) : { ticker: manual_ticker }
+      return nil if parsed[:ticker].blank?
 
       Security::Resolver.new(
-        ticker_symbol,
-        exchange_operating_mic: exchange_operating_mic
+        parsed[:ticker],
+        exchange_operating_mic: parsed[:exchange_operating_mic],
+        price_provider: parsed[:price_provider]
       ).resolve
     end
 
diff --git a/app/models/trade_import.rb b/app/models/trade_import.rb
index e8372bed4..58ade4809 100644
--- a/app/models/trade_import.rb
+++ b/app/models/trade_import.rb
@@ -65,11 +65,11 @@ class TradeImport < Import
   end
 
   def csv_template
-    template = <<-CSV
+    template = <<~CSV
       date*,ticker*,exchange_operating_mic,currency,qty*,price*,account,name
-      05/15/2024,AAPL,XNAS,USD,10,150.00,Trading Account,Apple Inc. Purchase
-      05/16/2024,GOOGL,XNAS,USD,-5,2500.00,Investment Account,Alphabet Inc. Sale
-      05/17/2024,TSLA,XNAS,USD,2,700.50,Retirement Account,Tesla Inc. Purchase
+      2024-05-15,AAPL,XNAS,USD,10,150.00,Trading Account,Apple Inc. Purchase
+      2024-05-16,GOOGL,XNAS,USD,-5,2500.00,Investment Account,Alphabet Inc. Sale
+      2024-05-17,TSLA,XNAS,USD,2,700.50,Retirement Account,Tesla Inc. Purchase
     CSV
 
     csv = CSV.parse(template, headers: true)
diff --git a/app/models/transaction.rb b/app/models/transaction.rb
index 75e36bbdc..0334298d1 100644
--- a/app/models/transaction.rb
+++ b/app/models/transaction.rb
@@ -28,6 +28,44 @@ class Transaction < ApplicationRecord
 
   after_save :clear_merchant_unlinked_association, if: :merchant_id_previously_changed?
 
+  # Accessors for exchange_rate stored in extra jsonb field
+  def exchange_rate
+    extra&.dig("exchange_rate")
+  end
+
+  def exchange_rate=(value)
+    if value.blank?
+      self.extra = (extra || {}).merge("exchange_rate" => nil, "exchange_rate_invalid" => false)
+    else
+      begin
+        normalized_value = Float(value)
+        raise ArgumentError unless normalized_value.finite?
+
+        self.extra = (extra || {}).merge("exchange_rate" => normalized_value, "exchange_rate_invalid" => false)
+      rescue ArgumentError, TypeError
+        # Store the raw value for validation error reporting
+        self.extra = (extra || {}).merge("exchange_rate" => value, "exchange_rate_invalid" => true)
+      end
+    end
+  end
+
+  validate :exchange_rate_must_be_valid
+
+  private
+
+    def exchange_rate_must_be_valid
+      if extra&.dig("exchange_rate_invalid")
+        errors.add(:exchange_rate, "must be a number")
+      elsif exchange_rate.present?
+        numeric_rate = Float(exchange_rate) rescue nil
+        if numeric_rate.nil? || !numeric_rate.finite? || numeric_rate <= 0
+          errors.add(:exchange_rate, "must be greater than 0")
+        end
+      end
+    end
+
+  public
+
   enum :kind, {
     standard: "standard", # A regular transaction, included in budget analytics
     funds_movement: "funds_movement", # Movement of funds between accounts, excluded from budget analytics
@@ -56,7 +94,14 @@ class Transaction < ApplicationRecord
   INTERNAL_MOVEMENT_LABELS = [ "Transfer", "Sweep In", "Sweep Out", "Exchange" ].freeze
 
   # Providers that support pending transaction flags
-  PENDING_PROVIDERS = %w[simplefin plaid lunchflow].freeze
+  PENDING_PROVIDERS = %w[simplefin plaid lunchflow enable_banking].freeze
+
+  # Pre-computed SQL fragment for subqueries that check if a transaction (aliased as "t") is pending.
+  # Stored as a constant so static analysis can verify it contains no user input.
+  PENDING_CHECK_SQL = PENDING_PROVIDERS
+    .map { |p| "(t.extra -> '#{p}' ->> 'pending')::boolean = true" }
+    .join(" OR ")
+    .freeze
 
   # Pending transaction scopes - filter based on provider pending flags in extra JSONB
   # Works with any provider that stores pending status in extra["provider_name"]["pending"]
@@ -70,6 +115,14 @@ class Transaction < ApplicationRecord
     where(conditions.join(" AND "))
   }
 
+  # SQL snippet for raw queries that must exclude pending transactions.
+  # Use in income statements, balance sheets, and raw analytics.
+  def self.pending_providers_sql(table_alias = "t")
+    PENDING_PROVIDERS.map do |provider|
+      "AND (#{table_alias}.extra -> '#{provider}' ->> 'pending')::boolean IS DISTINCT FROM true"
+    end.join("\n")
+  end
+
   # Family-scoped query for Enrichable#clear_ai_cache
   def self.family_scope(family)
     joins(entry: :account).where(accounts: { family_id: family.id })
@@ -95,10 +148,28 @@ class Transaction < ApplicationRecord
     PENDING_PROVIDERS.any? do |provider|
       ActiveModel::Type::Boolean.new.cast(extra_data.dig(provider, "pending"))
     end
-  rescue
+  rescue StandardError
     false
   end
 
+  def activity_security_id
+    extra&.dig("security_id").presence || extra&.dig("security", "id").presence
+  end
+
+  def activity_security
+    security_id = activity_security_id.to_s
+    return @activity_security = nil if security_id.blank?
+    return @activity_security if defined?(@activity_security_id) && @activity_security_id == security_id
+
+    @activity_security_id = security_id
+    @activity_security = Security.find_by(id: security_id)
+  end
+
+  def set_preloaded_activity_security(security)
+    @activity_security_id = security&.id&.to_s
+    @activity_security = security
+  end
+
   # Potential duplicate matching methods
   # These help users review and resolve fuzzy-matched pending/posted pairs
 
@@ -131,22 +202,106 @@ class Transaction < ApplicationRecord
     potential_posted_match_data&.dig("dismissed") == true
   end
 
-  # Merge this pending transaction with its suggested posted match
-  # This DELETES the pending entry since the posted version is canonical
+  # Merge this pending transaction with its suggested posted match.
+  # The pending entry is destroyed; the posted entry survives with attributes inherited from both sides.
+  # Attribute inheritance: Date + Category from pending, Name + Merchant from posted (booked).
   def merge_with_duplicate!
+    return false unless pending?
     return false unless has_potential_duplicate?
 
     posted_entry = potential_duplicate_entry
     return false unless posted_entry
 
-    pending_entry_id = entry.id
-    pending_entry_name = entry.name
+    pending_entry = entry
 
-    # Delete this pending entry completely (no need to keep it around)
-    entry.destroy!
+    # Guard: cross-account merges are never valid
+    if posted_entry.account_id != pending_entry.account_id
+      Rails.logger.warn("merge_with_duplicate! rejected: posted_entry #{posted_entry.id} belongs to different account than pending entry #{pending_entry.id}")
+      return false
+    end
 
-    Rails.logger.info("User merged pending entry #{pending_entry_id} (#{pending_entry_name}) with posted entry #{posted_entry.id}")
-    true
+    pending_entry_id = pending_entry.id
+    merge_succeeded = false
+
+    ApplicationRecord.transaction(requires_new: true) do
+      # Row-level locks prevent concurrent merges on the same pair of entries.
+      # If a concurrent request already destroyed the pending entry, lock! raises
+      # RecordNotFound — treat that as an idempotent success.
+      begin
+        pending_entry.lock!
+      rescue ActiveRecord::RecordNotFound
+        Rails.logger.info("Pending entry #{pending_entry_id} already destroyed (concurrent merge), skipping")
+        return true
+      end
+
+      begin
+        posted_entry.lock!
+      rescue ActiveRecord::RecordNotFound
+        Rails.logger.info("Posted entry #{posted_entry.id} deleted concurrently; aborting merge")
+        raise ActiveRecord::Rollback
+      end
+
+      # Capture after lock! (which reloads) to guarantee DB-fresh values and avoid
+      # stale in-memory cached associations (e.g., loaded via touch: true).
+      external_id        = pending_entry.external_id
+      pending_entry_date = pending_entry.date
+
+      # Batch all changes to the surviving posted Transaction into a single update!
+      # to avoid firing after_save callbacks twice on the same row.
+      # Lock the Transaction row so concurrent merges into the same posted entry
+      # cannot race on reading/writing extra (e.g., the manual_merge array).
+      posted_tx = posted_entry.entryable
+      posted_tx.lock! if posted_tx.is_a?(Transaction)
+      if posted_tx.is_a?(Transaction)
+        tx_attrs = {}
+
+        # Merge metadata — always written so the sync engine can skip re-importing.
+        # Stored as an array so multiple pending entries merged into the same posted
+        # transaction each preserve their external_id for future sync exclusion.
+        # Legacy records written as a plain Hash are migrated to a single-element array
+        # on first append, maintaining backward compatibility.
+        if external_id.present?
+          new_record = {
+            "merged_from_entry_id"    => pending_entry_id,
+            "merged_from_external_id" => external_id,
+            "merged_at"               => Time.current.iso8601,
+            "source"                  => pending_entry.source
+          }
+          prior = case posted_tx.extra["manual_merge"]
+          when Array then posted_tx.extra["manual_merge"]
+          when Hash  then [ posted_tx.extra["manual_merge"] ]
+          else []
+          end
+          tx_attrs[:extra] = posted_tx.extra.merge("manual_merge" => prior + [ new_record ])
+        end
+
+        # Attribute inheritance — only when the posted entry is not already user-protected.
+        unless posted_entry.protected_from_sync?
+          pending_transaction = pending_entry.entryable
+          if pending_transaction.is_a?(Transaction) && pending_transaction.category_id.present?
+            tx_attrs[:category_id] = pending_transaction.category_id
+          end
+        end
+
+        posted_tx.update!(tx_attrs) if tx_attrs.any?
+      end
+
+      # Date inheritance on the Entry row — separate from the Transaction update above.
+      unless posted_entry.protected_from_sync?
+        # Date: pending dates reflect actual transaction initiation time
+        posted_entry.update!(date: pending_entry_date) if posted_entry.date != pending_entry_date
+        # Name + Merchant intentionally NOT inherited — booked values are canonical
+      end
+
+      # Lock the posted entry so future syncs cannot overwrite the merged state
+      posted_entry.mark_user_modified!
+
+      Rails.logger.info("User merged pending entry #{pending_entry_id} (ext: #{external_id}) into posted entry #{posted_entry.id}")
+      pending_entry.destroy!
+      merge_succeeded = true
+    end
+
+    merge_succeeded
   end
 
   # Dismiss the duplicate suggestion - user says these are NOT the same transaction
diff --git a/app/models/transaction/activity_security_preloader.rb b/app/models/transaction/activity_security_preloader.rb
new file mode 100644
index 000000000..2939cf29d
--- /dev/null
+++ b/app/models/transaction/activity_security_preloader.rb
@@ -0,0 +1,36 @@
+class Transaction::ActivitySecurityPreloader
+  def initialize(records)
+    @records = Array(records)
+  end
+
+  def preload
+    transactions.each do |transaction|
+      transaction.set_preloaded_activity_security(securities_by_id[transaction.activity_security_id.to_s])
+    end
+
+    records
+  end
+
+  private
+    attr_reader :records
+
+    def transactions
+      @transactions ||= records.filter_map do |record|
+        case record
+        when Transaction
+          record
+        when Entry
+          record.transaction? ? record.entryable : nil
+        end
+      end
+    end
+
+    def securities_by_id
+      @securities_by_id ||= begin
+        security_ids = transactions.filter_map(&:activity_security_id).uniq
+        return {} if security_ids.empty?
+
+        Security.where(id: security_ids).index_by { |security| security.id.to_s }
+      end
+    end
+end
diff --git a/app/models/transaction/search.rb b/app/models/transaction/search.rb
index d60e39fb4..d9a87c18e 100644
--- a/app/models/transaction/search.rb
+++ b/app/models/transaction/search.rb
@@ -29,8 +29,8 @@ class Transaction::Search
       # This already joins entries + accounts. To avoid expensive double-joins, don't join them again (causes full table scan)
       query = family.transactions.merge(Entry.excluding_split_parents)
 
-      # Scope to accessible accounts when provided
-      query = query.where(entries: { account_id: accessible_account_ids }) if accessible_account_ids
+      # Scope to accessible accounts when provided (including an empty array, which should yield no results)
+      query = query.where(entries: { account_id: accessible_account_ids }) unless accessible_account_ids.nil?
 
       query = apply_active_accounts_filter(query, active_accounts_only)
       query = apply_category_filter(query, categories)
@@ -88,11 +88,11 @@ class Transaction::Search
                   .take
 
         Totals.new(
-          count: result.transactions_count.to_i,
-          income_money: Money.new(result.income_total, family.currency),
-          expense_money: Money.new(result.expense_total, family.currency),
-          transfer_inflow_money: Money.new(result.transfer_inflow_total, family.currency),
-          transfer_outflow_money: Money.new(result.transfer_outflow_total, family.currency)
+          count: result&.transactions_count.to_i,
+          income_money: Money.new((result&.income_total || 0), family.currency),
+          expense_money: Money.new((result&.expense_total || 0), family.currency),
+          transfer_inflow_money: Money.new((result&.transfer_inflow_total || 0), family.currency),
+          transfer_outflow_money: Money.new((result&.transfer_outflow_total || 0), family.currency)
         )
       end
     end
diff --git a/app/models/transaction_import.rb b/app/models/transaction_import.rb
index 229526046..8b93431e6 100644
--- a/app/models/transaction_import.rb
+++ b/app/models/transaction_import.rb
@@ -105,11 +105,11 @@ class TransactionImport < Import
   end
 
   def csv_template
-    template = <<-CSV
+    template = <<~CSV
       date*,amount*,name,currency,category,tags,account,notes
-      05/15/2024,-45.99,Grocery Store,USD,Food,groceries|essentials,Checking Account,Monthly grocery run
-      05/16/2024,1500.00,Salary,,Income,,Main Account,
-      05/17/2024,-12.50,Coffee Shop,,,coffee,,
+      2024-05-15,-45.99,Grocery Store,USD,Food,groceries|essentials,Checking Account,Monthly grocery run
+      2024-05-16,1500.00,Salary,,Income,,Main Account,
+      2024-05-17,-12.50,Coffee Shop,,,coffee,,
     CSV
 
     csv = CSV.parse(template, headers: true)
diff --git a/app/models/transfer.rb b/app/models/transfer.rb
index d2dcbf667..878e899be 100644
--- a/app/models/transfer.rb
+++ b/app/models/transfer.rb
@@ -107,12 +107,12 @@ class Transfer < ApplicationRecord
   private
     def transfer_has_different_accounts
       return unless inflow_transaction&.entry && outflow_transaction&.entry
-      errors.add(:base, "Must be from different accounts") if to_account == from_account
+      errors.add(:base, :different_accounts) if to_account == from_account
     end
 
     def transfer_has_same_family
       return unless inflow_transaction&.entry && outflow_transaction&.entry
-      errors.add(:base, "Must be from same family") unless to_account&.family == from_account&.family
+      errors.add(:base, :same_family) unless to_account&.family == from_account&.family
     end
 
     def transfer_has_opposite_amounts
@@ -126,10 +126,10 @@ class Transfer < ApplicationRecord
 
       if inflow_entry.currency == outflow_entry.currency
         # For same currency, amounts must be exactly opposite
-        errors.add(:base, "Must have opposite amounts") if inflow_amount + outflow_amount != 0
+        errors.add(:base, :opposite_amounts) if inflow_amount + outflow_amount != 0
       else
         # For different currencies, just check the signs are opposite
-        errors.add(:base, "Must have opposite amounts") unless inflow_amount.negative? && outflow_amount.positive?
+        errors.add(:base, :opposite_amounts) unless inflow_amount.negative? && outflow_amount.positive?
       end
     end
 
@@ -138,6 +138,6 @@ class Transfer < ApplicationRecord
 
       date_diff = (inflow_transaction.entry.date - outflow_transaction.entry.date).abs
       max_days = status == "confirmed" ? 30 : 4
-      errors.add(:base, "Must be within #{max_days} days") if date_diff > max_days
+      errors.add(:base, :within_days, count: max_days) if date_diff > max_days
     end
 end
diff --git a/app/models/transfer/creator.rb b/app/models/transfer/creator.rb
index 1825e92d0..7aa8bc72c 100644
--- a/app/models/transfer/creator.rb
+++ b/app/models/transfer/creator.rb
@@ -1,10 +1,18 @@
 class Transfer::Creator
-  def initialize(family:, source_account_id:, destination_account_id:, date:, amount:)
+  def initialize(family:, source_account_id:, destination_account_id:, date:, amount:, exchange_rate: nil)
     @family = family
     @source_account = family.accounts.find(source_account_id) # early throw if not found
     @destination_account = family.accounts.find(destination_account_id) # early throw if not found
     @date = date
     @amount = amount.to_d
+
+    if exchange_rate.present?
+      rate_value = exchange_rate.to_d
+      raise ArgumentError, "exchange_rate must be greater than 0" unless rate_value > 0
+      @exchange_rate = rate_value
+    else
+      @exchange_rate = nil
+    end
   end
 
   def create
@@ -23,7 +31,7 @@ class Transfer::Creator
   end
 
   private
-    attr_reader :family, :source_account, :destination_account, :date, :amount
+    attr_reader :family, :source_account, :destination_account, :date, :amount, :exchange_rate
 
     def outflow_transaction
       name = "#{name_prefix} to #{destination_account.name}"
@@ -62,13 +70,13 @@ class Transfer::Creator
     end
 
     # If destination account has different currency, its transaction should show up as converted
-    # Future improvement: instead of a 1:1 conversion fallback, add a UI/UX flow for missing rates
+    # Uses user-provided exchange rate if available, otherwise requires a provider rate
     def inflow_converted_money
       Money.new(amount.abs, source_account.currency)
            .exchange_to(
              destination_account.currency,
              date: date,
-             fallback_rate: 1.0
+             custom_rate: exchange_rate
            )
     end
 
diff --git a/app/models/user.rb b/app/models/user.rb
index 02320aa8d..b1c40bb76 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -9,9 +9,6 @@ class User < ApplicationRecord
   if encryption_ready?
     # MFA secrets
     encrypts :otp_secret, deterministic: true
-    # Note: otp_backup_codes is a PostgreSQL array column which doesn't support
-    # AR encryption. To encrypt it, a migration would be needed to change the
-    # column type from array to text/jsonb.
 
     # PII - emails (deterministic for lookups, downcase for case-insensitive)
     encrypts :email, deterministic: true, downcase: true
@@ -28,6 +25,7 @@ class User < ApplicationRecord
   has_many :sessions, dependent: :destroy
   has_many :chats, dependent: :destroy
   has_many :api_keys, dependent: :destroy
+  has_many :webauthn_credentials, dependent: :destroy
   has_many :mobile_devices, dependent: :destroy
   has_many :invitations, foreign_key: :inviter_id, dependent: :destroy
   has_many :impersonator_support_sessions, class_name: "ImpersonationSession", foreign_key: :impersonator_id, dependent: :destroy
@@ -39,6 +37,8 @@ class User < ApplicationRecord
   has_many :shared_accounts, through: :account_shares, source: :account
   accepts_nested_attributes_for :family, update_only: true
 
+  MFA_BACKUP_CODE_COUNT = 8
+
   validates :email, presence: true, uniqueness: true, format: { with: URI::MailTo::EMAIL_REGEXP }
   validate :ensure_valid_profile_image
   validates :default_period, inclusion: { in: Period::PERIODS.keys }
@@ -220,24 +220,39 @@ class User < ApplicationRecord
   end
 
   def enable_mfa!
+    raise ArgumentError, "OTP secret must be set before enabling MFA" if otp_secret.blank?
+
+    backup_codes = generate_backup_codes
+
+    # Store bcrypt digests only; this Postgres array cannot use AR encryption.
     update!(
       otp_required: true,
-      otp_backup_codes: generate_backup_codes
+      otp_backup_codes: backup_codes.map { |code| digest_backup_code(code) }
     )
+
+    backup_codes
   end
 
   def disable_mfa!
-    update!(
-      otp_secret: nil,
-      otp_required: false,
-      otp_backup_codes: []
-    )
+    transaction do
+      update!(
+        otp_secret: nil,
+        otp_required: false,
+        otp_backup_codes: []
+      )
+      webauthn_credentials.destroy_all
+    end
   end
 
   def verify_otp?(code)
     return false if otp_secret.blank?
-    return true if verify_backup_code?(code)
-    totp.verify(code, drift_behind: 15)
+
+    normalized_code = normalize_mfa_code(code)
+    return false if normalized_code.blank?
+    return true if totp.verify(normalized_code, drift_behind: 15)
+    return false unless backup_code_input?(normalized_code)
+
+    consume_backup_code!(normalized_code)
   end
 
   def provisioning_uri
@@ -245,6 +260,20 @@ class User < ApplicationRecord
     totp.provisioning_uri(email)
   end
 
+  def ensure_webauthn_id!
+    return webauthn_id if webauthn_id.present?
+
+    with_lock do
+      update!(webauthn_id: WebAuthn.generate_user_id) unless webauthn_id.present?
+    end
+
+    webauthn_id
+  end
+
+  def webauthn_enabled?
+    otp_required? && webauthn_credentials.exists?
+  end
+
   def onboarded?
     onboarded_at.present?
   end
@@ -336,6 +365,10 @@ class User < ApplicationRecord
     preferences&.dig("dashboard_two_column") == true
   end
 
+  def preview_features_enabled?
+    preferences&.dig("preview_features_enabled") == true
+  end
+
   def update_transactions_preferences(prefs)
     transaction do
       lock!
@@ -379,6 +412,10 @@ class User < ApplicationRecord
         self.show_sidebar = true unless show_sidebar
         self.show_ai_sidebar = true unless show_ai_sidebar
       end
+
+      if new_record? && member? && !ai_available?
+        self.show_ai_sidebar = false
+      end
     end
 
     def leaving_guest_role?
@@ -442,21 +479,72 @@ class User < ApplicationRecord
       ROTP::TOTP.new(otp_secret, issuer: "Sure Finances")
     end
 
-    def verify_backup_code?(code)
-      return false if otp_backup_codes.blank?
+    def consume_backup_code!(normalized_code)
+      consumed = false
 
-      # Find and remove the used backup code
-      if (index = otp_backup_codes.index(code))
-        remaining_codes = otp_backup_codes.dup
-        remaining_codes.delete_at(index)
-        update!(otp_backup_codes: remaining_codes)
-        true
-      else
-        false
+      transaction do
+        lock!
+
+        if otp_backup_codes.present?
+          matching_index = otp_backup_codes.index do |stored_code|
+            backup_code_matches?(stored_code, normalized_code)
+          end
+
+          if matching_index
+            remaining_codes = otp_backup_codes.dup
+            remaining_codes.delete_at(matching_index)
+            update!(otp_backup_codes: remaining_codes)
+            consumed = true
+          end
+        end
       end
+
+      consumed
     end
 
     def generate_backup_codes
-      8.times.map { SecureRandom.hex(4) }
+      MFA_BACKUP_CODE_COUNT.times.map { SecureRandom.hex(8) }
+    end
+
+    def digest_backup_code(code)
+      BCrypt::Password.create(normalize_mfa_code(code), cost: backup_code_digest_cost).to_s
+    end
+
+    def backup_code_matches?(stored_code, normalized_code)
+      if backup_code_digest?(stored_code)
+        return false unless backup_code_input?(normalized_code)
+
+        BCrypt::Password.new(stored_code).is_password?(normalized_code)
+      else
+        # Legacy plaintext codes are accepted once so existing MFA users are
+        # not locked out after backup-code hashing ships.
+        ActiveSupport::SecurityUtils.secure_compare(stored_code.to_s, normalized_code)
+      end
+    rescue BCrypt::Errors::InvalidHash
+      false
+    end
+
+    def backup_code_digest?(stored_code)
+      stored_code.to_s.start_with?("$2a$", "$2b$", "$2y$")
+    end
+
+    def normalize_mfa_code(code)
+      code.to_s.strip.downcase
+    end
+
+    def backup_code_input?(code)
+      backup_code_candidate?(code) || legacy_plaintext_backup_code_candidate?(code)
+    end
+
+    def backup_code_candidate?(code)
+      code.to_s.match?(/\A[0-9a-f]{16}\z/)
+    end
+
+    def legacy_plaintext_backup_code_candidate?(code)
+      code.to_s.match?(/\A[0-9a-f]{8}\z/)
+    end
+
+    def backup_code_digest_cost
+      ActiveModel::SecurePassword.min_cost ? BCrypt::Engine::MIN_COST : BCrypt::Engine.cost
     end
 end
diff --git a/app/models/user_message.rb b/app/models/user_message.rb
index 5a123120d..865550a4a 100644
--- a/app/models/user_message.rb
+++ b/app/models/user_message.rb
@@ -11,7 +11,7 @@ class UserMessage < Message
     chat.ask_assistant_later(self)
   end
 
-  def request_response
-    chat.ask_assistant(self)
+  def request_response(assistant_message: nil)
+    chat.ask_assistant(self, assistant_message: assistant_message)
   end
 end
diff --git a/app/models/webauthn_credential.rb b/app/models/webauthn_credential.rb
new file mode 100644
index 000000000..da7ebefe3
--- /dev/null
+++ b/app/models/webauthn_credential.rb
@@ -0,0 +1,15 @@
+class WebauthnCredential < ApplicationRecord
+  belongs_to :user
+
+  before_validation :set_default_nickname
+
+  validates :nickname, presence: true, length: { maximum: 80 }
+  validates :credential_id, presence: true, uniqueness: true
+  validates :public_key, presence: true
+  validates :sign_count, numericality: { greater_than_or_equal_to: 0, only_integer: true }
+
+  private
+    def set_default_nickname
+      self.nickname = nickname.to_s.strip.presence || I18n.t("webauthn_credentials.default_name")
+    end
+end
diff --git a/app/views/account_sharings/show.html.erb b/app/views/account_sharings/show.html.erb
index b53a6bdff..5700136ba 100644
--- a/app/views/account_sharings/show.html.erb
+++ b/app/views/account_sharings/show.html.erb
@@ -46,7 +46,7 @@
             <% end %>
           </div>
           <div class="flex justify-end">
-            <%= render DS::Button.new(text: t(".save"), class: "md:w-auto w-full justify-center") %>
+            <%= render DS::Button.new(text: t(".save"), type: :submit, class: "md:w-auto w-full justify-center") %>
           </div>
         <% end %>
       <% else %>
@@ -83,7 +83,7 @@
               </div>
             </div>
             <div class="flex justify-end">
-              <%= render DS::Button.new(text: t(".save"), class: "md:w-auto w-full justify-center") %>
+              <%= render DS::Button.new(text: t(".save"), type: :submit, class: "md:w-auto w-full justify-center") %>
             </div>
           <% end %>
         </div>
diff --git a/app/views/account_statements/index.html.erb b/app/views/account_statements/index.html.erb
new file mode 100644
index 000000000..dba3f1677
--- /dev/null
+++ b/app/views/account_statements/index.html.erb
@@ -0,0 +1,170 @@
+<%= content_for :page_title, t(".title") %>
+
+<%= settings_section title: t(".title") do %>
+  <div class="space-y-4">
+    <div class="rounded-xl bg-container-inset p-4">
+      <div class="flex items-start justify-between gap-3 mb-4">
+        <div>
+          <p class="text-sm font-medium text-primary"><%= t(".upload_title") %></p>
+          <p class="text-xs text-secondary"><%= t(".upload_description") %></p>
+        </div>
+        <div class="text-right">
+          <p class="text-xs text-secondary"><%= t(".storage_used") %></p>
+          <p class="text-sm font-medium text-primary"><%= number_to_human_size(@total_storage_bytes) %></p>
+        </div>
+      </div>
+
+      <%= styled_form_with url: account_statements_path, scope: :account_statement, multipart: true, class: "grid gap-3 lg:grid-cols-[1fr_16rem_auto] lg:items-end" do |form| %>
+        <div>
+          <%= form.label :files, t("account_statements.form.files_label"), class: "form-field__label" %>
+          <%= form.file_field :files,
+                              multiple: true,
+                              accept: AccountStatement::ACCEPTED_FILE_EXTENSIONS.join(","),
+                              class: "form-field__input" %>
+          <p class="text-xs text-secondary mt-2"><%= t("account_statements.form.files_hint", max_size: AccountStatement::MAX_FILE_SIZE / 1.megabyte) %></p>
+        </div>
+        <%= form.collection_select :account_id,
+                                   @accounts,
+                                   :id,
+                                   :name,
+                                   { include_blank: t(".leave_unmatched"), label: t(".account_label") },
+                                   { data: { testid: "account-statement-account-select" } } %>
+        <div>
+          <%= form.submit t("account_statements.form.inbox_upload") %>
+        </div>
+      <% end %>
+    </div>
+
+    <div class="rounded-xl bg-container-inset space-y-1 p-1">
+      <div class="flex items-center gap-1.5 px-4 py-2 text-xs font-medium text-secondary uppercase">
+        <p><%= t(".unmatched_title") %></p>
+        <span class="text-subdued">&middot;</span>
+        <p><%= @unmatched_pagy.count %></p>
+      </div>
+
+      <div class="bg-container rounded-lg shadow-border-xs overflow-x-auto">
+        <% if @unmatched_statements.any? %>
+          <table class="w-full">
+            <thead>
+              <tr class="text-xs uppercase font-medium text-secondary border-b border-divider">
+                <th class="px-3 py-3 text-left min-w-56"><%= t("account_statements.table.file") %></th>
+                <th class="px-3 py-3 text-left min-w-44"><%= t("account_statements.table.period") %></th>
+                <th class="px-3 py-3 text-left min-w-48"><%= t("account_statements.table.suggestion") %></th>
+                <th class="px-3 py-3 text-right min-w-24"><%= t("account_statements.table.actions") %></th>
+              </tr>
+            </thead>
+            <tbody>
+              <% @unmatched_statements.each do |statement| %>
+                <tr id="<%= dom_id(statement) %>" class="border-b border-subdued hover:bg-surface-hover">
+                  <td class="px-3 py-3">
+                    <%= link_to account_statement_path(statement), class: "flex items-center gap-2 min-w-0 text-sm font-medium text-primary hover:underline" do %>
+                      <%= icon(account_statement_file_icon(statement), size: "sm") %>
+                      <span class="truncate"><%= statement.filename %></span>
+                    <% end %>
+                    <p class="text-xs text-secondary"><%= number_to_human_size(statement.byte_size) %></p>
+                  </td>
+                  <td class="px-3 py-3 text-sm text-secondary"><%= account_statement_period(statement) %></td>
+                  <td class="px-3 py-3">
+                    <% if statement.suggested_account.present? %>
+                      <div class="flex flex-col gap-1">
+                        <p class="text-sm font-medium text-primary"><%= statement.suggested_account.name %></p>
+                        <p class="text-xs text-secondary"><%= t(".confidence", confidence: number_to_percentage(statement.match_confidence.to_d * 100, precision: 0)) %></p>
+                      </div>
+                    <% else %>
+                      <span class="text-sm text-secondary"><%= t(".no_suggestion") %></span>
+                    <% end %>
+                  </td>
+                  <td class="px-3 py-3">
+                    <div class="flex items-center justify-end gap-3">
+                      <% if statement.suggested_account.present? %>
+                        <%= button_to link_account_statement_path(statement),
+                                      method: :patch,
+                                      params: { account_id: statement.suggested_account_id },
+                                      class: "flex items-center",
+                                      aria: { label: t("account_statements.table.link_suggestion") } do %>
+                          <%= icon("link", class: "w-5 h-5 text-primary") %>
+                        <% end %>
+                        <%= button_to reject_account_statement_path(statement),
+                                      method: :patch,
+                                      class: "flex items-center",
+                                      aria: { label: t("account_statements.table.reject") } do %>
+                          <%= icon("x", class: "w-5 h-5 text-secondary") %>
+                        <% end %>
+                      <% end %>
+                      <%= link_to account_statement_path(statement), aria: { label: t("account_statements.table.view") } do %>
+                        <%= icon("eye", class: "w-5 h-5 text-primary") %>
+                      <% end %>
+                    </div>
+                  </td>
+                </tr>
+              <% end %>
+            </tbody>
+          </table>
+        <% else %>
+          <p class="text-sm text-secondary text-center py-8 font-medium"><%= t(".empty_unmatched") %></p>
+        <% end %>
+      </div>
+      <% if @unmatched_pagy.pages > 1 %>
+        <div class="px-3 py-2">
+          <%= render "shared/pagination", pagy: @unmatched_pagy %>
+        </div>
+      <% end %>
+    </div>
+
+    <div class="rounded-xl bg-container-inset space-y-1 p-1">
+      <div class="flex items-center gap-1.5 px-4 py-2 text-xs font-medium text-secondary uppercase">
+        <p><%= t(".linked_title") %></p>
+        <span class="text-subdued">&middot;</span>
+        <p><%= @linked_pagy.count %></p>
+      </div>
+
+      <div class="bg-container rounded-lg shadow-border-xs overflow-x-auto">
+        <% if @linked_statements.any? %>
+          <table class="w-full">
+            <thead>
+              <tr class="text-xs uppercase font-medium text-secondary border-b border-divider">
+                <th class="px-3 py-3 text-left min-w-56"><%= t("account_statements.table.file") %></th>
+                <th class="px-3 py-3 text-left min-w-44"><%= t("account_statements.table.account") %></th>
+                <th class="px-3 py-3 text-left min-w-44"><%= t("account_statements.table.period") %></th>
+                <th class="px-3 py-3 text-right min-w-24"><%= t("account_statements.table.actions") %></th>
+              </tr>
+            </thead>
+            <tbody>
+              <% @linked_statements.each do |statement| %>
+                <tr id="<%= dom_id(statement) %>" class="border-b border-subdued hover:bg-surface-hover">
+                  <td class="px-3 py-3">
+                    <%= link_to account_statement_path(statement), class: "flex items-center gap-2 min-w-0 text-sm font-medium text-primary hover:underline" do %>
+                      <%= icon(account_statement_file_icon(statement), size: "sm") %>
+                      <span class="truncate"><%= statement.filename %></span>
+                    <% end %>
+                  </td>
+                  <td class="px-3 py-3 text-sm text-secondary"><%= statement.account&.name %></td>
+                  <td class="px-3 py-3 text-sm text-secondary"><%= account_statement_period(statement) %></td>
+                  <td class="px-3 py-3">
+                    <div class="flex items-center justify-end gap-3">
+                      <%= link_to account_statement_path(statement), aria: { label: t("account_statements.table.view") } do %>
+                        <%= icon("eye", class: "w-5 h-5 text-primary") %>
+                      <% end %>
+                      <% if statement.original_file.attached? %>
+                        <%= link_to rails_blob_path(statement.original_file, disposition: "attachment"), aria: { label: t("account_statements.table.download") } do %>
+                          <%= icon("download", class: "w-5 h-5 text-primary") %>
+                        <% end %>
+                      <% end %>
+                    </div>
+                  </td>
+                </tr>
+              <% end %>
+            </tbody>
+          </table>
+        <% else %>
+          <p class="text-sm text-secondary text-center py-8 font-medium"><%= t(".empty_linked") %></p>
+        <% end %>
+      </div>
+      <% if @linked_pagy.pages > 1 %>
+        <div class="px-3 py-2">
+          <%= render "shared/pagination", pagy: @linked_pagy %>
+        </div>
+      <% end %>
+    </div>
+  </div>
+<% end %>
diff --git a/app/views/account_statements/show.html.erb b/app/views/account_statements/show.html.erb
new file mode 100644
index 000000000..e320fc79a
--- /dev/null
+++ b/app/views/account_statements/show.html.erb
@@ -0,0 +1,180 @@
+<%= content_for :page_title, @statement.filename %>
+
+<%= settings_section title: t(".title") do %>
+  <div class="space-y-4">
+    <div class="rounded-xl bg-container-inset p-4">
+      <div class="flex flex-col gap-4 md:flex-row md:items-start md:justify-between">
+        <div class="min-w-0">
+          <div class="flex items-center gap-2">
+            <%= icon(account_statement_file_icon(@statement), size: "sm") %>
+            <h2 class="text-lg font-medium text-primary truncate"><%= @statement.filename %></h2>
+          </div>
+          <div class="mt-2 flex flex-wrap items-center gap-2 text-xs text-secondary">
+            <%= account_statement_status_badge(@statement) %>
+            <span><%= number_to_human_size(@statement.byte_size) %></span>
+            <span><%= @statement.content_type %></span>
+          </div>
+        </div>
+
+        <div class="flex items-center gap-3">
+          <% if @statement.original_file.attached? %>
+            <%= link_to rails_blob_path(@statement.original_file, disposition: "attachment"),
+                        class: "inline-flex items-center gap-2 text-sm font-medium text-primary hover:text-primary-hover" do %>
+              <%= icon("download", size: "sm") %>
+              <%= t(".download") %>
+            <% end %>
+          <% end %>
+          <% if @can_manage_statement %>
+            <%= button_to account_statement_path(@statement),
+                          method: :delete,
+                          class: "inline-flex items-center gap-2 text-sm font-medium text-destructive",
+                          data: { turbo_confirm: CustomConfirm.for_resource_deletion("statement") } do %>
+              <%= icon("trash-2", size: "sm", color: "destructive") %>
+              <%= t(".delete") %>
+            <% end %>
+          <% end %>
+        </div>
+      </div>
+    </div>
+
+    <div class="grid gap-4 lg:grid-cols-[1fr_22rem]">
+      <div class="rounded-xl bg-container-inset p-4">
+        <h3 class="text-sm font-medium text-primary mb-3"><%= t(".metadata_title") %></h3>
+
+        <% if @can_manage_statement %>
+          <%= styled_form_with model: @statement, url: account_statement_path(@statement), method: :patch, class: "space-y-4" do |form| %>
+            <div class="grid gap-3 md:grid-cols-2">
+              <%= form.text_field :institution_name_hint, label: t(".institution_name_hint") %>
+              <%= form.text_field :account_name_hint, label: t(".account_name_hint") %>
+              <%= form.text_field :account_last4_hint, label: t(".account_last4_hint") %>
+              <%= form.select :currency,
+                              account_statement_currency_options(@statement),
+                              { label: t(".currency"), selected: @statement.statement_currency } %>
+              <%= form.date_field :period_start_on, label: t(".period_start_on") %>
+              <%= form.date_field :period_end_on, label: t(".period_end_on") %>
+              <%= form.number_field :opening_balance, label: t(".opening_balance"), step: "0.01" %>
+              <%= form.number_field :closing_balance, label: t(".closing_balance"), step: "0.01" %>
+            </div>
+
+            <%= form.submit t(".save") %>
+          <% end %>
+        <% else %>
+          <dl class="grid gap-3 md:grid-cols-2 text-sm">
+            <div>
+              <dt class="text-xs text-secondary"><%= t(".account_label") %></dt>
+              <dd class="text-primary"><%= @statement.account&.name || t(".unmatched_account") %></dd>
+            </div>
+            <div>
+              <dt class="text-xs text-secondary"><%= t(".institution_name_hint") %></dt>
+              <dd class="text-primary"><%= @statement.institution_name_hint.presence || t(".unknown_value") %></dd>
+            </div>
+            <div>
+              <dt class="text-xs text-secondary"><%= t(".account_name_hint") %></dt>
+              <dd class="text-primary"><%= @statement.account_name_hint.presence || t(".unknown_value") %></dd>
+            </div>
+            <div>
+              <dt class="text-xs text-secondary"><%= t(".account_last4_hint") %></dt>
+              <dd class="text-primary"><%= @statement.account_last4_hint.presence || t(".unknown_value") %></dd>
+            </div>
+            <div>
+              <dt class="text-xs text-secondary"><%= t(".currency") %></dt>
+              <dd class="text-primary"><%= @statement.statement_currency %></dd>
+            </div>
+            <div>
+              <dt class="text-xs text-secondary"><%= t("account_statements.table.period") %></dt>
+              <dd class="text-primary"><%= account_statement_period(@statement) %></dd>
+            </div>
+            <div>
+              <dt class="text-xs text-secondary"><%= t(".opening_balance") %></dt>
+              <dd class="text-primary privacy-sensitive"><%= account_statement_balance_label(@statement, :opening_balance) %></dd>
+            </div>
+            <div>
+              <dt class="text-xs text-secondary"><%= t(".closing_balance") %></dt>
+              <dd class="text-primary privacy-sensitive"><%= account_statement_balance_label(@statement, :closing_balance) %></dd>
+            </div>
+          </dl>
+        <% end %>
+      </div>
+
+      <div class="space-y-4">
+        <div class="rounded-xl bg-container-inset p-4">
+          <h3 class="text-sm font-medium text-primary mb-3"><%= t(".linking_title") %></h3>
+
+          <% if @statement.account.present? %>
+            <p class="text-sm text-secondary mb-3">
+              <%= t(".linked_to", account: @statement.account.name) %>
+            </p>
+            <% if @can_manage_statement %>
+              <%= button_to unlink_account_statement_path(@statement),
+                            method: :patch,
+                            class: "inline-flex items-center gap-2 text-sm font-medium text-primary" do %>
+                <%= icon("unlink", size: "sm") %>
+                <%= t(".unlink") %>
+              <% end %>
+            <% end %>
+          <% elsif @statement.suggested_account.present? %>
+            <p class="text-sm text-secondary mb-3">
+              <%= t(".suggested_account", account: @statement.suggested_account.name, confidence: number_to_percentage(@statement.match_confidence.to_d * 100, precision: 0)) %>
+            </p>
+            <% if @can_manage_statement %>
+              <div class="flex items-center gap-3">
+                <%= button_to link_account_statement_path(@statement),
+                              method: :patch,
+                              params: { account_id: @statement.suggested_account_id },
+                              class: "inline-flex items-center gap-2 text-sm font-medium text-primary" do %>
+                  <%= icon("link", size: "sm") %>
+                  <%= t(".link_suggestion") %>
+                <% end %>
+                <%= button_to reject_account_statement_path(@statement),
+                              method: :patch,
+                              class: "inline-flex items-center gap-2 text-sm font-medium text-secondary" do %>
+                  <%= icon("x", size: "sm") %>
+                  <%= t(".reject") %>
+                <% end %>
+              </div>
+            <% end %>
+          <% else %>
+            <p class="text-sm text-secondary"><%= t(".no_suggestion") %></p>
+          <% end %>
+        </div>
+
+        <div class="rounded-xl bg-container-inset p-4">
+          <h3 class="text-sm font-medium text-primary mb-3"><%= t(".reconciliation_title") %></h3>
+
+          <% if @reconciliation_checks.any? %>
+            <div class="space-y-3">
+              <% @reconciliation_checks.each do |check| %>
+                <div class="rounded-lg bg-container shadow-border-xs p-3">
+                  <div class="flex items-center justify-between gap-3">
+                    <p class="text-sm font-medium text-primary"><%= account_statement_reconciliation_label(check) %></p>
+                    <% if check[:status] == "matched" %>
+                      <%= render "shared/badge", color: "success" do %><%= t("account_statements.reconciliation.matched") %><% end %>
+                    <% else %>
+                      <%= render "shared/badge", color: "error" do %><%= t("account_statements.reconciliation.mismatched") %><% end %>
+                    <% end %>
+                  </div>
+                  <dl class="mt-3 space-y-1 text-xs text-secondary">
+                    <div class="flex justify-between gap-3">
+                      <dt><%= t(".statement_amount") %></dt>
+                      <dd class="privacy-sensitive"><%= Money.new(check[:statement_amount], @statement.statement_currency).format %></dd>
+                    </div>
+                    <div class="flex justify-between gap-3">
+                      <dt><%= t(".ledger_amount") %></dt>
+                      <dd class="privacy-sensitive"><%= Money.new(check[:ledger_amount], @statement.statement_currency).format %></dd>
+                    </div>
+                    <div class="flex justify-between gap-3">
+                      <dt><%= t(".difference") %></dt>
+                      <dd class="privacy-sensitive"><%= Money.new(check[:difference], @statement.statement_currency).format %></dd>
+                    </div>
+                  </dl>
+                </div>
+              <% end %>
+            </div>
+          <% else %>
+            <p class="text-sm text-secondary"><%= t(".reconciliation_unavailable") %></p>
+          <% end %>
+        </div>
+      </div>
+    </div>
+  </div>
+<% end %>
diff --git a/app/views/accounts/_account.html.erb b/app/views/accounts/_account.html.erb
index 00341560b..bcc57a68d 100644
--- a/app/views/accounts/_account.html.erb
+++ b/app/views/accounts/_account.html.erb
@@ -54,7 +54,7 @@
 
       <% if account.draft? %>
         <%= render DS::Link.new(
-          text: "Complete setup",
+          text: t(".complete_setup"),
           href: edit_account_path(account, return_to: return_to),
           variant: :outline,
           frame: :modal
@@ -71,6 +71,17 @@
             <% if !account.linked? && %w[Depository CreditCard Investment Crypto].include?(account.accountable_type) %>
               <% menu.with_item(variant: "link", text: t("accounts.account.link_provider"), href: select_provider_account_path(account), icon: "link", data: { turbo_frame: :modal }) %>
             <% elsif account.linked? %>
+              <%# Same-provider relink (e.g., card-replacement fraud). Only surfaced for
+                 SimpleFIN-linked accounts today; other providers can be added later. %>
+              <% if account.linked_to?("SimplefinAccount") %>
+                <% menu.with_item(
+                  variant: "link",
+                  text: t("accounts.account.change_simplefin_account"),
+                  href: select_existing_account_simplefin_items_path(account_id: account.id),
+                  icon: "arrow-left-right",
+                  data: { turbo_frame: :modal }
+                ) %>
+              <% end %>
               <% menu.with_item(variant: "link", text: t("accounts.account.unlink_provider"), href: confirm_unlink_account_path(account), icon: "unlink", data: { turbo_frame: :modal }) %>
             <% end %>
           <% end %>
diff --git a/app/views/accounts/_account_sidebar_tabs.html.erb b/app/views/accounts/_account_sidebar_tabs.html.erb
index ae6f793d8..653a64c85 100644
--- a/app/views/accounts/_account_sidebar_tabs.html.erb
+++ b/app/views/accounts/_account_sidebar_tabs.html.erb
@@ -1,5 +1,6 @@
 <%# locals: (family:, active_tab:, mobile: false) %>
 
+<% cache account_sidebar_tabs_cache_key(family: family, active_tab: active_tab, mobile: mobile), expires_in: 12.hours do %>
 <div id="account-sidebar-tabs">
   <% if family.missing_data_provider? %>
     <details class="group bg-yellow-tint-10 rounded-lg p-2 text-yellow-600 mb-3 text-xs">
@@ -88,3 +89,4 @@
     <% end %>
   <% end %>
 </div>
+<% end %>
diff --git a/app/views/accounts/_account_type.html.erb b/app/views/accounts/_account_type.html.erb
index 741ace78b..d055156f1 100644
--- a/app/views/accounts/_account_type.html.erb
+++ b/app/views/accounts/_account_type.html.erb
@@ -1,11 +1,11 @@
 <%# locals: (accountable:) %>
 
 <%= link_to new_polymorphic_path(accountable, step: "method_select", return_to: params[:return_to]),
-            class: "flex items-center gap-4 w-full text-center focus:outline-hidden hover:bg-surface-hover focus:bg-surface-hover fg-primary border border-transparent block px-2 rounded-lg p-2" do %>
+            class: "flex items-center gap-4 w-full text-center focus:outline-hidden hover:bg-surface-hover focus:bg-surface-hover text-primary border border-transparent block px-2 rounded-lg p-2" do %>
   <%= render DS::FilledIcon.new(
     icon: accountable.icon,
     hex_color: accountable.color,
   ) %>
 
-  <%= accountable.display_name.singularize %>
+  <%= accountable.singular_display_name %>
 <% end %>
diff --git a/app/views/accounts/_accountable_group.html.erb b/app/views/accounts/_accountable_group.html.erb
index 64f655797..28727dc85 100644
--- a/app/views/accounts/_accountable_group.html.erb
+++ b/app/views/accounts/_accountable_group.html.erb
@@ -56,7 +56,7 @@
     <div class="my-2">
       <%= render DS::Link.new(
       href: new_polymorphic_path(account_group.key, step: "method_select"),
-      text: t("accounts.sidebar.new_account_group", account_group: account_group.name.downcase.singularize),
+      text: t("accounts.sidebar.new_account_group", account_group: account_group.accountable_type.singular_display_name.downcase),
       icon: "plus",
       full_width: true,
       variant: "ghost",
diff --git a/app/views/accounts/_tax_treatment_badge.html.erb b/app/views/accounts/_tax_treatment_badge.html.erb
index 070e870ba..b27da2381 100644
--- a/app/views/accounts/_tax_treatment_badge.html.erb
+++ b/app/views/accounts/_tax_treatment_badge.html.erb
@@ -1,17 +1,17 @@
 <%# locals: (account:) %>
 <%
   treatment = account.tax_treatment
-  badge_classes = case treatment
-  when :tax_exempt
-    "bg-green-500/10 text-green-600 theme-dark:text-green-400"
-  when :tax_deferred
-    "bg-blue-500/10 text-blue-600 theme-dark:text-blue-400"
-  when :tax_advantaged
-    "bg-purple-500/10 text-purple-600 theme-dark:text-purple-400"
-  else
-    "bg-gray-500/10 text-secondary"
-  end
+  tone = case treatment
+         when :tax_exempt     then :green
+         when :tax_deferred   then :indigo  # was raw blue-500/10 → maps to closest DS tone
+         when :tax_advantaged then :violet  # was raw purple-500/10 → maps to closest DS tone
+         else                      :neutral
+         end
 %>
-<span class="inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium <%= badge_classes %>" title="<%= t("accounts.tax_treatment_descriptions.#{treatment}") %>">
-  <%= account.tax_treatment_label %>
-</span>
+<%= render DS::Pill.new(
+  label: account.tax_treatment_label,
+  tone: tone,
+  marker: false,
+  show_dot: false,
+  title: t("accounts.tax_treatment_descriptions.#{treatment}")
+) %>
diff --git a/app/views/accounts/confirm_unlink.html.erb b/app/views/accounts/confirm_unlink.html.erb
index 5b77c4808..e61cfd925 100644
--- a/app/views/accounts/confirm_unlink.html.erb
+++ b/app/views/accounts/confirm_unlink.html.erb
@@ -6,19 +6,15 @@
       <%= t("accounts.confirm_unlink.description_html", account_name: @account.name, provider_name: @account.provider_name) %>
     </p>
 
-    <div class="mb-4 p-3 bg-yellow-50 border border-yellow-200 rounded-lg">
-      <div class="flex items-start gap-2">
-        <%= icon "alert-triangle", class: "w-4 h-4 text-yellow-600 mt-0.5 flex-shrink-0" %>
-        <div class="text-xs">
-          <p class="font-medium text-yellow-900 mb-1"><%= t("accounts.confirm_unlink.warning_title") %></p>
-          <ul class="text-yellow-700 list-disc list-inside space-y-1">
-            <li><%= t("accounts.confirm_unlink.warning_no_sync") %></li>
-            <li><%= t("accounts.confirm_unlink.warning_manual_updates") %></li>
-            <li><%= t("accounts.confirm_unlink.warning_transactions_kept") %></li>
-            <li><%= t("accounts.confirm_unlink.warning_can_delete") %></li>
-          </ul>
-        </div>
-      </div>
+    <div class="mb-4">
+      <%= render DS::Alert.new(title: t("accounts.confirm_unlink.warning_title"), variant: :warning) do %>
+        <ul class="list-disc list-inside">
+          <li><%= t("accounts.confirm_unlink.warning_no_sync") %></li>
+          <li><%= t("accounts.confirm_unlink.warning_manual_updates") %></li>
+          <li><%= t("accounts.confirm_unlink.warning_transactions_kept") %></li>
+          <li><%= t("accounts.confirm_unlink.warning_can_delete") %></li>
+        </ul>
+      <% end %>
     </div>
 
     <%= render DS::Button.new(
diff --git a/app/views/accounts/index.html.erb b/app/views/accounts/index.html.erb
index ec2fce04e..38ba4d888 100644
--- a/app/views/accounts/index.html.erb
+++ b/app/views/accounts/index.html.erb
@@ -9,7 +9,7 @@
         frame: :_top
       ) %>
   <%= render DS::Link.new(
-    text: "New account",
+    text: t(".new_account"),
     href: new_account_path(return_to: accounts_path),
     variant: "primary",
     icon: "plus",
@@ -17,7 +17,7 @@
   ) %>
 <% end %>
 
-<% if @manual_accounts.empty? && @plaid_items.empty? && @simplefin_items.empty? && @lunchflow_items.empty? && @enable_banking_items.empty? && @coinstats_items.empty? && @coinbase_items.empty? && @mercury_items.empty? && @snaptrade_items.empty? && @indexa_capital_items.empty? %>
+<% if @manual_accounts.empty? && @plaid_items.empty? && @simplefin_items.empty? && @lunchflow_items.empty? && @enable_banking_items.empty? && @coinstats_items.empty? && @coinbase_items.empty? && @mercury_items.empty? && @brex_items.empty? && @ibkr_items.empty? && @snaptrade_items.empty? && @indexa_capital_items.empty? && @sophtron_items.empty? %>
   <%= render "empty" %>
 <% else %>
   <div class="space-y-2">
@@ -41,10 +41,18 @@
       <%= render @coinstats_items.sort_by(&:created_at) %>
     <% end %>
 
+    <% if @sophtron_items.any? %>
+      <%= render @sophtron_items.sort_by(&:created_at) %>
+    <% end %>
+
     <% if @mercury_items.any? %>
       <%= render @mercury_items.sort_by(&:created_at) %>
     <% end %>
 
+    <% if @brex_items.any? %>
+      <%= render @brex_items.sort_by(&:created_at) %>
+    <% end %>
+
     <% if @coinbase_items.any? %>
       <%= render @coinbase_items.sort_by(&:created_at) %>
     <% end %>
@@ -53,9 +61,13 @@
       <%= render @snaptrade_items.sort_by(&:created_at) %>
     <% end %>
 
+    <% if @ibkr_items.any? %>
+      <%= render @ibkr_items.sort_by(&:created_at) %>
+    <% end %>
+
     <% if @indexa_capital_items.any? %>
-  <%= render @indexa_capital_items.sort_by(&:created_at) %>
-<% end %>
+      <%= render @indexa_capital_items.sort_by(&:created_at) %>
+    <% end %>
 
     <% if @manual_accounts.any? %>
       <div id="manual-accounts">
diff --git a/app/views/accounts/index/_account_groups.erb b/app/views/accounts/index/_account_groups.erb
index a66ddf5e3..79709142e 100644
--- a/app/views/accounts/index/_account_groups.erb
+++ b/app/views/accounts/index/_account_groups.erb
@@ -1,6 +1,11 @@
 <%# locals: (accounts:) %>
 
-<% ActiveRecord::Associations::Preloader.new(records: accounts, associations: :account_shares).call if accounts.any? %>
+<% if accounts.any? %>
+  <% ActiveRecord::Associations::Preloader.new(
+       records: accounts,
+       associations: [ :account_shares, :accountable, :plaid_account, :simplefin_account, { account_providers: :provider } ]
+     ).call %>
+<% end %>
 <% accounts.group_by(&:accountable_type).sort_by { |group, _| group }.each do |group, accounts| %>
   <div class="bg-container-inset p-1 rounded-xl">
     <div class="flex items-center px-4 py-2 text-xs font-medium text-secondary">
@@ -9,7 +14,7 @@
       <p><%= accounts.count %></p>
 
       <% unless accounts.any?(&:syncing?) %>
-        <p class="ml-auto"><%= totals_by_currency(collection: accounts, money_method: :balance_money) %></p>
+        <p class="ml-auto privacy-sensitive"><%= totals_by_currency(collection: accounts, money_method: :balance_money) %></p>
       <% end %>
     </div>
     <div class="bg-container rounded-lg shadow-border-xs overflow-hidden">
diff --git a/app/views/accounts/new.html.erb b/app/views/accounts/new.html.erb
index 01b02a575..7caa4dda3 100644
--- a/app/views/accounts/new.html.erb
+++ b/app/views/accounts/new.html.erb
@@ -27,7 +27,7 @@
     <% unless params[:return_to].present? %>
       <%= button_to imports_path(import: { type: "AccountImport" }),
               data: { turbo_frame: :_top },
-            class: "flex items-center gap-4 w-full text-center focus:outline-hidden hover:bg-surface-hover focus:bg-surface-hover fg-primary border border-transparent block px-2 rounded-lg p-2" do %>
+            class: "flex items-center gap-4 w-full text-center focus:outline-hidden hover:bg-surface-hover focus:bg-surface-hover text-primary border border-transparent block px-2 rounded-lg p-2" do %>
         <%= render DS::FilledIcon.new(
           icon: "download",
           hex_color: "#F79009",
diff --git a/app/views/accounts/new/_container.html.erb b/app/views/accounts/new/_container.html.erb
index 67697da50..6c1c16112 100644
--- a/app/views/accounts/new/_container.html.erb
+++ b/app/views/accounts/new/_container.html.erb
@@ -2,7 +2,7 @@
 
 <%= render DS::Dialog.new do |dialog| %>
   <div class="flex flex-col relative" data-controller="list-keyboard-navigation">
-    <div class="border-b border-tertiary md:border-alpha-black-25 px-4 pb-4 text-gray-800 flex items-center justify-between gap-2">
+    <div class="border-b border-tertiary md:border-alpha-black-25 px-4 pb-4 text-primary flex items-center justify-between gap-2">
       <div class="flex items-center gap-2">
         <% if back_path %>
           <%= render DS::Link.new(
@@ -29,13 +29,13 @@
     <div class="border-t border-alpha-black-25 px-4 pt-4 text-secondary text-sm justify-between hidden md:flex">
       <div class="flex space-x-5">
         <div class="flex items-center space-x-2">
-          <span>Select</span>
+          <span><%= t(".select") %></span>
           <kbd class="bg-alpha-black-50 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.1)] p-1 rounded-md flex w-5 h-5 shrink-0 grow-0 items-center justify-center">
             <%= icon("corner-down-left", size: "xs") %>
           </kbd>
         </div>
         <div class="flex items-center space-x-2">
-          <span>Navigate</span>
+          <span><%= t(".navigate") %></span>
           <kbd class="bg-alpha-black-50 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.1)] p-1 rounded-md flex w-5 h-5 shrink-0 grow-0 items-center justify-center">
             <%= icon("arrow-up", size: "xs") %>
           </kbd>
@@ -45,7 +45,7 @@
         </div>
       </div>
       <div class="flex items-center space-x-2">
-        <button data-action="DS--dialog#close">Close</button>
+        <button data-action="DS--dialog#close"><%= t(".close") %></button>
         <kbd class="bg-alpha-black-50 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.1)] p-1 rounded-md flex w-8 h-5 shrink-0 grow-0 items-center justify-center text-xs">ESC</kbd>
       </div>
     </div>
diff --git a/app/views/accounts/new/_method_selector.html.erb b/app/views/accounts/new/_method_selector.html.erb
index f98fef36c..ac3c31909 100644
--- a/app/views/accounts/new/_method_selector.html.erb
+++ b/app/views/accounts/new/_method_selector.html.erb
@@ -10,7 +10,7 @@
          <% end %>
        <% end %>>
     <%# Manual entry option %>
-    <%= link_to path, class: "flex items-center gap-4 w-full text-center text-primary focus:outline-hidden focus:bg-surface border border-transparent focus:border focus:border-gray-200 px-2 hover:bg-surface rounded-lg p-2" do %>
+    <%= link_to path, class: "flex items-center gap-4 w-full text-center text-primary focus:outline-hidden focus:bg-surface border border-transparent focus:border focus:border-secondary px-2 hover:bg-surface rounded-lg p-2" do %>
       <span class="flex w-8 h-8 shrink-0 grow-0 items-center justify-center rounded-lg bg-alpha-black-50 shadow-[inset_0_0_0_1px_rgba(0,0,0,0.02)]">
         <%= icon("keyboard") %>
       </span>
diff --git a/app/views/accounts/show.html.erb b/app/views/accounts/show.html.erb
index 170f12986..a2c663b6b 100644
--- a/app/views/accounts/show.html.erb
+++ b/app/views/accounts/show.html.erb
@@ -2,7 +2,11 @@
       account: @account,
       chart_view: @chart_view,
       chart_period: @period,
-      active_tab: @tab
+      active_tab: @tab,
+      statement_coverage: @statement_coverage,
+      statements: @account_statements,
+      reconciliation_statuses: @statement_reconciliation_statuses,
+      can_manage_statements: @can_manage_statements
     ) do |account_page| %>
   <%= account_page.with_activity_feed(feed_data: @activity_feed_data, pagy: @pagy, search: @q[:search]) %>
 <% end %>
diff --git a/app/views/accounts/show/_activity.html.erb b/app/views/accounts/show/_activity.html.erb
index 76de75102..5660695c9 100644
--- a/app/views/accounts/show/_activity.html.erb
+++ b/app/views/accounts/show/_activity.html.erb
@@ -7,11 +7,11 @@
       <% unless @account.linked? %>
         <% if @account.permission_for(Current.user).in?([ :owner, :full_control ]) %>
           <%= render DS::Menu.new(variant: "button") do |menu| %>
-            <% menu.with_button(text: "New", variant: "secondary", icon: "plus") %>
+            <% menu.with_button(text: t(".new"), variant: "secondary", icon: "plus") %>
 
             <% menu.with_item(
                 variant: "link",
-                text: "New balance",
+                text: t(".new_balance"),
                 icon: "circle-dollar-sign",
                 href: new_valuation_path(account_id: @account.id),
                 data: { turbo_frame: :modal }) %>
@@ -44,11 +44,11 @@
               data: { controller: "auto-submit-form" } do |form| %>
         <div class="flex gap-2 mb-4">
           <div class="grow">
-            <div class="flex items-center px-3 py-2 gap-2 border border-secondary rounded-lg focus-within:ring-gray-100 focus-within:border-gray-900">
+            <div class="flex items-center px-3 py-2 gap-2 border border-secondary rounded-lg focus-within:border-primary">
               <%= icon("search") %>
               <%= hidden_field_tag :account_id, @account.id %>
               <%= form.search_field :search,
-                            placeholder: "Search entries by name",
+                            placeholder: t(".search_placeholder"),
                             value: @q[:search],
                             class: "form-field__input placeholder:text-sm placeholder:text-secondary",
                             "data-auto-submit-form-target": "auto" %>
diff --git a/app/views/accounts/show/_header.html.erb b/app/views/accounts/show/_header.html.erb
index cafd97811..ddbad5a2b 100644
--- a/app/views/accounts/show/_header.html.erb
+++ b/app/views/accounts/show/_header.html.erb
@@ -17,7 +17,7 @@
             <% end %>
             <% if account.draft? %>
               <%= render DS::Link.new(
-                  text: "Complete setup",
+                  text: t(".complete_setup"),
                   href: edit_account_path(account),
                   variant: :outline,
                   size: :sm,
diff --git a/app/views/accounts/show/_menu.html.erb b/app/views/accounts/show/_menu.html.erb
index 45a39fe18..de1b77626 100644
--- a/app/views/accounts/show/_menu.html.erb
+++ b/app/views/accounts/show/_menu.html.erb
@@ -3,9 +3,10 @@
 <% permission = account.permission_for(Current.user) %>
 <%= render DS::Menu.new(testid: "account-menu") do |menu| %>
   <% if permission.in?([ :owner, :full_control ]) %>
-    <% menu.with_item(variant: "link", text: "Edit", href: edit_account_path(account), icon: "pencil-line", data: { turbo_frame: :modal }) %>
+    <% menu.with_item(variant: "link", text: t(".edit"), href: edit_account_path(account), icon: "pencil-line", data: { turbo_frame: :modal }) %>
   <% end %>
-  <% menu.with_item(variant: "link", text: "Sharing", href: account_sharing_path(account), icon: "users", data: { turbo_frame: :modal }) %>
+  <% menu.with_item(variant: "link", text: t(".sharing"), href: account_sharing_path(account), icon: "users", data: { turbo_frame: :modal }) %>
+  <% menu.with_item(variant: "link", text: t(".statements"), href: account_path(account, tab: "statements"), icon: "archive") %>
 
   <% if permission.in?([ :owner, :full_control ]) %>
     <% if account.supports_trades? %>
@@ -30,7 +31,7 @@
   <% if account.owned_by?(Current.user) && !account.linked? %>
     <% menu.with_item(
       variant: "button",
-      text: "Delete account",
+      text: t(".delete_account"),
       href: account_path(account),
       method: :delete,
       icon: "trash-2",
diff --git a/app/views/accounts/show/_statements.html.erb b/app/views/accounts/show/_statements.html.erb
new file mode 100644
index 000000000..3a5d4a11a
--- /dev/null
+++ b/app/views/accounts/show/_statements.html.erb
@@ -0,0 +1,124 @@
+<%# locals: (account:, coverage:, statements:, reconciliation_statuses:, can_manage_statements:) %>
+
+<div class="space-y-4">
+  <div class="rounded-xl bg-container-inset p-1">
+    <div class="flex flex-col gap-3 px-4 py-3 lg:flex-row lg:items-start lg:justify-between">
+      <div>
+        <p class="text-sm font-medium text-primary"><%= t("account_statements.account_tab.coverage_title") %></p>
+        <p class="text-xs text-secondary"><%= t("account_statements.account_tab.coverage_description") %></p>
+        <p class="text-xs text-secondary"><%= account_statement_coverage_range(coverage) %></p>
+      </div>
+      <div class="flex flex-wrap items-center gap-3">
+        <%= form_with url: account_path(account), method: :get, data: { controller: "auto-submit-form" } do |form| %>
+          <%= form.hidden_field :tab, value: "statements" %>
+          <%= form.select :statement_year,
+                          coverage.available_years.map { |year| [ year, year ] },
+                          { selected: coverage.selected_year },
+                          class: "bg-container border border-secondary rounded-lg px-3 py-2 text-sm pr-7 cursor-pointer text-primary focus:outline-hidden focus:ring-0",
+                          data: { "auto-submit-form-target": "auto" },
+                          aria: { label: t("account_statements.account_tab.year_label") } %>
+        <% end %>
+        <%= link_to account_statements_path,
+                    class: "inline-flex items-center gap-2 text-sm font-medium text-primary hover:text-primary-hover" do %>
+          <%= icon("inbox", size: "sm") %>
+          <%= t("account_statements.account_tab.open_inbox") %>
+        <% end %>
+      </div>
+    </div>
+
+    <div class="grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-6 gap-2 bg-container rounded-lg shadow-border-xs p-3">
+      <% coverage.months.each do |month| %>
+        <div class="rounded-lg ring px-3 py-2 <%= account_statement_coverage_classes(month.status) %>">
+          <p class="text-xs font-medium"><%= account_statement_coverage_label(month) %></p>
+          <p class="text-xs capitalize"><%= t("account_statements.coverage.status.#{month.status}") %></p>
+        </div>
+      <% end %>
+    </div>
+  </div>
+
+  <% if can_manage_statements %>
+    <div class="rounded-xl bg-container-inset p-4">
+      <%= styled_form_with url: account_statements_path, scope: :account_statement, multipart: true, class: "space-y-3" do |form| %>
+        <%= form.hidden_field :account_id, value: account.id %>
+        <div>
+          <%= form.label :files, t("account_statements.form.files_label"), class: "form-field__label" %>
+          <%= form.file_field :files,
+                              multiple: true,
+                              accept: AccountStatement::ACCEPTED_FILE_EXTENSIONS.join(","),
+                              class: "form-field__input" %>
+          <p class="text-xs text-secondary mt-2"><%= t("account_statements.form.files_hint", max_size: AccountStatement::MAX_FILE_SIZE / 1.megabyte) %></p>
+        </div>
+        <%= form.submit t("account_statements.form.account_upload") %>
+      <% end %>
+    </div>
+  <% end %>
+
+  <div class="rounded-xl bg-container-inset p-1">
+    <div class="flex items-center gap-1.5 px-4 py-2 text-xs font-medium text-secondary uppercase">
+      <p><%= t("account_statements.account_tab.statements_title") %></p>
+      <span class="text-subdued">&middot;</span>
+      <p><%= statements.size %></p>
+    </div>
+
+    <div class="bg-container rounded-lg shadow-border-xs overflow-x-auto">
+      <% if statements.any? %>
+        <table class="w-full">
+          <thead>
+            <tr class="text-xs uppercase font-medium text-secondary border-b border-divider">
+              <th class="px-3 py-3 text-left min-w-56"><%= t("account_statements.table.file") %></th>
+              <th class="px-3 py-3 text-left min-w-44"><%= t("account_statements.table.period") %></th>
+              <th class="px-3 py-3 text-left min-w-32"><%= t("account_statements.table.reconciliation") %></th>
+              <th class="px-3 py-3 text-right min-w-24"><%= t("account_statements.table.actions") %></th>
+            </tr>
+          </thead>
+          <tbody>
+            <% statements.each do |statement| %>
+              <tr id="<%= dom_id(statement) %>" class="border-b border-subdued hover:bg-surface-hover">
+                <td class="px-3 py-3">
+                  <%= link_to account_statement_path(statement), class: "flex items-center gap-2 min-w-0 text-sm font-medium text-primary hover:underline" do %>
+                    <%= icon(account_statement_file_icon(statement), size: "sm") %>
+                    <span class="truncate"><%= statement.filename %></span>
+                  <% end %>
+                  <p class="text-xs text-secondary"><%= number_to_human_size(statement.byte_size) %></p>
+                </td>
+                <td class="px-3 py-3 text-sm text-secondary"><%= account_statement_period(statement) %></td>
+                <td class="px-3 py-3">
+                  <% case reconciliation_statuses[statement.id] %>
+                  <% when "matched" %>
+                    <%= render "shared/badge", color: "success" do %><%= t("account_statements.reconciliation.matched") %><% end %>
+                  <% when "mismatched" %>
+                    <%= render "shared/badge", color: "error" do %><%= t("account_statements.reconciliation.mismatched") %><% end %>
+                  <% else %>
+                    <%= render "shared/badge" do %><%= t("account_statements.reconciliation.unavailable") %><% end %>
+                  <% end %>
+                </td>
+                <td class="px-3 py-3">
+                  <div class="flex items-center justify-end gap-3">
+                    <%= link_to account_statement_path(statement), aria: { label: t("account_statements.table.view") } do %>
+                      <%= icon("eye", class: "w-5 h-5 text-primary") %>
+                    <% end %>
+                    <% if statement.original_file.attached? %>
+                      <%= link_to rails_blob_path(statement.original_file, disposition: "attachment"), aria: { label: t("account_statements.table.download") } do %>
+                        <%= icon("download", class: "w-5 h-5 text-primary") %>
+                      <% end %>
+                    <% end %>
+                    <% if can_manage_statements %>
+                      <%= button_to unlink_account_statement_path(statement),
+                                    method: :patch,
+                                    class: "flex items-center",
+                                    aria: { label: t("account_statements.table.unlink") } do %>
+                        <%= icon("unlink", class: "w-5 h-5 text-secondary") %>
+                      <% end %>
+                    <% end %>
+                  </div>
+                </td>
+              </tr>
+            <% end %>
+          </tbody>
+        </table>
+      <% else %>
+        <p class="text-sm text-secondary text-center py-8 font-medium"><%= t("account_statements.account_tab.empty") %></p>
+      <% end %>
+    </div>
+  </div>
+</div>
diff --git a/app/views/accounts/show/_statements_frame.html.erb b/app/views/accounts/show/_statements_frame.html.erb
new file mode 100644
index 000000000..acccc4190
--- /dev/null
+++ b/app/views/accounts/show/_statements_frame.html.erb
@@ -0,0 +1,10 @@
+<%# locals: (account:, coverage:, statements:, reconciliation_statuses:, can_manage_statements:) %>
+
+<%= turbo_frame_tag dom_id(account, :statements_tab) do %>
+  <%= render "accounts/show/statements",
+             account: account,
+             coverage: coverage,
+             statements: statements,
+             reconciliation_statuses: reconciliation_statuses,
+             can_manage_statements: can_manage_statements %>
+<% end %>
diff --git a/app/views/admin/sso_providers/_form.html.erb b/app/views/admin/sso_providers/_form.html.erb
index 5ccdc3b87..9845bab1a 100644
--- a/app/views/admin/sso_providers/_form.html.erb
+++ b/app/views/admin/sso_providers/_form.html.erb
@@ -6,7 +6,7 @@
       <%= icon "alert-circle", class: "w-5 h-5 text-destructive mr-2 shrink-0" %>
       <div>
         <p class="text-sm font-medium text-destructive">
-          <%= pluralize(sso_provider.errors.count, "error") %> prohibited this provider from being saved:
+          <%= t("admin.sso_providers.form.errors_title", count: sso_provider.errors.count) %>
         </p>
         <ul class="mt-2 text-sm text-destructive list-disc list-inside">
           <% sso_provider.errors.full_messages.each do |message| %>
@@ -20,38 +20,38 @@
 
 <%= styled_form_with model: [:admin, sso_provider], class: "space-y-6", data: { controller: "admin-sso-form" } do |form| %>
   <div class="space-y-4">
-    <h3 class="font-medium text-primary">Basic Information</h3>
+    <h3 class="font-medium text-primary"><%= t("admin.sso_providers.form.basic_information") %></h3>
 
     <div class="grid grid-cols-1 gap-4 sm:grid-cols-2">
       <%= form.select :strategy,
           options_for_select([
-            ["OpenID Connect", "openid_connect"],
-            ["SAML 2.0", "saml"],
-            ["Google OAuth2", "google_oauth2"],
-            ["GitHub", "github"]
+            [t("admin.sso_providers.form.strategy_openid_connect"), "openid_connect"],
+            [t("admin.sso_providers.form.strategy_saml"), "saml"],
+            [t("admin.sso_providers.form.strategy_google_oauth2"), "google_oauth2"],
+            [t("admin.sso_providers.form.strategy_github"), "github"]
           ], sso_provider.strategy),
-          { label: "Strategy" },
+          { label: t("admin.sso_providers.form.strategy_label") },
           { data: { action: "change->admin-sso-form#toggleFields" } } %>
 
       <%= form.text_field :name,
-          label: "Name",
-          placeholder: "e.g., keycloak, authentik",
+          label: t("admin.sso_providers.form.name_label"),
+          placeholder: t("admin.sso_providers.form.name_placeholder"),
           required: true,
           data: { action: "input->admin-sso-form#updateCallbackUrl" } %>
     </div>
-    <p class="text-xs text-secondary -mt-2">Unique identifier (lowercase, numbers, underscores only)</p>
+    <p class="text-xs text-secondary -mt-2"><%= t("admin.sso_providers.form.name_help") %></p>
 
     <div class="grid grid-cols-1 gap-4 sm:grid-cols-2">
       <%= form.text_field :label,
-          label: "Button Label",
-          placeholder: "e.g., Sign in with Keycloak",
+          label: t("admin.sso_providers.form.label_label"),
+          placeholder: t("admin.sso_providers.form.label_placeholder"),
           required: true %>
 
       <div>
         <%= form.text_field :icon,
-            label: "Icon (optional)",
-            placeholder: "e.g., key, shield" %>
-        <p class="text-xs text-secondary mt-1">Lucide icon name for the login button</p>
+            label: t("admin.sso_providers.form.icon_label"),
+            placeholder: t("admin.sso_providers.form.icon_placeholder") %>
+        <p class="text-xs text-secondary mt-1"><%= t("admin.sso_providers.form.icon_help") %></p>
       </div>
     </div>
 
@@ -65,42 +65,42 @@
   </div>
 
   <div class="border-t border-primary pt-4 space-y-4">
-    <h3 class="font-medium text-primary">OAuth/OIDC Configuration</h3>
+    <h3 class="font-medium text-primary"><%= t("admin.sso_providers.form.oauth_configuration") %></h3>
 
     <div data-oidc-field class="<%= "hidden" unless sso_provider.strategy == "openid_connect" %>">
       <%= form.text_field :issuer,
-          label: "Issuer URL",
-          placeholder: "https://your-idp.example.com/realms/your-realm",
+          label: t("admin.sso_providers.form.issuer_label"),
+          placeholder: t("admin.sso_providers.form.issuer_placeholder"),
           data: { action: "blur->admin-sso-form#validateIssuer" } %>
-      <p class="text-xs text-secondary mt-1">OIDC issuer URL (validates .well-known/openid-configuration)</p>
+      <p class="text-xs text-secondary mt-1"><%= t("admin.sso_providers.form.issuer_help") %></p>
     </div>
 
     <%= form.text_field :client_id,
-        label: "Client ID",
-        placeholder: "your-client-id",
+        label: t("admin.sso_providers.form.client_id_label"),
+        placeholder: t("admin.sso_providers.form.client_id_placeholder"),
         required: true %>
 
     <%= form.password_field :client_secret,
-        label: "Client Secret",
-        placeholder: sso_provider.persisted? ? "••••••••" : "your-client-secret",
+        label: t("admin.sso_providers.form.client_secret_label"),
+        placeholder: sso_provider.persisted? ? t("admin.sso_providers.form.client_secret_placeholder_existing") : t("admin.sso_providers.form.client_secret_placeholder_new"),
         required: !sso_provider.persisted? %>
     <% if sso_provider.persisted? %>
-      <p class="text-xs text-secondary -mt-2">Leave blank to keep existing secret</p>
+      <p class="text-xs text-secondary -mt-2"><%= t("admin.sso_providers.form.client_secret_help_existing") %></p>
     <% end %>
 
     <div data-oidc-field class="<%= "hidden" unless sso_provider.strategy == "openid_connect" %>">
-      <label class="block text-sm font-medium text-primary mb-1">Callback URL</label>
+      <label class="block text-sm font-medium text-primary mb-1"><%= t("admin.sso_providers.form.redirect_uri_label") %></label>
       <div class="flex items-center gap-2">
         <code class="flex-1 bg-surface px-3 py-2 rounded text-sm text-secondary overflow-x-auto"
               data-admin-sso-form-target="callbackUrl"><%= "#{request.base_url}/auth/#{sso_provider.name.presence || 'PROVIDER_NAME'}/callback" %></code>
         <button type="button"
                 data-action="click->admin-sso-form#copyCallback"
                 class="p-2 text-secondary hover:text-primary shrink-0"
-                title="Copy to clipboard">
+                title="<%= t("admin.sso_providers.form.copy_button") %>">
           <%= icon "copy", class: "w-4 h-4" %>
         </button>
       </div>
-      <p class="text-xs text-secondary mt-1">Configure this URL in your identity provider</p>
+      <p class="text-xs text-secondary mt-1"><%= t("admin.sso_providers.form.redirect_uri_help") %></p>
     </div>
   </div>
 
@@ -119,7 +119,7 @@
 
     <details class="mt-4">
       <summary class="cursor-pointer text-sm font-medium text-secondary hover:text-primary"><%= t("admin.sso_providers.form.manual_saml_config") %></summary>
-      <div class="mt-3 space-y-3 pl-4 border-l-2 border-secondary/30">
+      <div class="mt-3 space-y-3 pl-4 border-l-2 border-tertiary">
         <p class="text-xs text-secondary"><%= t("admin.sso_providers.form.manual_saml_help") %></p>
 
         <div>
@@ -172,18 +172,18 @@
     </details>
 
     <div>
-      <label class="block text-sm font-medium text-primary mb-1">SP Callback URL (ACS URL)</label>
+      <label class="block text-sm font-medium text-primary mb-1"><%= t("admin.sso_providers.form.saml_sp_callback_url_label") %></label>
       <div class="flex items-center gap-2">
         <code class="flex-1 bg-surface px-3 py-2 rounded text-sm text-secondary overflow-x-auto"
               data-admin-sso-form-target="samlCallbackUrl"><%= "#{request.base_url}/auth/#{sso_provider.name.presence || 'PROVIDER_NAME'}/callback" %></code>
         <button type="button"
                 data-action="click->admin-sso-form#copySamlCallback"
                 class="p-2 text-secondary hover:text-primary shrink-0"
-                title="Copy to clipboard">
+                title="<%= t("admin.sso_providers.form.copy_button") %>">
           <%= icon "copy", class: "w-4 h-4" %>
         </button>
       </div>
-      <p class="text-xs text-secondary mt-1">Configure this URL as the Assertion Consumer Service URL in your IdP</p>
+      <p class="text-xs text-secondary mt-1"><%= t("admin.sso_providers.form.saml_sp_callback_url_help") %></p>
     </div>
   </div>
 
@@ -202,7 +202,7 @@
 
     <details class="mt-4">
       <summary class="cursor-pointer text-sm font-medium text-secondary hover:text-primary"><%= t("admin.sso_providers.form.role_mapping_title") %></summary>
-      <div class="mt-3 space-y-3 pl-4 border-l-2 border-secondary/30">
+      <div class="mt-3 space-y-3 pl-4 border-l-2 border-tertiary">
         <p class="text-xs text-secondary"><%= t("admin.sso_providers.form.role_mapping_help") %></p>
 
         <div>
@@ -282,9 +282,9 @@
     </div>
 
     <div class="flex gap-3">
-      <%= link_to "Cancel", admin_sso_providers_path, class: "px-4 py-2 text-sm font-medium text-secondary hover:text-primary" %>
-      <%= form.submit sso_provider.persisted? ? "Update Provider" : "Create Provider",
-          class: "px-4 py-2 bg-primary text-inverse rounded-lg text-sm font-medium hover:bg-primary/90" %>
+      <%= link_to t("admin.sso_providers.form.cancel"), admin_sso_providers_path, class: "px-4 py-2 text-sm font-medium text-secondary hover:text-primary" %>
+      <%= form.submit sso_provider.persisted? ? t("admin.sso_providers.form.update_provider") : t("admin.sso_providers.form.create_provider"),
+          class: "px-4 py-2 button-bg-primary text-inverse rounded-lg text-sm font-medium hover:button-bg-primary-hover" %>
     </div>
   </div>
 <% end %>
diff --git a/app/views/admin/sso_providers/index.html.erb b/app/views/admin/sso_providers/index.html.erb
index 8709fbdb1..c799d374d 100644
--- a/app/views/admin/sso_providers/index.html.erb
+++ b/app/views/admin/sso_providers/index.html.erb
@@ -1,16 +1,16 @@
-<%= content_for :page_title, "SSO Providers" %>
+<%= content_for :page_title, t(".page_title") %>
 
 <div class="space-y-4">
   <p class="text-secondary mb-4">
-    Manage single sign-on authentication providers for your instance.
+    <%= t(".description") %>
     <% unless FeatureFlags.db_sso_providers? %>
-      <span class="text-warning">Changes require a server restart to take effect.</span>
+      <span class="text-warning"><%= t(".restart_required") %></span>
     <% end %>
   </p>
 
-  <%= settings_section title: "Configured Providers" do %>
+  <%= settings_section title: t(".configured_providers") do %>
     <% if @sso_providers.any? %>
-      <div class="divide-y divide-primary">
+      <div class="divide-y divide-alpha-black-200 theme-dark:divide-alpha-white-200">
         <% @sso_providers.each do |provider| %>
           <div class="flex items-center justify-between py-3 first:pt-0 last:pb-0">
             <div class="flex items-center gap-3">
@@ -27,20 +27,20 @@
             <div class="flex items-center gap-2">
               <% if provider.enabled? %>
                 <span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-green-100 text-green-800">
-                  Enabled
+                  <%= t(".enabled") %>
                 </span>
               <% else %>
                 <span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-surface text-secondary">
-                  Disabled
+                  <%= t(".disabled") %>
                 </span>
               <% end %>
-              <%= link_to edit_admin_sso_provider_path(provider), class: "p-1 text-secondary hover:text-primary", title: "Edit" do %>
+              <%= link_to edit_admin_sso_provider_path(provider), class: "p-1 text-secondary hover:text-primary", title: t(".edit") do %>
                 <%= icon "pencil", class: "w-4 h-4" %>
               <% end %>
-              <%= button_to toggle_admin_sso_provider_path(provider), method: :patch, class: "p-1 text-secondary hover:text-primary", title: provider.enabled? ? "Disable" : "Enable", form: { data: { turbo_confirm: "Are you sure you want to #{provider.enabled? ? 'disable' : 'enable'} this provider?" } } do %>
+              <%= button_to toggle_admin_sso_provider_path(provider), method: :patch, class: "p-1 text-secondary hover:text-primary", title: provider.enabled? ? t(".disable") : t(".enable"), form: { data: { turbo_confirm: provider.enabled? ? t("admin.sso_providers.toggle.confirm_disable") : t("admin.sso_providers.toggle.confirm_enable") } } do %>
                 <%= icon provider.enabled? ? "toggle-right" : "toggle-left", class: "w-4 h-4" %>
               <% end %>
-              <%= button_to admin_sso_provider_path(provider), method: :delete, class: "p-1 text-destructive hover:text-destructive", title: "Delete", form: { data: { turbo_confirm: "Are you sure you want to delete this provider? This action cannot be undone." } } do %>
+              <%= button_to admin_sso_provider_path(provider), method: :delete, class: "p-1 text-destructive hover:text-destructive", title: t(".delete"), form: { data: { turbo_confirm: t("admin.sso_providers.destroy.confirm") } } do %>
                 <%= icon "trash-2", class: "w-4 h-4" %>
               <% end %>
             </div>
@@ -50,14 +50,14 @@
     <% else %>
       <div class="text-center py-6">
         <%= icon "key", class: "w-12 h-12 mx-auto text-secondary mb-3" %>
-        <p class="text-secondary">No SSO providers configured yet.</p>
+        <p class="text-secondary"><%= t(".no_providers_message") %></p>
       </div>
     <% end %>
 
     <div class="pt-4 border-t border-primary">
       <%= link_to new_admin_sso_provider_path, class: "inline-flex items-center gap-2 text-sm font-medium text-primary hover:text-secondary" do %>
         <%= icon "plus", class: "w-4 h-4" %>
-        Add Provider
+        <%= t(".add_provider") %>
       <% end %>
     </div>
   <% end %>
@@ -73,7 +73,7 @@
         </div>
       </div>
 
-      <div class="divide-y divide-primary">
+      <div class="divide-y divide-alpha-black-200 theme-dark:divide-alpha-white-200">
         <% @legacy_providers.each do |provider| %>
           <div class="flex items-center justify-between py-3 first:pt-0 last:pb-0">
             <div class="flex items-center gap-3">
@@ -100,26 +100,25 @@
     <% end %>
   <% end %>
 
-  <%= settings_section title: "Configuration Mode", collapsible: true, open: false do %>
+  <%= settings_section title: t(".configuration_mode"), collapsible: true, open: false do %>
     <div class="space-y-3">
       <div class="flex items-center justify-between">
         <div>
-          <p class="font-medium text-primary">Database-backed providers</p>
-          <p class="text-sm text-secondary">Load providers from database instead of YAML config</p>
+          <p class="font-medium text-primary"><%= t(".db_backed_providers") %></p>
+          <p class="text-sm text-secondary"><%= t(".db_backed_providers_description") %></p>
         </div>
         <% if FeatureFlags.db_sso_providers? %>
           <span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-green-100 text-green-800">
-            Enabled
+            <%= t(".enabled") %>
           </span>
         <% else %>
           <span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-surface text-secondary">
-            Disabled
+            <%= t(".disabled") %>
           </span>
         <% end %>
       </div>
       <p class="text-sm text-secondary">
-        Set <code class="bg-surface px-1 py-0.5 rounded text-xs">AUTH_PROVIDERS_SOURCE=db</code> to enable database-backed providers.
-        This allows changes without server restarts.
+        <%= t(".db_backed_providers_help_html") %>
       </p>
     </div>
   <% end %>
diff --git a/app/views/admin/users/index.html.erb b/app/views/admin/users/index.html.erb
index 6d10e0570..c31a1fb61 100644
--- a/app/views/admin/users/index.html.erb
+++ b/app/views/admin/users/index.html.erb
@@ -1,12 +1,12 @@
 <%= content_for :page_title, t(".title") %>
 
-<div class="bg-container rounded-xl shadow-border-xs p-4">
-  <div class="mb-6">
+<div class="bg-container rounded-xl shadow-border-xs p-4 space-y-6">
+  <div>
     <p class="text-sm text-secondary"><%= t(".description") %></p>
   </div>
 
   <!-- Filters -->
-  <div class="mb-6">
+  <div>
     <%= form_with url: admin_users_path, method: :get, class: "flex gap-4 items-end flex-wrap" do |f| %>
       <div class="w-full md:w-auto">
         <%= f.label :role, t(".filters.role"), class: "block text-sm font-medium text-primary mb-1" %>
@@ -33,7 +33,7 @@
   </div>
 
   <!-- Summary: trials expiring in next 7 days -->
-  <div class="grid grid-cols-1 md:grid-cols-4 gap-4 mb-6">
+  <div class="grid grid-cols-1 md:grid-cols-4 gap-4">
     <div class="bg-container-inset rounded-lg p-4">
       <div class="flex items-center gap-2 mb-2">
         <%= icon "calendar-clock", class: "w-5 h-5 text-secondary" %>
@@ -95,7 +95,7 @@
                     <th class="px-4 py-2 text-right text-xs font-medium text-secondary uppercase"><%= t(".table.role") %></th>
                   </tr>
                 </thead>
-                <tbody class="divide-y divide-primary">
+                <tbody class="divide-y divide-alpha-black-200 theme-dark:divide-alpha-white-200">
                   <% users.each do |user| %>
                     <tr>
                       <td class="px-4 py-3">
@@ -137,7 +137,7 @@
                   <% end %>
                 </tbody>
                 <% if pending_invitations.any? %>
-                  <tbody class="divide-y divide-primary border-t border-dashed border-primary">
+                  <tbody class="divide-y divide-alpha-black-200 theme-dark:divide-alpha-white-200 border-t border-dashed border-primary">
                     <% pending_invitations.each do |invitation| %>
                       <tr class="bg-red-50/30 dark:bg-red-950/20">
                         <td class="px-4 py-3">
diff --git a/app/views/api/v1/accounts/_account.json.jbuilder b/app/views/api/v1/accounts/_account.json.jbuilder
new file mode 100644
index 000000000..b38c3b1a6
--- /dev/null
+++ b/app/views/api/v1/accounts/_account.json.jbuilder
@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+balance_money = account.balance_money
+cash_balance_money = account.cash_balance_money
+
+json.id account.id
+json.name account.name
+json.balance balance_money.format
+json.balance_cents((balance_money.amount * balance_money.currency.minor_unit_conversion).round(0).to_i)
+json.cash_balance cash_balance_money.format
+json.cash_balance_cents((cash_balance_money.amount * cash_balance_money.currency.minor_unit_conversion).round(0).to_i)
+json.currency account.currency
+json.classification account.classification
+json.account_type account.accountable_type&.underscore
+json.subtype account.subtype
+json.status account.status
+json.institution_name account.institution_name
+json.institution_domain account.institution_domain
+json.created_at account.created_at.iso8601
+json.updated_at account.updated_at.iso8601
diff --git a/app/views/api/v1/accounts/index.json.jbuilder b/app/views/api/v1/accounts/index.json.jbuilder
index e6e8bfeec..889e2e5d4 100644
--- a/app/views/api/v1/accounts/index.json.jbuilder
+++ b/app/views/api/v1/accounts/index.json.jbuilder
@@ -1,12 +1,7 @@
 # frozen_string_literal: true
 
 json.accounts @accounts do |account|
-  json.id account.id
-  json.name account.name
-  json.balance account.balance_money.format
-  json.currency account.currency
-  json.classification account.classification
-  json.account_type account.accountable_type.underscore
+  json.partial! "account", account: account
 end
 
 json.pagination do
diff --git a/app/views/api/v1/accounts/show.json.jbuilder b/app/views/api/v1/accounts/show.json.jbuilder
new file mode 100644
index 000000000..8a29ac174
--- /dev/null
+++ b/app/views/api/v1/accounts/show.json.jbuilder
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+json.partial! "account", account: @account
diff --git a/app/views/api/v1/balances/_balance.json.jbuilder b/app/views/api/v1/balances/_balance.json.jbuilder
new file mode 100644
index 000000000..05b92d98e
--- /dev/null
+++ b/app/views/api/v1/balances/_balance.json.jbuilder
@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+json.id balance.id
+json.date balance.date
+json.currency balance.currency
+json.flows_factor balance.flows_factor
+
+json.balance format_money(balance.balance_money)
+json.balance_cents money_to_minor_units(balance.balance_money)
+json.cash_balance format_money(balance.cash_balance_money)
+json.cash_balance_cents money_to_minor_units(balance.cash_balance_money)
+
+json.start_cash_balance format_money(balance.start_cash_balance_money)
+json.start_cash_balance_cents money_to_minor_units(balance.start_cash_balance_money)
+json.start_non_cash_balance format_money(balance.start_non_cash_balance_money)
+json.start_non_cash_balance_cents money_to_minor_units(balance.start_non_cash_balance_money)
+json.start_balance format_money(balance.start_balance_money)
+json.start_balance_cents money_to_minor_units(balance.start_balance_money)
+
+json.cash_inflows format_money(balance.cash_inflows_money)
+json.cash_inflows_cents money_to_minor_units(balance.cash_inflows_money)
+json.cash_outflows format_money(balance.cash_outflows_money)
+json.cash_outflows_cents money_to_minor_units(balance.cash_outflows_money)
+json.non_cash_inflows format_money(balance.non_cash_inflows_money)
+json.non_cash_inflows_cents money_to_minor_units(balance.non_cash_inflows_money)
+json.non_cash_outflows format_money(balance.non_cash_outflows_money)
+json.non_cash_outflows_cents money_to_minor_units(balance.non_cash_outflows_money)
+json.net_market_flows format_money(balance.net_market_flows_money)
+json.net_market_flows_cents money_to_minor_units(balance.net_market_flows_money)
+json.cash_adjustments format_money(balance.cash_adjustments_money)
+json.cash_adjustments_cents money_to_minor_units(balance.cash_adjustments_money)
+json.non_cash_adjustments format_money(balance.non_cash_adjustments_money)
+json.non_cash_adjustments_cents money_to_minor_units(balance.non_cash_adjustments_money)
+
+json.end_cash_balance format_money(balance.end_cash_balance_money)
+json.end_cash_balance_cents money_to_minor_units(balance.end_cash_balance_money)
+json.end_non_cash_balance format_money(balance.end_non_cash_balance_money)
+json.end_non_cash_balance_cents money_to_minor_units(balance.end_non_cash_balance_money)
+json.end_balance format_money(balance.end_balance_money)
+json.end_balance_cents money_to_minor_units(balance.end_balance_money)
+
+json.account do
+  json.id balance.account.id
+  json.name balance.account.name
+  json.account_type balance.account.accountable_type&.underscore
+end
+
+json.created_at balance.created_at.iso8601
+json.updated_at balance.updated_at.iso8601
diff --git a/app/views/api/v1/balances/index.json.jbuilder b/app/views/api/v1/balances/index.json.jbuilder
new file mode 100644
index 000000000..ddd8fe389
--- /dev/null
+++ b/app/views/api/v1/balances/index.json.jbuilder
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+json.balances @balances do |balance|
+  json.partial! "balance", balance: balance
+end
+
+json.pagination do
+  json.page @pagy.page
+  json.per_page @per_page
+  json.total_count @pagy.count
+  json.total_pages @pagy.pages
+end
diff --git a/app/views/api/v1/balances/show.json.jbuilder b/app/views/api/v1/balances/show.json.jbuilder
new file mode 100644
index 000000000..3c31c5911
--- /dev/null
+++ b/app/views/api/v1/balances/show.json.jbuilder
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+json.partial! "balance", balance: @balance
diff --git a/app/views/api/v1/budget_categories/_budget_category.json.jbuilder b/app/views/api/v1/budget_categories/_budget_category.json.jbuilder
new file mode 100644
index 000000000..a0418f78a
--- /dev/null
+++ b/app/views/api/v1/budget_categories/_budget_category.json.jbuilder
@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+money_to_minor_units = lambda do |money|
+  (money.amount * money.currency.minor_unit_conversion).round(0).to_i if money
+end
+include_derived_amounts = local_assigns.fetch(:include_derived_amounts, true)
+
+json.id budget_category.id
+json.budget_id budget_category.budget_id
+json.currency budget_category.currency
+json.subcategory budget_category.subcategory?
+json.inherits_parent_budget budget_category.inherits_parent_budget?
+
+json.budgeted_spending budget_category.budgeted_spending_money.format
+json.budgeted_spending_cents money_to_minor_units.call(budget_category.budgeted_spending_money)
+json.display_budgeted_spending Money.new(budget_category.display_budgeted_spending, budget_category.currency).format
+json.display_budgeted_spending_cents money_to_minor_units.call(Money.new(budget_category.display_budgeted_spending, budget_category.currency))
+if include_derived_amounts
+  json.actual_spending budget_category.actual_spending_money.format
+  json.actual_spending_cents money_to_minor_units.call(budget_category.actual_spending_money)
+  json.available_to_spend budget_category.available_to_spend_money.format
+  json.available_to_spend_cents money_to_minor_units.call(budget_category.available_to_spend_money)
+end
+
+json.category do
+  json.id budget_category.category.id
+  json.name budget_category.category.name
+  json.color budget_category.category.color
+  json.lucide_icon budget_category.category.lucide_icon
+  json.parent_id budget_category.category.parent_id
+end
+
+json.created_at budget_category.created_at.iso8601
+json.updated_at budget_category.updated_at.iso8601
diff --git a/app/views/api/v1/budget_categories/index.json.jbuilder b/app/views/api/v1/budget_categories/index.json.jbuilder
new file mode 100644
index 000000000..14ef80310
--- /dev/null
+++ b/app/views/api/v1/budget_categories/index.json.jbuilder
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+json.budget_categories @budget_categories do |budget_category|
+  json.partial! "budget_category", budget_category: budget_category, include_derived_amounts: false
+end
+
+json.pagination do
+  json.page @pagy.page
+  json.per_page @per_page
+  json.total_count @pagy.count
+  json.total_pages @pagy.pages
+end
diff --git a/app/views/api/v1/budget_categories/show.json.jbuilder b/app/views/api/v1/budget_categories/show.json.jbuilder
new file mode 100644
index 000000000..84a92e5c0
--- /dev/null
+++ b/app/views/api/v1/budget_categories/show.json.jbuilder
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+json.partial! "budget_category", budget_category: @budget_category
diff --git a/app/views/api/v1/budgets/_budget.json.jbuilder b/app/views/api/v1/budgets/_budget.json.jbuilder
new file mode 100644
index 000000000..173df442b
--- /dev/null
+++ b/app/views/api/v1/budgets/_budget.json.jbuilder
@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+money_to_minor_units = lambda do |money|
+  (money.amount * money.currency.minor_unit_conversion).round(0).to_i if money
+end
+
+include_derived_amounts = local_assigns.fetch(:include_derived_amounts, true)
+
+json.id budget.id
+json.start_date budget.start_date
+json.end_date budget.end_date
+json.name budget.name
+json.currency budget.currency
+json.initialized budget.initialized?
+json.current budget.current?
+
+json.budgeted_spending budget.budgeted_spending_money&.format
+json.budgeted_spending_cents money_to_minor_units.call(budget.budgeted_spending_money)
+json.expected_income budget.expected_income_money&.format
+json.expected_income_cents money_to_minor_units.call(budget.expected_income_money)
+json.allocated_spending budget.allocated_spending_money.format
+json.allocated_spending_cents money_to_minor_units.call(budget.allocated_spending_money)
+
+if include_derived_amounts
+  json.actual_spending budget.actual_spending_money.format
+  json.actual_spending_cents money_to_minor_units.call(budget.actual_spending_money)
+  json.actual_income budget.actual_income_money.format
+  json.actual_income_cents money_to_minor_units.call(budget.actual_income_money)
+  json.available_to_spend budget.available_to_spend_money.format
+  json.available_to_spend_cents money_to_minor_units.call(budget.available_to_spend_money)
+  json.available_to_allocate budget.available_to_allocate_money.format
+  json.available_to_allocate_cents money_to_minor_units.call(budget.available_to_allocate_money)
+end
+
+json.created_at budget.created_at.iso8601
+json.updated_at budget.updated_at.iso8601
diff --git a/app/views/api/v1/budgets/index.json.jbuilder b/app/views/api/v1/budgets/index.json.jbuilder
new file mode 100644
index 000000000..ebf1b3018
--- /dev/null
+++ b/app/views/api/v1/budgets/index.json.jbuilder
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+json.budgets @budgets do |budget|
+  json.partial! "budget", budget: budget, include_derived_amounts: false
+end
+
+json.pagination do
+  json.page @pagy.page
+  json.per_page @per_page
+  json.total_count @pagy.count
+  json.total_pages @pagy.pages
+end
diff --git a/app/views/api/v1/budgets/show.json.jbuilder b/app/views/api/v1/budgets/show.json.jbuilder
new file mode 100644
index 000000000..3e88d7669
--- /dev/null
+++ b/app/views/api/v1/budgets/show.json.jbuilder
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+json.partial! "budget", budget: @budget
diff --git a/app/views/api/v1/chats/_chat.json.jbuilder b/app/views/api/v1/chats/_chat.json.jbuilder
index a1b520ebf..259e2c5f4 100644
--- a/app/views/api/v1/chats/_chat.json.jbuilder
+++ b/app/views/api/v1/chats/_chat.json.jbuilder
@@ -2,6 +2,6 @@
 
 json.id chat.id
 json.title chat.title
-json.error chat.error.present? ? chat.error : nil
+json.error chat.presentable_error_message
 json.created_at chat.created_at.iso8601
 json.updated_at chat.updated_at.iso8601
diff --git a/app/views/api/v1/chats/index.json.jbuilder b/app/views/api/v1/chats/index.json.jbuilder
index c251b4161..9f65a069a 100644
--- a/app/views/api/v1/chats/index.json.jbuilder
+++ b/app/views/api/v1/chats/index.json.jbuilder
@@ -5,7 +5,7 @@ json.chats @chats do |chat|
   json.title chat.title
   json.last_message_at chat.messages.ordered.first&.created_at&.iso8601
   json.message_count chat.messages.count
-  json.error chat.error.present? ? chat.error : nil
+  json.error chat.presentable_error_message
   json.created_at chat.created_at.iso8601
   json.updated_at chat.updated_at.iso8601
 end
diff --git a/app/views/api/v1/family_exports/_family_export.json.jbuilder b/app/views/api/v1/family_exports/_family_export.json.jbuilder
new file mode 100644
index 000000000..f8f0d304a
--- /dev/null
+++ b/app/views/api/v1/family_exports/_family_export.json.jbuilder
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+json.id family_export.id
+json.status family_export.status
+json.filename family_export.filename
+json.downloadable family_export.downloadable?
+json.download_path family_export.downloadable? ? download_api_v1_family_export_path(family_export) : nil
+attached = family_export.export_file.attached?
+json.file do
+  json.attached attached
+  json.byte_size attached ? family_export.export_file.byte_size : nil
+  json.content_type attached ? family_export.export_file.content_type : nil
+end
+json.created_at family_export.created_at
+json.updated_at family_export.updated_at
diff --git a/app/views/api/v1/family_exports/index.json.jbuilder b/app/views/api/v1/family_exports/index.json.jbuilder
new file mode 100644
index 000000000..d3d3b9d22
--- /dev/null
+++ b/app/views/api/v1/family_exports/index.json.jbuilder
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+json.data do
+  json.array! @family_exports, partial: "api/v1/family_exports/family_export", as: :family_export
+end
+
+json.meta do
+  json.page @pagy.page
+  json.per_page @per_page
+  json.total_count @pagy.count
+  json.total_pages @pagy.pages
+end
diff --git a/app/views/api/v1/family_exports/show.json.jbuilder b/app/views/api/v1/family_exports/show.json.jbuilder
new file mode 100644
index 000000000..b9c2ecd12
--- /dev/null
+++ b/app/views/api/v1/family_exports/show.json.jbuilder
@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+json.data do
+  json.partial! "api/v1/family_exports/family_export", family_export: @family_export
+end
diff --git a/app/views/api/v1/family_settings/show.json.jbuilder b/app/views/api/v1/family_settings/show.json.jbuilder
new file mode 100644
index 000000000..025e82dfe
--- /dev/null
+++ b/app/views/api/v1/family_settings/show.json.jbuilder
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+json.id @family.id
+json.name @family.name
+json.currency @family.currency
+json.locale @family.locale
+json.date_format @family.date_format
+json.country @family.country
+json.timezone @family.timezone
+json.month_start_day @family.month_start_day
+json.moniker @family.moniker
+json.default_account_sharing @family.default_account_sharing
+json.custom_enabled_currencies @family.custom_enabled_currencies?
+json.enabled_currencies @family.enabled_currency_codes
+json.created_at @family.created_at.iso8601
+json.updated_at @family.updated_at.iso8601
diff --git a/app/views/api/v1/imports/_status_detail.json.jbuilder b/app/views/api/v1/imports/_status_detail.json.jbuilder
new file mode 100644
index 000000000..7535dcada
--- /dev/null
+++ b/app/views/api/v1/imports/_status_detail.json.jbuilder
@@ -0,0 +1,22 @@
+uploaded = local_assigns[:uploaded]
+uploaded = import.uploaded? if uploaded.nil?
+configured = local_assigns[:configured]
+configured = import.configured_for_status_detail? if configured.nil?
+
+json.uploaded uploaded
+json.configured configured
+json.terminal import.complete? || import.failed? || import.revert_failed?
+
+if include_validation_stats
+  valid_rows_count = local_assigns.fetch(:valid_rows_count)
+  invalid_rows_count = local_assigns.fetch(:invalid_rows_count)
+
+  cleaned = local_assigns[:cleaned]
+  publishable = local_assigns[:publishable]
+  cleaned = import.cleaned_from_validation_stats?(invalid_rows_count: invalid_rows_count) if cleaned.nil?
+  publishable = import.publishable_from_validation_stats?(invalid_rows_count: invalid_rows_count) if publishable.nil?
+
+  json.cleaned cleaned
+  json.publishable publishable
+  json.revertable import.revertable?
+end
diff --git a/app/views/api/v1/imports/index.json.jbuilder b/app/views/api/v1/imports/index.json.jbuilder
index eff1c6414..3359d704a 100644
--- a/app/views/api/v1/imports/index.json.jbuilder
+++ b/app/views/api/v1/imports/index.json.jbuilder
@@ -8,6 +8,9 @@ json.data do
     json.account_id import.account_id
     json.rows_count import.rows_count
     json.error import.error if import.error.present?
+    json.status_detail do
+      json.partial! "status_detail", import: import, include_validation_stats: false
+    end
   end
 end
 
diff --git a/app/views/api/v1/imports/rows.json.jbuilder b/app/views/api/v1/imports/rows.json.jbuilder
new file mode 100644
index 000000000..75d1ad5ac
--- /dev/null
+++ b/app/views/api/v1/imports/rows.json.jbuilder
@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+mapping_summary = lambda do |type, key|
+  mapping = @row_mapping_lookup[[ type, key.to_s ]]
+
+  if mapping
+    mappable = if mapping.mappable
+      {
+        id: mapping.mappable.id,
+        type: mapping.mappable_type,
+        name: mapping.mappable.try(:name)
+      }
+    end
+
+    {
+      key: mapping.key,
+      type: mapping.type,
+      value: mapping.value,
+      create_when_empty: mapping.create_when_empty,
+      creatable: mapping.creatable?,
+      mappable: mappable
+    }
+  else
+    {
+      key: key,
+      type: type,
+      value: nil,
+      create_when_empty: false,
+      creatable: false,
+      mappable: nil
+    }
+  end
+end
+
+json.data do
+  json.array! @rows do |row|
+    json.id row.id
+    json.row_number row.source_row_number
+    json.valid row.errors.empty?
+    json.errors row.errors.full_messages
+
+    json.fields do
+      json.account row.account
+      json.date row.date
+      json.qty row.qty
+      json.ticker row.ticker
+      json.exchange_operating_mic row.exchange_operating_mic
+      json.price row.price
+      json.amount row.amount
+      json.currency row.currency
+      json.name row.name
+      json.category row.category
+      json.tags row.tags
+      json.entity_type row.entity_type
+      json.notes row.notes
+      json.active row.active
+      json.effective_date row.effective_date
+      json.conditions row.conditions
+      json.actions row.actions
+    end
+
+    json.mappings do
+      json.account mapping_summary.call("Import::AccountMapping", row.account) if row.account.present?
+      json.category mapping_summary.call("Import::CategoryMapping", row.category) if row.category.present?
+      json.account_type mapping_summary.call("Import::AccountTypeMapping", row.entity_type) if row.entity_type.present?
+      json.tags row.tags_list.reject(&:blank?).map { |tag| mapping_summary.call("Import::TagMapping", tag) }
+    end
+  end
+end
+
+json.meta do
+  json.current_page @pagy.page
+  json.next_page @pagy.next
+  json.prev_page @pagy.prev
+  json.total_pages @pagy.pages
+  json.total_count @pagy.count
+  json.per_page @per_page
+end
diff --git a/app/views/api/v1/imports/show.json.jbuilder b/app/views/api/v1/imports/show.json.jbuilder
index 18509062e..fd8526428 100644
--- a/app/views/api/v1/imports/show.json.jbuilder
+++ b/app/views/api/v1/imports/show.json.jbuilder
@@ -1,3 +1,10 @@
+rows = @import.rows.to_a
+valid_rows_count = rows.count(&:valid?)
+invalid_rows_count = rows.length - valid_rows_count
+cleaned = @import.cleaned_from_validation_stats?(invalid_rows_count: invalid_rows_count)
+publishable = @import.publishable_from_validation_stats?(invalid_rows_count: invalid_rows_count)
+mapping_counts = @import.mapping_status_counts
+
 json.data do
   json.id @import.id
   json.type @import.type
@@ -6,6 +13,15 @@ json.data do
   json.updated_at @import.updated_at
   json.account_id @import.account_id
   json.error @import.error if @import.error.present?
+  json.status_detail do
+    json.partial! "status_detail",
+                  import: @import,
+                  include_validation_stats: true,
+                  valid_rows_count: valid_rows_count,
+                  invalid_rows_count: invalid_rows_count,
+                  cleaned: cleaned,
+                  publishable: publishable
+  end
 
   json.configuration do
     json.date_col_label @import.date_col_label
@@ -22,9 +38,14 @@ json.data do
 
   json.stats do
     json.rows_count @import.rows_count
-    json.valid_rows_count @import.rows.select(&:valid?).count if @import.rows.loaded?
+    json.valid_rows_count valid_rows_count
+    json.invalid_rows_count invalid_rows_count
+    json.mappings_count mapping_counts[:mappings_count]
+    json.unassigned_mappings_count mapping_counts[:unassigned_mappings_count]
   end
 
+  json.verification @import.verification_payload if @import.is_a?(SureImport)
+
   # Only show a subset of rows for preview if needed, or link to a separate rows endpoint
   # json.sample_rows @import.rows.limit(5)
 end
diff --git a/app/views/api/v1/provider_connections/_provider_connection.json.jbuilder b/app/views/api/v1/provider_connections/_provider_connection.json.jbuilder
new file mode 100644
index 000000000..dc233c6f6
--- /dev/null
+++ b/app/views/api/v1/provider_connections/_provider_connection.json.jbuilder
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+json.extract! provider_connection,
+              :id,
+              :provider,
+              :provider_type,
+              :name,
+              :status,
+              :requires_update,
+              :credentials_configured,
+              :scheduled_for_deletion,
+              :pending_account_setup,
+              :institution,
+              :accounts,
+              :sync,
+              :created_at,
+              :updated_at
diff --git a/app/views/api/v1/provider_connections/index.json.jbuilder b/app/views/api/v1/provider_connections/index.json.jbuilder
new file mode 100644
index 000000000..2fe69b2f9
--- /dev/null
+++ b/app/views/api/v1/provider_connections/index.json.jbuilder
@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+json.data do
+  json.array! @provider_connections, partial: "api/v1/provider_connections/provider_connection", as: :provider_connection
+end
diff --git a/app/views/api/v1/recurring_transactions/_recurring_transaction.json.jbuilder b/app/views/api/v1/recurring_transactions/_recurring_transaction.json.jbuilder
new file mode 100644
index 000000000..c103ed53b
--- /dev/null
+++ b/app/views/api/v1/recurring_transactions/_recurring_transaction.json.jbuilder
@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+json.id recurring_transaction.id
+json.amount recurring_transaction.amount_money.format
+money_to_minor_units = lambda do |money|
+  (money.amount * money.currency.minor_unit_conversion).round(0).to_i if money
+end
+json.amount_cents money_to_minor_units.call(recurring_transaction.amount_money)
+json.currency recurring_transaction.currency
+json.expected_day_of_month recurring_transaction.expected_day_of_month
+json.last_occurrence_date recurring_transaction.last_occurrence_date
+json.next_expected_date recurring_transaction.next_expected_date
+json.status recurring_transaction.status
+json.occurrence_count recurring_transaction.occurrence_count
+json.name recurring_transaction.name
+json.manual recurring_transaction.manual
+json.expected_amount_min recurring_transaction.expected_amount_min_money&.format
+json.expected_amount_min_cents money_to_minor_units.call(recurring_transaction.expected_amount_min_money)
+json.expected_amount_max recurring_transaction.expected_amount_max_money&.format
+json.expected_amount_max_cents money_to_minor_units.call(recurring_transaction.expected_amount_max_money)
+json.expected_amount_avg recurring_transaction.expected_amount_avg_money&.format
+json.expected_amount_avg_cents money_to_minor_units.call(recurring_transaction.expected_amount_avg_money)
+json.created_at recurring_transaction.created_at.iso8601
+json.updated_at recurring_transaction.updated_at.iso8601
+
+if recurring_transaction.account.present?
+  json.account do
+    json.id recurring_transaction.account.id
+    json.name recurring_transaction.account.name
+    json.account_type recurring_transaction.account.accountable_type&.underscore
+  end
+else
+  json.account nil
+end
+
+if recurring_transaction.merchant.present?
+  json.merchant do
+    json.id recurring_transaction.merchant.id
+    json.name recurring_transaction.merchant.name
+  end
+else
+  json.merchant nil
+end
diff --git a/app/views/api/v1/recurring_transactions/index.json.jbuilder b/app/views/api/v1/recurring_transactions/index.json.jbuilder
new file mode 100644
index 000000000..98a9c795d
--- /dev/null
+++ b/app/views/api/v1/recurring_transactions/index.json.jbuilder
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+json.recurring_transactions @recurring_transactions do |recurring_transaction|
+  json.partial! "recurring_transaction", recurring_transaction: recurring_transaction
+end
+
+json.pagination do
+  json.page @pagy.page
+  json.per_page @per_page
+  json.total_count @pagy.count
+  json.total_pages @pagy.pages
+end
diff --git a/app/views/api/v1/recurring_transactions/show.json.jbuilder b/app/views/api/v1/recurring_transactions/show.json.jbuilder
new file mode 100644
index 000000000..f96ab77de
--- /dev/null
+++ b/app/views/api/v1/recurring_transactions/show.json.jbuilder
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+json.partial! "recurring_transaction", recurring_transaction: @recurring_transaction
diff --git a/app/views/api/v1/rejected_transfers/_rejected_transfer.json.jbuilder b/app/views/api/v1/rejected_transfers/_rejected_transfer.json.jbuilder
new file mode 100644
index 000000000..d8efa4425
--- /dev/null
+++ b/app/views/api/v1/rejected_transfers/_rejected_transfer.json.jbuilder
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+json.id rejected_transfer.id
+
+json.inflow_transaction do
+  json.partial! "api/v1/transfers/transaction_side", transaction: rejected_transfer.inflow_transaction
+end
+
+json.outflow_transaction do
+  json.partial! "api/v1/transfers/transaction_side", transaction: rejected_transfer.outflow_transaction
+end
+
+json.created_at rejected_transfer.created_at.iso8601
+json.updated_at rejected_transfer.updated_at.iso8601
diff --git a/app/views/api/v1/rejected_transfers/index.json.jbuilder b/app/views/api/v1/rejected_transfers/index.json.jbuilder
new file mode 100644
index 000000000..08c070f9b
--- /dev/null
+++ b/app/views/api/v1/rejected_transfers/index.json.jbuilder
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+json.rejected_transfers @rejected_transfers do |rejected_transfer|
+  json.partial! "rejected_transfer", rejected_transfer: rejected_transfer
+end
+
+json.pagination do
+  json.page @pagy.page
+  json.per_page @per_page
+  json.total_count @pagy.count
+  json.total_pages @pagy.pages
+end
diff --git a/app/views/api/v1/rejected_transfers/show.json.jbuilder b/app/views/api/v1/rejected_transfers/show.json.jbuilder
new file mode 100644
index 000000000..60edba7cf
--- /dev/null
+++ b/app/views/api/v1/rejected_transfers/show.json.jbuilder
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+json.partial! "rejected_transfer", rejected_transfer: @rejected_transfer
diff --git a/app/views/api/v1/rule_runs/_rule_run.json.jbuilder b/app/views/api/v1/rule_runs/_rule_run.json.jbuilder
new file mode 100644
index 000000000..e61677714
--- /dev/null
+++ b/app/views/api/v1/rule_runs/_rule_run.json.jbuilder
@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+json.id rule_run.id
+json.rule_id rule_run.rule_id
+json.rule_name rule_run.rule_name
+json.execution_type rule_run.execution_type
+json.status rule_run.status
+json.transactions_queued rule_run.transactions_queued
+json.transactions_processed rule_run.transactions_processed
+json.transactions_modified rule_run.transactions_modified
+json.pending_jobs_count rule_run.pending_jobs_count
+json.executed_at rule_run.executed_at.iso8601
+json.error_message rule_run.error_message
+
+if rule_run.rule
+  json.rule do
+    json.id rule_run.rule.id
+    json.name rule_run.rule.name
+    json.resource_type rule_run.rule.resource_type
+    json.active rule_run.rule.active
+  end
+else
+  json.rule nil
+end
+
+json.created_at rule_run.created_at.iso8601
+json.updated_at rule_run.updated_at.iso8601
diff --git a/app/views/api/v1/rule_runs/index.json.jbuilder b/app/views/api/v1/rule_runs/index.json.jbuilder
new file mode 100644
index 000000000..6b1e1802e
--- /dev/null
+++ b/app/views/api/v1/rule_runs/index.json.jbuilder
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+json.data do
+  json.array! @rule_runs do |rule_run|
+    json.partial! "rule_run", rule_run: rule_run
+  end
+end
+
+json.meta do
+  json.current_page @pagy.page
+  json.next_page @pagy.next
+  json.prev_page @pagy.prev
+  json.total_pages @pagy.pages
+  json.total_count @pagy.count
+  json.per_page @per_page
+end
diff --git a/app/views/api/v1/rule_runs/show.json.jbuilder b/app/views/api/v1/rule_runs/show.json.jbuilder
new file mode 100644
index 000000000..c6f555d4d
--- /dev/null
+++ b/app/views/api/v1/rule_runs/show.json.jbuilder
@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+json.data do
+  json.partial! "rule_run", rule_run: @rule_run
+end
diff --git a/app/views/api/v1/rules/_action.json.jbuilder b/app/views/api/v1/rules/_action.json.jbuilder
new file mode 100644
index 000000000..3dfbab6a1
--- /dev/null
+++ b/app/views/api/v1/rules/_action.json.jbuilder
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+json.id action.id
+json.action_type action.action_type
+json.value action.value
+json.created_at action.created_at.iso8601
+json.updated_at action.updated_at.iso8601
diff --git a/app/views/api/v1/rules/_condition.json.jbuilder b/app/views/api/v1/rules/_condition.json.jbuilder
new file mode 100644
index 000000000..088028b71
--- /dev/null
+++ b/app/views/api/v1/rules/_condition.json.jbuilder
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+json.id condition.id
+json.condition_type condition.condition_type
+json.operator condition.operator
+json.value condition.value
+
+if condition.compound?
+  json.sub_conditions condition.sub_conditions do |sub_condition|
+    json.partial! "api/v1/rules/condition", condition: sub_condition
+  end
+else
+  json.sub_conditions []
+end
+
+json.created_at condition.created_at.iso8601
+json.updated_at condition.updated_at.iso8601
diff --git a/app/views/api/v1/rules/_rule.json.jbuilder b/app/views/api/v1/rules/_rule.json.jbuilder
new file mode 100644
index 000000000..1009a3737
--- /dev/null
+++ b/app/views/api/v1/rules/_rule.json.jbuilder
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+json.id rule.id
+json.name rule.name
+json.resource_type rule.resource_type
+json.active rule.active
+json.effective_date rule.effective_date&.iso8601
+json.conditions rule.conditions.select { |condition| condition.parent_id.nil? } do |condition|
+  json.partial! "api/v1/rules/condition", condition: condition
+end
+json.actions rule.actions do |action|
+  json.partial! "api/v1/rules/action", action: action
+end
+json.created_at rule.created_at.iso8601
+json.updated_at rule.updated_at.iso8601
diff --git a/app/views/api/v1/rules/index.json.jbuilder b/app/views/api/v1/rules/index.json.jbuilder
new file mode 100644
index 000000000..97432d8b6
--- /dev/null
+++ b/app/views/api/v1/rules/index.json.jbuilder
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+json.data @rules do |rule|
+  json.partial! "api/v1/rules/rule", rule: rule
+end
+
+json.meta do
+  json.current_page @pagy.page
+  json.next_page @pagy.next
+  json.prev_page @pagy.prev
+  json.total_pages @pagy.pages
+  json.total_count @pagy.count
+  json.per_page @per_page
+end
diff --git a/app/views/api/v1/rules/show.json.jbuilder b/app/views/api/v1/rules/show.json.jbuilder
new file mode 100644
index 000000000..0c4de976c
--- /dev/null
+++ b/app/views/api/v1/rules/show.json.jbuilder
@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+json.data do
+  json.partial! "api/v1/rules/rule", rule: @rule
+end
diff --git a/app/views/api/v1/securities/_security.json.jbuilder b/app/views/api/v1/securities/_security.json.jbuilder
new file mode 100644
index 000000000..3fcc31b31
--- /dev/null
+++ b/app/views/api/v1/securities/_security.json.jbuilder
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+json.id security.id
+json.ticker security.ticker
+json.name security.name
+json.kind security.kind
+json.country_code security.country_code
+json.exchange_mic security.exchange_mic
+json.exchange_acronym security.exchange_acronym
+json.exchange_operating_mic security.exchange_operating_mic
+json.exchange_name security.exchange_name
+json.offline security.offline
+json.offline_reason security.offline_reason
+json.website_url security.website_url
+json.logo_url security.display_logo_url
+json.first_provider_price_on security.first_provider_price_on
+json.created_at security.created_at.iso8601
+json.updated_at security.updated_at.iso8601
diff --git a/app/views/api/v1/securities/index.json.jbuilder b/app/views/api/v1/securities/index.json.jbuilder
new file mode 100644
index 000000000..f7ffdd22d
--- /dev/null
+++ b/app/views/api/v1/securities/index.json.jbuilder
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+json.securities @securities do |security|
+  json.partial! "security", security: security
+end
+
+json.pagination do
+  json.page @pagy.page
+  json.per_page @per_page
+  json.total_count @pagy.count
+  json.total_pages @pagy.pages
+end
diff --git a/app/views/api/v1/securities/show.json.jbuilder b/app/views/api/v1/securities/show.json.jbuilder
new file mode 100644
index 000000000..7ed519050
--- /dev/null
+++ b/app/views/api/v1/securities/show.json.jbuilder
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+json.partial! "security", security: @security
diff --git a/app/views/api/v1/security_prices/_security_price.json.jbuilder b/app/views/api/v1/security_prices/_security_price.json.jbuilder
new file mode 100644
index 000000000..9804493bb
--- /dev/null
+++ b/app/views/api/v1/security_prices/_security_price.json.jbuilder
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+json.id security_price.id
+json.date security_price.date
+json.price Money.new(security_price.price, security_price.currency).format
+json.price_amount format("%.4f", security_price.price.to_d)
+json.currency security_price.currency
+json.provisional security_price.provisional
+
+json.security do
+  json.id security_price.security.id
+  json.ticker security_price.security.ticker
+  json.name security_price.security.name
+  json.exchange_operating_mic security_price.security.exchange_operating_mic
+end
+
+json.created_at security_price.created_at.iso8601
+json.updated_at security_price.updated_at.iso8601
diff --git a/app/views/api/v1/security_prices/index.json.jbuilder b/app/views/api/v1/security_prices/index.json.jbuilder
new file mode 100644
index 000000000..8c534edfc
--- /dev/null
+++ b/app/views/api/v1/security_prices/index.json.jbuilder
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+json.security_prices @security_prices do |security_price|
+  json.partial! "security_price", security_price: security_price
+end
+
+json.pagination do
+  json.page @pagy.page
+  json.per_page @per_page
+  json.total_count @pagy.count
+  json.total_pages @pagy.pages
+end
diff --git a/app/views/api/v1/security_prices/show.json.jbuilder b/app/views/api/v1/security_prices/show.json.jbuilder
new file mode 100644
index 000000000..e3a997f70
--- /dev/null
+++ b/app/views/api/v1/security_prices/show.json.jbuilder
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+json.partial! "security_price", security_price: @security_price
diff --git a/app/views/api/v1/syncs/_sync.json.jbuilder b/app/views/api/v1/syncs/_sync.json.jbuilder
new file mode 100644
index 000000000..9550aeca1
--- /dev/null
+++ b/app/views/api/v1/syncs/_sync.json.jbuilder
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+syncable = sync.syncable
+
+json.id sync.id
+json.status sync.status
+json.in_progress sync.in_progress?
+json.terminal sync.terminal?
+json.syncable do
+  json.type sync.syncable_type
+  json.id sync.syncable_id
+  json.name syncable&.try(:name)
+end
+json.parent_id sync.parent_id
+json.children_count sync.children.size
+json.window_start_date sync.window_start_date
+json.window_end_date sync.window_end_date
+json.pending_at sync.pending_at
+json.syncing_at sync.syncing_at
+json.completed_at sync.completed_at
+json.failed_at sync.failed_at
+json.error sync.api_error_payload
+json.created_at sync.created_at
+json.updated_at sync.updated_at
diff --git a/app/views/api/v1/syncs/index.json.jbuilder b/app/views/api/v1/syncs/index.json.jbuilder
new file mode 100644
index 000000000..70496f7ff
--- /dev/null
+++ b/app/views/api/v1/syncs/index.json.jbuilder
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+json.data do
+  json.array! @syncs, partial: "api/v1/syncs/sync", as: :sync
+end
+
+json.meta do
+  json.page @pagy.page
+  json.per_page @per_page
+  json.total_count @pagy.count
+  json.total_pages @pagy.pages
+end
diff --git a/app/views/api/v1/syncs/show.json.jbuilder b/app/views/api/v1/syncs/show.json.jbuilder
new file mode 100644
index 000000000..621b5638a
--- /dev/null
+++ b/app/views/api/v1/syncs/show.json.jbuilder
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+json.data do
+  if @sync
+    json.partial! "api/v1/syncs/sync", sync: @sync
+  else
+    json.nil!
+  end
+end
diff --git a/app/views/api/v1/transactions/_transaction.json.jbuilder b/app/views/api/v1/transactions/_transaction.json.jbuilder
index 9f3a47a98..488ecbe5b 100644
--- a/app/views/api/v1/transactions/_transaction.json.jbuilder
+++ b/app/views/api/v1/transactions/_transaction.json.jbuilder
@@ -17,6 +17,8 @@ json.signed_amount_cents(transaction.entry.classification == "income" ? amount_c
 json.currency transaction.entry.currency
 json.name transaction.entry.name
 json.notes transaction.entry.notes
+json.external_id transaction.entry.external_id
+json.source transaction.entry.source
 json.classification transaction.entry.classification
 
 # Account information
diff --git a/app/views/api/v1/transfers/_transaction_side.json.jbuilder b/app/views/api/v1/transfers/_transaction_side.json.jbuilder
new file mode 100644
index 000000000..99b3099b3
--- /dev/null
+++ b/app/views/api/v1/transfers/_transaction_side.json.jbuilder
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+entry = transaction.entry
+
+json.id transaction.id
+json.entry_id entry.id
+json.date entry.date
+json.amount entry.amount_money.format
+json.amount_cents money_to_minor_units(entry.amount_money)
+json.currency entry.currency
+json.name entry.name
+json.kind transaction.kind
+
+json.account do
+  json.id entry.account.id
+  json.name entry.account.name
+  json.account_type entry.account.accountable_type.underscore
+end
diff --git a/app/views/api/v1/transfers/_transfer.json.jbuilder b/app/views/api/v1/transfers/_transfer.json.jbuilder
new file mode 100644
index 000000000..1fb27815f
--- /dev/null
+++ b/app/views/api/v1/transfers/_transfer.json.jbuilder
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+json.id transfer.id
+json.status transfer.status
+json.date transfer.date
+json.amount transfer.amount_abs.format
+json.amount_cents money_to_minor_units(transfer.amount_abs)
+json.currency transfer.inflow_transaction.entry.currency
+json.transfer_type transfer.transfer_type
+json.notes transfer.notes
+
+json.inflow_transaction do
+  json.partial! "api/v1/transfers/transaction_side", transaction: transfer.inflow_transaction
+end
+
+json.outflow_transaction do
+  json.partial! "api/v1/transfers/transaction_side", transaction: transfer.outflow_transaction
+end
+
+json.created_at transfer.created_at.iso8601
+json.updated_at transfer.updated_at.iso8601
diff --git a/app/views/api/v1/transfers/index.json.jbuilder b/app/views/api/v1/transfers/index.json.jbuilder
new file mode 100644
index 000000000..fdb49b15d
--- /dev/null
+++ b/app/views/api/v1/transfers/index.json.jbuilder
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+json.transfers @transfers do |transfer|
+  json.partial! "transfer", transfer: transfer
+end
+
+json.pagination do
+  json.page @pagy.page
+  json.per_page @per_page
+  json.total_count @pagy.count
+  json.total_pages @pagy.pages
+end
diff --git a/app/views/api/v1/transfers/show.json.jbuilder b/app/views/api/v1/transfers/show.json.jbuilder
new file mode 100644
index 000000000..d5c0710f3
--- /dev/null
+++ b/app/views/api/v1/transfers/show.json.jbuilder
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+json.partial! "transfer", transfer: @transfer
diff --git a/app/views/api/v1/valuations/_valuation.json.jbuilder b/app/views/api/v1/valuations/_valuation.json.jbuilder
index 1e63fb537..3341fa0e6 100644
--- a/app/views/api/v1/valuations/_valuation.json.jbuilder
+++ b/app/views/api/v1/valuations/_valuation.json.jbuilder
@@ -1,17 +1,19 @@
 # frozen_string_literal: true
 
-json.id valuation.entry.id
-json.date valuation.entry.date
-json.amount valuation.entry.amount_money.format
-json.currency valuation.entry.currency
-json.notes valuation.entry.notes
+entry = local_assigns[:entry] || valuation.entry
+
+json.id entry.id
+json.date entry.date
+json.amount entry.amount_money.format
+json.currency entry.currency
+json.notes entry.notes
 json.kind valuation.kind
 
 # Account information
 json.account do
-  json.id valuation.entry.account.id
-  json.name valuation.entry.account.name
-  json.account_type valuation.entry.account.accountable_type.underscore
+  json.id entry.account.id
+  json.name entry.account.name
+  json.account_type entry.account.accountable_type.underscore
 end
 
 # Additional metadata
diff --git a/app/views/api/v1/valuations/index.json.jbuilder b/app/views/api/v1/valuations/index.json.jbuilder
new file mode 100644
index 000000000..a7b93c0d2
--- /dev/null
+++ b/app/views/api/v1/valuations/index.json.jbuilder
@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+json.valuations @entries do |entry|
+  json.partial! "valuation", valuation: entry.entryable, entry: entry
+end
+
+json.pagination do
+  json.page @pagy.page
+  json.per_page @per_page
+  json.total_count @pagy.count
+  json.total_pages @pagy.pages
+end
diff --git a/app/views/assistant_messages/_assistant_message.html.erb b/app/views/assistant_messages/_assistant_message.html.erb
index 59356a788..6b00a3c2d 100644
--- a/app/views/assistant_messages/_assistant_message.html.erb
+++ b/app/views/assistant_messages/_assistant_message.html.erb
@@ -1,10 +1,15 @@
 <%# locals: (assistant_message:) %>
 
 <div id="<%= dom_id(assistant_message) %>">
-  <% if assistant_message.reasoning? %>
+  <% if assistant_message.pending? %>
+    <div class="flex items-start gap-3 mb-6">
+      <%= render "chats/ai_avatar" %>
+      <p class="text-sm text-secondary animate-pulse"><%= t("chats.thinking") %></p>
+    </div>
+  <% elsif assistant_message.reasoning? %>
     <details class="group mb-1">
       <summary class="flex items-center gap-2">
-        <p class="text-secondary text-sm">Assistant reasoning</p>
+        <p class="text-secondary text-sm"><%= t(".assistant_reasoning") %></p>
         <%= icon("chevron-down", class: "group-open:transform group-open:rotate-180") %>
       </summary>
 
diff --git a/app/views/assistant_messages/_tool_calls.html.erb b/app/views/assistant_messages/_tool_calls.html.erb
index 59c149225..d2adace6a 100644
--- a/app/views/assistant_messages/_tool_calls.html.erb
+++ b/app/views/assistant_messages/_tool_calls.html.erb
@@ -3,15 +3,15 @@
 <details class="my-2 group mb-4">
   <summary class="text-secondary text-xs cursor-pointer flex items-center gap-2">
     <%= icon("chevron-right", class: "group-open:transform group-open:rotate-90") %>
-    <p>Tool Calls</p>
+    <p><%= t(".tool_calls") %></p>
   </summary>
 
   <div class="mt-2">
     <% message.tool_calls.each do |tool_call| %>
       <div class="bg-blue-50 border-blue-200 px-3 py-2 rounded-lg border mb-2">
-        <p class="text-secondary text-xs">Function:</p>
+        <p class="text-secondary text-xs"><%= t(".function") %></p>
         <p class="text-primary text-sm font-mono"><%= tool_call.function_name %></p>
-        <p class="text-secondary text-xs mt-2">Arguments:</p>
+        <p class="text-secondary text-xs mt-2"><%= t(".arguments") %></p>
         <pre class="text-primary text-sm font-mono whitespace-pre-wrap"><%= tool_call.function_arguments %></pre>
       </div>
     <% end %>
diff --git a/app/views/binance_items/_binance_item.html.erb b/app/views/binance_items/_binance_item.html.erb
index d08e6d34d..5a1374fc7 100644
--- a/app/views/binance_items/_binance_item.html.erb
+++ b/app/views/binance_items/_binance_item.html.erb
@@ -1,49 +1,51 @@
 <%# locals: (binance_item:, unlinked_count: binance_item.unlinked_accounts_count) %>
 
 <%= tag.div id: dom_id(binance_item) do %>
-  <details open class="group bg-container p-4 shadow-border-xs rounded-xl">
-    <summary class="flex items-center gap-2">
-      <%= icon "chevron-right", class: "group-open:transform group-open:rotate-90" %>
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center gap-2">
+        <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
 
-      <div class="flex items-center justify-center h-8 w-8 rounded-full" style="background-color: rgba(240, 185, 11, 0.15);">
-        <div class="flex items-center justify-center">
-          <%= icon "coins", size: "sm", class: "text-[#F0B90B]" %>
+        <div class="flex items-center justify-center h-8 w-8 rounded-full" style="background-color: rgba(240, 185, 11, 0.15);">
+          <div class="flex items-center justify-center">
+            <%= icon "coins", size: "sm", class: "text-[#F0B90B]" %>
+          </div>
         </div>
-      </div>
 
-      <div class="pl-1 text-sm flex-1">
-        <div class="flex items-center gap-2">
-          <%= tag.p binance_item.institution_display_name, class: "font-medium text-primary" %>
-          <% if binance_item.scheduled_for_deletion? %>
-            <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+        <div class="pl-1 text-sm flex-1">
+          <div class="flex items-center gap-2">
+            <%= tag.p binance_item.institution_display_name, class: "font-medium text-primary" %>
+            <% if binance_item.scheduled_for_deletion? %>
+              <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+            <% end %>
+          </div>
+          <p class="text-xs text-secondary"><%= t(".provider_name") %></p>
+          <% if binance_item.syncing? %>
+            <div class="text-secondary flex items-center gap-1">
+              <%= icon "loader", size: "sm", class: "animate-spin" %>
+              <%= tag.span t(".syncing") %>
+            </div>
+          <% elsif binance_item.requires_update? %>
+            <div class="text-warning flex items-center gap-1">
+              <%= icon "alert-triangle", size: "sm", color: "warning" %>
+              <%= tag.span t(".reconnect") %>
+            </div>
+          <% else %>
+            <p class="text-secondary">
+              <% if binance_item.last_synced_at %>
+                <% if binance_item.sync_status_summary %>
+                  <%= t(".status_with_summary", timestamp: time_ago_in_words(binance_item.last_synced_at), summary: binance_item.sync_status_summary) %>
+                <% else %>
+                  <%= t(".status", timestamp: time_ago_in_words(binance_item.last_synced_at)) %>
+                <% end %>
+              <% else %>
+                <%= t(".status_never") %>
+              <% end %>
+            </p>
           <% end %>
         </div>
-        <p class="text-xs text-secondary"><%= t(".provider_name") %></p>
-        <% if binance_item.syncing? %>
-          <div class="text-secondary flex items-center gap-1">
-            <%= icon "loader", size: "sm", class: "animate-spin" %>
-            <%= tag.span t(".syncing") %>
-          </div>
-        <% elsif binance_item.requires_update? %>
-          <div class="text-warning flex items-center gap-1">
-            <%= icon "alert-triangle", size: "sm", color: "warning" %>
-            <%= tag.span t(".reconnect") %>
-          </div>
-        <% else %>
-          <p class="text-secondary">
-            <% if binance_item.last_synced_at %>
-              <% if binance_item.sync_status_summary %>
-                <%= t(".status_with_summary", timestamp: time_ago_in_words(binance_item.last_synced_at), summary: binance_item.sync_status_summary) %>
-              <% else %>
-                <%= t(".status", timestamp: time_ago_in_words(binance_item.last_synced_at)) %>
-              <% end %>
-            <% else %>
-              <%= t(".status_never") %>
-            <% end %>
-          </p>
-        <% end %>
       </div>
-    </summary>
+    <% end %>
 
     <% if Current.user&.admin? %>
       <div class="flex items-center justify-end gap-2 mt-2">
@@ -128,5 +130,5 @@
         <% end %>
       </div>
     <% end %>
-  </details>
+  <% end %>
 <% end %>
diff --git a/app/views/binance_items/select_existing_account.html.erb b/app/views/binance_items/select_existing_account.html.erb
index 8f12e628a..a980fca99 100644
--- a/app/views/binance_items/select_existing_account.html.erb
+++ b/app/views/binance_items/select_existing_account.html.erb
@@ -17,7 +17,7 @@
           <%= hidden_field_tag :account_id, @account.id %>
           <div class="space-y-2 max-h-64 overflow-auto">
             <% @available_binance_accounts.each do |ba| %>
-              <label class="flex items-center gap-3 p-2 rounded border border-surface-inset/50 hover:border-primary cursor-pointer">
+              <label class="flex items-center gap-3 p-2 rounded border border-secondary hover:border-primary cursor-pointer">
                 <%= radio_button_tag :binance_account_id, ba.id, false %>
                 <div class="flex flex-col">
                   <span class="text-sm text-primary font-medium"><%= ba.name.presence || ba.id %></span>
diff --git a/app/views/brex_items/_api_error.html.erb b/app/views/brex_items/_api_error.html.erb
new file mode 100644
index 000000000..0cf49d068
--- /dev/null
+++ b/app/views/brex_items/_api_error.html.erb
@@ -0,0 +1,37 @@
+<%# locals: (error_message:, return_path:) %>
+<%= turbo_frame_tag "modal" do %>
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t(".title")) %>
+    <% dialog.with_body do %>
+      <div class="space-y-4">
+        <div class="flex items-start gap-3">
+          <%= icon("alert-circle", class: "text-destructive w-5 h-5 shrink-0 mt-0.5") %>
+          <div class="text-sm">
+            <p class="font-medium text-primary mb-2"><%= t(".heading") %></p>
+            <p class="text-secondary"><%= error_message %></p>
+          </div>
+        </div>
+
+        <div class="bg-surface rounded-lg p-4 space-y-2 text-sm">
+          <p class="font-medium text-primary"><%= t(".common_issues") %></p>
+          <ul class="list-disc list-inside space-y-1 text-secondary">
+            <li><strong><%= t(".invalid_token_label") %></strong> <%= t(".invalid_token") %></li>
+            <li><strong><%= t(".expired_credentials_label") %></strong> <%= t(".expired_credentials") %></li>
+            <li><strong><%= t(".permissions_label") %></strong> <%= t(".permissions") %></li>
+            <li><strong><%= t(".network_label") %></strong> <%= t(".network") %></li>
+            <li><strong><%= t(".service_label") %></strong> <%= t(".service") %></li>
+          </ul>
+        </div>
+
+        <div class="mt-4">
+          <%= render DS::Link.new(
+            text: t(".settings_link"),
+            href: return_path.presence || settings_providers_path,
+            variant: :primary,
+            data: { turbo: false }
+          ) %>
+        </div>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/brex_items/_brex_item.html.erb b/app/views/brex_items/_brex_item.html.erb
new file mode 100644
index 000000000..293813b10
--- /dev/null
+++ b/app/views/brex_items/_brex_item.html.erb
@@ -0,0 +1,134 @@
+<%# locals: (brex_item:) %>
+<% render_locals = brex_item_render_locals(
+     brex_item,
+     sync_stats_map: @brex_sync_stats_map,
+     account_counts_map: @brex_account_counts_map,
+     institutions_count_map: @brex_institutions_count_map
+   ) %>
+<% stats = render_locals[:stats] %>
+<% unlinked_count = render_locals[:unlinked_count] %>
+<% linked_count = render_locals[:linked_count] %>
+<% total_count = render_locals[:total_count] %>
+<% institutions_count = render_locals[:institutions_count] %>
+
+<%= tag.div id: dom_id(brex_item) do %>
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center justify-between gap-2">
+        <div class="flex items-center gap-2">
+          <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
+
+          <div class="flex items-center justify-center h-8 w-8 bg-container-inset rounded-full">
+            <% if brex_item.logo.attached? %>
+              <%= image_tag brex_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
+            <% else %>
+              <div class="flex items-center justify-center">
+                <%= tag.p brex_item.name.first.upcase, class: "text-primary text-xs font-medium" %>
+              </div>
+            <% end %>
+          </div>
+
+          <div class="pl-1 text-sm">
+            <div class="flex items-center gap-2">
+              <%= tag.p brex_item.name, class: "font-medium text-primary" %>
+              <% if brex_item.scheduled_for_deletion? %>
+                <%= tag.p t(".deletion_in_progress"), class: "text-destructive text-sm animate-pulse" %>
+              <% end %>
+            </div>
+            <% if brex_item.accounts.any? %>
+              <p class="text-xs text-secondary">
+                <%= brex_item.institution_summary %>
+              </p>
+            <% end %>
+            <% if brex_item.syncing? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "loader", size: "sm", class: "animate-spin" %>
+                <%= tag.span t(".syncing") %>
+              </div>
+            <% elsif brex_item.sync_error.present? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= render DS::Tooltip.new(text: brex_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive", as: :span) %>
+                <%= tag.span t(".error"), class: "text-destructive" %>
+              </div>
+            <% else %>
+              <p class="text-secondary">
+                <% if brex_item.last_synced_at %>
+                  <% if brex_item.sync_status_summary %>
+                    <%= t(".status_with_summary", timestamp: time_ago_in_words(brex_item.last_synced_at), summary: brex_item.sync_status_summary) %>
+                  <% else %>
+                    <%= t(".status", timestamp: time_ago_in_words(brex_item.last_synced_at)) %>
+                  <% end %>
+                <% else %>
+                  <%= t(".status_never") %>
+                <% end %>
+              </p>
+            <% end %>
+          </div>
+        </div>
+
+        <% if Current.user&.admin? %>
+          <div class="flex items-center gap-2">
+            <% if Rails.env.development? %>
+              <%= icon(
+                "refresh-cw",
+                as_button: true,
+                href: sync_brex_item_path(brex_item)
+              ) %>
+            <% end %>
+
+            <%= render DS::Menu.new do |menu| %>
+              <% menu.with_item(
+                variant: "button",
+                text: t(".delete"),
+                icon: "trash-2",
+                href: brex_item_path(brex_item),
+                method: :delete,
+                confirm: CustomConfirm.for_resource_deletion(brex_item.name, high_severity: true)
+              ) %>
+            <% end %>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
+
+    <% unless brex_item.scheduled_for_deletion? %>
+      <div class="space-y-4 mt-4">
+        <% if brex_item.accounts.any? %>
+          <%= render "accounts/index/account_groups", accounts: brex_item.accounts %>
+        <% end %>
+
+        <%= render ProviderSyncSummary.new(
+          stats: stats,
+          provider_item: brex_item,
+          institutions_count: institutions_count
+        ) %>
+
+        <% if unlinked_count > 0 %>
+          <div class="p-4 flex flex-col gap-3 items-center justify-center">
+            <p class="text-primary font-medium text-sm"><%= t(".setup_needed") %></p>
+            <p class="text-secondary text-sm"><%= t(".setup_description", linked: linked_count, total: total_count) %></p>
+            <%= render DS::Link.new(
+              text: t(".setup_action"),
+              icon: "settings",
+              variant: "primary",
+              href: setup_accounts_brex_item_path(brex_item),
+              frame: :modal
+            ) %>
+          </div>
+        <% elsif brex_item.accounts.empty? && total_count == 0 %>
+          <div class="p-4 flex flex-col gap-3 items-center justify-center">
+            <p class="text-primary font-medium text-sm"><%= t(".no_accounts_title") %></p>
+            <p class="text-secondary text-sm"><%= t(".no_accounts_description") %></p>
+            <%= render DS::Link.new(
+              text: t(".setup_action"),
+              icon: "settings",
+              variant: "primary",
+              href: setup_accounts_brex_item_path(brex_item),
+              frame: :modal
+            ) %>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/brex_items/_setup_required.html.erb b/app/views/brex_items/_setup_required.html.erb
new file mode 100644
index 000000000..e6347142e
--- /dev/null
+++ b/app/views/brex_items/_setup_required.html.erb
@@ -0,0 +1,35 @@
+<%= turbo_frame_tag "modal" do %>
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t(".title")) %>
+    <% dialog.with_body do %>
+      <div class="space-y-4">
+        <div class="flex items-start gap-3">
+          <%= icon("alert-circle", class: "text-warning w-5 h-5 shrink-0 mt-0.5") %>
+          <div class="text-sm text-secondary">
+            <p class="font-medium text-primary mb-2"><%= t(".heading") %></p>
+            <p><%= t(".description") %></p>
+          </div>
+        </div>
+
+        <div class="bg-surface rounded-lg p-4 space-y-2 text-sm">
+          <p class="font-medium text-primary"><%= t(".setup_steps") %></p>
+          <ol class="list-decimal list-inside space-y-1 text-secondary">
+            <li><%= t(".steps.open_settings_html") %></li>
+            <li><%= t(".steps.find_section_html") %></li>
+            <li><%= t(".steps.enter_token") %></li>
+            <li><%= t(".steps.return_to_link") %></li>
+          </ol>
+        </div>
+
+        <div class="mt-4">
+          <%= render DS::Link.new(
+            text: t(".settings_link"),
+            href: settings_providers_path,
+            variant: :primary,
+            data: { turbo: false }
+          ) %>
+        </div>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/brex_items/_subtype_select.html.erb b/app/views/brex_items/_subtype_select.html.erb
new file mode 100644
index 000000000..9653265a6
--- /dev/null
+++ b/app/views/brex_items/_subtype_select.html.erb
@@ -0,0 +1,16 @@
+<div class="subtype-select hidden" data-type="<%= account_type %>">
+  <% if subtype_config[:options].present? %>
+    <%= label_tag "account_subtypes[#{brex_account.id}]", subtype_config[:label],
+                 class: "block text-sm font-medium text-primary mb-2" %>
+    <% selected_value = "" %>
+    <% if account_type == "Depository" %>
+      <% selected_value = default_brex_depository_subtype(brex_account.name) %>
+    <% end %>
+    <% prompt_key = account_type == "Depository" ? "subtype" : "type" %>
+    <%= select_tag "account_subtypes[#{brex_account.id}]",
+                  options_for_select([[t("brex_items.subtype_select.placeholder.#{prompt_key}"), ""]] + subtype_config[:options], selected_value),
+                  { class: "appearance-none bg-container border border-primary rounded-md px-3 py-2 text-sm leading-6 text-primary focus:border-primary focus:ring-1 focus:ring-primary focus:outline-none w-full" } %>
+  <% else %>
+    <p class="text-sm text-secondary"><%= subtype_config[:message] %></p>
+  <% end %>
+</div>
diff --git a/app/views/brex_items/select_accounts.html.erb b/app/views/brex_items/select_accounts.html.erb
new file mode 100644
index 000000000..7ca056eb0
--- /dev/null
+++ b/app/views/brex_items/select_accounts.html.erb
@@ -0,0 +1,62 @@
+<%= turbo_frame_tag "modal" do %>
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t(".title")) %>
+
+    <% dialog.with_body do %>
+      <div class="space-y-4">
+        <p class="text-sm text-secondary">
+          <%= t(".description", product_name: product_name) %>
+        </p>
+
+        <%= form_with url: link_accounts_brex_items_path,
+                      method: :post,
+                      data: { turbo_frame: "_top" },
+                      class: "space-y-4" do %>
+          <%= hidden_field_tag :brex_item_id, @brex_item.id %>
+          <%= hidden_field_tag :accountable_type, @accountable_type %>
+          <%= hidden_field_tag :return_to, @return_to %>
+
+          <% account_displays = @available_accounts.map { |account| brex_account_display(account) } %>
+          <% has_selectable = account_displays.any? { |account_display| !account_display.blank_name? } %>
+
+          <div class="space-y-2">
+            <% account_displays.each do |account_display| %>
+              <label class="flex items-start gap-3 p-3 border <%= account_display.blank_name? ? "border-destructive bg-destructive/10" : "border-primary" %> rounded-lg <%= account_display.blank_name? ? "cursor-not-allowed opacity-60" : "hover:bg-subtle cursor-pointer" %> transition-colors">
+                <%= check_box_tag "account_ids[]", account_display.id, false, disabled: account_display.blank_name?, class: "mt-1" %>
+                <div class="flex-1">
+                  <div class="font-medium text-sm <%= account_display.blank_name? ? "text-destructive" : "text-primary" %>">
+                    <% if account_display.blank_name? %>
+                      <%= t(".no_name_placeholder") %>
+                    <% else %>
+                      <%= account_display.name %>
+                    <% end %>
+                  </div>
+                  <div class="text-xs text-secondary mt-1">
+                    <%= brex_account_metadata(account_display) %>
+                  </div>
+                  <% if account_display.blank_name? %>
+                    <div class="text-xs text-destructive mt-1">
+                      <%= t(".configure_name_in_brex") %>
+                    </div>
+                  <% end %>
+                </div>
+              </label>
+            <% end %>
+          </div>
+
+          <div class="flex gap-2 justify-end pt-4">
+            <%= link_to t(".cancel"), @return_to || new_account_path,
+                class: "inline-flex items-center gap-1 px-3 py-2 text-sm font-medium rounded-lg text-primary button-bg-secondary hover:button-bg-secondary-hover",
+                data: { turbo_frame: "_top" } %>
+            <%= render DS::Button.new(
+              text: t(".link_accounts"),
+              variant: :primary,
+              type: :submit,
+              disabled: !has_selectable
+            ) %>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/brex_items/select_existing_account.html.erb b/app/views/brex_items/select_existing_account.html.erb
new file mode 100644
index 000000000..ddb681e7a
--- /dev/null
+++ b/app/views/brex_items/select_existing_account.html.erb
@@ -0,0 +1,62 @@
+<%= turbo_frame_tag "modal" do %>
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t(".title", account_name: @account.name)) %>
+
+    <% dialog.with_body do %>
+      <div class="space-y-4">
+        <p class="text-sm text-secondary">
+          <%= t(".description") %>
+        </p>
+
+        <%= form_with url: link_existing_account_brex_items_path,
+                      method: :post,
+                      data: { turbo_frame: "_top" },
+                      class: "space-y-4" do %>
+          <%= hidden_field_tag :brex_item_id, @brex_item.id %>
+          <%= hidden_field_tag :account_id, @account.id %>
+          <%= hidden_field_tag :return_to, @return_to %>
+
+          <% account_displays = @available_accounts.map { |account| brex_account_display(account) } %>
+          <% has_selectable = account_displays.any? { |account_display| !account_display.blank_name? } %>
+
+          <div class="space-y-2">
+            <% account_displays.each do |account_display| %>
+              <label class="flex items-start gap-3 p-3 border <%= account_display.blank_name? ? "border-destructive bg-destructive/10" : "border-primary" %> rounded-lg <%= account_display.blank_name? ? "cursor-not-allowed opacity-60" : "hover:bg-subtle cursor-pointer" %> transition-colors">
+                <%= radio_button_tag "brex_account_id", account_display.id, false, disabled: account_display.blank_name?, class: "mt-1" %>
+                <div class="flex-1">
+                  <div class="font-medium text-sm <%= account_display.blank_name? ? "text-destructive" : "text-primary" %>">
+                    <% if account_display.blank_name? %>
+                      <%= t(".no_name_placeholder") %>
+                    <% else %>
+                      <%= account_display.name %>
+                    <% end %>
+                  </div>
+                  <div class="text-xs text-secondary mt-1">
+                    <%= brex_account_metadata(account_display) %>
+                  </div>
+                  <% if account_display.blank_name? %>
+                    <div class="text-xs text-destructive mt-1">
+                      <%= t(".configure_name_in_brex") %>
+                    </div>
+                  <% end %>
+                </div>
+              </label>
+            <% end %>
+          </div>
+
+          <div class="flex gap-2 justify-end pt-4">
+            <%= link_to t(".cancel"), @return_to || accounts_path,
+                class: "inline-flex items-center gap-1 px-3 py-2 text-sm font-medium rounded-lg text-primary button-bg-secondary hover:button-bg-secondary-hover",
+                data: { turbo_frame: "_top" } %>
+            <%= render DS::Button.new(
+              text: t(".link_account"),
+              variant: :primary,
+              type: :submit,
+              disabled: !has_selectable
+            ) %>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/brex_items/setup_accounts.html.erb b/app/views/brex_items/setup_accounts.html.erb
new file mode 100644
index 000000000..88206fb46
--- /dev/null
+++ b/app/views/brex_items/setup_accounts.html.erb
@@ -0,0 +1,106 @@
+<% content_for :title, t(".title") %>
+
+<%= render DS::Dialog.new do |dialog| %>
+  <% dialog.with_header(title: t(".title")) do %>
+    <div class="flex items-center gap-2">
+      <%= icon "building-2", class: "text-primary" %>
+      <span class="text-primary"><%= t(".subtitle") %></span>
+    </div>
+  <% end %>
+
+  <% dialog.with_body do %>
+    <%= form_with url: complete_account_setup_brex_item_path(@brex_item),
+                  method: :post,
+                  local: true,
+                  data: {
+                    controller: "loading-button",
+                    action: "submit->loading-button#showLoading",
+                    loading_button_loading_text_value: t(".creating_accounts"),
+                    turbo_frame: "_top"
+                  },
+                  class: "space-y-6" do |form| %>
+
+      <div class="space-y-4">
+        <% if @api_error.present? %>
+          <div class="p-8 flex flex-col gap-3 items-center justify-center text-center">
+            <%= icon "alert-circle", size: "lg", class: "text-destructive" %>
+            <p class="text-primary font-medium"><%= t(".fetch_failed") %></p>
+            <p class="text-destructive text-sm"><%= @api_error %></p>
+          </div>
+        <% elsif @brex_accounts.empty? %>
+          <div class="p-8 flex flex-col gap-3 items-center justify-center text-center">
+            <%= icon "check-circle", size: "lg", class: "text-success" %>
+            <p class="text-primary font-medium"><%= t(".no_accounts_to_setup") %></p>
+            <p class="text-secondary text-sm"><%= t(".all_accounts_linked") %></p>
+          </div>
+        <% else %>
+          <div class="bg-surface border border-primary p-4 rounded-lg">
+            <div class="flex items-start gap-3">
+              <%= icon "info", size: "sm", class: "text-primary mt-0.5 flex-shrink-0" %>
+              <div>
+                <p class="text-sm text-primary mb-2">
+                  <strong><%= t(".choose_account_type") %></strong>
+                </p>
+                <ul class="text-xs text-secondary space-y-1 list-disc list-inside">
+                  <% @displayable_account_type_options.each do |label, type| %>
+                    <li><strong><%= label %></strong></li>
+                  <% end %>
+                </ul>
+              </div>
+            </div>
+          </div>
+
+          <% @brex_accounts.each do |brex_account| %>
+          <div class="border border-primary rounded-lg p-4">
+            <div class="flex items-center justify-between mb-3">
+              <div>
+                <h3 class="font-medium text-primary">
+                  <%= brex_account.name %>
+                </h3>
+              </div>
+            </div>
+
+            <div class="space-y-3" data-controller="account-type-selector" data-account-type-selector-account-id-value="<%= brex_account.id %>">
+              <div>
+                <%= label_tag "account_types[#{brex_account.id}]", t(".account_type_label"),
+                             class: "block text-sm font-medium text-primary mb-2" %>
+                <% default_account_type = brex_account.card? ? "CreditCard" : "Depository" %>
+                <%= select_tag "account_types[#{brex_account.id}]",
+                              options_for_select(@account_type_options, default_account_type),
+                              { class: "appearance-none bg-container border border-primary rounded-md px-3 py-2 text-sm leading-6 text-primary focus:border-primary focus:ring-1 focus:ring-primary focus:outline-none w-full",
+                                data: {
+                                  action: "change->account-type-selector#updateSubtype"
+                                } } %>
+              </div>
+
+              <!-- Subtype dropdowns (shown/hidden based on account type) -->
+              <div data-account-type-selector-target="subtypeContainer">
+                <% @subtype_options.each do |account_type, subtype_config| %>
+                  <%= render "brex_items/subtype_select", account_type: account_type, subtype_config: subtype_config, brex_account: brex_account %>
+                <% end %>
+              </div>
+            </div>
+          </div>
+          <% end %>
+        <% end %>
+      </div>
+
+      <div class="flex gap-3">
+        <%= render DS::Button.new(
+          text: t(".create_accounts"),
+          variant: "primary",
+          icon: "plus",
+          type: "submit",
+          class: "flex-1",
+          disabled: @api_error.present? || @brex_accounts.empty?,
+          data: { loading_button_target: "button" }
+        ) %>
+        <%= render DS::Link.new(
+          text: t(".cancel"),
+          variant: "secondary",
+          href: accounts_path
+        ) %>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/budget_categories/_allocation_progress.erb b/app/views/budget_categories/_allocation_progress.erb
index af854fe00..0312cd677 100644
--- a/app/views/budget_categories/_allocation_progress.erb
+++ b/app/views/budget_categories/_allocation_progress.erb
@@ -5,14 +5,14 @@
     <% if budget.available_to_allocate.negative? %>
       <div class="rounded-full w-1.5 h-1.5 bg-red-500"></div>
     <% else %>
-      <div class="rounded-full w-1.5 h-1.5 <%= budget.allocated_spending > 0 ? "bg-gray-900" : "bg-gray-100" %>"></div>
+      <div class="rounded-full w-1.5 h-1.5 <%= budget.allocated_spending > 0 ? "bg-inverse" : "bg-surface-inset" %>"></div>
     <% end %>
 
     <% if budget.available_to_allocate.negative? %>
-      <p class="text-primary text-sm">&gt; 100% set</p>
+      <p class="text-primary text-sm"><%= t("budget_categories.allocation_progress.over_set") %></p>
     <% else %>
       <p class="text-secondary text-sm">
-        <%= number_to_percentage(budget.allocated_percent, precision: 0) %> set
+        <%= t("budget_categories.allocation_progress.percent_set", percent: number_to_percentage(budget.allocated_percent, precision: 0)) %>
       </p>
     <% end %>
 
@@ -23,22 +23,22 @@
     </p>
   </div>
 
-  <div class="relative h-1.5 rounded-2xl bg-gray-100">
+  <div class="relative h-1.5 rounded-2xl bg-surface-inset">
     <% if budget.available_to_allocate.negative? %>
       <div class="absolute inset-0 bg-red-500 rounded-2xl" style="width: 100%;"></div>
     <% else %>
-      <div class="absolute inset-0 bg-gray-900 rounded-2xl" style="width: <%= budget.allocated_percent %>%;"></div>
+      <div class="absolute inset-0 bg-inverse rounded-2xl" style="width: <%= budget.allocated_percent %>%;"></div>
     <% end %>
   </div>
 
   <div class="text-sm">
     <% if budget.available_to_allocate.negative? %>
       <p class="text-secondary">
-        Budget exceeded by <span class="text-red-500 privacy-sensitive"><%= format_money(budget.available_to_allocate_money.abs) %></span>
+        <%= t("budget_categories.allocation_progress.budget_exceeded_html", amount: format_money(budget.available_to_allocate_money.abs)).html_safe %>
       </p>
     <% else %>
       <span class="text-primary privacy-sensitive"><%= format_money(budget.available_to_allocate_money) %></span>
-      <span class="text-secondary">left to allocate</span>
+      <span class="text-secondary"><%= t("budget_categories.allocation_progress.left_to_allocate") %></span>
     <% end %>
   </div>
 </div>
diff --git a/app/views/budget_categories/_budget_category.html.erb b/app/views/budget_categories/_budget_category.html.erb
index 8597a1b93..ff209f009 100644
--- a/app/views/budget_categories/_budget_category.html.erb
+++ b/app/views/budget_categories/_budget_category.html.erb
@@ -1,4 +1,4 @@
-<%# locals: (budget_category:) %>
+<%# locals: (budget_category:, show_budget_meta: true) %>
 
 <%= turbo_frame_tag dom_id(budget_category), class: "flex-1 min-w-0 block" do %>
   <%= link_to budget_budget_category_path(budget_category.budget, budget_category), class: "group block w-full px-4 py-2 bg-container", data: { turbo_frame: "drawer" } do %>
@@ -49,7 +49,7 @@
         <div class="h-1.5 bg-container-inset rounded-full overflow-hidden">
           <% bar_color = budget_category.over_budget? ? "bg-red-500" : (budget_category.near_limit? ? "bg-yellow-500" : "bg-green-500") %>
           <div class="h-full <%= bar_color %> rounded-full transition-all duration-500"
-               style="width: <%= budget_category.bar_width_percent %>%"></div>
+            style="inline-size: <%= budget_category.bar_width_percent %>%"></div>
         </div>
       </div>
 
@@ -61,15 +61,26 @@
             <%= format_money(budget_category.actual_spending_money) %>
           </span>
         </div>
+        <% if show_budget_meta %>
         <div class="whitespace-nowrap w-full sm:w-auto inline-flex items-center gap-1">
           <span class="text-sm text-secondary"><%= t("reports.budget_performance.budgeted") %>:</span>
           <span class="font-medium text-primary privacy-sensitive">
             <%= format_money(budget_category.budgeted_spending_money) %>
           </span>
           <% if budget_category.inherits_parent_budget? %>
-            <span class="inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium bg-gray-500/5 text-secondary"><%= t("reports.budget_performance.shared") %></span>
+            <span class="inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium bg-gray-tint-5 text-secondary"><%= t("reports.budget_performance.shared") %></span>
           <% end %>
         </div>
+        <% if budget_category.suggested_daily_spending.present? %>
+          <% daily_info = budget_category.suggested_daily_spending %>
+          <div class="w-full sm:w-auto text-xs text-subdued">
+            <%= t("reports.budget_performance.suggested_daily",
+              amount: daily_info[:amount].format,
+              days: daily_info[:days_remaining])
+            %>
+          </div>
+        <% end %>
+        <% end %>
         <div class="whitespace-nowrap w-full sm:w-auto lg:ml-auto">
           <% if budget_category.available_to_spend >= 0 %>
             <span class="text-sm text-secondary"><%= t("reports.budget_performance.remaining") %>:</span>
@@ -85,18 +96,6 @@
         </div>
       </div>
 
-      <%# Suggested Daily Limit (if remaining days in month) %>
-      <% if budget_category.suggested_daily_spending.present? %>
-        <% daily_info = budget_category.suggested_daily_spending %>
-        <div class="py-2">
-          <p class="text-xs text-subdued break-words">
-            <%= t("reports.budget_performance.suggested_daily",
-                  amount: daily_info[:amount].format,
-                  days: daily_info[:days_remaining]) %>
-          </p>
-        </div>
-      <% end %>
-
     <% else %>
       <%# Uninitialized budget - show simple view %>
       <div class="flex items-center gap-3">
diff --git a/app/views/budget_categories/_budget_category_form.html.erb b/app/views/budget_categories/_budget_category_form.html.erb
index 59a564a8b..855a0cda8 100644
--- a/app/views/budget_categories/_budget_category_form.html.erb
+++ b/app/views/budget_categories/_budget_category_form.html.erb
@@ -8,22 +8,22 @@
   <div class="text-sm mr-3">
     <p class="text-primary font-medium mb-0.5"><%= budget_category.category.name %></p>
 
-    <p class="text-secondary"><%= budget_category.median_monthly_expense_money.format(precision: 0) %>/m avg</p>
+    <p class="text-secondary privacy-sensitive"><%= t("budget_categories.budget_category_form.monthly_average", amount: budget_category.median_monthly_expense_money.format(precision: 0)) %></p>
   </div>
 
   <div class="ml-auto">
     <%= form_with model: [budget_category.budget, budget_category], data: { controller: "auto-submit-form preserve-focus" } do |f| %>
       <div class="form-field w-[120px]">
-        <div class="flex items-center">
+        <div class="flex items-center privacy-sensitive privacy-sensitive-interactive">
           <span class="text-secondary text-sm mr-2"><%= currency.symbol %></span>
           <%= f.number_field :budgeted_spending,
                             class: "form-field__input text-right [appearance:textfield] [&::-webkit-outer-spin-button]:appearance-none [&::-webkit-inner-spin-button]:appearance-none",
-                            placeholder: budget_category.subcategory? ? "Shared" : "0",
+                            placeholder: budget_category.subcategory? ? t("budget_categories.budget_category_form.shared_placeholder") : "0",
                             step: currency.step,
                             id: dom_id(budget_category, :budgeted_spending),
                             min: 0,
                             data: { auto_submit_form_target: "auto" },
-                            title: budget_category.subcategory? ? "Leave empty to share parent's budget" : nil %>
+                            title: budget_category.subcategory? ? t("budget_categories.budget_category_form.shared_title") : nil %>
         </div>
       </div>
     <% end %>
diff --git a/app/views/budget_categories/_confirm_button.html.erb b/app/views/budget_categories/_confirm_button.html.erb
index a9d983317..730ebf1e3 100644
--- a/app/views/budget_categories/_confirm_button.html.erb
+++ b/app/views/budget_categories/_confirm_button.html.erb
@@ -1,6 +1,6 @@
 <div id="<%= dom_id(budget, :confirm_button) %>">
   <%= render DS::Button.new(
-    text: "Confirm",
+    text: t(".confirm"),
     variant: "primary",
     full_width: true,
     href: budget_path(budget),
diff --git a/app/views/budget_categories/_no_categories.html.erb b/app/views/budget_categories/_no_categories.html.erb
index 44d8915b1..ed949d2d9 100644
--- a/app/views/budget_categories/_no_categories.html.erb
+++ b/app/views/budget_categories/_no_categories.html.erb
@@ -1,18 +1,18 @@
 <div class="flex justify-center items-center">
   <div class="text-center flex flex-col items-center max-w-[500px]">
-    <h2 class="text-lg text-primary font-medium">Oops!</h2>
+    <h2 class="text-lg text-primary font-medium"><%= t(".oops") %></h2>
     <p class="text-secondary text-sm max-w-sm mx-auto mb-4">
-      You have not created or assigned any expense categories to your transactions yet.
+      <%= t(".no_categories_message") %>
     </p>
 
     <div class="flex items-center gap-2">
       <%= render DS::Button.new(
-        text: "Use defaults (recommended)",
+        text: t(".use_defaults"),
         href: bootstrap_categories_path,
       ) %>
 
       <%= render DS::Link.new(
-        text: "New category",
+        text: t(".new_category"),
         variant: "outline",
         icon: "plus",
         href: new_category_path,
diff --git a/app/views/budget_categories/_uncategorized_budget_category_form.html.erb b/app/views/budget_categories/_uncategorized_budget_category_form.html.erb
index 0ed955d34..49e545cb0 100644
--- a/app/views/budget_categories/_uncategorized_budget_category_form.html.erb
+++ b/app/views/budget_categories/_uncategorized_budget_category_form.html.erb
@@ -7,12 +7,12 @@
 
   <div class="text-sm mr-3">
     <p class="text-primary font-medium mb-0.5"><%= budget_category.category.name %></p>
-    <p class="text-secondary"><%= budget_category.avg_monthly_expense_money.format(precision: 0) %>/m avg</p>
+    <p class="text-secondary privacy-sensitive"><%= t("budget_categories.budget_category_form.monthly_average", amount: budget_category.avg_monthly_expense_money.format(precision: 0)) %></p>
   </div>
 
   <div class="ml-auto">
     <div class="form-field w-[120px]">
-      <div class="flex items-center">
+      <div class="flex items-center privacy-sensitive">
         <span class="text-subdued text-sm mr-2"><%= budget_category.budgeted_spending_money.currency.symbol %></span>
         <%= text_field_tag :uncategorized, budget_category.budgeted_spending_money.amount, autocomplete: "off", class: "form-field__input text-right [appearance:textfield] [&::-webkit-outer-spin-button]:appearance-none [&::-webkit-inner-spin-button]:appearance-none", disabled: true %>
       </div>
diff --git a/app/views/budget_categories/index.html.erb b/app/views/budget_categories/index.html.erb
index d5ded43d7..049d5ede8 100644
--- a/app/views/budget_categories/index.html.erb
+++ b/app/views/budget_categories/index.html.erb
@@ -8,9 +8,9 @@
 <div>
   <div class="space-y-6">
     <div class="text-center space-y-2">
-      <h1 class="text-3xl text-primary font-medium">Edit your category budgets</h1>
+      <h1 class="text-3xl text-primary font-medium"><%= t(".title") %></h1>
       <p class="text-secondary text-sm max-w-md mx-auto">
-        Adjust category budgets to set spending limits. Unallocated funds will be automatically assigned as uncategorized.
+        <%= t(".description") %>
       </p>
     </div>
 
diff --git a/app/views/budget_categories/show.html.erb b/app/views/budget_categories/show.html.erb
index 154a7958f..6d8d64ed9 100644
--- a/app/views/budget_categories/show.html.erb
+++ b/app/views/budget_categories/show.html.erb
@@ -1,7 +1,7 @@
 <%= render DS::Dialog.new(variant: :drawer) do |dialog| %>
   <% dialog.with_header do %>
     <div>
-      <p class="text-sm text-secondary">Category</p>
+      <p class="text-sm text-secondary"><%= t(".category") %></p>
       <h3 class="text-2xl font-medium text-primary">
         <%= @budget_category.name %>
       </h3>
@@ -26,12 +26,12 @@
   <% end %>
 
   <% dialog.with_body do %>
-    <% dialog.with_section(title: "Overview", open: true) do %>
+    <% dialog.with_section(title: t(".overview"), open: true) do %>
       <div class="pb-4">
         <dl class="space-y-3 px-3 py-2">
           <div class="flex items-center justify-between text-sm">
             <dt class="text-secondary">
-              <%= @budget_category.budget.start_date.strftime("%b %Y") %> spending
+              <%= t(".spending", date: @budget_category.budget.start_date.strftime("%b %Y")) %>
             </dt>
             <dd class="text-primary font-medium privacy-sensitive">
               <%= format_money @budget_category.actual_spending_money %>
@@ -40,30 +40,30 @@
 
           <% if @budget_category.budget.initialized? %>
             <div class="flex items-center justify-between text-sm">
-              <dt class="text-secondary">Status</dt>
+              <dt class="text-secondary"><%= t(".status") %></dt>
               <% if @budget_category.available_to_spend.negative? %>
                 <dd class="flex items-center gap-1 text-red-500 font-medium privacy-sensitive">
                   <%= icon "alert-circle", size: "sm", color: "destructive" %>
                   <%= format_money @budget_category.available_to_spend_money.abs %>
-                  <span>overspent</span>
+                  <span><%= t(".overspent") %></span>
                 </dd>
               <% elsif @budget_category.available_to_spend.zero? %>
                 <dd class="flex items-center gap-1 text-orange-500 font-medium privacy-sensitive">
                   <%= icon "x-circle", size: "sm", color: "warning" %>
                   <%= format_money @budget_category.available_to_spend_money %>
-                  <span>left</span>
+                  <span><%= t(".left") %></span>
                 </dd>
               <% else %>
                 <dd class="text-primary flex items-center gap-1 text-green-500 font-medium privacy-sensitive">
                   <%= icon "check-circle", size: "sm", color: "success" %>
                   <%= format_money @budget_category.available_to_spend_money %>
-                  <span>left</span>
+                  <span><%= t(".left") %></span>
                 </dd>
               <% end %>
             </div>
 
             <div class="flex items-center justify-between text-sm">
-              <dt class="text-secondary">Budgeted</dt>
+              <dt class="text-secondary"><%= t(".budgeted") %></dt>
               <dd class="text-primary font-medium privacy-sensitive">
                 <%= format_money @budget_category.budgeted_spending_money %>
               </dd>
@@ -71,14 +71,14 @@
           <% end %>
 
           <div class="flex items-center justify-between text-sm">
-            <dt class="text-secondary">Monthly average spending</dt>
+            <dt class="text-secondary"><%= t(".monthly_average_spending") %></dt>
             <dd class="text-primary font-medium privacy-sensitive">
               <%= @budget_category.avg_monthly_expense_money.format %>
             </dd>
           </div>
 
           <div class="flex items-center justify-between text-sm">
-            <dt class="text-secondary">Monthly median spending</dt>
+            <dt class="text-secondary"><%= t(".monthly_median_spending") %></dt>
             <dd class="text-primary font-medium privacy-sensitive">
               <%= @budget_category.median_monthly_expense_money.format %>
             </dd>
@@ -87,7 +87,7 @@
       </div>
     <% end %>
 
-    <% dialog.with_section(title: "Recent Transactions", open: true) do %>
+    <% dialog.with_section(title: t(".recent_transactions"), open: true) do %>
       <div class="space-y-2">
         <div class="px-3 py-4 space-y-2">
           <% if @recent_transactions.any? %>
@@ -120,7 +120,7 @@
             </ul>
 
             <%= render DS::Link.new(
-              text: "View all category transactions",
+              text: t(".view_all_transactions"),
               variant: "outline",
               full_width: true,
               href: transactions_path(q: {
@@ -132,7 +132,7 @@
             ) %>
           <% else %>
             <p class="text-secondary text-sm mb-4">
-              No transactions found for this budget period.
+              <%= t(".no_transactions") %>
             </p>
           <% end %>
         </div>
diff --git a/app/views/budgets/_actuals_summary.html.erb b/app/views/budgets/_actuals_summary.html.erb
index fe9509d9a..524fb0006 100644
--- a/app/views/budgets/_actuals_summary.html.erb
+++ b/app/views/budgets/_actuals_summary.html.erb
@@ -2,7 +2,7 @@
 
 <div>
   <div class="p-4 border-b border-secondary">
-    <h3 class="text-sm text-secondary mb-2">Income</h3>
+    <h3 class="text-sm text-secondary mb-2"><%= t(".income") %></h3>
 
     <span class="inline-block mb-2 text-xl font-medium text-primary privacy-sensitive">
       <%= budget.actual_income_money.format %>
@@ -30,7 +30,7 @@
   </div>
 
   <div class="p-4">
-    <h3 class="text-sm text-secondary mb-2">Expenses</h3>
+    <h3 class="text-sm text-secondary mb-2"><%= t(".expenses") %></h3>
 
     <span class="inline-block mb-2 text-xl font-medium text-primary privacy-sensitive"><%= budget.actual_spending_money.format %></span>
 
diff --git a/app/views/budgets/_budget_categories.html.erb b/app/views/budgets/_budget_categories.html.erb
index 46824bac3..addb349f3 100644
--- a/app/views/budgets/_budget_categories.html.erb
+++ b/app/views/budgets/_budget_categories.html.erb
@@ -1,44 +1,34 @@
 <%# locals: (budget:) %>
 
-<div>
-  <div class="flex items-center gap-1.5 px-4 py-2 text-xs font-medium text-secondary uppercase">
-    <p>Categories</p>
-    <span class="text-subdued">&middot;</span>
-    <p><%= budget.budget_categories.count %></p>
+<% categories_state = budget_categories_view_state(budget) %>
+<% uncategorized_budget_category = categories_state[:uncategorized_budget_category] %>
+<% visible_expenses_empty = categories_state[:visible_expenses_empty] %>
+<% over_budget_groups = categories_state[:over_budget_groups] %>
+<% show_over_budget_uncategorized = categories_state[:show_over_budget_uncategorized] %>
+<% over_budget_count = categories_state[:over_budget_count] %>
+<% on_track_groups = categories_state[:on_track_groups] %>
+<% show_on_track_uncategorized = categories_state[:show_on_track_uncategorized] %>
+<% on_track_count = categories_state[:on_track_count] %>
 
-    <p class="ml-auto">Amount</p>
-  </div>
+<div class="space-y-4">
 
-  <div class="bg-container py-1 shadow-border-xs rounded-md">
-    <% if budget.family.categories.expenses.empty? %>
-      <div class="py-8">
-        <%= render "budget_categories/no_categories" %>
-      </div>
-    <% else %>
-      <% category_groups = BudgetCategory::Group.for(budget.budget_categories) %>
+  <% if over_budget_count.positive? %>
+    <%= render "budgets/category_section",
+      budget: budget,
+      count: over_budget_count,
+      groups: over_budget_groups,
+      uncategorized: uncategorized_budget_category,
+      show_uncategorized: show_over_budget_uncategorized,
+      over_budget_mode: true %>
+  <% end %>
 
-      <% category_groups.each_with_index do |group, index| %>
-        <div class="py-2">
-          <%= render "budget_categories/budget_category", budget_category: group.budget_category %>
+  <%= render "budgets/category_section",
+    budget: budget,
+    count: on_track_count,
+    groups: on_track_groups,
+    uncategorized: uncategorized_budget_category,
+    show_uncategorized: show_on_track_uncategorized,
+    over_budget_mode: false
+  %>
 
-          <div>
-            <% group.budget_subcategories.each do |budget_subcategory| %>
-              <div class="w-full flex items-start">
-                <div class="ml-8 pt-4 flex items-center justify-center text-subdued">
-                  <%= icon "corner-down-right" %>
-                </div>
-
-                <%= render "budget_categories/budget_category", budget_category: budget_subcategory %>
-              </div>
-            <% end %>
-          </div>
-        </div>
-
-        <%= render "shared/ruler" %>
-      <% end %>
-      <div class="py-2">
-        <%= render "budget_categories/budget_category", budget_category: budget.uncategorized_budget_category %>
-      </div>
-    <% end %>
-  </div>
-</div>
+</div>
\ No newline at end of file
diff --git a/app/views/budgets/_budget_donut.html.erb b/app/views/budgets/_budget_donut.html.erb
index 8879d9bfc..15c88046f 100644
--- a/app/views/budgets/_budget_donut.html.erb
+++ b/app/views/budgets/_budget_donut.html.erb
@@ -4,8 +4,8 @@
   <div data-donut-chart-target="contentContainer" class="flex justify-center items-center h-full">
     <div data-donut-chart-target="defaultContent" class="flex flex-col items-center">
       <% if budget.initialized? %>
-        <div class="text-gray-600 text-sm mb-2">
-          <span>Spent</span>
+        <div class="text-secondary text-sm mb-2">
+          <span><%= t(".spent") %></span>
         </div>
 
         <div class="mb-2 text-3xl font-medium privacy-sensitive <%= budget.available_to_spend.negative? ? "text-red-500" : "text-primary" %>">
@@ -13,7 +13,7 @@
         </div>
 
         <%= render DS::Link.new(
-          text: "of #{budget.budgeted_spending_money.format}",
+          text: t(".of_budget", amount: budget.budgeted_spending_money.format),
           variant: "secondary",
           icon: "pencil",
           icon_position: "right",
@@ -26,7 +26,7 @@
         </div>
 
         <%= render DS::Link.new(
-          text: "New budget",
+          text: t(".new_budget"),
           size: "sm",
           icon: "plus",
           href: edit_budget_path(budget)
@@ -47,7 +47,7 @@
           </p>
 
           <%= render DS::Link.new(
-            text: "of #{bc.budgeted_spending_money.format(precision: 0)}",
+            text: t(".of_budget", amount: bc.budgeted_spending_money.format(precision: 0)),
             variant: "secondary",
             icon: "pencil",
             icon_position: "right",
@@ -59,7 +59,7 @@
     <% end %>
 
     <div id="segment_unused" class="hidden">
-      <p class="text-sm text-secondary text-center mb-2">Unused</p>
+      <p class="text-sm text-secondary text-center mb-2"><%= t(".unused") %></p>
 
       <p class="text-3xl font-medium text-primary privacy-sensitive">
         <%= format_money(budget.available_to_spend_money) %>
diff --git a/app/views/budgets/_budget_header.html.erb b/app/views/budgets/_budget_header.html.erb
index 6f7d59fce..b1df7cee7 100644
--- a/app/views/budgets/_budget_header.html.erb
+++ b/app/views/budgets/_budget_header.html.erb
@@ -27,20 +27,20 @@
     <% end %>
   </div>
 
-  <%= render DS::Menu.new(variant: "button") do |menu| %>
-    <% menu.with_button class: "flex items-center gap-1 hover:bg-alpha-black-25 cursor-pointer rounded-md p-2"  do %>
+  <%= render DS::Popover.new(variant: "button") do |popover| %>
+    <% popover.with_button class: "flex items-center gap-1 hover:bg-alpha-black-25 cursor-pointer rounded-md p-2"  do %>
       <span class="text-primary font-medium text-lg lg:text-base"><%= @budget.name %></span>
       <%= icon("chevron-down") %>
     <% end %>
 
-    <% menu.with_custom_content do %>
+    <% popover.with_custom_content do %>
       <%= render "budgets/picker", family: Current.family, year: budget.start_date.year %>
     <% end %>
   <% end %>
 
   <div class="ml-auto">
     <%= render DS::Link.new(
-        text: "Today",
+        text: t(".today"),
         variant: "outline",
         href: budget_path(Budget.date_to_param(Date.current)),
     ) %>
diff --git a/app/views/budgets/_budget_nav.html.erb b/app/views/budgets/_budget_nav.html.erb
index 41d81a614..45c8f9e8d 100644
--- a/app/views/budgets/_budget_nav.html.erb
+++ b/app/views/budgets/_budget_nav.html.erb
@@ -16,7 +16,7 @@
                   step[:is_complete] ? "text-green-600" : "text-secondary"
                 end %>
       <% step_class = if is_current
-                  "bg-primary text-primary"
+                  "bg-inverse text-inverse"
                 else
                   step[:is_complete] ? "bg-green-600/10 border-alpha-black-25" : "bg-container-inset"
                 end %>
diff --git a/app/views/budgets/_budget_tabs.html.erb b/app/views/budgets/_budget_tabs.html.erb
new file mode 100644
index 000000000..cdb82ba31
--- /dev/null
+++ b/app/views/budgets/_budget_tabs.html.erb
@@ -0,0 +1,31 @@
+<div class="w-full flex justify-center">
+    <div class="max-w-full w-full lg:w-auto overflow-x-auto no-scrollbar">
+        <div class="w-full inline-flex whitespace-nowrap bg-container-inset rounded-lg p-1 text-sm font-medium gap-0.5">
+
+        <button
+            data-action="click->budget-filter#setFilter"
+            data-budget-filter-filter-param="all"
+            data-budget-filter-target="tab"
+            class="w-full inline-flex justify-center items-center text-sm font-medium px-2 py-1 rounded-md transition-colors duration-200 bg-white theme-dark:bg-gray-700 text-primary shadow-sm">
+            <%= t("budgets.show.filter.all") %>
+        </button>
+
+        <button
+            data-action="click->budget-filter#setFilter"
+            data-budget-filter-filter-param="over_budget"
+            data-budget-filter-target="tab"
+            class="w-full inline-flex justify-center items-center text-sm font-medium px-2 py-1 rounded-md transition-colors duration-200 shadow-sm">
+            <%= t("budgets.show.filter.over_budget") %>
+        </button>
+
+        <button
+            data-action="click->budget-filter#setFilter"
+            data-budget-filter-filter-param="on_track"
+            data-budget-filter-target="tab"
+            class="w-full inline-flex justify-center items-center text-sm font-medium px-2 py-1 rounded-md transition-colors duration-200 shadow-sm">
+            <%= t("budgets.show.filter.on_track") %>
+        </button>
+
+        </div>
+    </div>
+</div>
\ No newline at end of file
diff --git a/app/views/budgets/_budgeted_summary.html.erb b/app/views/budgets/_budgeted_summary.html.erb
index 07905d0d3..86a9f1210 100644
--- a/app/views/budgets/_budgeted_summary.html.erb
+++ b/app/views/budgets/_budgeted_summary.html.erb
@@ -2,7 +2,7 @@
 
 <div>
   <div class="p-4 border-b border-secondary">
-    <h3 class="text-sm text-secondary mb-2">Expected income</h3>
+    <h3 class="text-sm text-secondary mb-2"><%= t(".expected_income") %></h3>
 
     <span class="inline-block mb-2 text-xl font-medium text-primary privacy-sensitive">
       <%= format_money(budget.expected_income_money) %>
@@ -19,12 +19,12 @@
         <% end %>
       </div>
       <div class="flex justify-between text-sm privacy-sensitive">
-        <p class="text-secondary"><%= format_money(budget.actual_income_money) %> earned</p>
+        <p class="text-secondary"><%= t(".earned", amount: format_money(budget.actual_income_money)) %></p>
         <p class="font-medium">
           <% if budget.remaining_expected_income.negative? %>
-            <span class="text-green-500"><%= format_money(budget.remaining_expected_income_money.abs) %> over</span>
+            <span class="text-green-500"><%= t(".over", amount: format_money(budget.remaining_expected_income_money.abs)) %></span>
           <% else %>
-            <span class="text-primary"><%= format_money(budget.remaining_expected_income_money) %> left</span>
+            <span class="text-primary"><%= t(".left", amount: format_money(budget.remaining_expected_income_money)) %></span>
           <% end %>
         </p>
       </div>
@@ -32,7 +32,7 @@
   </div>
 
   <div class="p-4">
-    <h3 class="text-sm text-secondary mb-2">Budgeted</h3>
+    <h3 class="text-sm text-secondary mb-2"><%= t(".budgeted") %></h3>
 
     <span class="inline-block mb-2 text-xl font-medium text-primary privacy-sensitive">
       <%= format_money(budget.budgeted_spending_money) %>
@@ -49,12 +49,12 @@
         <% end %>
       </div>
       <div class="flex justify-between text-sm privacy-sensitive">
-        <p class="text-secondary"><%= format_money(budget.actual_spending_money) %> spent</p>
+        <p class="text-secondary"><%= t(".spent", amount: format_money(budget.actual_spending_money)) %></p>
         <p class="font-medium">
           <% if budget.available_to_spend.negative? %>
-            <span class="text-destructive"><%= format_money(budget.available_to_spend_money.abs) %> over</span>
+            <span class="text-destructive"><%= t(".over", amount: format_money(budget.available_to_spend_money.abs)) %></span>
           <% else %>
-            <span class="text-primary"><%= format_money(budget.available_to_spend_money) %> left</span>
+            <span class="text-primary"><%= t(".left", amount: format_money(budget.available_to_spend_money)) %></span>
           <% end %>
         </p>
       </div>
diff --git a/app/views/budgets/_category_group.html.erb b/app/views/budgets/_category_group.html.erb
new file mode 100644
index 000000000..7ef0ad347
--- /dev/null
+++ b/app/views/budgets/_category_group.html.erb
@@ -0,0 +1,28 @@
+<%# locals: (group:, parent_visible:, over_budget_mode: false) %>
+
+<% if parent_visible %>
+  <div class="py-2">
+    <%= render "budget_categories/budget_category",
+      budget_category: group.budget_category,
+      show_budget_meta: (over_budget_mode ? group.budget_category.over_budget_with_budget? : true) %>
+  </div>
+<% end %>
+
+<% group.budget_subcategories.each do |budget_subcategory| %>
+  <% if parent_visible %>
+    <div class="py-2 w-full flex items-start">
+      <div class="ml-8 pt-4 flex items-center justify-center text-subdued">
+        <%= icon "corner-down-right" %>
+      </div>
+      <%= render "budget_categories/budget_category",
+        budget_category: budget_subcategory,
+        show_budget_meta: (over_budget_mode ? budget_subcategory.over_budget_with_budget? : true) %>
+    </div>
+  <% else %>
+    <div class="py-2">
+      <%= render "budget_categories/budget_category",
+        budget_category: budget_subcategory,
+        show_budget_meta: (over_budget_mode ? budget_subcategory.over_budget_with_budget? : true) %>
+    </div>
+  <% end %>
+<% end %>
diff --git a/app/views/budgets/_category_section.html.erb b/app/views/budgets/_category_section.html.erb
new file mode 100644
index 000000000..52d4c4980
--- /dev/null
+++ b/app/views/budgets/_category_section.html.erb
@@ -0,0 +1,56 @@
+<%# locals: (budget:, count:, groups:, uncategorized:, show_uncategorized:, over_budget_mode:) %>
+
+<%# derive display config from over_budget_mode %>
+<%
+  if over_budget_mode
+    target = "overBudget"
+    title = t("budgets.show.over_budget_categories.short_title")
+  else
+    target = "onTrack"
+    title = t("budgets.show.on_track_categories.short_title")
+  end
+%>
+
+<div class="bg-container-inset rounded-xl p-1" data-budget-filter-target="<%= target %>">
+
+  <!-- Section Header -->
+  <div class="flex items-center gap-1.5 px-4 py-2 text-xs font-medium text-secondary uppercase">
+    <p><%= title %></p>
+    <span class="text-subdued">&middot;</span>
+    <p><%= count %></p>
+    <p class="ml-auto"><%= t("budgets.show.categories.amount") %></p>
+  </div>
+
+  <!-- Section Body -->
+  <div class="bg-container py-1 shadow-border-xs rounded-md">
+
+    <% groups.each_with_index do |group, index| %>
+
+      <%# derive parent visibility based on mode %>
+      <%
+        parent_visible =
+          if over_budget_mode
+            group.budget_category.any_over_budget?
+          else
+            budget.initialized? ? group.budget_category.visible_on_track? : true
+          end
+      %>
+    <%= render "shared/ruler" unless index == 0 %>
+      <%= render "budgets/category_group",
+        group: group,
+        parent_visible: parent_visible,
+        over_budget_mode: over_budget_mode %>
+
+    <% end %>
+
+    <% if show_uncategorized %>
+      <%= render "shared/ruler" unless groups.size == 0 %>
+      <div class="py-2">
+        <%= render "budget_categories/budget_category",
+          budget_category: uncategorized,
+          show_budget_meta: (over_budget_mode ? uncategorized.over_budget_with_budget? : true) %>
+      </div>
+    <% end %>
+
+  </div>
+</div>
\ No newline at end of file
diff --git a/app/views/budgets/_over_allocation_warning.html.erb b/app/views/budgets/_over_allocation_warning.html.erb
index bd75fba28..16ebf72e6 100644
--- a/app/views/budgets/_over_allocation_warning.html.erb
+++ b/app/views/budgets/_over_allocation_warning.html.erb
@@ -2,10 +2,10 @@
 
 <div class="flex flex-col gap-4 items-center justify-center h-full">
   <%= icon "alert-triangle", size: "lg", color: "destructive" %>
-  <p class="text-secondary text-sm text-center">You have over-allocated your budget.  Please fix your allocations.</p>
+  <p class="text-secondary text-sm text-center"><%= t(".over_allocated_message") %></p>
 
   <%= render DS::Link.new(
-    text: "Fix allocations",
+    text: t(".fix_allocations"),
     variant: "secondary",
     size: "sm",
     icon: "pencil",
diff --git a/app/views/budgets/_picker.html.erb b/app/views/budgets/_picker.html.erb
index a1deaea03..47e2ba43f 100644
--- a/app/views/budgets/_picker.html.erb
+++ b/app/views/budgets/_picker.html.erb
@@ -15,7 +15,7 @@
         </span>
       <% end %>
 
-      <span class="w-40 text-center px-3 py-2 border border-tertiary rounded-md" data-budget-picker-target="year">
+      <span class="w-40 text-center px-3 py-2">
         <%= year %>
       </span>
 
diff --git a/app/views/budgets/edit.html.erb b/app/views/budgets/edit.html.erb
index 3ec00b220..abe757af6 100644
--- a/app/views/budgets/edit.html.erb
+++ b/app/views/budgets/edit.html.erb
@@ -8,24 +8,24 @@
 <div>
   <div class="space-y-4">
     <div class="text-center space-y-2">
-      <h1 class="text-3xl text-primary font-medium">Setup your budget</h1>
+      <h1 class="text-3xl text-primary font-medium"><%= t(".setup_title") %></h1>
       <p class="text-secondary text-sm max-w-sm mx-auto">
-        Enter your monthly earnings and planned spending below to setup your budget.
+        <%= t(".setup_description") %>
       </p>
     </div>
 
     <div class="mx-auto max-w-lg">
       <%= styled_form_with model: @budget, class: "space-y-3", data: { controller: "budget-form" } do |f| %>
-        <%= f.money_field :budgeted_spending, label: "Budgeted spending", required: true, disable_currency: true %>
-        <%= f.money_field :expected_income, label: "Expected income", required: true, disable_currency: true %>
+        <%= f.money_field :budgeted_spending, label: t(".budgeted_spending"), required: true, disable_currency: true %>
+        <%= f.money_field :expected_income, label: t(".expected_income"), required: true, disable_currency: true %>
 
         <% if @budget.estimated_income && @budget.estimated_spending %>
           <div class="border border-tertiary rounded-lg p-3 flex">
             <%= icon "sparkles" %>
             <div class="ml-2 space-y-1 text-sm">
-              <h4 class="text-primary">Autosuggest income & spending budget</h4>
+              <h4 class="text-primary"><%= t(".autosuggest_title") %></h4>
               <p class="text-secondary">
-                This will be based on transaction history. AI can make mistakes, verify before continuing.
+                <%= t(".autosuggest_description") %>
               </p>
             </div>
 
@@ -40,7 +40,7 @@
           </div>
         <% end %>
 
-        <%= f.submit "Continue" %>
+        <%= f.submit t(".continue") %>
       <% end %>
     </div>
   </div>
diff --git a/app/views/budgets/show.html.erb b/app/views/budgets/show.html.erb
index 768cf7727..0df039ba5 100644
--- a/app/views/budgets/show.html.erb
+++ b/app/views/budgets/show.html.erb
@@ -47,23 +47,39 @@
     </div>
 
     <%# Bottom Section: Categories full width %>
-    <div class="w-full bg-container rounded-xl shadow-border-xs p-4">
-      <div class="flex items-center justify-between mb-4">
-        <h2 class="text-lg font-medium">Categories</h2>
+    <% has_over_budget = budget_has_over_budget?(@budget) %>
+    <%= content_tag :div,
+      class: "w-full bg-container rounded-xl shadow-border-xs p-4",
+      data: (has_over_budget ? { controller: "budget-filter" } : {}) do %>
+      <div class="flex items-center mb-4 flex-nowrap justify-between">
+        <h2 class="text-lg font-medium shrink-0">
+          <%= t("budgets.show.categories.title") %>
+        </h2>
 
-        <% if @budget.initialized? %>
-          <%= render DS::Link.new(
-            text: "Edit",
-            variant: "secondary",
-            icon: "settings-2",
-            href: budget_budget_categories_path(@budget)
-          ) %>
+        <% if has_over_budget %>
+          <div class="hidden lg:flex flex-1 min-w-0 px-1">
+            <%= render "budgets/budget_tabs" %>
+          </div>
         <% end %>
-      </div>
 
-      <div class="bg-container-inset rounded-xl p-1">
-        <%= render "budgets/budget_categories", budget: @budget %>
+        <div class="<%= has_over_budget ? "shrink-0 flex justify-end whitespace-nowrap" : "ml-auto" %>">
+          <% if @budget.initialized? %>
+            <%= render DS::Link.new(
+              text: t("budgets.show.categories.edit"),
+              variant: "secondary",
+              icon: "settings-2",
+              href: budget_budget_categories_path(@budget)
+            ) %>
+          <% end %>
+        </div>
       </div>
-    </div>
+      <% if has_over_budget %>
+        <div class="flex lg:hidden flex-1 min-w-0 mb-4">
+          <%= render "budgets/budget_tabs" %>
+        </div>
+      <% end %>
+
+      <%= render "budgets/budget_categories", budget: @budget %>
+    <% end %>
   </div>
 </div>
diff --git a/app/views/categories/_badge.html.erb b/app/views/categories/_badge.html.erb
index 10135c251..5570f2c70 100644
--- a/app/views/categories/_badge.html.erb
+++ b/app/views/categories/_badge.html.erb
@@ -1,15 +1,17 @@
 <%# locals: (category:) %>
 <% category ||= Category.uncategorized %>
 
-<div>
-  <span class="flex items-center gap-1 text-sm font-medium rounded-full px-1.5 py-1 border truncate focus-visible:outline-none focus-visible:ring-0"
+<div class="min-w-0 w-full">
+  <span class="flex w-full items-center gap-1 text-sm font-medium rounded-full px-1.5 py-1 border focus-visible:outline-none focus-visible:ring-0"
         style="
           background-color: color-mix(in oklab, <%= category.color %> 10%, transparent);
           border-color: color-mix(in oklab, <%= category.color %> 10%, transparent);
           color: <%= category.color %>;">
     <% if category.lucide_icon.present? %>
-      <%= icon category.lucide_icon, size: "sm", color: "current" %>
+      <span class="shrink-0">
+        <%= icon category.lucide_icon, size: "sm", color: "current" %>
+      </span>
     <% end %>
-    <%= category.name %>
+    <span class="min-w-0 flex-1 truncate" data-testid="category-name"><%= category.name %></span>
   </span>
 </div>
diff --git a/app/views/categories/_category.html.erb b/app/views/categories/_category.html.erb
index dbc9b80fe..1460fe5d6 100644
--- a/app/views/categories/_category.html.erb
+++ b/app/views/categories/_category.html.erb
@@ -1,7 +1,7 @@
 <%# locals: (category:) %>
 
-<div id="<%= dom_id(category) %>" class="flex justify-between items-center px-4 pb-4 <%= "pt-4" unless category.subcategory? %> <%= "pb-4" unless category.subcategories.any? %> bg-container">
-  <div class="flex w-full items-center gap-2.5">
+<div id="<%= dom_id(category) %>" class="flex items-center gap-3 px-4 pb-4 <%= "pt-4" unless category.subcategory? %> <%= "pb-4" unless category.subcategories.any? %> bg-container">
+  <div class="flex min-w-0 flex-1 items-center gap-2.5" data-testid="category-content">
     <% if category.subcategory? %>
       <span style="color: <%= category.color %>">
         <%= icon "corner-down-right", size: "sm", color: "current", class: "ml-2" %>
@@ -11,7 +11,7 @@
     <%= render partial: "categories/badge", locals: { category: category } %>
   </div>
 
-  <div class="justify-self-end">
+  <div class="shrink-0" data-testid="category-actions">
     <%= render DS::Menu.new do |menu| %>
       <% menu.with_item(variant: "link", text: t(".edit"), icon: "pencil", href: edit_category_path(category), data: { turbo_frame: :modal }) %>
 
diff --git a/app/views/categories/_category_name_mobile.html.erb b/app/views/categories/_category_name_mobile.html.erb
index 2f9bd07cb..36c13021c 100644
--- a/app/views/categories/_category_name_mobile.html.erb
+++ b/app/views/categories/_category_name_mobile.html.erb
@@ -1,4 +1,4 @@
-<span id="category_name_mobile_<%= transaction.id %>" class="text-secondary lg:hidden">
+<span id="category_name_mobile_<%= transaction.id %>" class="text-secondary lg:hidden min-w-0 truncate">
   <% if transaction.transfer&.categorizable? || transaction.transfer.nil? %>
     <%= transaction.category&.name || Category.uncategorized.name %>
   <% else %>
diff --git a/app/views/categories/_form.html.erb b/app/views/categories/_form.html.erb
index 1f3e5fbeb..8cc890885 100644
--- a/app/views/categories/_form.html.erb
+++ b/app/views/categories/_form.html.erb
@@ -14,7 +14,7 @@
           <div class="fixed right-0 sm:right-auto mx-2 sm:ml-8 sm:mr-0 mt-2 z-50 bg-container p-4 border border-alpha-black-25 rounded-2xl shadow-xs h-fit" data-category-target="popup">
             <div class="flex gap-2 flex-col mb-4" data-category-target="selection" style="<%= "display:none;" if @category.subcategory? %>">
               <div data-category-target="pickerSection"></div>
-              <h4 class="text-gray-500 text-sm">Color</h4>
+              <h4 class="text-secondary text-sm"><%= t(".color") %></h4>
               <div class="flex flex-wrap md:flex-nowrap gap-2 items-center" data-category-target="colorsSection">
                 <% Category::COLORS.each do |color| %>
                   <label class="relative">
@@ -34,14 +34,14 @@
                   <%= icon "palette", size: "2xl", data: { action: "click->category#toggleSections" } %>
                 </div>
                 <div data-category-target="validationMessage" class="hidden self-start flex gap-1 items-center text-xs text-destructive ">
-                  <span>Poor contrast, choose darker color or</span>
-                  <button type="button" class="underline cursor-pointer" data-action="category#autoAdjust">auto-adjust.</button>
+                  <span><%= t(".poor_contrast") %></span>
+                  <button type="button" class="underline cursor-pointer" data-action="category#autoAdjust"><%= t(".auto_adjust") %></button>
                 </div>
               </div>
             </div>
 
             <div class="flex flex-wrap gap-2 justify-center flex-col w-auto md:w-87">
-              <h4 class="text-secondary text-sm">Icon</h4>
+              <h4 class="text-secondary text-sm"><%= t(".icon") %></h4>
               <div class="flex flex-wrap gap-0.5 max-h-52 overflow-auto">
                 <% Category.icon_codes.each do |icon| %>
                   <label class="relative">
@@ -62,9 +62,9 @@
       <% end %>
 
       <div class="space-y-2">
-        <%= f.text_field :name, placeholder: t(".placeholder"), required: true, autofocus: true, label: "Name", data: { color_avatar_target: "name" } %>
+        <%= f.text_field :name, placeholder: t(".placeholder"), required: true, autofocus: true, label: t(".name_label"), data: { color_avatar_target: "name" } %>
         <% unless category.parent? %>
-          <%= f.select :parent_id, categories.pluck(:name, :id), { include_blank: "(unassigned)", label: "Parent category (optional)" }, disabled: category.parent?, data: { action: "change->category#handleParentChange" } %>
+          <%= f.select :parent_id, categories.pluck(:name, :id), { include_blank: t(".unassigned"), label: t(".parent_category_label") }, disabled: category.parent?, data: { action: "change->category#handleParentChange" } %>
         <% end %>
       </div>
     </section>
diff --git a/app/views/categories/_menu.html.erb b/app/views/categories/_menu.html.erb
index ad7dc4f5c..321f91f9c 100644
--- a/app/views/categories/_menu.html.erb
+++ b/app/views/categories/_menu.html.erb
@@ -1,8 +1,8 @@
-<%# locals: (transaction:) %>
+<%# locals: (transaction:, in_split_group: false) %>
 
-<%= render DS::Menu.new(variant: "button") do |menu| %>
-  <% menu.with_button do %>
-    <div class="hidden lg:flex">
+<%= render DS::Popover.new(variant: "button") do |popover| %>
+  <% popover.with_button(class: "block w-full overflow-hidden") do %>
+    <div class="hidden min-w-0 w-full lg:flex">
       <%= render partial: "categories/badge", locals: { category: transaction.category } %>
     </div>
     <div class="flex lg:hidden">
@@ -10,8 +10,8 @@
     </div>
   <% end %>
 
-  <% menu.with_custom_content do %>
-    <%= turbo_frame_tag "category_dropdown", src: category_dropdown_path(category_id: transaction.category_id, transaction_id: transaction.id), loading: :lazy do %>
+  <% popover.with_custom_content do %>
+    <%= turbo_frame_tag "category_dropdown", src: category_dropdown_path(category_id: transaction.category_id, transaction_id: transaction.id, grouped: in_split_group), loading: :lazy do %>
       <div class="p-6 flex items-center justify-center">
         <p class="text-sm text-secondary animate-pulse"><%= t(".loading") %></p>
       </div>
diff --git a/app/views/categories/index.html.erb b/app/views/categories/index.html.erb
index 8c5391831..7edac37eb 100644
--- a/app/views/categories/index.html.erb
+++ b/app/views/categories/index.html.erb
@@ -3,7 +3,7 @@
   <%= render DS::Menu.new do |menu| %>
     <% menu.with_item(
         variant: "button",
-        text: "Delete all",
+        text: t(".delete_all"),
         href: destroy_all_categories_path,
         method: :delete,
         icon: "trash-2",
diff --git a/app/views/category/deletions/new.html.erb b/app/views/category/deletions/new.html.erb
index cf06b137d..d594dba7a 100644
--- a/app/views/category/deletions/new.html.erb
+++ b/app/views/category/deletions/new.html.erb
@@ -16,6 +16,7 @@
 
       <%= render DS::Button.new(
         variant: "destructive",
+        type: :submit,
         text: t(".delete_and_leave_uncategorized", category_name: @category.name),
         full_width: true,
         data: { deletion_target: "destructiveSubmitButton" }
@@ -23,6 +24,7 @@
 
       <%= render DS::Button.new(
         text: t(".delete_and_recategorize", category_name: @category.name),
+        type: :submit,
         data: { deletion_target: "safeSubmitButton" },
         hidden: true,
         full_width: true
diff --git a/app/views/category/dropdowns/_row.html.erb b/app/views/category/dropdowns/_row.html.erb
index fbf6cf421..067286e24 100644
--- a/app/views/category/dropdowns/_row.html.erb
+++ b/app/views/category/dropdowns/_row.html.erb
@@ -10,6 +10,7 @@
       data: { filter_name: category.name } do %>
   <%= button_to transaction_category_path(
         @transaction.entry,
+        grouped: params[:grouped],
         entry: {
           entryable_type: "Transaction",
           entryable_attributes: { id: @transaction.id, category_id: category.id }
@@ -28,7 +29,7 @@
     <%= render partial: "categories/badge", locals: { category: category } %>
   <% end %>
 
-  <%= render DS::Menu.new do |menu| %>
+  <%= render DS::Menu.new(variant: :icon_sm) do |menu| %>
     <% menu.with_item(variant: "link", text: t(".edit"), icon: "pencil-line", href: edit_category_path(category), data: { turbo_frame: :modal }) %>
     <% menu.with_item(variant: "link", text: t(".delete"), icon: "trash-2", href: new_category_deletion_path(category), data: { turbo_frame: :modal }, destructive: true) %>
   <% end %>
diff --git a/app/views/category/dropdowns/show.html.erb b/app/views/category/dropdowns/show.html.erb
index 234c31463..27a272ea4 100644
--- a/app/views/category/dropdowns/show.html.erb
+++ b/app/views/category/dropdowns/show.html.erb
@@ -51,7 +51,7 @@
           <%= button_to transaction_path(@transaction.entry),
                       method: :patch,
                       data: { turbo_frame: dom_id(@transaction.entry) },
-                      params: { entry: { entryable_type: "Transaction", entryable_attributes: { id: @transaction.id, category_id: nil } } },
+                      params: { grouped: params[:grouped], entry: { entryable_type: "Transaction", entryable_attributes: { id: @transaction.id, category_id: nil } } },
                       class: "flex text-sm font-medium items-center gap-2 text-secondary w-full rounded-lg p-2 hover:bg-container-inset-hover" do %>
             <%= icon("minus") %>
 
@@ -65,7 +65,7 @@
                   data: { turbo_frame: "modal" } do %>
             <%= icon("refresh-cw") %>
 
-            <p>Match transfer/payment</p>
+            <p><%= t(".match_transfer") %></p>
           <% end %>
         <% end %>
 
@@ -85,6 +85,7 @@
                         method: :patch,
                         data: { controller: "auto-submit-form" } do |f| %>
               <%= f.hidden_field "entry[excluded]", value: !@transaction.entry.excluded %>
+              <%= hidden_field_tag :grouped, "true" if params[:grouped] == "true" %>
               <%= f.check_box "entry[excluded]",
                           checked: @transaction.entry.excluded,
                           class: "checkbox checkbox--light",
@@ -92,7 +93,7 @@
             <% end %>
           </div>
 
-          <p>One-time <%= @transaction.entry.amount.negative? ? "income" : "expense" %></p>
+          <p><%= t(".one_time", type: @transaction.entry.amount.negative? ? t(".income") : t(".expense")) %></p>
 
           <span class="text-orange-500 ml-auto">
             <%= icon("asterisk", color: "current") %>
diff --git a/app/views/chats/_ai_consent.html.erb b/app/views/chats/_ai_consent.html.erb
index 3e9437508..03266a810 100644
--- a/app/views/chats/_ai_consent.html.erb
+++ b/app/views/chats/_ai_consent.html.erb
@@ -3,14 +3,13 @@
     <%= render "chats/ai_avatar" %>
   </div>
 
-  <h3 class="text-sm font-medium text-primary mb-1 -mt-2 text-center">Enable AI Chats</h3>
+  <h3 class="text-sm font-medium text-primary mb-1 -mt-2 text-center"><%= t(".title") %></h3>
 
-  <p class="text-gray-600 mb-4 text-sm text-center">
+  <p class="text-secondary mb-4 text-sm text-center">
     <% if Current.user.ai_available? %>
-      AI chat can answer financial questions and provide insights based on your data. To use this feature you'll need to explicitly enable it.
+      <%= t(".available_description") %>
     <% else %>
-      To use the AI assistant, you need to set the <code class="bg-surface-inset px-1 py-0.5 rounded font-mono text-xs">OPENAI_ACCESS_TOKEN</code>
-      environment variable or configure it in the Self-Hosting settings of your instance.
+      <%= t(".unavailable_description_html") %>
     <% end %>
   </p>
 
@@ -18,9 +17,9 @@
     <%= form_with url: user_path(Current.user), method: :patch, class: "w-full", data: { turbo: false } do |form| %>
       <%= form.hidden_field "user[ai_enabled]", value: true %>
       <%= form.hidden_field "user[redirect_to]", value: "home" %>
-      <%= form.submit "Enable AI Chats", class: "cursor-pointer hover:bg-inverse-hover w-full py-2 px-4 bg-inverse fg-inverse rounded-lg text-sm font-medium" %>
+      <%= form.submit t(".enable_button"), class: "cursor-pointer hover:bg-inverse-hover w-full py-2 px-4 bg-inverse text-inverse rounded-lg text-sm font-medium" %>
     <% end %>
   <% end %>
 
-  <p class="text-xs text-secondary text-center mt-2">Disable anytime.  All data sent to our LLM providers is anonymized.</p>
+  <p class="text-xs text-secondary text-center mt-2"><%= t(".disable_note") %></p>
 </div>
diff --git a/app/views/chats/_ai_greeting.html.erb b/app/views/chats/_ai_greeting.html.erb
index e04b9bc51..f5baa52c6 100644
--- a/app/views/chats/_ai_greeting.html.erb
+++ b/app/views/chats/_ai_greeting.html.erb
@@ -2,27 +2,27 @@
   <%= render "chats/ai_avatar" %>
 
   <div class="max-w-[85%] text-sm space-y-4 text-primary">
-    <p>Hey <%= Current.user&.first_name || "there" %>! I'm an AI/large-language-model that can help with your finances. I have access to the web and your account data.</p>
+    <p><%= t(".greeting", name: Current.user&.first_name || t(".there")) %></p>
 
     <p>
-      You can use <span class="bg-container border border-secondary px-1.5 py-0.5 rounded font-mono text-xs">/</span> to access commands
+      <%= t(".commands_hint_html") %>
     </p>
 
     <div class="space-y-3">
-      <p>Here's a few questions you can ask:</p>
+      <p><%= t(".questions_intro") %></p>
 
       <% questions = [
         {
           icon: "chart-area",
-          text: "Evaluate investment portfolio"
+          text: t(".evaluate_portfolio")
         },
         {
           icon: "wallet-minimal",
-          text: "Show spending insights"
+          text: t(".spending_insights")
         },
         {
           icon: "alert-triangle",
-          text: "Find unusual patterns"
+          text: t(".unusual_patterns")
         }
       ] %>
 
@@ -30,7 +30,7 @@
         <% questions.each do |question| %>
           <button data-action="chat#submitSampleQuestion"
                   data-chat-question-param="<%= question[:text] %>"
-                  class="w-fit flex items-center gap-2 border border-tertiary rounded-full py-1.5 px-2.5 hover:bg-gray-100">
+                  class="w-fit flex items-center gap-2 border border-tertiary rounded-full py-1.5 px-2.5 hover:bg-surface-inset">
             <%= icon(question[:icon]) %> <%= question[:text] %>
           </button>
         <% end %>
diff --git a/app/views/chats/_chat.html.erb b/app/views/chats/_chat.html.erb
index fc082f377..d10d9f771 100644
--- a/app/views/chats/_chat.html.erb
+++ b/app/views/chats/_chat.html.erb
@@ -14,14 +14,14 @@
   <%= render DS::Menu.new(icon_vertical: true) do |menu| %>
     <% menu.with_item(
       variant: "link",
-      text: "Edit chat title",
+      text: t(".edit_chat_title"),
       href: edit_chat_path(chat, ctx: "list"),
       icon: "pencil",
       frame: dom_id(chat, "title")) %>
 
     <% menu.with_item(
       variant: "button",
-      text: "Delete chat",
+      text: t(".delete_chat"),
       href: chat_path(chat),
       icon: "trash-2",
       method: :delete,
diff --git a/app/views/chats/_chat_nav.html.erb b/app/views/chats/_chat_nav.html.erb
index 6cf7d28f2..ea093fc61 100644
--- a/app/views/chats/_chat_nav.html.erb
+++ b/app/views/chats/_chat_nav.html.erb
@@ -10,7 +10,7 @@
       icon: "menu",
       href: path,
       frame: chat_frame,
-      text: "All chats"
+      text: t(".all_chats")
     ) %>
 
     <div class="grow">
@@ -19,19 +19,19 @@
   </div>
 
   <%= render DS::Menu.new(icon_vertical: true) do |menu| %>
-    <% menu.with_item(variant: "link", text: "Start new chat", href: new_chat_path, icon: "plus") %>
+    <% menu.with_item(variant: "link", text: t(".start_new_chat"), href: new_chat_path, icon: "plus") %>
 
     <% unless chat.new_record? %>
       <% menu.with_item(
         variant: "link",
-        text: "Edit chat title",
+        text: t(".edit_chat_title"),
         href: edit_chat_path(chat, ctx: "chat"),
         icon: "pencil",
         frame: dom_id(chat, "title")) %>
 
       <% menu.with_item(
         variant: "button",
-        text: "Delete chat",
+        text: t(".delete_chat"),
         href: chat_path(chat),
         icon: "trash-2",
         method: :delete,
diff --git a/app/views/chats/_error.html.erb b/app/views/chats/_error.html.erb
index bbcb75818..c4ea7b912 100644
--- a/app/views/chats/_error.html.erb
+++ b/app/views/chats/_error.html.erb
@@ -1,17 +1,17 @@
 <%# locals: (chat:) %>
 
-<div id="chat-error" class="px-3 py-2 bg-red-100 border border-red-500 rounded-lg">
+<div id="<%= chat.error_target %>" class="px-3 py-2 bg-red-100 border border-red-500 rounded-lg">
   <% if chat.debug_mode? %>
     <div class="overflow-x-auto text-xs p-4 bg-red-200 rounded-md mb-2">
-      <code><%= chat.error %></code>
+      <code><%= chat.technical_error_message %></code>
     </div>
   <% end %>
 
   <div class="flex items-center justify-between gap-2">
-    <p class="text-xs text-red-500">Failed to generate response.  Please try again.</p>
+    <p class="text-xs text-red-500"><%= chat.presentable_error_message %></p>
 
     <%= render DS::Button.new(
-      text: "Retry",
+      text: t(".retry"),
       href: retry_chat_path(chat),
     ) %>
   </div>
diff --git a/app/views/chats/_thinking_indicator.html.erb b/app/views/chats/_thinking_indicator.html.erb
deleted file mode 100644
index e1ba89217..000000000
--- a/app/views/chats/_thinking_indicator.html.erb
+++ /dev/null
@@ -1,6 +0,0 @@
-<%# locals: (chat:, message: "Thinking ...") -%>
-
-<div id="thinking-indicator" class="flex items-start gap-3">
-  <%= render "chats/ai_avatar" %>
-  <p class="text-sm text-secondary animate-pulse"><%= message %></p>
-</div>
diff --git a/app/views/chats/index.html.erb b/app/views/chats/index.html.erb
index 801865e31..8afa67c57 100644
--- a/app/views/chats/index.html.erb
+++ b/app/views/chats/index.html.erb
@@ -10,14 +10,14 @@
       <% if @chats.any? %>
         <div class="grow flex flex-col">
           <div class="flex items-center justify-between my-6">
-            <h1 class="text-xl font-medium">Chats</h1>
+            <h1 class="text-xl font-medium"><%= t(".chats") %></h1>
             <%= render DS::Link.new(
               id: "new-chat",
               icon: "plus",
               variant: "icon",
               href: new_chat_path,
               frame: chat_frame,
-              text: "New chat"
+              text: t(".new_chat")
             ) %>
           </div>
           <div class="space-y-2 px-0.5">
@@ -26,7 +26,7 @@
         </div>
       <% else %>
         <div class="grow flex flex-col">
-          <h1 class="sr-only">Chats</h1>
+          <h1 class="sr-only"><%= t(".chats") %></h1>
           <div class="mt-auto py-8">
             <%= render "chats/ai_greeting" %>
           </div>
diff --git a/app/views/chats/show.html.erb b/app/views/chats/show.html.erb
index 496d4ac65..2b69c1f0d 100644
--- a/app/views/chats/show.html.erb
+++ b/app/views/chats/show.html.erb
@@ -15,7 +15,7 @@
         <% end %>
       </div>
 
-      <div id="messages" class="grow overflow-y-auto p-4 space-y-6 lg:pb-4" data-chat-target="messages">
+      <div id="<%= @chat.messages_target %>" class="grow overflow-y-auto p-4 space-y-6 lg:pb-4" data-chat-target="messages">
         <% if @chat.conversation_messages.any? %>
           <% @chat.conversation_messages.ordered.each do |message| %>
             <%= render message %>
@@ -26,10 +26,6 @@
           </div>
         <% end %>
 
-        <% if params[:thinking].present? %>
-          <%= render "chats/thinking_indicator", chat: @chat %>
-        <% end %>
-
         <% if @chat.error.present? && @chat.needs_assistant_response? %>
           <%= render "chats/error", chat: @chat %>
         <% end %>
diff --git a/app/views/coinbase_items/_coinbase_item.html.erb b/app/views/coinbase_items/_coinbase_item.html.erb
index 0694c261d..5d1262888 100644
--- a/app/views/coinbase_items/_coinbase_item.html.erb
+++ b/app/views/coinbase_items/_coinbase_item.html.erb
@@ -16,92 +16,94 @@
        end
      end %>
 
-  <details open class="group bg-container p-4 shadow-border-xs rounded-xl">
-    <summary class="flex items-center justify-between gap-2 focus-visible:outline-hidden">
-      <div class="flex items-center gap-2">
-        <%= icon "chevron-right", class: "group-open:transform group-open:rotate-90" %>
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center justify-between gap-2 focus-visible:outline-hidden">
+        <div class="flex items-center gap-2">
+          <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
 
-        <div class="flex items-center justify-center h-8 w-8 rounded-full" style="background-color: rgba(0, 82, 255, 0.1);">
-          <div class="flex items-center justify-center">
-            <%= icon "bitcoin", size: "sm", class: "text-[#0052FF]" %>
+          <div class="flex items-center justify-center h-8 w-8 rounded-full" style="background-color: rgba(0, 82, 255, 0.1);">
+            <div class="flex items-center justify-center">
+              <%= icon "bitcoin", size: "sm", class: "text-[#0052FF]" %>
+            </div>
           </div>
-        </div>
 
-        <div class="pl-1 text-sm">
-          <div class="flex items-center gap-2">
-            <%= tag.p coinbase_item.institution_display_name, class: "font-medium text-primary" %>
-            <% if coinbase_item.scheduled_for_deletion? %>
-              <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+          <div class="pl-1 text-sm">
+            <div class="flex items-center gap-2">
+              <%= tag.p coinbase_item.institution_display_name, class: "font-medium text-primary" %>
+              <% if coinbase_item.scheduled_for_deletion? %>
+                <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+              <% end %>
+            </div>
+            <p class="text-xs text-secondary"><%= t(".provider_name") %></p>
+            <% if coinbase_item.syncing? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "loader", size: "sm", class: "animate-spin" %>
+                <%= tag.span t(".syncing") %>
+              </div>
+            <% elsif coinbase_item.requires_update? %>
+              <div class="text-warning flex items-center gap-1">
+                <%= icon "alert-triangle", size: "sm", color: "warning" %>
+                <%= tag.span t(".reconnect") %>
+              </div>
+            <% else %>
+              <p class="text-secondary">
+                <% if coinbase_item.last_synced_at %>
+                  <% if coinbase_item.sync_status_summary %>
+                    <%= t(".status_with_summary", timestamp: time_ago_in_words(coinbase_item.last_synced_at), summary: coinbase_item.sync_status_summary) %>
+                  <% else %>
+                    <%= t(".status", timestamp: time_ago_in_words(coinbase_item.last_synced_at)) %>
+                  <% end %>
+                <% else %>
+                  <%= t(".status_never") %>
+                <% end %>
+              </p>
             <% end %>
           </div>
-          <p class="text-xs text-secondary"><%= t(".provider_name") %></p>
-          <% if coinbase_item.syncing? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= icon "loader", size: "sm", class: "animate-spin" %>
-              <%= tag.span t(".syncing") %>
-            </div>
-          <% elsif coinbase_item.requires_update? %>
-            <div class="text-warning flex items-center gap-1">
-              <%= icon "alert-triangle", size: "sm", color: "warning" %>
-              <%= tag.span t(".reconnect") %>
-            </div>
-          <% else %>
-            <p class="text-secondary">
-              <% if coinbase_item.last_synced_at %>
-                <% if coinbase_item.sync_status_summary %>
-                  <%= t(".status_with_summary", timestamp: time_ago_in_words(coinbase_item.last_synced_at), summary: coinbase_item.sync_status_summary) %>
-                <% else %>
-                  <%= t(".status", timestamp: time_ago_in_words(coinbase_item.last_synced_at)) %>
-                <% end %>
-              <% else %>
-                <%= t(".status_never") %>
-              <% end %>
-            </p>
-          <% end %>
         </div>
-      </div>
 
-      <% if Current.user&.admin? %>
-        <div class="flex items-center gap-2">
-          <% if coinbase_item.requires_update? %>
-            <%= render DS::Link.new(
-              text: t(".update_credentials"),
-              icon: "refresh-cw",
-              variant: "secondary",
-              href: settings_providers_path,
-              frame: "_top"
-            ) %>
-          <% else %>
-            <%= icon(
-              "refresh-cw",
-              as_button: true,
-              href: sync_coinbase_item_path(coinbase_item),
-              disabled: coinbase_item.syncing?
-            ) %>
-          <% end %>
-
-          <%= render DS::Menu.new do |menu| %>
-            <% if unlinked_count.to_i > 0 %>
-              <% menu.with_item(
-                variant: "link",
-                text: t(".import_wallets_menu"),
-                icon: "plus",
-                href: setup_accounts_coinbase_item_path(coinbase_item),
-                frame: :modal
+        <% if Current.user&.admin? %>
+          <div class="flex items-center gap-2">
+            <% if coinbase_item.requires_update? %>
+              <%= render DS::Link.new(
+                text: t(".update_credentials"),
+                icon: "refresh-cw",
+                variant: "secondary",
+                href: settings_providers_path,
+                frame: "_top"
+              ) %>
+            <% else %>
+              <%= icon(
+                "refresh-cw",
+                as_button: true,
+                href: sync_coinbase_item_path(coinbase_item),
+                disabled: coinbase_item.syncing?
               ) %>
             <% end %>
-            <% menu.with_item(
-              variant: "button",
-              text: t(".delete"),
-              icon: "trash-2",
-              href: coinbase_item_path(coinbase_item),
-              method: :delete,
-              confirm: CustomConfirm.for_resource_deletion(coinbase_item.institution_display_name, high_severity: true)
-            ) %>
-          <% end %>
-        </div>
-      <% end %>
-    </summary>
+
+            <%= render DS::Menu.new do |menu| %>
+              <% if unlinked_count.to_i > 0 %>
+                <% menu.with_item(
+                  variant: "link",
+                  text: t(".import_wallets_menu"),
+                  icon: "plus",
+                  href: setup_accounts_coinbase_item_path(coinbase_item),
+                  frame: :modal
+                ) %>
+              <% end %>
+              <% menu.with_item(
+                variant: "button",
+                text: t(".delete"),
+                icon: "trash-2",
+                href: coinbase_item_path(coinbase_item),
+                method: :delete,
+                confirm: CustomConfirm.for_resource_deletion(coinbase_item.institution_display_name, high_severity: true)
+              ) %>
+            <% end %>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
 
     <% unless coinbase_item.scheduled_for_deletion? %>
       <div class="space-y-4 mt-4">
@@ -142,5 +144,5 @@
         <% end %>
       </div>
     <% end %>
-  </details>
+  <% end %>
 <% end %>
diff --git a/app/views/coinbase_items/select_existing_account.html.erb b/app/views/coinbase_items/select_existing_account.html.erb
index 86b9d3840..aee144bdc 100644
--- a/app/views/coinbase_items/select_existing_account.html.erb
+++ b/app/views/coinbase_items/select_existing_account.html.erb
@@ -17,7 +17,7 @@
           <%= hidden_field_tag :account_id, @account.id %>
           <div class="space-y-2 max-h-64 overflow-auto">
             <% @available_coinbase_accounts.each do |ca| %>
-              <label class="flex items-center gap-3 p-2 rounded border border-surface-inset/50 hover:border-primary cursor-pointer">
+              <label class="flex items-center gap-3 p-2 rounded border border-secondary hover:border-primary cursor-pointer">
                 <%= radio_button_tag :coinbase_account_id, ca.id, false %>
                 <div class="flex flex-col">
                   <span class="text-sm text-primary font-medium"><%= ca.name.presence || ca.account_id %></span>
diff --git a/app/views/coinstats_items/_coinstats_item.html.erb b/app/views/coinstats_items/_coinstats_item.html.erb
index ba8b90b2d..aae9b65ef 100644
--- a/app/views/coinstats_items/_coinstats_item.html.erb
+++ b/app/views/coinstats_items/_coinstats_item.html.erb
@@ -1,82 +1,84 @@
 <%# locals: (coinstats_item:) %>
 
 <%= tag.div id: dom_id(coinstats_item) do %>
-  <details open class="group bg-container p-4 shadow-border-xs rounded-xl">
-    <summary class="flex items-center justify-between gap-2 focus-visible:outline-hidden">
-      <div class="flex items-center gap-2">
-        <%= icon "chevron-right", class: "group-open:transform group-open:rotate-90" %>
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center justify-between gap-2 focus-visible:outline-hidden">
+        <div class="flex items-center gap-2">
+          <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
 
-        <div class="flex items-center justify-center h-8 w-8 bg-success/10 rounded-full">
-          <div class="flex items-center justify-center">
-            <%= tag.p coinstats_item.institution_display_name.first.upcase, class: "text-success text-xs font-medium" %>
+          <div class="flex items-center justify-center h-8 w-8 bg-success/10 rounded-full">
+            <div class="flex items-center justify-center">
+              <%= tag.p coinstats_item.institution_display_name.first.upcase, class: "text-success text-xs font-medium" %>
+            </div>
           </div>
-        </div>
 
-        <div class="pl-1 text-sm">
-          <div class="flex items-center gap-2">
-            <%= tag.p coinstats_item.institution_display_name, class: "font-medium text-primary" %>
-            <% if coinstats_item.scheduled_for_deletion? %>
-              <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+          <div class="pl-1 text-sm">
+            <div class="flex items-center gap-2">
+              <%= tag.p coinstats_item.institution_display_name, class: "font-medium text-primary" %>
+              <% if coinstats_item.scheduled_for_deletion? %>
+                <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+              <% end %>
+            </div>
+            <p class="text-xs text-secondary"><%= t(".provider_name") %></p>
+            <% if coinstats_item.syncing? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "loader", size: "sm", class: "animate-spin" %>
+                <%= tag.span t(".syncing") %>
+              </div>
+            <% elsif coinstats_item.requires_update? %>
+              <div class="text-warning flex items-center gap-1">
+                <%= icon "alert-triangle", size: "sm", color: "warning" %>
+                <%= tag.span t(".reconnect") %>
+              </div>
+            <% else %>
+              <p class="text-secondary">
+                <% if coinstats_item.last_synced_at %>
+                  <% if coinstats_item.sync_status_summary %>
+                    <%= t(".status_with_summary", timestamp: time_ago_in_words(coinstats_item.last_synced_at), summary: coinstats_item.sync_status_summary) %>
+                  <% else %>
+                    <%= t(".status", timestamp: time_ago_in_words(coinstats_item.last_synced_at)) %>
+                  <% end %>
+                <% else %>
+                  <%= t(".status_never") %>
+                <% end %>
+              </p>
             <% end %>
           </div>
-          <p class="text-xs text-secondary"><%= t(".provider_name") %></p>
-          <% if coinstats_item.syncing? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= icon "loader", size: "sm", class: "animate-spin" %>
-              <%= tag.span t(".syncing") %>
-            </div>
-          <% elsif coinstats_item.requires_update? %>
-            <div class="text-warning flex items-center gap-1">
-              <%= icon "alert-triangle", size: "sm", color: "warning" %>
-              <%= tag.span t(".reconnect") %>
-            </div>
-          <% else %>
-            <p class="text-secondary">
-              <% if coinstats_item.last_synced_at %>
-                <% if coinstats_item.sync_status_summary %>
-                  <%= t(".status_with_summary", timestamp: time_ago_in_words(coinstats_item.last_synced_at), summary: coinstats_item.sync_status_summary) %>
-                <% else %>
-                  <%= t(".status", timestamp: time_ago_in_words(coinstats_item.last_synced_at)) %>
-                <% end %>
-              <% else %>
-                <%= t(".status_never") %>
-              <% end %>
-            </p>
-          <% end %>
         </div>
+
+        <% if Current.user&.admin? %>
+          <div class="flex items-center gap-2">
+            <% if coinstats_item.requires_update? %>
+              <%= render DS::Link.new(
+                text: t(".update_api_key"),
+                icon: "refresh-cw",
+                variant: "secondary",
+                href: settings_providers_path,
+                frame: "_top"
+              ) %>
+            <% elsif Rails.env.development? %>
+              <%= icon(
+                "refresh-cw",
+                as_button: true,
+                href: sync_coinstats_item_path(coinstats_item)
+              ) %>
+            <% end %>
+
+            <%= render DS::Menu.new do |menu| %>
+              <% menu.with_item(
+                variant: "button",
+                text: t(".delete"),
+                icon: "trash-2",
+                href: coinstats_item_path(coinstats_item),
+                method: :delete,
+                confirm: CustomConfirm.for_resource_deletion(coinstats_item.institution_display_name, high_severity: true)
+              ) %>
+            <% end %>
+          </div>
+        <% end %>
       </div>
-
-      <% if Current.user&.admin? %>
-        <div class="flex items-center gap-2">
-          <% if coinstats_item.requires_update? %>
-            <%= render DS::Link.new(
-              text: t(".update_api_key"),
-              icon: "refresh-cw",
-              variant: "secondary",
-              href: settings_providers_path,
-              frame: "_top"
-            ) %>
-          <% elsif Rails.env.development? %>
-            <%= icon(
-              "refresh-cw",
-              as_button: true,
-              href: sync_coinstats_item_path(coinstats_item)
-            ) %>
-          <% end %>
-
-          <%= render DS::Menu.new do |menu| %>
-            <% menu.with_item(
-              variant: "button",
-              text: t(".delete"),
-              icon: "trash-2",
-              href: coinstats_item_path(coinstats_item),
-              method: :delete,
-              confirm: CustomConfirm.for_resource_deletion(coinstats_item.institution_display_name, high_severity: true)
-            ) %>
-          <% end %>
-        </div>
-      <% end %>
-    </summary>
+    <% end %>
 
     <% unless coinstats_item.scheduled_for_deletion? %>
       <div class="space-y-4 mt-4">
@@ -103,5 +105,5 @@
         <% end %>
       </div>
     <% end %>
-  </details>
+  <% end %>
 <% end %>
diff --git a/app/views/coinstats_items/new.html.erb b/app/views/coinstats_items/new.html.erb
index 955c7a2cb..5d163f86e 100644
--- a/app/views/coinstats_items/new.html.erb
+++ b/app/views/coinstats_items/new.html.erb
@@ -53,8 +53,7 @@
               <% end %>
 
               <div class="flex justify-end">
-                <%= form.submit t(".link_wallet_submit"),
-                                class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-inverse bg-inverse hover:bg-inverse-hover focus:outline-none focus:ring-2 focus:ring-gray-900 focus:ring-offset-2 transition-colors" %>
+                <%= form.submit t(".link_wallet_submit") %>
               </div>
             <% end %>
           </section>
@@ -90,8 +89,7 @@
               <div data-coinstats-exchange-fields-target="fields" class="space-y-3"></div>
 
               <div class="flex justify-end">
-                <%= form.submit t(".link_exchange_submit"),
-                                class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-inverse bg-inverse hover:bg-inverse-hover focus:outline-none focus:ring-2 focus:ring-gray-900 focus:ring-offset-2 transition-colors" %>
+                <%= form.submit t(".link_exchange_submit") %>
               </div>
             <% end %>
           </section>
@@ -115,11 +113,13 @@
           </div>
 
           <div class="mt-4">
-            <%= link_to settings_providers_path,
-                        class: "w-full inline-flex items-center justify-center rounded-lg font-medium whitespace-nowrap rounded-lg hidden md:inline-flex px-3 py-2 text-sm text-inverse bg-inverse hover:bg-inverse-hover disabled:bg-gray-500 theme-dark:disabled:bg-gray-400",
-                        data: { turbo: false } do %>
-              <%= t(".go_to_settings") %>
-            <% end %>
+            <%= render DS::Link.new(
+              text: t(".go_to_settings"),
+              href: settings_providers_path,
+              variant: :primary,
+              full_width: true,
+              data: { turbo: false }
+            ) %>
           </div>
         </div>
       <% end %>
diff --git a/app/views/credit_cards/_overview.html.erb b/app/views/credit_cards/_overview.html.erb
index 1dfcbb0b7..317191a14 100644
--- a/app/views/credit_cards/_overview.html.erb
+++ b/app/views/credit_cards/_overview.html.erb
@@ -28,7 +28,7 @@
 
 <div class="flex justify-center py-8">
   <%= render DS::Link.new(
-    text: "Edit account details",
+    text: t(".edit_account_details"),
     variant: "ghost",
     href: edit_credit_card_path(account),
     frame: :modal
diff --git a/app/views/doorkeeper/applications/_form.html.erb b/app/views/doorkeeper/applications/_form.html.erb
index 4cc71b3d8..cb9bc6be6 100644
--- a/app/views/doorkeeper/applications/_form.html.erb
+++ b/app/views/doorkeeper/applications/_form.html.erb
@@ -4,7 +4,7 @@
   <% end %>
 
   <div class="form-group row">
-    <%= f.label :name, class: "col-sm-2 col-form-label font-weight-bold" %>
+    <%= f.label :name, class: "col-sm-2 col-form-label font-bold" %>
     <div class="col-sm-10">
       <%= f.text_field :name, class: "form-control #{ 'is-invalid' if application.errors[:name].present? }", required: true %>
       <%= doorkeeper_errors_for application, :name %>
@@ -12,7 +12,7 @@
   </div>
 
   <div class="form-group row">
-    <%= f.label :redirect_uri, class: "col-sm-2 col-form-label font-weight-bold" %>
+    <%= f.label :redirect_uri, class: "col-sm-2 col-form-label font-bold" %>
     <div class="col-sm-10">
       <%= f.text_area :redirect_uri, class: "form-control #{ 'is-invalid' if application.errors[:redirect_uri].present? }" %>
       <%= doorkeeper_errors_for application, :redirect_uri %>
@@ -29,7 +29,7 @@
   </div>
 
   <div class="form-group row">
-    <%= f.label :confidential, class: "col-sm-2 form-check-label font-weight-bold" %>
+    <%= f.label :confidential, class: "col-sm-2 form-check-label font-bold" %>
     <div class="col-sm-10">
       <%= f.check_box :confidential, class: "checkbox #{ 'is-invalid' if application.errors[:confidential].present? }" %>
       <%= doorkeeper_errors_for application, :confidential %>
@@ -40,7 +40,7 @@
   </div>
 
   <div class="form-group row">
-    <%= f.label :scopes, class: "col-sm-2 col-form-label font-weight-bold" %>
+    <%= f.label :scopes, class: "col-sm-2 col-form-label font-bold" %>
     <div class="col-sm-10">
       <%= f.text_field :scopes, class: "form-control #{ 'has-error' if application.errors[:scopes].present? }" %>
       <%= doorkeeper_errors_for application, :scopes %>
diff --git a/app/views/doorkeeper/applications/show.html.erb b/app/views/doorkeeper/applications/show.html.erb
index 53e84c785..fcd32a692 100644
--- a/app/views/doorkeeper/applications/show.html.erb
+++ b/app/views/doorkeeper/applications/show.html.erb
@@ -5,14 +5,14 @@
 <div class="row">
   <div class="col-md-8">
     <h4><%= t(".application_id") %>:</h4>
-    <p><code class="bg-light" id="application_id"><%= @application.uid %></code></p>
+    <p><code class="bg-surface" id="application_id"><%= @application.uid %></code></p>
 
     <h4><%= t(".secret") %>:</h4>
     <p>
-      <code class="bg-light" id="secret">
+      <code class="bg-surface" id="secret">
         <% secret = flash[:application_secret].presence || @application.plaintext_secret %>
         <% if secret.blank? && Doorkeeper.config.application_secret_hashed? %>
-          <span class="bg-light font-italic text-uppercase text-muted"><%= t(".secret_hashed") %></span>
+          <span class="bg-surface italic uppercase text-subdued"><%= t(".secret_hashed") %></span>
         <% else %>
           <%= secret %>
         <% end %>
@@ -21,17 +21,17 @@
 
     <h4><%= t(".scopes") %>:</h4>
     <p>
-      <code class="bg-light" id="scopes">
+      <code class="bg-surface" id="scopes">
         <% if @application.scopes.present? %>
           <%= @application.scopes %>
         <% else %>
-          <span class="bg-light font-italic text-uppercase text-muted"><%= t(".not_defined") %></span>
+          <span class="bg-surface italic uppercase text-subdued"><%= t(".not_defined") %></span>
         <% end %>
       </code>
     </p>
 
     <h4><%= t(".confidential") %>:</h4>
-    <p><code class="bg-light" id="confidential"><%= @application.confidential? %></code></p>
+    <p><code class="bg-surface" id="confidential"><%= @application.confidential? %></code></p>
 
     <h4><%= t(".callback_urls") %>:</h4>
 
@@ -40,7 +40,7 @@
         <% @application.redirect_uri.split.each do |uri| %>
           <tr>
             <td>
-              <code class="bg-light"><%= uri %></code>
+              <code class="bg-surface"><%= uri %></code>
             </td>
             <td>
               <%= link_to t("doorkeeper.applications.buttons.authorize"), oauth_authorization_path(client_id: @application.uid, redirect_uri: uri, response_type: "code", scope: @application.scopes), class: "btn btn-success", target: "_blank" %>
@@ -49,7 +49,7 @@
         <% end %>
       </table>
     <% else %>
-      <span class="bg-light font-italic text-uppercase text-muted"><%= t(".not_defined") %></span>
+      <span class="bg-surface italic uppercase text-subdued"><%= t(".not_defined") %></span>
     <% end %>
   </div>
 
diff --git a/app/views/doorkeeper/authorizations/error.html.erb b/app/views/doorkeeper/authorizations/error.html.erb
index 401e191f7..033430030 100644
--- a/app/views/doorkeeper/authorizations/error.html.erb
+++ b/app/views/doorkeeper/authorizations/error.html.erb
@@ -14,7 +14,7 @@
 
   <div class="text-center">
     <%= render DS::Link.new(
-      text: "Go back",
+      text: t("doorkeeper.authorizations.error.go_back"),
       href: "javascript:history.back()",
       variant: :secondary
     ) %>
diff --git a/app/views/doorkeeper/authorizations/show.html.erb b/app/views/doorkeeper/authorizations/show.html.erb
index 4653af2a1..43552339a 100644
--- a/app/views/doorkeeper/authorizations/show.html.erb
+++ b/app/views/doorkeeper/authorizations/show.html.erb
@@ -7,11 +7,11 @@
   </div>
 
   <div class="bg-surface-inset rounded-lg p-4">
-    <p class="text-xs text-secondary mb-2">Authorization Code:</p>
+    <p class="text-xs text-secondary mb-2"><%= t(".authorization_code_label") %></p>
     <code id="authorization_code" class="block text-sm font-mono text-primary break-all"><%= params[:code] %></code>
   </div>
 
   <p class="text-sm text-secondary text-center">
-    Copy this code and paste it into the application.
+    <%= t(".copy_instructions") %>
   </p>
 </div>
diff --git a/app/views/enable_banking_items/_enable_banking_item.html.erb b/app/views/enable_banking_items/_enable_banking_item.html.erb
index 6d53b0c6a..2e3af279b 100644
--- a/app/views/enable_banking_items/_enable_banking_item.html.erb
+++ b/app/views/enable_banking_items/_enable_banking_item.html.erb
@@ -1,85 +1,87 @@
 <%# locals: (enable_banking_item:) %>
 
 <%= tag.div id: dom_id(enable_banking_item) do %>
-  <details open class="group bg-container p-4 shadow-border-xs rounded-xl">
-    <summary class="flex items-center justify-between gap-2 focus-visible:outline-hidden">
-      <div class="flex items-center gap-2">
-        <%= icon "chevron-right", class: "group-open:transform group-open:rotate-90" %>
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center justify-between gap-2 focus-visible:outline-hidden">
+        <div class="flex items-center gap-2">
+          <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
 
-        <div class="flex items-center justify-center h-8 w-8 bg-success/10 rounded-full">
-          <% if enable_banking_item.logo.attached? %>
-            <%= image_tag enable_banking_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
-          <% else %>
-            <div class="flex items-center justify-center">
-              <%= tag.p enable_banking_item.institution_display_name.first.upcase, class: "text-success text-xs font-medium" %>
-            </div>
-          <% end %>
-        </div>
-
-        <div class="pl-1 text-sm">
-          <div class="flex items-center gap-2">
-            <%= tag.p enable_banking_item.institution_display_name, class: "font-medium text-primary" %>
-            <% if enable_banking_item.scheduled_for_deletion? %>
-              <p class="text-destructive text-sm animate-pulse">Deletion in progress</p>
+          <div class="flex items-center justify-center h-8 w-8 bg-success/10 rounded-full">
+            <% if enable_banking_item.logo.attached? %>
+              <%= image_tag enable_banking_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
+            <% else %>
+              <div class="flex items-center justify-center">
+                <%= tag.p enable_banking_item.institution_display_name.first.upcase, class: "text-success text-xs font-medium" %>
+              </div>
             <% end %>
           </div>
-          <p class="text-xs text-secondary">Enable Banking</p>
-          <% if enable_banking_item.syncing? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= icon "loader", size: "sm", class: "animate-spin" %>
-              <%= tag.span "Syncing..." %>
-            </div>
-          <% elsif enable_banking_item.requires_update? %>
-            <div class="text-warning flex items-center gap-1">
-              <%= icon "alert-triangle", size: "sm", color: "warning" %>
-              <%= tag.span "Reconnect" %>
-            </div>
-          <% else %>
-            <p class="text-secondary">
-              <% if enable_banking_item.last_synced_at %>
-                Last synced <%= time_ago_in_words(enable_banking_item.last_synced_at) %> ago
-                <% if enable_banking_item.sync_status_summary %>
-                  · <%= enable_banking_item.sync_status_summary %>
-                <% end %>
-              <% else %>
-                Never synced
+
+          <div class="pl-1 text-sm">
+            <div class="flex items-center gap-2">
+              <%= tag.p enable_banking_item.institution_display_name, class: "font-medium text-primary" %>
+              <% if enable_banking_item.scheduled_for_deletion? %>
+                <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
               <% end %>
-            </p>
-          <% end %>
-        </div>
-      </div>
-
-      <% if Current.user&.admin? %>
-        <div class="flex items-center gap-2">
-          <% if enable_banking_item.requires_update? %>
-            <%= button_to reauthorize_enable_banking_item_path(enable_banking_item),
-                          method: :post,
-                          class: "inline-flex items-center gap-1 px-3 py-1.5 text-sm font-medium rounded-lg text-white bg-warning hover:opacity-90 transition-colors",
-                          data: { turbo: false } do %>
-              <%= icon "refresh-cw", size: "sm" %>
-              Update
+            </div>
+            <p class="text-xs text-secondary"><%= t(".provider_name") %></p>
+            <% if enable_banking_item.syncing? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "loader", size: "sm", class: "animate-spin" %>
+                <%= tag.span t(".syncing") %>
+              </div>
+            <% elsif enable_banking_item.requires_update? %>
+              <div class="text-warning flex items-center gap-1">
+                <%= icon "alert-triangle", size: "sm", color: "warning" %>
+                <%= tag.span t(".reconnect") %>
+              </div>
+            <% else %>
+              <p class="text-secondary">
+                <% if enable_banking_item.last_synced_at %>
+                  <%= t(".last_synced", time: time_ago_in_words(enable_banking_item.last_synced_at)) %>
+                  <% if enable_banking_item.sync_status_summary %>
+                    · <%= enable_banking_item.sync_status_summary %>
+                  <% end %>
+                <% else %>
+                  <%= t(".never_synced") %>
+                <% end %>
+              </p>
             <% end %>
-          <% elsif Rails.env.development? %>
-            <%= icon(
-              "refresh-cw",
-              as_button: true,
-              href: sync_enable_banking_item_path(enable_banking_item)
-            ) %>
-          <% end %>
-
-          <%= render DS::Menu.new do |menu| %>
-            <% menu.with_item(
-              variant: "button",
-              text: "Delete",
-              icon: "trash-2",
-              href: enable_banking_item_path(enable_banking_item),
-              method: :delete,
-              confirm: CustomConfirm.for_resource_deletion(enable_banking_item.institution_display_name, high_severity: true)
-            ) %>
-          <% end %>
+          </div>
         </div>
-      <% end %>
-    </summary>
+
+        <% if Current.user&.admin? %>
+          <div class="flex items-center gap-2">
+            <% if enable_banking_item.requires_update? %>
+              <%= button_to reauthorize_enable_banking_item_path(enable_banking_item),
+                            method: :post,
+                            class: "inline-flex items-center gap-1 px-3 py-1.5 text-sm font-medium rounded-lg text-inverse bg-warning hover:opacity-90 transition-colors",
+                            data: { turbo: false } do %>
+                <%= icon "refresh-cw", size: "sm" %>
+                <%= t(".update") %>
+              <% end %>
+            <% elsif Rails.env.development? %>
+              <%= icon(
+                "refresh-cw",
+                as_button: true,
+                href: sync_enable_banking_item_path(enable_banking_item)
+              ) %>
+            <% end %>
+
+            <%= render DS::Menu.new do |menu| %>
+              <% menu.with_item(
+                variant: "button",
+                text: t(".delete"),
+                icon: "trash-2",
+                href: enable_banking_item_path(enable_banking_item),
+                method: :delete,
+                confirm: CustomConfirm.for_resource_deletion(enable_banking_item.institution_display_name, high_severity: true)
+              ) %>
+            <% end %>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
 
     <% unless enable_banking_item.scheduled_for_deletion? %>
       <div class="space-y-4 mt-4">
@@ -109,10 +111,10 @@
 
         <% if enable_banking_item.unlinked_accounts_count > 0 %>
           <div class="p-4 flex flex-col gap-3 items-center justify-center">
-            <p class="text-primary font-medium text-sm">Setup needed</p>
-            <p class="text-secondary text-sm"><%= pluralize(enable_banking_item.unlinked_accounts_count, "account") %> imported from Enable Banking need to be set up</p>
+            <p class="text-primary font-medium text-sm"><%= t(".setup_needed") %></p>
+            <p class="text-secondary text-sm"><%= t(".setup_needed_description", count: enable_banking_item.unlinked_accounts_count) %></p>
             <%= render DS::Link.new(
-              text: "Set up accounts",
+              text: t(".set_up_accounts"),
               icon: "settings",
               variant: "primary",
               href: setup_accounts_enable_banking_item_path(enable_banking_item),
@@ -121,11 +123,11 @@
           </div>
         <% elsif enable_banking_item.accounts.empty? && enable_banking_item.enable_banking_accounts.empty? %>
           <div class="p-4 flex flex-col gap-3 items-center justify-center">
-            <p class="text-primary font-medium text-sm">No accounts found</p>
-            <p class="text-secondary text-sm">No accounts were found from Enable Banking. Try syncing again.</p>
+            <p class="text-primary font-medium text-sm"><%= t(".no_accounts_found") %></p>
+            <p class="text-secondary text-sm"><%= t(".no_accounts_found_description") %></p>
           </div>
         <% end %>
       </div>
     <% end %>
-  </details>
+  <% end %>
 <% end %>
diff --git a/app/views/enable_banking_items/_subtype_select.html.erb b/app/views/enable_banking_items/_subtype_select.html.erb
index a9bab3848..c5969396c 100644
--- a/app/views/enable_banking_items/_subtype_select.html.erb
+++ b/app/views/enable_banking_items/_subtype_select.html.erb
@@ -2,9 +2,7 @@
   <% if subtype_config[:options].present? %>
     <%= label_tag "account_subtypes[#{enable_banking_account.id}]", subtype_config[:label],
                  class: "block text-sm font-medium text-primary mb-2" %>
-    <% selected_value = account_type == "Depository" ?
-         (enable_banking_account.name.downcase.include?("checking") ? "checking" :
-          enable_banking_account.name.downcase.include?("savings") ? "savings" : "") : "" %>
+    <% selected_value = enable_banking_account.suggested_subtype.presence || "" %>
     <%= select_tag "account_subtypes[#{enable_banking_account.id}]",
                   options_for_select([["Select #{account_type == 'Depository' ? 'subtype' : 'type'}", ""]] + subtype_config[:options], selected_value),
                   { class: "appearance-none bg-container border border-primary rounded-md px-3 py-2 text-sm leading-6 text-primary focus:border-primary focus:ring-1 focus:ring-primary focus:outline-none w-full" } %>
diff --git a/app/views/enable_banking_items/new.html.erb b/app/views/enable_banking_items/new.html.erb
index f7e99cf3d..2f7b481e9 100644
--- a/app/views/enable_banking_items/new.html.erb
+++ b/app/views/enable_banking_items/new.html.erb
@@ -17,22 +17,22 @@
                     <% if item.session_valid? %>
                     <div class="w-2 h-2 bg-success rounded-full"></div>
                     <div>
-                        <p class="text-sm font-medium text-primary"><%= item.aspsp_name || "Connected Bank" %></p>
+                        <p class="text-sm font-medium text-primary"><%= item.aspsp_name || t(".connected_bank") %></p>
                         <p class="text-xs text-secondary">
-                        Session expires: <%= item.session_expires_at&.strftime("%b %d, %Y") || "Unknown" %>
+                        <%= t(".session_expires") %>: <%= item.session_expires_at&.strftime("%b %d, %Y") || t(".unknown") %>
                         </p>
                     </div>
                     <% elsif item.session_expired? %>
                     <div class="w-2 h-2 bg-warning rounded-full"></div>
                     <div>
-                        <p class="text-sm font-medium text-primary"><%= item.aspsp_name || "Connection" %></p>
-                        <p class="text-xs text-destructive">Session expired - re-authorization required</p>
+                        <p class="text-sm font-medium text-primary"><%= item.aspsp_name || t(".connection") %></p>
+                        <p class="text-xs text-destructive"><%= t(".session_expired") %></p>
                     </div>
                     <% else %>
                     <div class="w-2 h-2 bg-secondary rounded-full"></div>
                     <div>
-                        <p class="text-sm font-medium text-primary">Configured</p>
-                        <p class="text-xs text-secondary">Ready to connect a bank</p>
+                        <p class="text-sm font-medium text-primary"><%= t(".configured") %></p>
+                        <p class="text-xs text-secondary"><%= t(".ready_to_connect") %></p>
                     </div>
                     <% end %>
                 </div>
@@ -41,30 +41,32 @@
                     <% if item.session_valid? %>
                     <%= button_to sync_enable_banking_item_path(item),
                                     method: :post,
-                                    class: "inline-flex items-center justify-center rounded-lg px-3 py-1.5 text-xs font-medium text-primary bg-container border border-primary hover:bg-gray-50 transition-colors",
+                                    class: "inline-flex items-center justify-center rounded-lg px-3 py-1.5 text-xs font-medium text-primary bg-container border border-primary hover:bg-surface-inset transition-colors",
                                     data: { turbo: false } do %>
-                        Sync
+                        <%= t(".sync") %>
                     <% end %>
                     <% elsif item.session_expired? %>
                     <%= button_to reauthorize_enable_banking_item_path(item),
                                     method: :post,
                                     class: "inline-flex items-center justify-center rounded-lg px-3 py-1.5 text-xs font-medium text-white bg-warning hover:opacity-90 transition-colors",
                                     data: { turbo: false } do %>
-                        Reconnect
+                        <%= t(".reconnect") %>
                     <% end %>
                     <% else %>
-                    <%= link_to select_bank_enable_banking_item_path(item),
-                                class: "inline-flex items-center justify-center rounded-lg px-3 py-1.5 text-xs font-medium text-white bg-gray-900 hover:bg-gray-800 transition-colors",
-                                data: { turbo_frame: "modal" } do %>
-                        Connect Bank
-                    <% end %>
+                    <%= render DS::Link.new(
+                      text: t(".connect_bank"),
+                      href: select_bank_enable_banking_item_path(item),
+                      variant: :primary,
+                      size: :sm,
+                      data: { turbo_frame: "modal" }
+                    ) %>
                     <% end %>
 
                     <%= button_to enable_banking_item_path(item),
                                 method: :delete,
                                 class: "inline-flex items-center justify-center rounded-lg px-3 py-1.5 text-xs font-medium text-destructive hover:bg-destructive/10 transition-colors",
-                                data: { turbo_confirm: "Are you sure you want to remove this connection?" } do %>
-                    Remove
+                                data: { turbo_confirm: t(".remove_confirm") } do %>
+                    <%= t(".remove") %>
                     <% end %>
                 </div>
                 </div>
@@ -73,13 +75,13 @@
             <%# Add Connection button below the list - only show if we have a valid session to copy credentials from %>
             <% if item_for_new_connection %>
                 <div class="flex justify-center pt-2">
-                <%= button_to new_connection_enable_banking_item_path(item_for_new_connection),
-                                method: :post,
-                                class: "inline-flex items-center gap-2 justify-center rounded-lg px-4 py-2 text-sm font-medium text-white bg-gray-900 hover:bg-gray-800 transition-colors",
-                                data: { turbo_frame: "modal" } do %>
-                    <%= icon "plus", size: "sm" %>
-                    Add Connection
-                <% end %>
+                <%= render DS::Button.new(
+                  text: t(".add_connection"),
+                  icon: "plus",
+                  href: new_connection_enable_banking_item_path(item_for_new_connection),
+                  variant: :primary,
+                  data: { turbo_method: :post, turbo_frame: "modal" }
+                ) %>
                 </div>
             <% end %>
             </div>
@@ -88,27 +90,29 @@
                 <div class="flex items-start gap-3">
                 <%= icon("alert-circle", class: "text-warning w-5 h-5 shrink-0 mt-0.5") %>
                 <div class="text-sm text-secondary">
-                    <p class="font-medium text-primary mb-2">Enable Banking connection not configured</p>
-                    <p>Before you can link Enable Banking accounts, you need to configure your Enable Banking connection.</p>
+                    <p class="font-medium text-primary mb-2"><%= t(".not_configured") %></p>
+                    <p><%= t(".not_configured_description") %></p>
                 </div>
                 </div>
 
                 <div class="bg-surface rounded-lg p-4 space-y-2 text-sm">
-                <p class="font-medium text-primary">Setup Steps:</p>
+                <p class="font-medium text-primary"><%= t(".setup_steps_title") %></p>
                 <ol class="list-decimal list-inside space-y-1 text-secondary">
-                    <li>Go to <strong>Settings → Providers</strong></li>
-                    <li>Find the <strong>Enable Banking</strong> section</li>
-                    <li>Enter your Enable Banking credentials</li>
-                    <li>Return here to link your accounts</li>
+                    <li><%= t(".setup_step_1_html") %></li>
+                    <li><%= t(".setup_step_2_html") %></li>
+                    <li><%= t(".setup_step_3") %></li>
+                    <li><%= t(".setup_step_4") %></li>
                 </ol>
                 </div>
 
                 <div class="mt-4">
-                <%= link_to settings_providers_path,
-                            class: "w-full inline-flex items-center justify-center rounded-lg font-medium whitespace-nowrap rounded-lg hidden md:inline-flex px-3 py-2 text-sm text-inverse bg-inverse hover:bg-inverse-hover disabled:bg-gray-500 theme-dark:disabled:bg-gray-400",
-                            data: { turbo: false } do %>
-                    Go to Provider Settings
-                <% end %>
+                <%= render DS::Link.new(
+                  text: t(".go_to_provider_settings"),
+                  href: settings_providers_path,
+                  variant: :primary,
+                  full_width: true,
+                  data: { turbo: false }
+                ) %>
                 </div>
             </div>
         <% end %>
diff --git a/app/views/enable_banking_items/select_bank.html.erb b/app/views/enable_banking_items/select_bank.html.erb
index 561639dd8..124c8e3ec 100644
--- a/app/views/enable_banking_items/select_bank.html.erb
+++ b/app/views/enable_banking_items/select_bank.html.erb
@@ -3,7 +3,7 @@
     <% dialog.with_header(title: t(".title", default: "Select Your Bank")) %>
 
     <% dialog.with_body do %>
-      <div class="space-y-4">
+      <div class="space-y-4" data-controller="bank-search">
         <p class="text-sm text-secondary">
           <%= t(".description", default: "Choose the bank you want to connect to your account.") %>
         </p>
@@ -15,29 +15,52 @@
         <% end %>
 
         <% if @aspsps.present? %>
+          <%# Search input — filters list client-side via Stimulus %>
+          <input
+            type="text"
+            placeholder="<%= t(".search_placeholder", default: "Search for your bank...") %>"
+            data-bank-search-target="input"
+            data-action="input->bank-search#filter"
+            class="w-full px-3 py-2 text-sm rounded-md border border-primary bg-container-inset text-primary placeholder:text-secondary focus:outline-none focus:ring-1 focus:ring-primary"
+            autocomplete="off"
+            aria-label="<%= t(".search_label", default: "Search for your bank") %>"
+            autofocus>
+
           <div class="space-y-2 max-h-80 overflow-y-auto">
             <% @aspsps.each do |aspsp| %>
-              <%= button_to authorize_enable_banking_item_path(@enable_banking_item),
-                            method: :post,
-                            params: { aspsp_name: aspsp[:name], new_connection: @new_connection },
-                            class: "w-full flex items-center gap-4 p-3 rounded-lg border border-primary bg-container hover:bg-subtle transition-colors text-left",
-                            data: { turbo: false } do %>
-                <% if aspsp[:logo].present? %>
-                  <img src="<%= aspsp[:logo] %>" alt="<%= aspsp[:name] %>" class="w-10 h-10 rounded object-contain">
-                <% else %>
-                  <div class="w-10 h-10 rounded bg-gray-100 flex items-center justify-center">
-                    <%= icon "building-bank", class: "w-5 h-5 text-gray-400" %>
-                  </div>
-                <% end %>
-                <div class="flex-1">
-                  <p class="font-medium text-sm text-primary"><%= aspsp[:name] %></p>
-                  <% if aspsp[:bic].present? %>
-                    <p class="text-xs text-secondary">BIC: <%= aspsp[:bic] %></p>
+              <div data-bank-search-target="item" data-bank-name="<%= aspsp[:name].to_s.downcase(:fold) %>">
+                <%= button_to authorize_enable_banking_item_path(@enable_banking_item),
+                              method: :post,
+                              params: { aspsp_name: aspsp[:name], new_connection: @new_connection },
+                              class: "w-full flex items-center gap-4 p-3 rounded-lg border border-primary bg-container hover:bg-subtle transition-colors text-left",
+                              data: { turbo: false } do %>
+                  <% if aspsp[:logo].present? %>
+                    <img src="<%= aspsp[:logo] %>" alt="<%= aspsp[:name] %>" class="w-10 h-10 rounded object-contain">
+                  <% else %>
+                    <div class="w-10 h-10 rounded bg-container-inset flex items-center justify-center">
+                      <%= icon "building-bank", class: "w-5 h-5 text-tertiary" %>
+                    </div>
                   <% end %>
-                </div>
-                <%= icon "chevron-right", class: "w-5 h-5 text-secondary" %>
-              <% end %>
+                  <div class="flex-1 min-w-0">
+                    <div class="flex items-center gap-2 flex-wrap">
+                      <p class="font-medium text-sm text-primary"><%= aspsp[:name] %></p>
+                      <% if aspsp[:beta] %>
+                        <span class="text-xs font-medium text-warning bg-warning/10 px-2 py-0.5 rounded-full flex-shrink-0">
+                          <%= t(".beta_label", default: "Beta") %>
+                        </span>
+                      <% end %>
+                    </div>
+                    <% if aspsp[:bic].present? %>
+                      <p class="text-xs text-secondary truncate">BIC: <%= aspsp[:bic] %></p>
+                    <% end %>
+                  </div>
+                  <%= icon "chevron-right", class: "w-5 h-5 text-secondary flex-shrink-0" %>
+                <% end %>
+              </div>
             <% end %>
+            <div data-bank-search-target="emptyState" class="hidden py-4 text-center text-sm text-secondary">
+              <%= t(".no_search_results", default: "No banks match your search.") %>
+            </div>
           </div>
         <% else %>
           <div class="text-center py-8">
diff --git a/app/views/enable_banking_items/select_existing_account.html.erb b/app/views/enable_banking_items/select_existing_account.html.erb
index 7ff7aedad..9d77b7071 100644
--- a/app/views/enable_banking_items/select_existing_account.html.erb
+++ b/app/views/enable_banking_items/select_existing_account.html.erb
@@ -1,15 +1,15 @@
 <%# Modal: Link an existing manual account to a Enable Banking account %>
 <%= turbo_frame_tag "modal" do %>
   <%= render DS::Dialog.new do |dialog| %>
-    <% dialog.with_header(title: "Link Enable Banking account") %>
+    <% dialog.with_header(title: t(".title")) %>
 
     <% dialog.with_body do %>
       <% if @available_enable_banking_accounts.blank? %>
         <div class="p-4 text-sm text-secondary">
-          <p class="mb-2">All Enable Banking accounts appear to be linked already.</p>
+          <p class="mb-2"><%= t(".all_linked") %></p>
           <ul class="list-disc list-inside space-y-1">
-            <li>If you just connected or synced, try again after the sync completes.</li>
-            <li>To link a different account, first unlink it from the account’s actions menu.</li>
+            <li><%= t(".try_after_sync") %></li>
+            <li><%= t(".unlink_to_move") %></li>
           </ul>
         </div>
       <% else %>
@@ -17,12 +17,12 @@
           <%= hidden_field_tag :account_id, @account.id %>
           <div class="space-y-2 max-h-64 overflow-auto">
             <% @available_enable_banking_accounts.each do |eba| %>
-              <label class="flex items-center gap-3 p-2 rounded border border-surface-inset/50 hover:border-primary cursor-pointer">
+              <label class="flex items-center gap-3 p-2 rounded border border-secondary hover:border-primary cursor-pointer">
                 <%= radio_button_tag :enable_banking_account_id, eba.id, false %>
                 <div class="flex flex-col">
                   <span class="text-sm text-primary font-medium"><%= eba.name.presence || eba.account_id %></span>
                   <span class="text-xs text-secondary">
-                    <%= eba.currency %> • Balance: <%= number_to_currency((eba.current_balance || 0), unit: eba.currency) %>
+                    <%= eba.currency %> • <%= t(".balance") %>: <%= number_to_currency((eba.current_balance || 0), unit: eba.currency) %>
                   </span>
                 </div>
               </label>
@@ -30,8 +30,8 @@
           </div>
 
           <div class="flex items-center justify-end gap-2">
-            <%= render DS::Button.new(text: "Link", variant: :primary, icon: "link-2", type: :submit) %>
-            <%= render DS::Link.new(text: "Cancel", variant: :secondary, href: accounts_path, data: { turbo_frame: "_top" }) %>
+            <%= render DS::Button.new(text: t(".link"), variant: :primary, icon: "link-2", type: :submit) %>
+            <%= render DS::Link.new(text: t(".cancel"), variant: :secondary, href: accounts_path, data: { turbo_frame: "_top" }) %>
           </div>
         <% end %>
       <% end %>
diff --git a/app/views/enable_banking_items/setup_accounts.html.erb b/app/views/enable_banking_items/setup_accounts.html.erb
index 2db41d72d..97060d2c2 100644
--- a/app/views/enable_banking_items/setup_accounts.html.erb
+++ b/app/views/enable_banking_items/setup_accounts.html.erb
@@ -1,8 +1,8 @@
 <%= render DS::Dialog.new do |dialog| %>
-  <% dialog.with_header(title: "Set Up Your Enable Banking Accounts") do %>
+  <% dialog.with_header(title: t(".title")) do %>
     <div class="flex items-center gap-2">
       <%= icon "building-2", class: "text-primary" %>
-      <span class="text-primary">Choose the correct account types for your imported accounts</span>
+      <span class="text-primary"><%= t(".header_subtitle") %></span>
     </div>
   <% end %>
 
@@ -13,7 +13,7 @@
                   data: {
                     controller: "loading-button",
                     action: "submit->loading-button#showLoading",
-                    loading_button_loading_text_value: "Creating Accounts...",
+                    loading_button_loading_text_value: t(".creating_accounts"),
                     turbo_frame: "_top"
                   },
                   class: "space-y-6" do |form| %>
@@ -24,7 +24,7 @@
             <%= icon "info", size: "sm", class: "text-primary mt-0.5 flex-shrink-0" %>
             <div>
               <p class="text-sm text-primary mb-2">
-                <strong>Choose the correct account type for each Enable Banking account:</strong>
+                <strong><%= t(".choose_account_type") %></strong>
               </p>
               <ul class="text-xs text-secondary space-y-1 list-disc list-inside">
                 <% @account_type_options.reject { |_, type| type == "skip" }.each do |label, _| %>
@@ -35,21 +35,33 @@
           </div>
         </div>
 
+        <!-- PSD2 savings accounts notice -->
+        <div class="bg-surface border border-primary p-4 rounded-lg">
+          <div class="flex items-start gap-3">
+            <%= icon "alert-triangle", size: "sm", class: "text-warning mt-0.5 flex-shrink-0" %>
+            <div>
+              <p class="text-sm text-primary">
+                <%= t("enable_banking_items.setup_accounts.psd2_savings_notice") %>
+              </p>
+            </div>
+          </div>
+        </div>
+
         <!-- Sync Date Range Selection -->
         <div class="bg-surface border border-primary p-4 rounded-lg">
           <div class="flex items-start gap-3">
             <%= icon "calendar", size: "sm", class: "text-primary mt-0.5 flex-shrink-0" %>
             <div class="flex-1">
               <p class="text-sm text-primary mb-3">
-                <strong>Historical Data Range:</strong>
+                <strong><%= t(".historical_data_range") %></strong>
               </p>
               <%= form.date_field :sync_start_date,
-                    label: "Start syncing transactions from:",
+                    label: t(".sync_start_date_label"),
                     value: @enable_banking_item.sync_start_date || 3.months.ago.to_date,
-                    min: 1.year.ago.to_date,
+                    min: 2.years.ago.to_date,
                     max: Date.current,
                     class: "w-full max-w-xs rounded-md border border-primary px-3 py-2 text-sm bg-container-inset text-primary",
-                    help_text: "Select how far back you want to sync transaction history. Maximum 1 year of history available." %>
+                    help_text: t(".sync_start_date_help") %>
             </div>
           </div>
         </div>
@@ -69,18 +81,21 @@
                     <p><%= enable_banking_account.account_type_display %></p>
                   <% end %>
                   <% if enable_banking_account.current_balance.present? %>
-                    <p>Balance: <%= number_to_currency(enable_banking_account.current_balance, unit: enable_banking_account.currency) %></p>
+                    <p><%= t(".balance") %>: <%= number_to_currency(enable_banking_account.current_balance, unit: enable_banking_account.currency) %></p>
                   <% end %>
                 </div>
               </div>
             </div>
 
-            <div class="space-y-3" data-controller="account-type-selector" data-account-type-selector-account-id-value="<%= enable_banking_account.id %>">
+            <div class="space-y-3"
+                 data-controller="account-type-selector"
+                 data-account-type-selector-account-id-value="<%= enable_banking_account.id %>"
+                 data-account-type-selector-suggested-subtype-value="<%= enable_banking_account.suggested_subtype %>">
               <div>
-                <%= label_tag "account_types[#{enable_banking_account.id}]", "Account Type:",
+                <%= label_tag "account_types[#{enable_banking_account.id}]", t(".account_type_label"),
                              class: "block text-sm font-medium text-primary mb-2" %>
                 <%= select_tag "account_types[#{enable_banking_account.id}]",
-                              options_for_select(@account_type_options, "skip"),
+                              options_for_select(@account_type_options, enable_banking_account.suggested_account_type || "skip"),
                               { class: "appearance-none bg-container border border-primary rounded-md px-3 py-2 text-sm leading-6 text-primary focus:border-primary focus:ring-1 focus:ring-primary focus:outline-none w-full",
                                 data: {
                                   action: "change->account-type-selector#updateSubtype"
@@ -100,7 +115,7 @@
 
       <div class="flex gap-3">
         <%= render DS::Button.new(
-          text: "Create Accounts",
+          text: t(".create_accounts"),
           variant: "primary",
           icon: "plus",
           type: "submit",
@@ -108,7 +123,7 @@
           data: { loading_button_target: "button" }
         ) %>
         <%= render DS::Link.new(
-          text: "Cancel",
+          text: t(".cancel"),
           variant: "secondary",
           href: accounts_path
         ) %>
diff --git a/app/views/entries/_entry.html.erb b/app/views/entries/_entry.html.erb
index 3c3f83fa3..5ba08622e 100644
--- a/app/views/entries/_entry.html.erb
+++ b/app/views/entries/_entry.html.erb
@@ -1,6 +1,6 @@
-<%# locals: (entry:, balance_trend: nil, view_ctx: "global") %>
+<%# locals: (entry:, balance_trend: nil, view_ctx: "global", in_split_group: false) %>
 
 <% if entry.entryable.present? %>
   <%= render partial: entry.entryable.to_partial_path,
-             locals: { entry: entry, balance_trend: balance_trend, view_ctx: view_ctx } %>
+             locals: { entry: entry, balance_trend: balance_trend, view_ctx: view_ctx, in_split_group: in_split_group } %>
 <% end %>
diff --git a/app/views/entries/_selection_bar.html.erb b/app/views/entries/_selection_bar.html.erb
index 5bd4b5788..19033d78e 100644
--- a/app/views/entries/_selection_bar.html.erb
+++ b/app/views/entries/_selection_bar.html.erb
@@ -7,6 +7,17 @@
 
   <div class="flex items-center gap-1 text-secondary">
     <%= turbo_frame_tag "bulk_transaction_edit_drawer" %>
+
+    <%= link_to new_transaction_path,
+                class: "p-1.5 group/duplicate hover:bg-inverse flex items-center justify-center rounded-md hidden",
+                title: t("transactions.selection_bar.duplicate"),
+                data: {
+                  turbo_frame: "modal",
+                  bulk_select_target: "duplicateLink"
+                } do %>
+      <%= icon "copy", class: "group-hover/duplicate:text-inverse" %>
+    <% end %>
+
     <%= link_to new_transactions_bulk_update_path,
                 class: "p-1.5 group/edit hover:bg-inverse flex items-center justify-center rounded-md",
                 title: "Edit",
diff --git a/app/views/family_exports/new.html.erb b/app/views/family_exports/new.html.erb
index 7c8f3ac98..9433eee2f 100644
--- a/app/views/family_exports/new.html.erb
+++ b/app/views/family_exports/new.html.erb
@@ -1,40 +1,40 @@
 <%= render DS::Dialog.new do |dialog| %>
-  <% dialog.with_header(title: "Export your data", subtitle: "Download all your financial data") %>
+  <% dialog.with_header(title: t(".dialog_title"), subtitle: t(".dialog_subtitle")) %>
 
   <% dialog.with_body do %>
     <div class="space-y-4">
       <div class="bg-container-inset rounded-lg p-4 space-y-3">
-        <h3 class="font-medium text-primary">What's included:</h3>
+        <h3 class="font-medium text-primary"><%= t(".whats_included") %></h3>
         <ul class="space-y-2 text-sm text-secondary">
           <li class="flex items-start gap-2">
             <%= icon "check", class: "shrink-0 mt-0.5 text-positive" %>
-            <span>All accounts and balances</span>
+            <span><%= t(".accounts_and_balances") %></span>
           </li>
           <li class="flex items-start gap-2">
             <%= icon "check", class: "shrink-0 mt-0.5 text-positive" %>
-            <span>Transaction history</span>
+            <span><%= t(".transaction_history") %></span>
           </li>
           <li class="flex items-start gap-2">
             <%= icon "check", class: "shrink-0 mt-0.5 text-positive" %>
-            <span>Investment trades</span>
+            <span><%= t(".investment_trades") %></span>
           </li>
           <li class="flex items-start gap-2">
             <%= icon "check", class: "shrink-0 mt-0.5 text-positive" %>
-            <span>Categories, tags and rules</span>
+            <span><%= t(".categories_tags_rules") %></span>
           </li>
         </ul>
       </div>
 
       <div class="bg-amber-50 border border-amber-200 rounded-lg p-3">
         <p class="text-sm text-amber-800">
-          <strong>Note:</strong> This export includes all of your data, but only some of the data can be imported back via the CSV import feature. We support account, transaction (with category and tags), and trade imports. Other account data cannot be imported and is for your records only.
+          <strong><%= t(".note_label") %>:</strong> <%= t(".note_description") %>
         </p>
       </div>
 
       <%= form_with url: family_exports_path, method: :post, class: "space-y-4" do |form| %>
         <div class="flex gap-3">
-          <%= link_to "Cancel", "#", class: "flex-1 text-center px-4 py-2 text-primary bg-surface border border-primary rounded-lg hover:bg-surface-hover", data: { action: "click->modal#close" } %>
-          <%= form.submit "Export data", class: "flex-1 bg-inverse fg-inverse rounded-lg px-4 py-2 cursor-pointer hover:bg-inverse-hover" %>
+          <%= link_to t(".cancel"), "#", class: "flex-1 text-center px-4 py-2 text-primary bg-surface border border-primary rounded-lg hover:bg-surface-hover", data: { action: "click->modal#close" } %>
+          <%= form.submit t(".export_data"), class: "flex-1 bg-inverse text-inverse rounded-lg px-4 py-2 cursor-pointer hover:bg-inverse-hover" %>
         </div>
       <% end %>
     </div>
diff --git a/app/views/family_merchants/_family_merchant.html.erb b/app/views/family_merchants/_family_merchant.html.erb
index 8e3306df7..c0df9dfec 100644
--- a/app/views/family_merchants/_family_merchant.html.erb
+++ b/app/views/family_merchants/_family_merchant.html.erb
@@ -18,10 +18,10 @@
   </td>
   <td class="py-3 px-4 text-sm text-right align-middle">
     <%= render DS::Menu.new do |menu| %>
-      <% menu.with_item(variant: "link", text: "Edit", href: edit_family_merchant_path(family_merchant), icon: "pencil", data: { turbo_frame: "modal" }) %>
+      <% menu.with_item(variant: "link", text: t(".edit"), href: edit_family_merchant_path(family_merchant), icon: "pencil", data: { turbo_frame: "modal" }) %>
       <% menu.with_item(
         variant: "button",
-        text: "Delete",
+        text: t(".delete"),
         href: family_merchant_path(family_merchant),
         icon: "trash-2",
         method: :delete,
diff --git a/app/views/family_merchants/merge.html.erb b/app/views/family_merchants/merge.html.erb
index 77d6ba84f..879118d56 100644
--- a/app/views/family_merchants/merge.html.erb
+++ b/app/views/family_merchants/merge.html.erb
@@ -13,7 +13,7 @@
         <div class="max-h-64 overflow-y-auto space-y-1 border border-secondary rounded-lg p-2">
           <% @merchants.each do |merchant| %>
             <label class="flex items-center gap-2 p-2 hover:bg-surface-hover rounded cursor-pointer">
-              <%= check_box_tag "source_ids[]", merchant.id, false, class: "rounded border-gray-300" %>
+              <%= check_box_tag "source_ids[]", merchant.id, false, class: "rounded border-secondary" %>
               <span class="text-sm text-primary"><%= merchant.name %></span>
               <% if merchant.is_a?(ProviderMerchant) %>
                 <span class="text-xs text-subdued">(<%= merchant.source&.titleize %>)</span>
@@ -26,6 +26,7 @@
 
       <%= render DS::Button.new(
         text: t(".submit"),
+        type: :submit,
         full_width: true
       ) %>
     <% end %>
diff --git a/app/views/holdings/_cash.html.erb b/app/views/holdings/_cash.html.erb
index 6fde392d7..72e8ceaf4 100644
--- a/app/views/holdings/_cash.html.erb
+++ b/app/views/holdings/_cash.html.erb
@@ -29,7 +29,7 @@
   </div>
 
   <div class="col-span-2 text-right">
-    <%= tag.p format_money account.cash_balance_money %>
+    <%= tag.p format_money(account.cash_balance_money), class: "privacy-sensitive" %>
   </div>
 
   <div class="col-span-2 text-right">
diff --git a/app/views/holdings/_cost_basis_cell.html.erb b/app/views/holdings/_cost_basis_cell.html.erb
index f482d0097..4ae265df4 100644
--- a/app/views/holdings/_cost_basis_cell.html.erb
+++ b/app/views/holdings/_cost_basis_cell.html.erb
@@ -12,29 +12,29 @@
   <% if holding.cost_basis_locked? && !editable %>
     <%# Locked and not editable (from holdings list) - just show value, right-aligned %>
     <div class="flex items-center justify-end gap-1">
-      <%= tag.span format_money(holding.avg_cost) %>
+      <%= tag.span format_money(holding.avg_cost), class: "privacy-sensitive" %>
       <%= icon "lock", size: "xs", class: "text-secondary" %>
     </div>
   <% else %>
     <%# Unlocked OR editable context (drawer) - show clickable menu %>
-    <%= render DS::Menu.new(variant: :button, placement: "bottom-end") do |menu| %>
-      <% menu.with_button(class: "hover:text-primary cursor-pointer group") do %>
+    <%= render DS::Popover.new(variant: :button, placement: "bottom-end") do |popover| %>
+      <% popover.with_button(class: "hover:text-primary cursor-pointer group") do %>
         <% if holding.avg_cost %>
           <div class="flex items-center gap-1">
-            <%= tag.span format_money(holding.avg_cost) %>
+            <%= tag.span format_money(holding.avg_cost), class: "privacy-sensitive" %>
             <% if holding.cost_basis_locked? %>
               <%= icon "lock", size: "xs", class: "text-secondary" %>
             <% end %>
             <%= icon "pencil", size: "xs", class: "text-secondary opacity-0 group-hover:opacity-100 transition-opacity" %>
           </div>
         <% else %>
-          <div class="flex items-center gap-1 px-2 py-0.5 rounded text-secondary hover:text-primary hover:bg-gray-100 theme-dark:hover:bg-gray-700 transition-colors">
+          <div class="flex items-center gap-1 px-2 py-0.5 rounded text-secondary hover:text-primary hover:bg-container-inset-hover transition-colors">
             <%= icon "pencil", size: "xs" %>
-            <span class="text-xs">Set</span>
+            <span class="text-xs"><%= t(".set") %></span>
           </div>
         <% end %>
       <% end %>
-      <% menu.with_custom_content do %>
+      <% popover.with_custom_content do %>
         <div class="p-4 min-w-[280px]"
              data-controller="cost-basis-form"
              data-cost-basis-form-qty-value="<%= holding.qty %>">
@@ -95,8 +95,8 @@
 
             <div class="flex justify-end gap-2 pt-2">
               <button type="button"
-                      class="inline-flex items-center gap-1 px-2 py-1 rounded-md text-sm font-medium text-primary bg-gray-200 hover:bg-gray-300 theme-dark:bg-gray-700 theme-dark:hover:bg-gray-600"
-                      data-action="click->DS--menu#close">
+                      class="inline-flex items-center gap-1 px-2 py-1 rounded-md text-sm font-medium text-primary button-bg-secondary-strong hover:button-bg-secondary-strong-hover"
+                      data-action="click->DS--popover#close">
                 <%= t(".cancel") %>
               </button>
               <%= f.submit t(".save"), class: "inline-flex items-center gap-1 px-2 py-1 rounded-md text-sm font-medium text-inverse bg-inverse hover:bg-inverse-hover" %>
diff --git a/app/views/holdings/_holding.html.erb b/app/views/holdings/_holding.html.erb
index c0ba88e64..533b2a7a6 100644
--- a/app/views/holdings/_holding.html.erb
+++ b/app/views/holdings/_holding.html.erb
@@ -3,10 +3,8 @@
 <%= turbo_frame_tag dom_id(holding) do %>
   <div class="grid grid-cols-12 items-center text-primary text-sm font-medium p-4">
     <div class="col-span-4 flex items-center gap-4">
-      <% if holding.security.brandfetch_icon_url.present? %>
-        <%= image_tag holding.security.brandfetch_icon_url, class: "w-9 h-9 rounded-full", loading: "lazy" %>
-      <% elsif holding.security.logo_url.present? %>
-        <%= image_tag holding.security.logo_url, class: "w-9 h-9 rounded-full", loading: "lazy" %>
+      <% if (logo = holding.security.display_logo_url).present? %>
+        <%= image_tag logo, class: "w-9 h-9 rounded-full", loading: "lazy" %>
       <% else %>
         <%= render DS::FilledIcon.new(variant: :text, text: holding.name, size: "md", rounded: true) %>
       <% end %>
@@ -41,7 +39,7 @@
       <% else %>
         <%= tag.p "--", class: "text-secondary" %>
       <% end %>
-      <%= tag.p t(".shares", qty: format_quantity(holding.qty)), class: "font-normal text-secondary" %>
+      <%= tag.p t(".shares", qty: format_quantity(holding.qty)), class: "font-normal text-secondary privacy-sensitive" %>
     </div>
 
     <div class="col-span-2 text-right">
diff --git a/app/views/holdings/_missing_price_tooltip.html.erb b/app/views/holdings/_missing_price_tooltip.html.erb
index f2f592011..94793a882 100644
--- a/app/views/holdings/_missing_price_tooltip.html.erb
+++ b/app/views/holdings/_missing_price_tooltip.html.erb
@@ -3,8 +3,8 @@
     <%= icon "info", size: "sm", color: "current" %>
     <%= tag.span t(".missing_data"), class: "font-normal text-xs" %>
   </div>
-  <div role="tooltip" data-tooltip-target="tooltip" class="tooltip bg-gray-700 text-sm p-2 rounded w-64">
-    <div class="fg-inverse">
+  <div role="tooltip" data-tooltip-target="tooltip" class="tooltip bg-inverse text-sm p-2 rounded w-64">
+    <div class="text-inverse">
       <%= t(".description") %>
     </div>
   </div>
diff --git a/app/views/holdings/index.html.erb b/app/views/holdings/index.html.erb
index a98a88c27..22eb0afa2 100644
--- a/app/views/holdings/index.html.erb
+++ b/app/views/holdings/index.html.erb
@@ -5,7 +5,7 @@
       <%= link_to new_trade_path(account_id: @account.id),
                   id: dom_id(@account, "new_trade"),
                   data: { turbo_frame: :modal },
-                  class: "flex gap-1 font-medium items-center bg-gray-50 theme-dark:bg-gray-700 hover:bg-gray-100 theme-dark:hover:bg-gray-600 text-primary p-2 rounded-lg" do %>
+                  class: "flex gap-1 font-medium items-center button-bg-secondary hover:button-bg-secondary-hover text-primary p-2 rounded-lg" do %>
         <span class="text-primary">
           <%= icon("plus", color: "current") %>
         </span>
diff --git a/app/views/holdings/show.html.erb b/app/views/holdings/show.html.erb
index 38ff086c0..e382fda31 100644
--- a/app/views/holdings/show.html.erb
+++ b/app/views/holdings/show.html.erb
@@ -6,10 +6,8 @@
         <%= tag.p @holding.ticker, class: "text-sm text-secondary" %>
       </div>
       <div class="flex items-center gap-3">
-        <% if @holding.security.brandfetch_icon_url.present? %>
-          <%= image_tag @holding.security.brandfetch_icon_url, loading: "lazy", class: "w-9 h-9 rounded-full" %>
-        <% elsif @holding.security.logo_url.present? %>
-          <%= image_tag @holding.security.logo_url, loading: "lazy", class: "w-9 h-9 rounded-full" %>
+        <% if (logo = @holding.security.display_logo_url).present? %>
+          <%= image_tag logo, loading: "lazy", class: "w-9 h-9 rounded-full" %>
         <% else %>
           <%= render DS::FilledIcon.new(variant: :text, text: @holding.name, size: "md", rounded: true) %>
         <% end %>
@@ -20,13 +18,31 @@
   <% dialog.with_body do %>
     <% dialog.with_section(title: t(".overview"), open: true) do %>
       <div class="pb-4">
+        <% if @holding.security.provider_status == :provider_unavailable %>
+          <div class="px-3 pt-2">
+            <%= render DS::Alert.new(
+              message: t(".provider_disabled_warning", provider: @holding.security.price_provider&.humanize || "Unknown"),
+              variant: :warning
+            ) %>
+          </div>
+        <% end %>
+        <% if (first_on = @holding.security.first_provider_price_on).present? &&
+              (earliest_trade_date = @holding.trades.minimum(:date)) &&
+              earliest_trade_date < first_on %>
+          <div class="px-3 pt-2">
+            <%= render DS::Alert.new(
+              message: t(".truncated_history_warning", date: l(first_on, format: :long)),
+              variant: :warning
+            ) %>
+          </div>
+        <% end %>
         <dl class="space-y-3 px-3 py-2">
           <div data-controller="holding-security-remap">
             <div class="flex items-center justify-between text-sm">
               <dt class="text-secondary"><%= t(".security_label") %></dt>
               <dd class="text-primary flex items-center gap-2">
                 <%= @holding.ticker %>
-                <% if @holding.security_remapped? %>
+                <% if @holding.security_remapped? && @holding.account.linked? %>
                   <span class="text-xs text-secondary">
                     (<%= t(".originally", ticker: @holding.provider_security.ticker) %>)
                   </span>
@@ -41,8 +57,8 @@
               </dd>
             </div>
             <div data-holding-security-remap-target="form" class="hidden mt-3 space-y-3">
-              <% if Security.provider.present? %>
-                <%= form_with url: remap_security_holding_path(@holding), method: :patch, class: "space-y-3" do |f| %>
+              <% if Security.providers.any? %>
+                <%= styled_form_with url: remap_security_holding_path(@holding), method: :patch, class: "space-y-3" do |f| %>
                   <div class="form-field combobox">
                     <%= f.combobox :security_id,
                                   securities_path(country_code: Current.family.country),
@@ -52,11 +68,11 @@
                   </div>
                   <div class="flex justify-end gap-2">
                     <button type="button"
-                            class="inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-primary bg-gray-200 hover:bg-gray-300 theme-dark:bg-gray-700 theme-dark:hover:bg-gray-600"
+                            class="inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-primary button-bg-secondary-strong hover:button-bg-secondary-strong-hover"
                             data-action="click->holding-security-remap#toggle">
                       <%= t(".cancel") %>
                     </button>
-                    <%= f.submit t(".remap_security"), class: "inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-inverse bg-inverse hover:bg-inverse-hover" %>
+                    <%= f.submit t(".remap_security") %>
                   </div>
                 <% end %>
               <% else %>
@@ -165,11 +181,11 @@
                 </div>
                 <div class="flex justify-end gap-2 pt-2">
                   <button type="button"
-                          class="inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-primary bg-gray-200 hover:bg-gray-300 theme-dark:bg-gray-700 theme-dark:hover:bg-gray-600"
+                          class="inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-primary button-bg-secondary-strong hover:button-bg-secondary-strong-hover"
                           data-action="click->drawer-cost-basis#toggle">
                     <%= t("holdings.cost_basis_cell.cancel") %>
                   </button>
-                  <%= f.submit t("holdings.cost_basis_cell.save"), class: "inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-inverse bg-inverse hover:bg-inverse-hover" %>
+                  <%= f.submit t("holdings.cost_basis_cell.save") %>
                 </div>
               <% end %>
             </div>
@@ -229,10 +245,31 @@
         </div>
       </div>
     <% end %>
-    <% if @holding.cost_basis_locked? || @holding.security_remapped? || @holding.account.can_delete_holdings? || !@holding.security.offline? %>
+    <% if @holding.cost_basis_locked? || (@holding.security_remapped? && @holding.account.linked?) || @holding.account.can_delete_holdings? || !@holding.security.offline? || @holding.security.provider_status == :provider_unavailable %>
       <% dialog.with_section(title: t(".settings"), open: true) do %>
         <div class="pb-4">
-          <% if @holding.security_remapped? %>
+          <% if @holding.security.provider_status == :provider_unavailable %>
+            <div class="flex items-center justify-between gap-2 p-3 border-b border-tertiary">
+              <div class="text-sm space-y-1 flex-1">
+                <h4 class="text-primary"><%= t(".switch_provider_label") %></h4>
+                <p class="text-secondary"><%= t(".switch_provider_description", provider: @holding.security.price_provider&.humanize || "Unknown") %></p>
+                <% if Security.providers.any? %>
+                  <%= form_with url: remap_security_holding_path(@holding), method: :patch, data: { controller: "auto-submit-form", "auto-submit-form-trigger-event-value": "change" } do |f| %>
+                    <div class="form-field combobox mt-2">
+                      <%= f.combobox :security_id,
+                                    securities_path(country_code: Current.family.country),
+                                    id: "switch_provider_security_id",
+                                    placeholder: t(".search_security_placeholder"),
+                                    data: { "auto-submit-form-target": "auto" } %>
+                    </div>
+                  <% end %>
+                <% else %>
+                  <p class="text-xs text-secondary mt-2"><%= t(".no_security_provider") %></p>
+                <% end %>
+              </div>
+            </div>
+          <% end %>
+          <% if @holding.security_remapped? && @holding.account.linked? %>
             <div class="flex items-center justify-between gap-2 p-3 border-b border-tertiary">
               <div class="text-sm space-y-1">
                 <h4 class="text-primary"><%= t(".security_remapped_label") %></h4>
@@ -241,7 +278,7 @@
               <%= button_to t(".reset_to_provider"),
                   reset_security_holding_path(@holding),
                   method: :post,
-                  class: "inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-primary bg-gray-200 hover:bg-gray-300 theme-dark:bg-gray-700 theme-dark:hover:bg-gray-600",
+                  class: "inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-primary button-bg-secondary-strong hover:button-bg-secondary-strong-hover",
                   form: { data: { turbo: false } },
                   data: { turbo_confirm: {
                     title: t(".reset_confirm_title"),
@@ -260,7 +297,7 @@
               <%= button_to t(".market_data_sync_button"),
                   sync_prices_holding_path(@holding),
                   method: :post,
-                  class: "inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-primary bg-gray-200 hover:bg-gray-300 theme-dark:bg-gray-700 theme-dark:hover:bg-gray-600",
+                  class: "inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-primary button-bg-secondary-strong hover:button-bg-secondary-strong-hover",
                   data: { loading_button_target: "button" },
                   form: { data: {
                     controller: "loading-button",
@@ -278,7 +315,7 @@
               <%= button_to t(".unlock_cost_basis"),
                   unlock_cost_basis_holding_path(@holding),
                   method: :post,
-                  class: "inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-primary bg-gray-200 hover:bg-gray-300 theme-dark:bg-gray-700 theme-dark:hover:bg-gray-600",
+                  class: "inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-primary button-bg-secondary-strong hover:button-bg-secondary-strong-hover",
                   form: { data: { turbo: false } },
                   data: { turbo_confirm: { title: t(".unlock_confirm_title"), body: t(".unlock_confirm_body") } } %>
             </div>
diff --git a/app/views/holdings/sync_prices.turbo_stream.erb b/app/views/holdings/sync_prices.turbo_stream.erb
index f2e253d91..98ab65d43 100644
--- a/app/views/holdings/sync_prices.turbo_stream.erb
+++ b/app/views/holdings/sync_prices.turbo_stream.erb
@@ -45,7 +45,7 @@
     <%= button_to t("holdings.show.market_data_sync_button"),
         sync_prices_holding_path(@holding),
         method: :post,
-        class: "inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-primary bg-gray-200 hover:bg-gray-300 theme-dark:bg-gray-700 theme-dark:hover:bg-gray-600",
+        class: "inline-flex items-center gap-1 px-3 py-2 rounded-lg text-sm font-medium text-primary button-bg-secondary-strong hover:button-bg-secondary-strong-hover",
         data: { loading_button_target: "button" },
         form: { data: {
           controller: "loading-button",
diff --git a/app/views/ibkr_items/_ibkr_item.html.erb b/app/views/ibkr_items/_ibkr_item.html.erb
new file mode 100644
index 000000000..f65e9b411
--- /dev/null
+++ b/app/views/ibkr_items/_ibkr_item.html.erb
@@ -0,0 +1,116 @@
+<%# locals: (ibkr_item:) %>
+
+<%= tag.div id: dom_id(ibkr_item) do %>
+  <% unlinked_count = ibkr_item.unlinked_accounts_count %>
+
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center justify-between gap-2">
+        <div class="flex items-center gap-2">
+          <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
+
+          <div class="flex items-center justify-center h-8 w-8 rounded-full bg-[#D32F2F]/10">
+            <span class="text-[#D32F2F] text-xs font-medium">IB</span>
+          </div>
+
+          <div class="pl-1 text-sm">
+            <div class="flex items-center gap-2">
+              <%= tag.p ibkr_item.institution_display_name, class: "font-medium text-primary" %>
+              <% if ibkr_item.scheduled_for_deletion? %>
+                <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+              <% end %>
+            </div>
+            <p class="text-xs text-secondary"><%= t(".flex_web_service") %></p>
+            <% if ibkr_item.syncing? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "loader", size: "sm", class: "animate-spin" %>
+                <%= tag.span t(".syncing") %>
+              </div>
+            <% elsif ibkr_item.requires_update? %>
+              <div class="text-warning flex items-center gap-1">
+                <%= icon "alert-triangle", size: "sm", color: "warning" %>
+                <%= tag.span t(".requires_update") %>
+              </div>
+            <% elsif ibkr_item.sync_error.present? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= render DS::Tooltip.new(text: ibkr_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive", as: :span) %>
+                <%= tag.span t(".error"), class: "text-destructive" %>
+              </div>
+            <% else %>
+              <p class="text-secondary">
+                <% if ibkr_item.last_synced_at %>
+                  <%= t(".synced", time: time_ago_in_words(ibkr_item.last_synced_at), summary: ibkr_item.sync_status_summary) %>
+                <% else %>
+                  <%= t(".never_synced") %>
+                <% end %>
+              </p>
+            <% end %>
+          </div>
+        </div>
+
+        <% if Current.user&.admin? %>
+          <div class="flex items-center gap-2">
+            <%= icon(
+              "refresh-cw",
+              as_button: true,
+              href: sync_ibkr_item_path(ibkr_item),
+              disabled: ibkr_item.syncing?
+            ) %>
+
+            <%= render DS::Menu.new do |menu| %>
+              <% if unlinked_count > 0 %>
+                <% menu.with_item(
+                  variant: "link",
+                  text: t(".setup_accounts"),
+                  icon: "settings",
+                  href: setup_accounts_ibkr_item_path(ibkr_item),
+                  frame: :modal
+                ) %>
+              <% end %>
+              <% menu.with_item(
+                variant: "button",
+                text: t(".delete"),
+                icon: "trash-2",
+                href: ibkr_item_path(ibkr_item),
+                method: :delete,
+                confirm: CustomConfirm.for_resource_deletion(ibkr_item.institution_display_name, high_severity: true)
+              ) %>
+            <% end %>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
+
+    <% unless ibkr_item.scheduled_for_deletion? %>
+      <div class="space-y-4 mt-4">
+        <% if ibkr_item.accounts.any? %>
+          <%= render "accounts/index/account_groups", accounts: ibkr_item.accounts %>
+        <% end %>
+
+        <% stats = ibkr_item.syncs.ordered.first&.sync_stats || {} %>
+        <%= render ProviderSyncSummary.new(stats: stats, provider_item: ibkr_item) %>
+
+        <% if Current.user&.admin? %>
+          <% if unlinked_count > 0 && ibkr_item.accounts.empty? %>
+            <div class="p-4 flex flex-col gap-3 items-center justify-center">
+              <p class="text-primary font-medium text-sm"><%= t(".accounts_need_setup") %></p>
+              <p class="text-secondary text-sm"><%= t(".accounts_need_setup_description") %></p>
+              <%= render DS::Link.new(
+                text: t(".setup_accounts"),
+                icon: "settings",
+                variant: "primary",
+                href: setup_accounts_ibkr_item_path(ibkr_item),
+                frame: :modal
+              ) %>
+            </div>
+          <% elsif ibkr_item.ibkr_accounts.none? %>
+            <div class="p-4 flex flex-col gap-3 items-center justify-center">
+              <p class="text-primary font-medium text-sm"><%= t(".no_accounts_discovered") %></p>
+              <p class="text-secondary text-sm"><%= t(".no_accounts_discovered_description") %></p>
+            </div>
+          <% end %>
+        <% end %>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/ibkr_items/select_existing_account.html.erb b/app/views/ibkr_items/select_existing_account.html.erb
new file mode 100644
index 000000000..d1d27663b
--- /dev/null
+++ b/app/views/ibkr_items/select_existing_account.html.erb
@@ -0,0 +1,39 @@
+<%= turbo_frame_tag "modal" do %>
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t(".title")) %>
+
+    <% dialog.with_body do %>
+      <% if @available_ibkr_accounts.blank? %>
+        <div class="p-4 text-sm text-secondary">
+          <p class="mb-2"><%= t(".no_accounts_available") %></p>
+          <ul class="list-disc list-inside space-y-1">
+            <li><%= t(".run_sync_hint") %></li>
+            <li><%= t(".wait_for_sync") %></li>
+          </ul>
+        </div>
+      <% else %>
+        <%= form_with url: link_existing_account_ibkr_items_path, method: :post, data: { turbo_frame: "_top" }, class: "space-y-4" do %>
+          <%= hidden_field_tag :account_id, @account.id %>
+          <div class="space-y-2 max-h-64 overflow-auto">
+            <% @available_ibkr_accounts.each do |ibkr_account| %>
+              <label class="flex items-center gap-3 p-2 rounded border border-secondary hover:border-primary cursor-pointer">
+                <%= radio_button_tag :ibkr_account_id, ibkr_account.id, false %>
+                <div class="flex flex-col">
+                  <span class="text-sm text-primary font-medium"><%= ibkr_account.name.presence || ibkr_account.ibkr_account_id %></span>
+                  <span class="text-xs text-secondary">
+                    <%= ibkr_account.currency %> • <%= t(".balance") %>: <%= number_to_currency((ibkr_account.current_balance || 0), unit: Money::Currency.new(ibkr_account.currency || "USD").symbol) %>
+                  </span>
+                </div>
+              </label>
+            <% end %>
+          </div>
+
+          <div class="flex items-center justify-end gap-2">
+            <%= render DS::Button.new(text: t(".link"), variant: :primary, icon: "link-2", type: :submit) %>
+            <%= render DS::Link.new(text: t(".cancel"), variant: :secondary, href: accounts_path, data: { turbo_frame: "_top" }) %>
+          </div>
+        <% end %>
+      <% end %>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/ibkr_items/setup_accounts.html.erb b/app/views/ibkr_items/setup_accounts.html.erb
new file mode 100644
index 000000000..80fb4d1e3
--- /dev/null
+++ b/app/views/ibkr_items/setup_accounts.html.erb
@@ -0,0 +1,174 @@
+<% content_for :title, t(".page_title") %>
+
+<%= render DS::Dialog.new(disable_click_outside: true) do |dialog| %>
+  <% dialog.with_header(title: t(".dialog_title")) do %>
+    <div class="flex items-center gap-2">
+      <%= icon "chart-line", class: "text-primary" %>
+      <span class="text-primary"><%= t(".subtitle") %></span>
+    </div>
+  <% end %>
+
+  <% dialog.with_body do %>
+    <div class="space-y-6">
+      <div class="bg-surface border border-primary p-4 rounded-lg">
+        <div class="flex items-start gap-3">
+          <%= icon "info", size: "sm", class: "text-primary mt-0.5 flex-shrink-0" %>
+          <div>
+            <p class="text-sm text-primary mb-2"><strong><%= t(".info_box.title") %></strong></p>
+            <ul class="text-xs text-secondary space-y-1 list-disc list-inside">
+              <li><%= t(".info_box.items.item_1") %></li>
+              <li><%= t(".info_box.items.item_2") %></li>
+              <li><%= t(".info_box.items.item_3") %></li>
+            </ul>
+            <p class="text-xs text-warning mt-2">
+              <%= icon "alert-triangle", size: "xs", class: "inline-block mr-1" %>
+              <%= t(".info_box.warning") %>
+            </p>
+          </div>
+        </div>
+      </div>
+
+      <% if @waiting_for_sync %>
+        <div id="ibkr-sync-spinner" class="flex flex-col items-center justify-center py-6 space-y-3">
+          <div class="animate-spin rounded-full h-6 w-6 border-b-2 border-primary"></div>
+          <p class="text-secondary text-center"><%= t(".status.fetching_accounts") %></p>
+        </div>
+        <div class="flex gap-3 justify-center">
+          <%= render DS::Link.new(
+            text: t(".buttons.refresh"),
+            variant: "secondary",
+            icon: "refresh-cw",
+            href: setup_accounts_ibkr_item_path(@ibkr_item),
+            frame: "_top"
+          ) %>
+          <%= render DS::Link.new(
+            text: t(".buttons.cancel"),
+            variant: "ghost",
+            href: accounts_path,
+            frame: "_top"
+          ) %>
+        </div>
+      <% elsif @no_accounts_found %>
+        <div class="no-accounts-found flex flex-col items-center justify-center py-6 space-y-3">
+          <%= icon "alert-circle", size: "lg", class: "text-warning" %>
+          <p class="text-primary text-center font-medium"><%= t(".status.no_accounts_found_title") %></p>
+          <p class="text-secondary text-center text-sm"><%= t(".status.no_accounts_found_description") %></p>
+        </div>
+        <div class="flex gap-3 justify-center">
+          <%= render DS::Link.new(
+            text: t(".buttons.back_to_settings"),
+            variant: "secondary",
+            href: settings_providers_path,
+            frame: "_top"
+          ) %>
+        </div>
+      <% else %>
+        <%= form_with url: complete_account_setup_ibkr_item_path(@ibkr_item), method: :post, data: { turbo_frame: "_top" } do %>
+          <% if @unlinked_accounts.any? %>
+            <div class="space-y-4">
+              <h3 class="font-medium text-primary"><%= t(".available_accounts.title") %></h3>
+
+              <% @unlinked_accounts.each do |ibkr_account| %>
+                <div class="border border-primary rounded-lg p-4 hover:bg-surface transition-colors">
+                  <div class="flex items-center gap-3">
+                    <input type="checkbox"
+                           id="account_<%= ibkr_account.id %>"
+                           name="account_ids[]"
+                           value="<%= ibkr_account.id %>"
+                           checked
+                           class="cursor-pointer">
+                    <label for="account_<%= ibkr_account.id %>" class="flex-1 cursor-pointer">
+                      <h4 class="font-medium text-primary"><%= ibkr_account.name %></h4>
+                      <p class="text-sm text-secondary">
+                        <%= t(
+                          ".available_accounts.account_summary",
+                          account_type: t(".available_accounts.account_type_investment"),
+                          balance: number_to_currency(ibkr_account.current_balance || 0, unit: Money::Currency.new(ibkr_account.currency || "USD").symbol)
+                        ) %>
+                      </p>
+                      <% if ibkr_account.ibkr_account_id.present? %>
+                        <p class="text-xs text-secondary"><%= t(".available_accounts.account_id", account_id: ibkr_account.ibkr_account_id) %></p>
+                      <% end %>
+                    </label>
+                  </div>
+                </div>
+              <% end %>
+            </div>
+
+            <div class="flex gap-3 mt-6">
+              <%= render DS::Button.new(
+                text: t(".buttons.create_selected_accounts"),
+                variant: "primary",
+                icon: "plus",
+                type: "submit",
+                class: "flex-1"
+              ) %>
+              <%= render DS::Link.new(
+                text: t(".buttons.cancel"),
+                variant: "secondary",
+                href: accounts_path,
+                frame: "_top"
+              ) %>
+            </div>
+          <% end %>
+        <% end %>
+
+        <% if @unlinked_accounts.any? && @linkable_accounts.any? %>
+          <div class="border-t border-secondary pt-4 mt-2">
+            <p class="text-xs text-secondary mb-3"><%= t(".link_existing.description") %></p>
+            <div class="space-y-2">
+              <% @unlinked_accounts.each do |ibkr_account| %>
+                <%= form_with url: link_existing_account_ibkr_items_path, method: :post, data: { turbo_frame: "_top" } do |link_form| %>
+                  <%= link_form.hidden_field :ibkr_account_id, value: ibkr_account.id %>
+                  <p class="text-xs text-primary mb-1"><%= ibkr_account.name %></p>
+                  <div class="flex items-center gap-2">
+                    <%= link_form.select :account_id,
+                          options_for_select(@linkable_accounts.map { |account| [t(".link_existing.manual_account_option", name: account.name, balance: number_to_currency(account.balance, unit: Money::Currency.new(account.currency || 'USD').symbol)), account.id] }),
+                          { prompt: t(".link_existing.select_prompt") },
+                          class: "bg-container border border-primary rounded px-2 py-1 text-sm text-primary flex-1 min-w-0" %>
+                    <%= render DS::Button.new(
+                      text: t(".buttons.link"),
+                      variant: "secondary",
+                      size: "sm",
+                      type: "submit"
+                    ) %>
+                  </div>
+                <% end %>
+              <% end %>
+            </div>
+          </div>
+        <% end %>
+
+        <% if @linked_accounts.any? %>
+          <div class="<%= 'border-t border-primary pt-6 mt-4' if @unlinked_accounts.any? %>">
+            <h3 class="font-medium text-primary mb-4"><%= t(".linked_accounts.title") %></h3>
+            <% @linked_accounts.each do |ibkr_account| %>
+              <div class="border border-success/20 bg-success/5 rounded-lg p-4 mb-2">
+                <div class="flex items-center justify-between">
+                  <div class="flex items-center gap-3">
+                    <%= icon "check-circle", class: "text-success" %>
+                    <div>
+                      <h4 class="font-medium text-primary"><%= ibkr_account.name %></h4>
+                      <p class="text-sm text-secondary"><%= t(".linked_accounts.linked_to_html", account: link_to(ibkr_account.current_account.name, account_path(ibkr_account.current_account), class: "link")) %></p>
+                    </div>
+                  </div>
+                </div>
+              </div>
+            <% end %>
+          </div>
+
+          <% if @unlinked_accounts.blank? %>
+            <div class="flex justify-end mt-4">
+              <%= render DS::Link.new(
+                text: t(".buttons.done"),
+                variant: "primary",
+                href: accounts_path,
+                frame: "_top"
+              ) %>
+            </div>
+          <% end %>
+        <% end %>
+      <% end %>
+    </div>
+  <% end %>
+<% end %>
diff --git a/app/views/impersonation_sessions/_super_admin_bar.html.erb b/app/views/impersonation_sessions/_super_admin_bar.html.erb
index a09a8250f..718471b67 100644
--- a/app/views/impersonation_sessions/_super_admin_bar.html.erb
+++ b/app/views/impersonation_sessions/_super_admin_bar.html.erb
@@ -1,20 +1,20 @@
 <div class="sticky top-0 left-0 w-full bg-black flex items-center justify-between font-mono">
   <div class="flex items-center bg-red-600 px-6 py-4">
     <%= icon "alert-triangle", size: "lg", color: "current", class: "mr-2" %>
-    <span class="text-inverse font-semibold uppercase">Super Admin</span>
+    <span class="text-inverse font-semibold uppercase"><%= t(".super_admin") %></span>
   </div>
   <div>
-    <%= link_to "Jobs", sidekiq_web_url, class: "text-white underline hover:text-gray-100" %>
+    <%= link_to t(".jobs"), sidekiq_web_url, class: "text-white underline hover:text-gray-100" %>
   </div>
 
   <div class="flex items-center space-x-2 px-2 py-2 text-white">
     <% if Current.session.active_impersonator_session.present? %>
       <div class="flex items-center space-x-3 bg-gray-800 border border-gray-700 rounded-md pl-3">
         <div class="text-sm">
-          Impersonating: <span class="font-semibold text-red-400"><%= Current.impersonated_user.email %></span>
+          <%= t(".impersonating") %>: <span class="font-semibold text-red-400"><%= Current.impersonated_user.email %></span>
         </div>
-        <%= button_to "Leave", leave_impersonation_sessions_path, method: :delete, class: "items-center px-3 py-1.5 border border-transparent text-sm font-medium rounded-md text-white bg-red-600 hover:bg-red-700 focus:outline-hidden focus:ring-2 focus:ring-offset-2 focus:ring-red-500" %>
-        <%= button_to "Terminate", complete_impersonation_session_path(Current.session.active_impersonator_session), method: :put, class: "items-center px-3 py-1.5 border border-transparent text-sm font-medium rounded-md text-white bg-red-600 hover:bg-red-700 focus:outline-hidden focus:ring-2 focus:ring-offset-2 focus:ring-red-500" %>
+        <%= button_to t(".leave"), leave_impersonation_sessions_path, method: :delete, class: "items-center px-3 py-1.5 border border-transparent text-sm font-medium rounded-md text-white bg-red-600 hover:bg-red-700 focus:outline-hidden focus:ring-2 focus:ring-offset-2 focus:ring-red-500" %>
+        <%= button_to t(".terminate"), complete_impersonation_session_path(Current.session.active_impersonator_session), method: :put, class: "items-center px-3 py-1.5 border border-transparent text-sm font-medium rounded-md text-white bg-red-600 hover:bg-red-700 focus:outline-hidden focus:ring-2 focus:ring-offset-2 focus:ring-red-500" %>
       </div>
     <% else %>
       <% if Current.true_user.impersonator_support_sessions.in_progress.any? %>
@@ -23,16 +23,16 @@
             Current.true_user.impersonator_support_sessions.in_progress.map { |session|
               ["#{session.impersonated.email} (#{session.status})", session.id]
             },
-            { prompt: "Join a session" },
+            { prompt: t(".join_a_session") },
             { class: "rounded-md text-sm border-0 focus:ring-0 ring-0 text-black font-mono" } %>
-          <%= f.submit "Join",
+          <%= f.submit t(".join"),
             class: "inline-flex items-center px-3 py-1.5 border border-transparent text-sm font-medium rounded-md text-white bg-red-600 hover:bg-red-700 focus:outline-hidden focus:ring-2 focus:ring-offset-2 focus:ring-red-500" %>
         <% end %>
       <% end %>
 
       <%= form_with model: ImpersonationSession.new, class: "flex items-center space-x-2" do |f| %>
-        <%= f.text_field :impersonated_id, class: "rounded-md text-sm border-0 focus:ring-0 ring-0 text-black font-mono w-96", placeholder: "UUID", autocomplete: "off" %>
-        <%= f.submit "Request Impersonation", class: "inline-flex items-center px-3 py-1.5 border border-transparent text-sm font-medium rounded-md text-white bg-red-600 hover:bg-red-700 focus:outline-hidden focus:ring-2 focus:ring-offset-2 focus:ring-red-500" %>
+        <%= f.text_field :impersonated_id, class: "rounded-md text-sm border-0 focus:ring-0 ring-0 text-black font-mono w-96", placeholder: t(".uuid_placeholder"), autocomplete: "off" %>
+        <%= f.submit t(".request_impersonation"), class: "inline-flex items-center px-3 py-1.5 border border-transparent text-sm font-medium rounded-md text-white bg-red-600 hover:bg-red-700 focus:outline-hidden focus:ring-2 focus:ring-offset-2 focus:ring-red-500" %>
       <% end %>
     <% end %>
   </div>
diff --git a/app/views/import/cleans/show.html.erb b/app/views/import/cleans/show.html.erb
index 3fcbf8143..834b9741a 100644
--- a/app/views/import/cleans/show.html.erb
+++ b/app/views/import/cleans/show.html.erb
@@ -14,11 +14,11 @@
     <div class="bg-container border border-tertiary rounded-lg p-3 flex flex-col md:flex-row items-start md:items-center justify-between gap-2 md:gap-0">
       <div class="flex items-center gap-2">
         <%= icon "check-circle", size: "sm", color: "success" %>
-        <p class="text-success text-sm">Your data has been cleaned</p>
+        <p class="text-success text-sm"><%= t(".data_cleaned") %></p>
       </div>
 
       <%= render DS::Link.new(
-        text: "Next step",
+        text: t(".next_step"),
         variant: "primary",
         href: @import.is_a?(PdfImport) ? import_path(@import) : import_confirm_path(@import),
         frame: :_top,
@@ -34,9 +34,9 @@
       </div>
 
       <div class="flex justify-center w-full md:w-auto">
-        <div class="bg-gray-50 rounded-lg inline-flex p-1 space-x-2 text-sm text-primary font-medium w-full md:w-auto">
-          <%= link_to "All rows", import_clean_path(@import, per_page: params[:per_page], view: "all"), class: "p-2 rounded-lg flex-1 md:flex-auto text-center #{params[:view] != 'errors' ? 'bg-container' : ''}" %>
-          <%= link_to "Error rows", import_clean_path(@import, per_page: params[:per_page], view: "errors"), class: "p-2 rounded-lg flex-1 md:flex-auto text-center #{params[:view] == 'errors' ? 'bg-container' : ''}" %>
+        <div class="bg-surface-inset rounded-lg inline-flex p-1 space-x-2 text-sm text-primary font-medium w-full md:w-auto">
+          <%= link_to t(".all_rows"), import_clean_path(@import, per_page: params[:per_page], view: "all"), class: "p-2 rounded-lg flex-1 md:flex-auto text-center #{params[:view] != 'errors' ? 'bg-container' : ''}" %>
+          <%= link_to t(".error_rows"), import_clean_path(@import, per_page: params[:per_page], view: "errors"), class: "p-2 rounded-lg flex-1 md:flex-auto text-center #{params[:view] == 'errors' ? 'bg-container' : ''}" %>
         </div>
       </div>
     </div>
diff --git a/app/views/import/configurations/_account_import.html.erb b/app/views/import/configurations/_account_import.html.erb
index a8c4ec010..2b50e4cb7 100644
--- a/app/views/import/configurations/_account_import.html.erb
+++ b/app/views/import/configurations/_account_import.html.erb
@@ -1,18 +1,18 @@
 <%# locals: (import:) %>
 
 <%= styled_form_with model: @import, url: import_configuration_path(@import), scope: :import, method: :patch, class: "space-y-4" do |form| %>
-  <%= form.select :entity_type_col_label, import.csv_headers, { include_blank: "Leave empty", label: "Entity Type" } %>
-  <%= form.select :name_col_label, import.csv_headers, { include_blank: "Leave empty", label: "Name" }, required: true %>
-  <%= form.select :amount_col_label, import.csv_headers, { include_blank: "Leave empty", label: "Balance" }, required: true %>
-  <%= form.select :currency_col_label, import.csv_headers, { include_blank: "Default", label: "Currency" } %>
+  <%= form.select :entity_type_col_label, import.csv_headers, { include_blank: t(".leave_empty"), label: t(".entity_type") } %>
+  <%= form.select :name_col_label, import.csv_headers, { include_blank: t(".leave_empty"), label: t(".name") }, required: true %>
+  <%= form.select :amount_col_label, import.csv_headers, { include_blank: t(".leave_empty"), label: t(".balance") }, required: true %>
+  <%= form.select :currency_col_label, import.csv_headers, { include_blank: t(".default"), label: t(".currency") } %>
 
   <div class="flex items-center gap-4">
-    <%= form.select :date_col_label, import.csv_headers, { include_blank: "Leave empty", label: "Balance Date" } %>
+    <%= form.select :date_col_label, import.csv_headers, { include_blank: t(".leave_empty"), label: t(".balance_date") } %>
     <%= form.select :date_format,
                     Family::DATE_FORMATS,
-                    { label: "Date Format", prompt: "Select format" },
+                    { label: t(".date_format"), prompt: t(".select_format") },
                     required: @import.date_col_label.present? %>
   </div>
 
-  <%= form.submit "Apply configuration", disabled: import.complete? %>
+  <%= form.submit t(".apply_configuration"), disabled: import.complete? %>
 <% end %>
diff --git a/app/views/import/configurations/_actual_import.html.erb b/app/views/import/configurations/_actual_import.html.erb
new file mode 100644
index 000000000..6b10d8a11
--- /dev/null
+++ b/app/views/import/configurations/_actual_import.html.erb
@@ -0,0 +1,27 @@
+<%# locals: (import:) %>
+
+<div class="flex items-center justify-between border border-secondary rounded-lg bg-success/5 p-5 gap-4 mb-4">
+  <span class="text-success">
+    <%= icon("check-circle", color: "current") %>
+  </span>
+  <p class="text-sm text-primary italic"><%= t(".preconfigured_notice") %></p>
+</div>
+
+<%= styled_form_with model: @import, url: import_configuration_path(@import), scope: :import, method: :patch, class: "space-y-4" do |form| %>
+  <div class="flex items-center gap-4">
+    <%= form.select :date_col_label, import.csv_headers, { include_blank: t(".leave_empty"), label: t(".date_label") }, required: true, disabled: import.complete? %>
+    <%= form.select :date_format, Family::DATE_FORMATS, { label: t(".date_format_label") }, label: true, required: true, disabled: import.complete? %>
+  </div>
+
+  <div class="flex items-center gap-4">
+    <%= form.select :amount_col_label, import.csv_headers, { include_blank: t(".leave_empty"), label: t(".amount_label") }, required: true, disabled: import.complete? %>
+    <%= form.select :signage_convention, [[t(".incomes_are_negative"), "inflows_negative"], [t(".incomes_are_positive"), "inflows_positive"]], { label: t(".signage_convention_label") }, disabled: import.complete? %>
+  </div>
+
+  <%= form.select :account_col_label, import.csv_headers, { include_blank: t(".leave_empty"), label: t(".account_label") }, disabled: import.complete? %>
+  <%= form.select :name_col_label, import.csv_headers, { include_blank: t(".leave_empty"), label: t(".name_label") }, disabled: import.complete? %>
+  <%= form.select :category_col_label, import.csv_headers, { include_blank: t(".leave_empty"), label: t(".category_label") }, disabled: import.complete? %>
+  <%= form.select :notes_col_label, import.csv_headers, { include_blank: t(".leave_empty"), label: t(".notes_label") }, disabled: import.complete? %>
+
+  <%= form.submit t(".apply_configuration"), disabled: import.complete? %>
+<% end %>
diff --git a/app/views/import/configurations/_trade_import.html.erb b/app/views/import/configurations/_trade_import.html.erb
index 9db460d40..4ac559487 100644
--- a/app/views/import/configurations/_trade_import.html.erb
+++ b/app/views/import/configurations/_trade_import.html.erb
@@ -3,38 +3,38 @@
 <%= styled_form_with model: @import, url: import_configuration_path(@import), scope: :import, method: :patch, class: "space-y-4" do |form| %>
   <div class="space-y-4">
     <div class="flex items-center gap-4">
-      <%= form.select :date_col_label, import.csv_headers, { include_blank: "Select column", label: "Date" }, required: true %>
+      <%= form.select :date_col_label, import.csv_headers, { include_blank: t(".select_column"), label: t(".date_label") }, required: true %>
       <%= form.select :date_format, Family::DATE_FORMATS, { label: t(".date_format_label")}, label: true, required: true %>
     </div>
 
     <div class="flex items-center gap-4">
-      <%= form.select :qty_col_label, import.csv_headers, { include_blank: "Select column", label: "Quantity" }, required: true %>
-      <%= form.select :signage_convention, [["Buys are positive qty", "inflows_positive"], ["Buys are negative qty", "inflows_negative"]], label: true, required: true %>
+      <%= form.select :qty_col_label, import.csv_headers, { include_blank: t(".select_column"), label: t(".quantity_label") }, required: true %>
+      <%= form.select :signage_convention, [[t(".buys_are_positive"), "inflows_positive"], [t(".buys_are_negative"), "inflows_negative"]], label: true, required: true %>
     </div>
 
     <div class="flex items-center gap-4">
-      <%= form.select :currency_col_label, import.csv_headers, { include_blank: "Default", label: "Currency" } %>
-      <%= form.select :number_format, Import::NUMBER_FORMATS.keys, { label: "Format", prompt: "Select format" }, required: true %>
+      <%= form.select :currency_col_label, import.csv_headers, { include_blank: t(".default"), label: t(".currency_label") } %>
+      <%= form.select :number_format, Import::NUMBER_FORMATS.keys, { label: t(".format_label"), prompt: t(".select_format") }, required: true %>
     </div>
 
-    <%= form.select :ticker_col_label, import.csv_headers, { include_blank: "Select column", label: "Ticker" }, required: true %>
-    <%= form.select :exchange_operating_mic_col_label, import.csv_headers, { include_blank: "Leave empty", label: "Stock exchange code" } %>
-    <%= form.select :price_col_label, import.csv_headers, { include_blank: "Select column", label: "Price" }, required: true %>
+    <%= form.select :ticker_col_label, import.csv_headers, { include_blank: t(".select_column"), label: t(".ticker_label") }, required: true %>
+    <%= form.select :exchange_operating_mic_col_label, import.csv_headers, { include_blank: t(".leave_empty"), label: t(".stock_exchange_code_label") } %>
+    <%= form.select :price_col_label, import.csv_headers, { include_blank: t(".select_column"), label: t(".price_label") }, required: true %>
 
     <% unless import.account.present? %>
-      <%= form.select :account_col_label, import.csv_headers, { include_blank: "Leave empty", label: "Account" } %>
+      <%= form.select :account_col_label, import.csv_headers, { include_blank: t(".leave_empty"), label: t(".account_label") } %>
     <% end %>
 
-    <%= form.select :name_col_label, import.csv_headers, { include_blank: "Leave empty", label: "Name" } %>
+    <%= form.select :name_col_label, import.csv_headers, { include_blank: t(".leave_empty"), label: t(".name_label") } %>
 
-    <% unless Security.provider %>
+    <% unless Security.providers.any? %>
       <div class="alert alert-warning">
         <p>
-          <strong>Note:</strong> The security prices provider is not configured.  Your trade imports will work, but Sure will not backfill price history.  Please go to your settings to configure this.
+          <strong><%= t(".note_label") %>:</strong> <%= t(".no_security_provider_warning") %>
         </p>
       </div>
     <% end %>
   </div>
 
-  <%= form.submit "Apply configuration", disabled: import.complete? %>
+  <%= form.submit t(".apply_configuration"), disabled: import.complete? %>
 <% end %>
diff --git a/app/views/import/configurations/_transaction_import.html.erb b/app/views/import/configurations/_transaction_import.html.erb
index e0466d550..e6b927101 100644
--- a/app/views/import/configurations/_transaction_import.html.erb
+++ b/app/views/import/configurations/_transaction_import.html.erb
@@ -19,11 +19,11 @@
   <div class="flex items-center gap-4">
     <%= form.select :date_col_label,
                     import.csv_headers,
-                    { label: "Date", prompt: "Select column" },
+                    { label: t(".date_label"), prompt: t(".select_column") },
                     required: true %>
     <%= form.select :date_format,
                     Family::DATE_FORMATS,
-                    { label: t(".date_format_label"), prompt: "Select format" },
+                    { label: t(".date_format_label"), prompt: t(".select_format") },
                     required: true %>
   </div>
 
@@ -31,21 +31,21 @@
   <div class="flex items-center gap-4">
     <%= form.select :amount_col_label,
                     import.csv_headers,
-                    { label: "Amount", container_class: "w-2/5", prompt: "Select column" },
+                    { label: t(".amount_label"), container_class: "w-2/5", prompt: t(".select_column") },
                     required: true %>
     <%= form.select :currency_col_label,
                     import.csv_headers,
-                    { include_blank: "Default", label: "Currency", container_class: "w-1/5" } %>
+                    { include_blank: t(".default"), label: t(".currency_label"), container_class: "w-1/5" } %>
     <%= form.select :number_format,
                     Import::NUMBER_FORMATS.keys,
-                    { label: "Format", prompt: "Select format", container_class: "w-2/5" },
+                    { label: t(".format_label"), prompt: t(".select_format"), container_class: "w-2/5" },
                     required: true %>
   </div>
 
   <%# Amount Type Strategy %>
   <%= form.select :amount_type_strategy,
                   Import::AMOUNT_TYPE_STRATEGIES.map { |strategy| [strategy.humanize, strategy] },
-                  { label: "Amount type strategy", prompt: "Select strategy" },
+                  { label: t(".amount_type_strategy_label"), prompt: t(".select_strategy") },
                   required: true,
                   data: {
                     action: "import#handleAmountTypeStrategyChange",
@@ -58,8 +58,8 @@
     <div class="flex items-center gap-2">
       <span class="text-sm shrink-0 text-secondary">↪</span>
       <%= form.select :signage_convention,
-                      [["Incomes are positive", "inflows_positive"], ["Incomes are negative", "inflows_negative"]],
-                      { label: "Amount type", prompt: "Select convention" },
+                      [[t(".incomes_are_positive"), "inflows_positive"], [t(".incomes_are_negative"), "inflows_negative"]],
+                      { label: t(".amount_type_label"), prompt: t(".select_convention") },
                       required: @import.amount_type_strategy == "signed_amount" %>
     </div>
   <% end %>
@@ -70,32 +70,32 @@
     <div class="space-y-2">
       <div class="flex items-center gap-2 text-sm">
         <span class="shrink-0 text-secondary">↪</span>
-        <span class="text-secondary">Set</span>
+        <span class="text-secondary"><%= t(".set") %></span>
         <%= form.select :entity_type_col_label,
                         import.csv_headers,
-                        { prompt: "Select column", container_class: "w-48 px-3 py-1.5 border border-secondary rounded-md" },
+                        { prompt: t(".select_column"), container_class: "w-48 px-3 py-1.5 border border-secondary rounded-md" },
                         required: @import.amount_type_strategy == "custom_column",
                         data: { action: "import#handleAmountTypeChange" } %>
-        <span class="text-secondary">as amount type column</span>
+        <span class="text-secondary"><%= t(".as_amount_type_column") %></span>
       </div>
 
       <div class="items-center gap-2 text-sm <%= @import.entity_type_col_label.nil? ? "hidden" : "flex" %>" data-import-target="amountTypeValue">
         <span class="shrink-0 text-secondary">↪</span>
-        <span class="text-secondary">Set</span>
+        <span class="text-secondary"><%= t(".set") %></span>
         <%= form.select :amount_type_identifier_value,
                         @import.selectable_amount_type_values,
-                        { prompt: "Select value", container_class: "w-48 px-3 py-1.5 border border-secondary rounded-md" },
+                        { prompt: t(".select_value"), container_class: "w-48 px-3 py-1.5 border border-secondary rounded-md" },
                         required: @import.amount_type_strategy == "custom_column",
                         data: { action: "import#handleAmountTypeIdentifierChange" } %>
-        <span class="text-secondary">as identifier value</span>
+        <span class="text-secondary"><%= t(".as_identifier_value") %></span>
       </div>
 
       <div class="items-center gap-2 text-sm <%= @import.amount_type_identifier_value.nil? ? "hidden" : "flex" %>" data-import-target="amountTypeInflowValue">
         <span class="shrink-0 text-secondary">↪</span>
-        <span class="text-secondary">Treat "<span class="font-medium"><%= @import.amount_type_identifier_value %></span>" as</span>
+        <span class="text-secondary"><%= t(".treat_as_html", value: @import.amount_type_identifier_value) %></span>
         <%= form.select :amount_type_inflow_value,
-                        [["Income (inflow)", "inflows_positive"], ["Expense (outflow)", "inflows_negative"]],
-                        { prompt: "Select type", container_class: "w-48 px-3 py-1.5 border border-secondary rounded-md" },
+                        [[t(".income_inflow"), "inflows_positive"], [t(".expense_outflow"), "inflows_negative"]],
+                        { prompt: t(".select_type"), container_class: "w-48 px-3 py-1.5 border border-secondary rounded-md" },
                         required: @import.amount_type_strategy == "custom_column" %>
       </div>
     </div>
@@ -105,21 +105,21 @@
   <% unless import.account.present? %>
     <%= form.select :account_col_label,
                     import.csv_headers,
-                    { include_blank: "Leave empty", label: "Account" } %>
+                    { include_blank: t(".leave_empty"), label: t(".account_label") } %>
   <% end %>
 
   <%= form.select :name_col_label,
                   import.csv_headers,
-                  { include_blank: "Leave empty", label: "Name" } %>
+                  { include_blank: t(".leave_empty"), label: t(".name_label") } %>
   <%= form.select :category_col_label,
                   import.csv_headers,
-                  { include_blank: "Leave empty", label: "Category" } %>
+                  { include_blank: t(".leave_empty"), label: t(".category_label") } %>
   <%= form.select :tags_col_label,
                   import.csv_headers,
-                  { include_blank: "Leave empty", label: "Tags" } %>
+                  { include_blank: t(".leave_empty"), label: t(".tags_label") } %>
   <%= form.select :notes_col_label,
                   import.csv_headers,
-                  { include_blank: "Leave empty", label: "Notes" } %>
+                  { include_blank: t(".leave_empty"), label: t(".notes_label") } %>
 
-  <%= form.submit "Apply configuration", disabled: import.complete? %>
+  <%= form.submit t(".apply_configuration"), disabled: import.complete? %>
 <% end %>
diff --git a/app/views/import/confirms/_mappings.html.erb b/app/views/import/confirms/_mappings.html.erb
index 2bb31ee8f..2cfb6ab46 100644
--- a/app/views/import/confirms/_mappings.html.erb
+++ b/app/views/import/confirms/_mappings.html.erb
@@ -12,7 +12,7 @@
             <%= tag.p t(".no_accounts"), class: "text-sm" %>
 
             <%= render DS::Link.new(
-              text: "Create account",
+              text: t(".create_account"),
               variant: "primary",
               href: new_account_path(return_to: import_confirm_path(import)),
               frame: :modal
@@ -60,7 +60,7 @@
 
     <div class="flex justify-center w-full">
       <%= render DS::Link.new(
-        text: "Next",
+        text: t(".next"),
         variant: "primary",
         href: is_last_step ? import_path(import) : url_for(step: step_idx + 2),
         icon: "arrow-right",
diff --git a/app/views/import/confirms/show.html.erb b/app/views/import/confirms/show.html.erb
index 269aca93e..8560b761d 100644
--- a/app/views/import/confirms/show.html.erb
+++ b/app/views/import/confirms/show.html.erb
@@ -31,8 +31,20 @@
     </div>
 
     <div class="flex flex-col gap-2">
-      <%= button_to t("import.confirms.sure_import.publish_button"), publish_import_path(@import), method: :post, class: "btn btn--primary w-full", disabled: !@import.publishable? %>
-      <%= link_to t("import.confirms.sure_import.cancel"), imports_path, class: "btn btn--ghost w-full text-center" %>
+      <%= render DS::Button.new(
+        text: t("import.confirms.sure_import.publish_button"),
+        href: publish_import_path(@import),
+        variant: :primary,
+        full_width: true,
+        disabled: !@import.publishable?,
+        data: { turbo_method: :post }
+      ) %>
+      <%= render DS::Link.new(
+        text: t("import.confirms.sure_import.cancel"),
+        href: imports_path,
+        variant: :ghost,
+        full_width: true
+      ) %>
     </div>
   </div>
 <% else %>
@@ -44,7 +56,7 @@
       <% @import.mapping_steps.each_with_index do |step_mapping_class, idx| %>
         <% is_active = step_idx == idx %>
 
-        <%= link_to url_for(step: idx + 1), class: "w-5 h-[3px] #{is_active ? 'bg-gray-900' : 'bg-gray-100'} rounded-xl hover:bg-gray-300 transition-colors duration-200" do %>
+        <%= link_to url_for(step: idx + 1), class: "w-5 h-[3px] #{is_active ? 'bg-inverse hover:bg-inverse-hover' : 'bg-surface-inset hover:bg-surface-inset-hover'} rounded-xl transition-colors duration-200" do %>
           <span class="sr-only">Step <%= idx + 1 %></span>
         <% end %>
       <% end %>
diff --git a/app/views/import/qif_category_selections/show.html.erb b/app/views/import/qif_category_selections/show.html.erb
index 4976d9961..f2b443004 100644
--- a/app/views/import/qif_category_selections/show.html.erb
+++ b/app/views/import/qif_category_selections/show.html.erb
@@ -83,7 +83,7 @@
                   <div class="col-span-8 flex items-center gap-2">
                     <span class="text-sm text-primary"><%= category %></span>
                     <% if is_split %>
-                      <span class="inline-flex items-center rounded-full bg-warning/10 px-2 py-0.5 text-xs font-medium text-warning"><%= t(".split_badge") %></span>
+                      <%= render DS::Pill.new(label: t(".split_badge"), tone: :warning, marker: false, show_dot: false) %>
                     <% end %>
                   </div>
                   <span class="col-span-3 text-sm text-secondary text-right">
diff --git a/app/views/import/rows/_form.html.erb b/app/views/import/rows/_form.html.erb
index e7f5a4a92..d5f06d420 100644
--- a/app/views/import/rows/_form.html.erb
+++ b/app/views/import/rows/_form.html.erb
@@ -40,7 +40,7 @@
             </div>
           <% end %>
 
-          <div class="absolute inset-0 bg-primary/5 pointer-events-none opacity-0 transition-opacity duration-150 ease-in-out z-0" data-mobile-cell-interaction-target="highlight"></div>
+          <div class="absolute inset-0 bg-gray-tint-5 pointer-events-none opacity-0 transition-opacity duration-150 ease-in-out z-0" data-mobile-cell-interaction-target="highlight"></div>
         </div>
       <% end %>
     <% end %>
diff --git a/app/views/import/uploads/show.html.erb b/app/views/import/uploads/show.html.erb
index cc9a94136..7cf51d651 100644
--- a/app/views/import/uploads/show.html.erb
+++ b/app/views/import/uploads/show.html.erb
@@ -93,7 +93,7 @@
   <%# ── Standard CSV upload ── %>
   <div class="space-y-4" data-controller="drag-and-drop-import">
     <!-- Overlay -->
-    <%= render "imports/drag_drop_overlay", title: "Drop CSV to upload", subtitle: "Your file will be uploaded automatically" %>
+    <%= render "imports/drag_drop_overlay", title: t(".drop_csv_title"), subtitle: t(".drop_csv_subtitle") %>
 
     <div class="space-y-4 mx-auto max-w-md">
       <div class="text-center space-y-2">
@@ -103,16 +103,16 @@
 
       <%= render DS::Tabs.new(active_tab: params[:tab] || "csv-upload", url_param_key: "tab", testid: "import-tabs") do |tabs| %>
         <% tabs.with_nav do |nav| %>
-          <% nav.with_btn(id: "csv-upload", label: "Upload CSV") %>
-          <% nav.with_btn(id: "csv-paste", label: "Copy & Paste") %>
+          <% nav.with_btn(id: "csv-upload", label: t(".upload_csv_tab")) %>
+          <% nav.with_btn(id: "csv-paste", label: t(".copy_paste_tab")) %>
         <% end %>
 
         <% tabs.with_panel(tab_id: "csv-upload") do %>
           <%= styled_form_with model: @import, scope: :import, url: import_upload_path(@import), multipart: true, class: "space-y-2", data: { drag_and_drop_import_target: "form" } do |form| %>
-            <%= form.select :col_sep, Import::SEPARATORS, label: true %>
+            <%= form.select :col_sep, Import.separator_options, label: true %>
 
             <% if @import.type == "TransactionImport" || @import.type == "TradeImport" %>
-              <%= form.select :account_id, @import.family.accounts.visible.alphabetically.pluck(:name, :id), { label: "Account (optional)", include_blank: "Multi-account import", selected: @import.account_id } %>
+              <%= form.select :account_id, @import.family.accounts.visible.alphabetically.pluck(:name, :id), { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
             <% end %>
 
             <label for="import_import_file_csv" class="flex flex-col items-center justify-center w-full h-64 border border-secondary border-dashed rounded-xl cursor-pointer" data-controller="file-upload" data-file-upload-target="uploadArea">
@@ -135,25 +135,25 @@
               </div>
             </label>
 
-            <%= form.submit "Upload CSV", disabled: @import.complete? %>
+            <%= form.submit t(".upload_csv_button"), disabled: @import.complete? %>
           <% end %>
         <% end %>
 
         <% tabs.with_panel(tab_id: "csv-paste") do %>
           <%= styled_form_with model: @import, scope: :import, url: import_upload_path(@import), multipart: true, class: "space-y-2" do |form| %>
-            <%= form.select :col_sep, Import::SEPARATORS, label: true %>
+            <%= form.select :col_sep, Import.separator_options, label: true %>
 
             <% if @import.type == "TransactionImport" || @import.type == "TradeImport" %>
-              <%= form.select :account_id, @import.family.accounts.visible.alphabetically.pluck(:name, :id), { label: "Account (optional)", include_blank: "Multi-account import", selected: @import.account_id } %>
+              <%= form.select :account_id, @import.family.accounts.visible.alphabetically.pluck(:name, :id), { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
             <% end %>
 
             <%= form.text_area :raw_file_str,
                          rows: 10,
                          required: true,
-                         placeholder: "Paste your CSV file contents here",
+                         placeholder: t(".paste_csv_placeholder"),
                          "data-auto-submit-form-target": "auto" %>
 
-            <%= form.submit "Upload CSV", disabled: @import.complete? %>
+            <%= form.submit t(".upload_csv_button"), disabled: @import.complete? %>
           <% end %>
         <% end %>
       <% end %>
@@ -161,7 +161,7 @@
 
     <div class="flex justify-center">
       <span class="text-secondary text-sm">
-        <%= link_to "Download a sample CSV", "/imports/#{@import.id}/upload/sample_csv", class: "text-primary underline", data: { turbo: false } %> to see the required CSV format
+        <%= link_to t(".download_sample_csv"), "/imports/#{@import.id}/upload/sample_csv", class: "text-primary underline", data: { turbo: false } %> <%= t(".to_see_format") %>
       </span>
     </div>
   </div>
diff --git a/app/views/imports/_failure.html.erb b/app/views/imports/_failure.html.erb
index ee9e8b9fc..3cdc4008f 100644
--- a/app/views/imports/_failure.html.erb
+++ b/app/views/imports/_failure.html.erb
@@ -7,10 +7,10 @@
     </div>
 
     <div class="text-center space-y-2">
-      <h1 class="font-medium text-primary text-center text-3xl">Import failed</h1>
-      <p class="text-sm text-secondary">Please check that your file format, for any errors and that all required fields are filled, then come back and try again.</p>
+      <h1 class="font-medium text-primary text-center text-3xl"><%= t(".title") %></h1>
+      <p class="text-sm text-secondary"><%= t(".description") %></p>
     </div>
 
-    <%= render DS::Button.new(text: "Try again", href: publish_import_path(import), full_width: true) %>
+    <%= render DS::Button.new(text: t(".try_again"), href: publish_import_path(import), full_width: true) %>
   </div>
 </div>
diff --git a/app/views/imports/_importing.html.erb b/app/views/imports/_importing.html.erb
index 43d61f540..7fb8ed100 100644
--- a/app/views/imports/_importing.html.erb
+++ b/app/views/imports/_importing.html.erb
@@ -2,18 +2,18 @@
 
 <div class="h-full flex flex-col justify-center items-center">
   <div class="space-y-6 max-w-sm">
-    <div class="mx-auto bg-gray-500/5 h-8 w-8 rounded-full flex items-center justify-center">
+    <div class="mx-auto bg-gray-tint-5 h-8 w-8 rounded-full flex items-center justify-center">
       <%= icon "loader", class: "animate-pulse" %>
     </div>
 
     <div class="text-center space-y-2">
-      <h1 class="font-medium text-primary text-center text-3xl">Import in progress</h1>
-      <p class="text-sm text-secondary">Your import is in progress. Check the imports menu for status updates or click 'Check Status' to refresh the page for updates. Feel free to continue using the app.</p>
+      <h1 class="font-medium text-primary text-center text-3xl"><%= t(".title") %></h1>
+      <p class="text-sm text-secondary"><%= t(".description") %></p>
     </div>
 
     <div class="space-y-2 flex flex-col">
-      <%= render DS::Link.new(text: "Check status", href: import_path(import), variant: "primary", full_width: true) %>
-      <%= render DS::Link.new(text: "Back to dashboard", href: root_path, variant: "secondary", full_width: true) %>
+      <%= render DS::Link.new(text: t(".check_status"), href: import_path(import), variant: "primary", full_width: true) %>
+      <%= render DS::Link.new(text: t(".back_to_dashboard"), href: root_path, variant: "secondary", full_width: true) %>
     </div>
   </div>
 </div>
diff --git a/app/views/imports/_pdf_import.html.erb b/app/views/imports/_pdf_import.html.erb
index f565e8274..068d55da9 100644
--- a/app/views/imports/_pdf_import.html.erb
+++ b/app/views/imports/_pdf_import.html.erb
@@ -16,14 +16,14 @@
       <div class="bg-container border border-primary rounded-xl p-4 space-y-4">
         <div class="space-y-2">
           <h2 class="font-medium text-primary"><%= t("imports.pdf_import.document_type_label") %></h2>
-          <p class="text-sm text-secondary px-3 py-2 bg-gray-500/5 rounded-lg">
+          <p class="text-sm text-secondary px-3 py-2 bg-gray-tint-5 rounded-lg">
             <%= t("imports.document_types.#{import.document_type}", default: import.document_type&.humanize || t("imports.pdf_import.unknown_document_type", default: "Unknown")) %>
           </p>
         </div>
 
         <div class="space-y-2">
           <h2 class="font-medium text-primary"><%= t("imports.pdf_import.transactions_extracted", default: "Transactions Extracted") %></h2>
-          <p class="text-sm text-secondary px-3 py-2 bg-gray-500/5 rounded-lg">
+          <p class="text-sm text-secondary px-3 py-2 bg-gray-tint-5 rounded-lg">
             <%= t("imports.pdf_import.transactions_extracted_count", count: import.rows_count, default: "%{count} transactions") %>
           </p>
         </div>
@@ -63,7 +63,7 @@
       </div>
 
     <% elsif import.importing? || import.pending? %>
-      <div class="mx-auto bg-gray-500/5 h-8 w-8 rounded-full flex items-center justify-center">
+      <div class="mx-auto bg-gray-tint-5 h-8 w-8 rounded-full flex items-center justify-center">
         <%= icon "loader", class: "animate-pulse" %>
       </div>
 
@@ -92,7 +92,7 @@
 
       <div class="space-y-2 flex flex-col">
         <%= render DS::Link.new(text: t("imports.pdf_import.try_again"), href: new_import_path, variant: "primary", full_width: true) %>
-        <%= button_to t("imports.pdf_import.delete_import"), import_path(import), method: :delete, class: "w-full font-medium text-sm px-3 py-2 rounded-lg text-primary bg-gray-200 hover:bg-gray-300" %>
+        <%= button_to t("imports.pdf_import.delete_import"), import_path(import), method: :delete, class: "w-full font-medium text-sm px-3 py-2 rounded-lg text-primary bg-surface-inset hover:bg-surface-inset-hover" %>
       </div>
 
     <% elsif import.complete? && import.ai_processed? %>
@@ -108,14 +108,14 @@
       <div class="bg-container border border-primary rounded-xl p-4 space-y-4">
         <div class="space-y-2">
           <h2 class="font-medium text-primary"><%= t("imports.pdf_import.document_type_label") %></h2>
-          <p class="text-sm text-secondary px-3 py-2 bg-gray-500/5 rounded-lg">
+          <p class="text-sm text-secondary px-3 py-2 bg-gray-tint-5 rounded-lg">
             <%= t("imports.document_types.#{import.document_type}", default: import.document_type&.humanize || t("imports.pdf_import.unknown_document_type", default: "Unknown")) %>
           </p>
         </div>
 
         <div class="space-y-2">
           <h2 class="font-medium text-primary"><%= t("imports.pdf_import.summary_label") %></h2>
-          <p class="text-sm text-secondary px-3 py-2 bg-gray-500/5 rounded-lg whitespace-pre-wrap">
+          <p class="text-sm text-secondary px-3 py-2 bg-gray-tint-5 rounded-lg whitespace-pre-wrap">
             <%= import.ai_summary %>
           </p>
         </div>
@@ -127,7 +127,7 @@
 
       <div class="space-y-2 flex flex-col">
         <%= render DS::Link.new(text: t("imports.pdf_import.back_to_imports"), href: imports_path, variant: "primary", full_width: true) %>
-        <%= button_to t("imports.pdf_import.delete_import"), import_path(import), method: :delete, class: "w-full font-medium text-sm px-3 py-2 rounded-lg text-primary bg-gray-200 hover:bg-gray-300" %>
+        <%= button_to t("imports.pdf_import.delete_import"), import_path(import), method: :delete, class: "w-full font-medium text-sm px-3 py-2 rounded-lg text-primary bg-surface-inset hover:bg-surface-inset-hover" %>
       </div>
 
     <% else %>
diff --git a/app/views/imports/_revert_failure.html.erb b/app/views/imports/_revert_failure.html.erb
index 9d64e7a76..6c4872d06 100644
--- a/app/views/imports/_revert_failure.html.erb
+++ b/app/views/imports/_revert_failure.html.erb
@@ -7,12 +7,12 @@
     </div>
 
     <div class="text-center space-y-2">
-      <h1 class="font-medium text-primary text-center text-3xl">Reverting import failed</h1>
-      <p class="text-sm text-secondary">Please try again</p>
+      <h1 class="font-medium text-primary text-center text-3xl"><%= t(".title") %></h1>
+      <p class="text-sm text-secondary"><%= t(".description") %></p>
     </div>
 
     <%= render DS::Button.new(
-      text: "Try again",
+      text: t(".try_again"),
       full_width: true,
       href: revert_import_path(import)
     ) %>
diff --git a/app/views/imports/_success.html.erb b/app/views/imports/_success.html.erb
index c0849e94b..329977a91 100644
--- a/app/views/imports/_success.html.erb
+++ b/app/views/imports/_success.html.erb
@@ -2,17 +2,50 @@
 
 <div class="h-full flex flex-col justify-center items-center">
   <div class="space-y-6 max-w-sm">
-    <div class="mx-auto bg-green-500/5 h-8 w-8 rounded-full flex items-center justify-center">
+    <div class="mx-auto bg-success/10 h-8 w-8 rounded-full flex items-center justify-center">
       <%= icon "check", color: "success" %>
     </div>
 
     <div class="text-center space-y-2">
-      <h1 class="font-medium text-primary text-center text-3xl">Import successful</h1>
-      <p class="text-sm text-secondary">Your imported data has been successfully added to the app and is now ready for use.</p>
+      <h1 class="font-medium text-primary text-center text-3xl"><%= t(".title") %></h1>
+      <p class="text-sm text-secondary"><%= t(".description") %></p>
     </div>
 
+    <% if import.is_a?(SureImport) %>
+      <% verification = import_verification_view(import) %>
+
+      <div class="bg-container border border-primary rounded-lg p-4 space-y-3 text-left">
+        <div class="flex items-center justify-between gap-3">
+          <h2 class="text-sm font-medium text-primary"><%= t(".verification.title") %></h2>
+          <span class="text-xs font-medium text-secondary"><%= t(".verification.status.#{verification.status}", default: verification.status.humanize) %></span>
+        </div>
+
+        <div class="grid grid-cols-2 gap-3 text-sm">
+          <div>
+            <p class="text-xs text-secondary"><%= t(".verification.checked") %></p>
+            <p class="font-medium text-primary"><%= number_with_delimiter(verification.checked_total) %></p>
+          </div>
+          <div>
+            <p class="text-xs text-secondary"><%= t(".verification.mismatches") %></p>
+            <p class="font-medium text-primary"><%= number_with_delimiter(verification.mismatches_count) %></p>
+          </div>
+        </div>
+
+        <% if verification.mismatches? %>
+          <div class="space-y-2">
+            <% verification.mismatches_preview.each do |key, counts| %>
+              <div class="flex items-center justify-between gap-3 text-xs">
+                <span class="text-secondary"><%= key.humanize %></span>
+                <span class="font-medium text-primary"><%= number_with_delimiter(counts["actual"]) %> / <%= number_with_delimiter(counts["expected"]) %></span>
+              </div>
+            <% end %>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
+
     <%= render DS::Link.new(
-      text: "Back to dashboard",
+      text: t(".back_to_dashboard"),
       variant: "primary",
       full_width: true,
       href: root_path
diff --git a/app/views/imports/_table.html.erb b/app/views/imports/_table.html.erb
index 8de7cea31..87978afeb 100644
--- a/app/views/imports/_table.html.erb
+++ b/app/views/imports/_table.html.erb
@@ -2,10 +2,10 @@
 <div class="bg-container-inset rounded-xl overflow-hidden md:mx-auto p-4">
   <% if caption %>
     <div class="flex items-center mb-4">
-      <div class="text-gray-500 mr-2">
+      <div class="text-secondary mr-2">
         <%= inline_svg_tag "icon-csv.svg", class: "w-4 h-4" %>
       </div>
-      <h2 class="text-sm text-gray-500 font-medium"><%= caption %></h2>
+      <h2 class="text-sm text-secondary font-medium"><%= caption %></h2>
     </div>
   <% end %>
   <div class="inline-block min-w-fit sm:w-full rounded-lg shadow-border-xs text-sm bg-container">
diff --git a/app/views/imports/new.html.erb b/app/views/imports/new.html.erb
index 33d07ddfd..e71d84b6f 100644
--- a/app/views/imports/new.html.erb
+++ b/app/views/imports/new.html.erb
@@ -31,7 +31,7 @@
 
     <%
       import_type = params[:type].presence || @pending_import&.type
-      active_tab = import_type.present? && !import_type.in?(%w[MintImport QifImport SureImport DocumentImport PdfImport]) ? "raw_data" : "financial_tools"
+      active_tab = import_type.present? && !import_type.in?(%w[MintImport ActualImport QifImport SureImport DocumentImport PdfImport]) ? "raw_data" : "financial_tools"
     %>
     <%= render DS::Tabs.new(active_tab: active_tab) do |tabs| %>
       <% tabs.with_nav do |nav| %>
@@ -42,7 +42,7 @@
       <% tabs.with_panel(tab_id: "financial_tools") do %>
         <div class="rounded-xl bg-container-inset p-1">
           <ul class="bg-container shadow-border-xs rounded-lg">
-            <% if @pending_import.present? && params[:type].present? && params[:type].in?(%w[MintImport QifImport SureImport DocumentImport PdfImport]) %>
+            <% if @pending_import.present? && params[:type].present? && params[:type].in?(%w[MintImport ActualImport QifImport SureImport DocumentImport PdfImport]) %>
               <li>
                 <%= link_to import_path(@pending_import), class: "flex items-center justify-between p-4 group cursor-pointer", data: { turbo: false } do %>
                   <div class="flex items-center gap-2">
@@ -99,6 +99,16 @@
                 enabled: true %>
             <% end %>
 
+            <% if params[:type].nil? || params[:type] == "ActualImport" %>
+              <%= render "imports/import_option",
+                type: "ActualImport",
+                icon_name: "wallet",
+                icon_bg_class: "bg-emerald-500/5",
+                icon_text_class: "text-emerald-500",
+                label: t(".import_actual"),
+                enabled: true %>
+            <% end %>
+
             <% if params[:type].nil? || params[:type] == "QifImport" %>
               <%= render "imports/import_option",
                 type: "QifImport",
@@ -112,8 +122,8 @@
             <%= render "imports/import_option",
               type: "TransactionImport",
               icon_name: "bar-chart-2",
-              icon_bg_class: "bg-gray-500/5",
-              icon_text_class: "text-gray-400",
+              icon_bg_class: "bg-gray-tint-5",
+              icon_text_class: "text-subdued",
               label: t(".import_ynab"),
               enabled: false,
               disabled_message: t(".coming_soon") %>
@@ -153,7 +163,7 @@
       <% tabs.with_panel(tab_id: "raw_data") do %>
         <div class="rounded-xl bg-container-inset p-1">
           <ul class="bg-container shadow-border-xs rounded-lg">
-            <% if @pending_import.present? && params[:type].present? && !params[:type].in?(%w[MintImport QifImport SureImport DocumentImport PdfImport]) %>
+            <% if @pending_import.present? && params[:type].present? && !params[:type].in?(%w[MintImport ActualImport QifImport SureImport DocumentImport PdfImport]) %>
               <li>
                 <%= link_to import_path(@pending_import), class: "flex items-center justify-between p-4 group cursor-pointer", data: { turbo: false } do %>
                   <div class="flex items-center gap-2">
diff --git a/app/views/indexa_capital_items/_indexa_capital_item.html.erb b/app/views/indexa_capital_items/_indexa_capital_item.html.erb
index 915a68650..d03c2ffb1 100644
--- a/app/views/indexa_capital_items/_indexa_capital_item.html.erb
+++ b/app/views/indexa_capital_items/_indexa_capital_item.html.erb
@@ -1,101 +1,103 @@
 <%# locals: (indexa_capital_item:) %>
 
 <%= tag.div id: dom_id(indexa_capital_item) do %>
-  <details open class="group bg-container p-4 shadow-border-xs rounded-xl">
-    <summary class="flex items-center justify-between gap-2 focus-visible:outline-hidden">
-      <div class="flex items-center gap-2">
-        <%= icon "chevron-right", class: "group-open:transform group-open:rotate-90" %>
+  <% unlinked_count = indexa_capital_item.unlinked_accounts_count %>
 
-        <div class="flex items-center justify-center h-8 w-8 bg-primary/10 rounded-full">
-          <div class="flex items-center justify-center">
-            <%= tag.p indexa_capital_item.name.first.upcase, class: "text-primary text-xs font-medium" %>
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center justify-between gap-2 focus-visible:outline-hidden">
+        <div class="flex items-center gap-2">
+          <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
+
+          <div class="flex items-center justify-center h-8 w-8 bg-container-inset rounded-full">
+            <div class="flex items-center justify-center">
+              <%= tag.p indexa_capital_item.name.first.upcase, class: "text-primary text-xs font-medium" %>
+            </div>
           </div>
-        </div>
 
-        <% unlinked_count = indexa_capital_item.unlinked_accounts_count %>
-
-        <div class="pl-1 text-sm">
-          <div class="flex items-center gap-2">
-            <%= tag.p indexa_capital_item.name, class: "font-medium text-primary" %>
-            <% if indexa_capital_item.scheduled_for_deletion? %>
-              <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+          <div class="pl-1 text-sm">
+            <div class="flex items-center gap-2">
+              <%= tag.p indexa_capital_item.name, class: "font-medium text-primary" %>
+              <% if indexa_capital_item.scheduled_for_deletion? %>
+                <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+              <% end %>
+            </div>
+            <p class="text-xs text-secondary"><%= t(".provider_name") %></p>
+            <% if indexa_capital_item.syncing? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "loader", size: "sm", class: "animate-spin" %>
+                <%= tag.span t(".syncing") %>
+              </div>
+            <% elsif indexa_capital_item.requires_update? %>
+              <div class="text-warning flex items-center gap-1">
+                <%= icon "alert-triangle", size: "sm", color: "warning" %>
+                <%= tag.span t(".requires_update") %>
+              </div>
+            <% elsif indexa_capital_item.sync_error.present? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= render DS::Tooltip.new(text: indexa_capital_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive", as: :span) %>
+                <%= tag.span t(".error"), class: "text-destructive" %>
+              </div>
+            <% else %>
+              <p class="text-secondary">
+                <% if indexa_capital_item.last_synced_at %>
+                  <%= t(".status", timestamp: time_ago_in_words(indexa_capital_item.last_synced_at), summary: indexa_capital_item.sync_status_summary) %>
+                <% else %>
+                  <%= t(".status_never") %>
+                <% end %>
+              </p>
             <% end %>
           </div>
-          <p class="text-xs text-secondary"><%= t(".provider_name") %></p>
-          <% if indexa_capital_item.syncing? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= icon "loader", size: "sm", class: "animate-spin" %>
-              <%= tag.span t(".syncing") %>
-            </div>
-          <% elsif indexa_capital_item.requires_update? %>
-            <div class="text-warning flex items-center gap-1">
-              <%= icon "alert-triangle", size: "sm", color: "warning" %>
-              <%= tag.span t(".requires_update") %>
-            </div>
-          <% elsif indexa_capital_item.sync_error.present? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= render DS::Tooltip.new(text: indexa_capital_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive") %>
-              <%= tag.span t(".error"), class: "text-destructive" %>
-            </div>
-          <% else %>
-            <p class="text-secondary">
-              <% if indexa_capital_item.last_synced_at %>
-                <%= t(".status", timestamp: time_ago_in_words(indexa_capital_item.last_synced_at), summary: indexa_capital_item.sync_status_summary) %>
-              <% else %>
-                <%= t(".status_never") %>
-              <% end %>
-            </p>
-          <% end %>
         </div>
-      </div>
 
-      <% if Current.user&.admin? %>
-        <div class="flex items-center gap-2">
-          <% if indexa_capital_item.requires_update? %>
-            <%= render DS::Link.new(
-              text: t(".update_credentials"),
-              icon: "refresh-cw",
-              variant: "secondary",
-              href: settings_providers_path,
-              frame: "_top"
-            ) %>
-          <% else %>
-            <%= icon(
-              "refresh-cw",
-              as_button: true,
-              href: sync_indexa_capital_item_path(indexa_capital_item),
-              disabled: indexa_capital_item.syncing?
-            ) %>
-          <% end %>
-
-          <%= render DS::Menu.new do |menu| %>
-            <% if unlinked_count > 0 %>
-              <% menu.with_item(
-                variant: "link",
-                text: t(".setup_action"),
-                icon: "settings",
-                href: setup_accounts_indexa_capital_item_path(indexa_capital_item),
-                frame: :modal
+        <% if Current.user&.admin? %>
+          <div class="flex items-center gap-2">
+            <% if indexa_capital_item.requires_update? %>
+              <%= render DS::Link.new(
+                text: t(".update_credentials"),
+                icon: "refresh-cw",
+                variant: "secondary",
+                href: settings_providers_path,
+                frame: "_top"
+              ) %>
+            <% else %>
+              <%= icon(
+                "refresh-cw",
+                as_button: true,
+                href: sync_indexa_capital_item_path(indexa_capital_item),
+                disabled: indexa_capital_item.syncing?
               ) %>
             <% end %>
-            <% menu.with_item(
-              variant: "link",
-              text: t(".update_credentials"),
-              icon: "cable",
-              href: settings_providers_path(manage: "1")
-            ) %>
-            <% menu.with_item(
-              variant: "button",
-              text: t(".delete"),
-              icon: "trash-2",
-              href: indexa_capital_item_path(indexa_capital_item),
-              method: :delete,
-              confirm: CustomConfirm.for_resource_deletion(indexa_capital_item.name, high_severity: true)
-            ) %>
-          <% end %>
-        </div>
-      <% end %>
-    </summary>
+
+            <%= render DS::Menu.new do |menu| %>
+              <% if unlinked_count > 0 %>
+                <% menu.with_item(
+                  variant: "link",
+                  text: t(".setup_action"),
+                  icon: "settings",
+                  href: setup_accounts_indexa_capital_item_path(indexa_capital_item),
+                  frame: :modal
+                ) %>
+              <% end %>
+              <% menu.with_item(
+                variant: "link",
+                text: t(".update_credentials"),
+                icon: "cable",
+                href: settings_providers_path(manage: "1")
+              ) %>
+              <% menu.with_item(
+                variant: "button",
+                text: t(".delete"),
+                icon: "trash-2",
+                href: indexa_capital_item_path(indexa_capital_item),
+                method: :delete,
+                confirm: CustomConfirm.for_resource_deletion(indexa_capital_item.name, high_severity: true)
+              ) %>
+            <% end %>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
 
     <% unless indexa_capital_item.scheduled_for_deletion? %>
       <div class="space-y-4 mt-4">
@@ -144,5 +146,5 @@
         <% end %>
       </div>
     <% end %>
-  </details>
+  <% end %>
 <% end %>
diff --git a/app/views/indexa_capital_items/select_existing_account.html.erb b/app/views/indexa_capital_items/select_existing_account.html.erb
index 7b0f46764..bb6535672 100644
--- a/app/views/indexa_capital_items/select_existing_account.html.erb
+++ b/app/views/indexa_capital_items/select_existing_account.html.erb
@@ -14,7 +14,13 @@
         <%= icon "alert-circle", class: "text-warning mx-auto mb-4", size: "lg" %>
         <p class="text-secondary"><%= t("indexa_capital_items.select_existing_account.no_accounts") %></p>
         <p class="text-sm text-secondary mt-2"><%= t("indexa_capital_items.select_existing_account.connect_hint") %></p>
-        <%= link_to t("indexa_capital_items.select_existing_account.settings_link"), settings_providers_path, class: "btn btn--primary btn--sm mt-4" %>
+        <%= render DS::Link.new(
+          text: t("indexa_capital_items.select_existing_account.settings_link"),
+          href: settings_providers_path,
+          variant: :primary,
+          size: :sm,
+          class: "mt-4"
+        ) %>
       </div>
     <% else %>
       <div class="space-y-4">
diff --git a/app/views/investment_activity/_badge.html.erb b/app/views/investment_activity/_badge.html.erb
index 549d5b33f..646e04d4d 100644
--- a/app/views/investment_activity/_badge.html.erb
+++ b/app/views/investment_activity/_badge.html.erb
@@ -1,33 +1,14 @@
 <%# locals: (label:) %>
-<%# Simple non-interactive badge for displaying activity labels %>
+<%# Simple non-interactive badge for displaying activity labels. %>
 <%
-  # Color mapping for different investment activity labels
-  color = case label
-  when "Buy"
-    "rgb(59 130 246)" # blue
-  when "Sell"
-    "rgb(239 68 68)" # red
-  when "Dividend", "Interest"
-    "rgb(34 197 94)" # green
-  when "Contribution"
-    "rgb(168 85 247)" # purple
-  when "Withdrawal"
-    "rgb(249 115 22)" # orange
-  when "Fee"
-    "rgb(107 114 128)" # gray
-  when "Transfer", "Sweep In", "Sweep Out", "Exchange"
-    "rgb(107 114 128)" # gray
-  when "Reinvestment"
-    "rgb(59 130 246)" # blue
-  else
-    "rgb(107 114 128)" # gray for "Other"
-  end
+  tone = case label
+         when "Buy", "Reinvestment"                                then :indigo  # was raw blue
+         when "Sell"                                               then :red
+         when "Dividend", "Interest"                               then :green
+         when "Contribution"                                       then :violet  # was raw purple
+         when "Withdrawal"                                         then :amber   # was raw orange
+         when "Fee", "Transfer", "Sweep In", "Sweep Out", "Exchange" then :gray
+         else                                                           :gray
+         end
 %>
-
-<span class="inline-flex items-center gap-1 text-xs font-medium rounded px-1.5 py-0.5 border"
-      style="
-        background-color: color-mix(in oklab, <%= color %> 10%, transparent);
-        border-color: color-mix(in oklab, <%= color %> 20%, transparent);
-        color: <%= color %>;">
-  <%= label %>
-</span>
+<%= render DS::Pill.new(label: label, tone: tone, marker: false, show_dot: false) %>
diff --git a/app/views/investments/_value_tooltip.html.erb b/app/views/investments/_value_tooltip.html.erb
index 0cdeee278..55619f9ab 100644
--- a/app/views/investments/_value_tooltip.html.erb
+++ b/app/views/investments/_value_tooltip.html.erb
@@ -2,34 +2,34 @@
 
 <div data-controller="tooltip" data-tooltip-placement-value="right" data-tooltip-offset-value=10 data-tooltip-cross-axis-value=50>
   <%= icon("info", size: "sm") %>
-  <div role="tooltip" data-tooltip-target="tooltip" class="tooltip bg-gray-700 text-sm p-2 rounded w-64">
-    <div class="fg-inverse">
+  <div role="tooltip" data-tooltip-target="tooltip" class="tooltip bg-inverse text-sm p-2 rounded w-64">
+    <div class="text-inverse">
       <%= t(".total_value_tooltip") %>
     </div>
     <div class="flex pt-3">
-      <div class="text-gray-300">
+      <div class="text-inverse opacity-70">
         <%= t(".cash") %>
       </div>
-      <div class="fg-inverse ml-auto">
+      <div class="text-inverse ml-auto">
         <%= tag.p format_money(cash, precision: 0) %>
       </div>
     </div>
     <div class="flex">
-      <div class="text-gray-300">
+      <div class="text-inverse opacity-70">
         <%= t(".holdings") %>
       </div>
-      <div class="fg-inverse ml-auto">
+      <div class="text-inverse ml-auto">
         <%= tag.p format_money(holdings, precision: 0) %>
       </div>
     </div>
 
-    <hr class="my-2 border-secondary">
+    <hr class="my-2 border-inverse">
 
     <div class="flex">
-      <div class="text-gray-300">
+      <div class="text-inverse opacity-70">
         <%= t(".total") %>
       </div>
-      <div class="fg-inverse font-bold ml-auto">
+      <div class="text-inverse font-bold ml-auto">
         <%= tag.p format_money(balance, precision: 0) %>
       </div>
     </div>
diff --git a/app/views/invitations/new.html.erb b/app/views/invitations/new.html.erb
index f74b6a9d5..05f323981 100644
--- a/app/views/invitations/new.html.erb
+++ b/app/views/invitations/new.html.erb
@@ -18,7 +18,7 @@
         { label: t(".role_label") } %>
 
       <div class="w-full">
-        <%= form.submit t(".submit"), class: "bg-inverse fg-inverse rounded-lg px-4 py-2 w-full" %>
+        <%= form.submit t(".submit"), class: "bg-inverse text-inverse rounded-lg px-4 py-2 w-full" %>
       </div>
     <% end %>
   <% end %>
diff --git a/app/views/kraken_items/_kraken_item.html.erb b/app/views/kraken_items/_kraken_item.html.erb
new file mode 100644
index 000000000..784ee1715
--- /dev/null
+++ b/app/views/kraken_items/_kraken_item.html.erb
@@ -0,0 +1,117 @@
+<%# locals: (kraken_item:, unlinked_count: kraken_item.unlinked_accounts_count) %>
+
+<%= tag.div id: dom_id(kraken_item) do %>
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center gap-2">
+        <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
+
+        <div class="flex items-center justify-center h-8 w-8 rounded-full bg-surface-inset">
+          <%= icon "waves", size: "sm", class: "text-primary" %>
+        </div>
+
+        <div class="pl-1 text-sm flex-1">
+          <div class="flex items-center gap-2">
+            <%= tag.p kraken_item.institution_display_name, class: "font-medium text-primary" %>
+            <% if kraken_item.scheduled_for_deletion? %>
+              <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+            <% end %>
+          </div>
+          <p class="text-xs text-secondary"><%= t(".provider_name") %></p>
+
+          <% if kraken_item.syncing? %>
+            <div class="text-secondary flex items-center gap-1">
+              <%= icon "loader", size: "sm", class: "animate-spin" %>
+              <%= tag.span t(".syncing") %>
+            </div>
+          <% elsif kraken_item.requires_update? %>
+            <div class="text-warning flex items-center gap-1">
+              <%= icon "alert-triangle", size: "sm", color: "warning" %>
+              <%= tag.span t(".reconnect") %>
+            </div>
+          <% else %>
+            <p class="text-secondary">
+              <% if kraken_item.last_synced_at %>
+                <% if kraken_item.sync_status_summary %>
+                  <%= t(".status_with_summary", timestamp: time_ago_in_words(kraken_item.last_synced_at), summary: kraken_item.sync_status_summary) %>
+                <% else %>
+                  <%= t(".status", timestamp: time_ago_in_words(kraken_item.last_synced_at)) %>
+                <% end %>
+              <% else %>
+                <%= t(".status_never") %>
+              <% end %>
+            </p>
+          <% end %>
+        </div>
+      </div>
+    <% end %>
+
+    <% if Current.user&.admin? %>
+      <div class="flex items-center justify-end gap-2 mt-2">
+        <%= icon(
+          "refresh-cw",
+          as_button: true,
+          href: sync_kraken_item_path(kraken_item),
+          disabled: kraken_item.syncing?
+        ) %>
+
+        <%= render DS::Menu.new do |menu| %>
+          <% if unlinked_count.to_i > 0 %>
+            <% menu.with_item(
+              variant: "link",
+              text: t(".import_accounts_menu"),
+              icon: "plus",
+              href: setup_accounts_kraken_item_path(kraken_item),
+              frame: :modal
+            ) %>
+          <% end %>
+          <% menu.with_item(
+            variant: "button",
+            text: t(".delete"),
+            icon: "trash-2",
+            href: kraken_item_path(kraken_item),
+            method: :delete,
+            confirm: CustomConfirm.for_resource_deletion(kraken_item.institution_display_name, high_severity: true)
+          ) %>
+        <% end %>
+      </div>
+    <% end %>
+
+    <% unless kraken_item.scheduled_for_deletion? %>
+      <div class="space-y-4 mt-4">
+        <% if kraken_item.accounts.any? %>
+          <%= render "accounts/index/account_groups", accounts: kraken_item.accounts %>
+          <% kraken_item.stale_rate_accounts.each do |kraken_account| %>
+            <div class="flex items-center gap-2 text-xs text-warning px-1">
+              <span class="font-mono">~</span>
+              <%= icon "triangle-alert", size: "sm" %>
+              <span><%= t(".stale_rate_warning", date: kraken_account.extra.dig("kraken", "rate_target_date")) %></span>
+            </div>
+          <% end %>
+        <% end %>
+
+        <% stats = kraken_item.syncs.ordered.first&.sync_stats || {} %>
+        <%= render ProviderSyncSummary.new(stats: stats, provider_item: kraken_item) %>
+
+        <% if unlinked_count.to_i > 0 && kraken_item.accounts.empty? %>
+          <div class="p-4 flex flex-col gap-3 items-center justify-center">
+            <p class="text-primary font-medium text-sm"><%= t(".setup_needed") %></p>
+            <p class="text-secondary text-sm"><%= t(".setup_description") %></p>
+            <%= render DS::Link.new(
+              text: t(".setup_action"),
+              icon: "plus",
+              variant: "primary",
+              href: setup_accounts_kraken_item_path(kraken_item),
+              frame: :modal
+            ) %>
+          </div>
+        <% elsif kraken_item.accounts.empty? && kraken_item.kraken_accounts.none? %>
+          <div class="p-4 flex flex-col gap-3 items-center justify-center">
+            <p class="text-primary font-medium text-sm"><%= t(".no_accounts_title") %></p>
+            <p class="text-secondary text-sm"><%= t(".no_accounts_message") %></p>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/kraken_items/select_existing_account.html.erb b/app/views/kraken_items/select_existing_account.html.erb
new file mode 100644
index 000000000..d7e9e5807
--- /dev/null
+++ b/app/views/kraken_items/select_existing_account.html.erb
@@ -0,0 +1,42 @@
+<%# Modal: Link an existing manual crypto exchange account to a Kraken account %>
+<%= turbo_frame_tag "modal" do %>
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t(".title")) %>
+
+    <% dialog.with_body do %>
+      <% if @available_kraken_accounts.blank? %>
+        <div class="p-4 text-sm text-secondary">
+          <p class="mb-2"><%= t(".no_accounts_found") %></p>
+          <ul class="list-disc list-inside space-y-1">
+            <li><%= t(".wait_for_sync") %></li>
+            <li><%= t(".check_provider_health") %></li>
+          </ul>
+        </div>
+      <% else %>
+        <%= form_with url: link_existing_account_kraken_items_path, method: :post, class: "space-y-4" do %>
+          <%= hidden_field_tag :account_id, @account.id %>
+          <%= hidden_field_tag :kraken_item_id, @kraken_item.id %>
+
+          <div class="space-y-2 max-h-64 overflow-auto">
+            <% @available_kraken_accounts.each do |kraken_account| %>
+              <label class="flex items-center gap-3 p-2 rounded border border-secondary hover:border-primary cursor-pointer">
+                <%= radio_button_tag :kraken_account_id, kraken_account.id, false, required: true %>
+                <div class="flex flex-col">
+                  <span class="text-sm text-primary font-medium"><%= kraken_account.name.presence || kraken_account.id %></span>
+                  <span class="text-xs text-secondary">
+                    <%= kraken_account.currency %> &bull; <%= number_with_delimiter(kraken_account.current_balance || 0, delimiter: ",") %>
+                  </span>
+                </div>
+              </label>
+            <% end %>
+          </div>
+
+          <div class="flex items-center justify-end gap-2">
+            <%= render DS::Button.new(text: t(".link"), variant: :primary, icon: "link-2", type: :submit) %>
+            <%= render DS::Link.new(text: t(".cancel"), variant: :secondary, href: accounts_path, data: { turbo_frame: "_top" }) %>
+          </div>
+        <% end %>
+      <% end %>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/kraken_items/setup_accounts.html.erb b/app/views/kraken_items/setup_accounts.html.erb
new file mode 100644
index 000000000..5b757f492
--- /dev/null
+++ b/app/views/kraken_items/setup_accounts.html.erb
@@ -0,0 +1,89 @@
+<% content_for :title, t(".title") %>
+
+<%= render DS::Dialog.new do |dialog| %>
+  <% dialog.with_header(title: t(".title")) do %>
+    <div class="flex items-center gap-2">
+      <%= icon "waves", class: "text-primary" %>
+      <span class="text-primary"><%= t(".subtitle") %></span>
+    </div>
+  <% end %>
+
+  <% dialog.with_body do %>
+    <%= form_with url: complete_account_setup_kraken_item_path(@kraken_item),
+                  method: :post,
+                  local: true,
+                  id: "kraken-setup-form",
+                  data: {
+                    controller: "loading-button",
+                    action: "submit->loading-button#showLoading",
+                    loading_button_loading_text_value: t(".creating"),
+                    turbo_frame: "_top"
+                  },
+                  class: "space-y-6" do |form| %>
+      <div class="space-y-4">
+        <div class="bg-surface border border-primary p-4 rounded-lg">
+          <div class="flex items-start gap-3">
+            <%= icon "info", size: "sm", class: "text-primary mt-0.5 flex-shrink-0" %>
+            <p class="text-sm text-primary"><%= t(".instructions") %></p>
+          </div>
+        </div>
+
+        <% if @kraken_accounts.empty? %>
+          <div class="text-center py-8">
+            <p class="text-secondary"><%= t(".no_accounts") %></p>
+          </div>
+        <% else %>
+          <div data-controller="select-all">
+            <div class="flex items-center justify-between mb-2">
+              <span class="text-sm text-secondary">
+                <%= t(".accounts_count", count: @kraken_accounts.count) %>
+              </span>
+              <label class="flex items-center gap-2 text-sm cursor-pointer">
+                <input type="checkbox"
+                       id="kraken-select-all"
+                       data-action="change->select-all#toggle"
+                       class="checkbox checkbox--dark">
+                <span class="text-secondary"><%= t(".select_all") %></span>
+              </label>
+            </div>
+
+            <div class="space-y-2 max-h-96 overflow-y-auto">
+              <% @kraken_accounts.each do |kraken_account| %>
+                <label for="ka_<%= kraken_account.id %>" class="flex items-center gap-3 p-3 border border-primary rounded-lg hover:bg-surface transition-colors cursor-pointer">
+                  <%= check_box_tag "selected_accounts[]",
+                                    kraken_account.id,
+                                    false,
+                                    id: "ka_#{kraken_account.id}",
+                                    class: "checkbox checkbox--dark",
+                                    data: { select_all_target: "checkbox" } %>
+                  <div class="flex-1 min-w-0">
+                    <p class="font-medium text-primary truncate"><%= kraken_account.name %></p>
+                    <p class="text-xs text-secondary"><%= kraken_account.account_type %></p>
+                  </div>
+                  <div class="text-right flex-shrink-0">
+                    <p class="text-sm font-medium text-primary">
+                      <%= number_with_delimiter(kraken_account.current_balance || 0, delimiter: ",") %>
+                    </p>
+                    <p class="text-xs text-secondary"><%= kraken_account.currency %></p>
+                  </div>
+                </label>
+              <% end %>
+            </div>
+          </div>
+        <% end %>
+      </div>
+
+      <div class="flex gap-3">
+        <%= render DS::Button.new(
+          text: t(".import_selected"),
+          variant: "primary",
+          icon: "plus",
+          type: "submit",
+          class: "flex-1",
+          data: { loading_button_target: "button" }
+        ) %>
+        <%= render DS::Link.new(text: t(".cancel"), variant: "secondary", href: accounts_path) %>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index 88db5847a..b675716dd 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -18,7 +18,7 @@ end %>
 
 <% desktop_nav_items = mobile_nav_items.reject { |item| item[:mobile_only] } %>
 <% expanded_sidebar_class = "w-full" %>
-<% collapsed_sidebar_class = "w-0" %>
+<% collapsed_sidebar_class = "w-0 overflow-hidden" %>
 
 <%= render "layouts/shared/htmldoc" do %>
   <div
@@ -27,6 +27,9 @@ end %>
     data-app-layout-expanded-sidebar-class="<%= expanded_sidebar_class %>"
     data-app-layout-collapsed-sidebar-class="<%= collapsed_sidebar_class %>"
     data-app-layout-user-id-value="<%= Current.user.id %>">
+    <%= link_to t("layouts.application.skip_to_main"), "#main",
+        class: "sr-only focus:not-sr-only focus:fixed focus:top-2 focus:left-2 focus:z-50 focus:px-3 focus:py-2 focus:rounded-lg focus:bg-container focus:text-primary focus:shadow-border-xs" %>
+
     <div
       class="hidden fixed inset-0 bg-surface z-20 h-full w-full pt-[calc(env(safe-area-inset-top)+0.75rem)] pr-3 pb-[calc(env(safe-area-inset-bottom)+0.75rem)] pl-3 overflow-y-auto transition-all duration-300"
       data-app-layout-target="mobileSidebar">
@@ -71,8 +74,8 @@ end %>
     </nav>
 
     <%# DESKTOP - Left navbar %>
-    <div class="hidden lg:block">
-      <nav class="h-full flex flex-col shrink-0 w-[84px] py-4 mr-3">
+    <div class="hidden lg:block border-r border-divider">
+      <nav class="h-full flex flex-col shrink-0 w-[84px] py-4">
         <div class="pl-2 mb-3">
           <%= link_to home_path, class: "block" do %>
             <%= image_tag "logomark-color.svg", class: "w-9 h-9 mx-auto" %>
@@ -102,15 +105,16 @@ end %>
 
     <%# DESKTOP - Left sidebar %>
     <%= tag.div class: class_names(
-        "hidden lg:block py-4 overflow-y-auto shrink-0 max-w-[320px] transition-all duration-300",
-        Current.user.show_sidebar? ? expanded_sidebar_class : collapsed_sidebar_class,
+        "hidden lg:block py-4 shrink-0 max-w-[320px] transition-all duration-300 border-divider",
+        Current.user.show_sidebar? ? [expanded_sidebar_class, "border-r"] : [collapsed_sidebar_class, "border-r-0"],
        ),
+       inert: !Current.user.show_sidebar?,
        data: { app_layout_target: "leftSidebar" } do %>
-      <% if content_for?(:sidebar) %>
-        <%= yield :sidebar %>
-      <% else %>
-        <div class="h-full flex flex-col">
-          <div class="overflow-y-auto grow">
+      <div class="px-4 h-full flex flex-col overflow-y-auto">
+        <% if content_for?(:sidebar) %>
+          <%= yield :sidebar %>
+        <% else %>
+          <div class="grow">
             <%= render "accounts/account_sidebar_tabs", family: Current.family, active_tab: @account_group_tab %>
           </div>
 
@@ -134,12 +138,12 @@ end %>
               </div>
             </div>
           <% end %>
-        </div>
-      <% end %>
+        <% end %>
+      </div>
     <% end %>
 
     <%# SHARED - Main content %>
-    <%= tag.main class: class_names("grow overflow-y-auto px-3 lg:px-10 w-full mx-auto pb-[calc(5rem+env(safe-area-inset-bottom))] lg:pb-0"), data: { app_layout_target: "content", viewport_target: "content" } do %>
+    <%= tag.main id: "main", class: class_names("grow overflow-y-auto px-3 lg:px-10 w-full mx-auto pb-[calc(5rem+env(safe-area-inset-bottom))] lg:pb-0"), data: { app_layout_target: "content", viewport_target: "content" } do %>
       <% unless intro_mode %>
         <div class="hidden lg:flex gap-2 items-center justify-between mb-6 sticky top-0 z-10 -mx-3 lg:-mx-10 px-3 lg:px-10 py-4 bg-surface border-b border-tertiary">
           <div class="flex items-center gap-2">
@@ -148,7 +152,7 @@ end %>
             <% if content_for?(:breadcrumbs) %>
               <%= yield :breadcrumbs %>
             <% else %>
-              <%= render "layouts/shared/breadcrumbs", breadcrumbs: @breadcrumbs %>
+              <%= render "layouts/shared/breadcrumbs", breadcrumbs: breadcrumbs %>
             <% end %>
           </div>
 
@@ -178,11 +182,12 @@ end %>
 
     <%# DESKTOP - Right sidebar %>
     <%= tag.div class: class_names(
-          "hidden lg:block h-full overflow-y-auto shrink-0 max-w-[400px] transition-all duration-300",
-          Current.user.show_ai_sidebar? ? expanded_sidebar_class : collapsed_sidebar_class,
+          "hidden lg:block h-full shrink-0 max-w-[400px] transition-all duration-300 border-divider",
+          Current.user.show_ai_sidebar? ? [expanded_sidebar_class, "border-l"] : [collapsed_sidebar_class, "border-l-0"],
         ),
+        inert: !Current.user.show_ai_sidebar?,
         data: { app_layout_target: "rightSidebar" } do %>
-      <%= tag.div id: "chat-container", class: "relative h-full", data: { controller: "chat hotkey", turbo_permanent: true } do %>
+      <%= tag.div id: "chat-container", class: "relative h-full px-4 overflow-y-auto", data: { controller: "chat hotkey", turbo_permanent: true } do %>
         <div class="flex flex-col h-full justify-between shrink-0">
           <%= turbo_frame_tag chat_frame, src: chat_view_path(@chat), loading: "lazy", class: "h-full" do %>
             <div class="flex justify-center items-center h-full">
@@ -192,7 +197,7 @@ end %>
         </div>
 
         <% unless Current.user.ai_enabled? %>
-          <div class="absolute backdrop-blur-lg inset-0 h-full w-full flex flex-col justify-center items-center pl-0.5 pr-4">
+          <div class="absolute backdrop-blur-lg inset-0 h-full w-full flex flex-col justify-center items-center px-4">
             <%= render "chats/ai_consent" %>
           </div>
         <% end %>
diff --git a/app/views/layouts/auth.html.erb b/app/views/layouts/auth.html.erb
index c02ee861f..271abef83 100644
--- a/app/views/layouts/auth.html.erb
+++ b/app/views/layouts/auth.html.erb
@@ -26,7 +26,7 @@
                 <%= tag.span t("layouts.auth.no_account", product_name: product_name), class: "text-secondary" %> <%= link_to t("layouts.auth.sign_up"), new_registration_path, class: "font-medium text-primary hover:underline transition" %>
               </p>
             <% elsif controller_name == "registrations" %>
-              <p class="text-sm text-center text-gray-600 hidden md:block">
+              <p class="text-sm text-center text-secondary hidden md:block">
                 <%= t("layouts.auth.existing_account") %> <%= link_to t("layouts.auth.sign_in"), new_session_path, class: "font-medium text-primary hover:underline transition" %>
               </p>
             <% end %>
diff --git a/app/views/layouts/lookbooks.html.erb b/app/views/layouts/lookbooks.html.erb
index de1b9dc9b..30d6e8e52 100644
--- a/app/views/layouts/lookbooks.html.erb
+++ b/app/views/layouts/lookbooks.html.erb
@@ -8,7 +8,7 @@
     <%= javascript_include_tag "application", "data-turbo-track": "reload", defer: true %>
     <%= javascript_importmap_tags %>
   </head>
-  <body class="p-4 h-full bg-container <%= params.dig(:lookbook, :display, :container_classes) %>">
+  <body class="p-4 h-full bg-container text-primary <%= params.dig(:lookbook, :display, :container_classes) %>">
     <%= yield %>
   </body>
 </html>
diff --git a/app/views/layouts/settings.html.erb b/app/views/layouts/settings.html.erb
index 9d5f4b17a..887789332 100644
--- a/app/views/layouts/settings.html.erb
+++ b/app/views/layouts/settings.html.erb
@@ -1,17 +1,22 @@
 <%= render "layouts/shared/htmldoc" do %>
   <div class="flex flex-col md:flex-row h-full bg-surface pt-[env(safe-area-inset-top)]">
-    <div class="p-4 w-full md:w-96 shrink-0 md:h-full md:overflow-y-auto">
-      <%= render "settings/settings_nav" %>
+    <%= link_to t("layouts.application.skip_to_main"), "#main",
+        class: "sr-only focus:not-sr-only focus:fixed focus:top-2 focus:left-2 focus:z-50 focus:px-3 focus:py-2 focus:rounded-lg focus:bg-container focus:text-primary focus:shadow-border-xs" %>
+
+    <div class="w-full md:w-auto md:min-w-64 shrink-0 md:h-full md:overflow-y-auto border-divider md:border-r">
+      <div class="p-4">
+        <%= render "settings/settings_nav" %>
+      </div>
     </div>
 
-    <main class="grow flex h-full">
+    <main id="main" class="grow flex h-full">
       <div class="relative max-w-4xl mx-auto flex flex-col w-full h-full">
         <div class="grow flex flex-col overflow-y-auto overflow-x-hidden overscroll-contain [-webkit-overflow-scrolling:touch]">
           <div class="sticky top-0 z-10 px-3 md:px-10 pt-1.5 md:pt-3 pb-3 bg-surface border-b border-tertiary shrink-0">
             <% if content_for?(:breadcrumbs) %>
               <%= yield :breadcrumbs %>
             <% else %>
-              <%= render "layouts/shared/breadcrumbs", breadcrumbs: @breadcrumbs %>
+              <%= render "layouts/shared/breadcrumbs", breadcrumbs: breadcrumbs %>
             <% end %>
 
             <div class="flex items-center justify-between gap-4 mt-1.5 min-h-9">
diff --git a/app/views/layouts/shared/_breadcrumbs.html.erb b/app/views/layouts/shared/_breadcrumbs.html.erb
index 665fa4bea..bbe191b28 100644
--- a/app/views/layouts/shared/_breadcrumbs.html.erb
+++ b/app/views/layouts/shared/_breadcrumbs.html.erb
@@ -7,11 +7,11 @@
     <% end %>
 
     <% if path.present? && index < breadcrumbs.size - 1 %>
-      <%= link_to name, path, class: "text-sm text-gray-500 font-medium" %>
+      <%= link_to name, path, class: "text-sm text-secondary font-medium" %>
     <% elsif index == breadcrumbs.size - 1 %>
       <span class="text-primary font-medium text-sm"><%= name %></span>
     <% else %>
-      <span class="text-sm text-gray-500 font-medium"><%= name %></span>
+      <span class="text-sm text-secondary font-medium"><%= name %></span>
     <% end %>
   <% end %>
 </div>
diff --git a/app/views/layouts/shared/_confirm_dialog.html.erb b/app/views/layouts/shared/_confirm_dialog.html.erb
index 03e923818..cefc5aa13 100644
--- a/app/views/layouts/shared/_confirm_dialog.html.erb
+++ b/app/views/layouts/shared/_confirm_dialog.html.erb
@@ -5,18 +5,19 @@
     <form method="dialog" class="space-y-4">
       <div class="space-y-2">
         <div class="flex items-center justify-between gap-2">
-          <h3 class="font-medium text-primary" data-confirm-dialog-target="title">Are you sure?</h3>
+          <h3 class="font-medium text-primary" data-confirm-dialog-target="title"><%= t(".are_you_sure") %></h3>
           <%= icon("x", as_button: true, type: "submit", value: "cancel") %>
         </div>
 
-        <p class="text-sm text-secondary" data-confirm-dialog-target="subtitle">This action cannot be undone.</p>
+        <p class="text-sm text-secondary" data-confirm-dialog-target="subtitle"><%= t(".cannot_be_undone") %></p>
       </div>
 
       <div>
         <% ["primary", "outline-destructive", "destructive"].each do |variant| %>
           <%= render DS::Button.new(
-          text: "Confirm",
+          text: t(".confirm"),
           variant: variant,
+          type: :submit,
           autofocus: true,
           full_width: true,
           value: "confirm",
diff --git a/app/views/layouts/shared/_nav_item.html.erb b/app/views/layouts/shared/_nav_item.html.erb
index 7ab4888ba..3c700e184 100644
--- a/app/views/layouts/shared/_nav_item.html.erb
+++ b/app/views/layouts/shared/_nav_item.html.erb
@@ -1,6 +1,6 @@
 <%# locals:(name:, path:, icon:, icon_custom:, active:, mobile_only: false) %>
 
-<%= link_to path, class: "space-y-1 group block relative pb-1" do %>
+<%= link_to path, class: "space-y-1 group block relative pb-1", aria: { current: ("page" if active) } do %>
   <div class="grow flex flex-col lg:flex-row gap-1 items-center">
     <%= tag.div class: class_names("w-4 h-1 lg:w-1 lg:h-4 rounded-bl-sm rounded-br-sm lg:rounded-tr-sm lg:rounded-br-sm lg:rounded-bl-none", "bg-nav-indicator" => active) %>
 
diff --git a/app/views/layouts/shared/_page_header.html.erb b/app/views/layouts/shared/_page_header.html.erb
index 018195fe0..622820cab 100644
--- a/app/views/layouts/shared/_page_header.html.erb
+++ b/app/views/layouts/shared/_page_header.html.erb
@@ -4,7 +4,7 @@
     <div class="space-y-1">
       <h1 class="text-3xl font-medium text-primary"><%= title %></h1>
       <% if local_assigns[:subtitle].present? %>
-        <p class="text-gray-500"><%= subtitle %></p>
+        <p class="text-secondary"><%= subtitle %></p>
       <% end %>
     </div>
   <% end %>
diff --git a/app/views/loans/tabs/_overview.html.erb b/app/views/loans/tabs/_overview.html.erb
index 41167e6fb..2c6d3810a 100644
--- a/app/views/loans/tabs/_overview.html.erb
+++ b/app/views/loans/tabs/_overview.html.erb
@@ -46,7 +46,7 @@
 
 <div class="flex justify-center py-8">
   <%= render DS::Link.new(
-    text: "Edit loan details",
+    text: t(".edit_loan_details"),
     variant: "ghost",
     href: edit_loan_path(account),
     frame: :modal
diff --git a/app/views/lunchflow_items/_api_error.html.erb b/app/views/lunchflow_items/_api_error.html.erb
index 1a1b49b3e..7a1e2c352 100644
--- a/app/views/lunchflow_items/_api_error.html.erb
+++ b/app/views/lunchflow_items/_api_error.html.erb
@@ -1,33 +1,32 @@
 <%# locals: (error_message:, return_path:) %>
 <%= turbo_frame_tag "modal" do %>
   <%= render DS::Dialog.new do |dialog| %>
-    <% dialog.with_header(title: "Lunch Flow Connection Error") %>
+    <% dialog.with_header(title: t(".title")) %>
     <% dialog.with_body do %>
       <div class="space-y-4">
-        <div class="flex items-start gap-3">
-          <%= icon("alert-circle", class: "text-destructive w-5 h-5 shrink-0 mt-0.5") %>
-          <div class="text-sm">
-            <p class="font-medium text-primary mb-2">Unable to connect to Lunch Flow</p>
-            <p class="text-secondary"><%= error_message %></p>
-          </div>
-        </div>
+        <%= render DS::Alert.new(
+          title: t(".unable_to_connect"),
+          message: error_message,
+          variant: :error
+        ) %>
 
         <div class="bg-surface rounded-lg p-4 space-y-2 text-sm">
-          <p class="font-medium text-primary">Common Issues:</p>
+          <p class="font-medium text-primary"><%= t(".common_issues") %></p>
           <ul class="list-disc list-inside space-y-1 text-secondary">
-            <li><strong>Invalid API Key:</strong> Check your API key in Provider Settings</li>
-            <li><strong>Expired Credentials:</strong> Generate a new API key from Lunch Flow</li>
-            <li><strong>Network Issue:</strong> Check your internet connection</li>
-            <li><strong>Service Down:</strong> Lunch Flow API may be temporarily unavailable</li>
+            <li><strong><%= t(".invalid_api_key_label") %>:</strong> <%= t(".invalid_api_key_desc") %></li>
+            <li><strong><%= t(".expired_credentials_label") %>:</strong> <%= t(".expired_credentials_desc") %></li>
+            <li><strong><%= t(".network_issue_label") %>:</strong> <%= t(".network_issue_desc") %></li>
+            <li><strong><%= t(".service_down_label") %>:</strong> <%= t(".service_down_desc") %></li>
           </ul>
         </div>
 
         <div class="mt-4">
-          <%= link_to settings_providers_path,
-                      class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-white bg-gray-900 hover:bg-gray-800 focus:outline-none focus:ring-2 focus:ring-gray-900 focus:ring-offset-2 transition-colors",
-                      data: { turbo: false } do %>
-            Check Provider Settings
-          <% end %>
+          <%= render DS::Link.new(
+            text: t(".check_provider_settings"),
+            href: settings_providers_path,
+            variant: :primary,
+            data: { turbo: false }
+          ) %>
         </div>
       </div>
     <% end %>
diff --git a/app/views/lunchflow_items/_lunchflow_item.html.erb b/app/views/lunchflow_items/_lunchflow_item.html.erb
index a1aec313b..a4db679b2 100644
--- a/app/views/lunchflow_items/_lunchflow_item.html.erb
+++ b/app/views/lunchflow_items/_lunchflow_item.html.erb
@@ -1,82 +1,84 @@
 <%# locals: (lunchflow_item:) %>
 
 <%= tag.div id: dom_id(lunchflow_item) do %>
-  <details open class="group bg-container p-4 shadow-border-xs rounded-xl">
-    <summary class="flex items-center justify-between gap-2">
-      <div class="flex items-center gap-2">
-        <%= icon "chevron-right", class: "group-open:transform group-open:rotate-90" %>
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center justify-between gap-2">
+        <div class="flex items-center gap-2">
+          <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
 
-        <div class="flex items-center justify-center h-8 w-8 bg-orange-600/10 rounded-full">
-          <% if lunchflow_item.logo.attached? %>
-            <%= image_tag lunchflow_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
-          <% else %>
-            <div class="flex items-center justify-center">
-              <%= tag.p lunchflow_item.name.first.upcase, class: "text-orange-600 text-xs font-medium" %>
-            </div>
-          <% end %>
-        </div>
-
-        <div class="pl-1 text-sm">
-          <div class="flex items-center gap-2">
-            <%= tag.p lunchflow_item.name, class: "font-medium text-primary" %>
-            <% if lunchflow_item.scheduled_for_deletion? %>
-              <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+          <div class="flex items-center justify-center h-8 w-8 bg-orange-600/10 rounded-full">
+            <% if lunchflow_item.logo.attached? %>
+              <%= image_tag lunchflow_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
+            <% else %>
+              <div class="flex items-center justify-center">
+                <%= tag.p lunchflow_item.name.first.upcase, class: "text-orange-600 text-xs font-medium" %>
+              </div>
             <% end %>
           </div>
-          <% if lunchflow_item.accounts.any? %>
-            <p class="text-xs text-secondary">
-              <%= lunchflow_item.institution_summary %>
-            </p>
-          <% end %>
-          <% if lunchflow_item.syncing? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= icon "loader", size: "sm", class: "animate-spin" %>
-              <%= tag.span t(".syncing") %>
-            </div>
-          <% elsif lunchflow_item.sync_error.present? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= render DS::Tooltip.new(text: lunchflow_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive") %>
-              <%= tag.span t(".error"), class: "text-destructive" %>
-            </div>
-          <% else %>
-            <p class="text-secondary">
-              <% if lunchflow_item.last_synced_at %>
-                <% if lunchflow_item.sync_status_summary %>
-                  <%= t(".status_with_summary", timestamp: time_ago_in_words(lunchflow_item.last_synced_at), summary: lunchflow_item.sync_status_summary) %>
-                <% else %>
-                  <%= t(".status", timestamp: time_ago_in_words(lunchflow_item.last_synced_at)) %>
-                <% end %>
-              <% else %>
-                <%= t(".status_never") %>
+
+          <div class="pl-1 text-sm">
+            <div class="flex items-center gap-2">
+              <%= tag.p lunchflow_item.name, class: "font-medium text-primary" %>
+              <% if lunchflow_item.scheduled_for_deletion? %>
+                <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
               <% end %>
-            </p>
-          <% end %>
+            </div>
+            <% if lunchflow_item.accounts.any? %>
+              <p class="text-xs text-secondary">
+                <%= lunchflow_item.institution_summary %>
+              </p>
+            <% end %>
+            <% if lunchflow_item.syncing? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "loader", size: "sm", class: "animate-spin" %>
+                <%= tag.span t(".syncing") %>
+              </div>
+            <% elsif lunchflow_item.sync_error.present? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= render DS::Tooltip.new(text: lunchflow_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive", as: :span) %>
+                <%= tag.span t(".error"), class: "text-destructive" %>
+              </div>
+            <% else %>
+              <p class="text-secondary">
+                <% if lunchflow_item.last_synced_at %>
+                  <% if lunchflow_item.sync_status_summary %>
+                    <%= t(".status_with_summary", timestamp: time_ago_in_words(lunchflow_item.last_synced_at), summary: lunchflow_item.sync_status_summary) %>
+                  <% else %>
+                    <%= t(".status", timestamp: time_ago_in_words(lunchflow_item.last_synced_at)) %>
+                  <% end %>
+                <% else %>
+                  <%= t(".status_never") %>
+                <% end %>
+              </p>
+            <% end %>
+          </div>
         </div>
+
+        <% if Current.user&.admin? %>
+          <div class="flex items-center gap-2">
+            <% if Rails.env.development? %>
+              <%= icon(
+                "refresh-cw",
+                as_button: true,
+                href: sync_lunchflow_item_path(lunchflow_item)
+              ) %>
+            <% end %>
+
+            <%= render DS::Menu.new do |menu| %>
+              <% menu.with_item(
+                variant: "button",
+                text: t(".delete"),
+                icon: "trash-2",
+                href: lunchflow_item_path(lunchflow_item),
+                method: :delete,
+                confirm: CustomConfirm.for_resource_deletion(lunchflow_item.name, high_severity: true)
+              ) %>
+            <% end %>
+          </div>
+        <% end %>
       </div>
-
-      <% if Current.user&.admin? %>
-        <div class="flex items-center gap-2">
-          <% if Rails.env.development? %>
-            <%= icon(
-              "refresh-cw",
-              as_button: true,
-              href: sync_lunchflow_item_path(lunchflow_item)
-            ) %>
-          <% end %>
-
-          <%= render DS::Menu.new do |menu| %>
-            <% menu.with_item(
-              variant: "button",
-              text: t(".delete"),
-              icon: "trash-2",
-              href: lunchflow_item_path(lunchflow_item),
-              method: :delete,
-              confirm: CustomConfirm.for_resource_deletion(lunchflow_item.name, high_severity: true)
-            ) %>
-          <% end %>
-        </div>
-      <% end %>
-    </summary>
+    <% end %>
 
     <% unless lunchflow_item.scheduled_for_deletion? %>
       <div class="space-y-4 mt-4">
@@ -128,5 +130,5 @@
         <% end %>
       </div>
     <% end %>
-  </details>
+  <% end %>
 <% end %>
diff --git a/app/views/lunchflow_items/_setup_required.html.erb b/app/views/lunchflow_items/_setup_required.html.erb
index 8776d7406..f53dce376 100644
--- a/app/views/lunchflow_items/_setup_required.html.erb
+++ b/app/views/lunchflow_items/_setup_required.html.erb
@@ -1,32 +1,31 @@
 <%= turbo_frame_tag "modal" do %>
   <%= render DS::Dialog.new do |dialog| %>
-    <% dialog.with_header(title: "Lunch Flow Setup Required") %>
+    <% dialog.with_header(title: t(".title")) %>
     <% dialog.with_body do %>
       <div class="space-y-4">
-        <div class="flex items-start gap-3">
-          <%= icon("alert-circle", class: "text-warning w-5 h-5 shrink-0 mt-0.5") %>
-          <div class="text-sm text-secondary">
-            <p class="font-medium text-primary mb-2">API Key Not Configured</p>
-            <p>Before you can link Lunch Flow accounts, you need to configure your Lunch Flow API key.</p>
-          </div>
-        </div>
+        <%= render DS::Alert.new(
+          title: t(".api_key_not_configured"),
+          message: t(".api_key_description"),
+          variant: :warning
+        ) %>
 
         <div class="bg-surface rounded-lg p-4 space-y-2 text-sm">
-          <p class="font-medium text-primary">Setup Steps:</p>
+          <p class="font-medium text-primary"><%= t(".setup_steps_title") %></p>
           <ol class="list-decimal list-inside space-y-1 text-secondary">
-            <li>Go to <strong>Settings → Providers</strong></li>
-            <li>Find the <strong>Lunch Flow</strong> section</li>
-            <li>Enter your Lunch Flow API key</li>
-            <li>Return here to link your accounts</li>
+            <li><%= t(".setup_step_1_html") %></li>
+            <li><%= t(".setup_step_2_html") %></li>
+            <li><%= t(".setup_step_3") %></li>
+            <li><%= t(".setup_step_4") %></li>
           </ol>
         </div>
 
         <div class="mt-4">
-          <%= link_to settings_providers_path,
-                      class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-white bg-gray-900 hover:bg-gray-800 focus:outline-none focus:ring-2 focus:ring-gray-900 focus:ring-offset-2 transition-colors",
-                      data: { turbo: false } do %>
-            Go to Provider Settings
-          <% end %>
+          <%= render DS::Link.new(
+            text: t(".go_to_provider_settings"),
+            href: settings_providers_path,
+            variant: :primary,
+            data: { turbo: false }
+          ) %>
         </div>
       </div>
     <% end %>
diff --git a/app/views/lunchflow_items/select_accounts.html.erb b/app/views/lunchflow_items/select_accounts.html.erb
index 9399bef0f..dc9f5aba5 100644
--- a/app/views/lunchflow_items/select_accounts.html.erb
+++ b/app/views/lunchflow_items/select_accounts.html.erb
@@ -46,8 +46,11 @@
             <%= link_to t(".cancel"), @return_to || new_account_path,
                 class: "inline-flex items-center gap-1 px-3 py-2 text-sm font-medium rounded-lg text-primary button-bg-secondary hover:button-bg-secondary-hover",
                 data: { turbo_frame: "_top", action: "DS--dialog#close" } %>
-            <%= submit_tag t(".link_accounts"),
-                class: "inline-flex items-center gap-1 px-3 py-2 text-sm font-medium rounded-lg text-inverse bg-inverse hover:bg-inverse-hover disabled:button-bg-disabled" %>
+            <%= render DS::Button.new(
+              text: t(".link_accounts"),
+              variant: :primary,
+              type: :submit
+            ) %>
           </div>
         </form>
       </div>
diff --git a/app/views/lunchflow_items/select_existing_account.html.erb b/app/views/lunchflow_items/select_existing_account.html.erb
index 3dc778517..07f8227eb 100644
--- a/app/views/lunchflow_items/select_existing_account.html.erb
+++ b/app/views/lunchflow_items/select_existing_account.html.erb
@@ -46,8 +46,11 @@
             <%= link_to t(".cancel"), @return_to || accounts_path,
                 class: "inline-flex items-center gap-1 px-3 py-2 text-sm font-medium rounded-lg text-primary button-bg-secondary hover:button-bg-secondary-hover",
                 data: { turbo_frame: "_top", action: "DS--dialog#close" } %>
-            <%= submit_tag t(".link_account"),
-                class: "inline-flex items-center gap-1 px-3 py-2 text-sm font-medium rounded-lg text-inverse bg-inverse hover:bg-inverse-hover disabled:button-bg-disabled" %>
+            <%= render DS::Button.new(
+              text: t(".link_account"),
+              variant: :primary,
+              type: :submit
+            ) %>
           </div>
         </form>
       </div>
diff --git a/app/views/mercury_items/_api_error.html.erb b/app/views/mercury_items/_api_error.html.erb
index bca14207b..7b736eab6 100644
--- a/app/views/mercury_items/_api_error.html.erb
+++ b/app/views/mercury_items/_api_error.html.erb
@@ -1,34 +1,35 @@
 <%# locals: (error_message:, return_path:) %>
 <%= turbo_frame_tag "modal" do %>
   <%= render DS::Dialog.new do |dialog| %>
-    <% dialog.with_header(title: "Mercury Connection Error") %>
+    <% dialog.with_header(title: t(".title")) %>
     <% dialog.with_body do %>
       <div class="space-y-4">
         <div class="flex items-start gap-3">
           <%= icon("alert-circle", class: "text-destructive w-5 h-5 shrink-0 mt-0.5") %>
           <div class="text-sm">
-            <p class="font-medium text-primary mb-2">Unable to connect to Mercury</p>
+            <p class="font-medium text-primary mb-2"><%= t(".unable_to_connect") %></p>
             <p class="text-secondary"><%= error_message %></p>
           </div>
         </div>
 
         <div class="bg-surface rounded-lg p-4 space-y-2 text-sm">
-          <p class="font-medium text-primary">Common Issues:</p>
+          <p class="font-medium text-primary"><%= t(".common_issues") %></p>
           <ul class="list-disc list-inside space-y-1 text-secondary">
-            <li><strong>Invalid API Token:</strong> Check your API token in Provider Settings</li>
-            <li><strong>Expired Credentials:</strong> Generate a new API token from Mercury</li>
-            <li><strong>Insufficient Permissions:</strong> Ensure your token has read-only access</li>
-            <li><strong>Network Issue:</strong> Check your internet connection</li>
-            <li><strong>Service Down:</strong> Mercury API may be temporarily unavailable</li>
+            <li><strong><%= t(".invalid_api_token_label") %>:</strong> <%= t(".invalid_api_token_desc") %></li>
+            <li><strong><%= t(".expired_credentials_label") %>:</strong> <%= t(".expired_credentials_desc") %></li>
+            <li><strong><%= t(".insufficient_permissions_label") %>:</strong> <%= t(".insufficient_permissions_desc") %></li>
+            <li><strong><%= t(".network_issue_label") %>:</strong> <%= t(".network_issue_desc") %></li>
+            <li><strong><%= t(".service_down_label") %>:</strong> <%= t(".service_down_desc") %></li>
           </ul>
         </div>
 
         <div class="mt-4">
-          <%= link_to settings_providers_path,
-                      class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-white bg-gray-900 hover:bg-gray-800 focus:outline-none focus:ring-2 focus:ring-gray-900 focus:ring-offset-2 transition-colors",
-                      data: { turbo: false } do %>
-            Check Provider Settings
-          <% end %>
+          <%= render DS::Link.new(
+            text: t(".check_provider_settings"),
+            href: settings_providers_path,
+            variant: :primary,
+            data: { turbo: false }
+          ) %>
         </div>
       </div>
     <% end %>
diff --git a/app/views/mercury_items/_mercury_item.html.erb b/app/views/mercury_items/_mercury_item.html.erb
index 0159551e8..9fb8f7923 100644
--- a/app/views/mercury_items/_mercury_item.html.erb
+++ b/app/views/mercury_items/_mercury_item.html.erb
@@ -1,82 +1,84 @@
 <%# locals: (mercury_item:) %>
 
 <%= tag.div id: dom_id(mercury_item) do %>
-  <details open class="group bg-container p-4 shadow-border-xs rounded-xl">
-    <summary class="flex items-center justify-between gap-2">
-      <div class="flex items-center gap-2">
-        <%= icon "chevron-right", class: "group-open:transform group-open:rotate-90" %>
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center justify-between gap-2">
+        <div class="flex items-center gap-2">
+          <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
 
-        <div class="flex items-center justify-center h-8 w-8 bg-blue-600/10 rounded-full">
-          <% if mercury_item.logo.attached? %>
-            <%= image_tag mercury_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
-          <% else %>
-            <div class="flex items-center justify-center">
-              <%= tag.p mercury_item.name.first.upcase, class: "text-blue-600 text-xs font-medium" %>
-            </div>
-          <% end %>
-        </div>
-
-        <div class="pl-1 text-sm">
-          <div class="flex items-center gap-2">
-            <%= tag.p mercury_item.name, class: "font-medium text-primary" %>
-            <% if mercury_item.scheduled_for_deletion? %>
-              <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+          <div class="flex items-center justify-center h-8 w-8 bg-blue-600/10 rounded-full">
+            <% if mercury_item.logo.attached? %>
+              <%= image_tag mercury_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
+            <% else %>
+              <div class="flex items-center justify-center">
+                <%= tag.p mercury_item.name.first.upcase, class: "text-blue-600 text-xs font-medium" %>
+              </div>
             <% end %>
           </div>
-          <% if mercury_item.accounts.any? %>
-            <p class="text-xs text-secondary">
-              <%= mercury_item.institution_summary %>
-            </p>
-          <% end %>
-          <% if mercury_item.syncing? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= icon "loader", size: "sm", class: "animate-spin" %>
-              <%= tag.span t(".syncing") %>
-            </div>
-          <% elsif mercury_item.sync_error.present? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= render DS::Tooltip.new(text: mercury_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive") %>
-              <%= tag.span t(".error"), class: "text-destructive" %>
-            </div>
-          <% else %>
-            <p class="text-secondary">
-              <% if mercury_item.last_synced_at %>
-                <% if mercury_item.sync_status_summary %>
-                  <%= t(".status_with_summary", timestamp: time_ago_in_words(mercury_item.last_synced_at), summary: mercury_item.sync_status_summary) %>
-                <% else %>
-                  <%= t(".status", timestamp: time_ago_in_words(mercury_item.last_synced_at)) %>
-                <% end %>
-              <% else %>
-                <%= t(".status_never") %>
+
+          <div class="pl-1 text-sm">
+            <div class="flex items-center gap-2">
+              <%= tag.p mercury_item.name, class: "font-medium text-primary" %>
+              <% if mercury_item.scheduled_for_deletion? %>
+                <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
               <% end %>
-            </p>
-          <% end %>
+            </div>
+            <% if mercury_item.accounts.any? %>
+              <p class="text-xs text-secondary">
+                <%= mercury_item.institution_summary %>
+              </p>
+            <% end %>
+            <% if mercury_item.syncing? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "loader", size: "sm", class: "animate-spin" %>
+                <%= tag.span t(".syncing") %>
+              </div>
+            <% elsif mercury_item.sync_error.present? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= render DS::Tooltip.new(text: mercury_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive", as: :span) %>
+                <%= tag.span t(".error"), class: "text-destructive" %>
+              </div>
+            <% else %>
+              <p class="text-secondary">
+                <% if mercury_item.last_synced_at %>
+                  <% if mercury_item.sync_status_summary %>
+                    <%= t(".status_with_summary", timestamp: time_ago_in_words(mercury_item.last_synced_at), summary: mercury_item.sync_status_summary) %>
+                  <% else %>
+                    <%= t(".status", timestamp: time_ago_in_words(mercury_item.last_synced_at)) %>
+                  <% end %>
+                <% else %>
+                  <%= t(".status_never") %>
+                <% end %>
+              </p>
+            <% end %>
+          </div>
         </div>
+
+        <% if Current.user&.admin? %>
+          <div class="flex items-center gap-2">
+            <% if Rails.env.development? %>
+              <%= icon(
+                "refresh-cw",
+                as_button: true,
+                href: sync_mercury_item_path(mercury_item)
+              ) %>
+            <% end %>
+
+            <%= render DS::Menu.new do |menu| %>
+              <% menu.with_item(
+                variant: "button",
+                text: t(".delete"),
+                icon: "trash-2",
+                href: mercury_item_path(mercury_item),
+                method: :delete,
+                confirm: CustomConfirm.for_resource_deletion(mercury_item.name, high_severity: true)
+              ) %>
+            <% end %>
+          </div>
+        <% end %>
       </div>
-
-      <% if Current.user&.admin? %>
-        <div class="flex items-center gap-2">
-          <% if Rails.env.development? %>
-            <%= icon(
-              "refresh-cw",
-              as_button: true,
-              href: sync_mercury_item_path(mercury_item)
-            ) %>
-          <% end %>
-
-          <%= render DS::Menu.new do |menu| %>
-            <% menu.with_item(
-              variant: "button",
-              text: t(".delete"),
-              icon: "trash-2",
-              href: mercury_item_path(mercury_item),
-              method: :delete,
-              confirm: CustomConfirm.for_resource_deletion(mercury_item.name, high_severity: true)
-            ) %>
-          <% end %>
-        </div>
-      <% end %>
-    </summary>
+    <% end %>
 
     <% unless mercury_item.scheduled_for_deletion? %>
       <div class="space-y-4 mt-4">
@@ -128,5 +130,5 @@
         <% end %>
       </div>
     <% end %>
-  </details>
+  <% end %>
 <% end %>
diff --git a/app/views/mercury_items/_setup_required.html.erb b/app/views/mercury_items/_setup_required.html.erb
index b8f576022..3738a1fce 100644
--- a/app/views/mercury_items/_setup_required.html.erb
+++ b/app/views/mercury_items/_setup_required.html.erb
@@ -1,32 +1,33 @@
 <%= turbo_frame_tag "modal" do %>
   <%= render DS::Dialog.new do |dialog| %>
-    <% dialog.with_header(title: "Mercury Setup Required") %>
+    <% dialog.with_header(title: t(".title")) %>
     <% dialog.with_body do %>
       <div class="space-y-4">
         <div class="flex items-start gap-3">
           <%= icon("alert-circle", class: "text-warning w-5 h-5 shrink-0 mt-0.5") %>
           <div class="text-sm text-secondary">
-            <p class="font-medium text-primary mb-2">API Token Not Configured</p>
-            <p>Before you can link Mercury accounts, you need to configure your Mercury API token.</p>
+            <p class="font-medium text-primary mb-2"><%= t(".api_token_not_configured") %></p>
+            <p><%= t(".api_token_description") %></p>
           </div>
         </div>
 
         <div class="bg-surface rounded-lg p-4 space-y-2 text-sm">
-          <p class="font-medium text-primary">Setup Steps:</p>
+          <p class="font-medium text-primary"><%= t(".setup_steps_title") %></p>
           <ol class="list-decimal list-inside space-y-1 text-secondary">
-            <li>Go to <strong>Settings > Providers</strong></li>
-            <li>Find the <strong>Mercury</strong> section</li>
-            <li>Enter your Mercury API token</li>
-            <li>Return here to link your accounts</li>
+            <li><%= t(".setup_step_1_html") %></li>
+            <li><%= t(".setup_step_2_html") %></li>
+            <li><%= t(".setup_step_3") %></li>
+            <li><%= t(".setup_step_4") %></li>
           </ol>
         </div>
 
         <div class="mt-4">
-          <%= link_to settings_providers_path,
-                      class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-white bg-gray-900 hover:bg-gray-800 focus:outline-none focus:ring-2 focus:ring-gray-900 focus:ring-offset-2 transition-colors",
-                      data: { turbo: false } do %>
-            Go to Provider Settings
-          <% end %>
+          <%= render DS::Link.new(
+            text: t(".go_to_provider_settings"),
+            href: settings_providers_path,
+            variant: :primary,
+            data: { turbo: false }
+          ) %>
         </div>
       </div>
     <% end %>
diff --git a/app/views/mercury_items/select_accounts.html.erb b/app/views/mercury_items/select_accounts.html.erb
index 7b9c15857..4b48c7720 100644
--- a/app/views/mercury_items/select_accounts.html.erb
+++ b/app/views/mercury_items/select_accounts.html.erb
@@ -10,6 +10,7 @@
 
         <form action="<%= link_accounts_mercury_items_path %>" method="post" class="space-y-4" data-turbo-frame="_top">
           <%= hidden_field_tag :authenticity_token, form_authenticity_token %>
+          <%= hidden_field_tag :mercury_item_id, @mercury_item.id %>
           <%= hidden_field_tag :accountable_type, @accountable_type %>
           <%= hidden_field_tag :return_to, @return_to %>
 
@@ -47,8 +48,11 @@
             <%= link_to t(".cancel"), @return_to || new_account_path,
                 class: "inline-flex items-center gap-1 px-3 py-2 text-sm font-medium rounded-lg text-primary button-bg-secondary hover:button-bg-secondary-hover",
                 data: { turbo_frame: "_top", action: "DS--dialog#close" } %>
-            <%= submit_tag t(".link_accounts"),
-                class: "inline-flex items-center gap-1 px-3 py-2 text-sm font-medium rounded-lg text-inverse bg-inverse hover:bg-inverse-hover disabled:button-bg-disabled" %>
+            <%= render DS::Button.new(
+              text: t(".link_accounts"),
+              variant: :primary,
+              type: :submit
+            ) %>
           </div>
         </form>
       </div>
diff --git a/app/views/mercury_items/select_existing_account.html.erb b/app/views/mercury_items/select_existing_account.html.erb
index d1ab2c4be..2641de1a5 100644
--- a/app/views/mercury_items/select_existing_account.html.erb
+++ b/app/views/mercury_items/select_existing_account.html.erb
@@ -10,6 +10,7 @@
 
         <form action="<%= link_existing_account_mercury_items_path %>" method="post" class="space-y-4" data-turbo-frame="_top">
           <%= hidden_field_tag :authenticity_token, form_authenticity_token %>
+          <%= hidden_field_tag :mercury_item_id, @mercury_item.id %>
           <%= hidden_field_tag :account_id, @account.id %>
           <%= hidden_field_tag :return_to, @return_to %>
 
@@ -47,8 +48,11 @@
             <%= link_to t(".cancel"), @return_to || accounts_path,
                 class: "inline-flex items-center gap-1 px-3 py-2 text-sm font-medium rounded-lg text-primary button-bg-secondary hover:button-bg-secondary-hover",
                 data: { turbo_frame: "_top", action: "DS--dialog#close" } %>
-            <%= submit_tag t(".link_account"),
-                class: "inline-flex items-center gap-1 px-3 py-2 text-sm font-medium rounded-lg text-inverse bg-inverse hover:bg-inverse-hover disabled:button-bg-disabled" %>
+            <%= render DS::Button.new(
+              text: t(".link_account"),
+              variant: :primary,
+              type: :submit
+            ) %>
           </div>
         </form>
       </div>
diff --git a/app/views/messages/_chat_form.html.erb b/app/views/messages/_chat_form.html.erb
index a7aeec81b..1fbc57c82 100644
--- a/app/views/messages/_chat_form.html.erb
+++ b/app/views/messages/_chat_form.html.erb
@@ -10,7 +10,7 @@
     <%# In the future, this will be a dropdown with different AI models %>
     <%= f.hidden_field :ai_model, value: default_ai_model %>
 
-    <%= f.text_area :content, placeholder: "Ask anything ...", value: message_hint,
+    <%= f.text_area :content, placeholder: t(".placeholder"), value: message_hint,
                   class: "w-full border-0 focus:ring-0 text-sm resize-none px-1 bg-transparent",
                   data: { chat_target: "input", action: "input->chat#autoResize keydown->chat#handleInputKeyDown" },
                   rows: 1 %>
@@ -27,5 +27,5 @@
     </div>
   <% end %>
 
-  <p class="text-xs text-secondary">AI responses are informational only and are not financial advice.</p>
+  <p class="text-xs text-secondary"><%= t(".disclaimer") %></p>
 </div>
diff --git a/app/views/mfa/new.html.erb b/app/views/mfa/new.html.erb
index c8ad0892f..65d56380f 100644
--- a/app/views/mfa/new.html.erb
+++ b/app/views/mfa/new.html.erb
@@ -27,7 +27,7 @@
                  autocomplete="off"
                  value="<%= Current.user.otp_secret %>"
                  class="text-sm bg-container px-2 py-1 rounded border border-secondary w-96 font-mono">
-          <button data-action="clipboard#copy" class="text-secondary hover:text-gray-700">
+          <button data-action="clipboard#copy" class="text-secondary hover:text-primary">
             <span data-clipboard-target="iconDefault">
               <%= icon "copy" %>
             </span>
diff --git a/app/views/mfa/verify.html.erb b/app/views/mfa/verify.html.erb
index 3652c1832..8627d15e9 100644
--- a/app/views/mfa/verify.html.erb
+++ b/app/views/mfa/verify.html.erb
@@ -3,12 +3,35 @@
   header_description t(".description")
 %>
 
+<% if @user&.webauthn_enabled? %>
+  <div class="space-y-3 mt-4 md:mt-0" data-controller="webauthn-authentication"
+       data-webauthn-authentication-options-url-value="<%= webauthn_options_mfa_path %>"
+       data-webauthn-authentication-verify-url-value="<%= verify_webauthn_mfa_path %>"
+       data-webauthn-authentication-unsupported-message-value="<%= t(".webauthn_unsupported") %>"
+       data-webauthn-authentication-error-fallback-value="<%= t("mfa.verify_webauthn.invalid_credential") %>">
+    <%= render DS::Button.new(
+      text: t(".webauthn_button"),
+      variant: "secondary",
+      icon: "fingerprint",
+      full_width: true,
+      type: "button",
+      data: { action: "webauthn-authentication#authenticate" }
+    ) %>
+    <p class="text-sm text-destructive" role="alert" aria-live="assertive" aria-atomic="true" aria-hidden="true" hidden data-webauthn-authentication-target="error"></p>
+    <div class="flex items-center gap-3">
+      <div class="border-t border-primary flex-1"></div>
+      <span class="text-xs text-secondary"><%= t(".or") %></span>
+      <div class="border-t border-primary flex-1"></div>
+    </div>
+  </div>
+<% end %>
+
 <%= styled_form_with url: verify_mfa_path, method: :post, class: "space-y-4 mt-4 md:mt-0", data: { turbo: false } do |form| %>
   <%= form.text_field :code,
     required: true,
     autofocus: true,
     autocomplete: "one-time-code",
-    type: "number",
+    type: "text",
     label: t(".page_title") %>
 
   <%= form.submit t(".verify_button") %>
diff --git a/app/views/oidc_accounts/link.html.erb b/app/views/oidc_accounts/link.html.erb
index c4bf1aaf3..ba15010d5 100644
--- a/app/views/oidc_accounts/link.html.erb
+++ b/app/views/oidc_accounts/link.html.erb
@@ -3,12 +3,11 @@
 %>
 
 <% if @user_exists %>
-  <div class="mb-6 p-4 bg-yellow-50 border border-yellow-200 rounded-md">
-    <h3 class="text-sm font-medium text-yellow-800 mb-2"><%= t("oidc_accounts.link.verify_heading") %></h3>
-    <p class="text-sm text-yellow-700">
+  <div class="mb-6">
+    <%= render DS::Alert.new(title: t("oidc_accounts.link.verify_heading"), variant: :warning) do %>
       <% email_suffix = @pending_auth["email"].present? ? t("oidc_accounts.link.email_suffix_html", email: @pending_auth["email"]) : "" %>
-      <%= t("oidc_accounts.link.verify_description_html", provider: @pending_auth["provider"], email_suffix: email_suffix).html_safe %>
-    </p>
+      <p><%= t("oidc_accounts.link.verify_description_html", provider: @pending_auth["provider"], email_suffix: email_suffix).html_safe %></p>
+    <% end %>
   </div>
 
   <%= styled_form_with url: create_link_oidc_account_path, class: "space-y-4", data: { turbo: false } do |form| %>
@@ -26,18 +25,17 @@
                             placeholder: t("oidc_accounts.link.password_placeholder"),
                             autocomplete: "current-password" %>
 
-    <div class="text-sm text-gray-600 mt-2">
+    <div class="text-sm text-secondary mt-2">
       <p><%= t("oidc_accounts.link.verify_hint") %></p>
     </div>
 
     <%= form.submit t("oidc_accounts.link.submit_link") %>
   <% end %>
 <% else %>
-  <div class="mb-6 p-4 bg-blue-50 border border-blue-200 rounded-md">
-    <h3 class="text-sm font-medium text-blue-800 mb-2"><%= t("oidc_accounts.link.create_heading") %></h3>
-    <p class="text-sm text-blue-700">
-      <%= t("oidc_accounts.link.create_description_html", email: @pending_auth["email"], provider: @pending_auth["provider"]).html_safe %>
-    </p>
+  <div class="mb-6">
+    <%= render DS::Alert.new(title: t("oidc_accounts.link.create_heading"), variant: :info) do %>
+      <p><%= t("oidc_accounts.link.create_description_html", email: @pending_auth["email"], provider: @pending_auth["provider"]).html_safe %></p>
+    <% end %>
   </div>
 
   <div class="space-y-4">
diff --git a/app/views/oidc_accounts/new_user.html.erb b/app/views/oidc_accounts/new_user.html.erb
index 4656d4dba..6a7f365f6 100644
--- a/app/views/oidc_accounts/new_user.html.erb
+++ b/app/views/oidc_accounts/new_user.html.erb
@@ -2,11 +2,12 @@
   header_title t("oidc_accounts.new_user.title")
 %>
 
-<div class="mb-6 p-4 bg-blue-50 border border-blue-200 rounded-md">
-  <h3 class="text-sm font-medium text-blue-800 mb-2"><%= t("oidc_accounts.new_user.heading") %></h3>
-  <p class="text-sm text-blue-700">
-    <%= t("oidc_accounts.new_user.description", provider: @pending_auth["provider"]) %>
-  </p>
+<div class="mb-6">
+  <%= render DS::Alert.new(
+    title: t("oidc_accounts.new_user.heading"),
+    message: t("oidc_accounts.new_user.description", provider: @pending_auth["provider"]),
+    variant: :info
+  ) %>
 </div>
 
 <%= styled_form_with model: @user, url: create_user_oidc_account_path, class: "space-y-4", data: { turbo: false } do |form| %>
diff --git a/app/views/onboardings/goals.html.erb b/app/views/onboardings/goals.html.erb
index 646a892d1..8cb36cd99 100644
--- a/app/views/onboardings/goals.html.erb
+++ b/app/views/onboardings/goals.html.erb
@@ -46,6 +46,7 @@
       <div class="mt-6">
         <%= render DS::Button.new(
           text: t("onboardings.goals.submit"),
+          type: :submit,
           full_width: true
         ) %>
       </div>
diff --git a/app/views/pages/changelog.html.erb b/app/views/pages/changelog.html.erb
index d401f0d87..a31cba62e 100644
--- a/app/views/pages/changelog.html.erb
+++ b/app/views/pages/changelog.html.erb
@@ -5,7 +5,7 @@
     <div class="w-full md:w-1/3">
       <div class="md:px-3 flex items-center gap-3">
         <% if @release_notes[:avatar].present? %>
-          <div class="fg-inverse shrink-0 w-9 h-9">
+          <div class="text-inverse shrink-0 w-9 h-9">
             <%= image_tag @release_notes[:avatar], class: "rounded-full w-full h-full object-cover" %>
           </div>
         <% else %>
diff --git a/app/views/pages/dashboard/_balance_sheet.html.erb b/app/views/pages/dashboard/_balance_sheet.html.erb
index 0f8710581..1c104fa28 100644
--- a/app/views/pages/dashboard/_balance_sheet.html.erb
+++ b/app/views/pages/dashboard/_balance_sheet.html.erb
@@ -37,13 +37,13 @@
 
         <div class="bg-container-inset rounded-xl p-1 space-y-1 overflow-x-auto">
           <div class="px-4 py-2 flex items-center uppercase text-xs font-medium text-secondary">
-            <div class="w-40">Name</div>
-            <div class="ml-auto text-right flex items-center gap-6">
-              <div class="w-24">
-                <p>Weight</p>
+            <div class="w-40 shrink-0"><%= t(".name") %></div>
+            <div class="ml-auto text-right flex items-center gap-2">
+              <div class="w-20 shrink-0">
+                <p><%= t(".weight") %></p>
               </div>
-              <div class="w-40">
-                <p>Value</p>
+              <div class="w-24 shrink-0">
+                <p><%= t(".value") %></p>
               </div>
             </div>
           </div>
@@ -55,34 +55,34 @@
                 <%= idx == classification_group.account_groups.size - 1 ? "rounded-b-lg" : "" %>
               ">
                 <summary class="cursor-pointer p-4 group-open:bg-container rounded-lg flex items-center justify-between">
-                  <div class="w-40 shrink-0 flex items-center gap-4">
+                  <div class="w-40 shrink-0 flex items-center gap-1">
                     <%= icon("chevron-right", class: "group-open:rotate-90") %>
 
                     <p><%= account_group.name %></p>
                   </div>
 
-                  <div class="flex items-center justify-between text-right gap-6">
-                    <div class="w-28 shrink-0 flex items-center justify-end gap-2">
+                  <div class="flex items-center justify-between text-right gap-2">
+                    <div class="w-20 shrink-0 flex items-center justify-end gap-2">
                       <%= render "pages/dashboard/group_weight", weight: account_group.weight, color: account_group.color %>
                     </div>
 
-                    <div class="w-40 shrink-0">
-                      <p class="privacy-sensitive"><%= format_money(account_group.total_money) %></p>
+                    <div class="w-24 shrink-0">
+                      <p class="privacy-sensitive"><%= format_money(account_group.total_money, precision: 0) %></p>
                     </div>
                   </div>
                 </summary>
 
                 <div>
                   <% account_group.accounts.each_with_index do |account, idx| %>
-                    <div class="pl-12 pr-4 py-3 flex items-center justify-between text-sm font-medium">
-                      <div class="flex items-center gap-3">
+                    <div class="pl-7 pr-4 py-3 flex items-center justify-between text-sm font-medium">
+                      <div class="flex items-center gap-2">
                         <%= render "accounts/logo", account: account, size: "sm", color: account_group.color %>
 
                         <%= link_to account.name, account_path(account) %>
                       </div>
 
-                      <div class="ml-auto flex items-center text-right gap-6">
-                        <div class="w-28 shrink-0 flex items-center justify-end gap-2">
+                      <div class="ml-auto flex items-center text-right gap-2">
+                        <div class="w-14 shrink-0 flex items-center justify-end gap-2">
                           <%
                               # Calculate weight as percentage of classification total
                               classification_total = classification_group.total_money.amount
@@ -91,8 +91,8 @@
                           <%= render "pages/dashboard/group_weight", weight: account_weight, color: account_group.color %>
                         </div>
 
-                        <div class="w-40 shrink-0">
-                          <p class="privacy-sensitive"><%= format_money(account.balance_money) %></p>
+                        <div class="w-24 shrink-0">
+                          <p class="privacy-sensitive"><%= format_money(account.balance_money, precision: 0) %></p>
                         </div>
                       </div>
                     </div>
@@ -118,10 +118,10 @@
           ) %>
 
           <p class="text-primary text-sm font-medium mb-1 mt-4">
-            <%= t("pages.dashboard.balance_sheet.no_items", name: classification_group.name) %>
+            <%= t("pages.dashboard.balance_sheet.no_#{classification_group.classification}") %>
           </p>
           <p class="text-secondary text-sm text-center">
-            <%= t("pages.dashboard.balance_sheet.add_accounts", name: classification_group.name) %>
+            <%= t("pages.dashboard.balance_sheet.add_#{classification_group.classification}_accounts") %>
           </p>
         </div>
       <% end %>
diff --git a/app/views/pages/dashboard/_cashflow_sankey.html.erb b/app/views/pages/dashboard/_cashflow_sankey.html.erb
index 5ec8de5ee..201e0c8b9 100644
--- a/app/views/pages/dashboard/_cashflow_sankey.html.erb
+++ b/app/views/pages/dashboard/_cashflow_sankey.html.erb
@@ -11,21 +11,13 @@
   </div>
   <% if sankey_data[:links].present? %>
     <div class="w-full h-96">
-      <div
-        data-controller="sankey-chart"
-        data-sankey-chart-data-value="<%= sankey_data.to_json %>"
-        data-sankey-chart-currency-symbol-value="<%= sankey_data[:currency_symbol] %>"
-        class="w-full h-full privacy-sensitive"></div>
+      <%= render "pages/dashboard/cashflow_sankey_chart", sankey_data: sankey_data %>
     </div>
     <%= render DS::Dialog.new(id: "cashflow-expanded-dialog", auto_open: false, width: "custom", disable_frame: true, content_class: "!w-[96vw] max-w-[1650px]", data: { action: "close->cashflow-expand#restore" }) do |dialog| %>
       <% dialog.with_header(title: t("pages.dashboard.cashflow_sankey.title")) %>
       <% dialog.with_body do %>
         <div class="w-full h-[85dvh] max-h-[90dvh] overflow-y-auto overscroll-contain">
-          <div
-            data-controller="sankey-chart"
-            data-sankey-chart-data-value="<%= sankey_data.to_json %>"
-            data-sankey-chart-currency-symbol-value="<%= sankey_data[:currency_symbol] %>"
-            class="w-full h-full privacy-sensitive"></div>
+          <%= render "pages/dashboard/cashflow_sankey_chart", sankey_data: sankey_data %>
         </div>
       <% end %>
     <% end %>
diff --git a/app/views/pages/dashboard/_cashflow_sankey_chart.html.erb b/app/views/pages/dashboard/_cashflow_sankey_chart.html.erb
new file mode 100644
index 000000000..d22b305ce
--- /dev/null
+++ b/app/views/pages/dashboard/_cashflow_sankey_chart.html.erb
@@ -0,0 +1,22 @@
+<%# locals: (sankey_data:) %>
+<div
+  data-controller="sankey-chart"
+  data-sankey-chart-data-value="<%= sankey_data.to_json %>"
+  data-sankey-chart-currency-symbol-value="<%= sankey_data[:currency_symbol] %>"
+  class="w-full h-full privacy-sensitive flex flex-col gap-2">
+  <div class="flex justify-start">
+    <%= render DS::Button.new(
+      variant: :icon,
+      icon: "arrow-left",
+      type: "button",
+      title: t("pages.dashboard.cashflow_sankey.zoom_out"),
+      aria: { label: t("pages.dashboard.cashflow_sankey.zoom_out") },
+      hidden: true,
+      data: {
+        sankey_chart_target: "zoomOutButton",
+        action: "sankey-chart#zoomOut"
+      }
+    ) %>
+  </div>
+  <div data-sankey-chart-target="chart" class="min-h-0 flex-1"></div>
+</div>
diff --git a/app/views/pages/dashboard/_group_weight.html.erb b/app/views/pages/dashboard/_group_weight.html.erb
index d3bf08e5c..4cf5e827d 100644
--- a/app/views/pages/dashboard/_group_weight.html.erb
+++ b/app/views/pages/dashboard/_group_weight.html.erb
@@ -4,9 +4,9 @@
 
 <div class="w-full flex items-center justify-between gap-2">
   <div class="flex gap-[3px]">
-    <% 10.times do |i| %>
-      <div class="w-0.5 h-2.5 rounded-lg <%= i < (effective_weight / 10.0).ceil ? "" : "opacity-20" %>" style="background-color: <%= color %>;"></div>
+    <% 5.times do |i| %>
+      <div class="w-0.5 h-2.5 rounded-lg <%= i < (effective_weight / 20.0).ceil ? "" : "opacity-20" %>" style="background-color: <%= color %>;"></div>
     <% end %>
   </div>
-  <p class="text-sm privacy-sensitive"><%= number_to_percentage(effective_weight, precision: 2) %></p>
+  <p class="text-sm privacy-sensitive"><%= number_to_percentage(effective_weight, precision: 0) %></p>
 </div>
diff --git a/app/views/pages/dashboard/_investment_summary.html.erb b/app/views/pages/dashboard/_investment_summary.html.erb
index bfae9c502..8509bfe08 100644
--- a/app/views/pages/dashboard/_investment_summary.html.erb
+++ b/app/views/pages/dashboard/_investment_summary.html.erb
@@ -40,7 +40,7 @@
           </thead>
           <tbody class="font-medium text-sm">
             <% holdings.each_with_index do |holding, idx| %>
-              <tr class="<%= idx < holdings.size - 1 ? "border-b border-divider" : "" %>">
+              <tr class="<%= idx < holdings.size - 1 ? "table-divider" : "" %>">
                 <td class="p-4">
                   <div class="flex items-center gap-3">
                     <% if holding.security.logo_url.present? %>
diff --git a/app/views/pages/feedback.html.erb b/app/views/pages/feedback.html.erb
index 71739e2c8..29031ce01 100644
--- a/app/views/pages/feedback.html.erb
+++ b/app/views/pages/feedback.html.erb
@@ -1,22 +1,22 @@
-<%= content_for :page_title, "Feedback" %>
+<%= content_for :page_title, t(".title") %>
 
 <div class="bg-container shadow-border-xs rounded-xl p-4">
-  <h2 class="text-lg font-medium text-primary mb-1">Leave feedback</h2>
-  <p class="text-sm text-secondary mb-4">Let us know if you have any specific feedback. Feel free to include links to videos or screenshots.</p>
+  <h2 class="text-lg font-medium text-primary mb-1"><%= t(".heading") %></h2>
+  <p class="text-sm text-secondary mb-4"><%= t(".description") %></p>
   <div class="flex flex-col md:flex-row gap-4">
     <%= link_to "https://github.com/we-promise/sure/discussions/categories/feature-requests", target: "_blank", rel: "noopener noreferrer", class: "w-full md:w-1/3 flex flex-col items-center p-4 border border-alpha-black-25 rounded-xl hover:bg-container-hover" do %>
       <%= image_tag "github-icon.svg", class: "w-8 h-8 mb-2" %>
-      <span class="text-sm font-medium text-primary text-center">Write a feature request</span>
+      <span class="text-sm font-medium text-primary text-center"><%= t(".feature_request") %></span>
     <% end %>
 
     <%= link_to "https://github.com/we-promise/sure/issues/new?assignees=&labels=bug&template=bug_report.md&title=", target: "_blank", rel: "noopener noreferrer", class: "w-full md:w-1/3 flex flex-col items-center p-4 border border-alpha-black-25 rounded-xl hover:bg-container-hover" do %>
       <%= image_tag "github-icon.svg", class: "w-8 h-8 mb-2" %>
-      <span class="text-sm font-medium text-primary text-center">File a bug report</span>
+      <span class="text-sm font-medium text-primary text-center"><%= t(".bug_report") %></span>
     <% end %>
 
     <%= link_to "https://discord.gg/36ZGBsxYEK", target: "_blank", rel: "noopener noreferrer", class: "w-full md:w-1/3 flex flex-col items-center p-4 border border-alpha-black-25 rounded-xl hover:bg-container-hover" do %>
       <%= image_tag "discord-icon.svg", class: "w-8 h-8 mb-2" %>
-      <span class="text-sm font-medium text-primary text-center">Discuss <%= product_name %> with others</span>
+      <span class="text-sm font-medium text-primary text-center"><%= t(".discuss", product: product_name) %></span>
     <% end %>
   </div>
 </div>
diff --git a/app/views/pages/intro.html.erb b/app/views/pages/intro.html.erb
index 30effdcc8..7c014008e 100644
--- a/app/views/pages/intro.html.erb
+++ b/app/views/pages/intro.html.erb
@@ -1,6 +1,6 @@
 <% content_for :page_header do %>
   <div class="space-y-2">
-    <h1 class="text-2xl font-semibold text-primary">Welcome!</h1>
+    <h1 class="text-2xl font-semibold text-primary"><%= t(".welcome") %></h1>
     <br>
   </div>
 <% end %>
@@ -10,12 +10,16 @@
     <div class="flex justify-center">
       <%= image_tag "logomark-color.svg", class: "w-16 h-16" %>
     </div>
-    <h2 class="text-xl font-semibold text-primary">Intro experience coming soon</h2>
+    <h2 class="text-xl font-semibold text-primary"><%= t(".coming_soon") %></h2>
     <p class="text-secondary">
-      We're building a richer onboarding journey to learn about your goals, milestones, and day-to-day needs. For now, head over to the chat sidebar to start a conversation with Sure and let us know where you are in your financial journey.
+      <%= t(".description") %>
     </p>
     <div>
-      <%= link_to "Start chatting", chats_path, class: "inline-flex items-center gap-2 px-4 py-2 rounded-lg bg-primary text-white font-medium" %>
+      <%= render DS::Link.new(
+        text: t(".start_chatting"),
+        href: chats_path,
+        variant: :primary
+      ) %>
     </div>
   </div>
 </div>
diff --git a/app/views/pages/privacy.html.erb b/app/views/pages/privacy.html.erb
index 303f18766..01b472540 100644
--- a/app/views/pages/privacy.html.erb
+++ b/app/views/pages/privacy.html.erb
@@ -5,7 +5,7 @@
     <div class="bg-container border border-primary rounded-xl p-6 sm:p-8 shadow-sm">
       <div class="text-center">
         <h1 class="text-xl sm:text-2xl font-bold text-primary mb-4"><%= t(".heading") %></h1>
-        <p class="text-sm sm:text-base text-muted"><%= t(".placeholder") %></p>
+        <p class="text-sm sm:text-base text-subdued"><%= t(".placeholder") %></p>
       </div>
     </div>
   </div>
diff --git a/app/views/pages/redis_configuration_error.html.erb b/app/views/pages/redis_configuration_error.html.erb
index 53c43387f..8a1a6411f 100644
--- a/app/views/pages/redis_configuration_error.html.erb
+++ b/app/views/pages/redis_configuration_error.html.erb
@@ -1,4 +1,4 @@
-<% content_for :title, "Redis Configuration Required - Sure" %>
+<% content_for :title, t(".page_title") %>
 
 <div class="flex items-center justify-center h-full p-4 sm:p-6 lg:p-8">
   <div class="w-full max-w-md sm:max-w-lg lg:max-w-2xl">
@@ -8,8 +8,8 @@
         <div class="mx-auto w-16 h-16 bg-red-100 rounded-full flex items-center justify-center mb-4">
           <%= icon "alert-triangle", class: "w-8 h-8 text-red-600" %>
         </div>
-        <h1 class="text-xl sm:text-2xl font-bold text-primary mb-2">Redis Configuration Required</h1>
-        <p class="text-sm sm:text-base text-muted">Your self-hosted Sure installation needs Redis to be properly configured.</p>
+        <h1 class="text-xl sm:text-2xl font-bold text-primary mb-2"><%= t(".heading") %></h1>
+        <p class="text-sm sm:text-base text-subdued"><%= t(".subheading") %></p>
       </div>
 
       <!-- Explanation -->
@@ -18,8 +18,8 @@
           <div class="flex items-start">
             <%= icon "info", class: "w-5 h-5 text-amber-600 mt-0.5 mr-3 flex-shrink-0" %>
             <div class="text-sm text-amber-800">
-              <p><strong>Why is Redis required?</strong></p>
-              <p class="mt-1">Sure uses Redis to power Sidekiq background jobs for tasks like syncing account data, processing imports, and other background operations that keep your financial data up to date.</p>
+              <p><strong><%= t(".why_required_title") %></strong></p>
+              <p class="mt-1"><%= t(".why_required_body") %></p>
             </div>
           </div>
         </div>
@@ -27,7 +27,7 @@
         <!-- Primary CTA -->
         <div class="text-center space-y-4">
           <%= render DS::Link.new(
-            text: "View Setup Guide",
+            text: t(".view_setup_guide"),
             href: "https://github.com/we-promise/sure/blob/main/docs/hosting/docker.md",
             variant: "primary",
             size: "lg",
@@ -36,16 +36,16 @@
             target: "_blank",
             rel: "noopener noreferrer"
           ) %>
-          <p class="text-sm text-muted">Follow our complete Docker setup guide to configure Redis</p>
+          <p class="text-sm text-subdued"><%= t(".setup_guide_hint") %></p>
         </div>
       </div>
 
       <!-- Secondary CTA -->
       <div class="pt-6 border-t border-primary">
         <div class="text-center space-y-3">
-          <p class="text-sm text-muted">Once you've configured Redis, refresh this page to continue.</p>
+          <p class="text-sm text-subdued"><%= t(".refresh_hint") %></p>
           <%= render DS::Button.new(
-            text: "Refresh Page",
+            text: t(".refresh_page"),
             variant: "secondary",
             icon: "refresh-cw",
             type: "button",
diff --git a/app/views/pages/terms.html.erb b/app/views/pages/terms.html.erb
index 303f18766..01b472540 100644
--- a/app/views/pages/terms.html.erb
+++ b/app/views/pages/terms.html.erb
@@ -5,7 +5,7 @@
     <div class="bg-container border border-primary rounded-xl p-6 sm:p-8 shadow-sm">
       <div class="text-center">
         <h1 class="text-xl sm:text-2xl font-bold text-primary mb-4"><%= t(".heading") %></h1>
-        <p class="text-sm sm:text-base text-muted"><%= t(".placeholder") %></p>
+        <p class="text-sm sm:text-base text-subdued"><%= t(".placeholder") %></p>
       </div>
     </div>
   </div>
diff --git a/app/views/password_resets/new.html.erb b/app/views/password_resets/new.html.erb
index 426a8451d..1f33f1154 100644
--- a/app/views/password_resets/new.html.erb
+++ b/app/views/password_resets/new.html.erb
@@ -16,6 +16,6 @@
     href: new_session_path,
     variant: :secondary,
     full_width: true,
-    class: "bg-white hover:bg-gray-100"
+    class: "bg-container hover:bg-surface-inset"
   ) %>
 </div>
diff --git a/app/views/pending_duplicate_merges/new.html.erb b/app/views/pending_duplicate_merges/new.html.erb
index 580603f62..4a21bd2a4 100644
--- a/app/views/pending_duplicate_merges/new.html.erb
+++ b/app/views/pending_duplicate_merges/new.html.erb
@@ -52,7 +52,7 @@
                     <div class="flex-1 text-sm">
                       <div class="font-medium text-primary"><%= entry.name %></div>
                       <div class="text-xs text-secondary">
-                        <%= I18n.l(entry.date, format: :short) %> •
+                        <%= entry.date ? I18n.l(entry.date, format: :short) : "—" %> •
                         <%= number_to_currency(entry.amount.abs, unit: Money::Currency.new(entry.currency).symbol) %>
                       </div>
                     </div>
diff --git a/app/views/plaid_items/_plaid_item.html.erb b/app/views/plaid_items/_plaid_item.html.erb
index e7fd2254f..36408d89e 100644
--- a/app/views/plaid_items/_plaid_item.html.erb
+++ b/app/views/plaid_items/_plaid_item.html.erb
@@ -1,82 +1,84 @@
 <%# locals: (plaid_item:) %>
 
 <%= tag.div id: dom_id(plaid_item) do %>
-  <details open class="group bg-container p-4 shadow-border-xs rounded-xl">
-    <summary class="flex items-center justify-between gap-2">
-      <div class="flex items-center gap-2">
-        <%= icon "chevron-right", class: "group-open:transform group-open:rotate-90" %>
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center justify-between gap-2">
+        <div class="flex items-center gap-2">
+          <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
 
-        <div class="flex items-center justify-center h-8 w-8 bg-blue-600/10 rounded-full">
-          <% if plaid_item.logo.attached? %>
-            <%= image_tag plaid_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
-          <% else %>
-            <div class="flex items-center justify-center">
-              <%= tag.p plaid_item.name.first.upcase, class: "text-blue-600 text-xs font-medium" %>
-            </div>
-          <% end %>
-        </div>
-
-        <div class="pl-1 text-sm">
-          <div class="flex items-center gap-2">
-            <%= tag.p plaid_item.name, class: "font-medium text-primary" %>
-            <% if plaid_item.scheduled_for_deletion? %>
-              <p class="text-destructive text-sm animate-pulse">(deletion in progress...)</p>
+          <div class="flex items-center justify-center h-8 w-8 bg-blue-600/10 rounded-full">
+            <% if plaid_item.logo.attached? %>
+              <%= image_tag plaid_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
+            <% else %>
+              <div class="flex items-center justify-center">
+                <%= tag.p plaid_item.name.first.upcase, class: "text-blue-600 text-xs font-medium" %>
+              </div>
             <% end %>
           </div>
-          <% if plaid_item.syncing? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= icon "loader", size: "sm", class: "animate-pulse" %>
-              <%= tag.span t(".syncing") %>
+
+          <div class="pl-1 text-sm">
+            <div class="flex items-center gap-2">
+              <%= tag.p plaid_item.name, class: "font-medium text-primary" %>
+              <% if plaid_item.scheduled_for_deletion? %>
+                <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+              <% end %>
             </div>
-          <% elsif plaid_item.requires_update? %>
-            <div class="text-warning flex items-center gap-1">
-              <%= icon "alert-triangle", size: "sm", color: "warning" %>
-              <%= tag.span t(".requires_update") %>
-            </div>
-          <% elsif plaid_item.sync_error.present? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= icon "alert-circle", size: "sm", color: "destructive" %>
-              <%= tag.span t(".error"), class: "text-destructive" %>
-            </div>
-          <% else %>
-            <p class="text-secondary">
-              <%= plaid_item.last_synced_at ? t(".status", timestamp: time_ago_in_words(plaid_item.last_synced_at)) : t(".status_never") %>
-            </p>
-          <% end %>
+            <% if plaid_item.syncing? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "loader", size: "sm", class: "animate-pulse" %>
+                <%= tag.span t(".syncing") %>
+              </div>
+            <% elsif plaid_item.requires_update? %>
+              <div class="text-warning flex items-center gap-1">
+                <%= icon "alert-triangle", size: "sm", color: "warning" %>
+                <%= tag.span t(".requires_update") %>
+              </div>
+            <% elsif plaid_item.sync_error.present? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "alert-circle", size: "sm", color: "destructive" %>
+                <%= tag.span t(".error"), class: "text-destructive" %>
+              </div>
+            <% else %>
+              <p class="text-secondary">
+                <%= plaid_item.last_synced_at ? t(".status", timestamp: time_ago_in_words(plaid_item.last_synced_at)) : t(".status_never") %>
+              </p>
+            <% end %>
+          </div>
         </div>
+
+        <% if Current.user&.admin? %>
+          <div class="flex items-center gap-2">
+            <% if plaid_item.requires_update? %>
+              <%= render DS::Link.new(
+                text: t(".update"),
+                icon: "refresh-cw",
+                variant: "secondary",
+                href: edit_plaid_item_path(plaid_item),
+                frame: "modal"
+              ) %>
+            <% elsif Rails.env.development? %>
+              <%= icon(
+                "refresh-cw",
+                as_button: true,
+                href: sync_plaid_item_path(plaid_item)
+              ) %>
+            <% end %>
+
+            <%= render DS::Menu.new do |menu| %>
+              <% menu.with_item(
+                variant: "button",
+                text: t(".delete"),
+                icon: "trash-2",
+                href: plaid_item_path(plaid_item),
+                method: :delete,
+                confirm: CustomConfirm.for_resource_deletion(plaid_item.name, high_severity: true)
+              ) %>
+            <% end %>
+          </div>
+        <% end %>
       </div>
-
-      <% if Current.user&.admin? %>
-        <div class="flex items-center gap-2">
-          <% if plaid_item.requires_update? %>
-            <%= render DS::Link.new(
-              text: t(".update"),
-              icon: "refresh-cw",
-              variant: "secondary",
-              href: edit_plaid_item_path(plaid_item),
-              frame: "modal"
-            ) %>
-          <% elsif Rails.env.development? %>
-            <%= icon(
-              "refresh-cw",
-              as_button: true,
-              href: sync_plaid_item_path(plaid_item)
-            ) %>
-          <% end %>
-
-          <%= render DS::Menu.new do |menu| %>
-            <% menu.with_item(
-              variant: "button",
-              text: t(".delete"),
-              icon: "trash-2",
-              href: plaid_item_path(plaid_item),
-              method: :delete,
-              confirm: CustomConfirm.for_resource_deletion(plaid_item.name, high_severity: true)
-            ) %>
-          <% end %>
-        </div>
-      <% end %>
-    </summary>
+    <% end %>
 
     <% unless plaid_item.scheduled_for_deletion? %>
       <div class="space-y-4 mt-4">
@@ -103,5 +105,5 @@
         <% end %>
       </div>
     <% end %>
-  </details>
+  <% end %>
 <% end %>
diff --git a/app/views/plaid_items/select_existing_account.html.erb b/app/views/plaid_items/select_existing_account.html.erb
index 8b0cde2bc..088d5bf11 100644
--- a/app/views/plaid_items/select_existing_account.html.erb
+++ b/app/views/plaid_items/select_existing_account.html.erb
@@ -35,8 +35,11 @@
             <%= link_to t(".cancel"), accounts_path,
                 class: "inline-flex items-center gap-1 px-3 py-2 text-sm font-medium rounded-lg text-primary button-bg-secondary hover:button-bg-secondary-hover",
                 data: { turbo_frame: "_top", action: "DS--dialog#close" } %>
-            <%= submit_tag t(".link_account"),
-                class: "inline-flex items-center gap-1 px-3 py-2 text-sm font-medium rounded-lg text-inverse bg-inverse hover:bg-inverse-hover disabled:button-bg-disabled" %>
+            <%= render DS::Button.new(
+              text: t(".link_account"),
+              variant: :primary,
+              type: :submit
+            ) %>
           </div>
         </form>
       </div>
diff --git a/app/views/properties/_overview_fields.html.erb b/app/views/properties/_overview_fields.html.erb
index 0fe59023d..d641c7bdf 100644
--- a/app/views/properties/_overview_fields.html.erb
+++ b/app/views/properties/_overview_fields.html.erb
@@ -2,8 +2,8 @@
 
 <div class="flex flex-col gap-2">
   <%= form.text_field :name,
-                  label: "Name",
-                  placeholder: "Vacation home",
+                  label: t(".name_label"),
+                  placeholder: t(".name_placeholder"),
                   required: true %>
 
   <%= form.hidden_field :accountable_type, value: "Property" %>
@@ -11,24 +11,24 @@
   <%= form.fields_for :accountable do |property_form| %>
     <%= property_form.select :subtype,
                 Property::SUBTYPES.map { |k, v| [v[:long], k] },
-                { prompt: "Select type", label: "Property type" }, required: true %>
+                { prompt: t(".subtype_prompt"), label: t(".property_type_label") }, required: true %>
 
     <div class="flex items-center gap-2">
       <%= property_form.number_field :year_built,
-                    label: "Year Built (optional)",
-                    placeholder: "1990",
+                    label: t(".year_built_label"),
+                    placeholder: t(".year_built_placeholder"),
                     min: 1500,
                     max: Time.current.year %>
     </div>
 
     <div class="flex items-center gap-2">
       <%= property_form.number_field :area_value,
-                      label: "Area (optional)",
-                      placeholder: "1200",
+                      label: t(".area_label"),
+                      placeholder: t(".area_placeholder"),
                       min: 0 %>
       <%= property_form.select :area_unit,
-                      [["Square Feet", "sqft"], ["Square Meters", "sqm"]],
-                      { label: "Area Unit" } %>
+                      [[t(".square_feet"), "sqft"], [t(".square_meters"), "sqm"]],
+                      { label: t(".area_unit_label") } %>
     </div>
   <% end %>
 
diff --git a/app/views/properties/address.html.erb b/app/views/properties/address.html.erb
index 834f7c95c..a8b873c7c 100644
--- a/app/views/properties/address.html.erb
+++ b/app/views/properties/address.html.erb
@@ -1,5 +1,5 @@
 <%= render DS::Dialog.new do |dialog| %>
-  <% dialog.with_header(title: "Enter property manually") %>
+  <% dialog.with_header(title: t(".title")) %>
   <% dialog.with_body do %>
     <div class="flex gap-4">
       <!-- Left sidebar with tabs -->
@@ -13,25 +13,25 @@
 
             <%= form.fields_for :address do |address_form| %>
               <%= address_form.text_field :line1,
-                    label: "Address Line 1",
-                    placeholder: "123 Main Street" %>
+                    label: t(".address_line1_label"),
+                    placeholder: t(".address_line1_placeholder") %>
 
               <div class="flex items-center gap-2">
                 <%= address_form.text_field :locality,
-                      label: "City",
-                      placeholder: "San Francisco" %>
+                      label: t(".city_label"),
+                      placeholder: t(".city_placeholder") %>
                 <%= address_form.text_field :region,
-                      label: "State/Region",
-                      placeholder: "CA" %>
+                      label: t(".state_region_label"),
+                      placeholder: t(".state_region_placeholder") %>
               </div>
 
               <div class="flex items-center gap-2">
                 <%= address_form.text_field :postal_code,
-                      label: "Postal Code",
-                      placeholder: "12345" %>
+                      label: t(".postal_code_label"),
+                      placeholder: t(".postal_code_placeholder") %>
                 <%= address_form.text_field :country,
-                      label: "Country",
-                      placeholder: "USA" %>
+                      label: t(".country_label"),
+                      placeholder: t(".country_placeholder") %>
               </div>
             <% end %>
           </div>
@@ -39,8 +39,9 @@
           <!-- Save button -->
           <div class="flex justify-end mt-4">
             <%= render DS::Button.new(
-              text: "Save",
+              text: t(".save"),
               variant: "primary",
+              type: :submit,
             ) %>
           </div>
         <% end %>
diff --git a/app/views/properties/balances.html.erb b/app/views/properties/balances.html.erb
index a25f77936..9477213f7 100644
--- a/app/views/properties/balances.html.erb
+++ b/app/views/properties/balances.html.erb
@@ -1,5 +1,5 @@
 <%= render DS::Dialog.new do |dialog| %>
-  <% dialog.with_header(title: "Enter property manually") %>
+  <% dialog.with_header(title: t(".title")) %>
   <% dialog.with_body do %>
     <div class="flex gap-4">
       <%= render "properties/form_tabs", account: @account, active_tab: "value" %>
@@ -11,16 +11,17 @@
             <%= render "properties/form_alert", notice: @success_message, error: @error_message %>
 
             <%= form.money_field :balance,
-                label: "Estimated market value",
-                label_tooltip: "The estimated market value of your property. This number can often be found on sites like Zillow or Redfin, and is never an exact number.",
+                label: t(".market_value_label"),
+                label_tooltip: t(".market_value_tooltip"),
                 placeholder: "0" %>
           </div>
 
           <!-- Next button -->
           <div class="flex justify-end mt-4">
             <%= render DS::Button.new(
-              text: @account.active? ? "Save" : "Next",
+              text: @account.active? ? t(".save") : t(".next"),
               variant: "primary",
+              type: :submit,
             ) %>
           </div>
         <% end %>
diff --git a/app/views/properties/edit.html.erb b/app/views/properties/edit.html.erb
index 51d674f96..428e60059 100644
--- a/app/views/properties/edit.html.erb
+++ b/app/views/properties/edit.html.erb
@@ -18,6 +18,7 @@
             <%= render DS::Button.new(
               text: @account.active? ? "Save" : "Next",
               variant: "primary",
+              type: :submit,
             ) %>
           </div>
         <% end %>
diff --git a/app/views/properties/new.html.erb b/app/views/properties/new.html.erb
index 03feb04a0..5e790cce0 100644
--- a/app/views/properties/new.html.erb
+++ b/app/views/properties/new.html.erb
@@ -1,5 +1,5 @@
 <%= render DS::Dialog.new do |dialog| %>
-  <% dialog.with_header(title: "Enter property manually") %>
+  <% dialog.with_header(title: t(".title")) %>
   <% dialog.with_body do %>
     <div class="flex gap-4">
       <!-- Left sidebar with tabs -->
@@ -16,8 +16,9 @@
           <!-- Create button -->
           <div class="flex justify-end mt-4">
             <%= render DS::Button.new(
-              text: "Next",
+              text: t(".next"),
               variant: "primary",
+              type: :submit,
             ) %>
           </div>
         <% end %>
diff --git a/app/views/properties/tabs/_overview.html.erb b/app/views/properties/tabs/_overview.html.erb
index 3a33e092f..df3417443 100644
--- a/app/views/properties/tabs/_overview.html.erb
+++ b/app/views/properties/tabs/_overview.html.erb
@@ -30,7 +30,7 @@
 
 <div class="flex justify-center py-8">
   <%= render DS::Link.new(
-    text: "Edit account details",
+    text: t(".edit_account_details"),
     href: edit_property_path(account),
     variant: "ghost",
     frame: :modal
diff --git a/app/views/recurring_transactions/_projected_transaction.html.erb b/app/views/recurring_transactions/_projected_transaction.html.erb
index 3659e3fe2..bc8778469 100644
--- a/app/views/recurring_transactions/_projected_transaction.html.erb
+++ b/app/views/recurring_transactions/_projected_transaction.html.erb
@@ -56,6 +56,10 @@
 
   <div class="col-span-2 ml-auto text-right shrink-0">
     <% display_amount = recurring_transaction.manual? && recurring_transaction.expected_amount_avg.present? ? recurring_transaction.expected_amount_avg : recurring_transaction.amount %>
-    <%= content_tag :p, format_money(-Money.new(display_amount, recurring_transaction.currency)), class: ["font-medium", "privacy-sensitive", display_amount.negative? ? "text-success" : "text-subdued"] %>
+    <% if recurring_transaction.transfer? %>
+      <%= content_tag :p, format_money(Money.new(display_amount.abs, recurring_transaction.currency)), class: [ "font-medium", "privacy-sensitive", "text-secondary" ] %>
+    <% else %>
+      <%= content_tag :p, format_money(-Money.new(display_amount, recurring_transaction.currency)), class: ["font-medium", "privacy-sensitive", display_amount.negative? ? "text-success" : "text-subdued"] %>
+    <% end %>
   </div>
 </div>
diff --git a/app/views/recurring_transactions/index.html.erb b/app/views/recurring_transactions/index.html.erb
index 7447cb317..96b29d4a1 100644
--- a/app/views/recurring_transactions/index.html.erb
+++ b/app/views/recurring_transactions/index.html.erb
@@ -128,16 +128,22 @@
                     <% end %>
                   </div>
                 </td>
-                <td class="py-3 px-2 text-sm font-medium privacy-sensitive <%= recurring_transaction.amount.negative? ? "text-success" : "text-primary" %>">
-                  <% if recurring_transaction.manual? && recurring_transaction.has_amount_variance? %>
-                    <div class="inline-flex items-center gap-1 cursor-help group" title="<%= t("recurring_transactions.amount_range", min: format_money(-recurring_transaction.expected_amount_min_money), max: format_money(-recurring_transaction.expected_amount_max_money)) %>">
-                      <span class="text-xs text-secondary group-hover:text-primary transition-colors">~</span>
-                      <span class="border-b border-dashed border-subdued group-hover:border-primary transition-colors privacy-sensitive"><%= format_money(-recurring_transaction.expected_amount_avg_money) %></span>
-                    </div>
-                  <% else %>
-                    <%= format_money(-recurring_transaction.amount_money) %>
-                  <% end %>
-                </td>
+                <% if recurring_transaction.transfer? %>
+                  <td class="py-3 px-2 text-sm font-medium privacy-sensitive text-secondary">
+                    <%= format_money(recurring_transaction.amount_money.abs) %>
+                  </td>
+                <% else %>
+                  <td class="py-3 px-2 text-sm font-medium privacy-sensitive <%= recurring_transaction.amount.negative? ? "text-success" : "text-primary" %>">
+                    <% if recurring_transaction.manual? && recurring_transaction.has_amount_variance? %>
+                      <div class="inline-flex items-center gap-1 cursor-help group" title="<%= t("recurring_transactions.amount_range", min: format_money(-recurring_transaction.expected_amount_min_money), max: format_money(-recurring_transaction.expected_amount_max_money)) %>">
+                        <span class="text-xs text-secondary group-hover:text-primary transition-colors">~</span>
+                        <span class="border-b border-dashed border-subdued group-hover:border-primary transition-colors privacy-sensitive"><%= format_money(-recurring_transaction.expected_amount_avg_money) %></span>
+                      </div>
+                    <% else %>
+                      <%= format_money(-recurring_transaction.amount_money) %>
+                    <% end %>
+                  </td>
+                <% end %>
                 <td class="py-3 px-2 text-sm text-secondary">
                   <%= t("recurring_transactions.day_of_month", day: recurring_transaction.expected_day_of_month) %>
                 </td>
diff --git a/app/views/registrations/new.html.erb b/app/views/registrations/new.html.erb
index 08aa1c720..7d9a7b25e 100644
--- a/app/views/registrations/new.html.erb
+++ b/app/views/registrations/new.html.erb
@@ -53,7 +53,7 @@
             action: "input->password-validator#validate"
           } %>
       <button type="button"
-              class="absolute right-3 top-1/2 -translate-y-1/2 text-gray-500 hover:text-gray-700 focus:outline-none"
+              class="absolute right-3 top-1/2 -translate-y-1/2 text-secondary hover:text-primary focus:outline-none"
               data-action="click->password-visibility#toggle">
         <div data-password-visibility-target="showIcon">
           <%= icon("eye") %>
@@ -65,10 +65,10 @@
     </div>
 
     <div class="flex gap-4 my-4">
-      <div class="h-1 bg-gray-200 rounded-full flex-grow" data-password-validator-target="blockLine" data-requirement-type="length"></div>
-      <div class="h-1 bg-gray-200 rounded-full flex-grow" data-password-validator-target="blockLine" data-requirement-type="case"></div>
-      <div class="h-1 bg-gray-200 rounded-full flex-grow" data-password-validator-target="blockLine" data-requirement-type="number"></div>
-      <div class="h-1 bg-gray-200 rounded-full flex-grow" data-password-validator-target="blockLine" data-requirement-type="special"></div>
+      <div class="h-1 bg-surface-inset rounded-full flex-grow" data-password-validator-target="blockLine" data-requirement-type="length"></div>
+      <div class="h-1 bg-surface-inset rounded-full flex-grow" data-password-validator-target="blockLine" data-requirement-type="case"></div>
+      <div class="h-1 bg-surface-inset rounded-full flex-grow" data-password-validator-target="blockLine" data-requirement-type="number"></div>
+      <div class="h-1 bg-surface-inset rounded-full flex-grow" data-password-validator-target="blockLine" data-requirement-type="special"></div>
     </div>
 
     <div class="space-y-1 my-4">
diff --git a/app/views/reports/_category_row.html.erb b/app/views/reports/_category_row.html.erb
index dbc15afca..9ef572e7d 100644
--- a/app/views/reports/_category_row.html.erb
+++ b/app/views/reports/_category_row.html.erb
@@ -4,7 +4,7 @@
   show_border = local_assigns.fetch(:show_border, false)
 %>
 
-<tr data-category="category-<%= item[:category_id] %>" class="text-secondary text-sm <%= show_border ? "border-b border-divider" : "" %>">
+<tr data-category="category-<%= item[:category_id] %>" class="text-secondary text-sm <%= show_border ? "table-divider" : "" %>">
   <td colspan="2" class="py-3 px-4 lg:px-6 <%= is_sub ? "pl-7 lg:pl-9" : "" %>">
     <div class="flex items-center gap-2">
       <% if is_sub %>
diff --git a/app/views/reports/_investment_flows.html.erb b/app/views/reports/_investment_flows.html.erb
index 83db092e2..ee773b994 100644
--- a/app/views/reports/_investment_flows.html.erb
+++ b/app/views/reports/_investment_flows.html.erb
@@ -1,7 +1,7 @@
 <%# locals: (investment_flows:) %>
 <div class="space-y-4">
   <p class="text-sm text-secondary">
-    Track money flowing into and out of your investment accounts through contributions and withdrawals.
+    <%= t(".description") %>
   </p>
 
   <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
@@ -9,36 +9,36 @@
     <div class="bg-container border border-primary rounded-lg p-4">
       <div class="flex items-center gap-2 mb-2">
         <%= icon("trending-up", size: "sm", class: "text-green-600") %>
-        <h3 class="text-sm font-medium text-secondary">Contributions</h3>
+        <h3 class="text-sm font-medium text-secondary"><%= t(".contributions") %></h3>
       </div>
       <div class="text-2xl font-semibold privacy-sensitive" style="color: rgb(34 197 94);">
         <%= format_money(investment_flows.contributions) %>
       </div>
-      <p class="text-xs text-secondary mt-1">Money added to investments</p>
+      <p class="text-xs text-secondary mt-1"><%= t(".contributions_description") %></p>
     </div>
 
     <!-- Withdrawals -->
     <div class="bg-container border border-primary rounded-lg p-4">
       <div class="flex items-center gap-2 mb-2">
         <%= icon("trending-down", size: "sm", class: "text-orange-600") %>
-        <h3 class="text-sm font-medium text-secondary">Withdrawals</h3>
+        <h3 class="text-sm font-medium text-secondary"><%= t(".withdrawals") %></h3>
       </div>
       <div class="text-2xl font-semibold privacy-sensitive" style="color: rgb(249 115 22);">
         <%= format_money(investment_flows.withdrawals) %>
       </div>
-      <p class="text-xs text-secondary mt-1">Money withdrawn from investments</p>
+      <p class="text-xs text-secondary mt-1"><%= t(".withdrawals_description") %></p>
     </div>
 
     <!-- Net Flow -->
     <div class="bg-container border border-primary rounded-lg p-4">
       <div class="flex items-center gap-2 mb-2">
         <%= icon("arrow-right-left", size: "sm", class: "text-primary") %>
-        <h3 class="text-sm font-medium text-secondary">Net Flow</h3>
+        <h3 class="text-sm font-medium text-secondary"><%= t(".net_flow") %></h3>
       </div>
       <div class="text-2xl font-semibold text-primary privacy-sensitive">
         <%= format_money(investment_flows.net_flow) %>
       </div>
-      <p class="text-xs text-secondary mt-1">Total net change</p>
+      <p class="text-xs text-secondary mt-1"><%= t(".net_flow_description") %></p>
     </div>
   </div>
 </div>
diff --git a/app/views/reports/_investment_performance.html.erb b/app/views/reports/_investment_performance.html.erb
index 7434ab923..23a922ebc 100644
--- a/app/views/reports/_investment_performance.html.erb
+++ b/app/views/reports/_investment_performance.html.erb
@@ -72,13 +72,11 @@
             </thead>
             <tbody class="text-secondary text-sm">
               <% investment_metrics[:top_holdings].each_with_index do |holding, idx| %>
-                <tr class="<%= idx < investment_metrics[:top_holdings].size - 1 ? "border-b border-divider" : "" %>">
+                <tr class="<%= idx < investment_metrics[:top_holdings].size - 1 ? "table-divider" : "" %>">
                   <td class="py-3 px-4 lg:px-6">
                     <div class="flex items-center gap-3">
-                      <% if holding.security.brandfetch_icon_url.present? %>
-                        <img src="<%= holding.security.brandfetch_icon_url %>" alt="<%= holding.ticker %>" class="w-6 h-6 rounded-full">
-                      <% elsif holding.security.logo_url.present? %>
-                        <img src="<%= Setting.transform_brand_fetch_url(holding.security.logo_url) %>" alt="<%= holding.ticker %>" class="w-6 h-6 rounded-full">
+                      <% if (logo = holding.security.display_logo_url).present? %>
+                        <img src="<%= Setting.transform_brand_fetch_url(logo) %>" alt="<%= holding.ticker %>" class="w-6 h-6 rounded-full">
                       <% else %>
                         <div class="w-8 h-8 rounded-full bg-container-inset flex items-center justify-center text-xs font-medium text-secondary">
                           <%= holding.ticker[0..1] %>
@@ -120,9 +118,13 @@
           <% investment_metrics[:gains_by_tax_treatment].each do |treatment, data| %>
             <div class="bg-container-inset rounded-lg p-4 space-y-3 flex-1 min-w-64">
               <div class="flex items-center justify-between">
-                <span class="inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium <%= tax_treatment_badge_classes(treatment) %>" title="<%= t("accounts.tax_treatment_descriptions.#{treatment}") %>">
-                  <%= t("accounts.tax_treatments.#{treatment}") %>
-                </span>
+                <%= render DS::Pill.new(
+                  label: t("accounts.tax_treatments.#{treatment}"),
+                  tone: tax_treatment_pill_tone(treatment),
+                  marker: false,
+                  show_dot: false,
+                  title: t("accounts.tax_treatment_descriptions.#{treatment}")
+                ) %>
                 <span class="text-sm font-semibold text-primary privacy-sensitive">
                   <%= format_money(data[:total_gain]) %>
                 </span>
diff --git a/app/views/reports/_net_worth.html.erb b/app/views/reports/_net_worth.html.erb
index 153090bf8..492d636b6 100644
--- a/app/views/reports/_net_worth.html.erb
+++ b/app/views/reports/_net_worth.html.erb
@@ -50,7 +50,7 @@
         </thead>
         <tbody>
           <% net_worth_metrics[:asset_groups].each_with_index do |group, idx| %>
-            <tr class="<%= idx < net_worth_metrics[:asset_groups].size - 1 ? "border-b border-divider" : "" %>">
+            <tr class="<%= idx < net_worth_metrics[:asset_groups].size - 1 ? "table-divider" : "" %>">
               <td class="py-3 px-4 lg:px-6 text-sm font-medium text-secondary"><%= group[:name] %></td>
               <td class="py-3 px-4 lg:px-6 text-sm font-medium text-right text-success privacy-sensitive"><%= group[:total].format %></td>
             </tr>
@@ -77,7 +77,7 @@
         </thead>
         <tbody>
           <% net_worth_metrics[:liability_groups].each_with_index do |group, idx| %>
-            <tr class="<%= idx < net_worth_metrics[:liability_groups].size - 1 ? "border-b border-divider" : "" %>">
+            <tr class="<%= idx < net_worth_metrics[:liability_groups].size - 1 ? "table-divider" : "" %>">
               <td class="py-3 px-4 lg:px-6 text-sm font-medium text-secondary"><%= group[:name] %></td>
               <td class="py-3 px-4 lg:px-6 text-sm font-medium text-right text-destructive privacy-sensitive"><%= group[:total].format %></td>
             </tr>
diff --git a/app/views/reports/_period_picker.html.erb b/app/views/reports/_period_picker.html.erb
new file mode 100644
index 000000000..764c95616
--- /dev/null
+++ b/app/views/reports/_period_picker.html.erb
@@ -0,0 +1,150 @@
+<%# locals: (period_type:, start_date:) %>
+
+<%= turbo_frame_tag "reports_picker" do %>
+  <div class="p-3 space-y-2">
+    <% case period_type %>
+    <% when :monthly %>
+      <div class="flex items-center gap-2 justify-between mb-2">
+        <%= render DS::Link.new(
+          variant: "icon",
+          icon: "chevron-left",
+          href: picker_reports_path(period_type: :monthly, start_date: start_date.beginning_of_year - 1.year),
+          aria: { label: t("reports.index.previous_year") },
+          frame: "reports_picker"
+        ) %>
+
+        <span class="w-40 text-center px-3 py-2">
+          <%= start_date.year %>
+        </span>
+
+        <% next_year_start = Date.new(start_date.year + 1, 1, 1) %>
+        <% if next_year_start <= Date.current %>
+          <%= render DS::Link.new(
+            variant: "icon",
+            icon: "chevron-right",
+            href: picker_reports_path(period_type: :monthly, start_date: next_year_start),
+            aria: { label: t("reports.index.next_year") },
+            frame: "reports_picker"
+          ) %>
+        <% else %>
+          <span class="text-subdued inline-flex items-center justify-center w-9 h-9 rounded-lg">
+            <%= icon "chevron-right", color: "current" %>
+          </span>
+        <% end %>
+      </div>
+
+      <div class="grid grid-cols-3 gap-2 text-sm text-center font-medium">
+        <% Date::ABBR_MONTHNAMES.compact.each_with_index do |month_name, i| %>
+          <% month = i + 1 %>
+          <% date = Date.new(start_date.year, month, 1) %>
+          <% if date <= Date.current %>
+            <%= render DS::Link.new(
+              variant: date.month == start_date.month ? "secondary" : "ghost",
+              text: month_name,
+              href: reports_path(period_type: :monthly, start_date: date, end_date: date.end_of_month),
+              full_width: true,
+              frame: :_top
+            ) %>
+          <% else %>
+            <span class="px-3 py-2 text-subdued rounded-md"><%= month_name %></span>
+          <% end %>
+        <% end %>
+      </div>
+
+    <% when :quarterly %>
+      <div class="flex items-center gap-2 justify-between mb-2">
+        <%= render DS::Link.new(
+          variant: "icon",
+          icon: "chevron-left",
+          href: picker_reports_path(period_type: :quarterly, start_date: Date.new(start_date.year - 1, 1, 1)),
+          aria: { label: t("reports.index.previous_year") },
+          frame: "reports_picker"
+        ) %>
+
+        <span class="w-40 text-center px-3 py-2">
+          <%= start_date.year %>
+        </span>
+
+        <% next_year_start = Date.new(start_date.year + 1, 1, 1) %>
+        <% if next_year_start <= Date.current %>
+          <%= render DS::Link.new(
+            variant: "icon",
+            icon: "chevron-right",
+            href: picker_reports_path(period_type: :quarterly, start_date: next_year_start),
+            aria: { label: t("reports.index.next_year") },
+            frame: "reports_picker"
+          ) %>
+        <% else %>
+          <span class="text-subdued inline-flex items-center justify-center w-9 h-9 rounded-lg">
+            <%= icon "chevron-right", color: "current" %>
+          </span>
+        <% end %>
+      </div>
+
+      <div class="grid grid-cols-2 gap-2 text-sm text-center font-medium">
+        <% (1..4).each do |q| %>
+          <% quarter_start = Date.new(start_date.year, (q - 1) * 3 + 1, 1) %>
+          <% quarter_end = quarter_start.end_of_quarter %>
+          <% if quarter_start <= Date.current %>
+            <%= render DS::Link.new(
+              variant: quarter_start.quarter == start_date.quarter && start_date.year == quarter_start.year ? "secondary" : "ghost",
+              text: t("reports.index.period_picker.quarter", quarter: q, year: start_date.year),
+              href: reports_path(period_type: :quarterly, start_date: quarter_start, end_date: quarter_end),
+              full_width: true,
+              frame: :_top
+            ) %>
+          <% else %>
+            <span class="px-3 py-2 text-subdued rounded-md"><%= t("reports.index.period_picker.quarter", quarter: q, year: start_date.year) %></span>
+          <% end %>
+        <% end %>
+      </div>
+
+    <% when :ytd %>
+      <% decade_start = (start_date.year / 10) * 10 %>
+      <% decade_end = decade_start + 9 %>
+
+      <div class="flex items-center gap-2 justify-between mb-2">
+        <%= render DS::Link.new(
+          variant: "icon",
+          icon: "chevron-left",
+          href: picker_reports_path(period_type: :ytd, start_date: Date.new(decade_start - 1, 1, 1)),
+          aria: { label: t("reports.index.previous_decade") },
+          frame: "reports_picker"
+        ) %>
+
+        <span class="w-40 text-center px-3 py-2">
+          <%= decade_start %>–<%= decade_end %>
+        </span>
+
+        <% if decade_start + 10 <= Date.current.year %>
+          <%= render DS::Link.new(
+            variant: "icon",
+            icon: "chevron-right",
+            href: picker_reports_path(period_type: :ytd, start_date: Date.new(decade_start + 10, 1, 1)),
+            aria: { label: t("reports.index.next_decade") },
+            frame: "reports_picker"
+          ) %>
+        <% else %>
+          <span class="text-subdued inline-flex items-center justify-center w-9 h-9 rounded-lg">
+            <%= icon "chevron-right", color: "current" %>
+          </span>
+        <% end %>
+      </div>
+
+      <div class="grid grid-cols-2 gap-2 text-sm text-center font-medium">
+        <% (decade_start..decade_end).each do |year| %>
+          <% next if year > Date.current.year %>
+          <% year_start = Date.new(year, 1, 1) %>
+          <% year_end = year == Date.current.year ? Date.current : Date.new(year, 12, 31) %>
+          <%= render DS::Link.new(
+            variant: year == start_date.year ? "secondary" : "ghost",
+            text: year == Date.current.year ? t("reports.index.period_picker.ytd", year: year) : year.to_s,
+            href: reports_path(period_type: :ytd, start_date: year_start, end_date: year_end),
+            full_width: true,
+            frame: :_top
+          ) %>
+        <% end %>
+      </div>
+    <% end %>
+  </div>
+<% end %>
\ No newline at end of file
diff --git a/app/views/reports/_trends_insights.html.erb b/app/views/reports/_trends_insights.html.erb
index a0111fa28..f3106ea60 100644
--- a/app/views/reports/_trends_insights.html.erb
+++ b/app/views/reports/_trends_insights.html.erb
@@ -21,7 +21,7 @@
             </thead>
             <tbody class="text-secondary text-sm">
               <% trends_data.each_with_index do |trend, idx| %>
-                <tr class="<%= idx < trends_data.size - 1 ? "border-b border-divider" : "" %>">
+                <tr class="<%= idx < trends_data.size - 1 ? "table-divider" : "" %>">
                   <td class="py-3 px-4 lg:px-6">
                     <span class="flex items-center gap-2 <%= trend[:is_current_month] ? "font-medium" : "" %>">
                       <%= trend[:month] %>
diff --git a/app/views/reports/index.html.erb b/app/views/reports/index.html.erb
index d3bd12b37..f66ce7788 100644
--- a/app/views/reports/index.html.erb
+++ b/app/views/reports/index.html.erb
@@ -90,11 +90,54 @@
     <% end %>
 
     <%# Period Display %>
-    <div class="text-sm text-subdued">
-      <%= t("reports.index.showing_period",
-            start: @start_date.strftime("%b %-d, %Y"),
-            end: @end_date.strftime("%b %-d, %Y")) %>
-    </div>
+    <% if @nav %>
+      <div class="flex items-center gap-1 mb-4">
+        <div class="flex items-center gap-2">
+          <%= render DS::Link.new(
+            variant: "icon",
+            icon: "chevron-left",
+            href: reports_path(period_type: @period_type, start_date: @nav[:prev_start], end_date: @nav[:prev_end]),
+            aria: { label: t("reports.index.previous_period") },
+          ) %>
+
+          <% if @nav[:at_latest] %>
+            <button disabled aria-label="<%= t('reports.index.next_period') %>" class="text-subdued inline-flex items-center justify-center w-9 h-9 rounded-lg cursor-not-allowed">
+              <%= icon("chevron-right", color: "current") %>
+            </button>
+          <% else %>
+            <%= render DS::Link.new(
+              variant: "icon",
+              icon: "chevron-right",
+              href: reports_path(period_type: @period_type, start_date: @nav[:next_start], end_date: @nav[:next_end]),
+              aria: { label: t("reports.index.next_period") },
+            ) %>
+          <% end %>
+        </div>
+
+        <% if [:monthly, :quarterly, :ytd].include?(@period_type) %>
+          <%= render DS::Popover.new(variant: "button") do |popover| %>
+            <% popover.with_button class: "flex items-center gap-1 hover:bg-alpha-black-25 cursor-pointer rounded-md p-2" do %>
+              <span class="text-primary font-medium text-lg lg:text-base"><%= @nav[:label] %></span>
+              <%= icon("chevron-down") %>
+            <% end %>
+
+            <% popover.with_custom_content do %>
+              <%= render "reports/period_picker", period_type: @period_type, start_date: @start_date %>
+            <% end %>
+          <% end %>
+        <% else %>
+          <span class="text-primary font-medium text-lg lg:text-base"><%= @nav[:label] %></span>
+        <% end %>
+
+        <div class="ml-auto">
+          <%= render DS::Link.new(
+            text: t("reports.index.today"),
+            variant: "outline",
+            href: reports_path(period_type: @period_type),
+          ) %>
+        </div>
+      </div>
+    <% end %>
   </div>
 <% end %>
 
diff --git a/app/views/reports/print.html.erb b/app/views/reports/print.html.erb
index 3add245f0..1de2a4cd2 100644
--- a/app/views/reports/print.html.erb
+++ b/app/views/reports/print.html.erb
@@ -52,7 +52,7 @@
           savings_rate = @summary_metrics[:current_income].amount > 0 ? ((@summary_metrics[:net_savings].amount / @summary_metrics[:current_income].amount) * 100).round(0) : 0
         %>
         <% if savings_rate != 0 %>
-          <span class="tufte-metric-card-change" style="color: #666;"><%= t("reports.print.summary.of_income", percent: savings_rate) %></span>
+          <span class="tufte-metric-card-change text-secondary"><%= t("reports.print.summary.of_income", percent: savings_rate) %></span>
         <% end %>
         <% if has_sparkline_data?(@trends_data) %>
           <svg width="60" height="20" viewBox="0 0 60 20" style="display:block;margin-top:6px;">
@@ -65,7 +65,7 @@
         <div class="tufte-metric-card tufte-metric-card-sm">
           <span class="tufte-metric-card-label"><%= t("reports.print.summary.budget") %></span>
           <span class="tufte-metric-card-value"><%= @summary_metrics[:budget_percent] %>%</span>
-          <span class="tufte-metric-card-change" style="color: #666;"><%= t("reports.print.summary.used") %></span>
+          <span class="tufte-metric-card-change text-secondary"><%= t("reports.print.summary.used") %></span>
         </div>
       <% end %>
     </div>
@@ -213,12 +213,12 @@
         <div class="tufte-metric-card tufte-metric-card-sm">
           <span class="tufte-metric-card-label"><%= t("reports.print.investments.contributions") %></span>
           <span class="tufte-metric-card-value tufte-income"><%= format_money(@investment_metrics[:period_contributions]) %></span>
-          <span class="tufte-metric-card-change" style="color: #666;"><%= t("reports.print.investments.this_period") %></span>
+          <span class="tufte-metric-card-change text-secondary"><%= t("reports.print.investments.this_period") %></span>
         </div>
         <div class="tufte-metric-card tufte-metric-card-sm">
           <span class="tufte-metric-card-label"><%= t("reports.print.investments.withdrawals") %></span>
           <span class="tufte-metric-card-value tufte-expense"><%= format_money(@investment_metrics[:period_withdrawals]) %></span>
-          <span class="tufte-metric-card-change" style="color: #666;"><%= t("reports.print.investments.this_period") %></span>
+          <span class="tufte-metric-card-change text-secondary"><%= t("reports.print.investments.this_period") %></span>
         </div>
       </div>
 
diff --git a/app/views/rule/conditions/_condition_group.html.erb b/app/views/rule/conditions/_condition_group.html.erb
index 54f056bae..09161462f 100644
--- a/app/views/rule/conditions/_condition_group.html.erb
+++ b/app/views/rule/conditions/_condition_group.html.erb
@@ -11,11 +11,11 @@
     <div class="flex items-center gap-2">
       <%# Show prefix on condition groups, except the first one %>
       <div class="pl-2" data-condition-prefix>
-        <span class="font-medium uppercase text-xs">and</span>
+        <span class="font-medium uppercase text-xs"><%= t(".and_prefix") %></span>
       </div>
-      <p class="text-sm text-secondary">match</p>
-      <%= form.select :operator, [["all", "and"], ["any", "or"]], { container_class: "w-fit" }, data: { rules_target: "operatorField" } %>
-      <p class="text-sm text-secondary">of the following conditions</p>
+      <p class="text-sm text-secondary"><%= t(".match") %></p>
+      <%= form.select :operator, [[t(".all"), "and"], [t(".any"), "or"]], { container_class: "w-fit" }, data: { rules_target: "operatorField" } %>
+      <p class="text-sm text-secondary"><%= t(".of_the_following_conditions") %></p>
     </div>
 
     <%= icon(
@@ -40,7 +40,7 @@
   </ul>
 
   <%= render DS::Button.new(
-    text: "Add condition",
+    text: t(".add_condition"),
     leading_icon: "plus",
     variant: "ghost",
     type: "button",
diff --git a/app/views/rules/_category_rule_cta.html.erb b/app/views/rules/_category_rule_cta.html.erb
index ff3481f4d..3c7f2ed41 100644
--- a/app/views/rules/_category_rule_cta.html.erb
+++ b/app/views/rules/_category_rule_cta.html.erb
@@ -13,7 +13,7 @@
     <%= f.hidden_field :rule_prompt_dismissed_at, value: Time.current %>
 
     <%= tag.div class:"flex gap-2 justify-end" do %>
-      <%= render DS::Button.new(text: "Dismiss", variant: "secondary") %>
+      <%= render DS::Button.new(text: "Dismiss", variant: "secondary", type: :submit) %>
       <% rule_href = new_rule_path(resource_type: "transaction", action_type: "set_transaction_category", action_value: cta[:category_id], name: cta[:merchant_name]) %>
       <%= render DS::Link.new(text: "Create rule", variant: "primary", href: rule_href, frame: :modal) %>
     <% end %>
diff --git a/app/views/rules/_form.html.erb b/app/views/rules/_form.html.erb
index 2f4f1fe18..7c942a35f 100644
--- a/app/views/rules/_form.html.erb
+++ b/app/views/rules/_form.html.erb
@@ -12,10 +12,10 @@
   <section class="space-y-4">
     <div class="flex items-center gap-1 text-secondary">
       <%= icon "tag", size: "sm" %>
-      <h3 class="text-sm font-medium text-primary">Rule name (optional)</h3>
+      <h3 class="text-sm font-medium text-primary"><%= t(".rule_name_label") %></h3>
     </div>
     <div class="ml-6">
-      <%= f.text_field :name, placeholder: "Enter a name for this rule", class: "form-field__input" %>
+      <%= f.text_field :name, placeholder: t(".rule_name_placeholder"), class: "form-field__input" %>
     </div>
   </section>
 
@@ -50,15 +50,15 @@
       </ul>
 
       <div class="flex items-center gap-2">
-        <%= render DS::Button.new(text: "Add condition", icon: "plus", variant: "ghost", type: "button", data: { action: "rules#addCondition" }) %>
-        <%= render DS::Button.new(text: "Add condition group", icon: "copy-plus", variant: "ghost", type: "button", data: { action: "rules#addConditionGroup" }) %>
+        <%= render DS::Button.new(text: t(".add_condition"), icon: "plus", variant: "ghost", type: "button", data: { action: "rules#addCondition" }) %>
+        <%= render DS::Button.new(text: t(".add_condition_group"), icon: "copy-plus", variant: "ghost", type: "button", data: { action: "rules#addConditionGroup" }) %>
       </div>
     </div>
   </section>
 
   <section class="space-y-4">
     <div class="flex items-center gap-1 text-secondary">
-      <h3 class="text-sm font-medium text-primary">THEN</h3>
+      <h3 class="text-sm font-medium text-primary"><%= t(".then") %></h3>
     </div>
 
     <%# Action template, used by Stimulus controller to add new actions dynamically %>
@@ -75,7 +75,7 @@
         <% end %>
       </ul>
 
-      <%= render DS::Button.new(text: "Add action", icon: "plus", variant: "ghost", type: "button", data: { action: "rules#addAction" }) %>
+      <%= render DS::Button.new(text: t(".add_action"), icon: "plus", variant: "ghost", type: "button", data: { action: "rules#addAction" }) %>
     </div>
   </section>
 
@@ -87,13 +87,13 @@
     <div class="ml-6 space-y-3">
       <div class="flex items-center gap-2">
         <%= f.radio_button :effective_date_enabled, false, checked: rule.effective_date.nil?, data: { action: "rules#clearEffectiveDate" } %>
-        <%= f.label :effective_date_enabled_false, "All past and future #{rule.resource_type}s", class: "text-sm text-primary" %>
+        <%= f.label :effective_date_enabled_false, t(".all_past_and_future", resource: rule.resource_type.pluralize), class: "text-sm text-primary" %>
       </div>
 
       <div class="flex items-center gap-2">
         <div class="flex items-center gap-2">
           <%= f.radio_button :effective_date_enabled, true, checked: rule.effective_date.present? %>
-          <%= f.label :effective_date_enabled_true, "Starting from", class: "text-sm text-primary" %>
+          <%= f.label :effective_date_enabled_true, t(".starting_from"), class: "text-sm text-primary" %>
         </div>
 
         <%= f.date_field :effective_date, container_class: "w-fit", data: { rules_target: "effectiveDateInput" } %>
diff --git a/app/views/rules/_rule.html.erb b/app/views/rules/_rule.html.erb
index 2e882e4ba..3106e8b4f 100644
--- a/app/views/rules/_rule.html.erb
+++ b/app/views/rules/_rule.html.erb
@@ -21,14 +21,14 @@
             <% end %>
           </span>
           <% if additional_condition_count.positive? %>
-            and <%= additional_condition_count %> more <%= additional_condition_count == 1 ? "condition" : "conditions" %>
+            <%= t(".and_more_conditions", count: additional_condition_count) %>
           <% end %>
         </p>
       </div>
     <% end %>
     <div class="flex items-center gap-2 mt-1">
       <div class="flex items-center gap-1 text-secondary w-16 shrink-0">
-        <span class="font-mono text-xs">THEN</span>
+        <span class="font-mono text-xs"><%= t(".then") %></span>
       </div>
       <p class="flex items-center flex-wrap gap-1.5 m-0">
         <span class="px-2 py-1 border border-secondary rounded-full">
@@ -36,14 +36,14 @@
             <%= t("rules.no_action") %>
           <% else %>
             <% if rule.actions.first.value && rule.actions.first.options %>
-              <%= rule.actions.first.executor.label %> to <%= rule.actions.first.value_display %>
+              <%= t(".action_label_to", label: rule.actions.first.executor.label, value: rule.actions.first.value_display) %>
             <% else %>
               <%= rule.actions.first.executor.label %>
             <% end %>
           <% end %>
         </span>
         <% if rule.actions.count > 1 %>
-          and <%= rule.actions.count - 1 %> more <%= rule.actions.count - 1 == 1 ? "action" : "actions" %>
+          <%= t(".and_more_actions", count: rule.actions.count - 1) %>
         <% end %>
       </p>
     </div>
@@ -54,9 +54,9 @@
       <p class="flex items-center flex-wrap gap-1.5 m-0">
         <span class="px-2 py-1 border border-secondary rounded-full">
           <% if rule.effective_date.nil? %>
-            All past and future <%= rule.resource_type.pluralize %>
+            <%= t(".all_past_and_future", resource: rule.resource_type.pluralize) %>
           <% else %>
-            <%= rule.resource_type.pluralize %> on or after <%= rule.effective_date.strftime("%b %-d, %Y") %>
+            <%= t(".on_or_after", resource: rule.resource_type.pluralize, date: rule.effective_date.strftime("%b %-d, %Y")) %>
           <% end %>
         </span>
       </p>
@@ -67,11 +67,11 @@
       <%= f.toggle :active, { data: { auto_submit_form_target: "auto" } } %>
     <% end %>
     <%= render DS::Menu.new do |menu| %>
-      <% menu.with_item(variant: "link", text: "Edit", href: edit_rule_path(rule), icon: "pencil", data: { turbo_frame: "modal" }) %>
-      <% menu.with_item(variant: "link", text: "Re-apply rule", href: confirm_rule_path(rule), icon: "refresh-cw", data: { turbo_frame: "modal" }) %>
+      <% menu.with_item(variant: "link", text: t(".edit"), href: edit_rule_path(rule), icon: "pencil", data: { turbo_frame: "modal" }) %>
+      <% menu.with_item(variant: "link", text: t(".re_apply_rule"), href: confirm_rule_path(rule), icon: "refresh-cw", data: { turbo_frame: "modal" }) %>
       <% menu.with_item(
         variant: "button",
-        text: "Delete",
+        text: t(".delete"),
         href: rule_path(rule),
         icon: "trash-2",
         method: :delete,
diff --git a/app/views/rules/confirm.html.erb b/app/views/rules/confirm.html.erb
index cf505c8f9..775846f6a 100644
--- a/app/views/rules/confirm.html.erb
+++ b/app/views/rules/confirm.html.erb
@@ -1,53 +1,44 @@
 <%= render DS::Dialog.new(reload_on_close: params[:reload_on_close].present?) do |dialog| %>
   <%
     title = if @rule.name.present?
-              "Confirm changes to \"#{@rule.name}\""
+              t(".title_with_name", name: @rule.name)
             else
-              "Confirm changes"
+              t(".title")
             end
   %>
   <% dialog.with_header(title: title) %>
 
   <% dialog.with_body do %>
     <p class="text-secondary text-sm mb-4">
-      You are about to apply this rule to
-      <span class="text-primary font-medium"><%= @rule.affected_resource_count %> <%= @rule.resource_type.pluralize %></span>
-      that meet the specified rule criteria.  Please confirm if you wish to proceed with this change.
+      <%= t(".apply_notice_html", count: @rule.affected_resource_count, resource: @rule.resource_type.pluralize) %>
     </p>
 
     <% if @rule.actions.any? { |a| a.action_type == "auto_categorize" } %>
       <% affected_count = @rule.affected_resource_count %>
-      <div class="mb-4 p-3 bg-blue-50 border border-blue-200 rounded-lg">
-        <div class="flex items-start gap-2">
-          <%= icon "info", class: "w-4 h-4 text-blue-600 mt-0.5 flex-shrink-0" %>
-          <div class="text-xs">
-            <p class="font-medium text-blue-900 mb-1">AI Cost Estimation</p>
-            <% if @estimated_cost.present? %>
-              <p class="text-blue-700">
-                This will use AI to categorize <%= affected_count %> transaction<%= "s" if affected_count != 1 %>.
-                Estimated cost: <span class="font-semibold">~$<%= sprintf("%.4f", @estimated_cost) %></span>
-              </p>
-            <% else %>
-              <p class="text-blue-700">
-                This will use AI to categorize <%= affected_count %> transaction<%= "s" if affected_count != 1 %>.
-                <% if @selected_model.present? %>
-                  <span class="font-semibold">Cost estimation unavailable for model "<%= @selected_model %>".</span>
-                <% else %>
-                  <span class="font-semibold">Cost estimation unavailable (no LLM provider configured).</span>
-                <% end %>
-                You may incur costs, please check with the model provider for the most up-to-date prices.
-              </p>
-            <% end %>
-            <p class="text-blue-600 mt-1">
-              <%= link_to "View usage history", settings_llm_usage_path, class: "underline hover:text-blue-800" %>
+      <div class="mb-4">
+        <%= render DS::Alert.new(title: t(".ai_cost_title"), variant: :info) do %>
+          <% if @estimated_cost.present? %>
+            <p><%= t(".ai_cost_with_estimate_html", count: affected_count, cost: sprintf("%.4f", @estimated_cost)) %></p>
+          <% else %>
+            <p>
+              <%= t(".ai_cost_no_estimate_html", count: affected_count) %>
+              <% if @selected_model.present? %>
+                <span class="font-semibold"><%= t(".cost_unavailable_model", model: @selected_model) %></span>
+              <% else %>
+                <span class="font-semibold"><%= t(".cost_unavailable_no_provider") %></span>
+              <% end %>
+              <%= t(".cost_warning") %>
             </p>
-          </div>
-        </div>
+          <% end %>
+          <p>
+            <%= link_to t(".view_usage_history"), settings_llm_usage_path, class: "text-link underline" %>
+          </p>
+        <% end %>
       </div>
     <% end %>
 
     <%= render DS::Button.new(
-      text: "Confirm changes",
+      text: t(".confirm_changes"),
       href: apply_rule_path(@rule),
       method: :post,
       full_width: true,
diff --git a/app/views/rules/confirm_all.html.erb b/app/views/rules/confirm_all.html.erb
index c88778767..d3b230766 100644
--- a/app/views/rules/confirm_all.html.erb
+++ b/app/views/rules/confirm_all.html.erb
@@ -9,32 +9,28 @@
     </p>
 
     <% if @rules.any? { |r| r.actions.any? { |a| a.action_type == "auto_categorize" } } %>
-      <div class="mb-4 p-3 bg-blue-50 border border-blue-200 rounded-lg">
-        <div class="flex items-start gap-2">
-          <%= icon "info", class: "w-4 h-4 text-blue-600 mt-0.5 flex-shrink-0" %>
-          <div class="text-xs">
-            <p class="font-medium text-blue-900 mb-1"><%= t("rules.apply_all.ai_cost_title") %></p>
-            <% if @estimated_cost.present? %>
-              <p class="text-blue-700">
-                <%= t("rules.apply_all.ai_cost_message", transactions: @total_affected_count) %>
-                <%= t("rules.apply_all.estimated_cost", cost: sprintf("%.4f", @estimated_cost)) %>
-              </p>
-            <% else %>
-              <p class="text-blue-700">
-                <%= t("rules.apply_all.ai_cost_message", transactions: @total_affected_count) %>
-                <% if @selected_model.present? %>
-                  <span class="font-semibold"><%= t("rules.apply_all.cost_unavailable_model", model: @selected_model) %></span>
-                <% else %>
-                  <span class="font-semibold"><%= t("rules.apply_all.cost_unavailable_no_provider") %></span>
-                <% end %>
-                <%= t("rules.apply_all.cost_warning") %>
-              </p>
-            <% end %>
-            <p class="text-blue-600 mt-1">
-              <%= link_to t("rules.apply_all.view_usage"), settings_llm_usage_path, class: "underline hover:text-blue-800" %>
+      <div class="mb-4">
+        <%= render DS::Alert.new(title: t("rules.apply_all.ai_cost_title"), variant: :info) do %>
+          <% if @estimated_cost.present? %>
+            <p>
+              <%= t("rules.apply_all.ai_cost_message", transactions: @total_affected_count) %>
+              <%= t("rules.apply_all.estimated_cost", cost: sprintf("%.4f", @estimated_cost)) %>
             </p>
-          </div>
-        </div>
+          <% else %>
+            <p>
+              <%= t("rules.apply_all.ai_cost_message", transactions: @total_affected_count) %>
+              <% if @selected_model.present? %>
+                <span class="font-semibold"><%= t("rules.apply_all.cost_unavailable_model", model: @selected_model) %></span>
+              <% else %>
+                <span class="font-semibold"><%= t("rules.apply_all.cost_unavailable_no_provider") %></span>
+              <% end %>
+              <%= t("rules.apply_all.cost_warning") %>
+            </p>
+          <% end %>
+          <p>
+            <%= link_to t("rules.apply_all.view_usage"), settings_llm_usage_path, class: "text-link underline" %>
+          </p>
+        <% end %>
       </div>
     <% end %>
 
diff --git a/app/views/rules/index.html.erb b/app/views/rules/index.html.erb
index 49282af42..05c5361dd 100644
--- a/app/views/rules/index.html.erb
+++ b/app/views/rules/index.html.erb
@@ -1,4 +1,4 @@
-<%= content_for :page_title, "Rules" %>
+<%= content_for :page_title, t(".page_title") %>
 <%= content_for :page_actions do %>
   <% if @rules.any? %>
     <%= render DS::Menu.new do |menu| %>
@@ -15,7 +15,7 @@
         )) %>
       <% menu.with_item(
         variant: "button",
-        text: "Delete all rules",
+        text: t(".delete_all_rules"),
         href: destroy_all_rules_path,
         icon: "trash-2",
         method: :delete,
@@ -30,7 +30,7 @@
     ) %>
   <% end %>
   <%= render DS::Link.new(
-    text: "New rule",
+    text: t(".new_rule"),
     variant: "primary",
     href: new_rule_path(resource_type: "transaction"),
     icon: "plus",
@@ -42,7 +42,7 @@
   <div class="flex items-center gap-2 mb-2 py-4">
     <%= icon("circle-alert", size: "sm") %>
     <p class="text-sm text-secondary">
-      AI-enabled rule actions will cost money.  Be sure to filter as narrowly as possible to avoid unnecessary costs.
+      <%= t(".ai_cost_warning") %>
     </p>
   </div>
 <% end %>
@@ -51,15 +51,15 @@
     <div class="bg-container-inset rounded-xl">
       <div class="flex justify-between px-4 py-2 text-xs uppercase">
         <div class="flex items-center gap-1.5 font-medium text-secondary">
-          <p>Rules</p>
+          <p><%= t(".rules_heading") %></p>
           <span class="text-subdued">&middot;</span>
           <p><%= @rules.count %></p>
         </div>
         <div class="flex items-center gap-1">
-          <span class="text-secondary">Sort by:</span>
+          <span class="text-secondary"><%= t(".sort_by") %></span>
           <%= form_with url: rules_path, method: :get, local: true, class: "flex items-center", data: { controller: "auto-submit-form" } do |form| %>
             <%= form.select :sort_by,
-                      options_for_select([["Name", "name"], ["Updated At", "updated_at"]], @sort_by),
+                      options_for_select([[t(".sort_name"), "name"], [t(".sort_updated_at"), "updated_at"]], @sort_by),
                       {},
                       class: "min-w-[120px] bg-transparent rounded border-none cursor-pointer text-primary uppercase text-xs w-auto",
                       data: { auto_submit_form_target: "auto", autosubmit_trigger_event: "change" } %>
@@ -70,7 +70,7 @@
             variant: "icon",
             icon: "arrow-up-down",
             size: :sm,
-            title: "Toggle sort direction"
+            title: t(".toggle_sort_direction")
           ) %>
         </div>
       </div>
@@ -83,11 +83,11 @@
   <% else %>
     <div class="flex justify-center items-center py-20">
       <div class="text-center flex flex-col items-center max-w-[500px]">
-        <p class="text-sm text-primary font-medium mb-1">No rules yet</p>
-        <p class="text-sm text-secondary mb-4">Set up rules to perform actions to your transactions and other data on every account sync.</p>
+        <p class="text-sm text-primary font-medium mb-1"><%= t(".no_rules_title") %></p>
+        <p class="text-sm text-secondary mb-4"><%= t(".no_rules_description") %></p>
         <div class="flex items-center gap-2">
           <%= render DS::Link.new(
-            text: "New rule",
+            text: t(".new_rule"),
             variant: "primary",
             href: new_rule_path(resource_type: "transaction"),
             icon: "plus",
@@ -128,6 +128,7 @@
                 <div><%= t("rules.recent_runs.columns.transactions_counts.queued") %></div>
                 <div><%= t("rules.recent_runs.columns.transactions_counts.processed") %></div>
                 <div><%= t("rules.recent_runs.columns.transactions_counts.modified") %></div>
+                <div><%= t("rules.recent_runs.columns.transactions_counts.blocked", default: "Blocked") %></div>
               </div>
             </th>
           </tr>
@@ -169,7 +170,7 @@
                 <%= run.rule_name.presence || run.rule&.name.presence || t("rules.recent_runs.unnamed_rule") %>
               </td>
               <td class="px-4 py-3 text-sm text-primary text-center tabular-nums">
-                <%= "#{number_with_delimiter(run.transactions_queued)} / #{number_with_delimiter(run.transactions_processed)} / #{number_with_delimiter(run.transactions_modified)}" %>
+                <%= "#{number_with_delimiter(run.transactions_queued)} / #{number_with_delimiter(run.transactions_processed)} / #{number_with_delimiter(run.transactions_modified)} / #{number_with_delimiter(run.transactions_blocked)}" %>
               </td>
             </tr>
           <% end %>
diff --git a/app/views/securities/_combobox_security.turbo_stream.erb b/app/views/securities/_combobox_security.turbo_stream.erb
index 50d35b9bb..79f8263e0 100644
--- a/app/views/securities/_combobox_security.turbo_stream.erb
+++ b/app/views/securities/_combobox_security.turbo_stream.erb
@@ -9,18 +9,28 @@
       </span>
       <span class="text-xs text-secondary">
         <%= t("securities.combobox.exchange_label", symbol: combobox_security.symbol, exchange: combobox_security.exchange_name) %>
+        <% if combobox_security.price_provider.present? %>
+          <span class="text-xs text-tertiary">&middot; <%= t("securities.providers.#{combobox_security.price_provider}", default: combobox_security.price_provider.humanize) %></span>
+        <% end %>
       </span>
     </div>
-    <% if combobox_security.country_code.present? %>
-      <div class="flex items-center bg-container-inset rounded-sm px-1.5 py-1 gap-1">
-        <%= image_tag("https://hatscripts.github.io/circle-flags/flags/#{combobox_security.country_code.downcase}.svg",
-                      class: "h-4 rounded-sm",
-                      alt: "#{combobox_security.country_code.upcase} flag",
-                      title: combobox_security.country_code.upcase) %>
-        <span class="text-xs text-secondary">
-          <%= combobox_security.country_code.upcase %>
+    <div class="flex items-center gap-1.5">
+      <% if combobox_security.currency.present? %>
+        <span class="text-xs text-secondary bg-container-inset rounded-sm px-1.5 py-1">
+          <%= combobox_security.currency %>
         </span>
-      </div>
-    <% end %>
+      <% end %>
+      <% if combobox_security.country_code.present? %>
+        <div class="flex items-center bg-container-inset rounded-sm px-1.5 py-1 gap-1">
+          <%= image_tag("https://hatscripts.github.io/circle-flags/flags/#{combobox_security.country_code.downcase}.svg",
+                        class: "h-4 rounded-sm",
+                        alt: "#{combobox_security.country_code.upcase} flag",
+                        title: combobox_security.country_code.upcase) %>
+          <span class="text-xs text-secondary">
+            <%= combobox_security.country_code.upcase %>
+          </span>
+        </div>
+      <% end %>
+    </div>
   </div>
 </div>
diff --git a/app/views/sessions/mobile_sso_start.html.erb b/app/views/sessions/mobile_sso_start.html.erb
index 74fa9ebfd..123aca3a7 100644
--- a/app/views/sessions/mobile_sso_start.html.erb
+++ b/app/views/sessions/mobile_sso_start.html.erb
@@ -4,5 +4,5 @@
     <input type="hidden" name="authenticity_token" value="<%= form_authenticity_token %>">
   </form>
   <script>document.getElementById('sso_form').submit();</script>
-  <noscript><p>Redirecting to sign in... <a href="/auth/<%= ERB::Util.html_escape(@provider) %>">Click here</a> if not redirected.</p></noscript>
+  <noscript><p><%= t("sessions.mobile_sso_start.redirecting_html", url: "/auth/#{ERB::Util.html_escape(@provider)}") %></p></noscript>
 </body></html>
diff --git a/app/views/settings/_section.html.erb b/app/views/settings/_section.html.erb
index bb5873839..14ef45a61 100644
--- a/app/views/settings/_section.html.erb
+++ b/app/views/settings/_section.html.erb
@@ -1,23 +1,39 @@
-<%# locals: (title:, subtitle: nil, content:, collapsible: false, open: true, auto_open_param: nil) %>
+<%# locals: (title:, subtitle: nil, content:, collapsible: false, open: true, auto_open_param: nil, status: nil, meta: nil, actions: nil, badge: nil) %>
 <% if collapsible %>
-  <details <%= "open" if open %>
-           class="group bg-container shadow-border-xs rounded-xl p-4"
-           <%= "data-controller=\"auto-open\" data-auto-open-param-value=\"#{h(auto_open_param)}\"".html_safe if auto_open_param.present? %>>
-    <summary class="flex items-center justify-between gap-2 cursor-pointer rounded-lg list-none [&::-webkit-details-marker]:hidden">
-      <div class="flex items-center gap-2">
-        <%= icon "chevron-right", class: "text-secondary group-open:transform group-open:rotate-90 transition-transform" %>
-        <div>
-          <h2 class="text-lg font-medium text-primary"><%= title %></h2>
-          <% if subtitle.present? %>
-            <p class="text-secondary text-sm"><%= subtitle %></p>
-          <% end %>
+  <%= render DS::Disclosure.new(
+    variant: :card,
+    open: open,
+    data: auto_open_param.present? ? { controller: "auto-open", auto_open_param_value: auto_open_param } : nil
+  ) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center justify-between gap-2 w-full">
+        <div class="flex items-center gap-2">
+          <%= icon "chevron-right", class: "text-secondary group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
+          <div>
+            <div class="flex items-center gap-2 flex-wrap">
+              <h2 class="text-lg font-medium text-primary"><%= title %></h2>
+              <%= badge if badge.present? %>
+            </div>
+            <% if subtitle.present? %>
+              <p class="text-secondary text-sm"><%= subtitle %></p>
+            <% end %>
+          </div>
         </div>
+        <% if status.present? %>
+          <div class="flex items-center gap-2 shrink-0 group-open:hidden">
+            <% if meta.present? %>
+              <span class="text-xs text-subdued"><%= meta %></span>
+            <% end %>
+            <%= status %>
+            <%= actions if actions.present? %>
+          </div>
+        <% end %>
       </div>
-    </summary>
+    <% end %>
     <div class="space-y-4 mt-4">
       <%= content %>
     </div>
-  </details>
+  <% end %>
 <% else %>
   <section class="bg-container shadow-border-xs rounded-xl p-4 space-y-4">
     <div>
diff --git a/app/views/settings/_settings_nav.html.erb b/app/views/settings/_settings_nav.html.erb
index bc4f9dcd0..f9e5e975b 100644
--- a/app/views/settings/_settings_nav.html.erb
+++ b/app/views/settings/_settings_nav.html.erb
@@ -4,7 +4,7 @@ nav_sections = [
     header: t(".general_section_title"),
     items: [
       { label: t(".accounts_label"), path: accounts_path, icon: "layers" },
-      { label: t(".bank_sync_label"), path: settings_bank_sync_path, icon: "banknote" },
+      { label: t(".bank_sync_label"), path: settings_providers_path, icon: "banknote", if: Current.user&.admin? },
       { label: t(".preferences_label"), path: settings_preferences_path, icon: "bolt" },
       { label: t(".appearance_label"), path: settings_appearance_path, icon: "palette" },
       { label: t(".profile_label"), path: settings_profile_path, icon: "circle-user" },
@@ -19,7 +19,8 @@ nav_sections = [
       { label: t(".tags_label"), path: tags_path, icon: "tags" },
       { label: t(".rules_label"), path: rules_path, icon: "git-branch" },
       { label: t(".merchants_label"), path: family_merchants_path, icon: "store" },
-      { label: t(".recurring_transactions_label"), path: recurring_transactions_path, icon: "repeat" }
+      { label: t(".recurring_transactions_label"), path: recurring_transactions_path, icon: "repeat" },
+      { label: t(".statement_vault_label"), path: account_statements_path, icon: "archive", if: Current.user&.admin? }
     ]
   },
   (
@@ -27,14 +28,14 @@ nav_sections = [
       header: t(".advanced_section_title"),
       items: [
         { label: t(".ai_prompts_label"), path: settings_ai_prompts_path, icon: "bot" },
-        { label: "LLM Usage", path: settings_llm_usage_path, icon: "activity" },
+        { label: t(".llm_usage_label"), path: settings_llm_usage_path, icon: "activity" },
         { label: t(".api_keys_label"), path: settings_api_key_path, icon: "key" },
+        { label: t(".debug_label", default: "Debug"), path: settings_debug_path, icon: "bug", if: Current.user&.super_admin? },
         { label: t(".self_hosting_label"), path: settings_hosting_path, icon: "database", if: self_hosted? },
-        { label: "Providers", path: settings_providers_path, icon: "plug" },
         { label: t(".imports_label"), path: imports_path, icon: "download" },
         { label: t(".exports_label"), path: family_exports_path, icon: "upload" },
-        { label: "SSO Providers", path: admin_sso_providers_path, icon: "key-round", if: Current.user&.super_admin? },
-        { label: "Users", path: admin_users_path, icon: "users", if: Current.user&.super_admin? }
+        { label: t(".sso_providers_label"), path: admin_sso_providers_path, icon: "key-round", if: Current.user&.super_admin? },
+        { label: t(".users_label"), path: admin_users_path, icon: "users", if: Current.user&.super_admin? }
       ]
     } : nil
   ),
diff --git a/app/views/settings/_user_avatar_field.html.erb b/app/views/settings/_user_avatar_field.html.erb
index 1bedac90e..64f23d9b1 100644
--- a/app/views/settings/_user_avatar_field.html.erb
+++ b/app/views/settings/_user_avatar_field.html.erb
@@ -5,7 +5,7 @@
     <button type="button"
             data-profile-image-preview-target="clearBtn"
             data-action="click->profile-image-preview#clearFileInput"
-      class="<%= user.profile_image.attached? ? "" : "hidden" %> z-50 cursor-pointer absolute bottom-0 right-0 w-8 h-8 bg-gray-50 rounded-full flex justify-center items-center border border-white border-2">
+      class="<%= user.profile_image.attached? ? "" : "hidden" %> z-50 cursor-pointer absolute bottom-0 right-0 w-8 h-8 bg-surface-inset rounded-full flex justify-center items-center border border-white border-2">
       <%= icon "x", size: "sm" %>
     </button>
 
@@ -52,7 +52,7 @@
 
     <%= form.file_field :profile_image,
         accept: "image/png, image/jpeg",
-        class: "hidden px-3 py-2 bg-gray-50 text-primary rounded-md text-sm font-medium",
+        class: "hidden px-3 py-2 bg-surface-inset text-primary rounded-md text-sm font-medium",
         data: {
           profile_image_preview_target: "input",
           action: "change->profile-image-preview#showFileInputPreview"
diff --git a/app/views/settings/ai_prompts/show.html.erb b/app/views/settings/ai_prompts/show.html.erb
index 6847b0481..60e11c9bb 100644
--- a/app/views/settings/ai_prompts/show.html.erb
+++ b/app/views/settings/ai_prompts/show.html.erb
@@ -24,7 +24,7 @@
         <!-- Main System Prompt Section -->
         <div class="space-y-3">
           <div class="flex items-center gap-3">
-            <div class="w-9 h-9 rounded-full bg-gray-25 flex justify-center items-center">
+            <div class="w-9 h-9 rounded-full bg-surface-inset flex justify-center items-center">
               <%= icon "message-circle" %>
             </div>
             <div>
@@ -52,7 +52,7 @@
         <!-- Auto-Categorization Section -->
         <div class="space-y-3">
           <div class="flex items-center gap-3">
-            <div class="w-9 h-9 rounded-full bg-gray-25 flex justify-center items-center">
+            <div class="w-9 h-9 rounded-full bg-surface-inset flex justify-center items-center">
               <%= icon "brain" %>
             </div>
             <div>
@@ -80,7 +80,7 @@
         <!-- Merchant Detection Section -->
         <div class="space-y-3">
           <div class="flex items-center gap-3">
-            <div class="w-9 h-9 rounded-full bg-gray-25 flex justify-center items-center">
+            <div class="w-9 h-9 rounded-full bg-surface-inset flex justify-center items-center">
               <%= icon "store" %>
             </div>
             <div>
diff --git a/app/views/settings/api_keys/created.html.erb b/app/views/settings/api_keys/created.html.erb
index 5e7eb833e..d0c4e7bca 100644
--- a/app/views/settings/api_keys/created.html.erb
+++ b/app/views/settings/api_keys/created.html.erb
@@ -1,6 +1,6 @@
-<%= content_for :page_title, "API Key Created" %>
+<%= content_for :page_title, t(".page_title") %>
 
-<%= settings_section title: "API Key Created Successfully", subtitle: "Your new API key has been generated successfully." do %>
+<%= settings_section title: t(".success_title"), subtitle: t(".success_description") do %>
   <div class="space-y-4">
     <div class="p-3 shadow-border-xs bg-container rounded-lg">
       <div class="flex items-start gap-3">
@@ -11,21 +11,21 @@
           variant: :success
         ) %>
         <div class="flex-1">
-          <h3 class="font-medium text-primary">API Key Created Successfully!</h3>
-          <p class="text-secondary text-sm mt-1">Your new API key "<%= @api_key.name %>" has been created and is ready to use.</p>
+          <h3 class="font-medium text-primary"><%= t(".success_title") %></h3>
+          <p class="text-secondary text-sm mt-1"><%= t(".key_ready", name: @api_key.name) %></p>
         </div>
       </div>
     </div>
 
     <div class="bg-surface-inset rounded-xl p-4">
-      <h4 class="font-medium text-primary mb-3">Your API Key</h4>
-      <p class="text-secondary text-sm mb-3">Copy and store this key securely. You'll need it to authenticate your API requests.</p>
+      <h4 class="font-medium text-primary mb-3"><%= t(".your_api_key") %></h4>
+      <p class="text-secondary text-sm mb-3"><%= t(".copy_store_securely") %></p>
 
       <div class="bg-container rounded-lg p-3 border border-primary" data-controller="clipboard">
         <div class="flex items-center justify-between gap-3">
           <code id="api-key-display" class="font-mono text-sm text-primary break-all" data-clipboard-target="source"><%= @api_key.plain_key %></code>
           <%= render DS::Button.new(
-            text: "Copy API Key",
+            text: t(".copy_key"),
             variant: "ghost",
             icon: "copy",
             data: { action: "clipboard#copy" }
@@ -35,49 +35,42 @@
     </div>
 
     <div class="bg-surface-inset rounded-xl p-4">
-      <h4 class="font-medium text-primary mb-3">Key Details</h4>
+      <h4 class="font-medium text-primary mb-3"><%= t(".key_details_title") %></h4>
       <div class="space-y-2 text-sm">
         <div class="flex justify-between">
-          <span class="text-secondary">Name:</span>
+          <span class="text-secondary"><%= t(".key_name_label") %></span>
           <span class="text-primary font-medium"><%= @api_key.name %></span>
         </div>
         <div class="flex justify-between">
-          <span class="text-secondary">Permissions:</span>
+          <span class="text-secondary"><%= t(".permissions_label") %></span>
           <span class="text-primary">
             <%= @api_key.scopes.map { |scope|
               case scope
-              when "read_accounts" then "View Accounts"
-              when "read_transactions" then "View Transactions"
-              when "read_balances" then "View Balances"
-              when "write_transactions" then "Create Transactions"
+              when "read_accounts" then t("settings.api_keys_controller.scope_descriptions.read_accounts")
+              when "read_transactions" then t("settings.api_keys_controller.scope_descriptions.read_transactions")
+              when "read_balances" then t("settings.api_keys_controller.scope_descriptions.read_balances")
+              when "write_transactions" then t("settings.api_keys_controller.scope_descriptions.write_transactions")
               else scope.humanize
               end
             }.join(", ") %>
           </span>
         </div>
         <div class="flex justify-between">
-          <span class="text-secondary">Created:</span>
+          <span class="text-secondary"><%= t(".created_label") %></span>
           <span class="text-primary"><%= @api_key.created_at.strftime("%B %d, %Y at %I:%M %p") %></span>
         </div>
       </div>
     </div>
 
-    <div class="bg-warning-50 border border-warning-200 rounded-xl p-4">
-      <div class="flex items-start gap-2">
-        <%= icon("alert-triangle", class: "w-5 h-5 text-warning-600 mt-0.5") %>
-        <div>
-          <h4 class="font-medium text-warning-800 text-sm">Important Security Note</h4>
-          <p class="text-warning-700 text-sm mt-1">
-            This is the only time your API key will be displayed. Make sure to copy it now and store it securely.
-            If you lose this key, you'll need to generate a new one.
-          </p>
-        </div>
-      </div>
-    </div>
+    <%= render DS::Alert.new(title: t(".security_note_title"), variant: :warning) do %>
+      <p>
+        <%= t(".security_note_body") %>
+      </p>
+    <% end %>
 
     <div class="bg-surface-inset rounded-xl p-4">
-      <h4 class="font-medium text-primary mb-3">How to use your API key</h4>
-      <p class="text-secondary text-sm mb-3">Include your API key in the X-Api-Key header when making requests:</p>
+      <h4 class="font-medium text-primary mb-3"><%= t(".usage_instructions_title") %></h4>
+      <p class="text-secondary text-sm mb-3"><%= t("settings.api_keys.show.current_api_key.usage_instructions", product_name: product_name) %></p>
       <div class="bg-container rounded-lg p-3 font-mono text-sm text-primary border border-primary">
         curl -H "X-Api-Key: <%= @api_key.plain_key %>" <%= request.base_url %>/api/v1/accounts
       </div>
@@ -85,7 +78,7 @@
 
     <div class="flex justify-end pt-4 border-t border-primary">
       <%= render DS::Link.new(
-        text: "Continue to API Key Settings",
+        text: t(".continue"),
         href: settings_api_key_path,
         variant: "primary"
       ) %>
diff --git a/app/views/settings/api_keys/created.turbo_stream.erb b/app/views/settings/api_keys/created.turbo_stream.erb
index 89dab090b..f187a6d31 100644
--- a/app/views/settings/api_keys/created.turbo_stream.erb
+++ b/app/views/settings/api_keys/created.turbo_stream.erb
@@ -2,10 +2,10 @@
   <div class="relative max-w-4xl mx-auto flex flex-col w-full h-full">
     <div class="grow space-y-4 overflow-y-auto -mx-1 px-1 pb-12">
       <h1 class="text-primary text-3xl md:text-xl font-medium">
-        API Key Created
+        <%= t("settings.api_keys.created.page_title") %>
       </h1>
 
-      <%= settings_section title: "API Key Created Successfully", subtitle: "Your new API key has been generated successfully." do %>
+      <%= settings_section title: t("settings.api_keys.created.success_title"), subtitle: t("settings.api_keys.created.success_description") do %>
         <div class="space-y-4">
           <div class="p-3 shadow-border-xs bg-container rounded-lg">
             <div class="flex items-start gap-3">
@@ -16,21 +16,21 @@
                 variant: :success
               ) %>
               <div class="flex-1">
-                <h3 class="font-medium text-primary">API Key Created Successfully!</h3>
-                <p class="text-secondary text-sm mt-1">Your new API key "<%= @api_key.name %>" has been created and is ready to use.</p>
+                <h3 class="font-medium text-primary"><%= t("settings.api_keys.created.success_title") %></h3>
+                <p class="text-secondary text-sm mt-1"><%= t("settings.api_keys.created.key_ready", name: @api_key.name) %></p>
               </div>
             </div>
           </div>
 
           <div class="bg-surface-inset rounded-xl p-4">
-            <h4 class="font-medium text-primary mb-3">Your API Key</h4>
-            <p class="text-secondary text-sm mb-3">Copy and store this key securely. You'll need it to authenticate your API requests.</p>
+            <h4 class="font-medium text-primary mb-3"><%= t("settings.api_keys.created.your_api_key") %></h4>
+            <p class="text-secondary text-sm mb-3"><%= t("settings.api_keys.created.copy_store_securely") %></p>
 
             <div class="bg-container rounded-lg p-3 border border-primary" data-controller="clipboard">
               <div class="flex items-center justify-between gap-3">
                 <code id="api-key-display" class="font-mono text-sm text-primary break-all" data-clipboard-target="source"><%= @api_key.plain_key %></code>
                 <%= render DS::Button.new(
-                  text: "Copy API Key",
+                  text: t("settings.api_keys.created.copy_key"),
                   variant: "ghost",
                   icon: "copy",
                   data: { action: "clipboard#copy" }
@@ -40,49 +40,42 @@
           </div>
 
           <div class="bg-surface-inset rounded-xl p-4">
-            <h4 class="font-medium text-primary mb-3">Key Details</h4>
+            <h4 class="font-medium text-primary mb-3"><%= t("settings.api_keys.created.key_details_title") %></h4>
             <div class="space-y-2 text-sm">
               <div class="flex justify-between">
-                <span class="text-secondary">Name:</span>
+                <span class="text-secondary"><%= t("settings.api_keys.created.key_name_label") %></span>
                 <span class="text-primary font-medium"><%= @api_key.name %></span>
               </div>
               <div class="flex justify-between">
-                <span class="text-secondary">Permissions:</span>
+                <span class="text-secondary"><%= t("settings.api_keys.created.permissions_label") %></span>
                 <span class="text-primary">
                   <%= @api_key.scopes.map { |scope|
                     case scope
-                    when "read_accounts" then "View Accounts"
-                    when "read_transactions" then "View Transactions"
-                    when "read_balances" then "View Balances"
-                    when "write_transactions" then "Create Transactions"
+                    when "read_accounts" then t("settings.api_keys_controller.scope_descriptions.read_accounts")
+                    when "read_transactions" then t("settings.api_keys_controller.scope_descriptions.read_transactions")
+                    when "read_balances" then t("settings.api_keys_controller.scope_descriptions.read_balances")
+                    when "write_transactions" then t("settings.api_keys_controller.scope_descriptions.write_transactions")
                     else scope.humanize
                     end
                   }.join(", ") %>
                 </span>
               </div>
               <div class="flex justify-between">
-                <span class="text-secondary">Created:</span>
+                <span class="text-secondary"><%= t("settings.api_keys.created.created_label") %></span>
                 <span class="text-primary"><%= @api_key.created_at.strftime("%B %d, %Y at %I:%M %p") %></span>
               </div>
             </div>
           </div>
 
-          <div class="bg-warning-50 border border-warning-200 rounded-xl p-4">
-            <div class="flex items-start gap-2">
-              <%= icon("alert-triangle", class: "w-5 h-5 text-warning-600 mt-0.5") %>
-              <div>
-                <h4 class="font-medium text-warning-800 text-sm">Important Security Note</h4>
-                <p class="text-warning-700 text-sm mt-1">
-                  This is the only time your API key will be displayed. Make sure to copy it now and store it securely.
-                  If you lose this key, you'll need to generate a new one.
-                </p>
-              </div>
-            </div>
-          </div>
+          <%= render DS::Alert.new(title: t("settings.api_keys.created.security_note_title"), variant: :warning) do %>
+            <p>
+              <%= t("settings.api_keys.created.security_note_body") %>
+            </p>
+          <% end %>
 
           <div class="bg-surface-inset rounded-xl p-4">
-            <h4 class="font-medium text-primary mb-3">How to use your API key</h4>
-            <p class="text-secondary text-sm mb-3">Include your API key in the X-Api-Key header when making requests:</p>
+            <h4 class="font-medium text-primary mb-3"><%= t("settings.api_keys.created.usage_instructions_title") %></h4>
+            <p class="text-secondary text-sm mb-3"><%= t("settings.api_keys.show.current_api_key.usage_instructions", product_name: product_name) %></p>
             <div class="bg-container rounded-lg p-3 font-mono text-sm text-primary border border-primary">
               curl -H "X-Api-Key: <%= @api_key.plain_key %>" <%= request.base_url %>/api/v1/accounts
             </div>
@@ -90,7 +83,7 @@
 
           <div class="flex justify-end pt-4 border-t border-primary">
             <%= render DS::Link.new(
-              text: "Continue to API Key Settings",
+              text: t("settings.api_keys.created.continue"),
               href: settings_api_key_path,
               variant: "primary"
             ) %>
diff --git a/app/views/settings/api_keys/new.html.erb b/app/views/settings/api_keys/new.html.erb
index 20e322981..d37a24f70 100644
--- a/app/views/settings/api_keys/new.html.erb
+++ b/app/views/settings/api_keys/new.html.erb
@@ -1,20 +1,20 @@
-<%= content_for :page_title, "Create New API Key" %>
+<%= content_for :page_title, t(".create_new_api_key") %>
 
-<%= settings_section title: nil, subtitle: "Generate a new API key to access your Sure data programmatically." do %>
+<%= settings_section title: nil, subtitle: t(".subtitle") do %>
   <%= styled_form_with model: @api_key, url: settings_api_key_path, class: "space-y-4" do |form| %>
     <%= form.text_field :name,
-        placeholder: "e.g., My Budget App, Portfolio Tracker",
-        label: "API Key Name",
-        help_text: "Choose a descriptive name to help you identify this key later." %>
+        placeholder: t(".name_placeholder"),
+        label: t(".name_label"),
+        help_text: t(".name_help_text") %>
 
     <div>
-      <%= form.label :scopes, "Permissions", class: "block text-sm font-medium text-primary mb-2" %>
-      <p class="text-sm text-secondary mb-3">Select the permissions this API key should have:</p>
+      <%= form.label :scopes, t(".permissions_label"), class: "block text-sm font-medium text-primary mb-2" %>
+      <p class="text-sm text-secondary mb-3"><%= t(".permissions_help") %></p>
 
       <div class="space-y-2">
         <% [
-          ["read", "Read Only", "View your accounts, transactions, and balances"],
-          ["read_write", "Read/Write", "View your data and create new transactions"]
+          ["read", t(".scope_read_only"), t(".scope_read_only_description")],
+          ["read_write", t(".scope_read_write"), t(".scope_read_write_description")]
         ].each do |value, label, description| %>
           <div class="bg-surface-inset rounded-lg p-3 border border-primary">
             <label class="flex items-start gap-3 cursor-pointer">
@@ -30,28 +30,21 @@
       </div>
     </div>
 
-    <div class="bg-warning-50 border border-warning-200 rounded-xl p-4">
-      <div class="flex items-start gap-2">
-        <%= icon("alert-triangle", class: "w-5 h-5 text-warning-600 mt-0.5") %>
-        <div>
-          <h4 class="font-medium text-warning-800 text-sm">Security Warning</h4>
-          <p class="text-warning-700 text-sm mt-1">
-            Your API key will be displayed only once after creation. Make sure to copy and store it securely.
-            Anyone with access to this key can access your data according to the permissions you select.
-          </p>
-        </div>
-      </div>
-    </div>
+    <%= render DS::Alert.new(title: t(".security_warning_title"), variant: :warning) do %>
+      <p>
+        <%= t(".security_warning_body") %>
+      </p>
+    <% end %>
 
     <div class="flex justify-end gap-3 pt-4 border-t border-primary">
       <%= render DS::Link.new(
-        text: "Cancel",
+        text: t(".cancel"),
         href: settings_api_key_path,
         variant: "ghost"
       ) %>
 
       <%= render DS::Button.new(
-        text: "Save API Key",
+        text: t(".save_api_key"),
         variant: "primary",
         type: "submit"
       ) %>
diff --git a/app/views/settings/api_keys/show.html.erb b/app/views/settings/api_keys/show.html.erb
index 91e1bd322..c32e87349 100644
--- a/app/views/settings/api_keys/show.html.erb
+++ b/app/views/settings/api_keys/show.html.erb
@@ -1,5 +1,5 @@
 <% if @newly_created && @plain_key %>
-  <%= content_for :page_title, "API Key Created Successfully" %>
+  <%= content_for :page_title, t(".newly_created.page_title") %>
 
   <div class="bg-container rounded-xl shadow-border-xs p-4">
     <div class="space-y-4">
@@ -12,21 +12,21 @@
             variant: :success
           ) %>
           <div class="flex-1">
-            <h3 class="font-medium text-primary">API Key Created Successfully!</h3>
-            <p class="text-secondary text-sm mt-1">Your new API key "<%= @current_api_key.name %>" has been created and is ready to use.</p>
+            <h3 class="font-medium text-primary"><%= t(".newly_created.heading") %></h3>
+            <p class="text-secondary text-sm mt-1"><%= t(".newly_created.key_ready", name: @current_api_key.name) %></p>
           </div>
         </div>
       </div>
 
       <div class="bg-surface-inset rounded-xl p-4">
-        <h4 class="font-medium text-primary mb-3">Your API Key</h4>
-        <p class="text-secondary text-sm mb-3">Copy and store this key securely. You'll need it to authenticate your API requests.</p>
+        <h4 class="font-medium text-primary mb-3"><%= t(".newly_created.your_api_key") %></h4>
+        <p class="text-secondary text-sm mb-3"><%= t(".newly_created.copy_store_securely") %></p>
 
         <div class="bg-container rounded-lg p-3 border border-primary" data-controller="clipboard">
           <div class="flex items-center justify-between gap-3">
             <code id="api-key-display" class="font-mono text-sm text-primary break-all" data-clipboard-target="source"><%= @current_api_key.plain_key %></code>
             <%= render DS::Button.new(
-              text: "Copy API Key",
+              text: t(".newly_created.copy_api_key"),
               variant: "ghost",
               icon: "copy",
               data: { action: "clipboard#copy" }
@@ -36,8 +36,8 @@
       </div>
 
       <div class="bg-surface-inset rounded-xl p-4">
-        <h4 class="font-medium text-primary mb-3">How to use your API key</h4>
-        <p class="text-secondary text-sm mb-3">Include your API key in the X-Api-Key header when making requests:</p>
+        <h4 class="font-medium text-primary mb-3"><%= t(".newly_created.how_to_use") %></h4>
+        <p class="text-secondary text-sm mb-3"><%= t(".current_api_key.usage_instructions", product_name: product_name) %></p>
         <div class="bg-container rounded-lg p-3 font-mono text-sm text-primary border border-primary">
           curl -H "X-Api-Key: <%= @current_api_key.plain_key %>" <%= request.base_url %>/api/v1/accounts
         </div>
@@ -45,7 +45,7 @@
 
       <div class="flex justify-end pt-4 border-t border-primary">
         <%= render DS::Link.new(
-          text: "Continue to API Key Settings",
+          text: t(".newly_created.continue"),
           href: settings_api_key_path,
           variant: "primary"
         ) %>
@@ -53,10 +53,10 @@
     </div>
   </div>
 <% elsif @current_api_key %>
-  <%= content_for :page_title, "Your API Key" %>
+  <%= content_for :page_title, t(".current_api_key.title") %>
   <%= content_for :page_actions do %>
     <%= render DS::Link.new(
-      text: "Create New Key",
+      text: t(".current_api_key.regenerate_key"),
       href: new_settings_api_key_path(regenerate: true),
       variant: "secondary"
     ) %>
@@ -75,30 +75,30 @@
           <div class="text-sm space-y-1">
             <p class="text-primary font-medium"><%= @current_api_key.name %></p>
             <p class="text-secondary">
-              Created <%= time_ago_in_words(@current_api_key.created_at) %> ago
+              <%= t(".current_api_key.created_ago", time: time_ago_in_words(@current_api_key.created_at)) %>
               <% if @current_api_key.last_used_at %>
-                • Last used <%= time_ago_in_words(@current_api_key.last_used_at) %> ago
+                • <%= t(".current_api_key.last_used_ago", time: time_ago_in_words(@current_api_key.last_used_at)) %>
               <% else %>
-                • Never used
+                • <%= t(".current_api_key.never_used") %>
               <% end %>
             </p>
           </div>
         </div>
 
         <div class="rounded-md bg-success px-2 py-1">
-          <p class="text-success-foreground font-medium text-xs">Active</p>
+          <p class="text-success-foreground font-medium text-xs"><%= t(".current_api_key.active") %></p>
         </div>
       </div>
 
       <div class="bg-surface-inset rounded-xl p-4">
-        <h4 class="font-medium text-primary mb-3">Permissions</h4>
+        <h4 class="font-medium text-primary mb-3"><%= t(".current_api_key.permissions") %></h4>
         <div class="flex flex-wrap gap-2">
           <% @current_api_key.scopes.each do |scope| %>
-            <span class="inline-flex items-center gap-1 px-2 py-1 bg-primary text-primary-foreground rounded-full text-xs font-medium">
+            <span class="inline-flex items-center gap-1 px-2 py-1 button-bg-primary text-inverse rounded-full text-xs font-medium">
               <%= icon("shield-check", class: "w-3 h-3") %>
               <%= case scope
-                  when "read" then "Read Only"
-                  when "read_write" then "Read/Write"
+                  when "read" then t(".current_api_key.scope_read_only")
+                  when "read_write" then t(".current_api_key.scope_read_write")
                   else scope.humanize
                   end %>
             </span>
@@ -107,14 +107,14 @@
       </div>
 
       <div class="bg-surface-inset rounded-xl p-4">
-        <h4 class="font-medium text-primary mb-3">Your API Key</h4>
-        <p class="text-secondary text-sm mb-3">Copy and store this key securely. You'll need it to authenticate your API requests.</p>
+        <h4 class="font-medium text-primary mb-3"><%= t(".current_api_key.title") %></h4>
+        <p class="text-secondary text-sm mb-3"><%= t(".current_api_key.copy_store_securely") %></p>
 
         <div class="bg-container rounded-lg p-3 border border-primary" data-controller="clipboard">
           <div class="flex items-center justify-between gap-3">
             <code id="api-key-display" class="font-mono text-sm text-primary break-all" data-clipboard-target="source"><%= @current_api_key.plain_key %></code>
             <%= render DS::Button.new(
-              text: "Copy API Key",
+              text: t(".current_api_key.copy_api_key"),
               variant: "ghost",
               icon: "copy",
               data: { action: "clipboard#copy" }
@@ -124,8 +124,8 @@
       </div>
 
       <div class="bg-surface-inset rounded-xl p-4">
-        <h4 class="font-medium text-primary mb-3">How to use your API key</h4>
-        <p class="text-secondary text-sm mb-3">Include your API key in the X-Api-Key header when making requests:</p>
+        <h4 class="font-medium text-primary mb-3"><%= t(".current_api_key.usage_instructions_title") %></h4>
+        <p class="text-secondary text-sm mb-3"><%= t(".current_api_key.usage_instructions", product_name: product_name) %></p>
         <div class="bg-container rounded-lg p-3 font-mono text-sm text-primary border border-primary">
           curl -H "X-Api-Key: <%= @current_api_key.plain_key %>" <%= request.base_url %>/api/v1/accounts
         </div>
@@ -133,12 +133,12 @@
 
       <div class="flex justify-end pt-4 border-t border-primary">
         <%= render DS::Button.new(
-          text: "Revoke Key",
+          text: t(".current_api_key.revoke_key"),
           href: settings_api_key_path,
           method: :delete,
           variant: "destructive",
           data: {
-            turbo_confirm: "Are you sure you want to revoke this API key?"
+            turbo_confirm: t(".current_api_key.revoke_confirmation")
           }
         ) %>
       </div>
diff --git a/app/views/settings/bank_sync/_provider_link.html.erb b/app/views/settings/bank_sync/_provider_link.html.erb
deleted file mode 100644
index 32a2caf59..000000000
--- a/app/views/settings/bank_sync/_provider_link.html.erb
+++ /dev/null
@@ -1,32 +0,0 @@
-<%# locals: (provider_link:) %>
-
-<%# Assign distinct colors to each provider %>
-<% provider_colors = {
-  "Lunch Flow" => "#6471eb",
-  "Plaid" => "#4da568",
-  "SimpleFin" => "#e99537",
-  "Enable Banking" => "#6471eb",
-  "CoinStats" => "#FF9332" # https://coinstats.app/press-kit/
-} %>
-<% provider_color = provider_colors[provider_link[:name]] || "#6B7280" %>
-
-<%= link_to provider_link[:path],
-            target: provider_link[:target],
-            rel: provider_link[:rel],
-            class: "flex justify-between items-center p-4 bg-container hover:bg-container-hover transition-colors" do %>
-  <div class="flex w-full items-center gap-2.5">
-    <%= render partial: "shared/color_avatar", locals: { name: provider_link[:name], color: provider_color } %>
-
-    <div class="flex flex-col">
-      <p class="text-primary text-sm font-medium">
-        <%= provider_link[:name] %>
-      </p>
-      <p class="text-secondary text-xs">
-        <%= provider_link[:description] %>
-      </p>
-    </div>
-  </div>
-  <div class="justify-self-end">
-    <%= icon("arrow-right", size: "sm", class: "text-secondary") %>
-  </div>
-<% end %>
diff --git a/app/views/settings/bank_sync/show.html.erb b/app/views/settings/bank_sync/show.html.erb
deleted file mode 100644
index 51c42bfcb..000000000
--- a/app/views/settings/bank_sync/show.html.erb
+++ /dev/null
@@ -1,26 +0,0 @@
-<%= content_for :page_title, "Bank Sync" %>
-
-<div class="bg-container rounded-xl shadow-border-xs p-4">
-  <% if @providers.any? %>
-    <div class="rounded-xl bg-container-inset space-y-1 p-1">
-      <div class="flex items-center gap-1.5 px-4 py-2 text-xs font-medium text-secondary uppercase">
-        <p>PROVIDERS</p>
-        <span class="text-subdued">&middot;</span>
-        <p><%= @providers.count %></p>
-      </div>
-
-      <div class="bg-container rounded-lg shadow-border-xs">
-        <div class="overflow-hidden rounded-lg">
-          <%= render partial: "provider_link", collection: @providers, spacer_template: "shared/ruler" %>
-        </div>
-      </div>
-    </div>
-  <% else %>
-    <div class="flex justify-center items-center py-20">
-      <div class="text-center flex flex-col items-center max-w-[300px]">
-        <p class="text-primary mb-1 font-medium text-sm">No providers configured</p>
-        <p class="text-secondary text-sm">Configure providers to link your bank accounts.</p>
-      </div>
-    </div>
-  <% end %>
-</div>
diff --git a/app/views/settings/debugs/show.html.erb b/app/views/settings/debugs/show.html.erb
new file mode 100644
index 000000000..d55c4ce46
--- /dev/null
+++ b/app/views/settings/debugs/show.html.erb
@@ -0,0 +1,115 @@
+<%= content_for :page_title, t(".page_title") %>
+
+<div class="space-y-6">
+  <div class="bg-container rounded-xl shadow-border-xs p-4">
+    <h1 class="text-lg font-semibold text-primary"><%= t(".title") %></h1>
+    <p class="text-sm text-secondary mt-1"><%= t(".subtitle") %></p>
+  </div>
+
+  <div class="bg-container rounded-xl shadow-border-xs p-4">
+    <%= form_with url: settings_debug_path, method: :get, class: "grid grid-cols-1 md:grid-cols-2 xl:grid-cols-4 gap-4 items-end" do |f| %>
+      <div>
+        <%= f.label :category, t(".filters.category"), class: "block text-sm font-medium text-primary mb-1" %>
+        <%= f.select :category, options_for_select([[t(".filters.all"), ""]] + @categories.map { |value| [value, value] }, params[:category]), {}, class: "rounded-lg border border-primary px-3 py-2 text-sm bg-container-inset text-primary w-full" %>
+      </div>
+      <div>
+        <%= f.label :level, t(".filters.level"), class: "block text-sm font-medium text-primary mb-1" %>
+        <%= f.select :level, options_for_select([[t(".filters.all"), ""]] + @levels.map { |value| [value, value] }, params[:level]), {}, class: "rounded-lg border border-primary px-3 py-2 text-sm bg-container-inset text-primary w-full" %>
+      </div>
+      <div>
+        <%= f.label :source, t(".filters.source"), class: "block text-sm font-medium text-primary mb-1" %>
+        <%= f.select :source, options_for_select([[t(".filters.all"), ""]] + @sources.map { |value| [value, value] }, params[:source]), {}, class: "rounded-lg border border-primary px-3 py-2 text-sm bg-container-inset text-primary w-full" %>
+      </div>
+      <div>
+        <%= f.label :provider_key, t(".filters.provider"), class: "block text-sm font-medium text-primary mb-1" %>
+        <%= f.select :provider_key, options_for_select([[t(".filters.all"), ""]] + @provider_keys.map { |value| [value, value] }, params[:provider_key]), {}, class: "rounded-lg border border-primary px-3 py-2 text-sm bg-container-inset text-primary w-full" %>
+      </div>
+      <div>
+        <%= f.label :start_date, t(".filters.start_date"), class: "block text-sm font-medium text-primary mb-1" %>
+        <%= f.date_field :start_date, value: @start_date || params[:start_date], class: "rounded-lg border border-primary px-3 py-2 text-sm bg-container-inset text-primary w-full" %>
+      </div>
+      <div>
+        <%= f.label :end_date, t(".filters.end_date"), class: "block text-sm font-medium text-primary mb-1" %>
+        <%= f.date_field :end_date, value: @end_date || params[:end_date], class: "rounded-lg border border-primary px-3 py-2 text-sm bg-container-inset text-primary w-full" %>
+      </div>
+      <div>
+        <%= f.label :family_id, t(".filters.family_id"), class: "block text-sm font-medium text-primary mb-1" %>
+        <%= f.text_field :family_id, value: params[:family_id], class: "rounded-lg border border-primary px-3 py-2 text-sm bg-container-inset text-primary w-full font-mono" %>
+      </div>
+      <div>
+        <%= f.label :account_id, t(".filters.account_id"), class: "block text-sm font-medium text-primary mb-1" %>
+        <%= f.text_field :account_id, value: params[:account_id], class: "rounded-lg border border-primary px-3 py-2 text-sm bg-container-inset text-primary w-full font-mono" %>
+      </div>
+      <div>
+        <%= f.label :user_id, t(".filters.user_id"), class: "block text-sm font-medium text-primary mb-1" %>
+        <%= f.text_field :user_id, value: params[:user_id], class: "rounded-lg border border-primary px-3 py-2 text-sm bg-container-inset text-primary w-full font-mono" %>
+      </div>
+      <div>
+        <%= f.label :account_provider_id, t(".filters.account_provider_id"), class: "block text-sm font-medium text-primary mb-1" %>
+        <%= f.text_field :account_provider_id, value: params[:account_provider_id], class: "rounded-lg border border-primary px-3 py-2 text-sm bg-container-inset text-primary w-full font-mono" %>
+      </div>
+      <div class="flex gap-2 xl:col-span-2">
+        <%= render DS::Button.new(variant: :primary, size: :md, type: "submit", text: t(".filters.submit"), class: "justify-center") %>
+        <%= render DS::Link.new(text: t(".filters.reset"), href: settings_debug_path, variant: "ghost") %>
+      </div>
+    <% end %>
+  </div>
+
+  <div class="bg-container rounded-xl shadow-border-xs overflow-hidden">
+    <% if @debug_log_entries.any? %>
+      <div class="overflow-x-auto">
+        <table class="w-full">
+          <thead class="bg-surface border-b border-primary">
+            <tr>
+              <th class="px-4 py-3 text-left text-xs font-medium text-secondary uppercase"><%= t(".table.time") %></th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-secondary uppercase"><%= t(".table.level") %></th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-secondary uppercase"><%= t(".table.category") %></th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-secondary uppercase"><%= t(".table.source") %></th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-secondary uppercase"><%= t(".table.message") %></th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-secondary uppercase"><%= t(".table.context") %></th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-secondary uppercase"><%= t(".table.metadata") %></th>
+            </tr>
+          </thead>
+          <tbody class="divide-y divide-alpha-black-200 theme-dark:divide-alpha-white-200">
+            <% @debug_log_entries.each do |entry| %>
+              <tr>
+                <td class="px-4 py-3 text-sm text-primary whitespace-nowrap"><%= l(entry.created_at, format: :long) %></td>
+                <td class="px-4 py-3 text-sm text-primary whitespace-nowrap"><%= entry.level %></td>
+                <td class="px-4 py-3 text-sm text-primary whitespace-nowrap"><%= entry.category %></td>
+                <td class="px-4 py-3 text-sm text-primary font-mono"><%= entry.source %></td>
+                <td class="px-4 py-3 text-sm text-primary"><%= entry.message %></td>
+                <td class="px-4 py-3 text-xs text-secondary font-mono whitespace-nowrap align-top">
+                  <div><%= t(".context.provider", value: entry.provider_key.presence || t(".missing_value")) %></div>
+                  <div><%= t(".context.family", value: entry.family_id || t(".missing_value")) %></div>
+                  <div><%= t(".context.account", value: entry.account_id || t(".missing_value")) %></div>
+                  <div><%= t(".context.user", value: entry.user_id || t(".missing_value")) %></div>
+                  <div><%= t(".context.account_provider", value: entry.account_provider_id || t(".missing_value")) %></div>
+                </td>
+                <td class="px-4 py-3 text-xs text-secondary align-top">
+                  <% if entry.metadata.present? %>
+                    <%= render DS::Disclosure.new(variant: :inline) do |disclosure| %>
+                      <% disclosure.with_summary_content do %>
+                        <span class="text-xs text-secondary"><%= t(".table.view_metadata") %></span>
+                      <% end %>
+                      <pre class="whitespace-pre-wrap break-words"><%= JSON.pretty_generate(entry.metadata) %></pre>
+                    <% end %>
+                  <% else %>
+                    <%= t(".missing_value") %>
+                  <% end %>
+                </td>
+              </tr>
+            <% end %>
+          </tbody>
+        </table>
+      </div>
+    <% else %>
+      <div class="p-8 text-center text-secondary"><%= t(".empty") %></div>
+    <% end %>
+  </div>
+
+  <% if @pagy.pages > 1 %>
+    <div>
+      <%= render "shared/pagination", pagy: @pagy %>
+    </div>
+  <% end %>
+</div>
diff --git a/app/views/settings/hostings/_alpha_vantage_settings.html.erb b/app/views/settings/hostings/_alpha_vantage_settings.html.erb
new file mode 100644
index 000000000..8a9249541
--- /dev/null
+++ b/app/views/settings/hostings/_alpha_vantage_settings.html.erb
@@ -0,0 +1,41 @@
+<div class="space-y-4">
+  <div>
+    <h2 class="font-medium mb-1"><%= t(".title") %></h2>
+    <% if ENV["ALPHA_VANTAGE_API_KEY"].present? %>
+      <p class="text-sm text-secondary"><%= t(".env_configured_message") %></p>
+    <% else %>
+      <div class="text-secondary text-sm mb-4">
+        <span><%= t(".description") %></span>
+        <details class="inline">
+          <summary class="cursor-pointer font-medium text-secondary underline inline"> <%= t(".show_details") %></summary>
+          <ol class="text-sm text-secondary mt-2 list-decimal ml-6 space-y-2">
+            <li><%= t(".step_1_html") %></li>
+            <li><%= t(".step_2") %></li>
+          </ol>
+        </details>
+      </div>
+    <% end %>
+  </div>
+
+  <%= styled_form_with model: Setting.new,
+                       url: settings_hosting_path,
+                       method: :patch,
+                       data: {
+                         controller: "auto-submit-form",
+                         "auto-submit-form-trigger-event-value": "blur"
+                       } do |form| %>
+    <% has_key = ENV["ALPHA_VANTAGE_API_KEY"].present? || Setting.alpha_vantage_api_key.present? %>
+    <%= form.text_field :alpha_vantage_api_key,
+                        label: t(".label"),
+                        type: "password",
+                        placeholder: t(".placeholder"),
+                        value: has_key ? "********" : "",
+                        disabled: ENV["ALPHA_VANTAGE_API_KEY"].present?,
+                        data: { "auto-submit-form-target": "auto" } %>
+  <% end %>
+
+  <%= render DS::Alert.new(variant: :warning) do %>
+    <p><%= t(".rate_limit_warning") %></p>
+    <p><%= t(".no_health_check_note") %></p>
+  <% end %>
+</div>
diff --git a/app/views/settings/hostings/_assistant_settings.html.erb b/app/views/settings/hostings/_assistant_settings.html.erb
index 082fddde7..37e5bbc65 100644
--- a/app/views/settings/hostings/_assistant_settings.html.erb
+++ b/app/views/settings/hostings/_assistant_settings.html.erb
@@ -54,12 +54,12 @@
         <%= button_to t(".disconnect_button"),
               disconnect_external_assistant_settings_hosting_path,
               method: :delete,
-              class: "bg-red-600 fg-inverse text-sm font-medium rounded-lg px-4 py-2 whitespace-nowrap",
+              class: "bg-red-600 text-inverse text-sm font-medium rounded-lg px-4 py-2 whitespace-nowrap",
               data: { turbo_confirm: {
                 title: t(".confirm_disconnect.title"),
                 body: t(".confirm_disconnect.body"),
                 accept: t(".disconnect_button"),
-                acceptClass: "w-full bg-red-600 fg-inverse rounded-xl text-center p-[10px] border mb-2"
+                acceptClass: "w-full bg-red-600 text-inverse rounded-xl text-center p-[10px] border mb-2"
               }} %>
       </div>
     <% end %>
diff --git a/app/views/settings/hostings/_brand_fetch_settings.html.erb b/app/views/settings/hostings/_brand_fetch_settings.html.erb
index ea83248e4..03c52701f 100644
--- a/app/views/settings/hostings/_brand_fetch_settings.html.erb
+++ b/app/views/settings/hostings/_brand_fetch_settings.html.erb
@@ -2,21 +2,21 @@
   <div>
     <h2 class="font-medium mb-1"><%= t(".title") %></h2>
     <% if ENV["BRAND_FETCH_CLIENT_ID"].present? %>
-      <p class="text-sm text-secondary">You have successfully configured your Brand Fetch Client ID through the BRAND_FETCH_CLIENT_ID environment variable.</p>
+      <p class="text-sm text-secondary"><%= t(".env_configured_message") %></p>
     <% else %>
       <div class="text-secondary text-sm mb-4">
         <span><%= t(".description") %></span>
         <details class="inline">
-          <summary class="cursor-pointer font-medium text-secondary underline inline"> (show details)</summary>
+          <summary class="cursor-pointer font-medium text-secondary underline inline"> <%= t(".show_details") %></summary>
           <ol class="text-sm text-secondary mt-2 list-decimal ml-6 space-y-2">
             <li>
-              Visit <a href="https://brandfetch.com/developers" target="_blank" rel="noopener noreferrer" class="underline">brandfetch.com</a> and create a free Brand Fetch Developer account.
+              <%= t(".setup_step_1_html") %>
             </li>
             <li>
-              Go to the <a href="https://developers.brandfetch.com/dashboard/logo-api" target="_blank" rel="noopener noreferrer" class="underline">Logo API</a> page.
+              <%= t(".setup_step_2_html") %>
             </li>
             <li>
-              Tap the eye icon under the "Your Client ID" section to reveal your <strong>Client ID</strong> and paste it below.
+              <%= t(".setup_step_3") %>
             </li>
           </ol>
         </details>
diff --git a/app/views/settings/hostings/_danger_zone_settings.html.erb b/app/views/settings/hostings/_danger_zone_settings.html.erb
index 18cfd4d03..23e26644e 100644
--- a/app/views/settings/hostings/_danger_zone_settings.html.erb
+++ b/app/views/settings/hostings/_danger_zone_settings.html.erb
@@ -7,12 +7,12 @@
       </div>
       <%=
             button_to t("settings.hostings.show.clear_cache"), clear_cache_settings_hosting_path, method: :delete,
-              class: "w-full md:w-auto bg-yellow-600 fg-inverse text-sm font-medium rounded-lg px-4 py-2",
+              class: "w-full md:w-auto bg-yellow-600 text-inverse text-sm font-medium rounded-lg px-4 py-2",
               data: { turbo_confirm: {
                 title: t("settings.hostings.show.confirm_clear_cache.title"),
                 body: t("settings.hostings.show.confirm_clear_cache.body"),
                 accept: t("settings.hostings.show.clear_cache"),
-                acceptClass: "w-full bg-yellow-600 fg-inverse rounded-xl text-center p-[10px] border mb-2"
+                acceptClass: "w-full bg-yellow-600 text-inverse rounded-xl text-center p-[10px] border mb-2"
               }}
       %>
     </div>
diff --git a/app/views/settings/hostings/_eodhd_settings.html.erb b/app/views/settings/hostings/_eodhd_settings.html.erb
new file mode 100644
index 000000000..0636da678
--- /dev/null
+++ b/app/views/settings/hostings/_eodhd_settings.html.erb
@@ -0,0 +1,39 @@
+<div class="space-y-4">
+  <div>
+    <h2 class="font-medium mb-1"><%= t(".title") %></h2>
+    <% if ENV["EODHD_API_KEY"].present? %>
+      <p class="text-sm text-secondary"><%= t(".env_configured_message") %></p>
+    <% else %>
+      <div class="text-secondary text-sm mb-4">
+        <span><%= t(".description") %></span>
+        <details class="inline">
+          <summary class="cursor-pointer font-medium text-secondary underline inline"> <%= t(".show_details") %></summary>
+          <ol class="text-sm text-secondary mt-2 list-decimal ml-6 space-y-2">
+            <li><%= t(".step_1_html") %></li>
+            <li><%= t(".step_2_html") %></li>
+            <li><%= t(".step_3") %></li>
+          </ol>
+        </details>
+      </div>
+    <% end %>
+  </div>
+
+  <%= styled_form_with model: Setting.new,
+                       url: settings_hosting_path,
+                       method: :patch,
+                       data: {
+                         controller: "auto-submit-form",
+                         "auto-submit-form-trigger-event-value": "blur"
+                       } do |form| %>
+    <% has_key = ENV["EODHD_API_KEY"].present? || Setting.eodhd_api_key.present? %>
+    <%= form.text_field :eodhd_api_key,
+                        label: t(".label"),
+                        type: "password",
+                        placeholder: t(".placeholder"),
+                        value: has_key ? "********" : "",
+                        disabled: ENV["EODHD_API_KEY"].present?,
+                        data: { "auto-submit-form-target": "auto" } %>
+  <% end %>
+
+  <%= render DS::Alert.new(message: t(".rate_limit_warning"), variant: :warning) %>
+</div>
diff --git a/app/views/settings/hostings/_openai_settings.html.erb b/app/views/settings/hostings/_openai_settings.html.erb
index 6691d9556..b54dd7671 100644
--- a/app/views/settings/hostings/_openai_settings.html.erb
+++ b/app/views/settings/hostings/_openai_settings.html.erb
@@ -63,5 +63,37 @@
                   { disabled: ENV["LLM_JSON_MODE"].present?,
                     data: { "auto-submit-form-target": "auto" } } %>
   <p class="text-xs text-secondary mt-1"><%= t(".json_mode_help") %></p>
+
+  <div class="pt-4 border-t border-secondary">
+    <h3 class="font-medium mb-1"><%= t(".budget_heading") %></h3>
+    <p class="text-xs text-secondary mb-3"><%= t(".budget_description") %></p>
+
+    <%= form.number_field :llm_context_window,
+                          label: t(".context_window_label"),
+                          placeholder: "2048",
+                          value: Setting.llm_context_window,
+                          min: 256,
+                          disabled: ENV["LLM_CONTEXT_WINDOW"].present?,
+                          data: { "auto-submit-form-target": "auto" } %>
+    <p class="text-xs text-secondary mt-1 mb-3"><%= t(".context_window_help") %></p>
+
+    <%= form.number_field :llm_max_response_tokens,
+                          label: t(".max_response_tokens_label"),
+                          placeholder: "512",
+                          value: Setting.llm_max_response_tokens,
+                          min: 64,
+                          disabled: ENV["LLM_MAX_RESPONSE_TOKENS"].present?,
+                          data: { "auto-submit-form-target": "auto" } %>
+    <p class="text-xs text-secondary mt-1 mb-3"><%= t(".max_response_tokens_help") %></p>
+
+    <%= form.number_field :llm_max_items_per_call,
+                          label: t(".max_items_per_call_label"),
+                          placeholder: "25",
+                          value: Setting.llm_max_items_per_call,
+                          min: 1,
+                          disabled: ENV["LLM_MAX_ITEMS_PER_CALL"].present?,
+                          data: { "auto-submit-form-target": "auto" } %>
+    <p class="text-xs text-secondary mt-1"><%= t(".max_items_per_call_help") %></p>
+  </div>
   <% end %>
 </div>
diff --git a/app/views/settings/hostings/_provider_selection.html.erb b/app/views/settings/hostings/_provider_selection.html.erb
index 55dde1e88..4e38bb38f 100644
--- a/app/views/settings/hostings/_provider_selection.html.erb
+++ b/app/views/settings/hostings/_provider_selection.html.erb
@@ -1,17 +1,16 @@
-<div class="space-y-4">
-  <div>
-    <h2 class="font-medium mb-1"><%= t(".title") %></h2>
-    <p class="text-secondary text-sm mb-4"><%= t(".description") %></p>
-  </div>
+<div class="space-y-6">
+  <%# Exchange Rate Provider - single dropdown %>
+  <div class="space-y-2">
+    <h3 class="font-medium text-sm"><%= t(".exchange_rate_title") %></h3>
+    <p class="text-secondary text-xs mb-2"><%= t(".exchange_rate_description") %></p>
 
-  <%= styled_form_with model: Setting.new,
-                       url: settings_hosting_path,
-                       method: :patch,
-                       data: {
-                         controller: "auto-submit-form",
-                         "auto-submit-form-trigger-event-value": "change"
-                       } do |form| %>
-    <div class="space-y-4">
+    <%= styled_form_with model: Setting.new,
+                         url: settings_hosting_path,
+                         method: :patch,
+                         data: {
+                           controller: "auto-submit-form",
+                           "auto-submit-form-trigger-event-value": "change"
+                         } do |form| %>
       <%= form.select :exchange_rate_provider,
                       [
                         [t(".providers.twelve_data"), "twelve_data"],
@@ -23,29 +22,55 @@
                         disabled: ENV["EXCHANGE_RATE_PROVIDER"].present?,
                         data: { "auto-submit-form-target": "auto" }
                       } %>
+    <% end %>
+  </div>
 
-      <%= form.select :securities_provider,
-                      [
-                        [t(".providers.twelve_data"), "twelve_data"],
-                        [t(".providers.yahoo_finance"), "yahoo_finance"]
-                      ],
-                      { label: t(".securities_provider_label") },
-                      {
-                        value: ENV.fetch("SECURITIES_PROVIDER", Setting.securities_provider),
-                        disabled: ENV["SECURITIES_PROVIDER"].present?,
-                        data: { "auto-submit-form-target": "auto" }
-                      } %>
-    </div>
+  <%# Securities Providers - multiple checkboxes %>
+  <div class="space-y-2">
+    <h3 class="font-medium text-sm"><%= t(".securities_title") %></h3>
+    <p class="text-secondary text-xs mb-2"><%= t(".securities_description") %></p>
 
-    <% if ENV["EXCHANGE_RATE_PROVIDER"].present? || ENV["SECURITIES_PROVIDER"].present? %>
-      <div class="mt-4 bg-warning-50 border border-warning-200 rounded-lg p-3">
-        <div class="flex items-start gap-2">
-          <%= icon("alert-circle", class: "w-5 h-5 text-warning-600 mt-0.5 shrink-0") %>
-          <p class="text-sm text-warning-800">
-            <%= t(".env_configured_message") %>
-          </p>
-        </div>
+    <%= styled_form_with model: Setting.new,
+                         url: settings_hosting_path,
+                         method: :patch,
+                         data: {
+                           controller: "auto-submit-form"
+                         } do |form| %>
+      <% disabled = ENV["SECURITIES_PROVIDERS"].present? || ENV["SECURITIES_PROVIDER"].present? %>
+      <% enabled_providers = Setting.enabled_securities_providers %>
+
+      <div class="space-y-2">
+        <%# Hidden field to ensure empty array is submitted when all unchecked %>
+        <input type="hidden" name="setting[securities_providers][]" value="">
+
+        <% [
+          ["twelve_data", t(".providers.twelve_data"), t(".twelve_data_hint")],
+          ["yahoo_finance", t(".providers.yahoo_finance"), t(".yahoo_finance_hint")],
+          ["tiingo", t(".providers.tiingo"), t(".requires_api_key")],
+          ["eodhd", t(".providers.eodhd"), t(".requires_api_key_eodhd")],
+          ["alpha_vantage", t(".providers.alpha_vantage"), t(".requires_api_key_alpha_vantage")],
+          ["mfapi", t(".providers.mfapi"), t(".mfapi_hint")],
+          ["binance_public", t(".providers.binance_public"), t(".binance_public_hint")],
+        ].each do |value, label, hint| %>
+          <label class="flex items-center gap-2 cursor-pointer">
+            <input type="checkbox"
+                   name="setting[securities_providers][]"
+                   value="<%= value %>"
+                   class="rounded border-primary text-primary focus:ring-primary"
+                   <%= "checked" if enabled_providers.include?(value) %>
+                   <%= "disabled" if disabled %>
+                   data-auto-submit-form-target="auto">
+            <span class="text-sm"><%= label %></span>
+            <% if hint %>
+              <span class="text-xs text-secondary">(<%= hint %>)</span>
+            <% end %>
+          </label>
+        <% end %>
       </div>
     <% end %>
+  </div>
+
+  <% if ENV["EXCHANGE_RATE_PROVIDER"].present? || ENV["SECURITIES_PROVIDERS"].present? || ENV["SECURITIES_PROVIDER"].present? %>
+    <%= render DS::Alert.new(message: t(".env_configured_message"), variant: :warning) %>
   <% end %>
 </div>
diff --git a/app/views/settings/hostings/_tiingo_settings.html.erb b/app/views/settings/hostings/_tiingo_settings.html.erb
new file mode 100644
index 000000000..af2cf0ff8
--- /dev/null
+++ b/app/views/settings/hostings/_tiingo_settings.html.erb
@@ -0,0 +1,37 @@
+<div class="space-y-4">
+  <div>
+    <h2 class="font-medium mb-1"><%= t(".title") %></h2>
+    <% if ENV["TIINGO_API_KEY"].present? %>
+      <p class="text-sm text-secondary"><%= t(".env_configured_message") %></p>
+    <% else %>
+      <div class="text-secondary text-sm mb-4">
+        <span><%= t(".description") %></span>
+        <details class="inline">
+          <summary class="cursor-pointer font-medium text-secondary underline inline"> <%= t(".show_details") %></summary>
+          <ol class="text-sm text-secondary mt-2 list-decimal ml-6 space-y-2">
+            <li><%= t(".step_1_html") %></li>
+            <li><%= t(".step_2_html") %></li>
+            <li><%= t(".step_3") %></li>
+          </ol>
+        </details>
+      </div>
+    <% end %>
+  </div>
+
+  <%= styled_form_with model: Setting.new,
+                       url: settings_hosting_path,
+                       method: :patch,
+                       data: {
+                         controller: "auto-submit-form",
+                         "auto-submit-form-trigger-event-value": "blur"
+                       } do |form| %>
+    <% has_key = ENV["TIINGO_API_KEY"].present? || Setting.tiingo_api_key.present? %>
+    <%= form.text_field :tiingo_api_key,
+                        label: t(".label"),
+                        type: "password",
+                        placeholder: t(".placeholder"),
+                        value: has_key ? "********" : "",
+                        disabled: ENV["TIINGO_API_KEY"].present?,
+                        data: { "auto-submit-form-target": "auto" } %>
+  <% end %>
+</div>
diff --git a/app/views/settings/hostings/_twelve_data_settings.html.erb b/app/views/settings/hostings/_twelve_data_settings.html.erb
index b6275491a..9dbb77289 100644
--- a/app/views/settings/hostings/_twelve_data_settings.html.erb
+++ b/app/views/settings/hostings/_twelve_data_settings.html.erb
@@ -7,17 +7,11 @@
       <div class="text-secondary text-sm mb-4">
         <span><%= t(".description") %></span>
         <details class="inline">
-          <summary class="cursor-pointer font-medium text-secondary underline inline"> (show details)</summary>
+          <summary class="cursor-pointer font-medium text-secondary underline inline"> <%= t(".show_details") %></summary>
           <ol class="text-sm text-secondary mt-2 list-decimal ml-6 space-y-2">
-            <li>
-              Visit <a href="https://twelvedata.com/register" target="_blank" rel="noopener noreferrer" class="underline">twelvedata.com</a> and create a free Twelve Data Developer account.
-            </li>
-            <li>
-              Go to the <a href="https://twelvedata.com/account/api-keys" target="_blank" rel="noopener noreferrer" class="underline">API Keys</a> page.
-            </li>
-            <li>
-              Reveal your <strong>Secret Key</strong> and paste it below.
-            </li>
+            <li><%= t(".step_1_html") %></li>
+            <li><%= t(".step_2_html") %></li>
+            <li><%= t(".step_3") %></li>
           </ol>
         </details>
       </div>
@@ -31,11 +25,12 @@
                          controller: "auto-submit-form",
                          "auto-submit-form-trigger-event-value": "blur"
                        } do |form| %>
+    <% has_key = ENV["TWELVE_DATA_API_KEY"].present? || Setting.twelve_data_api_key.present? %>
     <%= form.text_field :twelve_data_api_key,
                         label: t(".label"),
                         type: "password",
                         placeholder: t(".placeholder"),
-                        value: ENV.fetch("TWELVE_DATA_API_KEY", Setting.twelve_data_api_key),
+                        value: has_key ? "********" : "",
                         disabled: ENV["TWELVE_DATA_API_KEY"].present?,
                         container_class: @twelve_data_usage.present? && !@twelve_data_usage.success? ? "border-red-500" : "",
                         data: { "auto-submit-form-target": "auto" } %>
@@ -50,42 +45,38 @@
                 limit: number_with_delimiter(@twelve_data_usage.data.limit),
                 percentage: number_to_percentage(@twelve_data_usage.data.utilization, precision: 1)) %>
         </p>
-        <div class="w-52 h-1.5 bg-gray-100 rounded-2xl">
+        <div class="w-52 h-1.5 bg-surface-inset rounded-2xl">
           <div class="h-full bg-green-500 rounded-2xl"
                style="width: <%= [@twelve_data_usage.data.utilization, 2].max %>%;"></div>
         </div>
       </div>
-      <div class="bg-gray-100 rounded-md px-1.5 py-0.5 w-fit">
+      <div class="bg-surface-inset rounded-md px-1.5 py-0.5 w-fit">
         <p class="text-xs font-medium text-secondary uppercase">
           <%= t(".plan", plan: @twelve_data_usage.data.plan) %>
         </p>
       </div>
 
       <% if @plan_restricted_securities.present? %>
-        <div class="bg-amber-50 border border-amber-200 rounded-lg p-3 mt-4">
-          <div class="flex items-start gap-2">
-            <%= icon("alert-triangle", size: "sm", class: "text-amber-600 mt-0.5") %>
-            <div class="text-sm">
-              <p class="font-medium text-amber-800"><%= t(".plan_upgrade_warning_title") %></p>
-              <p class="text-amber-700 mt-1"><%= t(".plan_upgrade_warning_description") %></p>
-              <ul class="mt-2 space-y-1">
-                <% @plan_restricted_securities.each do |security| %>
-                  <li class="text-amber-700">
-                    <span class="font-medium"><%= security[:ticker] %></span>
-                    <% if security[:name].present? %>
-                      <span class="text-amber-600">(<%= security[:name] %>)</span>
-                    <% end %>
-                    <span class="text-amber-600">— <%= t(".requires_plan", plan: security[:required_plan]) %></span>
-                  </li>
-                <% end %>
-              </ul>
-              <p class="mt-2">
-                <a href="https://twelvedata.com/pricing" target="_blank" rel="noopener noreferrer" class="text-amber-800 underline font-medium">
-                  <%= t(".view_pricing") %>
-                </a>
-              </p>
-            </div>
-          </div>
+        <div class="mt-4">
+          <%= render DS::Alert.new(title: t(".plan_upgrade_warning_title"), variant: :warning) do %>
+            <p><%= t(".plan_upgrade_warning_description") %></p>
+            <ul class="space-y-1">
+              <% @plan_restricted_securities.each do |security| %>
+                <li>
+                  <span class="font-medium text-primary"><%= security[:ticker] %></span>
+                  <% if security[:name].present? %>
+                    <span class="text-secondary">(<%= security[:name] %>)</span>
+                  <% end %>
+                  <span class="text-secondary">— <%= t(".requires_plan", plan: security[:required_plan]) %></span>
+                </li>
+              <% end %>
+            </ul>
+            <p>
+              <a href="https://twelvedata.com/pricing" target="_blank" rel="noopener noreferrer" class="text-link underline font-medium">
+                <%= t(".view_pricing") %>
+              </a>
+            </p>
+          <% end %>
         </div>
       <% end %>
     </div>
diff --git a/app/views/settings/hostings/_yahoo_finance_settings.html.erb b/app/views/settings/hostings/_yahoo_finance_settings.html.erb
index 33676f547..1ed8044b6 100644
--- a/app/views/settings/hostings/_yahoo_finance_settings.html.erb
+++ b/app/views/settings/hostings/_yahoo_finance_settings.html.erb
@@ -20,19 +20,11 @@
           <%= t(".status_inactive") %>
         </p>
       </div>
-      <div class="bg-destructive-50 border border-destructive-200 rounded-lg p-3">
-        <div class="flex items-start gap-2">
-          <%= icon("alert-circle", class: "w-5 h-5 text-destructive-600 mt-0.5 shrink-0") %>
-          <div>
-            <h3 class="text-sm font-medium text-destructive-800">
-              <%= t(".connection_failed") %>
-            </h3>
-            <div class="mt-2 text-sm text-destructive-700">
-              <p><%= t(".troubleshooting") %></p>
-            </div>
-          </div>
-        </div>
-      </div>
+      <%= render DS::Alert.new(
+        title: t(".connection_failed"),
+        message: t(".troubleshooting"),
+        variant: :warning
+      ) %>
     </div>
   <% end %>
 </div>
diff --git a/app/views/settings/hostings/show.html.erb b/app/views/settings/hostings/show.html.erb
index 354cf86a4..6312f900e 100644
--- a/app/views/settings/hostings/show.html.erb
+++ b/app/views/settings/hostings/show.html.erb
@@ -17,6 +17,15 @@
     <% if @show_twelve_data_settings %>
       <%= render "settings/hostings/twelve_data_settings" %>
     <% end %>
+    <% if @show_tiingo_settings %>
+      <%= render "settings/hostings/tiingo_settings" %>
+    <% end %>
+    <% if @show_eodhd_settings %>
+      <%= render "settings/hostings/eodhd_settings" %>
+    <% end %>
+    <% if @show_alpha_vantage_settings %>
+      <%= render "settings/hostings/alpha_vantage_settings" %>
+    <% end %>
   </div>
 <% end %>
 <%= settings_section title: t(".sync_settings") do %>
diff --git a/app/views/settings/llm_usages/show.html.erb b/app/views/settings/llm_usages/show.html.erb
index c2d4660af..39929a55b 100644
--- a/app/views/settings/llm_usages/show.html.erb
+++ b/app/views/settings/llm_usages/show.html.erb
@@ -1,22 +1,22 @@
-<%= content_for :page_title, "LLM Usage & Costs" %>
+<%= content_for :page_title, t(".page_title") %>
 
 <div class="bg-container rounded-xl shadow-border-xs p-4">
   <div class="mb-6">
-    <p class="text-sm text-secondary">Track your AI usage and estimated costs</p>
+    <p class="text-sm text-secondary"><%= t(".subtitle") %></p>
   </div>
 
   <!-- Date Range Filter -->
   <div class="mb-6">
     <%= form_with url: settings_llm_usage_path, method: :get, class: "flex gap-4 items-end flex-wrap" do |f| %>
       <div class="w-full md:w-auto">
-        <%= f.label :start_date, "Start Date", class: "block text-sm font-medium text-primary mb-1" %>
+        <%= f.label :start_date, t(".start_date"), class: "block text-sm font-medium text-primary mb-1" %>
         <%= f.date_field :start_date, value: @start_date, class: "rounded-lg border border-primary px-3 py-2 text-sm bg-container-inset text-primary w-full" %>
       </div>
       <div class="w-full md:w-auto">
-        <%= f.label :end_date, "End Date", class: "block text-sm font-medium text-primary mb-1" %>
+        <%= f.label :end_date, t(".end_date"), class: "block text-sm font-medium text-primary mb-1" %>
         <%= f.date_field :end_date, value: @end_date, class: "rounded-lg border border-primary px-3 py-2 text-sm bg-container-inset text-primary w-full" %>
       </div>
-      <%= render DS::Button.new(variant: :primary, size: :md, type: "submit", text: "Filter", class: "md:w-auto w-full justify-center") %>
+      <%= render DS::Button.new(variant: :primary, size: :md, type: "submit", text: t(".filter"), class: "md:w-auto w-full justify-center") %>
     <% end %>
   </div>
 
@@ -25,7 +25,7 @@
     <div class="bg-container-inset rounded-lg p-4">
       <div class="flex items-center gap-2 mb-2">
         <%= icon "activity", class: "w-5 h-5 text-secondary" %>
-        <p class="text-xs font-medium text-secondary uppercase">Total Requests</p>
+        <p class="text-xs font-medium text-secondary uppercase"><%= t(".total_requests") %></p>
       </div>
       <p class="text-2xl font-semibold text-primary"><%= number_with_delimiter(@statistics[:total_requests]) %></p>
     </div>
@@ -33,19 +33,19 @@
     <div class="bg-container-inset rounded-lg p-4">
       <div class="flex items-center gap-2 mb-2">
         <%= icon "hash", class: "w-5 h-5 text-secondary" %>
-        <p class="text-xs font-medium text-secondary uppercase">Total Tokens</p>
+        <p class="text-xs font-medium text-secondary uppercase"><%= t(".total_tokens") %></p>
       </div>
       <p class="text-2xl font-semibold text-primary"><%= number_with_delimiter(@statistics[:total_tokens]) %></p>
       <p class="text-xs text-secondary mt-1">
-        <%= number_with_delimiter(@statistics[:total_prompt_tokens]) %> prompt /
-        <%= number_with_delimiter(@statistics[:total_completion_tokens]) %> completion
+        <%= number_with_delimiter(@statistics[:total_prompt_tokens]) %> <%= t(".prompt") %> /
+        <%= number_with_delimiter(@statistics[:total_completion_tokens]) %> <%= t(".completion") %>
       </p>
     </div>
 
     <div class="bg-container-inset rounded-lg p-4">
       <div class="flex items-center gap-2 mb-2">
         <%= icon "dollar-sign", class: "w-5 h-5 text-secondary" %>
-        <p class="text-xs font-medium text-secondary uppercase">Total Cost</p>
+        <p class="text-xs font-medium text-secondary uppercase"><%= t(".total_cost") %></p>
       </div>
       <p class="text-2xl font-semibold text-primary">$<%= sprintf("%.2f", @statistics[:total_cost]) %></p>
     </div>
@@ -53,15 +53,14 @@
     <div class="bg-container-inset rounded-lg p-4">
       <div class="flex items-center gap-2 mb-2">
         <%= icon "trending-up", class: "w-5 h-5 text-secondary" %>
-        <p class="text-xs font-medium text-secondary uppercase">Avg Cost/Request</p>
+        <p class="text-xs font-medium text-secondary uppercase"><%= t(".avg_cost_per_request") %></p>
       </div>
       <p class="text-2xl font-semibold text-primary">
         $<%= sprintf("%.4f", @statistics[:avg_cost]) %>
       </p>
       <% if @statistics[:requests_with_cost] < @statistics[:total_requests] %>
         <p class="text-xs text-secondary mt-1">
-          Based on <%= number_with_delimiter(@statistics[:requests_with_cost]) %> of
-          <%= number_with_delimiter(@statistics[:total_requests]) %> requests with cost data
+          <%= t(".based_on_requests", with_cost: number_with_delimiter(@statistics[:requests_with_cost]), total: number_with_delimiter(@statistics[:total_requests])) %>
         </p>
       <% end %>
     </div>
@@ -70,7 +69,7 @@
   <!-- Cost by Operation -->
   <% if @statistics[:by_operation].any? %>
     <div class="mb-6">
-      <h2 class="text-lg font-semibold text-primary mb-3">Cost by Operation</h2>
+      <h2 class="text-lg font-semibold text-primary mb-3"><%= t(".cost_by_operation") %></h2>
       <div class="bg-container-inset rounded-lg p-4">
         <div class="space-y-2">
           <% @statistics[:by_operation].each do |operation, cost| %>
@@ -87,7 +86,7 @@
   <!-- Cost by Model -->
   <% if @statistics[:by_model].any? %>
     <div class="mb-6">
-      <h2 class="text-lg font-semibold text-primary mb-3">Cost by Model</h2>
+      <h2 class="text-lg font-semibold text-primary mb-3"><%= t(".cost_by_model") %></h2>
       <div class="bg-container-inset rounded-lg p-4">
         <div class="space-y-2">
           <% @statistics[:by_model].each do |model, cost| %>
@@ -103,17 +102,17 @@
 
   <!-- Recent Usage Table -->
   <div>
-    <h2 class="text-lg font-semibold text-primary mb-3">Recent Usage</h2>
+    <h2 class="text-lg font-semibold text-primary mb-3"><%= t(".recent_usage") %></h2>
     <div class="bg-container-inset rounded-lg overflow-hidden">
       <% if @llm_usages.any? %>
         <table class="w-full">
           <thead class="bg-surface-default border-b border-primary">
             <tr>
-              <th class="px-4 py-3 text-left text-xs font-medium text-secondary uppercase">Date</th>
-              <th class="px-4 py-3 text-left text-xs font-medium text-secondary uppercase">Operation</th>
-              <th class="px-4 py-3 text-left text-xs font-medium text-secondary uppercase">Model</th>
-              <th class="px-4 py-3 text-right text-xs font-medium text-secondary uppercase">Tokens</th>
-              <th class="px-4 py-3 text-right text-xs font-medium text-secondary uppercase">Cost</th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-secondary uppercase"><%= t(".col_date") %></th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-secondary uppercase"><%= t(".col_operation") %></th>
+              <th class="px-4 py-3 text-left text-xs font-medium text-secondary uppercase"><%= t(".col_model") %></th>
+              <th class="px-4 py-3 text-right text-xs font-medium text-secondary uppercase"><%= t(".col_tokens") %></th>
+              <th class="px-4 py-3 text-right text-xs font-medium text-secondary uppercase"><%= t(".col_cost") %></th>
             </tr>
           </thead>
           <tbody class="divide-y divide-gray-100">
@@ -133,12 +132,12 @@
                     <div data-controller="tooltip" class="inline-flex justify-end">
                       <div class="inline-flex items-center gap-1 cursor-help">
                         <%= icon "alert-circle", class: "w-4 h-4 text-red-600 theme-dark:text-red-400" %>
-                        <span class="text-red-600 theme-dark:text-red-400 font-medium">Failed</span>
+                        <span class="text-red-600 theme-dark:text-red-400 font-medium"><%= t(".failed") %></span>
                       </div>
-                      <div role="tooltip" data-tooltip-target="tooltip" class="tooltip bg-gray-800 text-sm p-3 rounded w-72 text-left break-words whitespace-normal shadow-lg hidden">
-                        <div class="text-white">
+                      <div role="tooltip" data-tooltip-target="tooltip" class="tooltip bg-inverse text-sm p-3 rounded w-72 text-left break-words whitespace-normal shadow-lg hidden">
+                        <div class="text-inverse">
                           <% if usage.http_status_code.present? %>
-                            <p class="text-xs mt-1 text-gray-300">HTTP Status: <%= usage.http_status_code %></p>
+                            <p class="text-xs mt-1 text-inverse opacity-70">HTTP Status: <%= usage.http_status_code %></p>
                           <% end %>
                           <p class="text-xs"><%= usage.error_message %></p>
                         </div>
@@ -160,24 +159,17 @@
         </table>
       <% else %>
         <div class="p-8 text-center">
-          <p class="text-secondary">No usage data found for the selected period</p>
+          <p class="text-secondary"><%= t(".no_usage_data") %></p>
         </div>
       <% end %>
     </div>
   </div>
 
-  <!-- Pricing Information -->
-  <div class="mt-6 p-4 bg-blue-50 border border-blue-200 rounded-lg">
-    <div class="flex items-start gap-2">
-      <%= icon "info", class: "w-5 h-5 text-blue-600 mt-0.5" %>
-      <div>
-        <p class="text-sm font-medium text-blue-900">About Cost Estimates</p>
-        <p class="text-xs text-blue-700 mt-1">
-          Costs are estimated based on OpenAI's pricing as of 2025. Actual costs may vary.
-          Pricing is per 1 million tokens and varies by model.
-          Custom or self-hosted models will show "N/A" and are not included in cost totals.
-        </p>
-      </div>
-    </div>
+  <div class="mt-6">
+    <%= render DS::Alert.new(
+      title: t(".cost_estimates_title"),
+      message: t(".cost_estimates_description"),
+      variant: :info
+    ) %>
   </div>
 </div>
diff --git a/app/views/settings/payments/show.html.erb b/app/views/settings/payments/show.html.erb
index ac0184cea..0768440cd 100644
--- a/app/views/settings/payments/show.html.erb
+++ b/app/views/settings/payments/show.html.erb
@@ -13,7 +13,7 @@
         <div class="text-sm space-y-1">
           <% if @family.has_active_subscription? %>
             <p class="text-primary">
-              <span>Currently on the <span class="font-medium"><%= @family.subscription.name %></span>.</span> <br>
+              <span><%= t(".currently_on_plan") %> <span class="font-medium"><%= @family.subscription.name %></span>.</span> <br>
 
               <% if @family.next_payment_date %>
                 <% if @family.subscription_pending_cancellation? %>
@@ -25,21 +25,21 @@
             </p>
           <% elsif @family.trialing? %>
             <p class="text-primary">
-              Currently using the open demo of <%= product_name %> <br>
+              <%= t(".trialing", product_name: product_name) %> <br>
               <span class="text-secondary">
-                (Data will be deleted in <%= @family.days_left_in_trial %> days)
+                (<%= t(".trial_days_left", count: @family.days_left_in_trial) %>)
               </span>
             </p>
           <% else %>
-            <p class="text-primary">You are currently <span class="font-medium">not contributing</span></p>
-            <p class="text-secondary">Contributions to <%= product_name %> will show here.</p>
+            <p class="text-primary"><%= t(".not_contributing_prefix") %> <span class="font-medium"><%= t(".not_contributing_emphasis") %></span></p>
+            <p class="text-secondary"><%= t(".contributions_note", product_name: product_name) %></p>
           <% end %>
         </div>
       </div>
 
       <% if @family.has_active_subscription? %>
         <%= render DS::Link.new(
-          text: "Manage",
+          text: t(".manage"),
           icon: "external-link",
           variant: "primary",
           icon_position: "right",
@@ -48,7 +48,7 @@
         ) %>
       <% else %>
         <%= render DS::Link.new(
-          text: "Choose level",
+          text: t(".choose_level"),
           variant: "primary",
           icon: "plus",
           icon_position: "right",
@@ -59,7 +59,7 @@
 
     <div class="flex items-center gap-2">
       <%= image_tag "stripe-logo.svg", class: "w-5 h-5 shrink-0" %>
-      <p class="text-secondary text-sm">Payment via Stripe</p>
+      <p class="text-secondary text-sm"><%= t(".payment_via_stripe") %></p>
     </div>
   </div>
 <% end %>
diff --git a/app/views/settings/preferences/show.html.erb b/app/views/settings/preferences/show.html.erb
index 22faaf010..80b767bd1 100644
--- a/app/views/settings/preferences/show.html.erb
+++ b/app/views/settings/preferences/show.html.erb
@@ -1,63 +1,189 @@
 <%= content_for :page_title, t(".page_title") %>
-
 <%= settings_section title: t(".general_title"), subtitle: t(".general_subtitle") do %>
   <div>
     <%= styled_form_with model: @user, class: "space-y-4", data: { controller: "auto-submit-form" } do |form| %>
       <%= form.hidden_field :redirect_to, value: "preferences" %>
-
       <%= form.select :locale,
           language_options,
           { label: t(".language"), include_blank: t(".language_auto") },
           { data: { auto_submit_form_target: "auto" } } %>
-
       <%= form.fields_for :family do |family_form| %>
-        <%= family_form.select :currency,
-            Money::Currency.as_options.map { |currency| [ "#{currency.name} (#{currency.iso_code})", currency.iso_code ] },
-            { label: t(".currency") }, disabled: true %>
-
         <%= family_form.select :timezone,
             timezone_options,
             { label: t(".timezone") },
             { data: { auto_submit_form_target: "auto" } } %>
-
         <%= family_form.select :date_format,
             Family::DATE_FORMATS,
             { label: t(".date_format") },
             { data: { auto_submit_form_target: "auto" } } %>
-
-        <%= form.select :default_period,
-            Period.all.map { |period| [ period.label, period.key ] },
-            { label: t(".default_period") },
-            { data: { auto_submit_form_target: "auto" } } %>
-
         <%= form.select :default_account_order,
             AccountOrder.all.map { |order| [ order.label, order.key ] },
             { label: t(".default_account_order") },
             { data: { auto_submit_form_target: "auto" } } %>
-
         <%= family_form.select :country,
             country_options,
             { label: t(".country") },
             { data: { auto_submit_form_target: "auto" } } %>
-
         <%= family_form.select :month_start_day,
-            (1..28).map { |day| [day.ordinalize, day] },
+            (1..28).map { |day| [localized_ordinal(day), day] },
             { label: t(".month_start_day"), hint: t(".month_start_day_hint") },
             { data: { auto_submit_form_target: "auto" } } %>
-
         <% if @user.family.uses_custom_month_start? %>
           <div class="text-sm text-warning bg-warning/10 p-3 rounded-lg">
             <%= t(".month_start_day_warning") %>
           </div>
         <% end %>
-
-        <p class="text-xs italic pl-2 text-secondary">Please note, we are still working on translations for various languages.</p>
+        <p class="text-xs italic pl-2 text-secondary"><%= t(".translations_notice") %></p>
       <% end %>
     <% end %>
   </div>
 <% end %>
-
 <% if Current.user.admin? %>
+  <%= settings_section title: t(".currencies_title", moniker: family_moniker), subtitle: t(".currencies_subtitle", moniker: family_moniker_downcase) do %>
+    <% selected_count_translations = t(".selected_currencies_count") %>
+    <div class="space-y-4"
+         data-controller="currency-preferences"
+         data-currency-preferences-base-currency-value="<%= @user.family.primary_currency_code %>"
+         data-currency-preferences-locale-value="<%= I18n.locale %>"
+         data-currency-preferences-selected-count-translations-value="<%= selected_count_translations.to_json %>">
+      <% additional_preview_currencies = @user.family.secondary_enabled_currency_objects.first(6) %>
+      <% additional_currency_count = @user.family.secondary_enabled_currency_objects.count %>
+      <div class="rounded-xl border border-secondary p-4 bg-container-inset">
+        <div class="grid gap-4 md:grid-cols-2">
+          <div>
+            <p class="text-xs font-medium uppercase tracking-wide text-secondary"><%= t(".base_currency_label") %></p>
+            <div class="mt-2">
+              <p class="text-sm font-medium text-primary"><%= @user.family.primary_currency_code %></p>
+              <p class="text-sm text-secondary"><%= currency_label(@user.family.primary_currency_code) %></p>
+            </div>
+          </div>
+          <div class="md:border-l md:border-secondary md:pl-4">
+            <p class="text-xs font-medium uppercase tracking-wide text-secondary"><%= t(".additional_currencies_label") %></p>
+            <% if additional_preview_currencies.any? %>
+              <div class="mt-2 flex flex-wrap gap-2">
+                <% additional_preview_currencies.each do |currency| %>
+                  <span class="inline-flex items-center rounded-full bg-surface-inset px-2.5 py-1 text-xs font-medium text-primary">
+                    <%= currency.iso_code %>
+                  </span>
+                <% end %>
+                <% if additional_currency_count > additional_preview_currencies.count %>
+                  <span class="inline-flex items-center rounded-full bg-surface-inset px-2.5 py-1 text-xs font-medium text-secondary">
+                    <%= t(".currencies_more", count: additional_currency_count - additional_preview_currencies.count) %>
+                  </span>
+                <% end %>
+              </div>
+            <% else %>
+              <p class="mt-2 text-sm text-secondary"><%= t(".no_additional_currencies") %></p>
+            <% end %>
+          </div>
+        </div>
+      </div>
+      <div class="flex justify-end">
+        <%= render DS::Button.new(
+          text: t(".manage_currencies"),
+          type: :button,
+          class: "md:w-auto w-full justify-center",
+          data: { action: "currency-preferences#open" }
+        ) %>
+      </div>
+      <%= render DS::Dialog.new(
+        id: "currency-preferences-dialog",
+        auto_open: false,
+        disable_frame: true,
+        width: "md",
+        data: { currency_preferences_target: "dialog" }
+      ) do |dialog| %>
+        <% dialog.with_header(title: t(".manage_currencies"), subtitle: t(".manage_currencies_subtitle")) %>
+        <% dialog.with_body do %>
+          <% primary_currency_code = @user.family.primary_currency_code %>
+          <% selected_currency_codes = @user.family.enabled_currency_codes %>
+          <% base_currency_rows, other_currency_rows = Money::Currency.as_options.partition { |currency| currency.iso_code == primary_currency_code } %>
+          <% currency_rows = base_currency_rows + other_currency_rows %>
+          <%= styled_form_with model: @user, url: user_path(@user), class: "space-y-4", data: { action: "turbo:submit-end->currency-preferences#handleSubmitEnd" } do |form| %>
+            <%= form.hidden_field :redirect_to, value: "preferences" %>
+            <%= hidden_field_tag "user[family_attributes][id]", @user.family.id %>
+            <%= hidden_field_tag "user[family_attributes][enabled_currencies][]", primary_currency_code, id: nil %>
+            <div class="flex flex-wrap items-center justify-between gap-3">
+              <div class="flex flex-wrap gap-2">
+                <%= render DS::Button.new(
+                  text: t(".select_all_currencies"),
+                  type: :button,
+                  variant: :ghost,
+                  size: :sm,
+                  data: { action: "currency-preferences#selectAll" }
+                ) %>
+                <%= render DS::Button.new(
+                  text: t(".select_base_only"),
+                  type: :button,
+                  variant: :ghost,
+                  size: :sm,
+                  data: { action: "currency-preferences#selectBaseOnly" }
+                ) %>
+              </div>
+              <p class="text-sm font-medium text-secondary"
+                 data-currency-preferences-target="selectedCount"
+                 role="status"
+                 aria-live="polite"
+                 aria-atomic="true"></p>
+            </div>
+            <div data-controller="list-filter" class="space-y-3">
+              <%= render DS::SearchInput.new(
+                placeholder: t(".currency_search_placeholder"),
+                data: {
+                  list_filter_target: "input",
+                  action: "input->list-filter#filter"
+                }
+              ) %>
+              <div data-list-filter-target="list" class="max-h-80 overflow-auto rounded-xl border border-secondary divide-y divide-alpha-black-100 theme-dark:divide-alpha-white-100">
+                <p class="hidden px-4 py-3 text-sm text-secondary" data-list-filter-target="emptyMessage">
+                  <%= t(".no_matching_currencies") %>
+                </p>
+                <% currency_rows.each do |currency| %>
+                  <% checked = selected_currency_codes.include?(currency.iso_code) %>
+                  <% base_currency = currency.iso_code == primary_currency_code %>
+                  <label class="<%= class_names(
+                    "filterable-item flex items-start gap-3 px-4 py-3 cursor-pointer transition-colors hover:bg-surface-inset",
+                    "bg-surface-inset": base_currency,
+                    "cursor-default": base_currency
+                  ) %>"
+                         data-filter-name="<%= "#{currency.iso_code} #{currency.name}" %>">
+                    <%= check_box_tag "user[family_attributes][enabled_currencies][]",
+                                      currency.iso_code,
+                                      checked,
+                                      disabled: base_currency,
+                                      class: "checkbox checkbox--light mt-0.5",
+                                      data: {
+                                        currency_preferences_target: "checkbox",
+                                        action: "change->currency-preferences#updateSelectedCount"
+                                      } %>
+                    <div class="min-w-0 flex-1">
+                      <div class="flex items-start justify-between gap-3">
+                        <div class="min-w-0">
+                          <div class="flex items-center gap-2">
+                            <span class="text-sm font-medium text-primary"><%= currency.iso_code %></span>
+                            <% if base_currency %>
+                              <span class="inline-flex items-center rounded-full bg-surface px-2 py-0.5 text-[11px] font-medium text-secondary">
+                                <%= t(".base_currency_badge") %>
+                              </span>
+                            <% end %>
+                          </div>
+                          <p class="mt-0.5 text-sm text-secondary"><%= currency.name %></p>
+                        </div>
+                      </div>
+                    </div>
+                  </label>
+                <% end %>
+              </div>
+            </div>
+            <div class="flex justify-end gap-2">
+              <%= render DS::Button.new(text: t("shared.cancel"), type: :button, variant: :ghost, data: { action: "DS--dialog#close" }) %>
+              <%= render DS::Button.new(text: t(".save_currencies"), type: :submit) %>
+            </div>
+          <% end %>
+        <% end %>
+      <% end %>
+    </div>
+  <% end %>
   <%= settings_section title: t(".sharing_title", moniker: family_moniker), subtitle: t(".sharing_subtitle", moniker: family_moniker_downcase) do %>
     <div>
       <%= styled_form_with model: @user, class: "space-y-4", data: { controller: "auto-submit-form" } do |form| %>
@@ -75,3 +201,29 @@
     </div>
   <% end %>
 <% end %>
+
+<%# Preview features toggle — visible to all users, not just admins. Lives at
+    the bottom of Preferences as a standalone card (no section header) so the
+    toggle row is the entire surface. Posts directly to
+    settings#preferences#update via the Settings::PreferencesController,
+    matching the auto-submit pattern used on the Appearance page. %>
+<section class="bg-container shadow-border-xs rounded-xl p-4">
+  <%= form_with url: settings_preferences_path, method: :patch,
+        data: { controller: "auto-submit-form" } do |f| %>
+    <%# Wrapping the row in <label for=…> makes the title + description
+        themselves a click target for the toggle, so the cursor-pointer
+        affordance on the container is honest. %>
+    <label for="user_preview_features_enabled" class="flex cursor-pointer items-center gap-4 justify-between">
+      <div class="text-sm space-y-1">
+        <h4 class="text-primary"><%= t(".preview.title") %></h4>
+        <p class="text-secondary"><%= t(".preview.description") %></p>
+      </div>
+      <%= render DS::Toggle.new(
+            id: "user_preview_features_enabled",
+            name: "user[preview_features_enabled]",
+            checked: @user.preview_features_enabled?,
+            data: { auto_submit_form_target: "auto" }
+      ) %>
+    </label>
+  <% end %>
+</section>
diff --git a/app/views/settings/profiles/show.html.erb b/app/views/settings/profiles/show.html.erb
index c2f2dc158..5c431449d 100644
--- a/app/views/settings/profiles/show.html.erb
+++ b/app/views/settings/profiles/show.html.erb
@@ -8,7 +8,7 @@
       <%= form.email_field :email, placeholder: t(".email"), label: t(".email") %>
 
       <% if @user.unconfirmed_email.present? %>
-        <p class="mt-2 text-sm text-gray-600">
+        <p class="mt-2 text-sm text-secondary">
           You have requested to change your email to <%= @user.unconfirmed_email %>. Please go to your email and confirm for the change to take effect. If you haven't received the email, please check your spam folder, or <%= link_to "request a new confirmation email", resend_confirmation_email_user_path(@user), class: "hover:underline text-secondary" %>.
         </p>
       <% end %>
@@ -19,19 +19,19 @@
       </div>
 
       <div class="flex justify-end mt-4">
-        <%= render DS::Button.new(text: t(".save"), class: "md:w-auto w-full justify-center") %>
+        <%= render DS::Button.new(text: t(".save"), type: :submit, class: "md:w-auto w-full justify-center") %>
       </div>
     </div>
   <% end %>
 <% end %>
 
 <% unless Current.user.ui_layout_intro? %>
-  <%= settings_section title: family_moniker == "Group" ? t(".group_title", default: "Group") : t(".household_title"), subtitle: t(".household_subtitle", moniker_plural: family_moniker_plural_downcase, moniker: family_moniker_downcase) do %>
+  <%= settings_section title: Current.family&.moniker == "Group" ? t(".group_title", default: "Group") : t(".household_title"), subtitle: t(".household_subtitle", moniker_plural: family_moniker_plural_downcase, moniker: family_moniker_downcase) do %>
     <div class="space-y-4">
       <%= styled_form_with model: Current.user, class: "space-y-4", data: { controller: "auto-submit-form" } do |form| %>
         <%= form.fields_for :family do |family_fields| %>
-          <% name_label = family_moniker == "Group" ? t(".group_form_label", default: "Group name") : t(".household_form_label") %>
-          <% name_placeholder = family_moniker == "Group" ? t(".group_form_input_placeholder", default: "Enter group name") : t(".household_form_input_placeholder") %>
+          <% name_label = Current.family&.moniker == "Group" ? t(".group_form_label", default: "Group name") : t(".household_form_label") %>
+          <% name_placeholder = Current.family&.moniker == "Group" ? t(".group_form_input_placeholder", default: "Enter group name") : t(".household_form_input_placeholder") %>
           <%= family_fields.text_field :name,
                 placeholder: name_placeholder,
                 label: name_label,
@@ -50,7 +50,7 @@
             </div>
             <p class="text-primary font-medium text-sm"><%= user.display_name %></p>
             <div class="rounded-md bg-surface px-1.5 py-0.5">
-              <p class="uppercase text-secondary font-medium text-xs"><%= user.role %></p>
+              <p class="uppercase text-secondary font-medium text-xs"><%= t("users.roles.#{user.role}", default: user.role.humanize) %></p>
             </div>
             <% if Current.user.admin? && user != Current.user %>
               <div class="ml-auto">
@@ -70,7 +70,7 @@
             <div class="flex gap-2 items-center justify-between bg-container p-4 border border-alpha-black-25 rounded-lg">
               <div class="flex gap-2 items-center">
                 <div class="w-9 h-9 shrink-0">
-                  <div class="fg-inverse w-full h-full bg-surface-inset rounded-full flex items-center justify-center text-lg uppercase"><%= invitation.email[0] %></div>
+                  <div class="text-inverse w-full h-full bg-surface-inset rounded-full flex items-center justify-center text-lg uppercase"><%= invitation.email[0] %></div>
                 </div>
                 <div class="flex">
                   <p class="text-primary font-medium text-sm"><%= invitation.email %></p>
@@ -88,8 +88,8 @@
                                readonly
                                autocomplete="off"
                                value="<%= accept_invitation_url(invitation.token) %>"
-                               class="text-sm bg-gray-50 px-2 py-1 rounded border border-secondary w-72">
-                    <button data-action="clipboard#copy" class="text-secondary hover:text-gray-700">
+                               class="text-sm bg-surface-inset px-2 py-1 rounded border border-secondary w-72">
+                    <button data-action="clipboard#copy" class="text-secondary hover:text-primary">
                       <span data-clipboard-target="iconDefault">
                         <%= icon "copy" %>
                       </span>
diff --git a/app/views/settings/providers/_binance_panel.html.erb b/app/views/settings/providers/_binance_panel.html.erb
index 05378904a..578573188 100644
--- a/app/views/settings/providers/_binance_panel.html.erb
+++ b/app/views/settings/providers/_binance_panel.html.erb
@@ -1,32 +1,37 @@
 <div class="space-y-4">
   <% items = local_assigns[:binance_items] || @binance_items || Current.family.binance_items.active.ordered %>
 
-  <div class="prose prose-sm text-secondary">
-    <p class="text-primary font-medium"><%= t("settings.providers.binance_panel.setup_instructions") %></p>
-    <ol>
-      <li><%= t("settings.providers.binance_panel.step1_html").html_safe %></li>
-      <li><%= t("settings.providers.binance_panel.step2") %></li>
-      <li><%= t("settings.providers.binance_panel.step3") %></li>
-    </ol>
-    <p class="text-destructive text-xs font-medium"><%= t("settings.providers.binance_panel.no_withdraw_warning") %></p>
-  </div>
+  <%= render DS::Alert.new(
+        variant: :warning,
+        title: t("settings.providers.binance_panel.no_withdraw_title"),
+        message: t("settings.providers.binance_panel.no_withdraw_body")
+      ) %>
 
-  <div class="bg-surface border border-primary p-3 rounded-lg text-sm">
-    <p class="font-medium text-primary"><%= t("settings.providers.binance_panel.ip_hint_title") %></p>
-    <p class="text-secondary mt-1"><%= t("settings.providers.binance_panel.ip_hint_body") %></p>
-    <% server_ip = ENV["BINANCE_EGRESS_IP"].presence %>
-    <% if server_ip %>
-      <code class="mt-1 block text-xs bg-container-inset px-2 py-1 rounded font-mono text-primary"><%= server_ip %></code>
-    <% else %>
-      <p class="mt-1 text-xs text-secondary italic"><%= t("settings.providers.binance_panel.ip_hint_contact_admin") %></p>
-    <% end %>
+  <div class="space-y-2">
+    <%= render "settings/providers/setup_steps",
+               steps: [
+                 t("settings.providers.binance_panel.step1_html").html_safe,
+                 t("settings.providers.binance_panel.step2"),
+                 t("settings.providers.binance_panel.step3")
+               ] %>
+
+    <div class="bg-surface-inset rounded-xl p-4 text-sm">
+      <p class="text-xs font-medium uppercase text-subdued tracking-wider mb-2">
+        <%= t("settings.providers.binance_panel.ip_hint_title") %>
+      </p>
+      <p class="text-secondary"><%= t("settings.providers.binance_panel.ip_hint_body") %></p>
+      <% server_ip = ENV["BINANCE_EGRESS_IP"].presence %>
+      <% if server_ip %>
+        <code class="mt-2 block text-xs bg-container px-2 py-1 rounded font-mono text-primary"><%= server_ip %></code>
+      <% else %>
+        <p class="mt-1 text-xs text-secondary italic"><%= t("settings.providers.binance_panel.ip_hint_contact_admin") %></p>
+      <% end %>
+    </div>
   </div>
 
   <% error_msg = local_assigns[:error_message] || @error_message %>
   <% if error_msg.present? %>
-    <div class="p-2 rounded-md bg-destructive/10 text-destructive text-sm overflow-hidden">
-      <p class="line-clamp-3" title="<%= h(error_msg) %>"><%= error_msg %></p>
-    </div>
+    <%= render DS::Alert.new(message: error_msg, variant: :error) %>
   <% end %>
 
   <% if items.any? %>
@@ -88,19 +93,9 @@
                           type: :password %>
 
       <div class="flex justify-end">
-        <%= form.submit t("settings.providers.binance_panel.connect_button"),
-                        class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-inverse bg-inverse hover:bg-inverse-hover focus:outline-none focus:ring-2 focus:ring-gray-900 focus:ring-offset-2 transition-colors" %>
+        <%= form.submit t("settings.providers.binance_panel.connect_button") %>
       </div>
     <% end %>
   <% end %>
 
-  <div class="flex items-center gap-2">
-    <% if items.any? %>
-      <div class="w-2 h-2 bg-success rounded-full"></div>
-      <p class="text-sm text-secondary"><%= t("settings.providers.binance_panel.status_connected") %></p>
-    <% else %>
-      <div class="w-2 h-2 bg-tertiary rounded-full"></div>
-      <p class="text-sm text-secondary"><%= t("settings.providers.binance_panel.status_not_connected") %></p>
-    <% end %>
-  </div>
 </div>
diff --git a/app/views/settings/providers/_brex_panel.html.erb b/app/views/settings/providers/_brex_panel.html.erb
new file mode 100644
index 000000000..545e01802
--- /dev/null
+++ b/app/views/settings/providers/_brex_panel.html.erb
@@ -0,0 +1,156 @@
+<div id="brex-providers-panel" class="space-y-4">
+  <% active_items = local_assigns[:brex_items] || @brex_items || Current.family.brex_items.active.ordered %>
+  <% credentialed_items = active_items.select(&:credentials_configured?) %>
+
+  <div class="prose prose-sm text-secondary">
+    <p class="text-primary font-medium"><%= t("brex_items.provider_panel.setup_title") %></p>
+    <ol>
+      <li><%= t("brex_items.provider_panel.instructions.sign_in_html", link: link_to("Brex", "https://brex.com", target: "_blank", rel: "noopener noreferrer", class: "link")) %></li>
+      <li><%= t("brex_items.provider_panel.instructions.open_tokens") %></li>
+      <li><%= t("brex_items.provider_panel.instructions.create_token") %></li>
+      <li><%= t("brex_items.provider_panel.instructions.copy_token_html") %></li>
+    </ol>
+
+    <p class="text-sm text-subdued mt-2">
+      <%= t("brex_items.provider_panel.sandbox_note_html") %>
+    </p>
+  </div>
+
+  <% unless BrexItem.encryption_ready? %>
+    <div class="p-3 rounded-md bg-warning/10 text-warning text-sm">
+      <div class="flex items-start gap-2">
+        <%= icon "shield-alert", size: "sm", class: "mt-0.5 shrink-0" %>
+        <div>
+          <p class="font-medium"><%= t("brex_items.provider_panel.encryption_warning.title") %></p>
+          <p class="mt-1"><%= t("brex_items.provider_panel.encryption_warning.message") %></p>
+        </div>
+      </div>
+    </div>
+  <% end %>
+
+  <% error_msg = local_assigns[:error_message] || @error_message %>
+  <% if error_msg.present? %>
+    <div class="p-2 rounded-md bg-destructive/10 text-destructive text-sm overflow-hidden">
+      <p class="line-clamp-3" title="<%= error_msg %>"><%= error_msg %></p>
+    </div>
+  <% end %>
+
+  <% if active_items.any? %>
+    <div class="space-y-3">
+      <% active_items.each do |item| %>
+        <%= render DS::Disclosure.new(variant: :card) do |disclosure| %>
+          <% disclosure.with_summary_content do %>
+            <div class="flex items-center justify-between gap-2 w-full">
+              <div class="flex items-center gap-3">
+                <div class="flex items-center justify-center h-8 w-8 bg-container-inset rounded-full">
+                  <p class="text-primary text-xs font-medium"><%= item.name.to_s.first.to_s.upcase %></p>
+                </div>
+                <div>
+                  <p class="font-medium text-primary"><%= item.name %></p>
+                  <p class="text-xs text-secondary"><%= item.sync_status_summary %></p>
+                </div>
+              </div>
+            </div>
+          <% end %>
+
+          <div class="mt-4 space-y-4">
+            <div class="flex items-center gap-2">
+              <%= button_to sync_brex_item_path(item),
+                            method: :post,
+                            class: "inline-flex items-center gap-1 px-3 py-1.5 text-sm font-medium text-secondary hover:text-primary border border-secondary rounded-lg hover:border-primary",
+                            disabled: item.syncing? do %>
+                <%= icon "refresh-cw", size: "sm" %>
+                <%= t("brex_items.provider_panel.sync") %>
+              <% end %>
+              <%= button_to brex_item_path(item),
+                            method: :delete,
+                            class: "inline-flex items-center gap-1 px-3 py-1.5 text-sm font-medium text-destructive hover:bg-destructive/10 rounded-lg",
+                            aria: { label: t("brex_items.provider_panel.disconnect_label", name: item.name) },
+                            data: { turbo_confirm: t("brex_items.provider_panel.disconnect_confirm", name: item.name) } do %>
+                <%= icon "trash-2", size: "sm" %>
+              <% end %>
+            </div>
+
+            <%= styled_form_with model: item,
+                                 url: brex_item_path(item),
+                                 scope: :brex_item,
+                                 method: :patch,
+                                 data: { turbo: true },
+                                 class: "space-y-3" do |form| %>
+              <%= form.text_field :name,
+                                  label: t("brex_items.provider_panel.connection_name_label"),
+                                  placeholder: t("brex_items.provider_panel.connection_name_placeholder") %>
+
+              <%= form.text_field :token,
+                                  label: t("brex_items.provider_panel.token_label"),
+                                  placeholder: t("brex_items.provider_panel.keep_token_placeholder"),
+                                  type: :password,
+                                  value: nil %>
+
+              <%= form.text_field :base_url,
+                                  label: t("brex_items.provider_panel.base_url_label"),
+                                  placeholder: t("brex_items.provider_panel.base_url_placeholder"),
+                                  value: item.base_url %>
+
+              <div class="flex flex-wrap justify-end gap-2">
+                <%= render DS::Link.new(
+                  text: t("brex_items.provider_panel.setup_accounts"),
+                  icon: "settings",
+                  variant: "secondary",
+                  href: setup_accounts_brex_item_path(item),
+                  frame: :modal
+                ) %>
+                <%= form.submit t("brex_items.provider_panel.update_connection") %>
+              </div>
+            <% end %>
+          </div>
+        <% end %>
+      <% end %>
+    </div>
+  <% end %>
+
+  <%= render DS::Disclosure.new(variant: :card, open: active_items.none?) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center gap-2 text-sm font-medium text-primary">
+        <%= icon "plus" %>
+        <%= t("brex_items.provider_panel.add_connection") %>
+      </div>
+    <% end %>
+
+    <% brex_item = Current.family.brex_items.build(name: t("brex_items.provider_panel.default_connection_name")) %>
+    <%= styled_form_with model: brex_item,
+                         url: brex_items_path,
+                         scope: :brex_item,
+                         method: :post,
+                         data: { turbo: true },
+                         class: "space-y-3 mt-4" do |form| %>
+      <%= form.text_field :name,
+                          label: t("brex_items.provider_panel.connection_name_label"),
+                          placeholder: t("brex_items.provider_panel.connection_name_placeholder") %>
+
+      <%= form.text_field :token,
+                          label: t("brex_items.provider_panel.token_label"),
+                          placeholder: t("brex_items.provider_panel.token_placeholder"),
+                          type: :password,
+                          value: nil %>
+
+      <%= form.text_field :base_url,
+                          label: t("brex_items.provider_panel.base_url_label"),
+                          placeholder: t("brex_items.provider_panel.base_url_placeholder") %>
+
+      <div class="flex justify-end">
+        <%= form.submit t("brex_items.provider_panel.add_connection") %>
+      </div>
+    <% end %>
+  <% end %>
+
+  <div class="flex items-center gap-2">
+    <% if credentialed_items.any? %>
+      <div class="w-2 h-2 bg-success rounded-full"></div>
+      <p class="text-sm text-secondary"><%= t("brex_items.provider_panel.configured_html", accounts_link: link_to(t("brex_items.provider_panel.accounts_link"), accounts_path, class: "link")) %></p>
+    <% else %>
+      <div class="w-2 h-2 bg-surface-inset rounded-full"></div>
+      <p class="text-sm text-secondary"><%= t("brex_items.provider_panel.not_configured") %></p>
+    <% end %>
+  </div>
+</div>
diff --git a/app/views/settings/providers/_coinbase_panel.html.erb b/app/views/settings/providers/_coinbase_panel.html.erb
index 3cd62ff5d..82cb7d473 100644
--- a/app/views/settings/providers/_coinbase_panel.html.erb
+++ b/app/views/settings/providers/_coinbase_panel.html.erb
@@ -1,20 +1,16 @@
 <div id="coinbase-providers-panel" class="space-y-4">
   <% items = local_assigns[:coinbase_items] || @coinbase_items || Current.family.coinbase_items.active.ordered %>
 
-  <div class="prose prose-sm text-secondary">
-    <p class="text-primary font-medium"><%= t("settings.providers.coinbase_panel.setup_instructions") %></p>
-    <ol>
-      <li><%= t("settings.providers.coinbase_panel.step1_html").html_safe %></li>
-      <li><%= t("settings.providers.coinbase_panel.step2") %></li>
-      <li><%= t("settings.providers.coinbase_panel.step3") %></li>
-    </ol>
-  </div>
+  <%= render "settings/providers/setup_steps",
+             steps: [
+               t("settings.providers.coinbase_panel.step1_html").html_safe,
+               t("settings.providers.coinbase_panel.step2"),
+               t("settings.providers.coinbase_panel.step3")
+             ] %>
 
   <% error_msg = local_assigns[:error_message] || @error_message %>
   <% if error_msg.present? %>
-    <div class="p-2 rounded-md bg-destructive/10 text-destructive text-sm overflow-hidden">
-      <p class="line-clamp-3" title="<%= error_msg %>"><%= error_msg %></p>
-    </div>
+    <%= render DS::Alert.new(message: error_msg, variant: :error) %>
   <% end %>
 
   <% if items.any? %>
@@ -76,19 +72,9 @@
                           type: :password %>
 
       <div class="flex justify-end">
-        <%= form.submit t("settings.providers.coinbase_panel.connect_button"),
-                        class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-inverse bg-inverse hover:bg-inverse-hover focus:outline-none focus:ring-2 focus:ring-gray-900 focus:ring-offset-2 transition-colors" %>
+        <%= form.submit t("settings.providers.coinbase_panel.connect_button") %>
       </div>
     <% end %>
   <% end %>
 
-  <div class="flex items-center gap-2">
-    <% if items.any? %>
-      <div class="w-2 h-2 bg-success rounded-full"></div>
-      <p class="text-sm text-secondary"><%= t("settings.providers.coinbase_panel.status_connected") %></p>
-    <% else %>
-      <div class="w-2 h-2 bg-tertiary rounded-full"></div>
-      <p class="text-sm text-secondary"><%= t("settings.providers.coinbase_panel.status_not_connected") %></p>
-    <% end %>
-  </div>
 </div>
diff --git a/app/views/settings/providers/_coinstats_panel.html.erb b/app/views/settings/providers/_coinstats_panel.html.erb
index c5359e104..d545c9952 100644
--- a/app/views/settings/providers/_coinstats_panel.html.erb
+++ b/app/views/settings/providers/_coinstats_panel.html.erb
@@ -1,18 +1,14 @@
 <div class="space-y-4">
-  <div class="prose prose-sm text-secondary">
-    <p class="text-primary font-medium"><%= t("coinstats_items.new.setup_instructions") %></p>
-    <ol>
-      <li><%= t("coinstats_items.new.step1_html").html_safe %></li>
-      <li><%= t("coinstats_items.new.step2") %></li>
-      <li><%= t("coinstats_items.new.step3_html", accounts_url: accounts_path).html_safe %></li>
-    </ol>
-  </div>
+  <%= render "settings/providers/setup_steps",
+             steps: [
+               t("coinstats_items.new.step1_html").html_safe,
+               t("coinstats_items.new.step2"),
+               t("coinstats_items.new.step3_html", accounts_url: accounts_path).html_safe
+             ] %>
 
   <% error_msg = local_assigns[:error_message] || @error_message %>
   <% if error_msg.present? %>
-    <div class="p-2 rounded-md bg-destructive/10 text-destructive text-sm overflow-hidden">
-      <p class="line-clamp-3" title="<%= error_msg %>"><%= error_msg %></p>
-    </div>
+    <%= render DS::Alert.new(message: error_msg, variant: :error) %>
   <% end %>
 
   <%
@@ -36,19 +32,8 @@
                         type: :password %>
 
     <div class="flex justify-end">
-      <%= form.submit is_new_record ? t("coinstats_items.new.configure") : t("coinstats_items.new.update_configuration"),
-                      class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-inverse bg-inverse hover:bg-inverse-hover focus:outline-none focus:ring-2 focus:ring-gray-900 focus:ring-offset-2 transition-colors" %>
+      <%= form.submit is_new_record ? t("coinstats_items.new.configure") : t("coinstats_items.new.update_configuration") %>
     </div>
   <% end %>
 
-  <% items = local_assigns[:coinstats_items] || @coinstats_items || Current.family.coinstats_items.where.not(api_key: [nil, ""]) %>
-  <div class="flex items-center gap-2">
-    <% if items&.any? %>
-      <div class="w-2 h-2 bg-success rounded-full"></div>
-      <p class="text-sm text-secondary"><%= t("coinstats_items.new.status_configured_html", accounts_url: accounts_path).html_safe %></p>
-    <% else %>
-      <div class="w-2 h-2 bg-gray-400 rounded-full"></div>
-      <p class="text-sm text-secondary"><%= t("coinstats_items.new.status_not_configured") %></p>
-    <% end %>
-  </div>
 </div>
diff --git a/app/views/settings/providers/_connection_row.html.erb b/app/views/settings/providers/_connection_row.html.erb
new file mode 100644
index 000000000..21cf30ebd
--- /dev/null
+++ b/app/views/settings/providers/_connection_row.html.erb
@@ -0,0 +1,43 @@
+<%# locals: (entry:, open:) %>
+<%
+  status        = entry[:summary][:status]
+  meta          = entry[:summary][:meta]
+  last_synced   = entry[:summary][:last_synced_at]
+  border_class  =
+    case status
+    when :warn then "border border-warning/25"
+    when :err  then "border border-destructive-subtle"
+    else            "border border-transparent"
+    end
+  sync_action   = entry[:partial].present? ? render("settings/providers/sync_button", provider_key: entry[:provider_key], last_synced_at: last_synced) : nil
+  status_pill   = render("settings/providers/status_pill", status: status)
+  maturity_lbl  = Settings::ProviderCard.maturity_label(entry[:maturity])
+  details_data  = entry[:auto_open_param].present? ? { controller: "auto-open", auto_open_param_value: entry[:auto_open_param] } : {}
+%>
+<%= tag.details open: open,
+                class: "group bg-container shadow-border-xs rounded-xl #{border_class}",
+                data: details_data do %>
+  <summary class="flex items-center gap-3 min-h-15 px-4 py-3.5 cursor-pointer rounded-xl list-none [&::-webkit-details-marker]:hidden">
+    <%= icon "chevron-right", size: "sm", class: "!w-3.5 !h-3.5 text-secondary group-open:rotate-90 transition-transform" %>
+    <div class="flex items-center gap-2 flex-wrap min-w-0 flex-1">
+      <h3 class="text-sm font-medium text-primary"><%= entry[:title] %></h3>
+      <%= render "settings/providers/maturity_badge", label: maturity_lbl %>
+    </div>
+    <div class="flex items-center gap-2 shrink-0 group-open:hidden">
+      <% if meta.present? %>
+        <span class="text-xs text-subdued"><%= meta %></span>
+      <% end %>
+      <%= status_pill %>
+      <%= sync_action if sync_action %>
+    </div>
+  </summary>
+  <div class="space-y-4 mt-4 px-4 pb-4">
+    <% if entry[:configuration] %>
+      <%= render "settings/providers/provider_form", configuration: entry[:configuration] %>
+    <% else %>
+      <turbo-frame id="<%= entry[:turbo_id] %>-providers-panel">
+        <%= render "settings/providers/#{entry[:partial]}" %>
+      </turbo-frame>
+    <% end %>
+  </div>
+<% end %>
diff --git a/app/views/settings/providers/_drawer_header.html.erb b/app/views/settings/providers/_drawer_header.html.erb
new file mode 100644
index 000000000..20c3eb611
--- /dev/null
+++ b/app/views/settings/providers/_drawer_header.html.erb
@@ -0,0 +1,22 @@
+<%# locals: (provider_key:, title:) %>
+<% meta = provider_key.present? ? Provider::Metadata.for(provider_key) : nil %>
+<% maturity_label = meta ? Settings::ProviderCard.maturity_label(meta[:maturity]) : nil %>
+<div class="flex items-center justify-between gap-2">
+  <div class="flex items-center gap-2 min-w-0">
+    <% if meta && meta[:logo_bg].present? %>
+      <span class="w-7 h-7 rounded-lg flex items-center justify-center shrink-0 <%= meta[:logo_bg] %>">
+        <span class="text-xs font-bold text-inverse"><%= meta[:logo_text] %></span>
+      </span>
+    <% end %>
+    <h2 class="text-lg font-medium text-primary truncate"><%= title %></h2>
+    <%= render "settings/providers/maturity_badge", label: maturity_label %>
+  </div>
+  <%= render DS::Button.new(
+        variant: "icon",
+        class: "ml-auto hidden lg:flex",
+        icon: "x",
+        title: t("defaults.common.close"),
+        aria_label: t("defaults.common.close"),
+        data: { action: "DS--dialog#close" }
+      ) %>
+</div>
diff --git a/app/views/settings/providers/_enable_banking_panel.html.erb b/app/views/settings/providers/_enable_banking_panel.html.erb
index 1ca388cea..9b2fb2381 100644
--- a/app/views/settings/providers/_enable_banking_panel.html.erb
+++ b/app/views/settings/providers/_enable_banking_panel.html.erb
@@ -1,27 +1,18 @@
 <div class="space-y-4">
-  <div class="prose prose-sm text-secondary">
-    <p class="text-primary font-medium">Setup instructions:</p>
-    <ol>
-      <li>Visit your <a href="https://enablebanking.com" target="_blank" rel="noopener noreferrer" class="link">Enable Banking</a> developer account to get your credentials</li>
-      <li>Select your country code from the dropdown below</li>
-      <li>Enter your Application ID and paste your Client Certificate (including the private key)</li>
-      <li>Click Save Configuration, then use "Add Connection" to link your bank</li>
-      <li><%= t("settings.providers.enable_banking_panel.callback_url_instruction", callback_url: enable_banking_callback_url) %></li>
-    </ol>
-
-    <p class="text-primary font-medium">Field descriptions:</p>
-    <ul>
-      <li><strong>Country Code:</strong> ISO 3166-1 alpha-2 country code (e.g., GB, DE, FR) - determines available banks</li>
-      <li><strong>Application ID:</strong> The ID generated in your Enable Banking developer account</li>
-      <li><strong>Client Certificate:</strong> The certificate generated when you created your application (must include the private key)</li>
-    </ul>
-  </div>
+  <%
+    eb_link = link_to("Enable Banking", "https://enablebanking.com", target: "_blank", rel: "noopener noreferrer", class: "text-primary font-medium underline")
+  %>
+  <%= render "settings/providers/setup_steps",
+             steps: [
+               t("settings.providers.enable_banking_panel.step_1_html", link: eb_link),
+               t("settings.providers.enable_banking_panel.step_2"),
+               t("settings.providers.enable_banking_panel.step_3"),
+               t("settings.providers.enable_banking_panel.callback_url_instruction", callback_url: enable_banking_callback_url)
+             ] %>
 
   <% error_msg = local_assigns[:error_message] || @error_message %>
   <% if error_msg.present? %>
-    <div class="p-2 rounded-md bg-destructive/10 text-destructive text-sm overflow-hidden">
-      <p class="line-clamp-3" title="<%= error_msg %>"><%= error_msg %></p>
-    </div>
+    <%= render DS::Alert.new(message: error_msg, variant: :error) %>
   <% end %>
 
   <%
@@ -74,32 +65,32 @@
                     ["Sweden (SE)", "SE"],
                     ["United Kingdom (GB)", "GB"]
                   ], enable_banking_item.country_code),
-                  { label: true, include_blank: "Select country..." },
-                  { label: "Country", class: "form-field__input" } %>
+                  { label: true, include_blank: t("settings.providers.enable_banking_panel.select_country") },
+                  { label: t("settings.providers.enable_banking_panel.country_label"), class: "form-field__input" } %>
 
     <% if has_authenticated_connections && !is_new_record %>
-      <div class="p-3 rounded-md bg-warning/10 text-warning text-sm">
-        <p class="font-medium">Configuration locked</p>
-        <p class="text-xs mt-1">Credentials cannot be changed while you have active bank connections. Remove all connections first to update credentials.</p>
-      </div>
+      <%= render DS::Alert.new(
+            variant: :warning,
+            title: t("settings.providers.enable_banking_panel.config_locked_title"),
+            message: t("settings.providers.enable_banking_panel.config_locked_message")
+          ) %>
     <% end %>
 
     <%= form.text_field :application_id,
-                        label: "Application ID",
-                        placeholder: is_new_record ? "Enter application ID" : "Enter new ID to update",
+                        label: t("settings.providers.enable_banking_panel.application_id_label"),
+                        placeholder: is_new_record ? t("settings.providers.enable_banking_panel.application_id_placeholder_new") : t("settings.providers.enable_banking_panel.application_id_placeholder_update"),
                         value: enable_banking_item.application_id,
                         disabled: has_authenticated_connections && !is_new_record %>
 
     <%= form.text_area :client_certificate,
-                        label: "Client Certificate (with Private Key)",
+                        label: t("settings.providers.enable_banking_panel.client_certificate_label"),
                         placeholder: "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
                         rows: 6,
                         class: "form-field__input font-mono text-xs",
                         disabled: has_authenticated_connections && !is_new_record %>
 
     <div class="flex justify-end">
-      <%= form.submit is_new_record ? "Save Configuration" : "Update Configuration",
-                      class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-white bg-gray-900 hover:bg-gray-800" %>
+      <%= form.submit is_new_record ? t("settings.providers.enable_banking_panel.save_and_connect") : t("settings.providers.enable_banking_panel.update_connection") %>
     </div>
   <% end %>
 
@@ -116,7 +107,7 @@
         <div class="flex items-center justify-between p-3 rounded-lg bg-container border border-primary">
           <div class="flex items-center gap-3">
             <% if item.syncing? %>
-              <div class="w-2 h-2 bg-primary rounded-full animate-pulse"></div>
+              <div class="w-2 h-2 bg-inverse rounded-full animate-pulse"></div>
               <div>
                 <p class="text-sm font-medium text-primary"><%= item.aspsp_name || t("settings.providers.enable_banking_panel.syncing", default: "Syncing") %></p>
                 <p class="text-xs text-secondary"><%= t("settings.providers.enable_banking_panel.syncing", default: "Syncing") %></p>
@@ -130,22 +121,22 @@
             <% elsif item.session_valid? %>
               <div class="w-2 h-2 bg-success rounded-full"></div>
               <div>
-                <p class="text-sm font-medium text-primary"><%= item.aspsp_name || "Connected Bank" %></p>
+                <p class="text-sm font-medium text-primary"><%= item.aspsp_name || t("settings.providers.enable_banking_panel.connected_bank") %></p>
                 <p class="text-xs text-secondary">
-                  Session expires: <%= item.session_expires_at&.strftime("%b %d, %Y") || "Unknown" %>
+                  <%= t("settings.providers.enable_banking_panel.session_expires", date: item.session_expires_at&.strftime("%b %d, %Y") || t("settings.providers.enable_banking_panel.unknown")) %>
                 </p>
               </div>
             <% elsif item.session_expired? %>
               <div class="w-2 h-2 bg-warning rounded-full"></div>
               <div>
-                <p class="text-sm font-medium text-primary"><%= item.aspsp_name || "Connection" %></p>
-                <p class="text-xs text-destructive">Session expired - reconnect</p>
+                <p class="text-sm font-medium text-primary"><%= item.aspsp_name || t("settings.providers.enable_banking_panel.connection") %></p>
+                <p class="text-xs text-destructive"><%= t("settings.providers.enable_banking_panel.session_expired_reconnect") %></p>
               </div>
             <% else %>
               <div class="w-2 h-2 bg-secondary rounded-full"></div>
               <div>
-                <p class="text-sm font-medium text-primary">Configured</p>
-                <p class="text-xs text-secondary">Ready to link accounts</p>
+                <p class="text-sm font-medium text-primary"><%= t("settings.providers.enable_banking_panel.configured") %></p>
+                <p class="text-xs text-secondary"><%= t("settings.providers.enable_banking_panel.ready_to_link") %></p>
               </div>
             <% end %>
           </div>
@@ -154,30 +145,32 @@
             <% if item.session_valid? %>
               <%= button_to sync_enable_banking_item_path(item),
                             method: :post,
-                            class: "inline-flex items-center justify-center rounded-lg px-3 py-1.5 text-xs font-medium text-primary bg-container border border-primary hover:bg-gray-50 transition-colors",
+                            class: "inline-flex items-center justify-center rounded-lg px-3 py-1.5 text-xs font-medium text-primary bg-container border border-primary hover:bg-surface-inset transition-colors",
                             data: { turbo: false } do %>
-                Sync
+                <%= t("settings.providers.enable_banking_panel.sync") %>
               <% end %>
             <% elsif item.session_expired? %>
               <%= button_to reauthorize_enable_banking_item_path(item),
                             method: :post,
                             class: "inline-flex items-center justify-center rounded-lg px-3 py-1.5 text-xs font-medium text-white bg-warning hover:opacity-90 transition-colors",
                             data: { turbo: false } do %>
-                Reconnect
+                <%= t("settings.providers.enable_banking_panel.reconnect") %>
               <% end %>
             <% else %>
-              <%= link_to select_bank_enable_banking_item_path(item),
-                          class: "inline-flex items-center justify-center rounded-lg px-3 py-1.5 text-xs font-medium text-white bg-gray-900 hover:bg-gray-800 transition-colors",
-                          data: { turbo_frame: "modal" } do %>
-                Connect Bank
-              <% end %>
+              <%= render DS::Link.new(
+                text: t("settings.providers.enable_banking_panel.connect_bank"),
+                href: select_bank_enable_banking_item_path(item),
+                variant: :primary,
+                size: :sm,
+                data: { turbo_frame: "modal" }
+              ) %>
             <% end %>
 
             <%= button_to enable_banking_item_path(item),
                           method: :delete,
                           class: "inline-flex items-center justify-center rounded-lg px-3 py-1.5 text-xs font-medium text-destructive hover:bg-destructive/10 transition-colors",
-                          data: { turbo_confirm: "Are you sure you want to remove this connection?" } do %>
-              Remove
+                          data: { turbo_confirm: t("settings.providers.enable_banking_panel.remove_confirm") } do %>
+              <%= t("settings.providers.enable_banking_panel.remove") %>
             <% end %>
           </div>
         </div>
@@ -186,13 +179,13 @@
       <%# Add Connection button below the list - only show if we have a valid session to copy credentials from %>
       <% if item_for_new_connection %>
         <div class="flex justify-center pt-2">
-          <%= button_to new_connection_enable_banking_item_path(item_for_new_connection),
-                        method: :post,
-                        class: "inline-flex items-center gap-2 justify-center rounded-lg px-4 py-2 text-sm font-medium text-white bg-gray-900 hover:bg-gray-800 transition-colors",
-                        data: { turbo_frame: "modal" } do %>
-            <%= icon "plus", size: "sm" %>
-            Add Connection
-          <% end %>
+          <%= render DS::Button.new(
+            text: t("settings.providers.enable_banking_panel.add_connection"),
+            icon: "plus",
+            href: new_connection_enable_banking_item_path(item_for_new_connection),
+            variant: :primary,
+            data: { turbo_method: :post, turbo_frame: "modal" }
+          ) %>
         </div>
       <% end %>
     </div>
diff --git a/app/views/settings/providers/_group_heading.html.erb b/app/views/settings/providers/_group_heading.html.erb
new file mode 100644
index 000000000..e0a831f49
--- /dev/null
+++ b/app/views/settings/providers/_group_heading.html.erb
@@ -0,0 +1,12 @@
+<%# locals: (title:, count: nil, description: nil, anchor: nil) %>
+<%= tag.div id: anchor.presence, class: "flex items-baseline justify-between gap-3 mt-6 mb-1.5 px-1" do %>
+  <h2 class="text-xs font-medium text-secondary uppercase flex items-baseline gap-2">
+    <%= title %>
+    <% if count %>
+      <span class="text-subdued font-normal normal-case tabular-nums">· <%= count %></span>
+    <% end %>
+  </h2>
+  <% if description.present? %>
+    <p class="text-xs text-secondary"><%= description %></p>
+  <% end %>
+<% end %>
diff --git a/app/views/settings/providers/_health_strip.html.erb b/app/views/settings/providers/_health_strip.html.erb
new file mode 100644
index 000000000..1a30989f7
--- /dev/null
+++ b/app/views/settings/providers/_health_strip.html.erb
@@ -0,0 +1,28 @@
+<%# locals: (connected:, needs_attention:, accounts_syncing:, last_synced_at:) %>
+<div class="bg-container shadow-border-xs rounded-xl flex items-center gap-5 px-3.5 py-2.5 text-sm mt-4 mb-5">
+  <span class="inline-flex items-center gap-2">
+    <%= icon "check", size: "sm", class: "!w-3.5 !h-3.5 text-success" %>
+    <span class="font-medium tabular-nums"><%= connected %></span>
+    <span class="text-secondary"><%= t("settings.providers.health_strip.connected") %></span>
+  </span>
+  <% if needs_attention.positive? %>
+    <span class="h-3.5 border-l border-secondary"></span>
+    <span class="inline-flex items-center gap-2">
+      <%= icon "circle-alert", size: "sm", class: "!w-3.5 !h-3.5 text-warning" %>
+      <span class="font-medium tabular-nums"><%= needs_attention %></span>
+      <span class="text-secondary"><%= t("settings.providers.health_strip.needs_attention") %></span>
+    </span>
+  <% end %>
+  <% if accounts_syncing.positive? %>
+    <span class="h-3.5 border-l border-secondary"></span>
+    <span class="inline-flex items-center gap-2 text-secondary">
+      <span class="font-medium tabular-nums"><%= accounts_syncing %></span>
+      <span><%= t("settings.providers.health_strip.accounts_syncing") %></span>
+    </span>
+  <% end %>
+  <% if last_synced_at %>
+    <span class="ml-auto text-xs text-subdued">
+      <%= t("settings.providers.health_strip.last_synced", time: concise_time_ago(last_synced_at)) %>
+    </span>
+  <% end %>
+</div>
diff --git a/app/views/settings/providers/_ibkr_panel.html.erb b/app/views/settings/providers/_ibkr_panel.html.erb
new file mode 100644
index 000000000..7e9e686d9
--- /dev/null
+++ b/app/views/settings/providers/_ibkr_panel.html.erb
@@ -0,0 +1,152 @@
+<div id="ibkr-providers-panel" class="space-y-4">
+  <% error_msg = local_assigns[:error_message] || @error_message %>
+  <% if error_msg.present? %>
+    <%= render DS::Alert.new(message: error_msg, variant: :error) %>
+  <% end %>
+
+  <%= render "settings/providers/setup_steps",
+             steps: [
+               t(".steps.step_1"),
+               t(".steps.step_2"),
+               t(".steps.step_3"),
+               t(".steps.step_4"),
+               t(".steps.step_5")
+             ] %>
+
+  <%= render DS::Disclosure.new(variant: :card_inset) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-start justify-between gap-3">
+        <div>
+          <p class="text-xs font-medium uppercase text-subdued tracking-wider mb-2"><%= t(".flex_query_details.eyebrow") %></p>
+          <p class="text-sm font-medium text-primary"><%= t(".flex_query_details.title") %></p>
+          <p class="text-xs text-secondary mt-1"><%= t(".flex_query_details.summary") %></p>
+        </div>
+        <%= icon "chevron-down", class: "mt-0.5 text-secondary group-open:rotate-180 motion-safe:transition-transform motion-safe:duration-150" %>
+      </div>
+    <% end %>
+
+    <div class="mt-4 space-y-4 text-sm text-secondary">
+      <div class="space-y-2">
+        <p class="font-medium text-primary"><%= t(".flex_query_details.sections_heading") %></p>
+        <ul class="list-disc list-inside space-y-2">
+          <li>
+            <span class="text-primary"><%= t(".sections.account_information") %></span>
+          </li>
+          <li>
+            <span class="text-primary"><%= t(".sections.cash_report") %></span>
+            <ul class="list-disc list-inside mt-1 ml-4 space-y-1">
+              <li><%= t(".sections.cash_report_options") %></li>
+              <li><%= t(".sections.cash_report_fields") %></li>
+            </ul>
+          </li>
+          <li>
+            <span class="text-primary"><%= t(".sections.cash_transactions") %></span>
+            <ul class="list-disc list-inside mt-1 ml-4 space-y-1">
+              <li><%= t(".sections.cash_transactions_options") %></li>
+              <li><%= t(".sections.cash_transactions_fields") %></li>
+            </ul>
+          </li>
+          <li>
+            <span class="text-primary"><%= t(".sections.change_in_position_value_summary") %></span>
+          </li>
+          <li>
+            <span class="text-primary"><%= t(".sections.net_asset_value") %></span>
+            <ul class="list-disc list-inside mt-1 ml-4 space-y-1">
+              <li><%= t(".sections.net_asset_value_options") %></li>
+              <li><%= t(".sections.net_asset_value_fields") %></li>
+            </ul>
+          </li>
+          <li>
+            <span class="text-primary"><%= t(".sections.open_positions") %></span>
+            <ul class="list-disc list-inside mt-1 ml-4 space-y-1">
+              <li><%= t(".sections.open_positions_options") %></li>
+              <li><%= t(".sections.open_positions_fields") %></li>
+            </ul>
+          </li>
+          <li>
+            <span class="text-primary"><%= t(".sections.trades") %></span>
+            <ul class="list-disc list-inside mt-1 ml-4 space-y-1">
+              <li><%= t(".sections.trades_options") %></li>
+              <li><%= t(".sections.trades_fields") %></li>
+            </ul>
+          </li>
+        </ul>
+      </div>
+
+      <div class="space-y-2">
+        <p class="font-medium text-primary"><%= t(".flex_query_details.configuration_heading") %></p>
+        <ul class="list-disc list-inside space-y-1">
+          <li><%= t(".configuration.models") %></li>
+          <li><%= t(".configuration.format") %></li>
+          <li><%= t(".configuration.period") %></li>
+          <li><%= t(".configuration.date_format") %></li>
+          <li><%= t(".configuration.time_format") %></li>
+          <li><%= t(".configuration.date_time_separator") %></li>
+          <li><%= t(".configuration.profit_and_loss") %></li>
+          <li><%= t(".configuration.all_other_options") %></li>
+        </ul>
+      </div>
+
+      <p class="text-xs text-secondary"><%= t(".report_window_note") %></p>
+    </div>
+  <% end %>
+
+  <%
+    ibkr_item = Current.family.ibkr_items.first_or_initialize(name: "Interactive Brokers")
+    is_new_record = ibkr_item.new_record?
+  %>
+
+  <% if ibkr_item.persisted? %>
+    <div class="flex flex-wrap justify-end gap-2">
+      <%= button_to sync_ibkr_item_path(ibkr_item),
+                    method: :post,
+                    class: "inline-flex items-center gap-1 px-3 py-1.5 text-sm font-medium text-secondary hover:text-primary border border-secondary rounded-lg hover:border-primary",
+                    disabled: ibkr_item.syncing? do %>
+        <%= icon "refresh-cw", size: "sm" %>
+        <%= t(".sync") %>
+      <% end %>
+
+      <%= button_to ibkr_item_path(ibkr_item),
+                    method: :delete,
+                    class: "inline-flex items-center gap-1 px-3 py-1.5 text-sm font-medium text-destructive hover:bg-destructive/10 rounded-lg",
+                    data: { turbo_confirm: t(".disconnect_confirm") } do %>
+        <%= icon "trash-2", size: "sm" %>
+      <% end %>
+    </div>
+  <% end %>
+
+  <%= styled_form_with model: ibkr_item,
+                       url: is_new_record ? ibkr_items_path : ibkr_item_path(ibkr_item),
+                       scope: :ibkr_item,
+                       method: is_new_record ? :post : :patch,
+                       data: { turbo: true },
+                       class: "space-y-3" do |form| %>
+    <%= form.text_field :query_id,
+                        label: t(".query_id_label"),
+                        placeholder: is_new_record ? t(".query_id_placeholder_new") : t(".query_id_placeholder_existing"),
+                        type: :password %>
+
+    <%= form.text_field :token,
+                        label: t(".token_label"),
+                        placeholder: is_new_record ? t(".token_placeholder_new") : t(".token_placeholder_existing"),
+                        type: :password %>
+
+    <div class="flex flex-wrap justify-end gap-2">
+      <%= form.submit(is_new_record ? t(".save_configuration") : t(".update_configuration")) %>
+    </div>
+  <% end %>
+
+  <div class="flex items-center gap-2">
+    <% if ibkr_item.persisted? && ibkr_item.credentials_configured? %>
+      <div class="w-2 h-2 bg-success rounded-full"></div>
+      <p class="text-sm text-secondary">
+        <%= t(".status_configured_prefix", summary: ibkr_item.sync_status_summary) %>
+        <%= link_to t(".accounts_tab"), accounts_path, class: "link" %>
+        <%= t(".status_configured_suffix") %>
+      </p>
+    <% else %>
+      <div class="w-2 h-2 bg-gray-400 rounded-full"></div>
+      <p class="text-sm text-secondary"><%= t(".not_configured") %></p>
+    <% end %>
+  </div>
+</div>
diff --git a/app/views/settings/providers/_indexa_capital_panel.html.erb b/app/views/settings/providers/_indexa_capital_panel.html.erb
index c31ec5f1c..255126e42 100644
--- a/app/views/settings/providers/_indexa_capital_panel.html.erb
+++ b/app/views/settings/providers/_indexa_capital_panel.html.erb
@@ -1,18 +1,14 @@
 <div class="space-y-4">
-  <div class="prose prose-sm text-secondary">
-    <p class="text-primary font-medium"><%= t("indexa_capital_items.panel.setup_instructions") %></p>
-    <ol>
-      <li><%= t("indexa_capital_items.panel.step_1") %></li>
-      <li><%= t("indexa_capital_items.panel.step_2") %></li>
-      <li><%= t("indexa_capital_items.panel.step_3") %></li>
-    </ol>
-  </div>
+  <%= render "settings/providers/setup_steps",
+             steps: [
+               t("indexa_capital_items.panel.step_1"),
+               t("indexa_capital_items.panel.step_2"),
+               t("indexa_capital_items.panel.step_3")
+             ] %>
 
   <% error_msg = local_assigns[:error_message] || @error_message %>
   <% if error_msg.present? %>
-    <div class="p-2 rounded-md bg-destructive/10 text-destructive text-sm overflow-hidden">
-      <p class="line-clamp-3" title="<%= error_msg %>"><%= error_msg %></p>
-    </div>
+    <%= render DS::Alert.new(message: error_msg, variant: :error) %>
   <% end %>
 
   <%
@@ -27,19 +23,18 @@
                        data: { turbo: true },
                        class: "space-y-3" do |form| %>
 
-    <div class="bg-surface border border-primary p-3 rounded-lg">
-      <p class="text-sm font-medium text-primary mb-2"><%= t("indexa_capital_items.panel.fields.api_token.label") %></p>
-      <p class="text-xs text-secondary mb-2"><%= t("indexa_capital_items.panel.fields.api_token.description") %></p>
-      <%= form.text_field :api_token,
-                          label: t("indexa_capital_items.panel.fields.api_token.label"),
-                          placeholder: is_new_record ? t("indexa_capital_items.panel.fields.api_token.placeholder_new") : t("indexa_capital_items.panel.fields.api_token.placeholder_update"),
-                          type: :password %>
-    </div>
+    <%= form.text_field :api_token,
+                        label: t("indexa_capital_items.panel.fields.api_token.label"),
+                        placeholder: is_new_record ? t("indexa_capital_items.panel.fields.api_token.placeholder_new") : t("indexa_capital_items.panel.fields.api_token.placeholder_update"),
+                        type: :password %>
+    <p class="text-xs text-secondary px-1 -mt-1"><%= t("indexa_capital_items.panel.fields.api_token.description") %></p>
 
-    <details class="group">
-      <summary class="text-sm text-secondary cursor-pointer hover:text-primary transition-colors">
-        <%= t("indexa_capital_items.panel.alternative_auth") %>
-      </summary>
+    <%= render DS::Disclosure.new(variant: :inline) do |disclosure| %>
+      <% disclosure.with_summary_content do %>
+        <span class="text-sm text-secondary hover:text-primary transition-colors">
+          <%= t("indexa_capital_items.panel.alternative_auth") %>
+        </span>
+      <% end %>
       <div class="mt-3 space-y-3 pt-3 border-t border-primary">
         <%= form.text_field :username,
                             label: t("indexa_capital_items.panel.fields.username.label"),
@@ -56,22 +51,12 @@
                             placeholder: is_new_record ? t("indexa_capital_items.panel.fields.password.placeholder_new") : t("indexa_capital_items.panel.fields.password.placeholder_update"),
                             type: :password %>
       </div>
-    </details>
+    <% end %>
 
     <div class="flex justify-end">
       <%= form.submit is_new_record ? t("indexa_capital_items.panel.save_button") : t("indexa_capital_items.panel.update_button"),
-                      class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium btn btn--primary" %>
+                      class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium" %>
     </div>
   <% end %>
 
-  <% items = local_assigns[:indexa_capital_items] || @indexa_capital_items || Current.family.indexa_capital_items.where.not(username: [nil, ""], document: [nil, ""], password: [nil, ""]).or(Current.family.indexa_capital_items.where.not(api_token: [nil, ""])) %>
-  <div class="flex items-center gap-2">
-    <% if items&.any? %>
-      <div class="w-2 h-2 bg-success rounded-full"></div>
-      <p class="text-sm text-secondary"><%= t("indexa_capital_items.panel.status_configured_html", accounts_path: accounts_path).html_safe %></p>
-    <% else %>
-      <div class="w-2 h-2 bg-gray-400 rounded-full"></div>
-      <p class="text-sm text-secondary"><%= t("indexa_capital_items.panel.status_not_configured") %></p>
-    <% end %>
-  </div>
 </div>
diff --git a/app/views/settings/providers/_kraken_panel.html.erb b/app/views/settings/providers/_kraken_panel.html.erb
new file mode 100644
index 000000000..39719602c
--- /dev/null
+++ b/app/views/settings/providers/_kraken_panel.html.erb
@@ -0,0 +1,141 @@
+<div id="kraken-providers-panel" class="space-y-4">
+  <% items = local_assigns[:kraken_items] || @kraken_items || Current.family.kraken_items.active.ordered %>
+
+  <%= render DS::Alert.new(
+        variant: :warning,
+        message: safe_join([
+          content_tag(:p, t("settings.providers.kraken_panel.read_only_title"), class: "font-medium"),
+          content_tag(:p, t("settings.providers.kraken_panel.read_only_body"), class: "mt-1")
+        ])
+      ) %>
+
+  <%= render "settings/providers/setup_steps",
+             steps: [
+               t("settings.providers.kraken_panel.step1_html").html_safe,
+               t("settings.providers.kraken_panel.step2"),
+               t("settings.providers.kraken_panel.step3")
+             ] %>
+
+  <% error_msg = local_assigns[:error_message] || @error_message %>
+  <% if error_msg.present? %>
+    <%= render DS::Alert.new(message: error_msg, variant: :error) %>
+  <% end %>
+
+  <% if items.any? %>
+    <div class="space-y-3">
+      <% items.each do |item| %>
+        <%= render DS::Disclosure.new(variant: :card) do |disclosure| %>
+          <% disclosure.with_summary_content do %>
+            <div class="flex items-center justify-between gap-3 w-full">
+              <div class="flex items-center gap-3 min-w-0">
+                <div class="flex items-center justify-center h-8 w-8 rounded-full bg-surface-inset">
+                  <%= icon "waves", size: "sm", class: "text-primary" %>
+                </div>
+                <div class="min-w-0">
+                  <p class="font-medium text-primary truncate"><%= item.name %></p>
+                  <p class="text-xs text-secondary">
+                    <% if item.syncing? %>
+                      <%= t("settings.providers.kraken_panel.syncing") %>
+                    <% else %>
+                      <%= item.sync_status_summary %>
+                    <% end %>
+                  </p>
+                </div>
+              </div>
+            </div>
+          <% end %>
+
+          <div class="mt-4 space-y-4">
+            <div class="flex flex-wrap items-center gap-2">
+              <%= button_to sync_kraken_item_path(item),
+                            method: :post,
+                            class: "inline-flex items-center gap-1 px-3 py-1.5 text-sm font-medium text-secondary hover:text-primary border border-secondary rounded-lg hover:border-primary",
+                            disabled: item.syncing? do %>
+                <%= icon "refresh-cw", size: "sm" %>
+                <%= t("settings.providers.kraken_panel.sync") %>
+              <% end %>
+
+              <%= render DS::Link.new(
+                text: t("settings.providers.kraken_panel.setup_accounts"),
+                icon: "settings",
+                variant: "secondary",
+                href: setup_accounts_kraken_item_path(item),
+                frame: :modal
+              ) %>
+
+              <%= button_to kraken_item_path(item),
+                            method: :delete,
+                            class: "inline-flex items-center gap-1 px-3 py-1.5 text-sm font-medium text-destructive hover:bg-destructive/10 rounded-lg",
+                            data: { turbo_confirm: t("settings.providers.kraken_panel.disconnect_confirm", name: item.name) } do %>
+                <%= icon "trash-2", size: "sm" %>
+                <%= t("settings.providers.kraken_panel.disconnect") %>
+              <% end %>
+            </div>
+
+            <%= styled_form_with model: item,
+                                 url: kraken_item_path(item),
+                                 scope: :kraken_item,
+                                 method: :patch,
+                                 data: { turbo: true },
+                                 class: "space-y-3" do |form| %>
+              <%= form.text_field :name,
+                                  label: t("settings.providers.kraken_panel.connection_name_label"),
+                                  placeholder: t("settings.providers.kraken_panel.connection_name_placeholder") %>
+
+              <%= form.text_field :api_key,
+                                  label: t("settings.providers.kraken_panel.api_key_label"),
+                                  placeholder: t("settings.providers.kraken_panel.keep_api_key_placeholder"),
+                                  type: :password,
+                                  value: nil %>
+
+              <%= form.text_field :api_secret,
+                                  label: t("settings.providers.kraken_panel.api_secret_label"),
+                                  placeholder: t("settings.providers.kraken_panel.keep_api_secret_placeholder"),
+                                  type: :password,
+                                  value: nil %>
+
+              <div class="flex justify-end">
+                <%= form.submit t("settings.providers.kraken_panel.update_connection") %>
+              </div>
+            <% end %>
+          </div>
+        <% end %>
+      <% end %>
+    </div>
+  <% end %>
+
+  <% kraken_item = Current.family.kraken_items.build(name: t("settings.providers.kraken_panel.default_connection_name")) %>
+  <% if items.any? %>
+    <h3 class="flex items-center gap-2 text-sm font-medium text-primary mt-4">
+      <%= icon "plus", size: "sm" %>
+      <%= t("settings.providers.kraken_panel.add_connection") %>
+    </h3>
+  <% end %>
+
+  <%= styled_form_with model: kraken_item,
+                       url: kraken_items_path,
+                       scope: :kraken_item,
+                       method: :post,
+                       data: { turbo: true },
+                       class: "space-y-3" do |form| %>
+    <%= form.text_field :name,
+                        label: t("settings.providers.kraken_panel.connection_name_label"),
+                        placeholder: t("settings.providers.kraken_panel.connection_name_placeholder") %>
+
+    <%= form.text_field :api_key,
+                        label: t("settings.providers.kraken_panel.api_key_label"),
+                        placeholder: t("settings.providers.kraken_panel.api_key_placeholder"),
+                        type: :password,
+                        value: nil %>
+
+    <%= form.text_field :api_secret,
+                        label: t("settings.providers.kraken_panel.api_secret_label"),
+                        placeholder: t("settings.providers.kraken_panel.api_secret_placeholder"),
+                        type: :password,
+                        value: nil %>
+
+    <div class="flex justify-end">
+      <%= form.submit t("settings.providers.kraken_panel.add_connection") %>
+    </div>
+  <% end %>
+</div>
diff --git a/app/views/settings/providers/_lunchflow_panel.html.erb b/app/views/settings/providers/_lunchflow_panel.html.erb
index 65696e83e..d6aef9530 100644
--- a/app/views/settings/providers/_lunchflow_panel.html.erb
+++ b/app/views/settings/providers/_lunchflow_panel.html.erb
@@ -1,24 +1,17 @@
 <div class="space-y-4">
-  <div class="prose prose-sm text-secondary">
-    <p class="text-primary font-medium">Setup instructions:</p>
-    <ol>
-      <li>Visit <a href="https://www.lunchflow.app/?atp=BiDIYS" target="_blank" rel="noopener noreferrer" class="link">Lunch Flow</a> to get your API key</li>
-      <li>Paste your API key below and click the Save button</li>
-      <li>After a successful connection, go to the Accounts tab to set up new accounts and link them to your existing ones</li>
-    </ol>
-
-    <p class="text-primary font-medium">Field descriptions:</p>
-    <ul>
-      <li><strong>API Key:</strong> Your Lunch Flow API key for authentication (required)</li>
-      <li><strong>Base URL:</strong> Base URL for Lunch Flow API (optional, defaults to https://lunchflow.app/api/v1)</li>
-    </ul>
-  </div>
+  <%
+    lf_link = link_to("Lunch Flow", "https://www.lunchflow.app/?atp=BiDIYS", target: "_blank", rel: "noopener noreferrer", class: "text-primary font-medium underline")
+  %>
+  <%= render "settings/providers/setup_steps",
+             steps: [
+               t("settings.providers.lunchflow_panel.step_1_html", link: lf_link),
+               t("settings.providers.lunchflow_panel.step_2"),
+               t("settings.providers.lunchflow_panel.step_3")
+             ] %>
 
   <% error_msg = local_assigns[:error_message] || @error_message %>
   <% if error_msg.present? %>
-    <div class="p-2 rounded-md bg-destructive/10 text-destructive text-sm overflow-hidden">
-      <p class="line-clamp-3" title="<%= error_msg %>"><%= error_msg %></p>
-    </div>
+    <%= render DS::Alert.new(message: error_msg, variant: :error) %>
   <% end %>
 
   <%
@@ -34,29 +27,18 @@
                        data: { turbo: true },
                        class: "space-y-3" do |form| %>
     <%= form.text_field :api_key,
-                        label: "API Key",
-                        placeholder: is_new_record ? "Paste API key here" : "Enter new API key to update",
+                        label: t("settings.providers.lunchflow_panel.api_key_label"),
+                        placeholder: is_new_record ? t("settings.providers.lunchflow_panel.api_key_placeholder_new") : t("settings.providers.lunchflow_panel.api_key_placeholder_update"),
                         type: :password %>
 
     <%= form.text_field :base_url,
-                        label: "Base URL (Optional)",
-                        placeholder: "https://lunchflow.app/api/v1 (default)",
+                        label: t("settings.providers.lunchflow_panel.base_url_label"),
+                        placeholder: t("settings.providers.lunchflow_panel.base_url_placeholder"),
                         value: lunchflow_item.base_url %>
 
     <div class="flex justify-end">
-      <%= form.submit is_new_record ? "Save Configuration" : "Update Configuration",
-                      class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-white bg-gray-900 hover:bg-gray-800 focus:outline-none focus:ring-2 focus:ring-gray-900 focus:ring-offset-2 transition-colors" %>
+      <%= form.submit is_new_record ? t("settings.providers.lunchflow_panel.save_and_connect") : t("settings.providers.lunchflow_panel.update_connection") %>
     </div>
   <% end %>
 
-  <% items = local_assigns[:lunchflow_items] || @lunchflow_items || Current.family.lunchflow_items.where.not(api_key: nil) %>
-  <div class="flex items-center gap-2">
-    <% if items&.any? %>
-      <div class="w-2 h-2 bg-success rounded-full"></div>
-      <p class="text-sm text-secondary">Configured and ready to use. Visit the <a href="<%= accounts_path %>" class="link">Accounts</a> tab to manage and set up accounts.</p>
-    <% else %>
-      <div class="w-2 h-2 bg-gray-400 rounded-full"></div>
-      <p class="text-sm text-secondary">Not configured</p>
-    <% end %>
-  </div>
 </div>
diff --git a/app/views/settings/providers/_maturity_badge.html.erb b/app/views/settings/providers/_maturity_badge.html.erb
new file mode 100644
index 000000000..5f7979bca
--- /dev/null
+++ b/app/views/settings/providers/_maturity_badge.html.erb
@@ -0,0 +1,10 @@
+<%# locals: (label:) %>
+<% if label %>
+  <%= render DS::Pill.new(
+    label: label,
+    tone: :neutral,
+    marker: false,
+    show_dot: false,
+    size: :sm
+  ) %>
+<% end %>
diff --git a/app/views/settings/providers/_mercury_panel.html.erb b/app/views/settings/providers/_mercury_panel.html.erb
index 18e199c0b..c653ed66a 100644
--- a/app/views/settings/providers/_mercury_panel.html.erb
+++ b/app/views/settings/providers/_mercury_panel.html.erb
@@ -1,73 +1,125 @@
-<div class="space-y-4">
-  <div class="prose prose-sm text-secondary">
-    <p class="text-primary font-medium">Setup instructions:</p>
-    <ol>
-      <li>Visit <a href="https://mercury.com" target="_blank" rel="noopener noreferrer" class="link">Mercury</a> and log in to your account</li>
-      <li>Go to Settings > Developer > API Tokens</li>
-      <li>Create a new API token with "Read Only" access</li>
-      <li><strong>Important:</strong> Add your server's IP address to the token's whitelist</li>
-      <li>Copy the <strong>full token</strong> (including the <code>secret-token:</code> prefix) and paste it below</li>
-      <li>After a successful connection, go to the Accounts tab to set up new accounts</li>
-    </ol>
+<div id="mercury-providers-panel" class="space-y-4">
+  <% active_items = local_assigns[:mercury_items] || @mercury_items || Current.family.mercury_items.active.ordered %>
+  <% credentialed_items = active_items.select(&:credentials_configured?) %>
 
-    <p class="text-primary font-medium">Field descriptions:</p>
-    <ul>
-      <li><strong>API Token:</strong> Your full Mercury API token including the <code>secret-token:</code> prefix (required)</li>
-      <li><strong>Base URL:</strong> Mercury API URL (optional, defaults to https://api.mercury.com/api/v1)</li>
-    </ul>
-
-    <p class="text-sm text-muted-foreground mt-2">
-      <strong>Note:</strong> For sandbox testing, use <code>https://api-sandbox.mercury.com/api/v1</code> as the Base URL.
-      Mercury requires IP whitelisting - make sure to add your IP in the Mercury dashboard.
-    </p>
-  </div>
+  <%= render "settings/providers/setup_steps",
+             steps: [
+               t("mercury_items.provider_panel.instructions.sign_in_html", link: link_to("Mercury", "https://mercury.com", target: "_blank", rel: "noopener noreferrer", class: "text-primary font-medium underline")).html_safe,
+               t("mercury_items.provider_panel.instructions.open_tokens"),
+               t("mercury_items.provider_panel.instructions.create_token"),
+               t("mercury_items.provider_panel.instructions.whitelist_ip_html").html_safe,
+               t("mercury_items.provider_panel.instructions.copy_token_html").html_safe
+             ] %>
 
   <% error_msg = local_assigns[:error_message] || @error_message %>
   <% if error_msg.present? %>
-    <div class="p-2 rounded-md bg-destructive/10 text-destructive text-sm overflow-hidden">
-      <p class="line-clamp-3" title="<%= error_msg %>"><%= error_msg %></p>
+    <%= render DS::Alert.new(message: error_msg, variant: :error) %>
+  <% end %>
+
+  <% if active_items.any? %>
+    <div class="space-y-3">
+      <% active_items.each do |item| %>
+        <%= render DS::Disclosure.new(variant: :card) do |disclosure| %>
+          <% disclosure.with_summary_content do %>
+            <div class="flex items-center justify-between gap-2 w-full">
+              <div class="flex items-center gap-3">
+                <div class="flex items-center justify-center h-8 w-8 bg-blue-600/10 rounded-full">
+                  <p class="text-blue-600 text-xs font-medium"><%= item.name.to_s.first.to_s.upcase %></p>
+                </div>
+                <div>
+                  <p class="font-medium text-primary"><%= item.name %></p>
+                  <p class="text-xs text-secondary"><%= item.sync_status_summary %></p>
+                </div>
+              </div>
+            </div>
+          <% end %>
+
+          <div class="mt-4 space-y-4">
+            <div class="flex items-center gap-2">
+              <%= button_to sync_mercury_item_path(item),
+                            method: :post,
+                            class: "inline-flex items-center gap-1 px-3 py-1.5 text-sm font-medium text-secondary hover:text-primary border border-secondary rounded-lg hover:border-primary",
+                            disabled: item.syncing? do %>
+                <%= icon "refresh-cw", size: "sm" %>
+                <%= t("mercury_items.provider_panel.sync") %>
+              <% end %>
+              <%= button_to mercury_item_path(item),
+                            method: :delete,
+                            class: "inline-flex items-center gap-1 px-3 py-1.5 text-sm font-medium text-destructive hover:bg-destructive/10 rounded-lg",
+                            data: { turbo_confirm: t("mercury_items.provider_panel.disconnect_confirm", name: item.name) } do %>
+                <%= icon "trash-2", size: "sm" %>
+              <% end %>
+            </div>
+
+            <%= styled_form_with model: item,
+                                 url: mercury_item_path(item),
+                                 scope: :mercury_item,
+                                 method: :patch,
+                                 data: { turbo: true },
+                                 class: "space-y-3" do |form| %>
+              <%= form.text_field :name,
+                                  label: t("mercury_items.provider_panel.connection_name_label"),
+                                  placeholder: t("mercury_items.provider_panel.connection_name_placeholder") %>
+
+              <%= form.text_field :token,
+                                  label: t("mercury_items.provider_panel.token_label"),
+                                  placeholder: t("mercury_items.provider_panel.keep_token_placeholder"),
+                                  type: :password,
+                                  value: nil %>
+
+              <%= form.text_field :base_url,
+                                  label: t("mercury_items.provider_panel.base_url_label"),
+                                  placeholder: t("mercury_items.provider_panel.base_url_placeholder"),
+                                  value: item.base_url %>
+
+              <div class="flex flex-wrap justify-end gap-2">
+                <%= render DS::Link.new(
+                  text: t("mercury_items.provider_panel.setup_accounts"),
+                  icon: "settings",
+                  variant: "secondary",
+                  href: setup_accounts_mercury_item_path(item),
+                  frame: :modal
+                ) %>
+                <%= form.submit t("mercury_items.provider_panel.update_connection") %>
+              </div>
+            <% end %>
+          </div>
+        <% end %>
+      <% end %>
     </div>
   <% end %>
 
-  <%
-    # Get or initialize a mercury_item for this family
-    # - If family has an item WITH credentials, use it (for updates)
-    # - If family has an item WITHOUT credentials, use it (to add credentials)
-    # - If family has no items at all, create a new one
-    mercury_item = Current.family.mercury_items.first_or_initialize(name: "Mercury Connection")
-    is_new_record = mercury_item.new_record?
-  %>
-
+  <% mercury_item = Current.family.mercury_items.build(name: t("mercury_items.provider_panel.default_connection_name")) %>
+  <% if active_items.any? %>
+    <h3 class="flex items-center gap-2 text-sm font-medium text-primary mt-4">
+      <%= icon "plus", size: "sm" %>
+      <%= t("mercury_items.provider_panel.add_connection") %>
+    </h3>
+  <% end %>
   <%= styled_form_with model: mercury_item,
-                       url: is_new_record ? mercury_items_path : mercury_item_path(mercury_item),
+                       url: mercury_items_path,
                        scope: :mercury_item,
-                       method: is_new_record ? :post : :patch,
+                       method: :post,
                        data: { turbo: true },
                        class: "space-y-3" do |form| %>
+    <%= form.text_field :name,
+                        label: t("mercury_items.provider_panel.connection_name_label"),
+                        placeholder: t("mercury_items.provider_panel.connection_name_placeholder") %>
+
     <%= form.text_field :token,
-                        label: "Token",
-                        placeholder: is_new_record ? "Paste token here" : "Enter new token to update",
-                        type: :password %>
+                        label: t("mercury_items.provider_panel.token_label"),
+                        placeholder: t("mercury_items.provider_panel.token_placeholder"),
+                        type: :password,
+                        value: nil %>
 
     <%= form.text_field :base_url,
-                        label: "Base Url (Optional)",
-                        placeholder: "https://api.mercury.com/api/v1 (default)",
-                        value: mercury_item.base_url %>
+                        label: t("mercury_items.provider_panel.base_url_label"),
+                        placeholder: t("mercury_items.provider_panel.base_url_placeholder") %>
+    <p class="text-xs text-secondary px-1 -mt-1"><%= t("mercury_items.provider_panel.sandbox_note_html").html_safe %></p>
 
     <div class="flex justify-end">
-      <%= form.submit is_new_record ? "Save Configuration" : "Update Configuration",
-                      class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-white bg-gray-900 hover:bg-gray-800 focus:outline-none focus:ring-2 focus:ring-gray-900 focus:ring-offset-2 transition-colors" %>
+      <%= form.submit t("mercury_items.provider_panel.add_connection") %>
     </div>
   <% end %>
 
-  <% items = local_assigns[:mercury_items] || @mercury_items || Current.family.mercury_items.where.not(token: [nil, ""]) %>
-  <div class="flex items-center gap-2">
-    <% if items&.any? %>
-      <div class="w-2 h-2 bg-success rounded-full"></div>
-      <p class="text-sm text-secondary">Configured and ready to use. Visit the <a href="<%= accounts_path %>" class="link">Accounts</a> tab to manage and set up accounts.</p>
-    <% else %>
-      <div class="w-2 h-2 bg-gray-400 rounded-full"></div>
-      <p class="text-sm text-secondary">Not configured</p>
-    <% end %>
-  </div>
 </div>
diff --git a/app/views/settings/providers/_provider_form.html.erb b/app/views/settings/providers/_provider_form.html.erb
index cb2384a9f..a16a15675 100644
--- a/app/views/settings/providers/_provider_form.html.erb
+++ b/app/views/settings/providers/_provider_form.html.erb
@@ -1,34 +1,35 @@
 <%
   # Parameters:
   # - configuration: Provider::Configurable::Configuration object
+  provider_key = configuration.provider_key.to_s
+
+  setup_steps_data =
+    if %w[plaid plaid_eu].include?(provider_key)
+      plaid_link = link_to("Plaid Dashboard", "https://dashboard.plaid.com/team/keys", target: "_blank", rel: "noopener noreferrer", class: "text-primary font-medium underline")
+      step_1_key = "settings.providers.#{provider_key}_panel.step_1_html"
+      [
+        t(step_1_key, link: plaid_link),
+        t("settings.providers.plaid_panel.step_2"),
+        t("settings.providers.plaid_panel.step_3")
+      ]
+    end
 %>
 
 <div class="space-y-4">
-  <div>
-    <% if configuration.provider_description.present? %>
-      <div class="text-sm text-secondary mb-4 prose prose-sm">
-        <%= markdown(configuration.provider_description).html_safe %>
-      </div>
-    <% end %>
+  <% if setup_steps_data %>
+    <%= render "settings/providers/setup_steps", steps: setup_steps_data %>
+  <% elsif configuration.provider_description.present? %>
+    <div class="text-sm text-secondary prose prose-sm">
+      <%= markdown(configuration.provider_description).html_safe %>
+    </div>
+  <% end %>
 
-    <% env_configured = configuration.fields.any? { |f| f.env_key && ENV[f.env_key].present? } %>
-    <% if env_configured %>
-      <p class="text-sm text-secondary">
-        Configuration can be set via environment variables or overridden below.
-      </p>
-    <% end %>
-
-    <% if configuration.fields.any? { |f| f.description.present? } %>
-      <p class="text-secondary text-sm mb-4">Field descriptions:</p>
-      <ul class="text-sm text-secondary mb-4 list-disc ml-6 space-y-2">
-        <% configuration.fields.each do |field| %>
-          <% if field.description.present? %>
-            <li><strong><%= field.label %>:</strong> <%= field.description %></li>
-          <% end %>
-        <% end %>
-      </ul>
-    <% end %>
-  </div>
+  <% env_configured = configuration.fields.any? { |f| f.env_key && ENV[f.env_key].present? } %>
+  <% if env_configured %>
+    <p class="text-sm text-secondary">
+      Configuration can be set via environment variables or overridden below.
+    </p>
+  <% end %>
 
   <%= styled_form_with model: Setting.new,
                        url: settings_providers_path,
@@ -37,50 +38,33 @@
       <% configuration.fields.each do |field| %>
         <%
           env_value = ENV[field.env_key] if field.env_key
-          # Use dynamic hash-style access - works without explicit field declaration
           setting_value = Setting[field.setting_key]
-
-          # Show the setting value if it exists, otherwise show ENV value
-          # This allows users to see what they've overridden
           current_value = setting_value.presence || env_value
 
-          # Mask secret values if they exist
           display_value = if field.secret && current_value.present?
             "********"
           else
             current_value
           end
 
-          # Determine input type
           input_type = field.secret ? "password" : "text"
-
-          # Don't disable fields - allow overriding ENV variables
-          disabled = false
         %>
 
-        <%= form.text_field field.setting_key,
-                            label: field.label,
-                            type: input_type,
-                            placeholder: field.default || (field.required ? "" : "Optional"),
-                            value: display_value,
-                            disabled: disabled %>
+        <div class="space-y-1">
+          <%= form.text_field field.setting_key,
+                              label: field.label,
+                              type: input_type,
+                              placeholder: field.default || (field.required ? "" : "Optional"),
+                              value: display_value %>
+          <% if field.description.present? %>
+            <p class="text-xs text-secondary px-1"><%= field.description %></p>
+          <% end %>
+        </div>
       <% end %>
 
       <div class="flex justify-end">
-        <%= form.submit "Save Configuration",
-                        class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-white bg-gray-900 hover:bg-gray-800 focus:outline-none focus:ring-2 focus:ring-gray-900 focus:ring-offset-2 transition-colors" %>
+        <%= form.submit t(".save_and_connect") %>
       </div>
     </div>
   <% end %>
-
-  <%# Show configuration status %>
-  <div class="flex items-center gap-2 mt-4">
-    <% if configuration.configured? %>
-      <div class="w-2 h-2 bg-success rounded-full"></div>
-      <p class="text-sm text-secondary">Configured and ready to use</p>
-    <% else %>
-      <div class="w-2 h-2 bg-gray-400 rounded-full"></div>
-      <p class="text-sm text-secondary">Not configured</p>
-    <% end %>
-  </div>
 </div>
diff --git a/app/views/settings/providers/_search_filters.html.erb b/app/views/settings/providers/_search_filters.html.erb
new file mode 100644
index 000000000..30c36b172
--- /dev/null
+++ b/app/views/settings/providers/_search_filters.html.erb
@@ -0,0 +1,24 @@
+<div class="flex flex-wrap items-center gap-2.5 mt-5 mb-3">
+  <%= render DS::SearchInput.new(
+    class: "flex-1 min-w-[200px]",
+    placeholder: t("settings.providers.search_filters.placeholder"),
+    aria_label: t("settings.providers.search_filters.aria_label"),
+    data: {
+      providers_filter_target: "input",
+      action: "input->providers-filter#filter"
+    }
+  ) %>
+  <div class="inline-flex items-center gap-1 p-1 bg-surface-inset rounded-xl">
+    <% %w[all bank crypto investment].each do |kind| %>
+      <% active = kind == "all" %>
+      <button type="button"
+              data-providers-filter-target="chip"
+              data-action="click->providers-filter#selectChip"
+              data-kind="<%= kind %>"
+              aria-pressed="<%= active %>"
+              class="px-2.5 py-1 text-xs font-medium rounded-lg transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-alpha-black-100 <%= active ? "bg-container shadow-border-xs text-primary" : "text-secondary" %>">
+        <%= t("settings.providers.search_filters.chips.#{kind}") %>
+      </button>
+    <% end %>
+  </div>
+</div>
diff --git a/app/views/settings/providers/_setup_steps.html.erb b/app/views/settings/providers/_setup_steps.html.erb
new file mode 100644
index 000000000..e3537b3bb
--- /dev/null
+++ b/app/views/settings/providers/_setup_steps.html.erb
@@ -0,0 +1,26 @@
+<%# locals: (steps:, help: nil, eyebrow: nil) %>
+<%# steps: array of strings (or html_safe strings; caller is responsible for safety).
+    help:  optional hash { url:, text: } rendered under the steps with a small divider + book icon.
+    eyebrow: optional override for the localized "SETUP" eyebrow label. %>
+<div class="bg-surface-inset rounded-xl p-4">
+  <p class="text-xs font-medium uppercase text-subdued tracking-wider mb-2">
+    <%= eyebrow.presence || t("settings.providers.setup_steps.eyebrow") %>
+  </p>
+  <ol class="list-none p-0 m-0 space-y-2">
+    <% steps.each_with_index do |step, i| %>
+      <li class="relative pl-6 text-sm leading-relaxed text-primary">
+        <span class="absolute left-0 top-0.5 w-4 text-center font-mono text-xs tabular-nums text-subdued"><%= i + 1 %></span>
+        <%= step %>
+      </li>
+    <% end %>
+  </ol>
+  <% if help %>
+    <div class="mt-2.5 pt-2.5 border-t border-alpha-black-100 text-xs text-secondary flex items-center gap-1.5">
+      <%= icon "book-open", size: "sm", class: "!w-3 !h-3" %>
+      <span>
+        <%= t("settings.providers.setup_steps.need_help") %>
+        <%= link_to help[:text], help[:url], class: "text-primary font-medium", target: "_blank", rel: "noopener noreferrer" %>
+      </span>
+    </div>
+  <% end %>
+</div>
diff --git a/app/views/settings/providers/_simplefin_panel.html.erb b/app/views/settings/providers/_simplefin_panel.html.erb
index 1e50a611c..f5125a2a1 100644
--- a/app/views/settings/providers/_simplefin_panel.html.erb
+++ b/app/views/settings/providers/_simplefin_panel.html.erb
@@ -1,22 +1,16 @@
 <div class="space-y-4">
-  <div class="prose prose-sm text-secondary">
-    <p class="text-primary font-medium">Setup instructions:</p>
-    <ol>
-      <li>Visit <a href="https://beta-bridge.simplefin.org" target="_blank" rel="noopener noreferrer" class="link">SimpleFIN Bridge</a> to get your one-time setup token</li>
-      <li>Paste the token below and click the Save button to enable SimpleFIN bank data sync</li>
-      <li>After a successful connection, go to the Accounts tab to set up new accounts and link them to your existing ones</li>
-    </ol>
-
-    <p class="text-primary font-medium">Field descriptions:</p>
-    <ul>
-      <li><strong>Setup Token:</strong> Your SimpleFIN one-time setup token from SimpleFIN Bridge (consumed on first use)</li>
-    </ul>
-  </div>
+  <%
+    sf_link = link_to("SimpleFIN Bridge", "https://beta-bridge.simplefin.org", target: "_blank", rel: "noopener noreferrer", class: "text-primary font-medium underline")
+  %>
+  <%= render "settings/providers/setup_steps",
+             steps: [
+               t("settings.providers.simplefin_panel.step_1_html", link: sf_link),
+               t("settings.providers.simplefin_panel.step_2"),
+               t("settings.providers.simplefin_panel.step_3")
+             ] %>
 
   <% if defined?(@error_message) && @error_message.present? %>
-    <div class="p-2 rounded-md bg-destructive/10 text-destructive text-sm overflow-hidden">
-      <p class="line-clamp-3" title="<%= @error_message %>"><%= @error_message %></p>
-    </div>
+    <%= render DS::Alert.new(message: @error_message, variant: :error) %>
   <% end %>
 
   <%= styled_form_with model: SimplefinItem.new,
@@ -26,23 +20,13 @@
                        data: { turbo: true },
                        class: "space-y-3" do |form| %>
     <%= form.text_field :setup_token,
-                        label: "Setup Token",
-                        placeholder: "Paste SimpleFIN setup token",
+                        label: t("settings.providers.simplefin_panel.setup_token_label"),
+                        placeholder: t("settings.providers.simplefin_panel.setup_token_placeholder"),
                         type: :password %>
 
     <div class="flex justify-end">
-      <%= form.submit "Save Configuration",
-                      class: "inline-flex items-center justify-center rounded-lg px-4 py-2 text-sm font-medium text-white bg-gray-900 hover:bg-gray-800 focus:outline-none focus:ring-2 focus:ring-gray-900 focus:ring-offset-2 transition-colors" %>
+      <%= form.submit t("settings.providers.simplefin_panel.save_and_connect") %>
     </div>
   <% end %>
 
-  <div class="flex items-center gap-2">
-    <% if @simplefin_items&.any? %>
-      <div class="w-2 h-2 bg-success rounded-full"></div>
-      <p class="text-sm text-secondary">Configured and ready to use. Visit the <a href="<%= accounts_path %>" class="link">Accounts</a> tab to manage and set up accounts.</p>
-    <% else %>
-      <div class="w-2 h-2 bg-gray-400 rounded-full"></div>
-      <p class="text-sm text-secondary">Not configured</p>
-    <% end %>
-  </div>
 </div>
diff --git a/app/views/settings/providers/_snaptrade_panel.html.erb b/app/views/settings/providers/_snaptrade_panel.html.erb
index 314213acc..1c814b234 100644
--- a/app/views/settings/providers/_snaptrade_panel.html.erb
+++ b/app/views/settings/providers/_snaptrade_panel.html.erb
@@ -1,23 +1,17 @@
 <div class="space-y-4">
-  <div class="prose prose-sm text-secondary">
-    <p><%= t("providers.snaptrade.description") %></p>
+  <%= render DS::Alert.new(message: t("providers.snaptrade.free_tier_warning"), variant: :warning) %>
 
-    <p class="text-primary font-medium"><%= t("providers.snaptrade.setup_title") %></p>
-    <ol>
-      <li><%= t("providers.snaptrade.step_1_html") %></li>
-      <li><%= t("providers.snaptrade.step_2") %></li>
-      <li><%= t("providers.snaptrade.step_3") %></li>
-      <li><%= t("providers.snaptrade.step_4") %></li>
-    </ol>
-
-    <p class="text-warning text-sm"><%= icon("alert-triangle", class: "inline-block w-4 h-4 mr-1") %><%= t("providers.snaptrade.free_tier_warning") %></p>
-  </div>
+  <%= render "settings/providers/setup_steps",
+             steps: [
+               t("providers.snaptrade.step_1_html").html_safe,
+               t("providers.snaptrade.step_2"),
+               t("providers.snaptrade.step_3"),
+               t("providers.snaptrade.step_4")
+             ] %>
 
   <% error_msg = local_assigns[:error_message] || @error_message %>
   <% if error_msg.present? %>
-    <div class="p-2 rounded-md bg-destructive/10 text-destructive text-sm overflow-hidden">
-      <p class="line-clamp-3" title="<%= error_msg %>"><%= error_msg %></p>
-    </div>
+    <%= render DS::Alert.new(message: error_msg, variant: :error) %>
   <% end %>
 
   <%
@@ -44,25 +38,37 @@
                         type: :password %>
 
     <div class="flex justify-end">
-      <%= form.submit is_new_record ? t("providers.snaptrade.save_button") : t("providers.snaptrade.update_button"),
-                      class: "btn btn--primary" %>
+      <%= form.submit is_new_record ? t("providers.snaptrade.save_button") : t("providers.snaptrade.update_button") %>
     </div>
   <% end %>
 
   <% items = local_assigns[:snaptrade_items] || @snaptrade_items || Current.family.snaptrade_items.where.not(client_id: [nil, ""]) %>
 
-  <div class="border-t border-primary pt-4 mt-4">
-    <% if items&.any? %>
-      <% item = items.first %>
-      <% if item.user_registered? %>
-        <details class="group"
-                 data-controller="lazy-load"
-                 data-action="toggle->lazy-load#toggled"
-                 data-lazy-load-url-value="<%= connections_snaptrade_item_path(item) %>"
-                 data-lazy-load-auto-open-param-value="manage">
-          <summary class="flex items-center justify-between cursor-pointer list-none [&::-webkit-details-marker]:hidden">
+  <% if items&.any? %>
+    <% item = items.first %>
+    <% unless item.user_registered? %>
+      <div class="flex items-center gap-2 border-t border-primary pt-4 mt-4">
+        <span class="w-2 h-2 bg-warning rounded-full"></span>
+        <p class="text-sm text-secondary"><%= t("providers.snaptrade.status_needs_registration") %></p>
+      </div>
+    <% end %>
+  <% end %>
+
+  <% if items&.any? && items.first.user_registered? %>
+    <% item = items.first %>
+    <div class="border-t border-primary pt-4 mt-4">
+      <%= render DS::Disclosure.new(
+        variant: :inline,
+        data: {
+          controller: "lazy-load",
+          action: "toggle->lazy-load#toggled",
+          lazy_load_url_value: connections_snaptrade_item_path(item),
+          lazy_load_auto_open_param_value: "manage"
+        }
+      ) do |disclosure| %>
+        <% disclosure.with_summary_content do %>
+          <div class="flex items-center justify-between">
             <div class="flex items-center gap-2">
-              <div class="w-2 h-2 bg-success rounded-full"></div>
               <p class="text-sm text-secondary">
                 <%= t("providers.snaptrade.status_connected", count: item.snaptrade_accounts.count) %>
                 <% if item.unlinked_accounts_count > 0 %>
@@ -72,35 +78,21 @@
             </div>
             <span class="flex items-center gap-1 text-sm text-secondary hover:text-primary">
               <%= t("providers.snaptrade.manage_connections") %>
-              <%= icon "chevron-right", class: "w-3 h-3 transition-transform group-open:rotate-90" %>
+              <%= icon "chevron-right", class: "w-3 h-3 group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
             </span>
-          </summary>
-
-          <div class="mt-3 space-y-3" data-lazy-load-target="content">
-            <p class="text-xs text-secondary">
-              <%= t("providers.snaptrade.connection_limit_info") %>
-            </p>
-
-            <div data-lazy-load-target="loading" class="flex items-center gap-2 text-sm text-secondary py-2">
-              <%= icon "loader-2", class: "w-4 h-4 animate-spin" %>
-              <%= t("providers.snaptrade.loading_connections") %>
-            </div>
-
-            <div data-lazy-load-target="frame">
-            </div>
           </div>
-        </details>
-      <% else %>
-        <div class="flex items-center gap-2">
-          <div class="w-2 h-2 bg-warning rounded-full"></div>
-          <p class="text-sm text-secondary"><%= t("providers.snaptrade.status_needs_registration") %></p>
+        <% end %>
+
+        <div class="mt-3 space-y-3" data-lazy-load-target="content">
+          <div data-lazy-load-target="loading" class="flex items-center gap-2 text-sm text-secondary py-2">
+            <%= icon "loader-2", class: "w-4 h-4 animate-spin" %>
+            <%= t("providers.snaptrade.loading_connections") %>
+          </div>
+
+          <div data-lazy-load-target="frame">
+          </div>
         </div>
       <% end %>
-    <% else %>
-      <div class="flex items-center gap-2">
-        <div class="w-2 h-2 bg-gray-400 rounded-full"></div>
-        <p class="text-sm text-secondary"><%= t("providers.snaptrade.status_not_configured") %></p>
-      </div>
-    <% end %>
-  </div>
+    </div>
+  <% end %>
 </div>
diff --git a/app/views/settings/providers/_sophtron_panel.html.erb b/app/views/settings/providers/_sophtron_panel.html.erb
new file mode 100644
index 000000000..4511d01dc
--- /dev/null
+++ b/app/views/settings/providers/_sophtron_panel.html.erb
@@ -0,0 +1,47 @@
+<div class="space-y-4">
+  <%= render "settings/providers/setup_steps",
+             steps: [
+               t("sophtron_items.sophtron_panel.setup_instructions.step_1_html", url: "https://www.sophtron.com").html_safe,
+               t("sophtron_items.sophtron_panel.setup_instructions.step_2"),
+               t("sophtron_items.sophtron_panel.setup_instructions.step_3")
+             ] %>
+
+  <% error_msg = local_assigns[:error_message] || @error_message %>
+  <% if error_msg.present? %>
+    <%= render DS::Alert.new(message: error_msg, variant: :error) %>
+  <% end %>
+
+  <%
+    # Variables passed from controller
+    sophtron_item = @sophtron_item || Current.family.sophtron_items.build
+    is_new_record = @is_new_record || sophtron_item.new_record?
+    sophtron_items = @sophtron_items
+  %>
+
+  <%= styled_form_with model: sophtron_item,
+                       url: sophtron_item.new_record? ? sophtron_items_path : sophtron_item_path(sophtron_item),
+                       scope: :sophtron_item,
+                       method: sophtron_item.new_record? ? :post : :patch,
+                       data: { turbo: true },
+                       class: "space-y-3" do |form| %>
+    <%= form.text_field :user_id,
+                        label: t("sophtron_items.sophtron_panel.fields.user_id.label"),
+                        placeholder: is_new_record ? t("sophtron_items.sophtron_panel.fields.user_id.placeholder_new") : t("sophtron_items.sophtron_panel.fields.user_id.placeholder_edit"),
+                        type: :password %>
+
+    <%= form.text_field :access_key,
+                        label: t("sophtron_items.sophtron_panel.fields.access_key.label"),
+                        placeholder: is_new_record ? t("sophtron_items.sophtron_panel.fields.access_key.placeholder_new") : t("sophtron_items.sophtron_panel.fields.access_key.placeholder_edit"),
+                        type: :password %>
+
+    <%= form.text_field :base_url,
+                        label: t("sophtron_items.sophtron_panel.fields.base_url.label"),
+                        placeholder: t("sophtron_items.sophtron_panel.fields.base_url.placeholder"),
+                        value: sophtron_item.base_url %>
+
+    <div class="flex justify-end">
+      <%= form.submit is_new_record ? t("sophtron_items.sophtron_panel.save") : t("sophtron_items.sophtron_panel.update") %>
+    </div>
+  <% end %>
+
+</div>
diff --git a/app/views/settings/providers/_status_pill.html.erb b/app/views/settings/providers/_status_pill.html.erb
new file mode 100644
index 000000000..efabfd989
--- /dev/null
+++ b/app/views/settings/providers/_status_pill.html.erb
@@ -0,0 +1,15 @@
+<%# locals: (status:) %>
+<%
+  tone = case status.to_s.to_sym
+         when :ok  then :success
+         when :warn then :warning
+         when :err  then :error
+         else :neutral
+         end
+%>
+<%= render DS::Pill.new(
+  label: t("settings.providers.status.#{status}"),
+  tone: tone,
+  marker: false,
+  size: :sm
+) %>
diff --git a/app/views/settings/providers/_sync_button.html.erb b/app/views/settings/providers/_sync_button.html.erb
new file mode 100644
index 000000000..6e3df16ae
--- /dev/null
+++ b/app/views/settings/providers/_sync_button.html.erb
@@ -0,0 +1,15 @@
+<%# locals: (provider_key:, last_synced_at: nil) %>
+<% recently_synced = last_synced_at.present? && last_synced_at > 60.seconds.ago %>
+<% button_label = recently_synced ? t("settings.providers.recently_synced") : t("settings.providers.sync_provider") %>
+<%= render DS::Button.new(
+      variant: "icon",
+      size: "sm",
+      icon: "refresh-cw",
+      href: sync_provider_settings_providers_path(provider_key: provider_key),
+      method: :post,
+      disabled: recently_synced,
+      title: button_label,
+      aria: { label: button_label },
+      class: "disabled:opacity-40 disabled:cursor-not-allowed",
+      form: { onclick: "event.stopPropagation()", class: "inline-flex" }
+    ) %>
diff --git a/app/views/settings/providers/connect_form.html.erb b/app/views/settings/providers/connect_form.html.erb
new file mode 100644
index 000000000..f4c6e6d3c
--- /dev/null
+++ b/app/views/settings/providers/connect_form.html.erb
@@ -0,0 +1,21 @@
+<%= render DS::Dialog.new(frame: "drawer", responsive: true, auto_open: true) do |dialog| %>
+  <% provider_key = @panel_key || @provider_configuration&.provider_key&.to_s %>
+  <% dialog.with_header(custom_header: true) do %>
+    <%= render "settings/providers/drawer_header", provider_key: provider_key, title: @panel_title %>
+  <% end %>
+  <% dialog.with_body do %>
+    <% if @panel_partial %>
+      <turbo-frame id="<%= @panel_key %>-connect-form" target="_top">
+        <%= render "settings/providers/#{@panel_partial}" %>
+      </turbo-frame>
+    <% else %>
+      <turbo-frame id="config-connect-form" target="_top">
+        <%= render "settings/providers/provider_form", configuration: @provider_configuration %>
+      </turbo-frame>
+    <% end %>
+
+    <p class="text-xs text-secondary mt-6 pt-3 border-t border-tertiary">
+      <%= t("settings.providers.drawer_trust_statement") %>
+    </p>
+  <% end %>
+<% end %>
diff --git a/app/views/settings/providers/show.html.erb b/app/views/settings/providers/show.html.erb
index 4a9d76bdc..9108eabcd 100644
--- a/app/views/settings/providers/show.html.erb
+++ b/app/views/settings/providers/show.html.erb
@@ -1,88 +1,96 @@
-<%= content_for :page_title, "Sync Providers" %>
+<%= content_for :page_title, t("settings.providers.bank_sync.page_title") %>
 
 <div class="space-y-4">
   <% if @encryption_error %>
-    <div class="p-4 rounded-lg bg-destructive/10 border border-destructive/20">
-      <div class="flex items-start gap-3">
-        <%= icon("triangle-alert", class: "w-5 h-5 text-destructive shrink-0 mt-0.5") %>
-        <div>
-          <h3 class="font-medium text-primary"><%= t("settings.providers.encryption_error.title") %></h3>
-          <p class="text-secondary text-sm mt-1"><%= t("settings.providers.encryption_error.message") %></p>
+    <%= render DS::Alert.new(
+          variant: :error,
+          title: t("settings.providers.encryption_error.title"),
+          message: t("settings.providers.encryption_error.message")
+        ) %>
+  <% else %>
+    <div class="flex items-center justify-between gap-4">
+      <p class="text-secondary"><%= t("settings.providers.bank_sync.lede") %></p>
+      <% if @connected.any? || @needs_attention.any? %>
+        <% sync_all_disabled = Current.family.last_sync_all_attempted_at.present? && Current.family.last_sync_all_attempted_at > 30.seconds.ago %>
+        <%= render DS::Link.new(
+              text: t("settings.providers.sync_all"),
+              icon: "refresh-cw",
+              variant: "outline",
+              href: sync_all_settings_providers_path,
+              method: :post,
+              title: sync_all_disabled ? t("settings.providers.sync_all_recently") : nil,
+              aria: { disabled: sync_all_disabled.to_s },
+              class: sync_all_disabled ? "opacity-50 pointer-events-none" : nil
+            ) %>
+      <% end %>
+    </div>
+
+    <% all_connections = @needs_attention + @connected %>
+
+    <% if all_connections.any? %>
+      <% if @health %>
+        <%= render "settings/providers/health_strip",
+                   connected:        @health[:connected],
+                   needs_attention:  @health[:needs_attention],
+                   accounts_syncing: @health[:accounts_syncing],
+                   last_synced_at:   @health[:last_synced_at] %>
+      <% end %>
+
+      <%= render "settings/providers/group_heading",
+                 title: t("settings.providers.groups.your_connections"),
+                 count: all_connections.size %>
+
+      <div class="space-y-2">
+        <% all_connections.each do |entry| %>
+          <% auto_open = all_connections.size == 1 %>
+          <%= render "settings/providers/connection_row", entry: entry, open: auto_open %>
+        <% end %>
+      </div>
+    <% end %>
+
+    <% if @available.any? %>
+      <div data-controller="providers-filter">
+        <%= render "settings/providers/search_filters" %>
+
+        <div id="available" class="flex items-baseline justify-between gap-3 mt-6 mb-1.5 px-1">
+          <h2 class="text-xs font-medium text-secondary uppercase flex items-baseline gap-2">
+            <%= t("settings.providers.groups.available") %>
+            <span class="text-subdued font-normal normal-case tabular-nums">
+              · <span data-providers-filter-target="count"><%= @available.size %></span>
+            </span>
+          </h2>
+        </div>
+
+        <div data-providers-filter-target="empty" class="hidden text-sm text-secondary px-1 py-2 flex items-center gap-2">
+          <span><%= t("settings.providers.empty_filter") %></span>
+          <button type="button" data-action="click->providers-filter#clear" class="text-primary underline">
+            <%= t("settings.providers.clear_filter") %>
+          </button>
+        </div>
+
+        <div class="grid grid-cols-1 md:grid-cols-2 gap-3">
+          <% @available.each do |entry| %>
+            <% meta = Provider::Metadata.for(entry[:provider_key]) %>
+            <%= render Settings::ProviderCard.new(
+                  provider_key: entry[:provider_key],
+                  name:         entry[:title],
+                  tagline:      t("settings.providers.taglines.#{entry[:provider_key]}", default: nil),
+                  region:       meta[:region],
+                  kind:         meta[:kind],
+                  tier:         meta[:tier],
+                  maturity:     meta[:maturity] || :stable,
+                  logo_bg:      meta[:logo_bg],
+                  logo_text:    meta[:logo_text]
+                ) %>
+          <% end %>
         </div>
       </div>
-    </div>
-  <% else %>
-    <div>
-      <p class="text-secondary mb-4">
-        Configure credentials for third-party sync providers. Settings configured here will override environment variables.
-      </p>
-    </div>
-  <% end %>
-
-  <% unless @encryption_error %>
-    <% @provider_configurations.each do |config| %>
-      <%= settings_section title: config.provider_key.titleize, collapsible: true, open: false do %>
-        <%= render "settings/providers/provider_form", configuration: config %>
-      <% end %>
-    <% end %>
-
-    <%# Providers below are hardcoded because they manage Family-scoped connections                 %>
-    <%# (via their own models like SimplefinItem, LunchflowItem, etc.) rather than global settings. %>
-    <%# They require custom UI for connection management, status display, and sync actions.         %>
-    <%# The controller excludes them from @provider_configurations (see prepare_show_context).      %>
-
-    <%= settings_section title: "Lunch Flow", collapsible: true, open: false do %>
-      <turbo-frame id="lunchflow-providers-panel">
-        <%= render "settings/providers/lunchflow_panel" %>
-      </turbo-frame>
-    <% end %>
-
-    <%= settings_section title: "SimpleFIN", collapsible: true, open: false do %>
-      <turbo-frame id="simplefin-providers-panel">
-        <%= render "settings/providers/simplefin_panel" %>
-      </turbo-frame>
-    <% end %>
-
-    <%= settings_section title: "Enable Banking (beta)", collapsible: true, open: false do %>
-      <turbo-frame id="enable_banking-providers-panel">
-        <%= render "settings/providers/enable_banking_panel" %>
-      </turbo-frame>
-    <% end %>
-
-    <%= settings_section title: "CoinStats (beta)", collapsible: true, open: false do %>
-      <turbo-frame id="coinstats-providers-panel">
-        <%= render "settings/providers/coinstats_panel" %>
-      </turbo-frame>
-    <% end %>
-
-    <%= settings_section title: "Mercury (beta)", collapsible: true, open: false do %>
-      <turbo-frame id="mercury-providers-panel">
-        <%= render "settings/providers/mercury_panel" %>
-      </turbo-frame>
-    <% end %>
-
-    <%= settings_section title: "Coinbase (beta)", collapsible: true, open: false do %>
-      <turbo-frame id="coinbase-providers-panel">
-        <%= render "settings/providers/coinbase_panel" %>
-      </turbo-frame>
-    <% end %>
-
-    <%= settings_section title: "Binance (beta)", collapsible: true, open: false do %>
-      <turbo-frame id="binance-providers-panel">
-        <%= render "settings/providers/binance_panel" %>
-      </turbo-frame>
-    <% end %>
-
-    <%= settings_section title: "SnapTrade (beta)", collapsible: true, open: false, auto_open_param: "manage" do %>
-      <turbo-frame id="snaptrade-providers-panel">
-        <%= render "settings/providers/snaptrade_panel" %>
-      </turbo-frame>
-    <% end %>
-
-    <%= settings_section title: "Indexa Capital (alpha)", collapsible: true, open: false do %>
-      <turbo-frame id="indexa_capital-providers-panel">
-        <%= render "settings/providers/indexa_capital_panel" %>
-      </turbo-frame>
+    <% else %>
+      <%= render "settings/providers/group_heading",
+                 title: t("settings.providers.groups.available"),
+                 count: 0,
+                 anchor: "available" %>
+      <p class="text-sm text-secondary px-1 py-2"><%= t("settings.providers.groups.empty_available") %></p>
     <% end %>
   <% end %>
 </div>
diff --git a/app/views/settings/securities/show.html.erb b/app/views/settings/securities/show.html.erb
index b7866c225..c0482ac98 100644
--- a/app/views/settings/securities/show.html.erb
+++ b/app/views/settings/securities/show.html.erb
@@ -4,17 +4,17 @@
   <div class="space-y-4">
     <div class="p-3 shadow-border-xs bg-container rounded-lg md:flex md:justify-between md:items-center">
       <div class="flex items-center gap-3">
-        <div class="w-9 h-9 rounded-full bg-gray-25 flex justify-center items-center">
+        <div class="w-9 h-9 rounded-full bg-surface-inset flex justify-center items-center">
           <%= icon "shield-check" %>
         </div>
 
         <div class="text-sm space-y-1">
           <% if Current.user.otp_required? %>
-            <p class="text-primary">Two-factor authentication is <span class="font-medium text-green-600">enabled</span></p>
-            <p class="text-secondary">Your account is protected with an additional layer of security.</p>
+            <p class="text-primary"><%= t(".mfa_enabled_status_html") %></p>
+            <p class="text-secondary"><%= t(".mfa_enabled_description") %></p>
           <% else %>
-            <p class="text-primary">Two-factor authentication is <span class="font-medium text-red-600">disabled</span></p>
-            <p class="text-secondary">Enable 2FA to add an extra layer of security to your account.</p>
+            <p class="text-primary"><%= t(".mfa_disabled_status_html") %></p>
+            <p class="text-secondary"><%= t(".mfa_disabled_description") %></p>
           <% end %>
         </div>
       </div>
@@ -45,6 +45,82 @@
   </div>
 <% end %>
 
+<% if Current.user.otp_required? %>
+  <%= settings_section title: t(".webauthn_title"), subtitle: t(".webauthn_description") do %>
+    <div class="space-y-4">
+      <% if @webauthn_credentials.any? %>
+        <div class="space-y-2">
+          <% @webauthn_credentials.each do |credential| %>
+            <div class="flex items-center justify-between bg-container p-4 shadow-border-xs rounded-lg">
+              <div class="flex items-center gap-3">
+                <div class="w-9 h-9 shrink-0 bg-surface rounded-full flex items-center justify-center">
+                  <%= icon "fingerprint", class: "w-5 h-5 text-secondary" %>
+                </div>
+                <div>
+                  <p class="font-medium text-primary"><%= credential.nickname %></p>
+                  <p class="text-sm text-secondary">
+                    <%= t(".webauthn_added", date: l(credential.created_at.to_date)) %>
+                    <% if credential.last_used_at.present? %>
+                      <span><%= t(".webauthn_last_used", time_ago: time_ago_in_words(credential.last_used_at)) %></span>
+                    <% end %>
+                  </p>
+                </div>
+              </div>
+
+              <%= render DS::Button.new(
+                text: t(".webauthn_remove"),
+                variant: "outline_destructive",
+                size: "sm",
+                href: settings_webauthn_credential_path(credential),
+                method: :delete,
+                confirm: CustomConfirm.new(
+                  title: t(".webauthn_remove_confirm"),
+                  body: t(".webauthn_remove_confirm_body"),
+                  btn_text: t(".webauthn_remove"),
+                  destructive: true
+                )
+              ) %>
+            </div>
+          <% end %>
+        </div>
+      <% else %>
+        <div class="bg-surface-inset rounded-lg p-4">
+          <p class="text-sm text-secondary"><%= t(".webauthn_empty") %></p>
+        </div>
+      <% end %>
+
+      <%= styled_form_with scope: :webauthn_credential,
+                           url: settings_webauthn_credentials_path,
+                           method: :post,
+                           class: "space-y-3",
+                           data: {
+                             controller: "webauthn-registration",
+                             action: "submit->webauthn-registration#register",
+                             webauthn_registration_options_url_value: options_settings_webauthn_credentials_path,
+                             webauthn_registration_create_url_value: settings_webauthn_credentials_path,
+                             webauthn_registration_unsupported_message_value: t(".webauthn_unsupported"),
+                             webauthn_registration_error_fallback_value: t("webauthn_credentials.failure")
+                           } do |form| %>
+        <%= form.text_field :nickname,
+                            placeholder: t(".webauthn_name_placeholder"),
+                            label: t(".webauthn_name_label"),
+                            data: { webauthn_registration_target: "nickname" } %>
+
+        <p class="text-sm text-destructive" role="alert" aria-live="assertive" aria-atomic="true" aria-hidden="true" hidden data-webauthn-registration-target="error"></p>
+
+        <div>
+          <%= render DS::Button.new(
+            text: t(".webauthn_add"),
+            variant: "secondary",
+            icon: "fingerprint",
+            type: "submit"
+          ) %>
+        </div>
+      <% end %>
+    </div>
+  <% end %>
+<% end %>
+
 <% if @oidc_identities.any? || AuthConfig.sso_providers.any? %>
   <%= settings_section title: t(".sso_title"), subtitle: t(".sso_subtitle") do %>
     <% if @oidc_identities.any? %>
diff --git a/app/views/shared/_badge.html.erb b/app/views/shared/_badge.html.erb
index 56e099cb3..7d46618ec 100644
--- a/app/views/shared/_badge.html.erb
+++ b/app/views/shared/_badge.html.erb
@@ -1,22 +1,22 @@
 <%# locals: (color: nil, pulse: false) %>
-
-<%
-  def badge_classes(c, p)
-    classes = case c
-              when "success"
-                "bg-green-500/5 text-green-500"
-              when "error"
-                "bg-red-500/5 text-red-500"
-              when "warning"
-                "bg-orange-500/5 text-orange-500"
-              else
-                "bg-gray-500/5 text-secondary"
-              end
-
-    p ? "#{classes} animate-pulse" : classes
-  end
+<%#
+  Thin shim over DS::Pill: maps the shared/_badge string color values
+  (`success` / `error` / `warning` / nil) to semantic tones and renders
+  the yielded block as the pill label. `pulse: true` wraps the pill in
+  an `animate-pulse` span (DS::Pill itself doesn't support pulse).
 %>
-
-<span class="inline-flex items-center px-2 py-0.5 rounded-full ring ring-alpha-black-50 text-xs <%= badge_classes(color, pulse) %>">
-  <%= yield %>
-</span>
+<%
+  tone = case color
+         when "success" then :success
+         when "error"   then :error
+         when "warning" then :warning
+         else                :neutral
+         end
+  label = yield
+  pill = render DS::Pill.new(label: label, tone: tone, marker: false, show_dot: false)
+%>
+<% if pulse %>
+  <span class="animate-pulse inline-flex"><%= pill %></span>
+<% else %>
+  <%= pill %>
+<% end %>
diff --git a/app/views/shared/_exchange_rate_tabs.html.erb b/app/views/shared/_exchange_rate_tabs.html.erb
new file mode 100644
index 000000000..1ba15d706
--- /dev/null
+++ b/app/views/shared/_exchange_rate_tabs.html.erb
@@ -0,0 +1,39 @@
+<%# locals: (controller_id:, controller_key:, help_text:, convert_tab_label:, calculate_rate_tab_label:, destination_amount_label:, exchange_rate_label:, convert_input:, destination_input:) %>
+
+<div class="hidden px-1 pt-2" data-action="click-><%= controller_id %>#onExchangeRateTabClick" data-<%= controller_id %>-target="exchangeRateContainer">
+  <p class="text-xs text-secondary mb-2"><%= help_text %></p>
+
+  <%= render DS::Tabs.new(active_tab: "convert") do |tabs| %>
+    <%= tabs.with_nav do |nav| %>
+      <%= nav.with_btn(id: "convert", label: convert_tab_label) %>
+      <%= nav.with_btn(id: "calculateRate", label: calculate_rate_tab_label) %>
+    <% end %>
+
+    <%= tabs.with_panel(tab_id: "convert") do %>
+      <div class="space-y-2 mb-3">
+        <%= convert_input %>
+
+        <div class="flex items-center justify-between p-2 bg-container-inset rounded text-sm">
+          <span class="text-secondary"><%= destination_amount_label %></span>
+          <span class="font-medium text-primary" data-<%= controller_id %>-target="convertDestinationDisplay">-</span>
+        </div>
+      </div>
+    <% end %>
+
+    <%= tabs.with_panel(tab_id: "calculateRate") do %>
+      <div class="space-y-2 mb-3">
+        <div class="form-field">
+          <div class="form-field__body">
+            <label class="form-field__label" for="<%= "#{controller_key}_destination_amount" %>"><%= destination_amount_label %></label>
+            <%= destination_input %>
+          </div>
+        </div>
+
+        <div class="flex items-center justify-between p-2 bg-container-inset rounded text-sm">
+          <span class="text-secondary"><%= exchange_rate_label %></span>
+          <span class="font-medium text-primary" data-<%= controller_id %>-target="calculateRateDisplay">-</span>
+        </div>
+      </div>
+    <% end %>
+  <% end %>
+</div>
diff --git a/app/views/shared/_money_field.html.erb b/app/views/shared/_money_field.html.erb
index 41776c28f..21c773da8 100644
--- a/app/views/shared/_money_field.html.erb
+++ b/app/views/shared/_money_field.html.erb
@@ -9,8 +9,8 @@
 
 <div class="form-field <%= options[:container_class] %>"
      data-controller="money-field"
-     <% if options[:precision].present? %>data-money-field-precision-value="<%= options[:precision] %>"<% end %>
-     <% if options[:step].present? %>data-money-field-step-value="<%= options[:step] %>"<% end %>>
+     <% if options[:precision].present? %> data-money-field-precision-value="<%= options[:precision] %>"<% end %>
+     <% if options[:step].present? %> data-money-field-step-value="<%= options[:step] %>"<% end %>>
   <% if options[:label_tooltip] %>
     <div class="form-field__header">
       <%= form.label options[:label] || t(".label"), class: "form-field__label" do %>
@@ -22,7 +22,7 @@
       <div class="form-field__actions">
         <div data-controller="tooltip">
           <%= icon "help-circle", size: "sm", color: "default", class: "cursor-help" %>
-          <div role="tooltip" data-tooltip-target="tooltip" class="tooltip bg-gray-700 text-sm p-2 rounded w-64 text-white">
+          <div role="tooltip" data-tooltip-target="tooltip" class="tooltip bg-inverse text-inverse text-sm p-2 rounded w-64">
             <%= options[:label_tooltip] %>
           </div>
         </div>
@@ -60,26 +60,30 @@
           max: options[:max] || 99999999999999,
           step: options[:step] || currency.step,
           disabled: options[:disabled],
-          data: {
+          data: (options[:amount_data] || {}).merge({
             "money-field-target": "amount",
             "auto-submit-form-target": ("auto" if options[:auto_submit])
-          }.compact,
+          }.compact),
           required: options[:required] %>
       </div>
 
       <% unless options[:hide_currency] %>
         <div>
+          <% currency_data = (options[:currency_data] || {}).merge({
+               "money-field-target": "currency",
+               "auto-submit-form-target": ("auto" if options[:auto_submit])
+             }.compact)
+             # Preserve any existing action and append money-field handler
+             existing_action = currency_data.delete("action")
+             currency_data["action"] = ["change->money-field#handleCurrencyChange", existing_action].compact.join(" ")
+          %>
           <%= form.select currency_method,
-                        Money::Currency.as_options.map(&:iso_code),
+                        currency_picker_options_for_family(extra: currency.iso_code),
                         { inline: true, selected: currency.iso_code },
                         {
                           class: "w-fit pr-5 disabled:text-subdued form-field__input",
                           disabled: options[:disable_currency],
-                          data: {
-                            "money-field-target": "currency",
-                            action: "change->money-field#handleCurrencyChange",
-                            "auto-submit-form-target": ("auto" if options[:auto_submit])
-                          }.compact
+                          data: currency_data
                         } %>
         </div>
       <% end %>
diff --git a/app/views/shared/_text_tooltip.erb b/app/views/shared/_text_tooltip.erb
index a576b114c..b95fb4712 100644
--- a/app/views/shared/_text_tooltip.erb
+++ b/app/views/shared/_text_tooltip.erb
@@ -1,5 +1,5 @@
-<div role="tooltip" data-tooltip-target="tooltip" class="tooltip bg-gray-700 text-sm px-1.5 py-1 rounded-md">
-  <div class="fg-inverse font-normal max-w-[200px]">
+<div role="tooltip" data-tooltip-target="tooltip" class="tooltip bg-inverse text-sm px-1.5 py-1 rounded-md">
+  <div class="text-inverse font-normal max-w-[200px]">
     <%= tooltip_text %>
   </div>
 </div>
diff --git a/app/views/shared/_transaction_type_tabs.html.erb b/app/views/shared/_transaction_type_tabs.html.erb
index 720960871..dbb1f6b55 100644
--- a/app/views/shared/_transaction_type_tabs.html.erb
+++ b/app/views/shared/_transaction_type_tabs.html.erb
@@ -2,7 +2,7 @@
 
 <fieldset class="bg-surface-inset rounded-lg p-1 flex flex-wrap gap-2">
   <%= link_to new_transaction_path(nature: "outflow", account_id: account_id),
-              data: { turbo_frame: :modal },
+              data: { turbo_frame: :modal, action: "click->transaction-type-tabs#selectTab", nature: "outflow", "transaction-type-tabs-target": "tab" },
               class: "flex-1 min-w-0 flex px-4 py-1 rounded-lg items-center space-x-2 justify-center text-sm #{active_tab == 'expense' ? 'bg-container text-primary shadow-sm' : 'hover:bg-container text-subdued hover:text-primary hover:shadow-sm'}" do %>
     <%= icon "minus-circle" %>
     <%= tag.span class: "truncate" do %>
@@ -11,7 +11,7 @@
   <% end %>
 
   <%= link_to new_transaction_path(nature: "inflow", account_id: account_id),
-              data: { turbo_frame: :modal },
+              data: { turbo_frame: :modal, action: "click->transaction-type-tabs#selectTab", nature: "inflow", "transaction-type-tabs-target": "tab" },
               class: "flex-1 min-w-0 flex px-4 py-1 rounded-lg items-center space-x-2 justify-center text-sm #{active_tab == 'income' ? 'bg-container text-primary shadow-sm' : 'hover:bg-container text-subdued hover:text-primary hover:shadow-sm'}" do %>
     <%= icon "plus-circle" %>
     <%= tag.span class: "truncate" do %>
diff --git a/app/views/shared/notifications/_cta.html.erb b/app/views/shared/notifications/_cta.html.erb
index c428b66d1..9232ac591 100644
--- a/app/views/shared/notifications/_cta.html.erb
+++ b/app/views/shared/notifications/_cta.html.erb
@@ -3,7 +3,7 @@
 <div id="cta">
   <%= tag.div class: "relative flex gap-3 rounded-lg bg-container p-4 group w-full md:max-w-80 shadow-border-xs", data: { controller: "element-removal" } do %>
     <div class="h-5 w-5 shrink-0 p-px text-primary">
-      <div class="flex h-full items-center justify-center rounded-full bg-success fg-inverse">
+      <div class="flex h-full items-center justify-center rounded-full bg-success text-inverse">
         <%= icon "check", size: "xs", color: "current" %>
       </div>
     </div>
diff --git a/app/views/simplefin_items/_activity_badge.html.erb b/app/views/simplefin_items/_activity_badge.html.erb
new file mode 100644
index 000000000..931fa9605
--- /dev/null
+++ b/app/views/simplefin_items/_activity_badge.html.erb
@@ -0,0 +1,31 @@
+<%#
+  Renders a one-line activity summary for a SimpleFIN account on the setup card.
+  Helps users distinguish live accounts from dormant ones during setup, which is
+  essential when an institution has replaced a card (e.g., fraud replacement)
+  and returns both the old (dormant) and new (active) cards for a sync cycle.
+
+  Locals:
+    activity       - SimplefinAccount::ActivitySummary
+    likely_closed  - Boolean (dormant AND near-zero balance)
+%>
+<% count = activity.recent_transaction_count %>
+<% last_at = activity.last_transacted_at %>
+
+<% if likely_closed %>
+  <p class="mt-1 flex items-center gap-1.5 text-xs text-warning">
+    <%= icon "alert-triangle", size: "sm" %>
+    <%= t("simplefin_items.setup_accounts.activity.likely_closed") %>
+  </p>
+<% elsif count.positive? %>
+  <p class="mt-1 text-xs text-secondary">
+    <%= t("simplefin_items.setup_accounts.activity.recent", count: count, when: activity_when(last_at)) %>
+  </p>
+<% elsif last_at.present? %>
+  <p class="mt-1 text-xs text-secondary">
+    <%= t("simplefin_items.setup_accounts.activity.dormant", days: activity.days_since_last_activity) %>
+  </p>
+<% else %>
+  <p class="mt-1 text-xs text-secondary">
+    <%= t("simplefin_items.setup_accounts.activity.empty") %>
+  </p>
+<% end %>
diff --git a/app/views/simplefin_items/_replacement_prompt.html.erb b/app/views/simplefin_items/_replacement_prompt.html.erb
new file mode 100644
index 000000000..4337a8f69
--- /dev/null
+++ b/app/views/simplefin_items/_replacement_prompt.html.erb
@@ -0,0 +1,69 @@
+<%# locals: (simplefin_item:, suggestions:)
+  Banner rendered at the top of the SimpleFIN item card when the importer
+  detects a likely card-replacement pair (old card + new card, same
+  institution, same type). "Relink" reuses the existing link_existing_account
+  controller action to atomically swap the AccountProvider on the linked
+  Sure account. "Dismiss" persists a per-(dormant_sfa_id) dismissal on the
+  latest sync's sync_stats so the banner stops showing for that pair.
+  Suggestions are also auto-suppressed once the relink has already landed. %>
+<% latest_sync = simplefin_item.syncs.order(created_at: :desc).first %>
+<% dismissed_ids = Array(latest_sync&.sync_stats&.dig("dismissed_replacement_suggestions")) %>
+<div class="space-y-2">
+  <% suggestions.each do |suggestion| %>
+    <% old_sfa = simplefin_item.simplefin_accounts.find_by(id: suggestion["dormant_sfa_id"]) %>
+    <% new_sfa = simplefin_item.simplefin_accounts.find_by(id: suggestion["active_sfa_id"]) %>
+    <% sure_account = Current.family.accounts.find_by(id: suggestion["sure_account_id"]) %>
+    <% next unless old_sfa && new_sfa && sure_account %>
+    <%# Hide once the relink has landed: new sfa already linked to the target account. %>
+    <% next if new_sfa.current_account&.id == sure_account.id %>
+    <%# Hide if the user has dismissed this specific pair. %>
+    <% dismissal_key = "#{old_sfa.id}:#{new_sfa.id}" %>
+    <% next if dismissed_ids.include?(dismissal_key) %>
+
+    <div class="bg-yellow-50 theme-dark:bg-yellow-900/20 border border-yellow-200 theme-dark:border-yellow-800 rounded-lg p-4">
+      <div class="flex items-start gap-3">
+        <%= icon "credit-card", size: "sm", color: "warning", class: "shrink-0 mt-0.5" %>
+        <div class="flex-1 space-y-2">
+          <div class="flex items-start justify-between gap-2">
+            <p class="text-sm font-medium text-primary">
+              <%= t("simplefin_items.replacement_prompt.title",
+                    institution: suggestion["institution_name"].presence || simplefin_item.name) %>
+            </p>
+            <%= button_to dismiss_replacement_suggestion_simplefin_item_path(simplefin_item),
+                         params: { dormant_sfa_id: old_sfa.id, active_sfa_id: new_sfa.id },
+                         method: :post,
+                         form: { class: "inline shrink-0" },
+                         class: "-mt-1 -mr-1 p-1 rounded hover:bg-yellow-100 theme-dark:hover:bg-yellow-900/40 text-secondary",
+                         aria: { label: t("simplefin_items.replacement_prompt.dismiss_aria") } do %>
+              <%= icon "x", size: "sm" %>
+            <% end %>
+          </div>
+          <p class="text-xs text-secondary">
+            <%= t("simplefin_items.replacement_prompt.description",
+                  account_name: sure_account.name,
+                  old_name: old_sfa.name,
+                  new_name: new_sfa.name) %>
+          </p>
+          <div class="pt-1">
+            <% confirm = CustomConfirm.new(
+                 title: t("simplefin_items.replacement_prompt.confirm_title"),
+                 body: t("simplefin_items.replacement_prompt.confirm_body",
+                         account_name: sure_account.name,
+                         new_name: new_sfa.name),
+                 btn_text: t("simplefin_items.replacement_prompt.relink")
+               ) %>
+            <%= render DS::Button.new(
+              text: t("simplefin_items.replacement_prompt.relink"),
+              href: link_existing_account_simplefin_items_path(
+                account_id: sure_account.id,
+                simplefin_account_id: new_sfa.id
+              ),
+              variant: :primary,
+              data: { turbo_method: :post, turbo_confirm: confirm.to_data_attribute }
+            ) %>
+          </div>
+        </div>
+      </div>
+    </div>
+  <% end %>
+</div>
diff --git a/app/views/simplefin_items/_simplefin_item.html.erb b/app/views/simplefin_items/_simplefin_item.html.erb
index 0daf4af2a..8c632113f 100644
--- a/app/views/simplefin_items/_simplefin_item.html.erb
+++ b/app/views/simplefin_items/_simplefin_item.html.erb
@@ -16,177 +16,189 @@
        end
      end %>
 
-  <details open class="group bg-container p-4 shadow-border-xs rounded-xl">
-    <summary class="flex items-center justify-between gap-2">
-      <div class="flex items-center gap-2">
-        <%= icon "chevron-right", class: "group-open:transform group-open:rotate-90" %>
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center justify-between gap-2">
+        <div class="flex items-center gap-2">
+          <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
 
-        <div class="flex items-center justify-center h-8 w-8 bg-success/10 rounded-full">
-          <% if simplefin_item.logo.attached? %>
-            <%= image_tag simplefin_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
-          <% else %>
-            <div class="flex items-center justify-center">
-              <%= tag.p simplefin_item.name.first.upcase, class: "text-success text-xs font-medium" %>
-            </div>
-          <% end %>
-        </div>
-
-        <div class="pl-1 text-sm">
-          <div class="flex items-center gap-2">
-            <%= tag.p simplefin_item.name, class: "font-medium text-primary" %>
-            <% if simplefin_item.scheduled_for_deletion? %>
-              <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+          <div class="flex items-center justify-center h-8 w-8 bg-success/10 rounded-full">
+            <% if simplefin_item.logo.attached? %>
+              <%= image_tag simplefin_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
+            <% else %>
+              <div class="flex items-center justify-center">
+                <%= tag.p simplefin_item.name.first.upcase, class: "text-success text-xs font-medium" %>
+              </div>
             <% end %>
           </div>
-          <% if simplefin_item.accounts.any? %>
-            <p class="text-xs text-secondary">
-              <%= simplefin_item.institution_summary %>
-            </p>
-            <%# Extra inline badges from latest sync stats - only show warnings %>
-            <% stats = (@simplefin_sync_stats_map || {})[simplefin_item.id] || {} %>
-            <% has_warnings = stats["accounts_skipped"].to_i > 0 ||
-                              stats["rate_limited"].present? ||
-                              stats["rate_limited_at"].present? ||
-                              stats["total_errors"].to_i > 0 ||
-                              (stats["errors"].is_a?(Array) && stats["errors"].any?) %>
-            <% if has_warnings %>
-              <div class="flex items-center gap-2 mt-1">
-                <% if stats["accounts_skipped"].to_i > 0 %>
-                  <%= render DS::Tooltip.new(text: t(".accounts_skipped_tooltip"), icon: "alert-triangle", size: "sm", color: "warning") %>
-                  <span class="text-xs text-warning"><%= t(".accounts_skipped_label", count: stats["accounts_skipped"].to_i) %></span>
-                <% end %>
 
-                <% if stats["rate_limited"].present? || stats["rate_limited_at"].present? %>
-                  <% ts = stats["rate_limited_at"] %>
-                  <% ago = (ts.present? ? (begin; time_ago_in_words(Time.parse(ts)); rescue StandardError; nil; end) : nil) %>
-                  <%= render DS::Tooltip.new(
-                        text: (ago ? t(".rate_limited_ago", time: ago) : t(".rate_limited_recently")),
-                        icon: "clock",
-                        size: "sm",
-                        color: "warning"
-                      ) %>
-                <% end %>
-
-                <% if stats["total_errors"].to_i > 0 || (stats["errors"].is_a?(Array) && stats["errors"].any?) %>
-                  <% tooltip_text = simplefin_error_tooltip(stats) %>
-                  <% if tooltip_text.present? %>
-                    <%= render DS::Tooltip.new(text: tooltip_text, icon: "alert-octagon", size: "sm", color: "warning") %>
+          <div class="pl-1 text-sm">
+            <div class="flex items-center gap-2">
+              <%= tag.p simplefin_item.name, class: "font-medium text-primary" %>
+              <% if simplefin_item.scheduled_for_deletion? %>
+                <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+              <% end %>
+            </div>
+            <% if simplefin_item.accounts.any? %>
+              <p class="text-xs text-secondary">
+                <%= simplefin_item.institution_summary %>
+              </p>
+              <%# Extra inline badges from latest sync stats - only show warnings %>
+              <% stats = (@simplefin_sync_stats_map || {})[simplefin_item.id] || {} %>
+              <% has_warnings = stats["accounts_skipped"].to_i > 0 ||
+                                stats["rate_limited"].present? ||
+                                stats["rate_limited_at"].present? ||
+                                stats["total_errors"].to_i > 0 ||
+                                (stats["errors"].is_a?(Array) && stats["errors"].any?) %>
+              <% if has_warnings %>
+                <div class="flex items-center gap-2 mt-1">
+                  <% if stats["accounts_skipped"].to_i > 0 %>
+                    <%= render DS::Tooltip.new(text: t(".accounts_skipped_tooltip"), icon: "alert-triangle", size: "sm", color: "warning", as: :span) %>
+                    <span class="text-xs text-warning"><%= t(".accounts_skipped_label", count: stats["accounts_skipped"].to_i) %></span>
+                  <% end %>
+
+                  <% if stats["rate_limited"].present? || stats["rate_limited_at"].present? %>
+                    <% ts = stats["rate_limited_at"] %>
+                    <% ago = (ts.present? ? (begin; time_ago_in_words(Time.parse(ts)); rescue StandardError; nil; end) : nil) %>
+                    <%= render DS::Tooltip.new(
+                          text: (ago ? t(".rate_limited_ago", time: ago) : t(".rate_limited_recently")),
+                          icon: "clock",
+                          size: "sm",
+                          color: "warning",
+                          as: :span
+                        ) %>
+                  <% end %>
+
+                  <% if stats["total_errors"].to_i > 0 || (stats["errors"].is_a?(Array) && stats["errors"].any?) %>
+                    <% tooltip_text = simplefin_error_tooltip(stats) %>
+                    <% if tooltip_text.present? %>
+                      <%= render DS::Tooltip.new(text: tooltip_text, icon: "alert-octagon", size: "sm", color: "warning", as: :span) %>
+                    <% end %>
                   <% end %>
-                <% end %>
-              </div>
-            <% end %>
-          <% end %>
-          <%# Determine if all reported errors are benign duplicate-skips (suppress scary banner). Computed in controller for testability. %>
-          <% duplicate_only_errors = (@simplefin_duplicate_only_map || {})[simplefin_item.id] || false %>
-          <% if simplefin_item.syncing? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= icon "loader", size: "sm", class: "animate-spin" %>
-              <%= tag.span t(".syncing") %>
-            </div>
-          <% elsif simplefin_item.requires_update? %>
-            <div class="text-warning flex items-center gap-1">
-              <%= icon "alert-triangle", size: "sm", color: "warning" %>
-              <%= tag.span t(".requires_update") %>
-            </div>
-          <% elsif (stale_status = simplefin_item.stale_sync_status)[:stale] %>
-            <div class="text-warning flex items-center gap-1">
-              <%= icon "alert-circle", size: "sm", color: "warning" %>
-              <%= tag.span stale_status[:message], class: "text-sm" %>
-            </div>
-          <% elsif (pending_status = simplefin_item.stale_pending_status)[:count] > 0 %>
-            <div class="text-secondary">
-              <div class="flex items-center gap-1">
-                <%= icon "clock", size: "sm", color: "secondary" %>
-                <%= tag.span pending_status[:message], class: "text-sm" %>
-                <span class="text-xs text-subdued"><%= t(".stale_pending_note") %></span>
-              </div>
-              <% if pending_status[:accounts]&.any? %>
-                <div class="text-xs text-subdued ml-5">
-                  <%= t(".stale_pending_accounts", accounts: pending_status[:accounts].join(", ")) %>
                 </div>
               <% end %>
-            </div>
-          <% elsif (reconciled_status = simplefin_item.last_sync_reconciled_status)[:count] > 0 %>
-            <div class="text-success flex items-center gap-1">
-              <%= icon "check-circle", size: "sm", color: "success" %>
-              <%= tag.span reconciled_status[:message], class: "text-sm" %>
-              <span class="text-xs text-subdued"><%= t(".reconciled_details_note") %></span>
-            </div>
-          <% elsif simplefin_item.rate_limited_message.present? %>
-            <div class="text-warning flex items-center gap-1">
-              <%= icon "clock", size: "sm", color: "warning" %>
-              <%= tag.span simplefin_item.rate_limited_message %>
-            </div>
-          <% elsif simplefin_item.sync_error.present? && !duplicate_only_errors %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= render DS::Tooltip.new(text: simplefin_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive") %>
-              <%= tag.span t(".error"), class: "text-destructive" %>
-            </div>
-          <% elsif duplicate_only_errors %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= icon "info", size: "sm" %>
-              <%= tag.span t(".duplicate_accounts_skipped"), class: "text-secondary" %>
-            </div>
-          <% else %>
-            <p class="text-secondary">
-              <% if simplefin_item.last_synced_at %>
-                <% if simplefin_item.sync_status_summary %>
-                  <%= t(".status_with_summary", timestamp: time_ago_in_words(simplefin_item.last_synced_at), summary: simplefin_item.sync_status_summary) %>
-                <% else %>
-                  <%= t(".status", timestamp: time_ago_in_words(simplefin_item.last_synced_at)) %>
+            <% end %>
+            <%# Determine if all reported errors are benign duplicate-skips (suppress scary banner). Computed in controller for testability. %>
+            <% duplicate_only_errors = (@simplefin_duplicate_only_map || {})[simplefin_item.id] || false %>
+            <% if simplefin_item.syncing? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "loader", size: "sm", class: "animate-spin" %>
+                <%= tag.span t(".syncing") %>
+              </div>
+            <% elsif simplefin_item.requires_update? %>
+              <div class="text-warning flex items-center gap-1">
+                <%= icon "alert-triangle", size: "sm", color: "warning" %>
+                <%= tag.span t(".requires_update") %>
+              </div>
+            <% elsif (stale_status = simplefin_item.stale_sync_status)[:stale] %>
+              <div class="text-warning flex items-center gap-1">
+                <%= icon "alert-circle", size: "sm", color: "warning" %>
+                <%= tag.span stale_status[:message], class: "text-sm" %>
+              </div>
+            <% elsif (pending_status = simplefin_item.stale_pending_status)[:count] > 0 %>
+              <div class="text-secondary">
+                <div class="flex items-center gap-1">
+                  <%= icon "clock", size: "sm", color: "secondary" %>
+                  <%= tag.span pending_status[:message], class: "text-sm" %>
+                  <span class="text-xs text-subdued"><%= t(".stale_pending_note") %></span>
+                </div>
+                <% if pending_status[:accounts]&.any? %>
+                  <div class="text-xs text-subdued ml-5">
+                    <%= t(".stale_pending_accounts", accounts: pending_status[:accounts].join(", ")) %>
+                  </div>
                 <% end %>
-              <% else %>
-                <%= t(".status_never") %>
-              <% end %>
-            </p>
-          <% end %>
+              </div>
+            <% elsif (reconciled_status = simplefin_item.last_sync_reconciled_status)[:count] > 0 %>
+              <div class="text-success flex items-center gap-1">
+                <%= icon "check-circle", size: "sm", color: "success" %>
+                <%= tag.span reconciled_status[:message], class: "text-sm" %>
+                <span class="text-xs text-subdued"><%= t(".reconciled_details_note") %></span>
+              </div>
+            <% elsif simplefin_item.rate_limited_message.present? %>
+              <div class="text-warning flex items-center gap-1">
+                <%= icon "clock", size: "sm", color: "warning" %>
+                <%= tag.span simplefin_item.rate_limited_message %>
+              </div>
+            <% elsif simplefin_item.sync_error.present? && !duplicate_only_errors %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= render DS::Tooltip.new(text: simplefin_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive", as: :span) %>
+                <%= tag.span t(".error"), class: "text-destructive" %>
+              </div>
+            <% elsif duplicate_only_errors %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "info", size: "sm" %>
+                <%= tag.span t(".duplicate_accounts_skipped"), class: "text-secondary" %>
+              </div>
+            <% else %>
+              <p class="text-secondary">
+                <% if simplefin_item.last_synced_at %>
+                  <% if simplefin_item.sync_status_summary %>
+                    <%= t(".status_with_summary", timestamp: time_ago_in_words(simplefin_item.last_synced_at), summary: simplefin_item.sync_status_summary) %>
+                  <% else %>
+                    <%= t(".status", timestamp: time_ago_in_words(simplefin_item.last_synced_at)) %>
+                  <% end %>
+                <% else %>
+                  <%= t(".status_never") %>
+                <% end %>
+              </p>
+            <% end %>
+          </div>
         </div>
-      </div>
 
-      <% if Current.user&.admin? %>
-        <div class="flex items-center gap-2">
-          <% if simplefin_item.requires_update? %>
-            <%= render DS::Link.new(
-              text: t(".update"),
-              icon: "refresh-cw",
-              variant: "secondary",
-              href: edit_simplefin_item_path(simplefin_item),
-              frame: "modal"
-            ) %>
-          <% else %>
-            <%= icon(
-              "refresh-cw",
-              as_button: true,
-              href: sync_simplefin_item_path(simplefin_item),
-              disabled: simplefin_item.syncing?
-            ) %>
-          <% end %>
-
-          <%= render DS::Menu.new do |menu| %>
-            <% if unlinked_count.to_i > 0 %>
-              <% menu.with_item(
-                variant: "link",
-                text: t(".setup_accounts_menu"),
-                icon: "settings",
-                href: setup_accounts_simplefin_item_path(simplefin_item),
-                frame: :modal
+        <% if Current.user&.admin? %>
+          <div class="flex items-center gap-2">
+            <% if simplefin_item.requires_update? %>
+              <%= render DS::Link.new(
+                text: t(".update"),
+                icon: "refresh-cw",
+                variant: "secondary",
+                href: edit_simplefin_item_path(simplefin_item),
+                frame: "modal"
+              ) %>
+            <% else %>
+              <%= icon(
+                "refresh-cw",
+                as_button: true,
+                href: sync_simplefin_item_path(simplefin_item),
+                disabled: simplefin_item.syncing?
               ) %>
             <% end %>
-            <% menu.with_item(
-              variant: "button",
-              text: t(".delete"),
-              icon: "trash-2",
-              href: simplefin_item_path(simplefin_item),
-              method: :delete,
-              confirm: CustomConfirm.for_resource_deletion(simplefin_item.name, high_severity: true)
-            ) %>
-          <% end %>
-        </div>
-      <% end %>
-    </summary>
+
+            <%= render DS::Menu.new do |menu| %>
+              <% if unlinked_count.to_i > 0 %>
+                <% menu.with_item(
+                  variant: "link",
+                  text: t(".setup_accounts_menu"),
+                  icon: "settings",
+                  href: setup_accounts_simplefin_item_path(simplefin_item),
+                  frame: :modal
+                ) %>
+              <% end %>
+              <% menu.with_item(
+                variant: "button",
+                text: t(".delete"),
+                icon: "trash-2",
+                href: simplefin_item_path(simplefin_item),
+                method: :delete,
+                confirm: CustomConfirm.for_resource_deletion(simplefin_item.name, high_severity: true)
+              ) %>
+            <% end %>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
 
     <% unless simplefin_item.scheduled_for_deletion? %>
       <div class="space-y-4 mt-4">
+        <%# Replacement suggestions from the ReplacementDetector (card-fraud swap, etc.).
+           Only rendered when the latest sync flagged candidate pairs. %>
+        <% suggestions = ((@simplefin_sync_stats_map || {})[simplefin_item.id] || {})["replacement_suggestions"] %>
+        <% if suggestions.is_a?(Array) && suggestions.any? %>
+          <%= render "simplefin_items/replacement_prompt",
+                     simplefin_item: simplefin_item,
+                     suggestions: suggestions %>
+        <% end %>
+
         <% if simplefin_item.accounts.any? %>
           <%= render "accounts/index/account_groups", accounts: simplefin_item.accounts %>
         <% end %>
@@ -227,5 +239,5 @@
         <% end %>
       </div>
     <% end %>
-  </details>
+  <% end %>
 <% end %>
diff --git a/app/views/simplefin_items/edit.html.erb b/app/views/simplefin_items/edit.html.erb
index f0d3e0811..acc5761e7 100644
--- a/app/views/simplefin_items/edit.html.erb
+++ b/app/views/simplefin_items/edit.html.erb
@@ -1,11 +1,11 @@
-<% content_for :title, "Update SimpleFin Connection" %>
+<% content_for :title, t(".title") %>
 
 <%= turbo_frame_tag "modal" do %>
   <%= render DS::Dialog.new do |dialog| %>
-  <% dialog.with_header(title: "Update SimpleFin Connection") do %>
+  <% dialog.with_header(title: t(".title")) do %>
     <div class="flex items-center gap-2">
       <%= icon "building-2", class: "text-primary" %>
-      <span class="text-primary">Get a new setup token to reconnect your SimpleFin account</span>
+      <span class="text-primary"><%= t(".header_subtitle") %></span>
     </div>
   <% end %>
 
@@ -16,19 +16,19 @@
           <%= icon "info", size: "sm", class: "text-primary mt-0.5 flex-shrink-0" %>
           <div>
             <p class="text-sm text-primary mb-2">
-              <strong>Your SimpleFIN connection needs to be updated:</strong>
+              <strong><%= t(".connection_needs_update") %></strong>
             </p>
             <ol class="text-xs text-secondary space-y-1 list-decimal list-inside">
-              <li>Visit <a href="https://bridge.simplefin.org/simplefin/create" target="_blank" rel="noopener noreferrer" class="text-link hover:text-link underline">SimpleFIN Bridge</a> to create a new setup token</li>
-              <li>Copy the token and paste it below</li>
-              <li>Click "Update" to restore access</li>
+              <li><%= t(".step_1_html") %></li>
+              <li><%= t(".step_2") %></li>
+              <li><%= t(".step_3") %></li>
             </ol>
           </div>
         </div>
       </div>
 
       <% if @error_message %>
-        <div class="bg-destructive/10 border border-destructive/20 p-4 rounded-lg">
+        <div class="bg-destructive/10 border border-destructive-subtle p-4 rounded-lg">
           <div class="flex items-start gap-3">
             <%= icon "alert-triangle", size: "sm", class: "text-destructive mt-0.5 flex-shrink-0" %>
             <p class="text-sm text-destructive"><%= @error_message %></p>
@@ -46,14 +46,14 @@
 
       <div class="flex gap-3">
         <%= render DS::Button.new(
-          text: "Update",
+          text: t(".update"),
           variant: "primary",
           icon: "refresh-cw",
           type: "submit",
           class: "flex-1"
         ) %>
         <%= render DS::Link.new(
-          text: "Cancel",
+          text: t(".cancel"),
           variant: "secondary",
           href: accounts_path
         ) %>
diff --git a/app/views/simplefin_items/new.html.erb b/app/views/simplefin_items/new.html.erb
index ade7c448c..d0b3ffd9b 100644
--- a/app/views/simplefin_items/new.html.erb
+++ b/app/views/simplefin_items/new.html.erb
@@ -9,15 +9,20 @@
         </div>
       <% end %>
 
-      <%= form_with model: @simplefin_item, url: simplefin_items_path, method: :post, data: { turbo: true, turbo_frame: "_top" } do |f| %>
+      <%= styled_form_with model: @simplefin_item, url: simplefin_items_path, method: :post, data: { turbo: true, turbo_frame: "_top" } do |f| %>
         <div class="space-y-3">
           <div>
             <%= f.label :setup_token, t(".setup_token"), class: "text-sm text-secondary block mb-1" %>
             <%= f.text_field :setup_token, class: "input", placeholder: t(".setup_token_placeholder") %>
           </div>
           <div class="flex items-center gap-2 justify-end pt-2">
-            <%= link_to t(".cancel"), accounts_path, class: "btn", data: { turbo_frame: "_top", action: "DS--dialog#close" } %>
-            <%= f.submit t(".connect"), class: "btn btn--primary" %>
+            <%= render DS::Link.new(
+              text: t(".cancel"),
+              href: accounts_path,
+              variant: :secondary,
+              data: { turbo_frame: "_top", action: "DS--dialog#close" }
+            ) %>
+            <%= render DS::Button.new(text: t(".connect"), type: :submit) %>
           </div>
         </div>
       <% end %>
diff --git a/app/views/simplefin_items/select_existing_account.html.erb b/app/views/simplefin_items/select_existing_account.html.erb
index b47727556..8e2b27f7c 100644
--- a/app/views/simplefin_items/select_existing_account.html.erb
+++ b/app/views/simplefin_items/select_existing_account.html.erb
@@ -17,7 +17,7 @@
           <%= hidden_field_tag :account_id, @account.id %>
           <div class="space-y-2 max-h-64 overflow-auto">
             <% @available_simplefin_accounts.each do |sfa| %>
-              <label class="flex items-center gap-3 p-2 rounded border border-surface-inset/50 hover:border-primary cursor-pointer">
+              <label class="flex items-center gap-3 p-2 rounded border border-secondary hover:border-primary cursor-pointer">
                 <%= radio_button_tag :simplefin_account_id, sfa.id, false %>
                 <div class="flex flex-col">
                   <span class="text-sm text-primary font-medium"><%= sfa.name.presence || sfa.account_id %></span>
diff --git a/app/views/simplefin_items/setup_accounts.html.erb b/app/views/simplefin_items/setup_accounts.html.erb
index 1d30108e0..cf8441da3 100644
--- a/app/views/simplefin_items/setup_accounts.html.erb
+++ b/app/views/simplefin_items/setup_accounts.html.erb
@@ -1,10 +1,10 @@
-<% content_for :title, "Set Up SimpleFin Accounts" %>
+<% content_for :title, t(".title") %>
 
 <%= render DS::Dialog.new do |dialog| %>
-  <% dialog.with_header(title: "Set Up Your SimpleFin Accounts") do %>
+  <% dialog.with_header(title: t(".title")) do %>
     <div class="flex items-center gap-2">
       <%= icon "building-2", class: "text-primary" %>
-      <span class="text-primary">Choose the correct account types for your imported accounts</span>
+      <span class="text-primary"><%= t(".header_subtitle") %></span>
     </div>
   <% end %>
 
@@ -15,7 +15,7 @@
                   data: {
                     controller: "loading-button",
                     action: "submit->loading-button#showLoading",
-                    loading_button_loading_text_value: "Creating Accounts...",
+                    loading_button_loading_text_value: t(".creating_accounts"),
                     turbo_frame: "_top"
                   },
                   class: "space-y-6" do |form| %>
@@ -26,14 +26,14 @@
             <%= icon "info", size: "sm", class: "text-primary mt-0.5 flex-shrink-0" %>
             <div>
               <p class="text-sm text-primary mb-2">
-                <strong>Choose the correct account type for each SimpleFin account:</strong>
+                <strong><%= t(".choose_account_type") %></strong>
               </p>
               <ul class="text-xs text-secondary space-y-1 list-disc list-inside">
-                <li><strong>Checking or Savings</strong> - Regular bank accounts</li>
-                <li><strong>Credit Card</strong> - Credit card accounts</li>
-                <li><strong>Investment</strong> - Brokerage, 401(k), IRA accounts</li>
-                <li><strong>Loan or Mortgage</strong> - Debt accounts</li>
-                <li><strong>Other Asset</strong> - Everything else</li>
+                <li><strong><%= t(".account_type_checking_savings") %></strong> - <%= t(".account_type_checking_savings_desc") %></li>
+                <li><strong><%= t(".account_type_credit_card") %></strong> - <%= t(".account_type_credit_card_desc") %></li>
+                <li><strong><%= t(".account_type_investment") %></strong> - <%= t(".account_type_investment_desc") %></li>
+                <li><strong><%= t(".account_type_loan") %></strong> - <%= t(".account_type_loan_desc") %></li>
+                <li><strong><%= t(".account_type_other_asset") %></strong> - <%= t(".account_type_other_asset_desc") %></li>
               </ul>
             </div>
           </div>
@@ -45,12 +45,10 @@
             <%= icon "clock", size: "sm", class: "text-primary mt-0.5 flex-shrink-0" %>
             <div class="flex-1">
               <p class="text-sm text-primary mb-2">
-                <strong>Transaction History:</strong>
+                <strong><%= t(".transaction_history_title") %></strong>
               </p>
               <p class="text-xs text-secondary">
-                SimpleFin typically provides <strong>60-90 days</strong> of transaction history, depending on your bank.
-                After initial setup, new transactions will sync automatically going forward.
-                Historical data availability varies by institution and account type.
+                <%= t(".transaction_history_description_html") %>
               </p>
             </div>
           </div>
@@ -58,29 +56,49 @@
 
         <% @simplefin_accounts.each do |simplefin_account| %>
           <% inferred = @inferred_map[simplefin_account.id] || {} %>
-          <% selected_type = inferred[:confidence] == :high ? inferred[:type] : "skip" %>
+          <% activity = simplefin_account.activity_summary %>
+          <% near_zero_balance = (simplefin_account.current_balance || 0).to_d.abs <= 1 %>
+          <%# "Likely closed" requires evidence of prior activity that has since stopped.
+             An empty payload carries no signal (could be a brand-new card) so it renders
+             the neutral "no transactions imported yet" badge instead. %>
+          <% likely_closed = activity.last_transacted_at.present? && activity.dormant? && near_zero_balance %>
+          <%# Default likely-closed accounts (dormant AND near-zero balance) to "skip" so
+             users don't accidentally create empty Sure accounts for closed/replaced cards. %>
+          <% selected_type = if likely_closed
+            "skip"
+          else
+            inferred[:confidence] == :high ? inferred[:type] : "skip"
+          end %>
           <%# Check if this account needs user attention (type selected but subtype missing) %>
           <% types_with_subtypes = %w[Depository Investment Loan] %>
           <% needs_subtype_attention = selected_type != "skip" && types_with_subtypes.include?(selected_type) && inferred[:subtype].blank? %>
 
-          <div class="rounded-lg p-4 <%= needs_subtype_attention ? "border-2 border-warning bg-warning/5" : "border border-primary" %>">
+          <% card_class = if needs_subtype_attention
+            "border-2 border-warning bg-warning/5"
+          elsif likely_closed
+            "border border-tertiary bg-surface-inset"
+          else
+            "border border-primary"
+          end %>
+          <div class="rounded-lg p-4 <%= card_class %>">
             <div class="flex items-center justify-between mb-3">
-              <div>
-                <h3 class="font-medium text-primary">
+              <div class="flex-1">
+                <h3 class="font-medium <%= likely_closed ? "text-secondary" : "text-primary" %>">
                   <%= simplefin_account.name %>
                   <% if simplefin_account.org_data.present? && simplefin_account.org_data['name'].present? %>
                     <span class="text-secondary">• <%= simplefin_account.org_data["name"] %></span>
                   <% end %>
                 </h3>
                 <p class="text-sm text-secondary">
-                  Balance: <%= number_to_currency(simplefin_account.current_balance || 0, unit: simplefin_account.currency) %>
+                  <%= t(".account_card.balance") %>: <%= number_to_currency(simplefin_account.current_balance || 0, unit: simplefin_account.currency) %>
                 </p>
+                <%= render "activity_badge", activity: activity, likely_closed: likely_closed %>
               </div>
             </div>
 
             <div class="space-y-3" data-controller="account-type-selector" data-account-type-selector-account-id-value="<%= simplefin_account.id %>">
               <div>
-                <%= label_tag "account_types[#{simplefin_account.id}]", "Account Type:",
+                <%= label_tag "account_types[#{simplefin_account.id}]", t(".account_type_label"),
                              class: "block text-sm font-medium text-primary mb-2" %>
                 <%= select_tag "account_types[#{simplefin_account.id}]",
                               options_for_select(@account_type_options, selected_type),
@@ -126,7 +144,7 @@
 
       <div class="flex gap-3">
         <%= render DS::Button.new(
-          text: "Create Accounts",
+          text: t(".create_accounts"),
           variant: "primary",
           icon: "plus",
           type: "submit",
@@ -134,7 +152,7 @@
           data: { loading_button_target: "button" }
         ) %>
         <%= render DS::Link.new(
-          text: "Cancel",
+          text: t(".cancel"),
           variant: "secondary",
           href: accounts_path
         ) %>
diff --git a/app/views/snaptrade_items/_snaptrade_item.html.erb b/app/views/snaptrade_items/_snaptrade_item.html.erb
index f36712ec2..4314200c8 100644
--- a/app/views/snaptrade_items/_snaptrade_item.html.erb
+++ b/app/views/snaptrade_items/_snaptrade_item.html.erb
@@ -1,114 +1,116 @@
 <%# locals: (snaptrade_item:) %>
 
 <%= tag.div id: dom_id(snaptrade_item) do %>
-  <details open class="group bg-container p-4 shadow-border-xs rounded-xl">
-    <summary class="flex items-center justify-between gap-2">
-      <div class="flex items-center gap-2">
-        <%= icon "chevron-right", class: "group-open:transform group-open:rotate-90" %>
+  <% unlinked_count = snaptrade_item.unlinked_accounts_count %>
 
-        <div class="flex items-center justify-center h-8 w-8 bg-success/10 rounded-full">
-          <% if snaptrade_item.logo.attached? %>
-            <%= image_tag snaptrade_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
-          <% else %>
-            <div class="flex items-center justify-center">
-              <%= tag.p snaptrade_item.name.first.upcase, class: "text-success text-xs font-medium" %>
-            </div>
-          <% end %>
-        </div>
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center justify-between gap-2">
+        <div class="flex items-center gap-2">
+          <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
 
-        <% unlinked_count = snaptrade_item.unlinked_accounts_count %>
-
-        <div class="pl-1 text-sm">
-          <div class="flex items-center gap-2">
-            <%= tag.p snaptrade_item.name, class: "font-medium text-primary" %>
-            <% if snaptrade_item.scheduled_for_deletion? %>
-              <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+          <div class="flex items-center justify-center h-8 w-8 bg-success/10 rounded-full">
+            <% if snaptrade_item.logo.attached? %>
+              <%= image_tag snaptrade_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
+            <% else %>
+              <div class="flex items-center justify-center">
+                <%= tag.p snaptrade_item.name.first.upcase, class: "text-success text-xs font-medium" %>
+              </div>
             <% end %>
           </div>
-          <% if snaptrade_item.snaptrade_accounts.any? %>
-            <p class="text-xs text-secondary">
-              <%= snaptrade_item.brokerage_summary %>
-            </p>
-          <% end %>
-          <% if snaptrade_item.syncing? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= icon "loader", size: "sm", class: "animate-spin" %>
-              <%= tag.span t(".syncing") %>
-            </div>
-          <% elsif snaptrade_item.requires_update? %>
-            <div class="text-warning flex items-center gap-1">
-              <%= icon "alert-triangle", size: "sm", color: "warning" %>
-              <%= tag.span t(".requires_update") %>
-            </div>
-          <% elsif snaptrade_item.sync_error.present? %>
-            <div class="text-secondary flex items-center gap-1">
-              <%= render DS::Tooltip.new(text: snaptrade_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive") %>
-              <%= tag.span t(".error"), class: "text-destructive" %>
-            </div>
-          <% else %>
-            <p class="text-secondary">
-              <% if snaptrade_item.last_synced_at %>
-                <%= t(".status", timestamp: time_ago_in_words(snaptrade_item.last_synced_at), summary: snaptrade_item.sync_status_summary) %>
-              <% else %>
-                <%= t(".status_never") %>
+
+          <div class="pl-1 text-sm">
+            <div class="flex items-center gap-2">
+              <%= tag.p snaptrade_item.name, class: "font-medium text-primary" %>
+              <% if snaptrade_item.scheduled_for_deletion? %>
+                <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
               <% end %>
-            </p>
-          <% end %>
+            </div>
+            <% if snaptrade_item.snaptrade_accounts.any? %>
+              <p class="text-xs text-secondary">
+                <%= snaptrade_item.brokerage_summary %>
+              </p>
+            <% end %>
+            <% if snaptrade_item.syncing? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "loader", size: "sm", class: "animate-spin" %>
+                <%= tag.span t(".syncing") %>
+              </div>
+            <% elsif snaptrade_item.requires_update? %>
+              <div class="text-warning flex items-center gap-1">
+                <%= icon "alert-triangle", size: "sm", color: "warning" %>
+                <%= tag.span t(".requires_update") %>
+              </div>
+            <% elsif snaptrade_item.sync_error.present? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= render DS::Tooltip.new(text: snaptrade_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive", as: :span) %>
+                <%= tag.span t(".error"), class: "text-destructive" %>
+              </div>
+            <% else %>
+              <p class="text-secondary">
+                <% if snaptrade_item.last_synced_at %>
+                  <%= t(".status", timestamp: time_ago_in_words(snaptrade_item.last_synced_at), summary: snaptrade_item.sync_status_summary) %>
+                <% else %>
+                  <%= t(".status_never") %>
+                <% end %>
+              </p>
+            <% end %>
+          </div>
         </div>
-      </div>
 
-      <% if Current.user&.admin? %>
-        <div class="flex items-center gap-2">
-          <% if snaptrade_item.requires_update? || !snaptrade_item.user_registered? %>
-            <%= render DS::Link.new(
-              text: t(".reconnect"),
-              icon: "link",
-              variant: "secondary",
-              href: connect_snaptrade_item_path(snaptrade_item)
-            ) %>
-          <% else %>
-            <%= icon(
-              "refresh-cw",
-              as_button: true,
-              href: sync_snaptrade_item_path(snaptrade_item),
-              disabled: snaptrade_item.syncing?
-            ) %>
-          <% end %>
-
-          <%= render DS::Menu.new do |menu| %>
-            <% menu.with_item(
-              variant: "link",
-              text: t(".connect_brokerage"),
-              icon: "plus",
-              href: connect_snaptrade_item_path(snaptrade_item)
-            ) %>
-            <% if unlinked_count > 0 %>
-              <% menu.with_item(
-                variant: "link",
-                text: t(".setup_accounts_menu"),
-                icon: "settings",
-                href: setup_accounts_snaptrade_item_path(snaptrade_item),
-                frame: :modal
+        <% if Current.user&.admin? %>
+          <div class="flex items-center gap-2">
+            <% if snaptrade_item.requires_update? || !snaptrade_item.user_registered? %>
+              <%= render DS::Link.new(
+                text: t(".reconnect"),
+                icon: "link",
+                variant: "secondary",
+                href: connect_snaptrade_item_path(snaptrade_item)
+              ) %>
+            <% else %>
+              <%= icon(
+                "refresh-cw",
+                as_button: true,
+                href: sync_snaptrade_item_path(snaptrade_item),
+                disabled: snaptrade_item.syncing?
               ) %>
             <% end %>
-            <% menu.with_item(
-              variant: "link",
-              text: t(".manage_connections"),
-              icon: "cable",
-              href: settings_providers_path(manage: "1")
-            ) %>
-            <% menu.with_item(
-              variant: "button",
-              text: t(".delete"),
-              icon: "trash-2",
-              href: snaptrade_item_path(snaptrade_item),
-              method: :delete,
-              confirm: CustomConfirm.for_resource_deletion(snaptrade_item.name, high_severity: true)
-            ) %>
-          <% end %>
-        </div>
-      <% end %>
-    </summary>
+
+            <%= render DS::Menu.new do |menu| %>
+              <% menu.with_item(
+                variant: "link",
+                text: t(".connect_brokerage"),
+                icon: "plus",
+                href: connect_snaptrade_item_path(snaptrade_item)
+              ) %>
+              <% if unlinked_count > 0 %>
+                <% menu.with_item(
+                  variant: "link",
+                  text: t(".setup_accounts_menu"),
+                  icon: "settings",
+                  href: setup_accounts_snaptrade_item_path(snaptrade_item),
+                  frame: :modal
+                ) %>
+              <% end %>
+              <% menu.with_item(
+                variant: "link",
+                text: t(".manage_connections"),
+                icon: "cable",
+                href: settings_providers_path(manage: "1")
+              ) %>
+              <% menu.with_item(
+                variant: "button",
+                text: t(".delete"),
+                icon: "trash-2",
+                href: snaptrade_item_path(snaptrade_item),
+                method: :delete,
+                confirm: CustomConfirm.for_resource_deletion(snaptrade_item.name, high_severity: true)
+              ) %>
+            <% end %>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
 
     <% unless snaptrade_item.scheduled_for_deletion? %>
       <div class="space-y-4 mt-4">
@@ -155,5 +157,5 @@
         <% end %>
       </div>
     <% end %>
-  </details>
+  <% end %>
 <% end %>
diff --git a/app/views/snaptrade_items/select_existing_account.html.erb b/app/views/snaptrade_items/select_existing_account.html.erb
index ab4d49ff2..bf817c98d 100644
--- a/app/views/snaptrade_items/select_existing_account.html.erb
+++ b/app/views/snaptrade_items/select_existing_account.html.erb
@@ -14,7 +14,13 @@
         <%= icon "alert-circle", class: "text-warning mx-auto mb-4", size: "lg" %>
         <p class="text-secondary"><%= t("snaptrade_items.select_existing_account.no_accounts", default: "No unlinked SnapTrade accounts available.") %></p>
         <p class="text-sm text-secondary mt-2"><%= t("snaptrade_items.select_existing_account.connect_hint", default: "You may need to connect a brokerage first.") %></p>
-        <%= link_to t("snaptrade_items.select_existing_account.settings_link", default: "Go to Provider Settings"), settings_providers_path, class: "btn btn--primary btn--sm mt-4" %>
+        <%= render DS::Link.new(
+          text: t("snaptrade_items.select_existing_account.settings_link", default: "Go to Provider Settings"),
+          href: settings_providers_path,
+          variant: :primary,
+          size: :sm,
+          class: "mt-4"
+        ) %>
       </div>
     <% else %>
       <div class="space-y-4">
diff --git a/app/views/sophtron_items/_api_error.html.erb b/app/views/sophtron_items/_api_error.html.erb
new file mode 100644
index 000000000..e62f9628f
--- /dev/null
+++ b/app/views/sophtron_items/_api_error.html.erb
@@ -0,0 +1,42 @@
+<%# locals: (error_message:, return_path: nil, heading: nil, issue_keys: nil, action_label: nil) %>
+<% heading ||= t("sophtron_items.api_error.unable_to_connect") %>
+<% issue_keys ||= %w[incorrect_user_id invalid_access_key expired_credentials network_issue service_down] %>
+<% action_path = return_path.presence || settings_providers_path %>
+<% action_label ||= t("sophtron_items.api_error.check_provider_settings") %>
+
+<%= turbo_frame_tag "modal" do %>
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t("sophtron_items.api_error.title")) %>
+    <% dialog.with_body do %>
+      <div class="space-y-4">
+        <div class="rounded-lg border border-primary bg-container-inset p-3">
+          <div class="flex items-start gap-3">
+            <%= icon("alert-circle", color: "destructive", size: "sm", class: "mt-0.5") %>
+            <div class="space-y-1 text-sm">
+              <p class="font-medium text-primary"><%= heading %></p>
+              <p class="text-secondary"><%= h(error_message) %></p>
+            </div>
+          </div>
+        </div>
+
+        <div class="rounded-lg border border-primary bg-container-inset p-3 text-sm">
+          <p class="font-medium text-primary"><%= t("sophtron_items.api_error.common_issues_title") %></p>
+          <ul class="mt-2 list-disc space-y-1 pl-5 text-secondary">
+            <% issue_keys.each do |issue_key| %>
+              <li><%= t("sophtron_items.api_error.#{issue_key}") %></li>
+            <% end %>
+          </ul>
+        </div>
+
+        <div class="flex justify-end">
+          <%= render DS::Link.new(
+                text: action_label,
+                href: action_path,
+                variant: :primary,
+                data: { turbo: false }
+              ) %>
+        </div>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/sophtron_items/_loading.html.erb b/app/views/sophtron_items/_loading.html.erb
new file mode 100644
index 000000000..e0ea126c1
--- /dev/null
+++ b/app/views/sophtron_items/_loading.html.erb
@@ -0,0 +1,16 @@
+<%= turbo_frame_tag "modal" do %>
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t(".loading_title")) %>
+
+    <% dialog.with_body do %>
+      <div class="flex items-center justify-center py-8">
+        <div class="flex flex-col items-center gap-4">
+          <%= icon("loader-circle", class: "h-8 w-8 animate-spin text-primary") %>
+          <p class="text-sm text-secondary">
+            <%= t(".loading_message") %>
+          </p>
+        </div>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/sophtron_items/_mfa_context_fields.html.erb b/app/views/sophtron_items/_mfa_context_fields.html.erb
new file mode 100644
index 000000000..84dab88f7
--- /dev/null
+++ b/app/views/sophtron_items/_mfa_context_fields.html.erb
@@ -0,0 +1,6 @@
+<%= hidden_field_tag :accountable_type, @accountable_type %>
+<%= hidden_field_tag :account_id, @account_id %>
+<%= hidden_field_tag :return_to, @return_to %>
+<%= hidden_field_tag :manual_sync, @manual_sync_flow if @manual_sync_flow.present? %>
+<%= hidden_field_tag :sync_id, @manual_sync_id if @manual_sync_id.present? %>
+<%= hidden_field_tag :sophtron_account_id, @manual_sync_sophtron_account_id if @manual_sync_sophtron_account_id.present? %>
diff --git a/app/views/sophtron_items/_setup_required.html.erb b/app/views/sophtron_items/_setup_required.html.erb
new file mode 100644
index 000000000..d306640f4
--- /dev/null
+++ b/app/views/sophtron_items/_setup_required.html.erb
@@ -0,0 +1,37 @@
+<%= turbo_frame_tag "modal" do %>
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t("sophtron_items.sophtron_setup_required.title")) %>
+    <% dialog.with_body do %>
+      <div class="space-y-4">
+        <div class="rounded-lg border border-primary bg-container-inset p-3">
+          <div class="flex items-start gap-3">
+            <%= icon("alert-circle", color: "warning", size: "sm", class: "mt-0.5") %>
+            <div class="space-y-1 text-sm text-secondary">
+              <p class="font-medium text-primary"><%= t("sophtron_items.sophtron_setup_required.heading") %></p>
+              <p><%= t("sophtron_items.sophtron_setup_required.description") %></p>
+            </div>
+          </div>
+        </div>
+
+        <div class="rounded-lg border border-primary bg-container-inset p-3 text-sm">
+          <p class="font-medium text-primary"><%= t("sophtron_items.sophtron_setup_required.setup_steps_title") %></p>
+          <ol class="mt-2 list-decimal space-y-1 pl-5 text-secondary">
+            <li><%= t("sophtron_items.sophtron_setup_required.step_1_html") %></li>
+            <li><%= t("sophtron_items.sophtron_setup_required.step_2_html") %></li>
+            <li><%= t("sophtron_items.sophtron_setup_required.step_3_html") %></li>
+            <li><%= t("sophtron_items.sophtron_setup_required.step_4") %></li>
+          </ol>
+        </div>
+
+        <div class="flex justify-end">
+          <%= render DS::Link.new(
+                text: t("sophtron_items.sophtron_setup_required.go_to_provider_settings"),
+                href: settings_providers_path,
+                variant: :primary,
+                data: { turbo: false }
+              ) %>
+        </div>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/sophtron_items/_sophtron_item.html.erb b/app/views/sophtron_items/_sophtron_item.html.erb
new file mode 100644
index 000000000..a000d23b8
--- /dev/null
+++ b/app/views/sophtron_items/_sophtron_item.html.erb
@@ -0,0 +1,166 @@
+<%# locals: (sophtron_item:) %>
+
+<%= tag.div id: dom_id(sophtron_item) do %>
+  <% provider_display_name = sophtron_item.provider_display_name %>
+  <% manual_sync_required = sophtron_item.manual_sync_required? %>
+  <% connected_institution_options = sophtron_item.connected_institution_options %>
+  <%= render DS::Disclosure.new(variant: :card, open: true) do |disclosure| %>
+    <% disclosure.with_summary_content do %>
+      <div class="flex items-center justify-between gap-2">
+        <div class="flex items-center gap-2">
+          <%= icon "chevron-right", class: "group-open:rotate-90 motion-safe:transition-transform motion-safe:duration-150" %>
+
+          <div class="flex items-center justify-center h-8 w-8 bg-orange-600/10 rounded-full">
+            <% if sophtron_item.logo.attached? %>
+              <%= image_tag sophtron_item.logo, class: "rounded-full h-full w-full", loading: "lazy" %>
+            <% else %>
+              <div class="flex items-center justify-center">
+                <%= tag.p provider_display_name.first.upcase, class: "text-orange-600 text-xs font-medium" %>
+              </div>
+            <% end %>
+          </div>
+
+          <div class="pl-1 text-sm">
+            <div class="flex items-center gap-2">
+              <%= tag.p provider_display_name, class: "font-medium text-primary" %>
+              <% if manual_sync_required %>
+                <%= render DS::Pill.new(
+                  label: t(".manual_sync"),
+                  tone: :warning,
+                  marker: false,
+                  show_dot: false,
+                  size: :sm
+                ) %>
+              <% end %>
+              <% if sophtron_item.scheduled_for_deletion? %>
+                <p class="text-destructive text-sm animate-pulse"><%= t(".deletion_in_progress") %></p>
+              <% end %>
+            </div>
+            <% if sophtron_item.accounts.any? %>
+              <p class="text-xs text-secondary">
+                <%= sophtron_item.institution_summary %>
+              </p>
+            <% end %>
+            <% if sophtron_item.syncing? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= icon "loader", size: "sm", class: "animate-spin" %>
+                <%= tag.span t(".syncing") %>
+              </div>
+            <% elsif sophtron_item.sync_error.present? %>
+              <div class="text-secondary flex items-center gap-1">
+                <%= render DS::Tooltip.new(text: sophtron_item.sync_error, icon: "alert-circle", size: "sm", color: "destructive", as: :span) %>
+                <%= tag.span t(".error"), class: "text-destructive" %>
+              </div>
+            <% else %>
+              <p class="text-secondary">
+                <% if sophtron_item.last_synced_at %>
+                  <% if sophtron_item.sync_status_summary %>
+                    <%= t(".status_with_summary", timestamp: time_ago_in_words(sophtron_item.last_synced_at), summary: sophtron_item.sync_status_summary) %>
+                  <% else %>
+                    <%= t(".status", timestamp: time_ago_in_words(sophtron_item.last_synced_at)) %>
+                  <% end %>
+                <% else %>
+                  <%= t(".status_never") %>
+                <% end %>
+              </p>
+            <% end %>
+          </div>
+        </div>
+
+        <div class="flex items-center gap-2">
+          <% if manual_sync_required || Rails.env.development? %>
+            <%= render DS::Button.new(
+              variant: :icon,
+              icon: "refresh-cw",
+              href: sync_sophtron_item_path(sophtron_item),
+              frame: (manual_sync_required ? "modal" : nil),
+              title: t(".sync_now")
+            ) %>
+          <% end %>
+
+          <%= render DS::Menu.new do |menu| %>
+            <% if connected_institution_options.many? %>
+              <% connected_institution_options.each do |institution| %>
+                <% institution_manual_sync_required = sophtron_item.manual_sync_required_for_institution?(institution[:institution_key]) %>
+                <% menu.with_item(
+                  variant: "button",
+                  text: t(institution_manual_sync_required ? ".automatic_sync_for" : ".manual_sync_action_for", institution: institution[:name]),
+                  icon: institution_manual_sync_required ? "refresh-cw" : "pause-circle",
+                  href: toggle_manual_sync_sophtron_item_path(sophtron_item, institution_key: institution[:institution_key]),
+                  method: :post
+                ) %>
+              <% end %>
+            <% else %>
+              <% menu.with_item(
+                variant: "button",
+                text: t(manual_sync_required ? ".automatic_sync" : ".manual_sync_action"),
+                icon: manual_sync_required ? "refresh-cw" : "pause-circle",
+                href: toggle_manual_sync_sophtron_item_path(sophtron_item),
+                method: :post
+              ) %>
+            <% end %>
+            <% menu.with_item(
+              variant: "button",
+              text: t(".delete"),
+              icon: "trash-2",
+              href: sophtron_item_path(sophtron_item),
+              method: :delete,
+              confirm: CustomConfirm.for_resource_deletion(provider_display_name, high_severity: true)
+            ) %>
+          <% end %>
+        </div>
+      </div>
+    <% end %>
+
+    <% unless sophtron_item.scheduled_for_deletion? %>
+      <div class="space-y-4 mt-4">
+        <% if sophtron_item.accounts.any? %>
+          <%= render "accounts/index/account_groups", accounts: sophtron_item.accounts %>
+        <% end %>
+
+        <%# Sync summary (collapsible) - using shared ProviderSyncSummary component %>
+        <% stats = if defined?(@sophtron_sync_stats_map) && @sophtron_sync_stats_map
+             @sophtron_sync_stats_map[sophtron_item.id] || {}
+           else
+             sophtron_item.syncs.ordered.first&.sync_stats || {}
+           end %>
+        <%= render ProviderSyncSummary.new(
+          stats: stats,
+          provider_item: sophtron_item,
+          institutions_count: sophtron_item.connected_institutions.size
+        ) %>
+
+        <%# Use model methods for consistent counts %>
+        <% unlinked_count = sophtron_item.unlinked_accounts_count %>
+        <% linked_count = sophtron_item.linked_accounts_count %>
+        <% total_count = sophtron_item.total_accounts_count %>
+
+        <% if unlinked_count > 0 %>
+          <div class="p-4 flex flex-col gap-3 items-center justify-center">
+            <p class="text-primary font-medium text-sm"><%= t(".setup_needed") %></p>
+            <p class="text-secondary text-sm"><%= t(".setup_description", linked: linked_count, total: total_count) %></p>
+            <%= render DS::Link.new(
+              text: t(".setup_action"),
+              icon: "settings",
+              variant: "primary",
+              href: setup_accounts_sophtron_item_path(sophtron_item),
+              frame: :modal
+            ) %>
+          </div>
+        <% elsif sophtron_item.accounts.empty? && total_count == 0 %>
+          <div class="p-4 flex flex-col gap-3 items-center justify-center">
+            <p class="text-primary font-medium text-sm"><%= t(".no_accounts_title") %></p>
+            <p class="text-secondary text-sm"><%= t(".no_accounts_description") %></p>
+            <%= render DS::Link.new(
+              text: t(".setup_action"),
+              icon: "settings",
+              variant: "primary",
+              href: setup_accounts_sophtron_item_path(sophtron_item),
+              frame: :modal
+            ) %>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/sophtron_items/_subtype_select.html.erb b/app/views/sophtron_items/_subtype_select.html.erb
new file mode 100644
index 000000000..6ca3bcb8d
--- /dev/null
+++ b/app/views/sophtron_items/_subtype_select.html.erb
@@ -0,0 +1,23 @@
+<div class="subtype-select" data-type="<%= account_type %>" style="display: none;">
+  <% if subtype_config[:options].present? %>
+    <%= label_tag "account_subtypes[#{sophtron_account.id}]", subtype_config[:label],
+                 class: "block text-sm font-medium text-primary mb-2" %>
+    <% selected_value = "" %>
+    <% if account_type == "Depository" %>
+      <% n = sophtron_account.name.to_s.downcase %>
+      <% selected_value = "" %>
+      <% if n =~ /\bchecking\b|\bchequing\b|\bck\b|demand\s+deposit/ %>
+        <% selected_value = "checking" %>
+      <% elsif n =~ /\bsavings\b|\bsv\b/ %>
+        <% selected_value = "savings" %>
+      <% elsif n =~ /money\s+market|\bmm\b/ %>
+        <% selected_value = "money_market" %>
+      <% end %>
+    <% end %>
+    <%= select_tag "account_subtypes[#{sophtron_account.id}]",
+                  options_for_select([["Select #{account_type == 'Depository' ? 'subtype' : 'type'}", ""]] + subtype_config[:options], selected_value),
+                  { class: "appearance-none bg-container border border-primary rounded-md px-3 py-2 text-sm leading-6 text-primary focus:border-primary focus:ring-1 focus:ring-primary focus:outline-none w-full" } %>
+  <% else %>
+    <p class="text-sm text-secondary"><%= subtype_config[:message] %></p>
+  <% end %>
+</div>
diff --git a/app/views/sophtron_items/connect.html.erb b/app/views/sophtron_items/connect.html.erb
new file mode 100644
index 000000000..210f63a5a
--- /dev/null
+++ b/app/views/sophtron_items/connect.html.erb
@@ -0,0 +1,82 @@
+<%= turbo_frame_tag "modal" do %>
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t(".title")) %>
+
+    <% dialog.with_body do %>
+      <div class="space-y-4">
+        <%= form_with url: select_accounts_sophtron_items_path, method: :get, class: "space-y-3" do %>
+          <%= hidden_field_tag :accountable_type, @accountable_type %>
+          <%= hidden_field_tag :account_id, @account&.id %>
+          <%= hidden_field_tag :return_to, @return_to %>
+          <%= hidden_field_tag :connect_new_institution, true if @connect_new_institution %>
+
+          <div class="form-field">
+            <div class="form-field__body">
+              <%= label_tag :institution_name, t(".institution_search_label"), class: "form-field__label" %>
+              <%= text_field_tag :institution_name, @institution_search, placeholder: t(".institution_search_placeholder"), autocomplete: "off", class: "form-field__input" %>
+            </div>
+          </div>
+
+          <div class="flex justify-end">
+            <%= render DS::Button.new(text: t(".search"), type: "submit") %>
+          </div>
+        <% end %>
+
+        <% if @institution_search.present? && @institution_search.length < 2 %>
+          <p class="rounded-lg border border-primary bg-container-inset p-3 text-sm text-secondary"><%= t(".search_too_short") %></p>
+        <% elsif @institution_search.present? && @institutions.empty? %>
+          <p class="rounded-lg border border-primary bg-container-inset p-3 text-sm text-secondary"><%= t(".no_institutions") %></p>
+        <% end %>
+
+        <div class="space-y-3">
+          <% @institutions.each_with_index do |institution, index| %>
+            <% institution = institution.with_indifferent_access %>
+            <% institution_id = institution[:InstitutionID] || institution[:institution_id] %>
+            <% field_suffix = (institution_id.presence || index).to_s.parameterize %>
+            <% bank_username_id = "bank_username_#{field_suffix}" %>
+            <% bank_password_id = "bank_password_#{field_suffix}" %>
+            <%= form_with url: connect_institution_sophtron_item_path(@sophtron_item), method: :post, class: "space-y-3 rounded-lg border border-primary bg-container-inset p-3", data: { turbo_frame: "modal" } do %>
+              <%= hidden_field_tag :institution_id, institution_id %>
+              <%= hidden_field_tag :institution_name, institution[:InstitutionName] || institution[:institution_name] %>
+              <%= hidden_field_tag :accountable_type, @accountable_type %>
+              <%= hidden_field_tag :account_id, @account&.id %>
+              <%= hidden_field_tag :return_to, @return_to %>
+              <%= hidden_field_tag :connect_new_institution, true if @connect_new_institution %>
+
+              <h3 class="text-sm font-medium text-primary"><%= institution[:InstitutionName] || institution[:institution_name] %></h3>
+
+              <div class="grid grid-cols-1 gap-3">
+                <div class="form-field">
+                  <div class="form-field__body">
+                    <%= label_tag bank_username_id, t(".username"), class: "form-field__label" %>
+                    <%= text_field_tag :bank_username, nil, id: bank_username_id, autocomplete: "username", class: "form-field__input" %>
+                  </div>
+                </div>
+
+                <div class="form-field">
+                  <div class="form-field__body">
+                    <%= label_tag bank_password_id, t(".password"), class: "form-field__label" %>
+                    <%= password_field_tag :bank_password, nil, id: bank_password_id, autocomplete: "current-password", class: "form-field__input" %>
+                  </div>
+                </div>
+              </div>
+
+              <div class="flex justify-end">
+                <%= render DS::Button.new(text: t(".connect"), type: "submit") %>
+              </div>
+            <% end %>
+          <% end %>
+        </div>
+
+        <div class="flex justify-end pt-2">
+          <%= render DS::Link.new(
+                text: t(".cancel"),
+                href: @return_to || accounts_path,
+                variant: :secondary,
+                data: { turbo_frame: "_top", action: "click->DS--dialog#close" }
+              ) %>
+        </div>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/sophtron_items/connection_status.html.erb b/app/views/sophtron_items/connection_status.html.erb
new file mode 100644
index 000000000..5a2e8b5b6
--- /dev/null
+++ b/app/views/sophtron_items/connection_status.html.erb
@@ -0,0 +1,51 @@
+<% polling_data = if @timed_out
+     {}
+   else
+     {
+       controller: "polling",
+       polling_frame_id_value: "modal",
+       polling_url_value: connection_status_sophtron_item_path(@sophtron_item, accountable_type: @accountable_type, account_id: @account_id, return_to: @return_to, poll_attempt: @next_poll_attempt, post_mfa: @post_mfa_polling, manual_sync: @manual_sync_flow, sync_id: @manual_sync_id, sophtron_account_id: @manual_sync_sophtron_account_id),
+       polling_interval_value: @poll_interval_ms
+     }
+   end %>
+<% check_again_attempt = @timed_out ? 1 : (@next_poll_attempt || @poll_attempt.to_i + 1) %>
+
+<%= turbo_frame_tag "modal" do %>
+  <%= tag.div(data: polling_data) do %>
+    <%= render DS::Dialog.new do |dialog| %>
+      <% dialog.with_header(title: t(".title")) %>
+
+      <% dialog.with_body do %>
+        <div class="space-y-4">
+          <div class="rounded-lg border border-primary bg-container-inset p-3">
+            <div class="flex items-start gap-3">
+              <% if @timed_out %>
+                <%= icon "alert-circle", size: "sm", class: "mt-0.5" %>
+              <% else %>
+                <%= icon "loader", size: "sm", class: "mt-0.5 animate-spin" %>
+              <% end %>
+
+              <div class="space-y-1 text-sm">
+                <p class="font-medium text-primary">
+                  <%= @timed_out ? t(".timeout") : t(".waiting") %>
+                </p>
+                <p class="text-xs text-secondary">
+                  <%= t(".attempt", attempt: (@poll_attempt || 1), max: @max_poll_attempts) %>
+                </p>
+              </div>
+            </div>
+          </div>
+
+          <div class="flex gap-2 justify-end">
+            <%= render DS::Link.new(
+                  text: t(".check_again"),
+                  href: connection_status_sophtron_item_path(@sophtron_item, accountable_type: @accountable_type, account_id: @account_id, return_to: @return_to, poll_attempt: check_again_attempt, post_mfa: @post_mfa_polling, manual_sync: @manual_sync_flow, sync_id: @manual_sync_id, sophtron_account_id: @manual_sync_sophtron_account_id),
+                  variant: :primary,
+                  data: { turbo_frame: "modal", turbo_prefetch: false }
+                ) %>
+          </div>
+        </div>
+      <% end %>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/sophtron_items/manual_sync_complete.html.erb b/app/views/sophtron_items/manual_sync_complete.html.erb
new file mode 100644
index 000000000..70b0f3e57
--- /dev/null
+++ b/app/views/sophtron_items/manual_sync_complete.html.erb
@@ -0,0 +1,23 @@
+<%= turbo_frame_tag "modal" do %>
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t(".title")) %>
+
+    <% dialog.with_body do %>
+      <div class="space-y-4">
+        <div class="rounded-lg border border-primary bg-container-inset p-3">
+          <div class="flex items-start gap-3">
+            <%= icon "check-circle", size: "sm", color: "success", class: "mt-0.5" %>
+            <div class="space-y-1 text-sm">
+              <p class="font-medium text-primary"><%= t(".message") %></p>
+              <p class="text-xs text-secondary"><%= t(".description") %></p>
+            </div>
+          </div>
+        </div>
+
+        <div class="flex justify-end">
+          <%= render DS::Link.new(text: t(".close"), href: accounts_path, variant: :primary, data: { turbo_frame: "_top" }) %>
+        </div>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/sophtron_items/mfa.html.erb b/app/views/sophtron_items/mfa.html.erb
new file mode 100644
index 000000000..2247c7c29
--- /dev/null
+++ b/app/views/sophtron_items/mfa.html.erb
@@ -0,0 +1,87 @@
+<%= turbo_frame_tag "modal" do %>
+  <% security_questions = Array(@challenge[:security_questions]) %>
+  <% token_methods = Array(@challenge[:token_methods]) %>
+  <% safe_captcha_image = @challenge[:captcha_image].to_s.split(%r{[^A-Za-z0-9+/=\s]}, 2).first.to_s.gsub(/\s+/, "") %>
+
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t(".title")) %>
+
+    <% dialog.with_body do %>
+      <div class="space-y-4">
+        <% if security_questions.any? %>
+          <%= form_with url: submit_mfa_sophtron_item_path(@sophtron_item), method: :post, class: "space-y-3", data: { turbo_frame: "modal" } do %>
+            <%= hidden_field_tag :mfa_type, "security_answer" %>
+            <%= render "sophtron_items/mfa_context_fields" %>
+
+            <% security_questions.each_with_index do |question, index| %>
+              <% answer_field_id = "security_answer_#{index}" %>
+              <div class="form-field">
+                <div class="form-field__body">
+                  <%= label_tag answer_field_id, question, class: "form-field__label" %>
+                  <%= text_field_tag "security_answers[]", nil, id: answer_field_id, autocomplete: "off", class: "form-field__input" %>
+                </div>
+              </div>
+            <% end %>
+
+            <div class="flex justify-end">
+              <%= render DS::Button.new(text: t(".submit"), type: "submit") %>
+            </div>
+          <% end %>
+        <% elsif token_methods.any? %>
+          <div class="space-y-2">
+            <% token_methods.each do |method| %>
+              <%= form_with url: submit_mfa_sophtron_item_path(@sophtron_item), method: :post, data: { turbo_frame: "modal" } do %>
+                <%= hidden_field_tag :mfa_type, "token_choice" %>
+                <%= hidden_field_tag :token_choice, method %>
+                <%= render "sophtron_items/mfa_context_fields" %>
+                <%= button_tag type: "submit", class: "w-full rounded-lg border border-primary bg-container-inset p-3 text-left text-sm text-primary transition-colors hover:bg-container-inset-hover" do %>
+                  <span class="font-medium"><%= method %></span>
+                <% end %>
+              <% end %>
+            <% end %>
+          </div>
+        <% elsif @challenge[:token_sent] %>
+          <%= form_with url: submit_mfa_sophtron_item_path(@sophtron_item), method: :post, class: "space-y-3", data: { turbo_frame: "modal" } do %>
+            <%= hidden_field_tag :mfa_type, "token_input" %>
+            <%= render "sophtron_items/mfa_context_fields" %>
+            <div class="form-field">
+              <div class="form-field__body">
+                <%= label_tag :token_input, t(".token"), class: "form-field__label" %>
+                <%= text_field_tag :token_input, nil, autocomplete: "one-time-code", class: "form-field__input" %>
+              </div>
+            </div>
+            <div class="flex justify-end">
+              <%= render DS::Button.new(text: t(".submit"), type: "submit") %>
+            </div>
+          <% end %>
+        <% elsif @challenge[:token_read].present? %>
+          <div class="space-y-3">
+            <p class="rounded-lg border border-primary bg-container-inset p-3 text-sm text-primary"><%= @challenge[:token_read] %></p>
+            <%= form_with url: submit_mfa_sophtron_item_path(@sophtron_item), method: :post, data: { turbo_frame: "modal" } do %>
+              <%= hidden_field_tag :mfa_type, "verify_phone" %>
+              <%= render "sophtron_items/mfa_context_fields" %>
+              <%= render DS::Button.new(text: t(".phone_confirmed"), type: "submit") %>
+            <% end %>
+          </div>
+        <% elsif safe_captcha_image.present? %>
+          <%= form_with url: submit_mfa_sophtron_item_path(@sophtron_item), method: :post, class: "space-y-3", data: { turbo_frame: "modal" } do %>
+            <%= hidden_field_tag :mfa_type, "captcha" %>
+            <%= render "sophtron_items/mfa_context_fields" %>
+            <div class="rounded-lg border border-primary bg-container-inset p-3">
+              <%= image_tag "data:image/png;base64,#{safe_captcha_image}", alt: t(".captcha_alt"), class: "max-w-full rounded-md" %>
+            </div>
+            <div class="form-field">
+              <div class="form-field__body">
+                <%= label_tag :captcha_input, t(".captcha"), class: "form-field__label" %>
+                <%= text_field_tag :captcha_input, nil, autocomplete: "off", class: "form-field__input" %>
+              </div>
+            </div>
+            <div class="flex justify-end">
+              <%= render DS::Button.new(text: t(".submit"), type: "submit") %>
+            </div>
+          <% end %>
+        <% end %>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/sophtron_items/select_accounts.html.erb b/app/views/sophtron_items/select_accounts.html.erb
new file mode 100644
index 000000000..760847e2e
--- /dev/null
+++ b/app/views/sophtron_items/select_accounts.html.erb
@@ -0,0 +1,56 @@
+<%= turbo_frame_tag "modal" do %>
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t(".title")) %>
+
+    <% dialog.with_body do %>
+      <div class="space-y-4">
+        <p class="text-sm text-secondary">
+          <%= t(".description", product_name: product_name) %>
+        </p>
+
+        <form action="<%= link_accounts_sophtron_items_path %>" method="post" class="space-y-4" data-turbo-frame="_top">
+          <%= hidden_field_tag :authenticity_token, form_authenticity_token %>
+          <%= hidden_field_tag :accountable_type, @accountable_type %>
+          <%= hidden_field_tag :return_to, @return_to %>
+
+          <div class="space-y-2">
+            <% @available_accounts.each do |account| %>
+              <% Rails.logger.debug "Sophtron account data: #{account.inspect}" %>
+              <% has_blank_name = account[:account_name].blank? %>
+              <label class="flex items-start gap-3 rounded-lg border <%= has_blank_name ? "border-destructive bg-container-inset opacity-60" : "border-primary bg-container-inset hover:bg-container-inset-hover" %> p-3 <%= has_blank_name ? "cursor-not-allowed" : "cursor-pointer" %> transition-colors">
+                <%= check_box_tag "account_ids[]", account[:id], false, disabled: has_blank_name, class: "mt-1" %>
+                <div class="flex-1">
+                  <div class="text-sm font-medium <%= has_blank_name ? "text-destructive" : "text-primary" %>">
+                    <% if has_blank_name %>
+                      <%= t(".no_name_placeholder") %>
+                    <% else %>
+                      <%= account[:account_name] %>
+                    <% end %>
+                  </div>
+                  <div class="text-xs text-secondary mt-1">
+                    <%= account[:institution_name] %> • <%= account[:currency] %> • <%= account[:status] %>
+                  </div>
+                  <% if has_blank_name %>
+                    <div class="mt-1 text-xs text-destructive">
+                      <%= t(".configure_name_in_sophtron") %>
+                    </div>
+                  <% end %>
+                </div>
+              </label>
+            <% end %>
+          </div>
+
+          <div class="flex gap-2 justify-end pt-4">
+            <%= render DS::Link.new(
+                  text: t(".cancel"),
+                  href: @return_to || new_account_path,
+                  variant: :secondary,
+                  data: { turbo_frame: "_top", action: "DS--dialog#close" }
+                ) %>
+            <%= render DS::Button.new(text: t(".link_accounts"), type: "submit") %>
+          </div>
+        </form>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/sophtron_items/select_existing_account.html.erb b/app/views/sophtron_items/select_existing_account.html.erb
new file mode 100644
index 000000000..a717a37ab
--- /dev/null
+++ b/app/views/sophtron_items/select_existing_account.html.erb
@@ -0,0 +1,60 @@
+<%= turbo_frame_tag "modal" do %>
+  <%= render DS::Dialog.new do |dialog| %>
+    <% dialog.with_header(title: t(".title", account_name: @account.name)) %>
+
+    <% dialog.with_body do %>
+      <div class="space-y-4">
+        <p class="text-sm text-secondary">
+          <%= t(".description") %>
+        </p>
+
+        <%= form_with url: link_existing_account_sophtron_items_path,
+              method: :post,
+              class: "space-y-4",
+              data: { turbo_frame: "_top" } do %>
+          <%= hidden_field_tag :account_id, @account.id %>
+          <%= hidden_field_tag :return_to, @return_to %>
+
+          <div class="space-y-2">
+            <% @available_accounts.each do |account| %>
+              <% has_blank_name = account[:account_name].blank? %>
+              <label class="flex items-start gap-3 rounded-lg border <%= has_blank_name ? "border-destructive bg-container-inset opacity-60" : "border-primary bg-container-inset hover:bg-container-inset-hover" %> p-3 <%= has_blank_name ? "cursor-not-allowed" : "cursor-pointer" %> transition-colors">
+                <%= radio_button_tag "sophtron_account_id", account[:id], false,
+                      required: true,
+                      disabled: has_blank_name,
+                      class: "mt-1" %>
+                <div class="flex-1">
+                  <div class="text-sm font-medium <%= has_blank_name ? "text-destructive" : "text-primary" %>">
+                    <% if has_blank_name %>
+                      <%= t(".no_name_placeholder") %>
+                    <% else %>
+                      <%= account[:account_name] %>
+                    <% end %>
+                  </div>
+                  <div class="text-xs text-secondary mt-1">
+                    <%= account[:institution_name] %> • <%= account[:currency] %> • <%= account[:status] %>
+                  </div>
+                  <% if has_blank_name %>
+                    <div class="mt-1 text-xs text-destructive">
+                      <%= t(".configure_name_in_sophtron") %>
+                    </div>
+                  <% end %>
+                </div>
+              </label>
+            <% end %>
+          </div>
+
+          <div class="flex gap-2 justify-end pt-4">
+            <%= render DS::Link.new(
+                  text: t(".cancel"),
+                  href: @return_to || accounts_path,
+                  variant: :secondary,
+                  data: { turbo_frame: "_top", action: "click->DS--dialog#close" }
+                ) %>
+            <%= render DS::Button.new(text: t(".link_account"), type: "submit") %>
+          </div>
+        <% end %>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/sophtron_items/setup_accounts.html.erb b/app/views/sophtron_items/setup_accounts.html.erb
new file mode 100644
index 000000000..006cc1594
--- /dev/null
+++ b/app/views/sophtron_items/setup_accounts.html.erb
@@ -0,0 +1,105 @@
+<% content_for :title, "Set Up Sophtron Accounts" %>
+
+<%= render DS::Dialog.new do |dialog| %>
+  <% dialog.with_header(title: t(".title")) do %>
+    <div class="flex items-center gap-2">
+      <%= icon "building-2", class: "text-primary" %>
+      <span class="text-primary"><%= t(".subtitle") %></span>
+    </div>
+  <% end %>
+
+  <% dialog.with_body do %>
+    <%= form_with url: complete_account_setup_sophtron_item_path(@sophtron_item),
+                  method: :post,
+                  local: true,
+                  data: {
+                    controller: "loading-button",
+                    action: "submit->loading-button#showLoading",
+                    loading_button_loading_text_value: t(".creating_accounts"),
+                    turbo_frame: "_top"
+                  },
+                  class: "space-y-6" do |form| %>
+
+      <div class="space-y-4">
+        <% if @api_error.present? %>
+          <div class="p-8 flex flex-col gap-3 items-center justify-center text-center">
+            <%= icon "alert-circle", size: "lg", class: "text-destructive" %>
+            <p class="text-primary font-medium"><%= t(".fetch_failed") %></p>
+            <p class="text-destructive text-sm"><%= @api_error %></p>
+          </div>
+        <% elsif @sophtron_accounts.empty? %>
+          <div class="p-8 flex flex-col gap-3 items-center justify-center text-center">
+            <%= icon "check-circle", size: "lg", class: "text-success" %>
+            <p class="text-primary font-medium"><%= t(".no_accounts_to_setup") %></p>
+            <p class="text-secondary text-sm"><%= t(".all_accounts_linked") %></p>
+          </div>
+        <% else %>
+          <div class="bg-surface border border-primary p-4 rounded-lg">
+            <div class="flex items-start gap-3">
+              <%= icon "info", size: "sm", class: "text-primary mt-0.5 flex-shrink-0" %>
+              <div>
+                <p class="text-sm text-primary mb-2">
+                  <strong><%= t(".choose_account_type") %></strong>
+                </p>
+                <ul class="text-xs text-secondary space-y-1 list-disc list-inside">
+                  <% @account_type_options.reject { |_, type| type == "skip" }.each do |label, type| %>
+                    <li><strong><%= label %></strong></li>
+                  <% end %>
+                </ul>
+              </div>
+            </div>
+          </div>
+
+          <% @sophtron_accounts.each do |sophtron_account| %>
+          <div class="border border-primary rounded-lg p-4">
+            <div class="flex items-center justify-between mb-3">
+              <div>
+                <h3 class="font-medium text-primary">
+                  <%= sophtron_account.name %>
+                </h3>
+              </div>
+            </div>
+
+            <div class="space-y-3" data-controller="account-type-selector" data-account-type-selector-account-id-value="<%= sophtron_account.id %>">
+              <div>
+                <%= label_tag "account_types[#{sophtron_account.id}]", t(".account_type_label"),
+                             class: "block text-sm font-medium text-primary mb-2" %>
+                <%= select_tag "account_types[#{sophtron_account.id}]",
+                              options_for_select(@account_type_options, "skip"),
+                              { class: "appearance-none bg-container border border-primary rounded-md px-3 py-2 text-sm leading-6 text-primary focus:border-primary focus:ring-1 focus:ring-primary focus:outline-none w-full",
+                                data: {
+                                  action: "change->account-type-selector#updateSubtype"
+                                } } %>
+              </div>
+
+              <!-- Subtype dropdowns (shown/hidden based on account type) -->
+              <div data-account-type-selector-target="subtypeContainer">
+                <% @subtype_options.each do |account_type, subtype_config| %>
+                  <%= render "sophtron_items/subtype_select", account_type: account_type, subtype_config: subtype_config, sophtron_account: sophtron_account %>
+                <% end %>
+              </div>
+            </div>
+          </div>
+          <% end %>
+        <% end %>
+      </div>
+
+      <div class="flex gap-3">
+        <%= render DS::Button.new(
+          text: t(".create_accounts"),
+          variant: "primary",
+          icon: "plus",
+          type: "submit",
+          class: "flex-1",
+          disabled: @api_error.present? || @sophtron_accounts.empty?,
+          data: { loading_button_target: "button" }
+        ) %>
+        <%= render DS::Link.new(
+          text: t(".cancel"),
+          variant: "secondary",
+          href: accounts_path
+        ) %>
+      </div>
+    <% end %>
+  <% end %>
+<% end %>
diff --git a/app/views/splits/_category_select.html.erb b/app/views/splits/_category_select.html.erb
index 001919322..033a0915a 100644
--- a/app/views/splits/_category_select.html.erb
+++ b/app/views/splits/_category_select.html.erb
@@ -33,14 +33,15 @@
     <% end %>
   </button>
   <div class="absolute z-50 p-1.5 w-full min-w-48 rounded-lg shadow-lg shadow-border-xs bg-container mt-1.5 transition duration-150 ease-out -translate-y-1 opacity-0 hidden" data-select-target="menu">
-    <div class="relative flex items-center bg-container border border-secondary rounded-lg mb-1">
-      <input type="search"
-             placeholder="<%= t("helpers.select.search_placeholder") %>"
-             autocomplete="off"
-             class="bg-container text-sm placeholder:text-secondary font-normal h-10 pl-10 w-full border-none rounded-lg focus:outline-hidden focus:ring-0"
-             data-list-filter-target="input"
-             data-action="list-filter#filter">
-      <%= icon("search", class: "absolute inset-0 ml-2 transform top-1/2 -translate-y-1/2") %>
+    <div class="flex items-center bg-container border border-secondary rounded-lg mb-1 focus-within:ring-4 focus-within:ring-alpha-black-200 theme-dark:focus-within:ring-alpha-white-300 transition-shadow">
+      <%= render DS::SearchInput.new(
+        variant: :embedded,
+        placeholder: t("helpers.select.search_placeholder"),
+        data: {
+          list_filter_target: "input",
+          action: "list-filter#filter"
+        }
+      ) %>
     </div>
     <div data-list-filter-target="list" data-select-target="content" class="flex flex-col gap-0.5 max-h-64 overflow-auto" role="listbox" tabindex="-1">
       <%# Uncategorized option %>
diff --git a/app/views/subscriptions/upgrade.html.erb b/app/views/subscriptions/upgrade.html.erb
index 0c600cf99..2fbf5839a 100644
--- a/app/views/subscriptions/upgrade.html.erb
+++ b/app/views/subscriptions/upgrade.html.erb
@@ -1,17 +1,17 @@
 <div class="flex flex-col h-full justify-between bg-surface">
   <nav class="p-4">
-    <h1 class="sr-only">Upgrade</h1>
+    <h1 class="sr-only"><%= t(".page_title") %></h1>
 
     <div class="flex justify-end gap-2">
       <%= render DS::Link.new(
-        text: "Account Settings",
+        text: t(".account_settings"),
         icon: "settings",
         variant: "ghost",
         href: settings_profile_path,
       ) %>
 
       <%= render DS::Button.new(
-        text: "Sign out",
+        text: t(".sign_out"),
         icon: "log-out",
         icon_position: :right,
         variant: "ghost",
@@ -48,6 +48,7 @@
         <%= render DS::Button.new(
           text: t("subscriptions.upgrade.contribute_and_support_sure"),
           variant: "primary",
+          type: :submit,
           full_width: true
         ) %>
 
diff --git a/app/views/tag/deletions/new.html.erb b/app/views/tag/deletions/new.html.erb
index 4370d3da8..dcadf6e1d 100644
--- a/app/views/tag/deletions/new.html.erb
+++ b/app/views/tag/deletions/new.html.erb
@@ -16,13 +16,15 @@
 
       <%= render DS::Button.new(
         variant: "destructive",
+        type: :submit,
         text: t(".delete_and_leave_uncategorized", tag_name: @tag.name),
         full_width: true,
         data: { deletion_target: "destructiveSubmitButton" }
       ) %>
 
       <%= render DS::Button.new(
-        text: "Delete and reassign",
+        text: t(".delete_and_reassign"),
+        type: :submit,
         data: { deletion_target: "safeSubmitButton" },
         hidden: true,
         full_width: true
diff --git a/app/views/tags/index.html.erb b/app/views/tags/index.html.erb
index ade2df392..e2067dba7 100644
--- a/app/views/tags/index.html.erb
+++ b/app/views/tags/index.html.erb
@@ -3,7 +3,7 @@
   <%= render DS::Menu.new do |menu| %>
     <% menu.with_item(
           variant: "button",
-          text: "Delete all",
+          text: t(".delete_all"),
           href: destroy_all_tags_path,
           method: :delete,
           icon: "trash-2",
diff --git a/app/views/trades/_form.html.erb b/app/views/trades/_form.html.erb
index 600dde3b9..9bcf2d392 100644
--- a/app/views/trades/_form.html.erb
+++ b/app/views/trades/_form.html.erb
@@ -25,7 +25,7 @@
         }} %>
 
       <% if %w[buy sell].include?(type) %>
-        <% if Security.provider.present? %>
+        <% if Security.providers.any? %>
           <div class="form-field combobox">
             <%= form.combobox :ticker,
                             securities_path(country_code: Current.family.country),
@@ -51,7 +51,7 @@
       <%= form.date_field :date, label: true, value: model.date || Date.current, required: true %>
 
       <% unless %w[buy sell].include?(type) %>
-        <%= form.money_field :amount, label: t(".amount"), value: model.amount, required: true %>
+        <%= form.money_field :amount, label: t(".amount"), value: model.amount, required: true, default_currency: account&.currency %>
       <% end %>
 
       <% if %w[deposit withdrawal].include?(type) %>
@@ -60,8 +60,8 @@
 
       <% if %w[buy sell].include?(type) %>
         <%= form.number_field :qty, label: t(".qty"), placeholder: "10", min: 0.000000000000000001, step: "any", required: true %>
-        <%= form.money_field :price, label: t(".price"), step: "any", precision: 10, required: true %>
-        <%= form.money_field :fee, label: t(".fee"), step: "any", min: 0 %>
+        <%= form.money_field :price, label: t(".price"), step: "any", precision: 10, required: true, default_currency: account&.currency %>
+        <%= form.money_field :fee, label: t(".fee"), step: "any", min: 0, default_currency: account&.currency %>
       <% end %>
     </div>
 
diff --git a/app/views/trades/_header.html.erb b/app/views/trades/_header.html.erb
index 94e8a2c5a..eea444354 100644
--- a/app/views/trades/_header.html.erb
+++ b/app/views/trades/_header.html.erb
@@ -31,7 +31,7 @@
     </div>
 
     <span class="text-sm text-secondary">
-      <%= I18n.l(entry.date, format: :long) %>
+      <%= entry.date ? I18n.l(entry.date, format: :long) : "—" %>
     </span>
   <% end %>
 
diff --git a/app/views/trades/_trade.html.erb b/app/views/trades/_trade.html.erb
index b14a7527c..162a7da09 100644
--- a/app/views/trades/_trade.html.erb
+++ b/app/views/trades/_trade.html.erb
@@ -1,6 +1,7 @@
 <%# locals: (entry:, balance_trend: nil, **) %>
 
 <% trade = entry.entryable %>
+<% trade_logo_url = trade.security&.display_logo_url %>
 
 <%= turbo_frame_tag dom_id(entry) do %>
   <%= turbo_frame_tag dom_id(trade) do %>
@@ -10,20 +11,27 @@
                         class: "checkbox checkbox--light hidden lg:block",
                         data: {
                           id: entry.id,
+                          entry_type: entry.entryable_type,
                           "bulk-select-target": "row",
                           action: "bulk-select#toggleRowSelection",
                           checkbox_toggle_target: "selectionEntry"
                         } %>
 
         <div class="max-w-full">
-          <%= tag.div class: ["flex items-center gap-2 min-w-0"] do %>
+          <%= tag.div class: ["flex items-center gap-3 lg:gap-4 min-w-0"] do %>
             <div class="hidden lg:flex">
-              <%= render DS::FilledIcon.new(
-                variant: :text,
-                text: entry.name,
-                size: "sm",
-                rounded: true
-              ) %>
+              <% if trade_logo_url.present? %>
+                <%= image_tag Setting.transform_brand_fetch_url(trade_logo_url),
+                    class: "w-9 h-9 rounded-full border border-secondary",
+                    loading: "lazy" %>
+              <% else %>
+                <%= render DS::FilledIcon.new(
+                  variant: :text,
+                  text: trade.security&.ticker || entry.name,
+                  size: "lg",
+                  rounded: true
+                ) %>
+              <% end %>
             </div>
 
             <div class="flex lg:hidden">
@@ -56,7 +64,7 @@
         <% end %>
         <%= content_tag :p,
                     format_money(-entry.amount_money),
-                    class: ["text-green-600": entry.amount.negative?] %>
+                    class: ["privacy-sensitive", "text-green-600": entry.amount.negative?] %>
       </div>
     </div>
   <% end %>
diff --git a/app/views/trades/show.html.erb b/app/views/trades/show.html.erb
index 7e1c222c7..05519c726 100644
--- a/app/views/trades/show.html.erb
+++ b/app/views/trades/show.html.erb
@@ -1,13 +1,23 @@
 <%= render DS::Dialog.new(frame: "drawer", responsive: true) do |dialog| %>
   <% dialog.with_header(custom_header: true) do %>
-    <div class="flex items-start justify-between gap-4">
+    <div class="relative">
+      <div class="absolute right-0 top-0 z-10">
+        <%= dialog.close_button %>
+      </div>
       <%= render "trades/header", entry: @entry %>
-      <%= dialog.close_button %>
     </div>
   <% end %>
   <% trade = @entry.trade %>
   <% dialog.with_body do %>
     <%= render "entries/protection_indicator", entry: @entry, unlock_path: unlock_trade_path(trade) %>
+    <% if trade.security&.provider_status == :provider_unavailable %>
+      <div class="px-3 py-2">
+        <%= render DS::Alert.new(
+          message: t(".provider_disabled_warning", provider: trade.security.price_provider&.humanize || "Unknown"),
+          variant: :warning
+        ) %>
+      </div>
+    <% end %>
     <% dialog.with_section(title: t(".details"), open: true) do %>
       <div class="pb-4">
         <%= styled_form_with model: @entry,
diff --git a/app/views/transactions/_attachments.html.erb b/app/views/transactions/_attachments.html.erb
index dba4b464f..b771ca448 100644
--- a/app/views/transactions/_attachments.html.erb
+++ b/app/views/transactions/_attachments.html.erb
@@ -51,6 +51,7 @@
                 text: t(".upload"),
                 variant: :primary,
                 size: :sm,
+                type: :submit,
                 data: { attachment_upload_target: "submitButton" }
               ) %>
         </div>
diff --git a/app/views/transactions/_form.html.erb b/app/views/transactions/_form.html.erb
index 062d87c8b..722adf5ee 100644
--- a/app/views/transactions/_form.html.erb
+++ b/app/views/transactions/_form.html.erb
@@ -1,14 +1,15 @@
 <%# locals: (entry:, categories:) %>
 
-<%= styled_form_with model: entry, url: transactions_path, class: "space-y-4" do |f| %>
+<% account_currencies = Current.family.accounts.map { |a| [a.id, a.currency] }.to_h.to_json %>
+<%= styled_form_with model: entry, url: transactions_path, class: "space-y-4", data: { controller: "transaction-form", transaction_form_exchange_rate_url_value: exchange_rate_path, transaction_form_account_currencies_value: account_currencies } do |f| %>
   <% if entry.errors.any? %>
     <%= render "shared/form_errors", model: entry %>
   <% end %>
 
-  <section>
+  <section data-controller="transaction-type-tabs">
     <%= render "shared/transaction_type_tabs", active_tab: params[:nature] == "inflow" ? "income" : "expense", account_id: params[:account_id] %>
 
-    <%= f.hidden_field :nature, value: params[:nature] || "outflow" %>
+    <%= f.hidden_field :nature, value: params[:nature] || "outflow", data: { "transaction-type-tabs-target": "natureField" } %>
     <%= f.hidden_field :entryable_type, value: "Transaction" %>
   </section>
 
@@ -16,16 +17,69 @@
     <%= f.text_field :name, label: t(".description"), placeholder: t(".description_placeholder"), required: true %>
 
     <% if @entry.account_id %>
-      <%= f.hidden_field :account_id %>
+      <%= f.hidden_field :account_id, data: { transaction_form_target: "account" } %>
     <% else %>
-      <%= f.collection_select :account_id, accessible_accounts.manual.active.alphabetically, :id, :name, { prompt: t(".account_prompt"), label: t(".account"), selected: Current.user.default_account_for_transactions&.id, variant: :logo }, required: true, class: "form-field__input text-ellipsis" %>
+      <%= f.collection_select :account_id, accessible_accounts.manual.active.alphabetically, :id, :name, { prompt: t(".account_prompt"), label: t(".account"), selected: Current.user.default_account_for_transactions&.id, variant: :logo }, required: true, class: "form-field__input text-ellipsis", data: { transaction_form_target: "account", action: "change->transaction-form#checkCurrencyDifference" } %>
     <% end %>
 
-    <%= f.money_field :amount, label: t(".amount"), required: true %>
+    <%= f.money_field :amount, 
+      label: t(".amount"), 
+      required: true,
+      container_class: "money-field-wrapper",
+      amount_data: { transaction_form_target: "amount", action: "input->transaction-form#onAmountChange" },
+      currency_data: { transaction_form_target: "currency", action: "change->transaction-form#onCurrencyChange" } %>
+      
     <%= f.fields_for :entryable do |ef| %>
       <%= ef.collection_select :category_id, categories, :id, :name, { prompt: t(".category_prompt"), label: t(".category"), variant: :badge, searchable: true } %>
     <% end %>
-    <%= f.date_field :date, label: t(".date"), required: true, min: Entry.min_supported_date, max: Date.current, value: Date.current %>
+    
+    <%= f.date_field :date, 
+      label: t(".date"), 
+      required: true, 
+      min: Entry.min_supported_date, 
+      max: Date.current, 
+      value: f.object.date || Date.current,
+      data: { transaction_form_target: "date", action: "change->transaction-form#checkCurrencyDifference" } %>
+
+    <% convert_input = capture do %>
+      <%= f.fields_for :entryable do |ef| %>
+        <%= ef.number_field :exchange_rate,
+          label: t("shared.exchange_rate_tabs.exchange_rate"),
+          min: "0.00000000000001",
+          step: "0.00000000000001",
+          placeholder: "1.0",
+          class: "form-field__input",
+          data: {
+            transaction_form_target: "exchangeRateField",
+            action: "input->transaction-form#onConvertExchangeRateChange"
+          } %>
+      <% end %>
+    <% end %>
+
+    <% destination_input = capture do %>
+      <%= number_field_tag :destination_amount,
+        nil,
+        id: "transaction_form_destination_amount",
+        class: "form-field__input",
+        min: "0",
+        step: "0.00000001",
+        placeholder: "92",
+        data: {
+          transaction_form_target: "destinationAmount",
+          action: "input->transaction-form#onCalculateRateDestinationAmountChange"
+        } %>
+    <% end %>
+
+    <%= render "shared/exchange_rate_tabs",
+      controller_id: "transaction-form",
+      controller_key: "transaction_form",
+      help_text: t("shared.exchange_rate_tabs.exchange_rate_help"),
+      convert_tab_label: t("shared.exchange_rate_tabs.convert_tab"),
+      calculate_rate_tab_label: t("shared.exchange_rate_tabs.calculate_rate_tab"),
+      destination_amount_label: t("shared.exchange_rate_tabs.destination_amount"),
+      exchange_rate_label: t("shared.exchange_rate_tabs.exchange_rate"),
+      convert_input: convert_input,
+      destination_input: destination_input %>
   </section>
 
   <%= render DS::Disclosure.new(title: t(".details")) do %>
@@ -34,7 +88,10 @@
                 Current.family.available_merchants_for(Current.user).alphabetically,
                 :id, :name,
                 { include_blank: t(".none"),
-                  label: t(".merchant_label") } %>
+                  label: t(".merchant_label"),
+                  variant: :logo,
+                  searchable: true,
+                  menu_placement: :auto } %>
       <%= ef.select :tag_ids,
                     Current.family.tags.alphabetically.pluck(:name, :id),
                     {
diff --git a/app/views/transactions/_header.html.erb b/app/views/transactions/_header.html.erb
index d80c13bed..26fcacd94 100644
--- a/app/views/transactions/_header.html.erb
+++ b/app/views/transactions/_header.html.erb
@@ -19,13 +19,16 @@
     </h3>
     <div class="flex items-center gap-2">
       <span class="text-sm text-secondary">
-        <%= I18n.l(entry.date, format: :long) %>
+        <%= entry.date ? I18n.l(entry.date, format: :long) : "—" %>
       </span>
       <% if entry.transaction.pending? %>
-        <span class="inline-flex items-center gap-1 text-xs font-medium rounded-full px-1.5 py-0.5 border border-secondary text-secondary" title="<%= t("transactions.transaction.pending_tooltip") %>">
-          <%= icon "clock", size: "sm", color: "current" %>
-          <%= t("transactions.transaction.pending") %>
-        </span>
+        <%= render DS::Pill.new(
+          label: t("transactions.transaction.pending"),
+          tone: :neutral,
+          marker: false,
+          icon: "clock",
+          title: t("transactions.transaction.pending_tooltip")
+        ) %>
       <% end %>
     </div>
   </div>
diff --git a/app/views/transactions/_list.html.erb b/app/views/transactions/_list.html.erb
index 8506bdf85..5d57daa19 100644
--- a/app/views/transactions/_list.html.erb
+++ b/app/views/transactions/_list.html.erb
@@ -3,6 +3,8 @@
   data-controller="bulk-select checkbox-toggle drag-and-drop-import"
   data-bulk-select-singular-label-value="<%= t(".transaction") %>"
   data-bulk-select-plural-label-value="<%= t(".transactions") %>"
+  data-bulk-select-selected-label-value="<%= t("transactions.selection_bar.selected") %>"
+  data-bulk-select-edit-label-value="<%= t("transactions.selection_bar.edit") %>"
   class="flex flex-col bg-container rounded-xl shadow-border-xs px-3 py-4 lg:p-4 relative group">
 
   <%= form_with url: imports_path, method: :post, class: "hidden", data: { drag_and_drop_import_target: "form", turbo: false } do |f| %>
@@ -29,7 +31,7 @@
                   action: "bulk-select#togglePageSelection",
                   checkbox_toggle_target: "selectionEntry"
                 } %>
-            <p>transaction</p>
+            <p><%= t(".transaction") %></p>
           </div>
 
           <p class="col-span-2 md:block hidden"><%= t("transactions.form.category_label") %></p>
diff --git a/app/views/transactions/_notes.html.erb b/app/views/transactions/_notes.html.erb
new file mode 100644
index 000000000..7e32b9156
--- /dev/null
+++ b/app/views/transactions/_notes.html.erb
@@ -0,0 +1,14 @@
+<%# locals: (entry:, can_annotate:) %>
+<%= turbo_frame_tag dom_id(entry, :notes) do %>
+  <%= styled_form_with model: entry,
+        url: transaction_path(entry),
+        data: { controller: "auto-submit-form" } do |f| %>
+    <%= hidden_field_tag :grouped, "true" if params[:grouped] == "true" %>
+    <%= f.text_area :notes,
+            label: t("transactions.show.note_label"),
+            placeholder: t("transactions.show.note_placeholder"),
+            rows: 5,
+            disabled: !can_annotate,
+            "data-auto-submit-form-target": "auto" %>
+  <% end %>
+<% end %>
diff --git a/app/views/transactions/_split_parent_row.html.erb b/app/views/transactions/_split_parent_row.html.erb
index 70b44ebd2..f2e68eca6 100644
--- a/app/views/transactions/_split_parent_row.html.erb
+++ b/app/views/transactions/_split_parent_row.html.erb
@@ -36,10 +36,12 @@
               </div>
 
               <div class="flex items-center gap-1 flex-shrink-0">
-                <span class="inline-flex items-center gap-1 text-xs font-medium rounded-full px-1.5 py-0.5 border border-accent bg-accent/10 text-accent">
-                  <%= icon "split", size: "sm", color: "current" %>
-                  <%= t("transactions.split_parent_row.split_label") %>
-                </span>
+                <%= render DS::Pill.new(
+                  label: t("transactions.split_parent_row.split_label"),
+                  tone: :neutral,
+                  marker: false,
+                  icon: "split"
+                ) %>
               </div>
             </div>
 
@@ -64,6 +66,6 @@
   </div>
 
   <div class="shrink-0 col-span-4 lg:col-span-2 ml-auto flex items-center justify-end gap-2">
-    <%= content_tag :p, format_money(-entry.amount_money) %>
+    <%= content_tag :p, format_money(-entry.amount_money), class: "privacy-sensitive" %>
   </div>
 </div>
diff --git a/app/views/transactions/_transaction.html.erb b/app/views/transactions/_transaction.html.erb
index 071d2d3e3..8bccd8b4e 100644
--- a/app/views/transactions/_transaction.html.erb
+++ b/app/views/transactions/_transaction.html.erb
@@ -1,6 +1,7 @@
 <%# locals: (entry:, balance_trend: nil, view_ctx: "global", in_split_group: false) %>
 
 <% transaction = entry.entryable %>
+<% transaction_security_logo_url = transaction.activity_security&.display_logo_url %>
 
 <%= turbo_frame_tag dom_id(entry) do %>
   <%= turbo_frame_tag dom_id(transaction) do %>
@@ -12,24 +13,40 @@
             class: "checkbox checkbox--light hidden lg:block",
             data: {
               id: entry.id,
+              entry_type: entry.entryable_type,
               "bulk-select-target": "row",
               action: "bulk-select#toggleRowSelection",
               checkbox_toggle_target: "selectionEntry"
             } %>
 
         <div class="flex md:hidden items-center gap-1 col-span-2 relative shrink-0">
-          <%= render "transactions/transaction_category", transaction: transaction, variant: "mobile" %>
-          <% if transaction.merchant&.logo_url.present? %>
+          <%= render "transactions/transaction_category", transaction: transaction, variant: "mobile", in_split_group: in_split_group %>
+          <% if transaction_security_logo_url.present? %>
+            <%= image_tag Setting.transform_brand_fetch_url(transaction_security_logo_url),
+                class: "w-5 h-5 rounded-full absolute -bottom-1 -right-1 border border-secondary pointer-events-none",
+                loading: "lazy" %>
+          <% elsif transaction.merchant&.logo_url.present? %>
             <%= image_tag Setting.transform_brand_fetch_url(transaction.merchant.logo_url),
                 class: "w-5 h-5 rounded-full absolute -bottom-1 -right-1 border border-secondary pointer-events-none",
                 loading: "lazy" %>
           <% end %>
         </div>
 
-        <div class="max-w-full <%= 'opacity-50 text-secondary' if entry.excluded %>">
+        <div class="max-w-full min-w-0 <%= "opacity-50 text-secondary" if entry.excluded %>">
           <%= content_tag :div, class: ["flex items-center gap-3 lg:gap-4"] do %>
             <div class="hidden lg:flex">
-              <% if transaction.merchant&.logo_url.present? %>
+              <% if transaction.transfer? %>
+                <%= render DS::FilledIcon.new(
+                  icon: "arrow-right-left",
+                  hex_color: Category::TRANSFER_COLOR,
+                  size: "lg",
+                  rounded: true
+                ) %>
+              <% elsif transaction_security_logo_url.present? %>
+                <%= image_tag Setting.transform_brand_fetch_url(transaction_security_logo_url),
+                    class: "w-9 h-9 rounded-full border border-secondary",
+                    loading: "lazy" %>
+              <% elsif transaction.merchant&.logo_url.present? %>
                 <%= image_tag Setting.transform_brand_fetch_url(transaction.merchant.logo_url),
                     class: "w-9 h-9 rounded-full border border-secondary",
                     loading: "lazy" %>
@@ -62,7 +79,7 @@
                     <% else %>
                       <%= link_to(
                             entry.name,
-                            entry_path(entry),
+                            in_split_group ? entry_path(entry, grouped: true) : entry_path(entry),
                             data: {
                               turbo_frame: "drawer",
                               turbo_prefetch: false
@@ -81,33 +98,45 @@
 
                     <%# Pending indicator %>
                     <% if transaction.pending? %>
-                      <span class="inline-flex items-center gap-1 text-xs font-medium rounded-full px-1.5 py-0.5 border border-secondary text-secondary" title="<%= t("transactions.transaction.pending_tooltip") %>">
-                        <%= icon "clock", size: "sm", color: "current" %>
-                        <%= t("transactions.transaction.pending") %>
-                      </span>
+                      <%= render DS::Pill.new(
+                        label: t("transactions.transaction.pending"),
+                        tone: :neutral,
+                        marker: false,
+                        icon: "clock",
+                        title: t("transactions.transaction.pending_tooltip")
+                      ) %>
                     <% end %>
 
                     <%# Potential duplicate indicator - different styling for low vs medium confidence %>
                     <% if transaction.has_potential_duplicate? %>
                       <% if transaction.low_confidence_duplicate? %>
-                        <span class="inline-flex items-center gap-1 text-xs font-medium rounded-full px-1.5 py-0.5 border border-secondary bg-surface-inset text-secondary" title="<%= t("transactions.transaction.review_recommended_tooltip") %>">
-                          <%= icon "help-circle", size: "sm", color: "current" %>
-                          <%= t("transactions.transaction.review_recommended") %>
-                        </span>
+                        <%= render DS::Pill.new(
+                          label: t("transactions.transaction.review_recommended"),
+                          tone: :neutral,
+                          marker: false,
+                          icon: "help-circle",
+                          title: t("transactions.transaction.review_recommended_tooltip")
+                        ) %>
                       <% else %>
-                        <span class="inline-flex items-center gap-1 text-xs font-medium rounded-full px-1.5 py-0.5 border border-warning bg-warning/10 text-warning" title="<%= t("transactions.transaction.potential_duplicate_tooltip") %>">
-                          <%= icon "alert-triangle", size: "sm", color: "current" %>
-                          <%= t("transactions.transaction.possible_duplicate") %>
-                        </span>
+                        <%= render DS::Pill.new(
+                          label: t("transactions.transaction.possible_duplicate"),
+                          tone: :warning,
+                          marker: false,
+                          icon: "alert-triangle",
+                          title: t("transactions.transaction.potential_duplicate_tooltip")
+                        ) %>
                       <% end %>
                     <% end %>
 
                     <%# Split indicator %>
                     <% if @split_parent_entry_ids ? @split_parent_entry_ids.include?(entry.id) : entry.split_parent? %>
-                      <span class="inline-flex items-center gap-1 text-xs font-medium rounded-full px-1.5 py-0.5 border border-accent bg-accent/10 text-accent" title="<%= t("transactions.transaction.split_tooltip") %>">
-                        <%= icon "split", size: "sm", color: "current" %>
-                        <%= t("transactions.transaction.split") %>
-                      </span>
+                      <%= render DS::Pill.new(
+                        label: t("transactions.transaction.split"),
+                        tone: :neutral,
+                        marker: false,
+                        icon: "split",
+                        title: t("transactions.transaction.split_tooltip")
+                      ) %>
                     <% end %>
                     <% if entry.split_child? && !in_split_group %>
                       <span class="text-secondary" title="<%= t("transactions.transaction.split_child_tooltip") %>">
@@ -136,10 +165,10 @@
                           data: { turbo_frame: "_top" },
                           class: "hover:underline" %>
                     </span>
-                    <div class="flex items-center gap-1 truncate">
+                    <div class="flex min-w-0 items-center gap-1">
                       <%= render "categories/category_name_mobile", transaction: transaction %>
                       <% if transaction.merchant&.present? %>
-                        <span class="lg:hidden truncate">• <%= transaction.merchant.name %></span>
+                        <span class="lg:hidden min-w-0 truncate">• <%= transaction.merchant.name %></span>
                       <% end %>
                     </div>
                   <% end %>
@@ -150,16 +179,16 @@
         </div>
       </div>
 
-      <div class="hidden md:flex items-center gap-1 col-span-2">
+      <div class="hidden md:flex min-w-0 items-center gap-1 col-span-2">
         <% if entry.account.investment? && !transaction.transfer? %>
           <%# For investment accounts, show activity label instead of category %>
           <%= render "investment_activity/quick_edit_badge", entry: entry, entryable: transaction %>
         <% else %>
-          <%= render "transactions/transaction_category", transaction: transaction, variant: "desktop" %>
+          <%= render "transactions/transaction_category", transaction: transaction, variant: "desktop", in_split_group: in_split_group %>
         <% end %>
       </div>
 
-      <div class="shrink-0 col-span-4 lg:col-span-2 ml-auto flex items-center justify-end gap-2 <%= 'opacity-50' if entry.excluded %>">
+      <div class="shrink-0 col-span-4 lg:col-span-2 ml-auto flex items-center justify-end gap-2 <%= "opacity-50" if entry.excluded %>">
         <%# Protection indicator - shows on hover when entry is protected from sync %>
         <% if entry.protected_from_sync? && !entry.excluded? %>
           <%= link_to entry_path(entry),
diff --git a/app/views/transactions/_transaction_category.html.erb b/app/views/transactions/_transaction_category.html.erb
index 3b5c8d1b9..0d7301633 100644
--- a/app/views/transactions/_transaction_category.html.erb
+++ b/app/views/transactions/_transaction_category.html.erb
@@ -1,8 +1,8 @@
-<%# locals: (transaction:, variant:) %>
+<%# locals: (transaction:, variant:, in_split_group: false) %>
 
-<div id="<%= dom_id(transaction, "category_menu_#{variant}") %>">
+<div id="<%= dom_id(transaction, "category_menu_#{variant}") %>" class="min-w-0 overflow-hidden">
   <% if transaction.transfer&.categorizable? || transaction.transfer.nil? %>
-    <%= render "categories/menu", transaction: transaction %>
+    <%= render "categories/menu", transaction: transaction, in_split_group: in_split_group %>
   <% else %>
     <div class="hidden lg:flex">
       <%= render "categories/badge", category: transaction.transfer&.payment? ? payment_category :  transfer_category %>
diff --git a/app/views/transactions/_transfer_match.html.erb b/app/views/transactions/_transfer_match.html.erb
index 53d05a4f4..f2d39531d 100644
--- a/app/views/transactions/_transfer_match.html.erb
+++ b/app/views/transactions/_transfer_match.html.erb
@@ -2,21 +2,21 @@
 
 <div id="<%= dom_id(transaction, "transfer_match") %>" class="flex items-center gap-1">
   <% if transaction.transfer.confirmed? %>
-    <span title="<%= transaction.transfer.payment? ? "Payment" : "Transfer" %> is confirmed">
+    <span title="<%= transaction.transfer.payment? ? t("transactions.transfer_match.payment_confirmed") : t("transactions.transfer_match.transfer_confirmed") %>">
       <%= icon "link-2", size: "sm", class: "text-secondary" %>
     </span>
   <% elsif transaction.transfer.pending? %>
     <span class="hidden lg:inline-flex items-center rounded-full bg-surface-inset px-2 py-0.5 text-xs font-medium text-secondary">
-      Auto-matched
+      <%= t("transactions.transfer_match.auto_matched") %>
     </span>
     <span class="inline-flex lg:hidden items-center rounded-full bg-surface-inset px-2 py-0.5 text-xs font-medium text-secondary">
-      A/M
+      <%= t("transactions.transfer_match.auto_matched_short") %>
     </span>
 
     <%= button_to transfer_path(transaction.transfer, transfer: { status: "confirmed" }),
                     method: :patch,
                     class: "text-secondary flex items-center justify-center cursor-pointer",
-                    title: "Confirm match" do %>
+                    title: t("transactions.transfer_match.confirm_match") do %>
       <%= icon "check", size: "sm", class: "text-secondary hover:text-primary" %>
     <% end %>
 
@@ -24,7 +24,7 @@
                     method: :patch,
                     data: { turbo: false },
                     class: "text-secondary hover:text-primary flex items-center justify-center cursor-pointer",
-                    title: "Reject match" do %>
+                    title: t("transactions.transfer_match.reject_match") do %>
       <%= icon "x", size: "sm", class: "text-subdued hover:text-primary" %>
     <% end %>
   <% end %>
diff --git a/app/views/transactions/bulk_updates/new.html.erb b/app/views/transactions/bulk_updates/new.html.erb
index 0aee4d890..47b38bf3f 100644
--- a/app/views/transactions/bulk_updates/new.html.erb
+++ b/app/views/transactions/bulk_updates/new.html.erb
@@ -1,26 +1,27 @@
 <%= render DS::Dialog.new(variant: "drawer", frame: "bulk_transaction_edit_drawer") do |dialog| %>
-  <% dialog.with_header(title: "Edit transactions", data: { bulk_select_target: "bulkEditDrawerHeader" }) %>
+  <% dialog.with_header(title: t(".header_title"), data: { bulk_select_target: "bulkEditDrawerHeader" }) %>
 
   <% dialog.with_body do %>
     <%= styled_form_with url: transactions_bulk_update_path, scope: "bulk_update", class: "h-full flex flex-col justify-between gap-4", data: { turbo_frame: "_top" } do |form| %>
       <div class="space-y-4">
-        <%= render DS::Disclosure.new(title: "Overview", open: true) do %>
-          <%= form.date_field :date, label: "Date", max: Date.current %>
+        <%= render DS::Disclosure.new(title: t(".overview"), open: true) do %>
+          <%= form.date_field :date, label: t(".date_label"), max: Date.current %>
         <% end %>
 
-        <%= render DS::Disclosure.new(title: "Transactions", open: true) do %>
+        <%= render DS::Disclosure.new(title: t(".transactions_section"), open: true) do %>
           <div class="space-y-2">
-            <%= form.collection_select :category_id, Current.family.categories.alphabetically, :id, :name, { prompt: "Select a category", label: "Category", class: "text-subdued" } %>
-            <%= form.collection_select :merchant_id, Current.family.available_merchants_for(Current.user).alphabetically, :id, :name, { prompt: "Select a merchant", label: "Merchant", class: "text-subdued" } %>
-            <%= form.select :tag_ids, Current.family.tags.alphabetically.pluck(:name, :id), { include_blank: "None", multiple: true, label: "Tags", include_hidden: false } %>
-            <%= form.text_area :notes, label: "Notes", placeholder: "Enter a note that will be applied to selected transactions", rows: 5 %>
+            <%= form.text_field :name, label: t(".name_label"), placeholder: t(".name_placeholder") %>
+            <%= form.collection_select :category_id, Current.family.categories.alphabetically, :id, :name, { prompt: t(".category_prompt"), label: t(".category_label"), class: "text-subdued" } %>
+            <%= form.collection_select :merchant_id, Current.family.available_merchants_for(Current.user).alphabetically, :id, :name, { prompt: t(".merchant_prompt"), label: t(".merchant_label"), class: "text-subdued" } %>
+            <%= form.select :tag_ids, Current.family.tags.alphabetically.pluck(:name, :id), { include_blank: t(".none"), multiple: true, label: t(".tags_label"), include_hidden: false } %>
+            <%= form.text_area :notes, label: t(".notes_label"), placeholder: t(".notes_placeholder"), rows: 5 %>
           </div>
         <% end %>
       </div>
 
       <div class="flex justify-end gap-2 mt-auto">
-        <%= render DS::Button.new(text: "Cancel", variant: "ghost", data: { action: "click->DS--dialog#close" }) %>
-        <%= render DS::Button.new(text: "Save", data: { bulk_select_scope_param: "bulk_update", action: "bulk-select#submitBulkRequest" }) %>
+        <%= render DS::Button.new(text: t(".cancel"), variant: "ghost", data: { action: "click->DS--dialog#close" }) %>
+        <%= render DS::Button.new(text: t(".save"), type: :submit, data: { bulk_select_scope_param: "bulk_update", action: "bulk-select#submitBulkRequest" }) %>
       </div>
     <% end %>
   <% end %>
diff --git a/app/views/transactions/categorizes/_transaction_list.html.erb b/app/views/transactions/categorizes/_transaction_list.html.erb
index d624a0e3c..c3cd389ea 100644
--- a/app/views/transactions/categorizes/_transaction_list.html.erb
+++ b/app/views/transactions/categorizes/_transaction_list.html.erb
@@ -10,7 +10,7 @@
     </div>
     <%# Rows %>
     <div class="shadow-border-xs rounded-lg overflow-hidden">
-      <div class="max-h-[32rem] overflow-y-auto divide-y divide-primary text-sm">
+      <div class="max-h-[32rem] overflow-y-auto divide-y divide-alpha-black-200 theme-dark:divide-alpha-white-200 text-sm">
         <% entries.each do |entry| %>
           <%= render partial: "transactions/categorizes/entry_row", locals: { entry: entry, categories: categories } %>
         <% end %>
diff --git a/app/views/transactions/categorizes/show.html.erb b/app/views/transactions/categorizes/show.html.erb
index e5cb1f20e..778cc7780 100644
--- a/app/views/transactions/categorizes/show.html.erb
+++ b/app/views/transactions/categorizes/show.html.erb
@@ -75,7 +75,7 @@
                          data-categorize-target="filterInput"
                          data-action="keydown.enter->categorize#confirmFilterEdit keydown.escape->categorize#cancelFilterEdit">
                   <button type="button"
-                          class="flex items-center justify-center w-6 h-6 rounded-md bg-primary text-inverted hover:opacity-80 transition-opacity shrink-0"
+                          class="flex items-center justify-center w-6 h-6 rounded-md button-bg-primary text-inverse hover:opacity-80 transition-opacity shrink-0"
                           data-action="click->categorize#confirmFilterEdit">
                     <%= icon("check", size: "sm") %>
                   </button>
diff --git a/app/views/transactions/convert_to_trade.html.erb b/app/views/transactions/convert_to_trade.html.erb
index 631a5c9ab..b7e04524d 100644
--- a/app/views/transactions/convert_to_trade.html.erb
+++ b/app/views/transactions/convert_to_trade.html.erb
@@ -25,7 +25,7 @@
         </div>
         <div class="text-sm">
           <span class="text-secondary"><%= t(".amount_label") %></span>
-          <span class="font-medium <%= @entry.amount.negative? ? "text-green-600" : "text-primary" %>"><%= format_money(@entry.amount_money.abs) %></span>
+          <span class="font-medium privacy-sensitive <%= @entry.amount.negative? ? "text-green-600" : "text-primary" %>"><%= format_money(@entry.amount_money.abs) %></span>
         </div>
       </div>
 
@@ -33,7 +33,7 @@
       <div class="space-y-4">
         <div class="space-y-1">
           <%= f.label :security_id, t(".security_label"), class: "font-medium text-sm text-primary block" %>
-          <% if Security.provider.present? %>
+          <% if Security.providers.any? %>
             <%# Always use searchable combobox when provider available - prevents picking wrong similar tickers %>
             <div class="form-field combobox" style="--hw-handle-width: 0; --hw-handle-image: none;">
               <%= f.combobox :ticker,
@@ -157,7 +157,7 @@
         </div>
 
         <%# Only show exchange field when no provider - combobox selections already include exchange %>
-        <% unless Security.provider.present? %>
+        <% unless Security.providers.any? %>
           <div class="space-y-1">
             <%= f.label :exchange_operating_mic, t(".exchange_label"), class: "font-medium text-sm text-primary block" %>
             <%= f.text_field :exchange_operating_mic,
diff --git a/app/views/transactions/index.html.erb b/app/views/transactions/index.html.erb
index c56aec7a4..c00cbef9f 100644
--- a/app/views/transactions/index.html.erb
+++ b/app/views/transactions/index.html.erb
@@ -1,16 +1,16 @@
 <div class="space-y-4 pb-6 lg:pb-12 flex flex-col">
   <header class="flex justify-between items-center text-primary font-medium">
-    <h1 class="text-xl">Transactions</h1>
+    <h1 class="text-xl"><%= t(".title") %></h1>
     <div class="flex items-center gap-5">
       <div class="flex items-center gap-2">
         <%= render DS::Menu.new do |menu| %>
-          <% menu.with_item(variant: "link", text: "New rule", href: new_rule_path(resource_type: "transaction"), icon: "plus", data: { turbo_frame: :modal }) %>
-          <% menu.with_item(variant: "link", text: "Edit rules", href: rules_path, icon: "git-branch", data: { turbo_frame: :_top }) %>
-          <% menu.with_item(variant: "link", text: "Edit categories", href: categories_path, icon: "shapes", data: { turbo_frame: :_top }) %>
-          <% menu.with_item(variant: "link", text: "Edit tags", href: tags_path, icon: "tags", data: { turbo_frame: :_top }) %>
-          <% menu.with_item(variant: "link", text: "Edit merchants", href: family_merchants_path, icon: "store", data: { turbo_frame: :_top }) %>
-          <% menu.with_item(variant: "link", text: "Edit imports", href: imports_path, icon: "hard-drive-upload", data: { turbo_frame: :_top }) %>
-          <% menu.with_item(variant: "link", text: "Import", href: new_import_path, icon: "download", data: { turbo_frame: "modal", class_name: "md:!hidden" }) %>
+          <% menu.with_item(variant: "link", text: t(".new_rule"), href: new_rule_path(resource_type: "transaction"), icon: "plus", data: { turbo_frame: :modal }) %>
+          <% menu.with_item(variant: "link", text: t(".edit_rules"), href: rules_path, icon: "git-branch", data: { turbo_frame: :_top }) %>
+          <% menu.with_item(variant: "link", text: t(".edit_categories"), href: categories_path, icon: "shapes", data: { turbo_frame: :_top }) %>
+          <% menu.with_item(variant: "link", text: t(".edit_tags"), href: tags_path, icon: "tags", data: { turbo_frame: :_top }) %>
+          <% menu.with_item(variant: "link", text: t(".edit_merchants"), href: family_merchants_path, icon: "store", data: { turbo_frame: :_top }) %>
+          <% menu.with_item(variant: "link", text: t(".edit_imports"), href: imports_path, icon: "hard-drive-upload", data: { turbo_frame: :_top }) %>
+          <% menu.with_item(variant: "link", text: t(".import"), href: new_import_path, icon: "download", data: { turbo_frame: "modal", class_name: "md:!hidden" }) %>
           <% if @uncategorized_count > 0 %>
             <% menu.with_item(variant: "link", text: t(".categorize_button", count: @uncategorized_count), href: transactions_categorize_path, icon: "tag", data: { turbo_frame: :_top }) %>
           <% end %>
@@ -27,7 +27,7 @@
         </div>
 
         <%= render DS::Link.new(
-            text: "New transaction",
+            text: t(".new_transaction"),
             icon: "plus",
             variant: "primary",
             href: new_transaction_path,
diff --git a/app/views/transactions/new.html.erb b/app/views/transactions/new.html.erb
index 2e5573ac4..3d612c0a8 100644
--- a/app/views/transactions/new.html.erb
+++ b/app/views/transactions/new.html.erb
@@ -1,5 +1,5 @@
-<%= render DS::Dialog.new(scrollable: false) do |dialog| %>
-  <% dialog.with_header(title: "New transaction") %>
+<%= render DS::Dialog.new(scrollable: false, content_class: "lg:max-h-none lg:overflow-y-auto") do |dialog| %>
+  <% dialog.with_header(title: t(".new_transaction")) %>
   <% dialog.with_body do %>
     <%= render "form", entry: @entry, categories: @categories %>
   <% end %>
diff --git a/app/views/transactions/searches/_form.html.erb b/app/views/transactions/searches/_form.html.erb
index c86d0a539..93fda30b3 100644
--- a/app/views/transactions/searches/_form.html.erb
+++ b/app/views/transactions/searches/_form.html.erb
@@ -10,23 +10,23 @@
       <div class="flex items-center px-3 py-2 gap-2 border border-secondary rounded-lg focus-within:ring-secondary focus-within:border-secondary">
         <%= icon("search") %>
         <%= form.text_field :search,
-                            placeholder: "Search transactions ...",
+                            placeholder: t(".search_placeholder"),
                             value: @q[:search],
                             class: "form-field__input placeholder:text-sm placeholder:text-secondary",
                             "data-auto-submit-form-target": "auto" %>
       </div>
     </div>
 
-    <%= render DS::Menu.new(variant: "button", no_padding: true) do |menu| %>
-      <% menu.with_button(
+    <%= render DS::Popover.new(variant: "button", no_padding: true) do |popover| %>
+      <% popover.with_button(
         id: "transaction-filters-button",
         type: "button",
-        text: "Filter",
+        text: t(".filter"),
         variant: "outline",
         icon: "list-filter"
       ) %>
 
-      <% menu.with_custom_content do %>
+      <% popover.with_custom_content do %>
         <%= render "transactions/searches/menu", form: form %>
       <% end %>
     <% end %>
diff --git a/app/views/transactions/searches/_menu.html.erb b/app/views/transactions/searches/_menu.html.erb
index 0f2e9b09a..c424b20ed 100644
--- a/app/views/transactions/searches/_menu.html.erb
+++ b/app/views/transactions/searches/_menu.html.erb
@@ -37,8 +37,8 @@
         </div>
 
         <div>
-          <%= render DS::Button.new(text: t(".cancel"), type: "button", variant: "ghost", data: { action: "DS--menu#close" }) %>
-          <%= render DS::Button.new(text: t(".apply")) %>
+          <%= render DS::Button.new(text: t(".cancel"), type: "button", variant: "ghost", data: { action: "DS--popover#close" }) %>
+          <%= render DS::Button.new(text: t(".apply"), type: :submit) %>
         </div>
       </div>
     </div>
diff --git a/app/views/transactions/searches/filters/_date_filter.html.erb b/app/views/transactions/searches/filters/_date_filter.html.erb
index 63449f9ba..32ce60452 100644
--- a/app/views/transactions/searches/filters/_date_filter.html.erb
+++ b/app/views/transactions/searches/filters/_date_filter.html.erb
@@ -1,11 +1,11 @@
 <%# locals: (form:) %>
 <div class="p-3">
   <%= form.date_field :start_date,
-                      placeholder: "Start date",
+                      placeholder: t(".start_date"),
                       value: @q[:start_date],
                       class: "block w-full border border-secondary rounded-md bg-container py-2 pl-3 pr-3  focus:ring-gray-500 sm:text-sm" %>
   <%= form.date_field :end_date,
-                      placeholder: "End date",
+                      placeholder: t(".end_date"),
                       value: @q[:end_date],
                       class: "block w-full border border-secondary rounded-md bg-container py-2 pl-3 pr-3  focus:ring-gray-500 sm:text-sm mt-2" %>
 </div>
diff --git a/app/views/transactions/show.html.erb b/app/views/transactions/show.html.erb
index 1893b3364..342670518 100644
--- a/app/views/transactions/show.html.erb
+++ b/app/views/transactions/show.html.erb
@@ -22,22 +22,26 @@
                     <p class="text-sm font-medium text-primary"><%= potential_match.name %></p>
                     <p class="text-xs text-secondary"><%= potential_match.date.strftime("%b %d, %Y") %> • <%= potential_match.account.name %></p>
                   </div>
-                  <p class="text-sm font-medium <%= potential_match.amount.negative? ? "text-green-600" : "text-primary" %>">
+                  <p class="text-sm font-medium privacy-sensitive <%= potential_match.amount.negative? ? "text-green-600" : "text-primary" %>">
                     <%= format_money(-potential_match.amount_money) %>
                   </p>
                 </div>
               </div>
               <div class="flex items-center gap-2 mt-3">
-                <%= button_to t("transactions.show.merge_duplicate"),
-                    merge_duplicate_transaction_path(@entry.transaction),
-                    method: :post,
-                    class: "btn btn--primary btn--sm",
-                    data: { turbo_frame: "_top" } %>
-                <%= button_to t("transactions.show.keep_both"),
-                    dismiss_duplicate_transaction_path(@entry.transaction),
-                    method: :post,
-                    class: "btn btn--outline btn--sm",
-                    data: { turbo_frame: "_top" } %>
+                <%= render DS::Button.new(
+                  text: t("transactions.show.merge_duplicate"),
+                  href: merge_duplicate_transaction_path(@entry.transaction),
+                  variant: :primary,
+                  size: :sm,
+                  data: { turbo_method: :post, turbo_frame: "_top" }
+                ) %>
+                <%= render DS::Button.new(
+                  text: t("transactions.show.keep_both"),
+                  href: dismiss_duplicate_transaction_path(@entry.transaction),
+                  variant: :outline,
+                  size: :sm,
+                  data: { turbo_method: :post, turbo_frame: "_top" }
+                ) %>
               </div>
             </div>
           </div>
@@ -54,6 +58,7 @@
               url: transaction_path(@entry),
               class: "space-y-2",
               data: { controller: "auto-submit-form" } do |f| %>
+          <%= hidden_field_tag :grouped, "true" if params[:grouped] == "true" %>
           <%= f.text_field :name,
                 label: t(".name_label"),
                 disabled: @entry.split_child? || edit_locked,
@@ -95,6 +100,7 @@
             url: transaction_path(@entry),
             class: "space-y-2",
             data: { controller: "auto-submit-form" } do |f| %>
+        <%= hidden_field_tag :grouped, "true" if params[:grouped] == "true" %>
         <% unless @entry.transaction.transfer? %>
           <%= f.select :account,
               options_for_select(
@@ -109,7 +115,7 @@
                   :id, :name,
                   { include_blank: t(".none"),
                     label: t(".merchant_label"),
-                    class: "text-subdued", variant: :logo, searchable: true, disabled: @entry.split_child? || !can_annotate_entry? },
+                    variant: :logo, searchable: true, menu_placement: :auto, disabled: @entry.split_child? || !can_annotate_entry? },
                   "data-auto-submit-form-target": "auto" %>
             <%= ef.select :tag_ids,
                   Current.family.tags.alphabetically.pluck(:name, :id),
@@ -117,18 +123,13 @@
                     include_blank: t(".none"),
                     multiple: true,
                     label:    t(".tags_label"),
-                    disabled: @entry.split_child? || !can_annotate_entry?
+                    disabled: !can_annotate_entry?
                   },
                   { "data-controller": "multi-select", "data-auto-submit-form-target": "auto" } %>
           <% end %>
         <% end %>
-        <%= f.text_area :notes,
-                label: t(".note_label"),
-                placeholder: t(".note_placeholder"),
-                rows: 5,
-                disabled: @entry.split_child? || !can_annotate_entry?,
-                "data-auto-submit-form-target": "auto" %>
       <% end %>
+      <%= render "transactions/notes", entry: @entry, can_annotate: can_annotate_entry? %>
     <% end %>
 
     <% dialog.with_section(title: t(".attachments")) do %>
@@ -136,7 +137,7 @@
     <% end %>
 
     <% if (details = build_transaction_extra_details(@entry)) %>
-      <% dialog.with_section(title: "Additional details", open: false) do %>
+      <% dialog.with_section(title: t(".additional_details"), open: false) do %>
         <div class="px-3 py-2 space-y-3">
           <% if details[:kind] == :simplefin %>
             <% sf = details[:simplefin] %>
@@ -144,19 +145,19 @@
               <dl class="space-y-2">
                 <% if sf[:payee].present? %>
                   <div class="flex items-center justify-between gap-2">
-                    <dt class="text-secondary text-sm">Payee</dt>
+                    <dt class="text-secondary text-sm"><%= t(".payee") %></dt>
                     <dd class="text-sm text-primary"><%= sf[:payee] %></dd>
                   </div>
                 <% end %>
                 <% if sf[:description].present? %>
                   <div class="flex items-center justify-between gap-2">
-                    <dt class="text-secondary text-sm">Description</dt>
+                    <dt class="text-secondary text-sm"><%= t(".description") %></dt>
                     <dd class="text-sm text-primary"><%= sf[:description] %></dd>
                   </div>
                 <% end %>
                 <% if sf[:memo].present? %>
                   <div class="flex items-center justify-between gap-2">
-                    <dt class="text-secondary text-sm">Memo</dt>
+                    <dt class="text-secondary text-sm"><%= t(".memo") %></dt>
                     <dd class="text-sm text-primary"><%= sf[:memo] %></dd>
                   </div>
                 <% end %>
@@ -164,7 +165,7 @@
             <% end %>
             <% if details[:provider_extras].present? %>
               <div class="pt-2">
-                <h4 class="text-sm text-secondary mb-1">Provider extras</h4>
+                <h4 class="text-sm text-secondary mb-1"><%= t(".provider_extras") %></h4>
                 <dl class="space-y-2">
                   <% details[:provider_extras].each do |ex| %>
                     <div class="flex items-center justify-between gap-2">
@@ -267,12 +268,13 @@
 
     <% if can_edit_entry? %>
       <% dialog.with_section(title: t(".settings")) do %>
-        <% unless @entry.split_parent? || @entry.split_child? %>
+        <% unless @entry.split_parent? %>
           <div class="pb-4">
             <%= styled_form_with model: @entry,
                   url: transaction_path(@entry),
                   class: "p-3",
                   data: { controller: "auto-submit-form" } do |f| %>
+              <%= hidden_field_tag :grouped, "true" if params[:grouped] == "true" %>
               <div class="flex cursor-pointer items-center gap-4 justify-between">
                 <div class="text-sm space-y-1">
                   <h4 class="text-primary"><%= t(".exclude") %></h4>
@@ -289,6 +291,7 @@
                   url: transaction_path(@entry),
                   class: "p-3",
                   data: { controller: "auto-submit-form" } do |f| %>
+              <%= hidden_field_tag :grouped, "true" if params[:grouped] == "true" %>
               <%= f.fields_for :entryable do |ef| %>
                 <div class="flex cursor-pointer items-center gap-4 justify-between">
                   <div class="text-sm space-y-1">
@@ -314,6 +317,7 @@
                   url: transaction_path(@entry),
                   class: "p-3",
                   data: { controller: "auto-submit-form" } do |f| %>
+              <%= hidden_field_tag :grouped, "true" if params[:grouped] == "true" %>
               <%= f.fields_for :entryable do |ef| %>
                 <div class="flex cursor-pointer items-center gap-4 justify-between">
                   <div class="text-sm space-y-1">
@@ -348,11 +352,11 @@
         <% unless @entry.split_child? %>
           <div class="flex items-center justify-between gap-4 p-3">
             <div class="text-sm space-y-1">
-              <h4 class="text-primary">Transfer or Debt Payment?</h4>
-              <p class="text-secondary">Transfers and payments are special types of transactions that indicate money movement between 2 accounts.</p>
+              <h4 class="text-primary"><%= t(".transfer_or_debt_payment") %></h4>
+              <p class="text-secondary"><%= t(".transfer_matcher_description") %></p>
             </div>
             <%= render DS::Link.new(
-              text: "Open matcher",
+              text: t(".open_matcher"),
               icon: "arrow-left-right",
               variant: "outline",
               href: new_transaction_transfer_match_path(@entry),
@@ -379,11 +383,11 @@
           <% if @entry.account.investment? && @entry.entryable.is_a?(Transaction) && !@entry.excluded? %>
             <div class="flex items-center justify-between gap-2 p-3">
               <div class="text-sm space-y-1">
-                <h4 class="text-primary">Convert to Security Trade</h4>
-                <p class="text-secondary">Convert this transaction into a security trade (buy/sell) by providing ticker, shares, and price.</p>
+                <h4 class="text-primary"><%= t(".convert_to_trade_title") %></h4>
+                <p class="text-secondary"><%= t(".convert_to_trade_description") %></p>
               </div>
               <%= render DS::Button.new(
-                text: "Convert",
+                text: t(".convert"),
                 variant: "outline",
                 icon: "arrow-right-left",
                 href: convert_to_trade_transaction_path(@entry.transaction),
diff --git a/app/views/transfer_matches/_matching_fields.html.erb b/app/views/transfer_matches/_matching_fields.html.erb
index 0c5583bd2..46c6e1bd4 100644
--- a/app/views/transfer_matches/_matching_fields.html.erb
+++ b/app/views/transfer_matches/_matching_fields.html.erb
@@ -3,15 +3,15 @@
 <% if candidates.any? %>
   <div data-controller="transfer-match" class="space-y-2">
     <p class="text-sm text-secondary">
-      Select a method for matching your transactions.
+      <%= t(".select_method") %>
     </p>
 
     <%= form.select :method,
               [
-                ["Match existing transaction (recommended)", "existing"],
-                ["Create new transaction", "new"]
+                [t(".match_existing_recommended"), "existing"],
+                [t(".create_new_transaction"), "new"]
               ],
-              { selected: "existing", label: "Matching method" },
+              { selected: "existing", label: t(".matching_method") },
               data: { action: "change->transfer-match#update" } %>
 
     <div data-transfer-match-target="existingSelect">
@@ -19,19 +19,18 @@
                 candidates.map { |entry|
                   [entry_name_detailed(entry), entry.id]
                 },
-                { label: "Matching transaction" } %>
+                { label: t(".matching_transaction") } %>
     </div>
 
     <div data-transfer-match-target="newSelect" class="hidden">
       <%= form.select :target_account_id,
                 accounts.map { |account| [account.name, account.id] },
-                { label: "Target account" } %>
+                { label: t(".target_account") } %>
     </div>
   </div>
 <% else %>
   <p class="text-sm text-secondary">
-    We couldn't find any transactions to match from your other accounts.
-    Please select an account and we will create a new inflow transaction for you.
+    <%= t(".no_matching_transactions") %>
   </p>
 
   <%= form.hidden_field :method, value: "new" %>
@@ -39,6 +38,6 @@
   <div>
     <%= form.select :target_account_id,
                 accounts.map { |account| [account.name, account.id] },
-                { label: "Target account" } %>
+                { label: t(".target_account") } %>
   </div>
 <% end %>
diff --git a/app/views/transfer_matches/new.html.erb b/app/views/transfer_matches/new.html.erb
index 8a84b9821..e85f3dc4e 100644
--- a/app/views/transfer_matches/new.html.erb
+++ b/app/views/transfer_matches/new.html.erb
@@ -1,5 +1,5 @@
 <%= render DS::Dialog.new do |dialog| %>
-  <% dialog.with_header(title: "Match transfer or payment") %>
+  <% dialog.with_header(title: t(".header.title"), subtitle: t(".header.subtitle")) %>
   <% dialog.with_body do %>
     <%= styled_form_with(
           url: transaction_transfer_match_path(@entry),
@@ -9,8 +9,8 @@
         ) do |f| %>
       <section class="space-y-4">
         <div class="space-y-2">
-          <h2 class="text-sm font-medium text-gray-700">
-            <%= @entry.amount.positive? ? "From account: #{@entry.account.name}" : "From account" %>
+          <h2 class="text-sm font-medium text-secondary">
+            <%= @entry.amount.positive? ? t(".from_account_named", name: @entry.account.name) : t(".from_account") %>
           </h2>
 
           <% if @entry.amount.positive? %>
@@ -18,7 +18,7 @@
                   :entry_id,
                   [[entry_name_detailed(@entry), @entry.id]],
                   {
-                    label: "Outflow transaction",
+                    label: t(".outflow_transaction"),
                     selected: @entry.id,
                   },
                   disabled: true
@@ -36,8 +36,8 @@
 
       <section class="space-y-4">
         <div class="space-y-2">
-          <h2 class="text-sm font-medium text-gray-700">
-            <%= @entry.amount.negative? ? "To account: #{@entry.account.name}" : "To account" %>
+          <h2 class="text-sm font-medium text-secondary">
+            <%= @entry.amount.negative? ? t(".to_account_named", name: @entry.account.name) : t(".to_account") %>
           </h2>
 
           <% if @entry.amount.negative? %>
@@ -45,7 +45,7 @@
                   :entry_id,
                   [[entry_name_detailed(@entry), @entry.id]],
                   {
-                    label: "Inflow transaction",
+                    label: t(".inflow_transaction"),
                     selected: @entry.id,
                   },
                   disabled: true
@@ -57,7 +57,7 @@
         </div>
       </section>
 
-      <%= f.submit "Create transfer match" %>
+      <%= f.submit t(".create_transfer_match") %>
     <% end %>
   <% end %>
 <% end %>
diff --git a/app/views/transfers/_form.html.erb b/app/views/transfers/_form.html.erb
index 39684a9cd..a7696692a 100644
--- a/app/views/transfers/_form.html.erb
+++ b/app/views/transfers/_form.html.erb
@@ -1,4 +1,5 @@
-<%= styled_form_with model: transfer, class: "space-y-4", data: { turbo_frame: "_top", controller: "transfer-form" } do |f| %>
+<% account_currencies = Current.family.accounts.map { |a| [a.id, a.currency] }.to_h.to_json %>
+<%= styled_form_with model: transfer, class: "space-y-4", data: { turbo_frame: "_top", controller: "transfer-form", transfer_form_exchange_rate_url_value: exchange_rate_path, transfer_form_account_currencies_value: account_currencies } do |f| %>
   <% if transfer.errors.present? %>
     <div class="text-destructive flex items-center gap-2">
       <%= icon "circle-alert", size: "sm" %>
@@ -27,10 +28,49 @@
   <% end %>
 
   <section class="space-y-2">
-    <%= f.collection_select :from_account_id, @accounts, :id, :name, { prompt: t(".select_account"), label: t(".from"), selected: @from_account_id, variant: :logo }, required: true %>
-    <%= f.collection_select :to_account_id, @accounts, :id, :name, { prompt: t(".select_account"), label: t(".to"), variant: :logo }, required: true %>
-    <%= f.number_field :amount, label: t(".amount"), required: true, min: 0, placeholder: "100", step: 0.00000001 %>
-    <%= f.date_field :date, value: transfer.inflow_transaction&.entry&.date || Date.current, label: t(".date"), required: true, max: Date.current %>
+    <%= f.collection_select :from_account_id, @accounts, :id, :name, { prompt: t(".select_account"), label: t(".from"), selected: @from_account_id, variant: :logo }, { required: true, data: { transfer_form_target: "fromAccount", action: "change->transfer-form#checkCurrencyDifference" } } %>
+    <%= f.collection_select :to_account_id, @accounts, :id, :name, { prompt: t(".select_account"), label: t(".to"), variant: :logo }, { required: true, data: { transfer_form_target: "toAccount", action: "change->transfer-form#checkCurrencyDifference" } } %>
+    
+    <%= f.date_field :date, value: transfer.inflow_transaction&.entry&.date || Date.current, label: t(".date"), required: true, max: Date.current, data: { transfer_form_target: "date", action: "change->transfer-form#checkCurrencyDifference" } %>
+    
+    <%= f.number_field :amount, label: t(".source_amount"), required: true, min: 0, placeholder: "100", step: 0.00000001, data: { transfer_form_target: "amount", action: "input->transfer-form#onSourceAmountChange" } %>
+    
+    <% convert_input = capture do %>
+      <%= f.number_field :exchange_rate,
+        label: t("shared.exchange_rate_tabs.exchange_rate"),
+        min: "0.00000000000001",
+        step: "0.00000000000001",
+        placeholder: "1.0",
+        class: "form-field__input",
+        data: {
+          transfer_form_target: "exchangeRateField",
+          action: "input->transfer-form#onConvertExchangeRateChange"
+        } %>
+    <% end %>
+
+    <% destination_input = capture do %>
+      <%= tag.input type: "number",
+        id: "transfer_form_destination_amount",
+        class: "form-field__input",
+        min: "0",
+        step: "0.00000001",
+        placeholder: "92",
+        data: {
+          transfer_form_target: "destinationAmount",
+          action: "input->transfer-form#onCalculateRateDestinationAmountChange"
+        } %>
+    <% end %>
+
+    <%= render "shared/exchange_rate_tabs",
+      controller_id: "transfer-form",
+      controller_key: "transfer_form",
+      help_text: t("shared.exchange_rate_tabs.exchange_rate_help"),
+      convert_tab_label: t("shared.exchange_rate_tabs.convert_tab"),
+      calculate_rate_tab_label: t("shared.exchange_rate_tabs.calculate_rate_tab"),
+      destination_amount_label: t("shared.exchange_rate_tabs.destination_amount"),
+      exchange_rate_label: t("shared.exchange_rate_tabs.exchange_rate"),
+      convert_input: convert_input,
+      destination_input: destination_input %>
   </section>
 
   <section>
diff --git a/app/views/transfers/show.html.erb b/app/views/transfers/show.html.erb
index 792899bbb..3512fe592 100644
--- a/app/views/transfers/show.html.erb
+++ b/app/views/transfers/show.html.erb
@@ -23,36 +23,36 @@
       <div class="pb-4 px-3 pt-2 text-sm space-y-3 text-primary">
         <div class="space-y-3">
           <dl class="flex items-center gap-2 justify-between">
-            <dt class="text-secondary">From</dt>
+            <dt class="text-secondary"><%= t(".from") %></dt>
             <dd class="flex items-center gap-2 font-medium">
               <%= render "accounts/logo", account: @transfer.from_account, size: "sm" %>
               <%= link_to @transfer.from_account.name, account_path(@transfer.from_account), data: { turbo_frame: "_top" } %>
             </dd>
           </dl>
           <dl class="flex items-center gap-2 justify-between">
-            <dt class="text-secondary">Date</dt>
+            <dt class="text-secondary"><%= t(".date") %></dt>
             <dd class="font-medium"><%= l(@transfer.outflow_transaction.entry.date, format: :long) %></dd>
           </dl>
           <dl class="flex items-center gap-2 justify-between">
-            <dt class="text-secondary">Amount</dt>
+            <dt class="text-secondary"><%= t(".amount") %></dt>
             <dd class="font-medium text-red-500 privacy-sensitive"><%= format_money @transfer.outflow_transaction.entry.amount_money * -1 %></dd>
           </dl>
         </div>
         <%= render "shared/ruler", classes: "my-2" %>
         <div class="space-y-3">
           <dl class="flex items-center gap-2 justify-between">
-            <dt class="text-secondary">To</dt>
+            <dt class="text-secondary"><%= t(".to") %></dt>
             <dd class="flex items-center gap-2 font-medium">
               <%= render "accounts/logo", account: @transfer.to_account, size: "sm" %>
               <%= link_to @transfer.to_account.name, account_path(@transfer.to_account), data: { turbo_frame: "_top" } %>
             </dd>
           </dl>
           <dl class="flex items-center gap-2 justify-between">
-            <dt class="text-secondary">Date</dt>
+            <dt class="text-secondary"><%= t(".date") %></dt>
             <dd class="font-medium"><%= l(@transfer.inflow_transaction.entry.date, format: :long) %></dd>
           </dl>
           <dl class="flex items-center gap-2 justify-between">
-            <dt class="text-secondary">Amount</dt>
+            <dt class="text-secondary"><%= t(".amount") %></dt>
             <dd class="font-medium text-green-500 privacy-sensitive">+<%= format_money @transfer.inflow_transaction.entry.amount_money * -1 %></dd>
           </dl>
         </div>
@@ -62,7 +62,7 @@
       <%= styled_form_with model: @transfer,
               data: { controller: "auto-submit-form" }, class: "space-y-2" do |f| %>
         <% if @transfer.categorizable? %>
-          <%= f.collection_select :category_id, @categories.alphabetically, :id, :name, { label: "Category", include_blank: "Uncategorized", selected: @transfer.outflow_transaction.category&.id }, "data-auto-submit-form-target": "auto" %>
+          <%= f.collection_select :category_id, @categories.alphabetically, :id, :name, { label: t(".category"), include_blank: t(".uncategorized"), selected: @transfer.outflow_transaction.category&.id }, "data-auto-submit-form-target": "auto" %>
         <% end %>
         <%= f.text_area :notes,
                   label: t(".note_label"),
@@ -73,6 +73,22 @@
     <% end %>
     <% dialog.with_section(title: t(".settings")) do %>
       <div class="pb-4">
+        <% if @can_mark_as_recurring_transfer %>
+          <div class="flex items-center justify-between gap-2 p-3">
+            <div class="text-sm space-y-1">
+              <h4 class="text-primary"><%= t(".mark_recurring_title") %></h4>
+              <p class="text-secondary"><%= t(".mark_recurring_subtitle") %></p>
+            </div>
+            <%= render DS::Button.new(
+              text: t(".mark_recurring"),
+              variant: "outline",
+              icon: "repeat",
+              href: mark_as_recurring_transfer_path(@transfer),
+              method: :post,
+              frame: "_top"
+            ) %>
+          </div>
+        <% end %>
         <div class="flex items-center justify-between gap-2 p-3">
           <div class="text-sm space-y-1">
             <h4 class="text-primary"><%= t(".delete_title") %></h4>
diff --git a/app/views/users/_user_menu.html.erb b/app/views/users/_user_menu.html.erb
index ab74808e7..6268defb9 100644
--- a/app/views/users/_user_menu.html.erb
+++ b/app/views/users/_user_menu.html.erb
@@ -3,19 +3,20 @@
 <% intro_mode = local_assigns.fetch(:intro_mode, false) %>
 
 <div data-testid="user-menu">
-  <%= render DS::Menu.new(
-        variant: "avatar",
+  <%# `DS::Popover` (not `DS::Menu`) because the panel includes a
+      decorative profile header alongside the action items — `role="menu"`
+      would restrict AT users to menuitem-only navigation and hide the
+      user-info block. %>
+  <%= render DS::Popover.new(
+        variant: intro_mode ? "icon" : "avatar",
         avatar_url: user.profile_image&.variant(:small)&.url,
         initials: user.initials,
         placement: placement,
-        offset: offset
-      ) do |menu| %>
-    <% if intro_mode %>
-      <% menu.with_button do %>
-        <%= render DS::Button.new(variant: "icon", icon: "settings", data: { DS__menu_target: "button" }) %>
-      <% end %>
-    <% end %>
-    <%= menu.with_header do %>
+        offset: offset,
+        icon: "settings",
+        aria_label: t(".aria_label", default: "Open account menu")
+      ) do |popover| %>
+    <%= popover.with_header do %>
       <div class="px-4 py-3 flex items-center gap-3">
         <div class="w-9 h-9 shrink-0">
           <%= render "settings/user_avatar", avatar_url: user.profile_image&.variant(:small)&.url, initials: user.initials, lazy: true %>
@@ -32,7 +33,7 @@
       <% if self_hosted? %>
         <div class="px-4 py-3 border-t border-tertiary">
           <p class="text-sm">
-            <span class="font-medium text-primary">Version:</span>
+            <span class="font-medium text-primary"><%= t(".version") %>:</span>
             <%= link_to Sure.version.to_release_tag, "https://github.com/we-promise/sure/releases/tag/#{Sure.version.to_release_tag}", target: "_blank", class: "hover:underline" %>
 
             <% if Sure.commit_sha.present? %>
@@ -43,21 +44,27 @@
       <% end %>
     <% end %>
 
-    <% menu.with_item(
-      variant: "link",
-      text: "Settings",
-      icon: "settings",
-      href: intro_mode ? settings_profile_path : accounts_path(return_to: request.fullpath)
-    ) %>
-    <% menu.with_item(variant: "link", text: "Changelog", icon: "box", href: changelog_path) %>
+    <% popover.with_custom_content do %>
+      <%# `roving: false` keeps these items in the normal Tab order. The parent
+          `DS::Popover` has no arrow-key roving handler and is not a `role="menu"`
+          container, so the default `tabindex="-1"` would skip every item. %>
+      <%= render DS::MenuItem.new(
+        variant: "link",
+        roving: false,
+        text: t(".settings"),
+        icon: "settings",
+        href: intro_mode ? settings_profile_path : accounts_path(return_to: request.fullpath)
+      ) %>
+      <%= render DS::MenuItem.new(variant: "link", roving: false, text: t(".changelog"), icon: "box", href: changelog_path) %>
 
-    <% if self_hosted? && !intro_mode %>
-      <% menu.with_item(variant: "link", text: "Feedback", icon: "megaphone", href: feedback_path) %>
+      <% if self_hosted? && !intro_mode %>
+        <%= render DS::MenuItem.new(variant: "link", roving: false, text: t(".feedback"), icon: "megaphone", href: feedback_path) %>
+      <% end %>
+      <%= render DS::MenuItem.new(variant: "link", roving: false, text: t(".contact"), icon: "message-square-more", href: "https://discord.gg/36ZGBsxYEK", target: "_blank", rel: "noopener noreferrer") %>
+
+      <%= render DS::MenuItem.new(variant: "divider") %>
+
+      <%= render DS::MenuItem.new(variant: "button", roving: false, text: t(".log_out"), icon: "log-out", href: session_path(Current.session), method: :delete) %>
     <% end %>
-    <% menu.with_item(variant: "link", text: "Contact", icon: "message-square-more", href: "https://discord.gg/36ZGBsxYEK", target: "_blank", rel: "noopener noreferrer") %>
-
-    <% menu.with_item(variant: "divider") %>
-
-    <% menu.with_item(variant: "button", text: "Log out", icon: "log-out", href: session_path(Current.session), method: :delete) %>
   <% end %>
 </div>
diff --git a/app/views/valuations/_confirmation_contents.html.erb b/app/views/valuations/_confirmation_contents.html.erb
index d8fdf0328..32adf8a49 100644
--- a/app/views/valuations/_confirmation_contents.html.erb
+++ b/app/views/valuations/_confirmation_contents.html.erb
@@ -5,47 +5,47 @@
     <% brokerage_cash = reconciliation_dry_run.new_cash_balance || 0 %>
     <% holdings_value = reconciliation_dry_run.new_balance - brokerage_cash %>
 
-    <p>This will <%= action_verb %> the account value on <span class="font-medium text-primary"><%= entry.date.strftime("%B %d, %Y") %></span> to:</p>
+    <p><%= t(".this_will", action_verb: action_verb) %> <span class="font-medium text-primary"><%= entry.date.strftime("%B %d, %Y") %></span> <%= t(".to_colon") %></p>
 
     <div class="bg-container rounded-lg p-4 space-y-2 border border-primary">
       <div class="flex justify-between">
-        <span>Total account value</span>
+        <span><%= t(".total_account_value") %></span>
         <span class="font-medium text-primary"><%= Money.new(reconciliation_dry_run.new_balance, account.currency).format %></span>
       </div>
       <div class="flex justify-between text-xs">
-        <span>Holdings value</span>
+        <span><%= t(".holdings_value") %></span>
         <span><%= Money.new(holdings_value, account.currency).format %></span>
       </div>
       <div class="flex justify-between text-xs">
-        <span>Brokerage cash</span>
+        <span><%= t(".brokerage_cash") %></span>
         <span class="<%= brokerage_cash.negative? ? "text-red-500" : "text-green-500" %>"><%= Money.new(brokerage_cash, account.currency).format %></span>
       </div>
     </div>
   <% else %>
     <p><%= action_verb.capitalize %>
       <% if account.depository? %>
-        account balance
+        <%= t(".account_balance") %>
       <% elsif account.credit_card? %>
-        credit card balance
+        <%= t(".credit_card_balance") %>
       <% elsif account.loan? %>
-        loan balance
+        <%= t(".loan_balance") %>
       <% elsif account.property? %>
-        property value
+        <%= t(".property_value") %>
       <% elsif account.vehicle? %>
-        vehicle value
+        <%= t(".vehicle_value") %>
       <% elsif account.crypto? %>
-        crypto balance
+        <%= t(".crypto_balance") %>
       <% elsif account.other_asset? %>
-        asset value
+        <%= t(".asset_value") %>
       <% elsif account.other_liability? %>
-        liability balance
+        <%= t(".liability_balance") %>
       <% else %>
-        balance
+        <%= t(".balance") %>
       <% end %>
-      on <span class="font-medium text-primary"><%= entry.date.strftime("%B %d, %Y") %></span> to
+      <%= t(".on") %> <span class="font-medium text-primary"><%= entry.date.strftime("%B %d, %Y") %></span> <%= t(".to") %>
       <span class="font-medium text-primary"><%= entry.amount_money.format %></span>.
     </p>
   <% end %>
 
-  <p>All future transactions and balances will be recalculated based on this <%= is_update ? "change" : "update" %>.</p>
+  <p><%= t(".recalculate_notice", change_or_update: is_update ? t(".change") : t(".update")) %></p>
 </div>
diff --git a/app/views/valuations/_header.html.erb b/app/views/valuations/_header.html.erb
index 2db8c8739..2a8566273 100644
--- a/app/views/valuations/_header.html.erb
+++ b/app/views/valuations/_header.html.erb
@@ -2,7 +2,8 @@
 
 <%= tag.header class: "mb-4 space-y-1", id: dom_id(entry, :header) do %>
   <span class="text-secondary text-sm">
-    <%= entry.name %>
+    <% valuation = entry.entryable %>
+    <%= valuation.respond_to?(:opening_anchor?) && valuation.opening_anchor? ? t("valuations.show.opening_balance") : entry.name %>
   </span>
 
   <div class="flex items-center gap-4">
@@ -18,6 +19,6 @@
   </div>
 
   <span class="text-sm text-secondary">
-    <%= I18n.l(entry.date, format: :long) %>
+    <%= entry.date ? I18n.l(entry.date, format: :long) : "—" %>
   </span>
 <% end %>
diff --git a/app/views/valuations/_valuation.html.erb b/app/views/valuations/_valuation.html.erb
index 46ca62eda..003faf5fe 100644
--- a/app/views/valuations/_valuation.html.erb
+++ b/app/views/valuations/_valuation.html.erb
@@ -11,16 +11,18 @@
       <div class="col-span-8 flex items-center gap-3 lg:gap-4">
         <%= check_box_tag dom_id(entry, "selection"),
                         class: "checkbox checkbox--light hidden lg:block",
-                        data: { id: entry.id, "bulk-select-target": "row", action: "bulk-select#toggleRowSelection", checkbox_toggle_target: "selectionEntry" } %>
+                        data: { id: entry.id, entry_type: entry.entryable_type, "bulk-select-target": "row", action: "bulk-select#toggleRowSelection", checkbox_toggle_target: "selectionEntry" } %>
 
         <div class="flex items-center gap-3">
           <%= render DS::FilledIcon.new(icon: icon, size: "md", hex_color: color, rounded: true) %>
 
           <div class="truncate text-primary">
-            <%= link_to entry.name,
-                        entry_path(entry),
-                        data: { turbo_frame: "drawer", turbo_prefetch: false },
-                        class: "hover:underline" %>
+            <%= link_to(
+                  valuation.opening_anchor? ? t("valuations.show.opening_balance") : entry.name,
+                  entry_path(entry),
+                  data: { turbo_frame: "drawer", turbo_prefetch: false },
+                  class: "hover:underline"
+                ) %>
           </div>
         </div>
       </div>
diff --git a/app/views/valuations/index.html.erb b/app/views/valuations/index.html.erb
index 427714e32..c20fa26ff 100644
--- a/app/views/valuations/index.html.erb
+++ b/app/views/valuations/index.html.erb
@@ -4,7 +4,7 @@
       <%= tag.h2 t(".valuations"), class: "font-medium text-lg" %>
       <%= link_to new_valuation_path(@account),
                   data:  { turbo_frame: dom_id(@account.entries.valuations.new) },
-                  class: "flex gap-1 font-medium items-center bg-gray-50 text-primary p-2 rounded-lg" do %>
+                  class: "flex gap-1 font-medium items-center bg-surface-inset text-primary p-2 rounded-lg" do %>
         <span class="text-primary">
           <%= icon("plus", color: "current") %>
         </span>
diff --git a/app/views/valuations/show.html.erb b/app/views/valuations/show.html.erb
index 1cfaa09f9..c580ae202 100644
--- a/app/views/valuations/show.html.erb
+++ b/app/views/valuations/show.html.erb
@@ -23,11 +23,11 @@
                 label: t(".date_label"),
                 max: Date.current %>
           <%= f.money_field :amount,
-                label: "Account value on date",
+                label: t(".amount_label"),
                 disable_currency: true %>
           <div class="flex justify-end">
             <%= render DS::Button.new(
-              text: "Update value",
+              text: t(".update_value"),
               variant: :primary,
               type: "submit"
             ) %>
diff --git a/app/views/vehicles/tabs/_overview.html.erb b/app/views/vehicles/tabs/_overview.html.erb
index b71793bbc..ddd9cbe50 100644
--- a/app/views/vehicles/tabs/_overview.html.erb
+++ b/app/views/vehicles/tabs/_overview.html.erb
@@ -34,7 +34,7 @@
 
 <div class="flex justify-center py-8">
   <%= render DS::Link.new(
-    text: "Edit account details",
+    text: t(".edit_account_details"),
     variant: "ghost",
     href: edit_vehicle_path(account),
     frame: :modal
diff --git a/bin/setup b/bin/setup
index 3cd5a9d78..83098e248 100755
--- a/bin/setup
+++ b/bin/setup
@@ -17,6 +17,10 @@ FileUtils.chdir APP_ROOT do
   system! "gem install bundler --conservative"
   system("bundle check") || system!("bundle install")
 
+  puts "\n== Building design tokens =="
+  system! "npm install"
+  system! "npm run tokens:build"
+
   # puts "\n== Copying sample files =="
   # unless File.exist?("config/database.yml")
   #   FileUtils.cp "config/database.yml.sample", "config/database.yml"
diff --git a/bin/tokens.mjs b/bin/tokens.mjs
new file mode 100755
index 000000000..7fe2f8377
--- /dev/null
+++ b/bin/tokens.mjs
@@ -0,0 +1,172 @@
+#!/usr/bin/env node
+// Sure design tokens build.
+// Reads design/tokens/sure.tokens.json (W3C DTCG-flavored), emits one Tailwind v4 CSS file.
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const TOKENS = resolve(ROOT, "design/tokens/sure.tokens.json");
+const OUT = resolve(ROOT, "app/assets/tailwind/sure-design-system/_generated.css");
+
+const HEADER = `/*
+ * GENERATED — do not edit by hand.
+ * Source: design/tokens/sure.tokens.json
+ * Build:  npm run tokens:build
+ */
+`;
+
+// Single inline keyframe; not worth its own JSON token.
+const KEYFRAMES = `  @keyframes stroke-fill {
+    0% { stroke-dashoffset: 43.9822971503; }
+    100% { stroke-dashoffset: 0; }
+  }`;
+
+// Yield [path, node] for every token leaf (object with $value or $type === "utility").
+function* walk(node, path = []) {
+  if (!node || typeof node !== "object") return;
+  if ("$value" in node || node.$type === "utility") {
+    yield [path, node];
+    if (!node.$value || typeof node.$value !== "object") return;
+  }
+  for (const [k, v] of Object.entries(node)) {
+    if (k.startsWith("$")) continue;
+    yield* walk(v, [...path, k]);
+  }
+}
+
+// Path → CSS variable name. Trailing `DEFAULT` segment is dropped (Tailwind convention).
+function varName(path) {
+  const cleaned = path[path.length - 1] === "DEFAULT" ? path.slice(0, -1) : path;
+  return "--" + cleaned.join("-");
+}
+
+// Set of valid token paths (e.g. "color.gray.50", "utility.border-tertiary").
+// Populated once at the start of build(); referenced by resolveTemplate() and
+// refToClass() so a typo'd `{ref}` fails the build instead of emitting broken
+// CSS or a dangling utility class.
+let VALID_PATHS = null;
+
+function assertKnownRef(ref, source) {
+  if (VALID_PATHS && !VALID_PATHS.has(ref)) {
+    throw new Error(
+      `[tokens] Unknown token reference \`${source}\` (resolved path: \`${ref}\`). ` +
+      `Add it to design/tokens/sure.tokens.json or fix the typo.`
+    );
+  }
+}
+
+// Resolve template strings:
+//   {a.b}     → var(--a-b)
+//   {a.b|N%}  → --alpha(var(--a-b) / N%)
+function resolveTemplate(s) {
+  if (typeof s !== "string") return s;
+  return s.replace(/\{([^|}]+)(?:\|([^}]+))?\}/g, (whole, ref, alpha) => {
+    assertKnownRef(ref, whole);
+    const cssVar = "--" + ref.split(".").join("-");
+    return alpha ? `--alpha(var(${cssVar}) / ${alpha})` : `var(${cssVar})`;
+  });
+}
+
+// {color.gray.50} or {utility.border-tertiary} → Tailwind utility class name with the given prefix.
+// Drops a leading `color.` segment (since Tailwind colors are referenced as `bg-gray-50`, not `bg-color-gray-50`).
+function refToClass(refStr, prefix) {
+  const inner = refStr.replace(/^\{|\}$/g, "");
+  assertKnownRef(inner, refStr);
+  if (inner.startsWith("utility.")) return inner.slice("utility.".length);
+  const parts = inner.split(".");
+  if (parts[0] === "color") parts.shift();
+  return prefix + "-" + parts.join("-");
+}
+
+// Utility @apply argument. If value is a raw class string (no `{}`), pass through.
+// If value is a `{ref}`, resolve to a Tailwind class via the given prefix.
+function utilityClasses(value, prefix) {
+  if (typeof value !== "string") return "";
+  if (!value.includes("{")) return value;
+  return refToClass(value, prefix);
+}
+
+function build() {
+  const tokens = JSON.parse(readFileSync(TOKENS, "utf8"));
+
+  // Pre-compute the set of valid token paths so refs can be validated as we go.
+  VALID_PATHS = new Set();
+  for (const [path] of walk(tokens)) {
+    VALID_PATHS.add(path.join("."));
+  }
+
+  const themeLines = [];
+  const darkLines = [];
+  const utilityBlocks = [];
+
+  for (const [path, node] of walk(tokens)) {
+    if (path[0] === "utility") {
+      const name = path.slice(1).join("-");
+      const ext = node.$extensions || {};
+
+      if (ext["sure.compose"]) {
+        utilityBlocks.push(`@utility ${name} {\n  @apply ${ext["sure.compose"].join(" ")};\n}`);
+        continue;
+      }
+
+      const prefix = ext["sure.utility"]?.prefix;
+      const raw = ext["sure.utility"]?.raw;
+      const dark = ext["sure.dark"];
+
+      const lightLine = raw
+        ? `${raw}: ${resolveTemplate(node.$value)};`
+        : `@apply ${utilityClasses(node.$value, prefix)};`;
+
+      let block = `@utility ${name} {\n  ${lightLine}`;
+      if (dark) {
+        const darkLine = raw
+          ? `${raw}: ${resolveTemplate(dark)};`
+          : `@apply ${utilityClasses(dark, prefix)};`;
+        block += `\n\n  @variant theme-dark {\n    ${darkLine}\n  }`;
+      }
+      block += `\n}`;
+      utilityBlocks.push(block);
+      continue;
+    }
+
+    const name = varName(path);
+    themeLines.push(`  ${name}: ${resolveTemplate(node.$value)};`);
+
+    const dark = node.$extensions?.["sure.dark"];
+    if (dark !== undefined) {
+      darkLines.push(`    ${name}: ${resolveTemplate(dark)};`);
+    }
+  }
+
+  const css = `${HEADER}
+@theme {
+${themeLines.join("\n")}
+
+${KEYFRAMES}
+}
+
+@layer base {
+  [data-theme="dark"] {
+${darkLines.join("\n")}
+  }
+}
+
+${utilityBlocks.join("\n\n")}
+`;
+
+  writeFileSync(OUT, css);
+  console.log(`tokens → ${OUT.replace(ROOT + "/", "")} (${themeLines.length} primitives, ${darkLines.length} dark overrides, ${utilityBlocks.length} utilities)`);
+}
+
+try {
+  build();
+} catch (err) {
+  // Token errors are user-facing; the stack trace is noise.
+  if (err.message?.startsWith("[tokens]")) {
+    console.error(err.message);
+    process.exit(1);
+  }
+  throw err;
+}
diff --git a/charts/sure/CHANGELOG.md b/charts/sure/CHANGELOG.md
index 628fcdce7..0abee238d 100644
--- a/charts/sure/CHANGELOG.md
+++ b/charts/sure/CHANGELOG.md
@@ -5,6 +5,15 @@ All notable changes to the Sure Helm chart will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Changed
+- Bumped `pipelock.image.tag` from `2.0.0` to `2.2.0` (three minor releases behind latest). Floating `@v2` CI action pin picks up patch/minor updates automatically.
+- Refreshed pipelock feature notes in the chart README, `docs/hosting/pipelock.md`, and `pipelock.example.yaml` to reference the upstream changelog instead of a single version.
+
+### Added
+- README: CI scan status badge for the pipelock workflow.
+
 ## [0.6.9-alpha] - 2026-03-24
 
 ### Changed
diff --git a/charts/sure/Chart.yaml b/charts/sure/Chart.yaml
index cee4ff9b6..412a3c29e 100644
--- a/charts/sure/Chart.yaml
+++ b/charts/sure/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: sure
 description: Official Helm chart for deploying the Sure Rails app (web + Sidekiq) on Kubernetes with optional HA PostgreSQL (CloudNativePG) and Redis.
 type: application
-version: 0.7.0-alpha.3
-appVersion: "0.7.0-alpha.3"
+version: 0.7.1-alpha.10
+appVersion: "0.7.1-alpha.10"
 
 kubeVersion: ">=1.25.0-0"
 
diff --git a/charts/sure/README.md b/charts/sure/README.md
index 28b8e164f..73d5eb464 100644
--- a/charts/sure/README.md
+++ b/charts/sure/README.md
@@ -645,7 +645,7 @@ hpa:
 - **Forward proxy** (port 8888): Scans outbound HTTPS from Faraday-based AI clients. Auto-injected via `HTTPS_PROXY` env vars when enabled.
 - **MCP reverse proxy** (port 8889): Scans inbound MCP traffic from external AI assistants.
 
-v2.0 adds enhanced tool poisoning detection (full JSON schema scanning), per-read kill switch preemption on long-lived connections, trusted domain allowlisting, and MCP tool redirect profiles. Process sandboxing and attack simulation are also available via `extraConfig` and CLI.
+Recent pipelock releases add enhanced tool poisoning detection (full JSON schema scanning), per-read kill switch preemption, trusted domain allowlisting, MCP tool redirect profiles, signed action receipts, per-pattern DLP warn mode, and the `pipelock posture verify` / `pipelock session` CLIs. Process sandboxing and attack simulation are also available via `extraConfig` and CLI. See the [pipelock changelog](https://github.com/luckyPipewrench/pipelock/releases) for details.
 
 ### Enabling Pipelock
 
@@ -653,7 +653,7 @@ v2.0 adds enhanced tool poisoning detection (full JSON schema scanning), per-rea
 pipelock:
   enabled: true
   image:
-    tag: "2.0.0"
+    tag: "2.2.0"
   mode: balanced   # strict, balanced, or audit
 ```
 
@@ -685,7 +685,7 @@ pipelock:
 
 ### Validating your config
 
-Pipelock v2.0 includes two CLI tools for config validation:
+Pipelock includes CLI tools for config validation:
 
 ```bash
 # Run 24 synthetic attack scenarios against your config
diff --git a/charts/sure/templates/_env.tpl b/charts/sure/templates/_env.tpl
index e50ab7ce8..e0aba60d5 100644
--- a/charts/sure/templates/_env.tpl
+++ b/charts/sure/templates/_env.tpl
@@ -48,8 +48,10 @@ The helper always injects:
       key: ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT
 {{- end }}
 {{- if $includeDatabase }}
+{{- $railsExtraEnv := (default (dict) $ctx.Values.rails.extraEnv) -}}
+{{- $explicitDb := hasKey $railsExtraEnv "DATABASE_URL" -}}
 {{- $dburl := include "sure.databaseUrl" $ctx -}}
-{{- if $dburl }}
+{{- if and $dburl (not $explicitDb) }}
 - name: DB_PASSWORD
   valueFrom:
     secretKeyRef:
@@ -60,8 +62,10 @@ The helper always injects:
 {{- end }}
 {{- end }}
 {{- if $includeRedis }}
+{{- $railsExtraEnv := (default (dict) $ctx.Values.rails.extraEnv) -}}
+{{- $explicitRedis := hasKey $railsExtraEnv "REDIS_URL" -}}
 {{- $redis := include "sure.redisUrl" $ctx -}}
-{{- if $redis }}
+{{- if and $redis (not $explicitRedis) }}
 - name: REDIS_PASSWORD
   valueFrom:
     secretKeyRef:
diff --git a/charts/sure/templates/cnpg-cluster.yaml b/charts/sure/templates/cnpg-cluster.yaml
index a19c789be..2e694ea54 100644
--- a/charts/sure/templates/cnpg-cluster.yaml
+++ b/charts/sure/templates/cnpg-cluster.yaml
@@ -74,6 +74,10 @@ spec:
   tolerations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
+  {{- with .Values.cnpg.cluster.resources }}
+  resources:
+    {{- toYaml . | nindent 4 }} 
+  {{- end }}
   {{- with .Values.cnpg.cluster.topologySpreadConstraints }}
   topologySpreadConstraints:
     {{- toYaml . | nindent 4 }}
diff --git a/charts/sure/values.yaml b/charts/sure/values.yaml
index d2b5da6d0..f4b54f69e 100644
--- a/charts/sure/values.yaml
+++ b/charts/sure/values.yaml
@@ -110,6 +110,15 @@ cnpg:
     #   are passed through for CNPG to validate.
     backup: {}
 
+    # NOTE: These are example values for resource limits and requests, adapt them to your cluster and workload needs. CNPG can run on very small resource requests, but you may want to increase limits for production workloads.
+    # resources:
+    #   requests:
+    #     cpu: 100m
+    #     memory: 256Mi
+    #   limits:
+    #     cpu: 200m
+    #     memory: 512Mi
+    #     
     # Optional CNPG plugin configuration (rendered as `.spec.plugins` on the Cluster CR)
     # Example (barman-cloud plugin as WAL archiver):
     # plugins:
@@ -488,7 +497,7 @@ pipelock:
   enabled: false
   image:
     repository: ghcr.io/luckypipewrench/pipelock
-    tag: "2.0.0"
+    tag: "2.2.0"
     pullPolicy: IfNotPresent
     imagePullSecrets: []
   replicas: 1
diff --git a/compose.example.ai.yml b/compose.example.ai.yml
index 0ffc93a8b..7c79178f7 100644
--- a/compose.example.ai.yml
+++ b/compose.example.ai.yml
@@ -43,9 +43,24 @@
 # Troubleshooting:
 # ----------------
 #
-# If you run into problems, you should open a Discussion here:
+# Problems? Swing by our Discord or open a Discussion here:
 #
-# https://github.com/we-promise/sure/discussions/categories/ai-usage
+# https://github.com/we-promise/sure/discussions/categories/general
+#
+# IPv6 Note (Yahoo Finance Sync, others?):
+# ----------------------------------------
+# If you encounter "Failed to open TCP connection" errors to hosts like
+# fc.yahoo.com in your environment, the issue may be that DNS resolves
+# to an IPv6 address first. Since IPv6 may not be configured in the container,
+# the connection hangs. To work around this, you can hardcode the IPv4
+# addresses in your container's /etc/hosts or set custom DNS:
+#
+#   extra_hosts:
+#     - "fc.yahoo.com:173.223.12.81"
+#     - "query1.finance.yahoo.com:98.136.48.169"
+#     - "query2.finance.yahoo.com:98.136.48.169"
+#
+# Or use explicit DNS servers that prefer IPv4 (already configured below).
 #
 
 x-db-env: &db_env
@@ -97,7 +112,7 @@ x-rails-env: &rails_env
 
 services:
   pipelock:
-    image: ghcr.io/luckypipewrench/pipelock:latest  # pin to a specific version (e.g., :2.0.0) for production
+    image: ghcr.io/luckypipewrench/pipelock:latest  # pin to a specific version (e.g., :2.2.0) for production
     container_name: pipelock
     hostname: pipelock
     restart: unless-stopped
@@ -172,7 +187,7 @@ services:
       - WEBUI_AUTH=False
       - WEBUI_NAME=AI
       - WEBUI_URL=http://localhost:8080
-      - WEBUI_SECRET_KEY=t0p-s3cr3t
+      - WEBUI_SECRET_KEY=t0p-s3cr3t # pipelock:ignore
       - NO_PROXY=host.docker.internal
     extra_hosts:
       - host.docker.internal:host-gateway
@@ -240,10 +255,16 @@ services:
       # bypassing Pipelock's MCP scanning (auth token is still required).
       # For hardened deployments, use `expose: [3000]` instead and front
       # the web UI with a separate reverse proxy.
+      #
+      # To also publish on IPv6 (dual-stack), uncomment the line below AND
+      # set BINDING=:: in the environment block. See docs/hosting/docker.md
+      # "Binding to IPv6" for details.
+      # - "[::]:${PORT:-3000}:3000"
       - ${PORT:-3000}:3000
     restart: unless-stopped
     environment:
       <<: *rails_env
+      # BINDING: "::"  # Uncomment for IPv6 dual-stack inside the container
     depends_on:
       db:
         condition: service_healthy
@@ -304,7 +325,7 @@ services:
       - POSTGRES_HOST=db
       - POSTGRES_DB=${POSTGRES_DB:-sure_production}
       - POSTGRES_USER=${POSTGRES_USER:-sure_user}
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-sure_password}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-sure_password} # pipelock:ignore
       - SCHEDULE=@daily # Runs once a day at midnight
       - BACKUP_KEEP_DAYS=7 # Keeps the last 7 days of backups
       - BACKUP_KEEP_WEEKS=4 # Keeps 4 weekly backups
diff --git a/compose.example.yml b/compose.example.yml
index b52c047e1..108fd6b9a 100644
--- a/compose.example.yml
+++ b/compose.example.yml
@@ -22,10 +22,25 @@
 # Troubleshooting:
 # ----------------
 #
-# If you run into problems, you should open a Discussion here:
+# Problems? Swing by our Discord or open a Discussion here:
 #
 # https://github.com/we-promise/sure/discussions/categories/general
 #
+# IPv6 Note (Yahoo Finance Sync, others?):
+# ----------------------------------------
+# If you encounter "Failed to open TCP connection" errors to hosts like
+# fc.yahoo.com in your environment, the issue may be that DNS resolves
+# to an IPv6 address first. Since IPv6 may not be configured in the container,
+# the connection hangs. To work around this, you can hardcode the IPv4
+# addresses in your container's /etc/hosts or set custom DNS:
+#
+#   extra_hosts:
+#     - "fc.yahoo.com:173.223.12.81"
+#     - "query1.finance.yahoo.com:98.136.48.169"
+#     - "query2.finance.yahoo.com:98.136.48.169"
+#
+# Or use explicit DNS servers that prefer IPv4 (already configured below).
+#
 
 x-db-env: &db_env
   POSTGRES_USER: ${POSTGRES_USER:-sure_user}
@@ -51,9 +66,14 @@ services:
       - app-storage:/rails/storage
     ports:
       - ${PORT:-3000}:3000
+      # To also publish on IPv6 (dual-stack), uncomment the line below AND
+      # set BINDING=:: in the environment block. See docs/hosting/docker.md
+      # "Binding to IPv6" for details.
+      # - "[::]:${PORT:-3000}:3000"
     restart: unless-stopped
     environment:
       <<: *rails_env
+      # BINDING: "::"  # Uncomment for IPv6 dual-stack inside the container
     depends_on:
       db:
         condition: service_healthy
@@ -110,7 +130,7 @@ services:
       - POSTGRES_HOST=db
       - POSTGRES_DB=${POSTGRES_DB:-sure_production}
       - POSTGRES_USER=${POSTGRES_USER:-sure_user}
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-sure_password}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-sure_password} # pipelock:ignore
       - SCHEDULE=@daily # Runs once a day at midnight
       - BACKUP_KEEP_DAYS=7 # Keeps the last 7 days of backups
       - BACKUP_KEEP_WEEKS=4 # Keeps 4 weekly backups
diff --git a/config/application.rb b/config/application.rb
index 1269f1aad..17909aadf 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -48,6 +48,11 @@ module Sure
     config.x.ui = ActiveSupport::OrderedOptions.new
     default_layout = ENV.fetch("DEFAULT_UI_LAYOUT", "dashboard")
     config.x.ui.default_layout = default_layout.in?(%w[dashboard intro]) ? default_layout : "dashboard"
+
+    config.x.debug_log = ActiveSupport::OrderedOptions.new
+    retention_days = ENV.fetch("DEBUG_LOG_RETENTION_DAYS", "90").to_i
+    config.x.debug_log.retention_days = retention_days.positive? ? retention_days : 90
+
     # Handle OmniAuth/OIDC errors gracefully (must be before OmniAuth middleware)
     require_relative "../app/middleware/omniauth_error_handler"
     config.middleware.use OmniauthErrorHandler
diff --git a/config/brakeman.ignore b/config/brakeman.ignore
index ca044eb6c..d6b23c8f8 100644
--- a/config/brakeman.ignore
+++ b/config/brakeman.ignore
@@ -46,29 +46,6 @@
       ],
       "note": ""
     },
-    {
-      "warning_type": "Mass Assignment",
-      "warning_code": 105,
-      "fingerprint": "85e2c11853dd6c69b1953a6ec3ad661cd0ce3df55e4e5beff92365b6ed601171",
-      "check_name": "PermitAttributes",
-      "message": "Potentially dangerous key allowed for mass assignment",
-      "file": "app/controllers/api/v1/transactions_controller.rb",
-      "line": 255,
-      "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/",
-      "code": "params.require(:transaction).permit(:account_id, :date, :amount, :name, :description, :notes, :currency, :category_id, :merchant_id, :nature, :tag_ids => ([]))",
-      "render_path": null,
-      "location": {
-        "type": "method",
-        "class": "Api::V1::TransactionsController",
-        "method": "transaction_params"
-      },
-      "user_input": ":account_id",
-      "confidence": "High",
-      "cwe_id": [
-        915
-      ],
-      "note": "account_id is properly validated in create action - line 79 ensures account belongs to user's family: family.accounts.find(transaction_params[:account_id])"
-    },
     {
       "warning_type": "Mass Assignment",
       "warning_code": 105,
diff --git a/config/exchanges.yml b/config/exchanges.yml
index 589f20269..dfd9c89db 100644
--- a/config/exchanges.yml
+++ b/config/exchanges.yml
@@ -295,6 +295,11 @@ XLIM:
   name: Lima
   country: PE
 
+# Crypto exchanges
+BNCX:
+  name: Binance
+  country: AE
+
 # Middle East & Africa
 XTAE:
   name: Tel Aviv
diff --git a/config/i18n-tasks.yml b/config/i18n-tasks.yml
index bf7d512bb..bc07d893e 100644
--- a/config/i18n-tasks.yml
+++ b/config/i18n-tasks.yml
@@ -11,6 +11,7 @@ search:
   paths:
     - app/
   relative_roots:
+    - app/components
     - app/controllers
     - app/controllers/concerns
     - app/helpers
diff --git a/config/importmap.rb b/config/importmap.rb
index 5f1d80870..308591cbd 100644
--- a/config/importmap.rb
+++ b/config/importmap.rb
@@ -7,6 +7,8 @@ pin "@hotwired/stimulus-loading", to: "stimulus-loading.js"
 pin_all_from "app/javascript/controllers", under: "controllers"
 pin_all_from "app/components", under: "controllers", to: ""
 pin_all_from "app/javascript/services", under: "services", to: "services"
+pin_all_from "app/javascript/utils", under: "utils", to: "utils"
+pin "utils/sankey_zoom", to: "utils/sankey_zoom.mjs"
 pin "@github/hotkey", to: "@github--hotkey.js" # @3.1.1
 pin "@simonwep/pickr", to: "@simonwep--pickr.js" # @1.9.1
 
diff --git a/config/initializers/active_record_encryption.rb b/config/initializers/active_record_encryption.rb
index 0c6da99ef..35e6b865f 100644
--- a/config/initializers/active_record_encryption.rb
+++ b/config/initializers/active_record_encryption.rb
@@ -1,3 +1,5 @@
+require Rails.root.join("lib/active_record_encryption_config").to_s
+
 # Configure Active Record encryption keys
 # Priority order:
 # 1. Environment variables (works for both managed and self-hosted modes)
@@ -9,8 +11,12 @@ primary_key = ENV["ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY"]
 deterministic_key = ENV["ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY"]
 key_derivation_salt = ENV["ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT"]
 
+if ActiveRecordEncryptionConfig.partial_env?
+  raise ActiveRecordEncryptionConfig.partial_env_message
+end
+
 # If all environment variables are present, use them (works for both managed and self-hosted)
-if primary_key.present? && deterministic_key.present? && key_derivation_salt.present?
+if ActiveRecordEncryptionConfig.complete_env?
   Rails.application.config.active_record.encryption.primary_key = primary_key
   Rails.application.config.active_record.encryption.deterministic_key = deterministic_key
   Rails.application.config.active_record.encryption.key_derivation_salt = key_derivation_salt
diff --git a/config/initializers/active_storage_authorization.rb b/config/initializers/active_storage_authorization.rb
index 7766dc3c3..c856faa08 100644
--- a/config/initializers/active_storage_authorization.rb
+++ b/config/initializers/active_storage_authorization.rb
@@ -2,35 +2,95 @@
 Rails.application.config.to_prepare do
   module ActiveStorageAttachmentAuthorization
     extend ActiveSupport::Concern
+    PROTECTED_RECORD_TYPES = %w[Transaction AccountStatement].freeze
 
     included do
       include Authentication
-      before_action :authorize_transaction_attachment, if: :transaction_attachment?
+      before_action :authorize_protected_attachment
     end
 
     private
 
-      def authorize_transaction_attachment
-        attachment = ActiveStorage::Attachment.find_by(blob: authorized_blob)
-        return unless attachment&.record_type == "Transaction"
+      def authorize_protected_attachment
+        # Direct uploads create unattached blobs; model/controller code authorizes the later attachment.
+        return if is_a?(ActiveStorage::DirectUploadsController)
+        return unless authorized_blob
 
-        transaction = attachment.record
+        attachments = authorized_attachments
+        raise ActiveRecord::RecordNotFound if attachments.empty?
 
-        # Check if current user has access to this transaction's family
-        unless Current.family == transaction.entry.account.family
-          raise ActiveRecord::RecordNotFound
+        protected_attachments = attachments.select { |attachment| attachment.record_type.in?(PROTECTED_RECORD_TYPES) }
+        return if protected_attachments.empty?
+        return if protected_attachments.all? { |attachment| protected_attachment_authorized?(attachment) }
+
+        raise ActiveRecord::RecordNotFound
+      end
+
+      def protected_attachment_authorized?(attachment)
+        case attachment.record_type
+        when "Transaction"
+          transaction_attachment_authorized?(attachment)
+        when "AccountStatement"
+          account_statement_attachment_authorized?(attachment)
+        else
+          false
         end
       end
 
-      def transaction_attachment?
-        return false unless authorized_blob
+      def transaction_attachment_authorized?(attachment)
+        transaction = attachment.record
+        return false if transaction.nil?
 
-        attachment = ActiveStorage::Attachment.find_by(blob: authorized_blob)
-        attachment&.record_type == "Transaction"
+        Current.family == transaction.entry.account.family
+      rescue ActiveRecord::RecordNotFound, NoMethodError
+        false
+      end
+
+      def account_statement_attachment_authorized?(attachment)
+        statement = attachment.record
+        return false if statement.nil?
+
+        statement.viewable_by?(Current.user)
+      rescue ActiveRecord::RecordNotFound
+        false
+      end
+
+      def authorized_attachments
+        return nil unless authorized_blob
+
+        @authorized_attachments ||= ActiveStorage::Attachment.where(blob: authorized_blob).to_a
       end
 
       def authorized_blob
-        @blob || @representation&.blob
+        @blob || @representation&.blob || disk_service_blob
+      end
+
+      def disk_service_blob
+        return nil unless is_a?(ActiveStorage::DiskController) && action_name == "show"
+
+        key = decode_verified_key&.fetch(:key, nil)
+        return nil if key.blank?
+
+        blob_key = key.to_s[%r{\Avariants/([^/]+)/}, 1] || key
+        ActiveStorage::Blob.find_by(key: blob_key)
+      rescue ActiveStorage::InvalidKeyError
+        nil
+      end
+
+      def new_session_url
+        Rails.application.routes.url_helpers.new_session_url(active_storage_auth_url_options)
+      end
+
+      def new_registration_url
+        Rails.application.routes.url_helpers.new_registration_url(active_storage_auth_url_options)
+      end
+
+      def active_storage_auth_url_options
+        {
+          protocol: request.protocol,
+          host: request.host,
+          port: request.optional_port
+        }.compact
       end
   end
 
@@ -38,8 +98,10 @@ Rails.application.config.to_prepare do
     ActiveStorage::Blobs::RedirectController,
     ActiveStorage::Blobs::ProxyController,
     ActiveStorage::Representations::RedirectController,
-    ActiveStorage::Representations::ProxyController
-  ].each do |controller|
+    ActiveStorage::Representations::ProxyController,
+    (ActiveStorage::DiskController if defined?(ActiveStorage::DiskController)),
+    (ActiveStorage::DirectUploadsController if defined?(ActiveStorage::DirectUploadsController))
+  ].compact.each do |controller|
     controller.include ActiveStorageAttachmentAuthorization
   end
 end
diff --git a/config/initializers/filter_parameter_logging.rb b/config/initializers/filter_parameter_logging.rb
index af9db0312..5e4690a35 100644
--- a/config/initializers/filter_parameter_logging.rb
+++ b/config/initializers/filter_parameter_logging.rb
@@ -5,5 +5,6 @@
 # See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors.
 Rails.application.config.filter_parameters += [
   :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :openai_access_token,
-  :client_id, :consumer_key, :snaptrade_user_id, :snaptrade_user_secret
+  :client_id, :consumer_key, :snaptrade_user_id, :snaptrade_user_secret,
+  :bank_username, :bank_password, :security_answers, :captcha_input
 ]
diff --git a/config/initializers/mime_types.rb b/config/initializers/mime_types.rb
index 549789cbf..e116f5753 100644
--- a/config/initializers/mime_types.rb
+++ b/config/initializers/mime_types.rb
@@ -5,3 +5,6 @@
 Mime::Type.register "text/csv", :csv
 Mime::Type.register "application/pdf", :pdf
 Mime::Type.register "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", :xlsx
+
+# Register .mjs so Propshaft serves ES modules with the correct Content-Type.
+Mime::Type.register "text/javascript", :mjs unless Mime::Type.lookup_by_extension(:mjs)
diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb
index 4a16a69bb..8918e6f76 100644
--- a/config/initializers/rack_attack.rb
+++ b/config/initializers/rack_attack.rb
@@ -10,6 +10,14 @@ class Rack::Attack
     request.ip if request.path == "/oauth/token"
   end
 
+  # Throttle unauthenticated WebAuthn MFA ceremonies similarly to sign-in
+  # endpoints; registration remains behind normal application authentication.
+  throttle("mfa/webauthn", limit: 10, period: 1.minute) do |request|
+    if request.post? && request.path.in?(%w[/mfa/webauthn_options /mfa/verify_webauthn])
+      request.ip
+    end
+  end
+
   # Throttle admin endpoints to prevent brute-force attacks
   # More restrictive than general API limits since admin access is sensitive
   throttle("admin/ip", limit: 10, period: 1.minute) do |request|
diff --git a/config/initializers/sentry.rb b/config/initializers/sentry.rb
index 5d27918cd..8e31567d4 100644
--- a/config/initializers/sentry.rb
+++ b/config/initializers/sentry.rb
@@ -20,6 +20,7 @@ if ENV["SENTRY_DSN"].present?
     # We recommend adjusting this value in production.
     config.profiles_sample_rate = 0.25
 
+    config.release = Rails.root.join(".sure-version").read.strip rescue nil
     config.profiler_class = Sentry::Vernier::Profiler
   end
 end
diff --git a/config/initializers/sidekiq.rb b/config/initializers/sidekiq.rb
index 7183382a2..1338491a4 100644
--- a/config/initializers/sidekiq.rb
+++ b/config/initializers/sidekiq.rb
@@ -5,7 +5,7 @@ if Rails.env.production?
     configured_username = ::Digest::SHA256.hexdigest(ENV.fetch("SIDEKIQ_WEB_USERNAME", "sure"))
     configured_password = ::Digest::SHA256.hexdigest(ENV.fetch("SIDEKIQ_WEB_PASSWORD", "sure"))
 
-    ActiveSupport::SecurityUtils.secure_compare(::Digest::SHA256.hexdigest(username), configured_username) &&
+    ActiveSupport::SecurityUtils.secure_compare(::Digest::SHA256.hexdigest(username), configured_username) &
       ActiveSupport::SecurityUtils.secure_compare(::Digest::SHA256.hexdigest(password), configured_password)
   end
 end
diff --git a/config/initializers/version.rb b/config/initializers/version.rb
index fa7f79b90..3511dd434 100644
--- a/config/initializers/version.rb
+++ b/config/initializers/version.rb
@@ -16,7 +16,10 @@ module Sure
 
     private
       def semver
-        "0.7.0-alpha.3"
+        stripped_content = Rails.root.join(".sure-version").read.strip
+        stripped_content.presence || "n/a: #{commit_sha}"
+      rescue Errno::ENOENT
+        "n/a: #{commit_sha || 'unknown'}"
       end
   end
 end
diff --git a/config/initializers/webauthn.rb b/config/initializers/webauthn.rb
new file mode 100644
index 000000000..dd51232df
--- /dev/null
+++ b/config/initializers/webauthn.rb
@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+Rails.application.configure do
+  config.x.webauthn = ActiveSupport::OrderedOptions.new
+
+  credentials_config = Rails.application.credentials.webauthn || {}
+  credential_rp_id = credentials_config[:rp_id] || credentials_config["rp_id"]
+  credential_origins = credentials_config[:allowed_origins] || credentials_config["allowed_origins"]
+
+  configured_rp_id = ENV["WEBAUTHN_RP_ID"].presence || credential_rp_id.presence || ENV["APP_DOMAIN"].presence
+  default_rp_id = Rails.env.test? ? "www.example.com" : "localhost"
+
+  rp_id = configured_rp_id.presence || default_rp_id
+  rp_id = rp_id.to_s.strip.sub(%r{\Ahttps?://}, "").split("/").first.to_s.split(":").first
+
+  configured_origins = ENV["WEBAUTHN_ALLOWED_ORIGINS"].presence || credential_origins
+  allowed_origins = Array(configured_origins)
+    .flat_map { |origin| origin.to_s.split(",") }
+    .map { |origin| origin.strip.chomp("/") }
+    .reject(&:blank?)
+
+  if allowed_origins.blank?
+    allowed_origins = if Rails.env.test?
+      [ "http://www.example.com" ]
+    elsif rp_id == "localhost"
+      [ "http://localhost:3000" ]
+    else
+      [ "https://#{rp_id}" ]
+    end
+  end
+
+  config.x.webauthn.rp_id = rp_id
+  config.x.webauthn.allowed_origins = allowed_origins
+end
diff --git a/config/locales/breadcrumbs/ca.yml b/config/locales/breadcrumbs/ca.yml
index c726a4da7..af61405d4 100644
--- a/config/locales/breadcrumbs/ca.yml
+++ b/config/locales/breadcrumbs/ca.yml
@@ -1,6 +1,87 @@
 ---
 ca:
   breadcrumbs:
+    account_sharings: Compartició de comptes
+    account_statements: Arxiu d'extractes
+    accounts: Comptes
+    ai_prompts: Prompts d'IA
+    api_key: Clau API
+    api_keys: Claus API
+    appearance: Aparença
+    appearances: Aparença
+    bank_sync: Sincronització bancària
+    binance_items: Binance
+    brex_items: Brex
+    budget_categories: Categories del pressupost
+    budgets: Pressupostos
+    categories: Categories
+    categorize: Categoritza
+    chats: Xats
+    coinbase_items: Coinbase
+    coinstats_items: CoinStats
+    credit_cards: Targetes de crèdit
+    cryptos: Cripto
+    dashboard: Tauler
+    debug: Depuració
+    debugs: Depuració
+    depositories: Comptes d'efectiu
+    enable_banking_items: Enable Banking
     exports: Exportacions
+    family_exports: Exportacions
+    family_merchants: Comerços
+    guides: Guies
+    holdings: Posicions
     home: Inici
+    hostings: Self hosting
+    ibkr_items: Interactive Brokers
+    impersonation_sessions: Suplantacions
     imports: Importacions
+    indexa_capital_items: Indexa Capital
+    intro: Introducció
+    investments: Inversions
+    invitations: Invitacions
+    invite_codes: Codis d'invitació
+    kraken_items: Kraken
+    llm_usage: Ús d'LLM
+    llm_usages: Ús d'LLM
+    loans: Préstecs
+    lunchflow_items: Lunch Flow
+    merchants: Comerços
+    mercury_items: Mercury
+    messages: Missatges
+    mfa: Autenticació de dos factors
+    oidc_accounts: Comptes SSO
+    onboardings: Configuració inicial
+    other_assets: Altres actius
+    other_liabilities: Altres passius
+    payments: Pagaments
+    pending_duplicate_merges: Revisió de duplicats
+    plaid_items: Plaid
+    preferences: Preferències
+    profile: Informació del perfil
+    profiles: Informació del perfil
+    properties: Propietats
+    providers: Proveïdors
+    recurring_transactions: Recurrents
+    registrations: Registre
+    reports: Informes
+    rules: Regles
+    securities: Seguretat
+    security: Seguretat
+    self_hosting: Self hosting
+    sessions: Inici de sessió
+    simplefin_items: SimpleFIN
+    snaptrade_items: SnapTrade
+    sophtron_items: Sophtron
+    splits: Divisió
+    sso_identities: Connexions SSO
+    sso_providers: Proveïdors SSO
+    subscriptions: Subscripció
+    tags: Etiquetes
+    trades: Operacions
+    transactions: Transaccions
+    transfer_matches: Coincidències de transferències
+    transfers: Transferències
+    users: Usuaris
+    valuations: Valoracions
+    vehicles: Vehicles
diff --git a/config/locales/breadcrumbs/en.yml b/config/locales/breadcrumbs/en.yml
index 1c840acdc..c6f1ba1d8 100644
--- a/config/locales/breadcrumbs/en.yml
+++ b/config/locales/breadcrumbs/en.yml
@@ -1,8 +1,87 @@
 ---
 en:
   breadcrumbs:
+    account_sharings: Account sharing
+    account_statements: Statement vault
+    accounts: Accounts
+    ai_prompts: AI Prompts
+    api_key: API Key
+    api_keys: API Keys
+    appearance: Appearance
+    appearances: Appearance
+    bank_sync: Bank Sync
+    binance_items: Binance
+    brex_items: Brex
+    budget_categories: Budget categories
+    budgets: Budgets
+    categories: Categories
     categorize: Categorize
+    chats: Chats
+    coinbase_items: Coinbase
+    coinstats_items: CoinStats
+    credit_cards: Credit cards
+    cryptos: Crypto
+    dashboard: Dashboard
+    debug: Debug
+    debugs: Debug
+    depositories: Cash accounts
+    enable_banking_items: Enable Banking
     exports: Exports
+    family_exports: Exports
+    family_merchants: Merchants
+    guides: Guides
+    holdings: Holdings
     home: Home
+    hostings: Self-Hosting
+    ibkr_items: Interactive Brokers
+    impersonation_sessions: Impersonations
     imports: Imports
+    indexa_capital_items: Indexa Capital
+    intro: Intro
+    investments: Investments
+    invitations: Invitations
+    invite_codes: Invite codes
+    kraken_items: Kraken
+    llm_usage: LLM Usage
+    llm_usages: LLM Usage
+    loans: Loans
+    lunchflow_items: Lunch Flow
+    merchants: Merchants
+    mercury_items: Mercury
+    messages: Messages
+    mfa: Two-factor authentication
+    oidc_accounts: SSO accounts
+    onboardings: Onboarding
+    other_assets: Other assets
+    other_liabilities: Other liabilities
+    payments: Payments
+    pending_duplicate_merges: Duplicate review
+    plaid_items: Plaid
+    preferences: Preferences
+    profile: Profile Info
+    profiles: Profile Info
+    properties: Properties
+    providers: Providers
+    recurring_transactions: Recurring
+    registrations: Sign up
+    reports: Reports
+    rules: Rules
+    securities: Security
+    security: Security
+    self_hosting: Self-Hosting
+    sessions: Sign in
+    simplefin_items: SimpleFIN
+    snaptrade_items: SnapTrade
+    sophtron_items: Sophtron
+    splits: Split
+    sso_identities: SSO connections
+    sso_providers: SSO providers
+    subscriptions: Subscription
+    tags: Tags
+    trades: Trades
     transactions: Transactions
+    transfer_matches: Transfer matches
+    transfers: Transfers
+    users: Users
+    valuations: Valuations
+    vehicles: Vehicles
diff --git a/config/locales/breadcrumbs/es.yml b/config/locales/breadcrumbs/es.yml
index f0a45a491..905ac305d 100644
--- a/config/locales/breadcrumbs/es.yml
+++ b/config/locales/breadcrumbs/es.yml
@@ -1,6 +1,8 @@
 ---
 es:
   breadcrumbs:
+    categorize: Categorizar
     exports: Exportaciones
     home: Inicio
     imports: Importaciones
+    transactions: Transacciones
diff --git a/config/locales/breadcrumbs/fr.yml b/config/locales/breadcrumbs/fr.yml
new file mode 100644
index 000000000..7652e4afd
--- /dev/null
+++ b/config/locales/breadcrumbs/fr.yml
@@ -0,0 +1,8 @@
+---
+fr:
+  breadcrumbs:
+    categorize: Catégoriser
+    exports: Exports
+    home: Accueil
+    imports: Imports
+    transactions: Transactions
diff --git a/config/locales/breadcrumbs/hu.yml b/config/locales/breadcrumbs/hu.yml
new file mode 100644
index 000000000..93dcdb312
--- /dev/null
+++ b/config/locales/breadcrumbs/hu.yml
@@ -0,0 +1,21 @@
+---
+hu:
+  breadcrumbs:
+    ai_prompts: AI promptok
+    api_key: API kulcs
+    bank_sync: Bankszinkronizáció
+    budgets: Költségvetések
+    categorize: Kategorizálás
+    dashboard: Irányítópult
+    exports: Exportálások
+    guides: Útmutatók
+    home: Kezdőlap
+    imports: Importálások
+    intro: Bemutató
+    llm_usage: LLM használat
+    merchants: Kereskedők
+    profile: Profil adatok
+    reports: Jelentések
+    security: Biztonság
+    self_hosting: Saját üzemeltetés
+    transactions: Tranzakciók
diff --git a/config/locales/countries.ca.yml b/config/locales/countries.ca.yml
new file mode 100644
index 000000000..ecb7b82f4
--- /dev/null
+++ b/config/locales/countries.ca.yml
@@ -0,0 +1,121 @@
+---
+ca:
+  countries:
+    AD: Andorra
+    AE: Emirats Àrabs Units
+    AF: Afganistan
+    AL: Albània
+    AM: Armènia
+    AO: Angola
+    AR: Argentina
+    AT: Àustria
+    AU: Austràlia
+    BA: Bòsnia i Hercegovina
+    BD: Bangla Desh
+    BE: Bèlgica
+    BG: Bulgària
+    BO: Bolívia
+    BR: Brasil
+    BY: Bielorússia
+    CA: Canadà
+    CD: República Democràtica del Congo
+    CG: República del Congo
+    CH: Suïssa
+    CI: Costa d'Ivori
+    CL: Xile
+    CM: Camerun
+    CN: Xina
+    CO: Colòmbia
+    CR: Costa Rica
+    CU: Cuba
+    CY: Xipre
+    CZ: República Txeca
+    DE: Alemanya
+    DK: Dinamarca
+    DO: República Dominicana
+    DZ: Algèria
+    EC: Equador
+    EE: Estònia
+    EG: Egipte
+    ES: Espanya
+    ET: Etiòpia
+    FI: Finlàndia
+    FR: França
+    GB: Regne Unit
+    GE: Geòrgia
+    GH: Ghana
+    GR: Grècia
+    GT: Guatemala
+    HK: Hong Kong
+    HN: Hondures
+    HR: Croàcia
+    HT: Haití
+    HU: Hongria
+    ID: Indonèsia
+    IE: Irlanda
+    IL: Israel
+    IN: Índia
+    IQ: Iraq
+    IR: Iran
+    IS: Islàndia
+    IT: Itàlia
+    JM: Jamaica
+    JO: Jordània
+    JP: Japó
+    KE: Kenya
+    KH: Cambodja
+    KP: Corea del Nord
+    KR: Corea del Sud
+    KW: Kuwait
+    KZ: Kazakhstan
+    LB: Líban
+    LT: Lituània
+    LU: Luxemburg
+    LV: Letònia
+    MA: Marroc
+    MD: Moldàvia
+    ME: Montenegro
+    MG: Madagascar
+    MK: Macedònia del Nord
+    MM: Myanmar (Birmània)
+    MN: Mongòlia
+    MT: Malta
+    MX: Mèxic
+    MY: Malàisia
+    NG: Nigèria
+    NI: Nicaragua
+    NL: Països Baixos
+    'NO': Noruega
+    NP: Nepal
+    NZ: Nova Zelanda
+    PA: Panamà
+    PE: Perú
+    PH: Filipines
+    PK: Pakistan
+    PL: Polònia
+    PR: Puerto Rico
+    PT: Portugal
+    PY: Paraguai
+    QA: Qatar
+    RO: Romania
+    RS: Sèrbia
+    RU: Rússia
+    SA: Aràbia Saudita
+    SE: Suècia
+    SG: Singapur
+    SI: Eslovènia
+    SK: Eslovàquia
+    SV: El Salvador
+    SY: Síria
+    TH: Tailàndia
+    TN: Tunísia
+    TR: Turquia
+    TW: Taiwan
+    UA: Ucraïna
+    UG: Uganda
+    US: Estats Units
+    UY: Uruguai
+    VE: Veneçuela
+    VN: Vietnam
+    ZA: Sud-àfrica
+    ZW: Zimbàbue
diff --git a/config/locales/defaults/ca.yml b/config/locales/defaults/ca.yml
index 127267ac6..a88f011d3 100644
--- a/config/locales/defaults/ca.yml
+++ b/config/locales/defaults/ca.yml
@@ -41,7 +41,9 @@ ca:
     formats:
       default: "%d-%m-%Y"
       long: "%d de %B de %Y"
+      month_year: "%B de %Y"
       short: "%d de %b"
+      short_month_year: "%b de %Y"
     month_names:
     -
     - Gener
@@ -83,7 +85,7 @@ ca:
         other: menys de %{count} segons
       over_x_years:
         one: més d'%{count} any
-        other: més de %{count} anys
+        other: més d'%{count} anys
       x_days:
         one: "%{count} dia"
         other: "%{count} dies"
@@ -108,6 +110,8 @@ ca:
       year: any
   defaults:
     brand_name: "%{brand_name}"
+    common:
+      close: Tanca
     product_name: "%{product_name}"
   errors:
     format: "%{attribute} %{message}"
@@ -122,7 +126,7 @@ ca:
       greater_than: ha de ser més gran que %{count}
       greater_than_or_equal_to: ha de ser més gran o igual a %{count}
       in: ha d'estar entre %{count}
-      inclusion: no està inclós a la llista
+      inclusion: no està inclòs a la llista
       invalid: no és vàlid
       less_than: ha de ser menor que %{count}
       less_than_or_equal_to: ha de ser menor o igual a %{count}
@@ -148,13 +152,17 @@ ca:
       header:
         one: No s'ha pogut desar aquest/a %{model} perquè hi ha %{count} error
         other: No s'ha pogut desar aquest/a %{model} perquè hi ha hagut %{count} errors
+  global:
+    expand: Desplega
   helpers:
     select:
-      prompt: Si us plau tria
+      default_label: Selecciona...
+      prompt: Tria
+      search_placeholder: Cerca
     submit:
-      create: Crear %{model}
-      submit: Guardar %{model}
-      update: Actualitzar %{model}
+      create: Crea %{model}
+      submit: Desa %{model}
+      update: Actualitza %{model}
   number:
     currency:
       format:
diff --git a/config/locales/defaults/en.yml b/config/locales/defaults/en.yml
index bf860dde4..609c459d9 100644
--- a/config/locales/defaults/en.yml
+++ b/config/locales/defaults/en.yml
@@ -3,6 +3,8 @@ en:
   defaults:
     brand_name: "%{brand_name}"
     product_name: "%{product_name}"
+    common:
+      close: "Close"
   global:
     expand: "Expand"
   activerecord:
@@ -47,6 +49,8 @@ en:
       default: "%Y-%m-%d"
       long: "%B %d, %Y"
       short: "%b %d"
+      month_year: "%B %Y"
+      short_month_year: "%b %Y"
     month_names:
     -
     - January
diff --git a/config/locales/defaults/es.yml b/config/locales/defaults/es.yml
index 82b73c583..47cc3b860 100644
--- a/config/locales/defaults/es.yml
+++ b/config/locales/defaults/es.yml
@@ -153,6 +153,8 @@ es:
   helpers:
     select:
       prompt: Por favor seleccione
+      search_placeholder: Buscar
+      default_label: Seleccionar...
     submit:
       create: Crear %{model}
       submit: Guardar %{model}
diff --git a/config/locales/defaults/fr.yml b/config/locales/defaults/fr.yml
index 5f7e143ed..1c3ea8d5b 100644
--- a/config/locales/defaults/fr.yml
+++ b/config/locales/defaults/fr.yml
@@ -152,9 +152,13 @@ fr:
       header:
         one: 'Impossible d''enregistrer ce(tte) %{model} : %{count} erreur'
         other: 'Impossible d''enregistrer ce(tte) %{model} : %{count} erreurs'
+  global:
+    expand: Développer
   helpers:
     select:
       prompt: Veuillez sélectionner
+      default_label: Sélectionner…
+      search_placeholder: Rechercher
     submit:
       create: Créer un(e) %{model}
       submit: Enregistrer ce(tte) %{model}
diff --git a/config/locales/defaults/hu.yml b/config/locales/defaults/hu.yml
index f288a4016..4cebde9c1 100644
--- a/config/locales/defaults/hu.yml
+++ b/config/locales/defaults/hu.yml
@@ -138,13 +138,10 @@ hu:
   number:
     currency:
       format:
-        delimiter: ''
+        delimiter: " "
         format: "%n %u"
-        precision: 0
+        precision: 2
         separator: ","
-        significant: true
-        strip_insignificant_zeros: true
-        unit: Ft
     format:
       delimiter: " "
       precision: 2
diff --git a/config/locales/doorkeeper.ca.yml b/config/locales/doorkeeper.ca.yml
index 0b7a5f4aa..3f137996e 100644
--- a/config/locales/doorkeeper.ca.yml
+++ b/config/locales/doorkeeper.ca.yml
@@ -46,7 +46,7 @@ ca:
         callback_url: URL de retorn
         confidential: Confidencial?
         confidentiality:
-          'no': No
+          'no': 'No'
           'yes': Sí
         name: Nom
         new: Nova aplicació
@@ -68,6 +68,7 @@ ca:
         authorize: Autoritza
         deny: Denega
       error:
+        go_back: Torna enrere
         title: S'ha produït un error
       form_post:
         title: Envia aquest formulari
@@ -76,6 +77,8 @@ ca:
         prompt: Autoritzes %{client_name} a utilitzar el teu compte?
         title: Autorització requerida
       show:
+        authorization_code_label: 'Codi d''autorització:'
+        copy_instructions: Copia aquest codi i enganxa'l a l'aplicació.
         title: Codi d'autorització
     authorized_applications:
       buttons:
diff --git a/config/locales/doorkeeper.en.yml b/config/locales/doorkeeper.en.yml
index c9190526f..d37e0aea4 100644
--- a/config/locales/doorkeeper.en.yml
+++ b/config/locales/doorkeeper.en.yml
@@ -66,12 +66,15 @@ en:
         deny: 'Deny'
       error:
         title: 'An error has occurred'
+        go_back: 'Go back'
       new:
         title: 'Authorization required'
         prompt: 'Authorize %{client_name} to use your account?'
         able_to: 'This application will be able to'
       show:
         title: 'Authorization code'
+        authorization_code_label: 'Authorization Code:'
+        copy_instructions: 'Copy this code and paste it into the application.'
       form_post:
         title: 'Submit this form'
 
diff --git a/config/locales/doorkeeper.fr.yml b/config/locales/doorkeeper.fr.yml
new file mode 100644
index 000000000..412266539
--- /dev/null
+++ b/config/locales/doorkeeper.fr.yml
@@ -0,0 +1,156 @@
+---
+fr:
+  activerecord:
+    attributes:
+      doorkeeper/application:
+        name: 'Nom'
+        redirect_uri: 'URI de redirection'
+    errors:
+      models:
+        doorkeeper/application:
+          attributes:
+            redirect_uri:
+              fragment_present: 'ne peut pas contenir de fragment.'
+              invalid_uri: 'doit être une URI valide.'
+              unspecified_scheme: 'doit spécifier un schéma.'
+              relative_uri: 'doit être une URI absolue.'
+              secured_uri: 'doit être une URI HTTPS/SSL.'
+              forbidden_uri: 'est interdit par le serveur.'
+            scopes:
+              not_match_configured: "ne correspond pas à ceux configurés sur le serveur."
+
+  doorkeeper:
+    applications:
+      confirmations:
+        destroy: 'Êtes-vous sûr ?'
+      buttons:
+        edit: 'Modifier'
+        destroy: 'Supprimer'
+        submit: 'Envoyer'
+        cancel: 'Annuler'
+        authorize: 'Autoriser'
+      form:
+        error: 'Oups ! Vérifiez votre formulaire pour d''éventuelles erreurs'
+      help:
+        confidential: 'L''application sera utilisée dans un contexte où le client secret peut être gardé confidentiel. Les applications mobiles natives et les applications monopage (SPA) sont considérées comme non confidentielles.'
+        redirect_uri: 'Utilisez une ligne par URI'
+        blank_redirect_uri: "Laissez vide si vous avez configuré votre fournisseur pour utiliser les identifiants client (Client Credentials), le mot de passe du propriétaire de la ressource (Resource Owner Password Credentials) ou tout autre type d'octroi qui ne nécessite pas d'URI de redirection."
+        scopes: 'Séparez les scopes par des espaces. Laissez vide pour utiliser les scopes par défaut.'
+      edit:
+        title: 'Modifier l''application'
+      index:
+        title: 'Vos applications'
+        new: 'Nouvelle application'
+        name: 'Nom'
+        callback_url: 'URL de rappel'
+        confidential: 'Confidentielle ?'
+        actions: 'Actions'
+        confidentiality:
+          'yes': 'Oui'
+          'no': 'Non'
+      new:
+        title: 'Nouvelle application'
+      show:
+        title: 'Application : %{name}'
+        application_id: 'UID'
+        secret: 'Secret'
+        secret_hashed: 'Secret haché'
+        scopes: 'Scopes'
+        confidential: 'Confidentielle'
+        callback_urls: 'URL de rappel'
+        actions: 'Actions'
+        not_defined: 'Non défini'
+
+    authorizations:
+      buttons:
+        authorize: 'Autoriser'
+        deny: 'Refuser'
+      error:
+        title: 'Une erreur s''est produite'
+      new:
+        title: 'Autorisation requise'
+        prompt: 'Autoriser %{client_name} à utiliser votre compte ?'
+        able_to: 'Cette application pourra'
+      show:
+        title: 'Code d''autorisation'
+      form_post:
+        title: 'Envoyer ce formulaire'
+
+    authorized_applications:
+      confirmations:
+        revoke: 'Êtes-vous sûr ?'
+      buttons:
+        revoke: 'Révoquer'
+      index:
+        title: 'Vos applications autorisées'
+        application: 'Application'
+        created_at: 'Créée le'
+        date_format: '%d/%m/%Y %H:%M:%S'
+
+    pre_authorization:
+      status: 'Pré-autorisation'
+
+    errors:
+      messages:
+        # Common error messages
+        invalid_request:
+          unknown: 'La requête ne comporte pas un paramètre obligatoire, inclut une valeur de paramètre non prise en charge ou est malformée d''une autre manière.'
+          missing_param: 'Paramètre obligatoire manquant : %{value}.'
+          request_not_authorized: 'La requête doit être autorisée. Le paramètre obligatoire pour autoriser la requête est manquant ou invalide.'
+          invalid_code_challenge: 'Le code challenge est obligatoire.'
+        invalid_redirect_uri: "L'URI de redirection demandée est malformée ou ne correspond pas à l'URI de redirection du client."
+        unauthorized_client: 'Le client n''est pas autorisé à effectuer cette requête avec cette méthode.'
+        access_denied: 'Le propriétaire de la ressource ou le serveur d''autorisation a refusé la requête.'
+        invalid_scope: 'Le scope demandé est invalide, inconnu ou malformé.'
+        invalid_code_challenge_method:
+          zero: 'Le serveur d''autorisation ne prend pas en charge PKCE car aucune valeur de code_challenge_method n''est acceptée.'
+          one: 'Le code_challenge_method doit être %{challenge_methods}.'
+          other: 'Le code_challenge_method doit être l''un des suivants : %{challenge_methods}.'
+        server_error: 'Le serveur d''autorisation a rencontré une condition inattendue qui l''a empêché de traiter la requête.'
+        temporarily_unavailable: 'Le serveur d''autorisation est actuellement incapable de traiter la requête en raison d''une surcharge temporaire ou d''une maintenance du serveur.'
+
+        # Configuration error messages
+        credential_flow_not_configured: 'Le flux Resource Owner Password Credentials a échoué car Doorkeeper.configure.resource_owner_from_credentials n''est pas configuré.'
+        resource_owner_authenticator_not_configured: 'La recherche de Resource Owner a échoué car Doorkeeper.configure.resource_owner_authenticator n''est pas configuré.'
+        admin_authenticator_not_configured: 'L''accès au panneau d''administration est interdit car Doorkeeper.configure.admin_authenticator n''est pas configuré.'
+
+        # Access grant errors
+        unsupported_response_type: 'Le serveur d''autorisation ne prend pas en charge ce type de réponse.'
+        unsupported_response_mode: 'Le serveur d''autorisation ne prend pas en charge ce mode de réponse.'
+
+        # Access token errors
+        invalid_client: 'L''authentification du client a échoué en raison d''un client inconnu, d''une authentification client manquante ou d''une méthode d''authentification non prise en charge.'
+        invalid_grant: 'L''octroi d''autorisation fourni est invalide, expiré, révoqué, ne correspond pas à l''URI de redirection utilisée dans la requête d''autorisation, ou a été émis pour un autre client.'
+        unsupported_grant_type: 'Le type d''octroi d''autorisation n''est pas pris en charge par le serveur d''autorisation.'
+
+        invalid_token:
+          revoked: "Le jeton d'accès a été révoqué"
+          expired: "Le jeton d'accès a expiré"
+          unknown: "Le jeton d'accès est invalide"
+        revoke:
+          unauthorized: "Vous n'êtes pas autorisé à révoquer ce jeton"
+
+        forbidden_token:
+          missing_scope: 'L''accès à cette ressource requiert le scope "%{oauth_scopes}".'
+
+    flash:
+      applications:
+        create:
+          notice: 'Application créée.'
+        destroy:
+          notice: 'Application supprimée.'
+        update:
+          notice: 'Application mise à jour.'
+      authorized_applications:
+        destroy:
+          notice: 'Application révoquée.'
+
+    layouts:
+      admin:
+        title: 'Doorkeeper'
+        nav:
+          oauth2_provider: 'Fournisseur OAuth2'
+          applications: 'Applications'
+          home: 'Accueil'
+      application:
+        title: 'Autorisation OAuth requise'
diff --git a/config/locales/doorkeeper.hu.yml b/config/locales/doorkeeper.hu.yml
new file mode 100644
index 000000000..4038b4776
--- /dev/null
+++ b/config/locales/doorkeeper.hu.yml
@@ -0,0 +1,142 @@
+hu:
+  activerecord:
+    attributes:
+      doorkeeper/application:
+        name: 'Név'
+        redirect_uri: 'Átirányítási URI'
+    errors:
+      models:
+        doorkeeper/application:
+          attributes:
+            redirect_uri:
+              fragment_present: 'nem tartalmazhat töredéket.'
+              invalid_uri: 'érvényes URI kell legyen.'
+              unspecified_scheme: 'meg kell adni a sémát.'
+              relative_uri: 'abszolút URI kell legyen.'
+              secured_uri: 'HTTPS/SSL URI kell legyen.'
+              forbidden_uri: 'a szerver nem engedélyezi.'
+            scopes:
+              not_match_configured: "nem egyezik a szerveren beállítottal."
+  doorkeeper:
+    applications:
+      confirmations:
+        destroy: 'Biztosan törlöd?'
+      buttons:
+        edit: 'Szerkesztés'
+        destroy: 'Törlés'
+        submit: 'Küldés'
+        cancel: 'Mégsem'
+        authorize: 'Engedélyezés'
+      form:
+        error: 'Hoppá! Ellenőrizd az űrlapot, mert lehetnek hibák'
+      help:
+        confidential: 'Az alkalmazás olyan esetben kerül használatra, ahol az ügyfél titka bizalmas maradhat. A natív mobilalkalmazások és az egyoldalas alkalmazások (SPA) nem bizalmasnak minősülnek.'
+        redirect_uri: 'URI-nként egy sort használj'
+        blank_redirect_uri: "Hagyd üresen, ha a szolgáltatód Client Credentials, Resource Owner Password Credentials vagy más olyan hitelesítési folyamatot használ, amely nem igényel átirányítási URI-t."
+        scopes: 'A hatóköröket szóközzel válaszd el. Hagyd üresen az alapértelmezett hatókörök használatához.'
+      edit:
+        title: 'Alkalmazás szerkesztése'
+      index:
+        title: 'Alkalmazásaid'
+        new: 'Új alkalmazás'
+        name: 'Név'
+        callback_url: 'Visszahívási URL'
+        confidential: 'Bizalmas?'
+        actions: 'Műveletek'
+        confidentiality:
+          'yes': 'Igen'
+          'no': 'Nem'
+      new:
+        title: 'Új alkalmazás'
+      show:
+        title: 'Alkalmazás: %{name}'
+        application_id: 'UID'
+        secret: 'Titok'
+        secret_hashed: 'Titkosított titok'
+        scopes: 'Hatókörök'
+        confidential: 'Bizalmas'
+        callback_urls: 'Visszahívási URL-ek'
+        actions: 'Műveletek'
+        not_defined: 'Nincs megadva'
+    authorizations:
+      buttons:
+        authorize: 'Engedélyezés'
+        deny: 'Elutasítás'
+      error:
+        title: 'Hiba történt'
+        go_back: 'Vissza'
+      new:
+        title: 'Engedélyezés szükséges'
+        prompt: 'Engedélyezed, hogy %{client_name} hozzáférjen a fiókodhoz?'
+        able_to: 'Az alkalmazás a következőkre lesz jogosult'
+      show:
+        title: 'Engedélyezési kód'
+        authorization_code_label: 'Engedélyezési kód:'
+        copy_instructions: 'Másold ki ezt a kódot, és illeszd be az alkalmazásba.'
+      form_post:
+        title: 'Küldd el ezt az űrlapot'
+    authorized_applications:
+      confirmations:
+        revoke: 'Biztosan visszavonod?'
+      buttons:
+        revoke: 'Visszavonás'
+      index:
+        title: 'Engedélyezett alkalmazásaid'
+        application: 'Alkalmazás'
+        created_at: 'Létrehozva'
+        date_format: '%Y.%m.%d %H:%M:%S'
+    pre_authorization:
+      status: 'Előzetes engedélyezés'
+    errors:
+      messages:
+        invalid_request:
+          unknown: 'A kérésből hiányzik egy kötelező paraméter, nem támogatott paraméterértéket tartalmaz, vagy egyéb szempontból hibás.'
+          missing_param: 'Hiányzó kötelező paraméter: %{value}.'
+          request_not_authorized: 'A kérést engedélyezni kell. A kérés engedélyezéséhez szükséges paraméter hiányzik vagy érvénytelen.'
+          invalid_code_challenge: 'A kódkihívás megadása kötelező.'
+        invalid_redirect_uri: "A kért átirányítási URI hibás formátumú vagy nem egyezik az ügyfél átirányítási URI-jával."
+        unauthorized_client: 'Az ügyfél nem jogosult erre a kérésre ezzel a módszerrel.'
+        access_denied: 'Az erőforrás tulajdonosa vagy az engedélyezési szerver elutasította a kérést.'
+        invalid_scope: 'A kért hatókör érvénytelen, ismeretlen vagy hibás formátumú.'
+        invalid_code_challenge_method:
+          zero: 'Az engedélyezési szerver nem támogatja a PKCE-t, mivel nincsenek elfogadott code_challenge_method értékek.'
+          one: 'A code_challenge_method értéke csak %{challenge_methods} lehet.'
+          other: 'A code_challenge_method értéke a következők egyike lehet: %{challenge_methods}.'
+        server_error: 'Az engedélyezési szerver váratlan hibába ütközött, amely megakadályozta a kérés teljesítését.'
+        temporarily_unavailable: 'Az engedélyezési szerver jelenleg nem tudja kezelni a kérést a szerver túlterheltsége vagy karbantartása miatt.'
+        credential_flow_not_configured: 'A Resource Owner Password Credentials folyamat meghiúsult, mert a Doorkeeper.configure.resource_owner_from_credentials nincs beállítva.'
+        resource_owner_authenticator_not_configured: 'Az erőforrás-tulajdonos keresése meghiúsult, mert a Doorkeeper.configure.resource_owner_authenticator nincs beállítva.'
+        admin_authenticator_not_configured: 'Az adminisztrációs felülethez való hozzáférés le van tiltva, mert a Doorkeeper.configure.admin_authenticator nincs beállítva.'
+        unsupported_response_type: 'Az engedélyezési szerver nem támogatja ezt a választípust.'
+        unsupported_response_mode: 'Az engedélyezési szerver nem támogatja ezt a válaszmódot.'
+        invalid_client: 'Az ügyfél hitelesítése sikertelen: ismeretlen ügyfél, hiányzó hitelesítés vagy nem támogatott hitelesítési módszer.'
+        invalid_grant: 'A megadott engedélyezési jogosultság érvénytelen, lejárt, visszavont, nem egyezik az engedélyezési kérésben használt átirányítási URI-val, vagy másik ügyfélnek lett kiadva.'
+        unsupported_grant_type: 'Az engedélyezési jogosultság típusát az engedélyezési szerver nem támogatja.'
+        invalid_token:
+          revoked: "A hozzáférési token vissza lett vonva"
+          expired: "A hozzáférési token lejárt"
+          unknown: "A hozzáférési token érvénytelen"
+        revoke:
+          unauthorized: "Nincs jogosultságod visszavonni ezt a tokent"
+        forbidden_token:
+          missing_scope: 'Ehhez az erőforráshoz a következő hatókör szükséges: "%{oauth_scopes}".'
+    flash:
+      applications:
+        create:
+          notice: 'Az alkalmazás létrehozva.'
+        destroy:
+          notice: 'Az alkalmazás törölve.'
+        update:
+          notice: 'Az alkalmazás frissítve.'
+      authorized_applications:
+        destroy:
+          notice: 'Az alkalmazás hozzáférése visszavonva.'
+    layouts:
+      admin:
+        title: 'Doorkeeper'
+        nav:
+          oauth2_provider: 'OAuth2 Provider'
+          applications: 'Alkalmazások'
+          home: 'Kezdőlap'
+      application:
+        title: 'OAuth engedélyezés szükséges'
diff --git a/config/locales/mailers/invitation_mailer/ca.yml b/config/locales/mailers/invitation_mailer/ca.yml
index e00247801..64274f354 100644
--- a/config/locales/mailers/invitation_mailer/ca.yml
+++ b/config/locales/mailers/invitation_mailer/ca.yml
@@ -2,4 +2,4 @@
 ca:
   invitation_mailer:
     invite_email:
-      subject: "%{inviter} t'ha convidat a unir-te al seu grup familiar a %{product_name}!"
+      subject: "%{inviter} t'ha convidat a unir-te al seu compte de %{product_name}!"
diff --git a/config/locales/mailers/invitation_mailer/hu.yml b/config/locales/mailers/invitation_mailer/hu.yml
new file mode 100644
index 000000000..5ea9e145d
--- /dev/null
+++ b/config/locales/mailers/invitation_mailer/hu.yml
@@ -0,0 +1,5 @@
+---
+hu:
+  invitation_mailer:
+    invite_email:
+      subject: "%{inviter} meghívott, hogy csatlakozz a háztartásához a %{product_name} alkalmazásban!"
diff --git a/config/locales/mailers/pdf_import_mailer/ca.yml b/config/locales/mailers/pdf_import_mailer/ca.yml
new file mode 100644
index 000000000..1170cd293
--- /dev/null
+++ b/config/locales/mailers/pdf_import_mailer/ca.yml
@@ -0,0 +1,5 @@
+---
+ca:
+  pdf_import_mailer:
+    next_steps:
+      subject: S'ha analitzat el teu document PDF - %{product_name}
diff --git a/config/locales/mailers/pdf_import_mailer/fr.yml b/config/locales/mailers/pdf_import_mailer/fr.yml
new file mode 100644
index 000000000..63188c132
--- /dev/null
+++ b/config/locales/mailers/pdf_import_mailer/fr.yml
@@ -0,0 +1,5 @@
+---
+fr:
+  pdf_import_mailer:
+    next_steps:
+      subject: "Votre document PDF a été analysé - %{product_name}"
diff --git a/config/locales/mailers/pdf_import_mailer/hu.yml b/config/locales/mailers/pdf_import_mailer/hu.yml
new file mode 100644
index 000000000..1c8236762
--- /dev/null
+++ b/config/locales/mailers/pdf_import_mailer/hu.yml
@@ -0,0 +1,5 @@
+---
+hu:
+  pdf_import_mailer:
+    next_steps:
+      subject: "A PDF dokumentumod elemzése kész – %{product_name}"
diff --git a/config/locales/models/account/ca.yml b/config/locales/models/account/ca.yml
index bc22cd01f..43c7f9960 100644
--- a/config/locales/models/account/ca.yml
+++ b/config/locales/models/account/ca.yml
@@ -1,12 +1,25 @@
 ---
 ca:
+  account_order:
+    balance_asc:
+      label: Saldo (de menor a major)
+      label_short: Saldo ↑
+    balance_desc:
+      label: Saldo (de major a menor)
+      label_short: Saldo ↓
+    name_asc:
+      label: Nom (A-Z)
+      label_short: Nom ↑
+    name_desc:
+      label: Nom (Z-A)
+      label_short: Nom ↓
   activerecord:
     attributes:
       account:
         balance: Saldo
-        currency: Moneda
-        family: Família
-        family_id: Família
+        currency: Divisa
+        family: "%{moniker}"
+        family_id: "%{moniker}"
         name: Nom
         subtype: Subtipus
     models:
@@ -15,8 +28,7 @@ ca:
       account/depository: Compte bancari
       account/investment: Inversió
       account/loan: Préstec
-      account/other_asset: Altres actius
-      account/other_liability: Altres passius
+      account/other_asset: Altre actiu
+      account/other_liability: Altre passiu
       account/property: Immoble
       account/vehicle: Vehicle
-
diff --git a/config/locales/models/account/en.yml b/config/locales/models/account/en.yml
index e4c882b9c..df47d3302 100644
--- a/config/locales/models/account/en.yml
+++ b/config/locales/models/account/en.yml
@@ -1,5 +1,18 @@
 ---
 en:
+  account_order:
+    balance_asc:
+      label: Balance (Low to High)
+      label_short: Balance ↑
+    balance_desc:
+      label: Balance (High to Low)
+      label_short: Balance ↓
+    name_asc:
+      label: Name (A-Z)
+      label_short: Name ↑
+    name_desc:
+      label: Name (Z-A)
+      label_short: Name ↓
   activerecord:
     attributes:
       account:
diff --git a/config/locales/models/account/hu.yml b/config/locales/models/account/hu.yml
new file mode 100644
index 000000000..7966b9b53
--- /dev/null
+++ b/config/locales/models/account/hu.yml
@@ -0,0 +1,21 @@
+---
+hu:
+  activerecord:
+    attributes:
+      account:
+        balance: Egyenleg
+        currency: Pénznem
+        family: "%{moniker}"
+        family_id: "%{moniker}"
+        name: Név
+        subtype: Altípus
+    models:
+      account: Számla
+      account/credit: Hitelkártya
+      account/depository: Bankszámla
+      account/investment: Befektetés
+      account/loan: Kölcsön
+      account/other_asset: Egyéb vagyon
+      account/other_liability: Egyéb kötelezettség
+      account/property: Ingatlan
+      account/vehicle: Jármű
diff --git a/config/locales/models/account_statement/ca.yml b/config/locales/models/account_statement/ca.yml
new file mode 100644
index 000000000..f264559e8
--- /dev/null
+++ b/config/locales/models/account_statement/ca.yml
@@ -0,0 +1,30 @@
+---
+ca:
+  activerecord:
+    attributes:
+      account_statement:
+        account: Compte
+        account_last4_hint: Quatre últims dígits del compte
+        account_name_hint: Pista del nom del compte
+        closing_balance: Saldo final
+        content_sha256: Resum del contingut
+        currency: Divisa
+        filename: Nom del fitxer
+        institution_name_hint: Pista de la institució
+        opening_balance: Saldo inicial
+        original_file: Fitxer de l'extracte
+        period_end_on: Final del període
+        period_start_on: Inici del període
+    errors:
+      models:
+        account_statement:
+          attributes:
+            checksum:
+              duplicate_statement_file: ja s'ha pujat per a aquesta família
+            content_sha256:
+              duplicate_statement_file: ja s'ha pujat per a aquesta família
+            original_file:
+              invalid_format: ha de ser un fitxer PDF, CSV o XLSX
+              too_large: és massa gran. La mida màxima és %{max_mb}MB
+            period_end_on:
+              on_or_after_start: ha de ser igual o posterior a l'inici del període
diff --git a/config/locales/models/account_statement/en.yml b/config/locales/models/account_statement/en.yml
new file mode 100644
index 000000000..d801052d4
--- /dev/null
+++ b/config/locales/models/account_statement/en.yml
@@ -0,0 +1,30 @@
+---
+en:
+  activerecord:
+    attributes:
+      account_statement:
+        account: Account
+        account_last4_hint: Account last four
+        account_name_hint: Account name hint
+        closing_balance: Closing balance
+        content_sha256: Content digest
+        currency: Currency
+        filename: Filename
+        institution_name_hint: Institution hint
+        opening_balance: Opening balance
+        original_file: Statement file
+        period_end_on: Period end
+        period_start_on: Period start
+    errors:
+      models:
+        account_statement:
+          attributes:
+            checksum:
+              duplicate_statement_file: has already been uploaded for this family
+            content_sha256:
+              duplicate_statement_file: has already been uploaded for this family
+            original_file:
+              invalid_format: must be a PDF, CSV, or XLSX file
+              too_large: is too large. Maximum size is %{max_mb}MB
+            period_end_on:
+              on_or_after_start: must be on or after the period start
diff --git a/config/locales/models/account_statement/hu.yml b/config/locales/models/account_statement/hu.yml
new file mode 100644
index 000000000..6ae639f88
--- /dev/null
+++ b/config/locales/models/account_statement/hu.yml
@@ -0,0 +1,30 @@
+---
+hu:
+  activerecord:
+    attributes:
+      account_statement:
+        account: Számla
+        account_last4_hint: Számla utolsó négy számjegye
+        account_name_hint: Számlanév-tipp
+        closing_balance: Záró egyenleg
+        content_sha256: Tartalom-összefoglaló
+        currency: Pénznem
+        filename: Fájlnév
+        institution_name_hint: Intézménynév-tipp
+        opening_balance: Nyitóegyenleg
+        original_file: Kimutatásfájl
+        period_end_on: Időszak vége
+        period_start_on: Időszak kezdete
+    errors:
+      models:
+        account_statement:
+          attributes:
+            checksum:
+              duplicate_statement_file: már fel lett töltve ennél a háztartásnál
+            content_sha256:
+              duplicate_statement_file: már fel lett töltve ennél a háztartásnál
+            original_file:
+              invalid_format: csak PDF, CSV vagy XLSX fájl lehet
+              too_large: túl nagy. A maximális méret %{max_mb} MB
+            period_end_on:
+              on_or_after_start: nem lehet korábbi, mint az időszak kezdete
diff --git a/config/locales/models/address/ca.yml b/config/locales/models/address/ca.yml
index d879be675..e43482fad 100644
--- a/config/locales/models/address/ca.yml
+++ b/config/locales/models/address/ca.yml
@@ -9,4 +9,3 @@ ca:
       postal_code: Codi postal
       region: Regió
     format: "%{line1} %{line2}, %{locality}, %{region} %{postal_code} %{country}"
-
diff --git a/config/locales/models/address/hu.yml b/config/locales/models/address/hu.yml
new file mode 100644
index 000000000..6188d3203
--- /dev/null
+++ b/config/locales/models/address/hu.yml
@@ -0,0 +1,11 @@
+---
+hu:
+  address:
+    attributes:
+      country: Ország
+      line1: Cím 1. sor
+      line2: Cím 2. sor
+      locality: Helység
+      postal_code: Irányítószám
+      region: Megye/Régió
+    format: "%{country} %{region} %{postal_code} %{locality}, %{line1} %{line2}"
diff --git a/config/locales/models/api_key/ca.yml b/config/locales/models/api_key/ca.yml
new file mode 100644
index 000000000..95e88eb7d
--- /dev/null
+++ b/config/locales/models/api_key/ca.yml
@@ -0,0 +1,8 @@
+---
+ca:
+  activerecord:
+    errors:
+      models:
+        api_key:
+          cannot_destroy_demo_key: No es pot eliminar la clau API de monitoratge de
+            demostració
diff --git a/config/locales/models/api_key/en.yml b/config/locales/models/api_key/en.yml
new file mode 100644
index 000000000..88edff14e
--- /dev/null
+++ b/config/locales/models/api_key/en.yml
@@ -0,0 +1,7 @@
+---
+en:
+  activerecord:
+    errors:
+      models:
+        api_key:
+          cannot_destroy_demo_key: "Cannot destroy demo monitoring API key"
diff --git a/config/locales/models/api_key/hu.yml b/config/locales/models/api_key/hu.yml
new file mode 100644
index 000000000..78f98c066
--- /dev/null
+++ b/config/locales/models/api_key/hu.yml
@@ -0,0 +1,7 @@
+---
+hu:
+  activerecord:
+    errors:
+      models:
+        api_key:
+          cannot_destroy_demo_key: "A demo felügyeleti API-kulcs nem törölhető"
diff --git a/config/locales/models/brex_item/ca.yml b/config/locales/models/brex_item/ca.yml
new file mode 100644
index 000000000..ce59c6867
--- /dev/null
+++ b/config/locales/models/brex_item/ca.yml
@@ -0,0 +1,14 @@
+---
+ca:
+  activerecord:
+    attributes:
+      brex_item:
+        base_url: URL base
+        name: Nom de la connexió
+        token: Token
+    errors:
+      models:
+        brex_item:
+          attributes:
+            base_url:
+              official_hosts_only: ha de ser buit, https://api.brex.com o https://api-staging.brex.com
diff --git a/config/locales/models/brex_item/en.yml b/config/locales/models/brex_item/en.yml
new file mode 100644
index 000000000..4d8bf067b
--- /dev/null
+++ b/config/locales/models/brex_item/en.yml
@@ -0,0 +1,14 @@
+---
+en:
+  activerecord:
+    attributes:
+      brex_item:
+        base_url: Base URL
+        name: Connection name
+        token: Token
+    errors:
+      models:
+        brex_item:
+          attributes:
+            base_url:
+              official_hosts_only: must be blank, https://api.brex.com, or https://api-staging.brex.com
diff --git a/config/locales/models/brex_item/hu.yml b/config/locales/models/brex_item/hu.yml
new file mode 100644
index 000000000..0386c1a44
--- /dev/null
+++ b/config/locales/models/brex_item/hu.yml
@@ -0,0 +1,14 @@
+---
+hu:
+  activerecord:
+    attributes:
+      brex_item:
+        base_url: Alap URL
+        name: Kapcsolat neve
+        token: Token
+    errors:
+      models:
+        brex_item:
+          attributes:
+            base_url:
+              official_hosts_only: üres kell legyen, vagy https://api.brex.com, vagy https://api-staging.brex.com
diff --git a/config/locales/models/category/ca.yml b/config/locales/models/category/ca.yml
index 310293577..ffa650927 100644
--- a/config/locales/models/category/ca.yml
+++ b/config/locales/models/category/ca.yml
@@ -2,6 +2,28 @@
 ca:
   models:
     category:
+      defaults:
+        entertainment: Oci
+        fees: Comissions
+        food_and_drink: Menjar i begudes
+        gifts_and_donations: Regals i donacions
+        groceries: Alimentació
+        healthcare: Salut
+        home_improvement: Millora de la llar
+        income: Ingressos
+        insurance: Assegurances
+        loan_payments: Pagaments de préstecs
+        mortgage_rent: Hipoteca / Lloguer
+        personal_care: Cura personal
+        savings_and_investments: Estalvis i inversions
+        services: Serveis
+        shopping: Compres
+        sports_and_fitness: Esport i fitness
+        subscriptions: Subscripcions
+        taxes: Impostos
+        transportation: Transport
+        travel: Viatges
+        utilities: Subministraments
+      investment_contributions: Contribucions d'inversió
       other_investments: Altres inversions
       uncategorized: Sense categoria
-      investment_contributions: Contribucions d'inversió
diff --git a/config/locales/models/category/en.yml b/config/locales/models/category/en.yml
index 749f80860..7216b8a42 100644
--- a/config/locales/models/category/en.yml
+++ b/config/locales/models/category/en.yml
@@ -5,3 +5,25 @@ en:
       uncategorized: Uncategorized
       other_investments: Other Investments
       investment_contributions: Investment Contributions
+      defaults:
+        income: Income
+        food_and_drink: Food & Drink
+        groceries: Groceries
+        shopping: Shopping
+        transportation: Transportation
+        travel: Travel
+        entertainment: Entertainment
+        healthcare: Healthcare
+        personal_care: Personal Care
+        home_improvement: Home Improvement
+        mortgage_rent: Mortgage / Rent
+        utilities: Utilities
+        subscriptions: Subscriptions
+        insurance: Insurance
+        sports_and_fitness: Sports & Fitness
+        gifts_and_donations: Gifts & Donations
+        taxes: Taxes
+        loan_payments: Loan Payments
+        services: Services
+        fees: Fees
+        savings_and_investments: Savings & Investments
diff --git a/config/locales/models/category/hu.yml b/config/locales/models/category/hu.yml
new file mode 100644
index 000000000..605ead1cf
--- /dev/null
+++ b/config/locales/models/category/hu.yml
@@ -0,0 +1,29 @@
+---
+hu:
+  models:
+    category:
+      uncategorized: Kategorizálatlan
+      other_investments: Egyéb befektetések
+      investment_contributions: Befektetési befizetések
+      defaults:
+        income: Bevétel
+        food_and_drink: Étel és ital
+        groceries: Élelmiszer
+        shopping: Vásárlás
+        transportation: Közlekedés
+        travel: Utazás
+        entertainment: Szórakozás
+        healthcare: Egészségügy
+        personal_care: Személyes gondozás
+        home_improvement: Lakásfelújítás
+        mortgage_rent: Jelzálog / Bérleti díj
+        utilities: Rezsi
+        subscriptions: Előfizetések
+        insurance: Biztosítás
+        sports_and_fitness: Sport és fitnesz
+        gifts_and_donations: Ajándékok és adományok
+        taxes: Adók
+        loan_payments: Hitelrészletek
+        services: Szolgáltatások
+        fees: Díjak
+        savings_and_investments: Megtakarítások és befektetések
diff --git a/config/locales/models/category_import/ca.yml b/config/locales/models/category_import/ca.yml
new file mode 100644
index 000000000..9b7124b3f
--- /dev/null
+++ b/config/locales/models/category_import/ca.yml
@@ -0,0 +1,8 @@
+---
+ca:
+  activerecord:
+    errors:
+      models:
+        category_import:
+          missing_columns: 'Falten columnes obligatòries: %{columns}'
+          own_parent: La categoria '%{name}' no pot ser el seu propi pare
diff --git a/config/locales/models/category_import/en.yml b/config/locales/models/category_import/en.yml
new file mode 100644
index 000000000..46877bc47
--- /dev/null
+++ b/config/locales/models/category_import/en.yml
@@ -0,0 +1,8 @@
+---
+en:
+  activerecord:
+    errors:
+      models:
+        category_import:
+          own_parent: "Category '%{name}' cannot be its own parent"
+          missing_columns: "Missing required columns: %{columns}"
diff --git a/config/locales/models/category_import/hu.yml b/config/locales/models/category_import/hu.yml
new file mode 100644
index 000000000..474990177
--- /dev/null
+++ b/config/locales/models/category_import/hu.yml
@@ -0,0 +1,8 @@
+---
+hu:
+  activerecord:
+    errors:
+      models:
+        category_import:
+          own_parent: "A(z) '%{name}' kategória nem lehet saját maga szülője"
+          missing_columns: "Hiányzó kötelező oszlopok: %{columns}"
diff --git a/config/locales/models/chat/ca.yml b/config/locales/models/chat/ca.yml
new file mode 100644
index 000000000..7bb662ddb
--- /dev/null
+++ b/config/locales/models/chat/ca.yml
@@ -0,0 +1,11 @@
+---
+ca:
+  chat:
+    errors:
+      default: No s'ha pogut generar una resposta. Torna-ho a provar.
+      misconfigured: El proveïdor d'IA no està configurat correctament. Contacta amb
+        el teu administrador.
+      rate_limited: El proveïdor d'IA té un límit de peticions ara mateix. Torna-ho
+        a provar d'aquí a uns minuts.
+      temporarily_unavailable: El proveïdor d'IA no està disponible temporalment.
+        Torna-ho a provar d'aquí a uns minuts.
diff --git a/config/locales/models/chat/en.yml b/config/locales/models/chat/en.yml
new file mode 100644
index 000000000..705495c78
--- /dev/null
+++ b/config/locales/models/chat/en.yml
@@ -0,0 +1,8 @@
+---
+en:
+  chat:
+    errors:
+      rate_limited: "The AI provider is rate limited right now. Please try again in a few minutes."
+      temporarily_unavailable: "The AI provider is temporarily unavailable right now. Please try again in a few minutes."
+      misconfigured: "The AI provider is not configured correctly. Please contact your administrator."
+      default: "Failed to generate a response. Please try again."
diff --git a/config/locales/models/chat/es.yml b/config/locales/models/chat/es.yml
new file mode 100644
index 000000000..22e6494be
--- /dev/null
+++ b/config/locales/models/chat/es.yml
@@ -0,0 +1,8 @@
+---
+es:
+  chat:
+    errors:
+      rate_limited: "El proveedor de IA está limitando acceso a su API. Vuelve a intentarlo en unos minutos."
+      temporarily_unavailable: "El proveedor de IA no está disponible temporalmente. Vuelve a intentarlo en unos minutos."
+      misconfigured: "El proveedor de IA no está configurado correctamente. Ponte en contacto con tu administrador."
+      default: "No se pudo generar una respuesta. Inténtalo de nuevo."
diff --git a/config/locales/models/chat/hu.yml b/config/locales/models/chat/hu.yml
new file mode 100644
index 000000000..176e0265c
--- /dev/null
+++ b/config/locales/models/chat/hu.yml
@@ -0,0 +1,8 @@
+---
+hu:
+  chat:
+    errors:
+      rate_limited: "Az AI szolgáltató éppen korlátozott. Próbáld újra néhány perc múlva."
+      temporarily_unavailable: "Az AI szolgáltató jelenleg nem elérhető. Próbáld újra néhány perc múlva."
+      misconfigured: "Az AI szolgáltató nincs megfelelően beállítva. Kérjük, vedd fel a kapcsolatot a rendszergazdával."
+      default: "Nem sikerült választ generálni. Kérjük, próbáld újra."
diff --git a/config/locales/models/coinbase_account/ca.yml b/config/locales/models/coinbase_account/ca.yml
new file mode 100644
index 000000000..3379622a3
--- /dev/null
+++ b/config/locales/models/coinbase_account/ca.yml
@@ -0,0 +1,5 @@
+---
+ca:
+  coinbase:
+    processor:
+      paid_via: Pagat amb %{method}
diff --git a/config/locales/models/coinbase_account/fr.yml b/config/locales/models/coinbase_account/fr.yml
new file mode 100644
index 000000000..ea8844097
--- /dev/null
+++ b/config/locales/models/coinbase_account/fr.yml
@@ -0,0 +1,5 @@
+---
+fr:
+  coinbase:
+    processor:
+      paid_via: "Payé via %{method}"
diff --git a/config/locales/models/coinbase_account/hu.yml b/config/locales/models/coinbase_account/hu.yml
new file mode 100644
index 000000000..7e72b9b1a
--- /dev/null
+++ b/config/locales/models/coinbase_account/hu.yml
@@ -0,0 +1,5 @@
+---
+hu:
+  coinbase:
+    processor:
+      paid_via: "Fizetve: %{method}"
diff --git a/config/locales/models/coinstats_item/ca.yml b/config/locales/models/coinstats_item/ca.yml
index 2aadcea9b..d6d9f697e 100644
--- a/config/locales/models/coinstats_item/ca.yml
+++ b/config/locales/models/coinstats_item/ca.yml
@@ -4,7 +4,7 @@ ca:
     coinstats_item:
       syncer:
         calculating_balances: S'estan calculant els saldos...
-        checking_configuration: S'està comprovant la configuració del moneder...
-        importing_wallets: S'estan important moneders de CoinStats...
-        processing_holdings: S'estan processant les participacions...
-        wallets_need_setup: "%{count} moneders necessiten configuració..."
+        checking_configuration: S'està comprovant la configuració del compte de CoinStats...
+        importing_wallets: S'estan important comptes de cripto des de CoinStats...
+        processing_holdings: S'estan processant les posicions...
+        wallets_need_setup: "%{count} comptes de cripto necessiten configuració..."
diff --git a/config/locales/models/coinstats_item/hu.yml b/config/locales/models/coinstats_item/hu.yml
new file mode 100644
index 000000000..e39c1d470
--- /dev/null
+++ b/config/locales/models/coinstats_item/hu.yml
@@ -0,0 +1,10 @@
+---
+hu:
+  models:
+    coinstats_item:
+      syncer:
+        importing_wallets: Kriptószámlák importálása a CoinStats-ból...
+        checking_configuration: CoinStats fiók konfigurációjának ellenőrzése...
+        wallets_need_setup: "%{count} kriptószámlának szükséges a beállítás..."
+        processing_holdings: Befektetések feldolgozása...
+        calculating_balances: Egyenlegek kiszámítása...
diff --git a/config/locales/models/entry/hu.yml b/config/locales/models/entry/hu.yml
new file mode 100644
index 000000000..2ea467599
--- /dev/null
+++ b/config/locales/models/entry/hu.yml
@@ -0,0 +1,9 @@
+---
+hu:
+  activerecord:
+    errors:
+      models:
+        entry:
+          attributes:
+            base:
+              invalid_sell_quantity: nem lehet eladni %{sell_qty} részvényt (%{ticker}), mert csak %{current_qty} részvényed van
diff --git a/config/locales/models/import/ca.yml b/config/locales/models/import/ca.yml
index 56ecfa5c6..ffee0098d 100644
--- a/config/locales/models/import/ca.yml
+++ b/config/locales/models/import/ca.yml
@@ -3,7 +3,11 @@ ca:
   activerecord:
     attributes:
       import:
-        currency: Moneda
+        col_sep: Separador de columnes
+        col_seps:
+          comma: Coma (,)
+          semicolon: Punt i coma (;)
+        currency: Divisa
         number_format: Format numèric
     errors:
       models:
@@ -11,4 +15,5 @@ ca:
           attributes:
             raw_file_str:
               invalid_csv_format: no és un format CSV vàlid
-
+          duplicate_headers: 'Les capçaleres del CSV es normalitzen en columnes duplicades:
+            %{columns}'
diff --git a/config/locales/models/import/en.yml b/config/locales/models/import/en.yml
index 36a901518..1ff592eba 100644
--- a/config/locales/models/import/en.yml
+++ b/config/locales/models/import/en.yml
@@ -3,11 +3,16 @@ en:
   activerecord:
     attributes:
       import:
+        col_sep: Column separator
+        col_seps:
+          comma: Comma (,)
+          semicolon: Semicolon (;)
         currency: Currency
         number_format: Number Format
     errors:
       models:
         import:
+          duplicate_headers: "CSV headers normalize to duplicate columns: %{columns}"
           attributes:
             raw_file_str:
               invalid_csv_format: is not a valid CSV format
diff --git a/config/locales/models/import/hu.yml b/config/locales/models/import/hu.yml
new file mode 100644
index 000000000..f56aa9371
--- /dev/null
+++ b/config/locales/models/import/hu.yml
@@ -0,0 +1,14 @@
+---
+hu:
+  activerecord:
+    attributes:
+      import:
+        currency: Pénznem
+        number_format: Számformátum
+    errors:
+      models:
+        import:
+          duplicate_headers: "A CSV fejlécek duplikált oszlopokra normalizálódnak: %{columns}"
+          attributes:
+            raw_file_str:
+              invalid_csv_format: nem érvényes CSV formátum
diff --git a/config/locales/models/indexa_capital_item/ca.yml b/config/locales/models/indexa_capital_item/ca.yml
new file mode 100644
index 000000000..be3abb1b1
--- /dev/null
+++ b/config/locales/models/indexa_capital_item/ca.yml
@@ -0,0 +1,8 @@
+---
+ca:
+  activerecord:
+    errors:
+      models:
+        indexa_capital_item:
+          credentials_required: Cal la variable d'entorn INDEXA_API_TOKEN o bé les
+            credencials d'usuari/document/contrasenya
diff --git a/config/locales/models/indexa_capital_item/en.yml b/config/locales/models/indexa_capital_item/en.yml
new file mode 100644
index 000000000..66cbcc3c3
--- /dev/null
+++ b/config/locales/models/indexa_capital_item/en.yml
@@ -0,0 +1,7 @@
+---
+en:
+  activerecord:
+    errors:
+      models:
+        indexa_capital_item:
+          credentials_required: "Either INDEXA_API_TOKEN env var or username/document/password credentials are required"
diff --git a/config/locales/models/indexa_capital_item/hu.yml b/config/locales/models/indexa_capital_item/hu.yml
new file mode 100644
index 000000000..d416d4d39
--- /dev/null
+++ b/config/locales/models/indexa_capital_item/hu.yml
@@ -0,0 +1,7 @@
+---
+hu:
+  activerecord:
+    errors:
+      models:
+        indexa_capital_item:
+          credentials_required: "Az INDEXA_API_TOKEN környezeti változó vagy felhasználónév/dokumentum/jelszó hitelesítő adatok megadása kötelező"
diff --git a/config/locales/models/period/ca.yml b/config/locales/models/period/ca.yml
new file mode 100644
index 000000000..f63df2d4a
--- /dev/null
+++ b/config/locales/models/period/ca.yml
@@ -0,0 +1,54 @@
+---
+ca:
+  period:
+    all_time:
+      comparison_label: vs. inici
+      label: Sempre
+      label_short: Tot
+    current_month:
+      comparison_label: vs. inici de mes
+      label: Mes en curs
+      label_short: MTD
+    current_week:
+      comparison_label: vs. inici de setmana
+      label: Setmana en curs
+      label_short: STD
+    current_year:
+      comparison_label: vs. inici d'any
+      label: Any en curs
+      label_short: YTD
+    custom:
+      label: Període personalitzat
+      label_short: Personalitzat
+    last_10_years:
+      comparison_label: vs. fa 10 anys
+      label: Últims 10 anys
+      label_short: 10A
+    last_30_days:
+      comparison_label: vs. últims 30 dies
+      label: Últims 30 dies
+      label_short: 30D
+    last_365_days:
+      comparison_label: vs. fa 1 any
+      label: Últims 365 dies
+      label_short: 365D
+    last_5_years:
+      comparison_label: vs. fa 5 anys
+      label: Últims 5 anys
+      label_short: 5A
+    last_7_days:
+      comparison_label: vs. setmana anterior
+      label: Últims 7 dies
+      label_short: 7D
+    last_90_days:
+      comparison_label: vs. trimestre anterior
+      label: Últims 90 dies
+      label_short: 90D
+    last_day:
+      comparison_label: vs. ahir
+      label: Últim dia
+      label_short: 1D
+    last_month:
+      comparison_label: vs. mes anterior
+      label: Mes anterior
+      label_short: MA
diff --git a/config/locales/models/period/en.yml b/config/locales/models/period/en.yml
new file mode 100644
index 000000000..96e3bb21c
--- /dev/null
+++ b/config/locales/models/period/en.yml
@@ -0,0 +1,54 @@
+---
+en:
+  period:
+    last_day:
+      label_short: "1D"
+      label: "Last Day"
+      comparison_label: "vs. yesterday"
+    current_week:
+      label_short: "WTD"
+      label: "Current Week"
+      comparison_label: "vs. start of week"
+    last_7_days:
+      label_short: "7D"
+      label: "Last 7 Days"
+      comparison_label: "vs. last week"
+    current_month:
+      label_short: "MTD"
+      label: "Current Month"
+      comparison_label: "vs. start of month"
+    last_month:
+      label_short: "LM"
+      label: "Last Month"
+      comparison_label: "vs. last month"
+    last_30_days:
+      label_short: "30D"
+      label: "Last 30 Days"
+      comparison_label: "vs. last 30 days"
+    last_90_days:
+      label_short: "90D"
+      label: "Last 90 Days"
+      comparison_label: "vs. last quarter"
+    current_year:
+      label_short: "YTD"
+      label: "Current Year"
+      comparison_label: "vs. start of year"
+    last_365_days:
+      label_short: "365D"
+      label: "Last 365 Days"
+      comparison_label: "vs. 1 year ago"
+    last_5_years:
+      label_short: "5Y"
+      label: "Last 5 Years"
+      comparison_label: "vs. 5 years ago"
+    last_10_years:
+      label_short: "10Y"
+      label: "Last 10 Years"
+      comparison_label: "vs. 10 years ago"
+    all_time:
+      label_short: "All"
+      label: "All Time"
+      comparison_label: "vs. beginning"
+    custom:
+      label_short: "Custom"
+      label: "Custom Period"
diff --git a/config/locales/models/period/hu.yml b/config/locales/models/period/hu.yml
new file mode 100644
index 000000000..cbc946af0
--- /dev/null
+++ b/config/locales/models/period/hu.yml
@@ -0,0 +1,54 @@
+---
+hu:
+  period:
+    last_day:
+      label_short: "1N"
+      label: "Tegnap óta"
+      comparison_label: "vs. tegnap"
+    current_week:
+      label_short: "HE"
+      label: "Jelenlegi hét"
+      comparison_label: "vs. hét eleje"
+    last_7_days:
+      label_short: "7N"
+      label: "Utóbbi 7 nap"
+      comparison_label: "vs. előző hét"
+    current_month:
+      label_short: "HÓE"
+      label: "Jelenlegi hónap"
+      comparison_label: "vs. hónap eleje"
+    last_month:
+      label_short: "EHÓ"
+      label: "Előző hónap"
+      comparison_label: "vs. előző hónap"
+    last_30_days:
+      label_short: "30N"
+      label: "Utóbbi 30 nap"
+      comparison_label: "vs. utóbbi 30 nap"
+    last_90_days:
+      label_short: "90N"
+      label: "Utóbbi 90 nap"
+      comparison_label: "vs. előző negyedév"
+    current_year:
+      label_short: "ÉE"
+      label: "Jelenlegi év"
+      comparison_label: "vs. év eleje"
+    last_365_days:
+      label_short: "365N"
+      label: "Utóbbi 365 nap"
+      comparison_label: "vs. 1 évvel ezelőtt"
+    last_5_years:
+      label_short: "5É"
+      label: "Utóbbi 5 év"
+      comparison_label: "vs. 5 évvel ezelőtt"
+    last_10_years:
+      label_short: "10É"
+      label: "Utóbbi 10 év"
+      comparison_label: "vs. 10 évvel ezelőtt"
+    all_time:
+      label_short: "Mind"
+      label: "Teljes időszak"
+      comparison_label: "vs. kezdet"
+    custom:
+      label_short: "Egyéni"
+      label: "Egyéni időszak"
diff --git a/config/locales/models/plaid_account/ca.yml b/config/locales/models/plaid_account/ca.yml
new file mode 100644
index 000000000..29125eb3d
--- /dev/null
+++ b/config/locales/models/plaid_account/ca.yml
@@ -0,0 +1,7 @@
+---
+ca:
+  activerecord:
+    errors:
+      models:
+        plaid_account:
+          no_balance: El compte de Plaid ha de tenir un saldo actual o disponible
diff --git a/config/locales/models/plaid_account/en.yml b/config/locales/models/plaid_account/en.yml
new file mode 100644
index 000000000..afd10f40d
--- /dev/null
+++ b/config/locales/models/plaid_account/en.yml
@@ -0,0 +1,7 @@
+---
+en:
+  activerecord:
+    errors:
+      models:
+        plaid_account:
+          no_balance: "Plaid account must have either current or available balance"
diff --git a/config/locales/models/plaid_account/hu.yml b/config/locales/models/plaid_account/hu.yml
new file mode 100644
index 000000000..ef9407c16
--- /dev/null
+++ b/config/locales/models/plaid_account/hu.yml
@@ -0,0 +1,7 @@
+---
+hu:
+  activerecord:
+    errors:
+      models:
+        plaid_account:
+          no_balance: "A Plaid-számlának rendelkeznie kell aktuális vagy elérhető egyenleggel"
diff --git a/config/locales/models/provider_warnings/ca.yml b/config/locales/models/provider_warnings/ca.yml
index a78bd889d..d972ab171 100644
--- a/config/locales/models/provider_warnings/ca.yml
+++ b/config/locales/models/provider_warnings/ca.yml
@@ -1,4 +1,7 @@
 ---
 ca:
   provider_warnings:
-    limited_investment_data: "Les dades d'inversió d'aquest proveïdor són limitades. Les etiquetes d'activitat (Compra, Venda, Dividend) no estan disponibles, cosa que pot afectar la precisió del pressupost. Considereu crear regles per excloure o categoritzar les transaccions d'inversió."
+    limited_investment_data: Les dades d'inversió d'aquest proveïdor són limitades.
+      Les etiquetes d'activitat (Compra, Venda, Dividend) no estan disponibles, cosa
+      que pot afectar la precisió del pressupost. Considera crear regles per excloure
+      o categoritzar les transaccions d'inversió.
diff --git a/config/locales/models/provider_warnings/hu.yml b/config/locales/models/provider_warnings/hu.yml
new file mode 100644
index 000000000..88aa21146
--- /dev/null
+++ b/config/locales/models/provider_warnings/hu.yml
@@ -0,0 +1,4 @@
+---
+hu:
+  provider_warnings:
+    limited_investment_data: "A szolgáltató befektetési adatai korlátozottak. A tevékenységcímkék (Vétel, Eladás, Osztalék) nem elérhetők, ami befolyásolhatja a költségvetés pontosságát. Fontold meg szabályok létrehozását a befektetési tranzakciók kizárásához vagy kategorizálásához."
diff --git a/config/locales/models/recurring_transaction/ca.yml b/config/locales/models/recurring_transaction/ca.yml
new file mode 100644
index 000000000..6fd1c3ed1
--- /dev/null
+++ b/config/locales/models/recurring_transaction/ca.yml
@@ -0,0 +1,7 @@
+---
+ca:
+  activerecord:
+    errors:
+      models:
+        recurring_transaction:
+          merchant_or_name_required: Cal indicar un comerç o un nom
diff --git a/config/locales/models/recurring_transaction/en.yml b/config/locales/models/recurring_transaction/en.yml
new file mode 100644
index 000000000..6d3029628
--- /dev/null
+++ b/config/locales/models/recurring_transaction/en.yml
@@ -0,0 +1,7 @@
+---
+en:
+  activerecord:
+    errors:
+      models:
+        recurring_transaction:
+          merchant_or_name_required: "Either merchant or name must be present"
diff --git a/config/locales/models/recurring_transaction/hu.yml b/config/locales/models/recurring_transaction/hu.yml
new file mode 100644
index 000000000..16e833a50
--- /dev/null
+++ b/config/locales/models/recurring_transaction/hu.yml
@@ -0,0 +1,7 @@
+---
+hu:
+  activerecord:
+    errors:
+      models:
+        recurring_transaction:
+          merchant_or_name_required: "Kereskedőt vagy nevet kötelező megadni"
diff --git a/config/locales/models/rule/ca.yml b/config/locales/models/rule/ca.yml
new file mode 100644
index 000000000..639de6ed1
--- /dev/null
+++ b/config/locales/models/rule/ca.yml
@@ -0,0 +1,9 @@
+---
+ca:
+  activerecord:
+    errors:
+      models:
+        rule:
+          duplicate_actions: La regla no pot tenir accions duplicades %{types}
+          min_actions: ha de tenir com a mínim una acció
+          nested_conditions: Les condicions compostes no es poden imbricar
diff --git a/config/locales/models/rule/en.yml b/config/locales/models/rule/en.yml
new file mode 100644
index 000000000..adcc09b18
--- /dev/null
+++ b/config/locales/models/rule/en.yml
@@ -0,0 +1,9 @@
+---
+en:
+  activerecord:
+    errors:
+      models:
+        rule:
+          min_actions: "must have at least one action"
+          duplicate_actions: "Rule cannot have duplicate actions %{types}"
+          nested_conditions: "Compound conditions cannot be nested"
diff --git a/config/locales/models/rule/hu.yml b/config/locales/models/rule/hu.yml
new file mode 100644
index 000000000..cb50ca38f
--- /dev/null
+++ b/config/locales/models/rule/hu.yml
@@ -0,0 +1,9 @@
+---
+hu:
+  activerecord:
+    errors:
+      models:
+        rule:
+          min_actions: "legalább egy műveletet kötelező megadni"
+          duplicate_actions: "A szabálynak nem lehetnek duplikált műveletei: %{types}"
+          nested_conditions: "Összetett feltételek nem ágyazhatók egymásba"
diff --git a/config/locales/models/rule_import/ca.yml b/config/locales/models/rule_import/ca.yml
new file mode 100644
index 000000000..b0567f267
--- /dev/null
+++ b/config/locales/models/rule_import/ca.yml
@@ -0,0 +1,9 @@
+---
+ca:
+  activerecord:
+    errors:
+      models:
+        rule_import:
+          invalid_json: 'JSON no vàlid a les condicions o accions: %{message}'
+          min_actions: La regla ha de tenir com a mínim una acció
+          unsupported_resource_type: 'Tipus de recurs no compatible: %{resource_type}'
diff --git a/config/locales/models/rule_import/en.yml b/config/locales/models/rule_import/en.yml
new file mode 100644
index 000000000..4a34fc7cd
--- /dev/null
+++ b/config/locales/models/rule_import/en.yml
@@ -0,0 +1,9 @@
+---
+en:
+  activerecord:
+    errors:
+      models:
+        rule_import:
+          unsupported_resource_type: "Unsupported resource type: %{resource_type}"
+          invalid_json: "Invalid JSON in conditions or actions: %{message}"
+          min_actions: "Rule must have at least one action"
diff --git a/config/locales/models/rule_import/hu.yml b/config/locales/models/rule_import/hu.yml
new file mode 100644
index 000000000..a74c31546
--- /dev/null
+++ b/config/locales/models/rule_import/hu.yml
@@ -0,0 +1,9 @@
+---
+hu:
+  activerecord:
+    errors:
+      models:
+        rule_import:
+          unsupported_resource_type: "Nem támogatott erőforrástípus: %{resource_type}"
+          invalid_json: "Érvénytelen JSON a feltételekben vagy műveletekben: %{message}"
+          min_actions: "A szabálynak legalább egy művelete kell legyen"
diff --git a/config/locales/models/simplefin_account/ca.yml b/config/locales/models/simplefin_account/ca.yml
new file mode 100644
index 000000000..76763c4c5
--- /dev/null
+++ b/config/locales/models/simplefin_account/ca.yml
@@ -0,0 +1,7 @@
+---
+ca:
+  activerecord:
+    errors:
+      models:
+        simplefin_account:
+          no_balance: El compte de SimpleFIN ha de tenir un saldo actual o disponible
diff --git a/config/locales/models/simplefin_account/en.yml b/config/locales/models/simplefin_account/en.yml
new file mode 100644
index 000000000..83e910210
--- /dev/null
+++ b/config/locales/models/simplefin_account/en.yml
@@ -0,0 +1,7 @@
+---
+en:
+  activerecord:
+    errors:
+      models:
+        simplefin_account:
+          no_balance: "SimpleFin account must have either current or available balance"
diff --git a/config/locales/models/simplefin_account/hu.yml b/config/locales/models/simplefin_account/hu.yml
new file mode 100644
index 000000000..2e61ef2f1
--- /dev/null
+++ b/config/locales/models/simplefin_account/hu.yml
@@ -0,0 +1,7 @@
+---
+hu:
+  activerecord:
+    errors:
+      models:
+        simplefin_account:
+          no_balance: "A SimpleFin-számlának rendelkeznie kell aktuális vagy elérhető egyenleggel"
diff --git a/config/locales/models/sophtron_account/ca.yml b/config/locales/models/sophtron_account/ca.yml
new file mode 100644
index 000000000..30ff9f50c
--- /dev/null
+++ b/config/locales/models/sophtron_account/ca.yml
@@ -0,0 +1,7 @@
+---
+ca:
+  activerecord:
+    errors:
+      models:
+        sophtron_account:
+          no_balance: El compte de Sophtron ha de tenir un saldo actual o disponible
diff --git a/config/locales/models/sophtron_account/en.yml b/config/locales/models/sophtron_account/en.yml
new file mode 100644
index 000000000..581656f13
--- /dev/null
+++ b/config/locales/models/sophtron_account/en.yml
@@ -0,0 +1,7 @@
+---
+en:
+  activerecord:
+    errors:
+      models:
+        sophtron_account:
+          no_balance: "Sophtron account must have either current or available balance"
diff --git a/config/locales/models/sophtron_account/hu.yml b/config/locales/models/sophtron_account/hu.yml
new file mode 100644
index 000000000..62e97a274
--- /dev/null
+++ b/config/locales/models/sophtron_account/hu.yml
@@ -0,0 +1,7 @@
+---
+hu:
+  activerecord:
+    errors:
+      models:
+        sophtron_account:
+          no_balance: "A Sophtron-számlának rendelkeznie kell aktuális vagy elérhető egyenleggel"
diff --git a/config/locales/models/sso_provider/ca.yml b/config/locales/models/sso_provider/ca.yml
new file mode 100644
index 000000000..bed818f12
--- /dev/null
+++ b/config/locales/models/sso_provider/ca.yml
@@ -0,0 +1,14 @@
+---
+ca:
+  activerecord:
+    errors:
+      models:
+        sso_provider:
+          attributes:
+            settings:
+              metadata_url_invalid: L'URL de metadades de l'IdP ha de ser un URL vàlid
+              saml_cert_required: Cal el certificat de l'IdP o l'empremta del certificat
+                quan no s'utilitza l'URL de metadades
+              saml_url_required: Per als proveïdors SAML cal l'URL de metadades de
+                l'IdP o l'URL d'SSO de l'IdP
+              sso_url_invalid: L'URL d'SSO de l'IdP ha de ser un URL vàlid
diff --git a/config/locales/models/sso_provider/en.yml b/config/locales/models/sso_provider/en.yml
new file mode 100644
index 000000000..87097447c
--- /dev/null
+++ b/config/locales/models/sso_provider/en.yml
@@ -0,0 +1,12 @@
+---
+en:
+  activerecord:
+    errors:
+      models:
+        sso_provider:
+          attributes:
+            settings:
+              saml_url_required: "Either IdP Metadata URL or IdP SSO URL is required for SAML providers"
+              saml_cert_required: "Either IdP Certificate or Certificate Fingerprint is required when not using metadata URL"
+              metadata_url_invalid: "IdP Metadata URL must be a valid URL"
+              sso_url_invalid: "IdP SSO URL must be a valid URL"
diff --git a/config/locales/models/sso_provider/hu.yml b/config/locales/models/sso_provider/hu.yml
new file mode 100644
index 000000000..f66acd0f3
--- /dev/null
+++ b/config/locales/models/sso_provider/hu.yml
@@ -0,0 +1,12 @@
+---
+hu:
+  activerecord:
+    errors:
+      models:
+        sso_provider:
+          attributes:
+            settings:
+              saml_url_required: "SAML-szolgáltatókhoz kötelező megadni az IdP metaadat URL-jét vagy az IdP SSO URL-jét"
+              saml_cert_required: "Ha nem metaadat URL-t használsz, kötelező megadni az IdP tanúsítványt vagy a tanúsítvány ujjlenyomatát"
+              metadata_url_invalid: "Az IdP metaadat URL-nek érvényes URL-nek kell lennie"
+              sso_url_invalid: "Az IdP SSO URL-nek érvényes URL-nek kell lennie"
diff --git a/config/locales/models/time_series/value/ca.yml b/config/locales/models/time_series/value/ca.yml
index 9990ae475..02ccaf3b4 100644
--- a/config/locales/models/time_series/value/ca.yml
+++ b/config/locales/models/time_series/value/ca.yml
@@ -7,4 +7,3 @@ ca:
           attributes:
             value:
               must_be_a_money_or_numeric: ha de ser un Money o un valor numèric
-
diff --git a/config/locales/models/time_series/value/hu.yml b/config/locales/models/time_series/value/hu.yml
new file mode 100644
index 000000000..a971302d7
--- /dev/null
+++ b/config/locales/models/time_series/value/hu.yml
@@ -0,0 +1,9 @@
+---
+hu:
+  activemodel:
+    errors:
+      models:
+        time_series/value:
+          attributes:
+            value:
+              must_be_a_money_or_numeric: Money vagy numerikus értéknek kell lennie
diff --git a/config/locales/models/transaction/ca.yml b/config/locales/models/transaction/ca.yml
new file mode 100644
index 000000000..4cb3f500e
--- /dev/null
+++ b/config/locales/models/transaction/ca.yml
@@ -0,0 +1,11 @@
+---
+ca:
+  activerecord:
+    errors:
+      models:
+        transaction:
+          attributes:
+            attachments:
+              invalid_format: el fitxer %{index} té un format no compatible (%{file_format})
+              too_large: el fitxer %{index} és massa gran (màxim %{max_mb}MB)
+              too_many: no es poden superar %{max} fitxers per transacció
diff --git a/config/locales/models/transaction/es.yml b/config/locales/models/transaction/es.yml
new file mode 100644
index 000000000..896b2cdfe
--- /dev/null
+++ b/config/locales/models/transaction/es.yml
@@ -0,0 +1,11 @@
+---
+es:
+  activerecord:
+    errors:
+      models:
+        transaction:
+          attributes:
+            attachments:
+              too_many: "no puede superar %{max} archivos por transacción"
+              too_large: "el archivo %{index} es demasiado grande (máximo %{max_mb} MB)"
+              invalid_format: "el archivo %{index} tiene un formato no compatible (%{file_format})"
diff --git a/config/locales/models/transaction/fr.yml b/config/locales/models/transaction/fr.yml
new file mode 100644
index 000000000..786013d1a
--- /dev/null
+++ b/config/locales/models/transaction/fr.yml
@@ -0,0 +1,11 @@
+---
+fr:
+  activerecord:
+    errors:
+      models:
+        transaction:
+          attributes:
+            attachments:
+              too_many: "ne peut pas dépasser %{max} fichiers par transaction"
+              too_large: "le fichier %{index} est trop volumineux (maximum %{max_mb} Mo)"
+              invalid_format: "le fichier %{index} a un format non pris en charge (%{file_format})"
diff --git a/config/locales/models/transaction/hu.yml b/config/locales/models/transaction/hu.yml
new file mode 100644
index 000000000..5312117e8
--- /dev/null
+++ b/config/locales/models/transaction/hu.yml
@@ -0,0 +1,11 @@
+---
+hu:
+  activerecord:
+    errors:
+      models:
+        transaction:
+          attributes:
+            attachments:
+              too_many: "tranzakciónként legfeljebb %{max} fájl csatolható"
+              too_large: "a(z) %{index}. fájl túl nagy (maximum %{max_mb}MB)"
+              invalid_format: "a(z) %{index}. fájl formátuma nem támogatott (%{file_format})"
diff --git a/config/locales/models/transfer/ca.yml b/config/locales/models/transfer/ca.yml
index 75f00b76c..ca846488a 100644
--- a/config/locales/models/transfer/ca.yml
+++ b/config/locales/models/transfer/ca.yml
@@ -15,9 +15,13 @@ ca:
                 han d'estar dins d'un marge de 4 dies
               must_have_opposite_amounts: Les transaccions de transferència han de
                 tenir imports oposats
-              must_have_single_currency: La transferència ha de tenir una sola moneda
+              must_have_single_currency: La transferència ha de tenir una sola divisa
               outflow_cannot_be_in_multiple_transfers: La transacció de sortida no
                 pot formar part de múltiples transferències
+          different_accounts: Han de ser de comptes diferents
+          opposite_amounts: Han de tenir imports oposats
+          same_family: Han de ser de la mateixa família
+          within_days: Han d'estar dins de %{count} dies
   transfer:
     name: Transferència a %{to_account}
     payment_name: Pagament a %{to_account}
diff --git a/config/locales/models/transfer/en.yml b/config/locales/models/transfer/en.yml
index 094194f27..fddf74431 100644
--- a/config/locales/models/transfer/en.yml
+++ b/config/locales/models/transfer/en.yml
@@ -17,6 +17,10 @@ en:
               must_have_single_currency: Transfer must have a single currency
               outflow_cannot_be_in_multiple_transfers: Outflow transaction cannot
                 be part of multiple transfers
+          different_accounts: "Must be from different accounts"
+          same_family: "Must be from same family"
+          opposite_amounts: "Must have opposite amounts"
+          within_days: "Must be within %{count} days"
   transfer:
     name: Transfer to %{to_account}
     payment_name: Payment to %{to_account}
diff --git a/config/locales/models/transfer/hu.yml b/config/locales/models/transfer/hu.yml
new file mode 100644
index 000000000..e5677e476
--- /dev/null
+++ b/config/locales/models/transfer/hu.yml
@@ -0,0 +1,22 @@
+---
+hu:
+  activerecord:
+    errors:
+      models:
+        transfer:
+          different_accounts: "Különböző számlákról kell lennie"
+          same_family: "Ugyanazon a háztartáson belül kell lennie"
+          opposite_amounts: "Ellentétes összegekkel kell rendelkeznie"
+          within_days: "%{count} napon belül kell lennie"
+          attributes:
+            base:
+              inflow_cannot_be_in_multiple_transfers: A beérkező tranzakció nem szerepelhet több átutalásban
+              must_be_from_different_accounts: Az átutalásnak különböző számlák között kell történnie
+              must_be_from_same_family: Az átutalásnak ugyanazon a háztartáson belül kell maradnia
+              must_be_within_date_range: Az átutalás tranzakcióinak dátuma legfeljebb 4 nappal térhet el egymástól
+              must_have_opposite_amounts: Az átutalás tranzakcióinak ellentétes összegűeknek kell lenniük
+              must_have_single_currency: Az átutalásnak egyetlen pénznemben kell lennie
+              outflow_cannot_be_in_multiple_transfers: A kimenő tranzakció nem szerepelhet több átutalásban
+  transfer:
+    name: "Átutalás ide: %{to_account}"
+    payment_name: "Fizetés ide: %{to_account}"
diff --git a/config/locales/models/trend/hu.yml b/config/locales/models/trend/hu.yml
new file mode 100644
index 000000000..08d45e47e
--- /dev/null
+++ b/config/locales/models/trend/hu.yml
@@ -0,0 +1,13 @@
+---
+hu:
+  activemodel:
+    errors:
+      models:
+        trend:
+          attributes:
+            current:
+              must_be_of_the_same_type_as_previous: ugyanolyan típusú kell legyen, mint az előző
+              must_be_of_type_money_numeric_or_nil: Money, Numeric vagy nil típusú kell legyen
+            previous:
+              must_be_of_the_same_type_as_current: ugyanolyan típusú kell legyen, mint a jelenlegi
+              must_be_of_type_money_numeric_or_nil: Money, Numeric vagy nil típusú kell legyen
diff --git a/config/locales/models/user/ca.yml b/config/locales/models/user/ca.yml
index 0bcd625f9..33d47cbb9 100644
--- a/config/locales/models/user/ca.yml
+++ b/config/locales/models/user/ca.yml
@@ -4,8 +4,8 @@ ca:
     attributes:
       user:
         email: Correu electrònic
-        family: Família
-        family_id: Família
+        family: "%{moniker}"
+        family_id: "%{moniker}"
         first_name: Nom
         last_name: Cognom
         password: Contrasenya
@@ -16,7 +16,6 @@ ca:
           attributes:
             base:
               cannot_deactivate_admin_with_other_users: L'administrador no pot eliminar
-                el compte mentre hi hagi altres usuaris. Elimina tots els membres
-                primer.
+                el compte mentre hi hagi altres usuaris. Elimina primer tots els membres.
             profile_image:
               invalid_file_size: la mida del fitxer ha de ser inferior a %{max_megabytes}MB
diff --git a/config/locales/models/user/hu.yml b/config/locales/models/user/hu.yml
new file mode 100644
index 000000000..04b8e8f5e
--- /dev/null
+++ b/config/locales/models/user/hu.yml
@@ -0,0 +1,20 @@
+---
+hu:
+  activerecord:
+    attributes:
+      user:
+        email: E-mail
+        family: "%{moniker}"
+        family_id: "%{moniker}"
+        first_name: Keresztnév
+        last_name: Vezetéknév
+        password: Jelszó
+        password_confirmation: Jelszó megerősítése
+    errors:
+      models:
+        user:
+          attributes:
+            base:
+              cannot_deactivate_admin_with_other_users: A rendszergazda nem törölheti fiókját, amíg más tagok is vannak. Kérjük, először töröld az összes tagot.
+            profile_image:
+              invalid_file_size: a fájl mérete nem haladhatja meg a %{max_megabytes}MB-ot
diff --git a/config/locales/views/account_sharings/ca.yml b/config/locales/views/account_sharings/ca.yml
new file mode 100644
index 000000000..2b932320e
--- /dev/null
+++ b/config/locales/views/account_sharings/ca.yml
@@ -0,0 +1,30 @@
+---
+ca:
+  account_sharings:
+    show:
+      exclude_from_finances: Exclou dels meus pressupostos i informes
+      finance_toggle_description: Compta aquest compte al teu patrimoni net, pressupostos
+        i informes
+      include_in_finances: Inclou als meus pressupostos i informes
+      member: Membre
+      no_members: Encara no hi ha altres membres amb qui compartir aquest compte
+      owner_label: 'Propietari: %{name}'
+      permission: Permís
+      permissions:
+        full_control: Control total
+        full_control_description: Pot veure, editar i gestionar transaccions
+        read_only: Només visualització
+        read_only_description: Només pot veure les dades del compte
+        read_write: Pot anotar
+        read_write_description: Pot categoritzar, etiquetar i afegir notes
+      save: Desa la configuració de compartició
+      shared: Compartit
+      shared_with_count:
+        one: Compartit amb 1 membre
+        other: Compartit amb %{count} membres
+      subtitle: Controla qui pot veure i interactuar amb aquest compte
+      title: Compartició de comptes
+    update:
+      finance_toggle_success: Preferència d'inclusió a les finances actualitzada
+      not_owner: Només el propietari del compte pot gestionar la compartició
+      success: Configuració de compartició actualitzada
diff --git a/config/locales/views/account_sharings/fr.yml b/config/locales/views/account_sharings/fr.yml
new file mode 100644
index 000000000..66cb86ead
--- /dev/null
+++ b/config/locales/views/account_sharings/fr.yml
@@ -0,0 +1,29 @@
+---
+fr:
+  account_sharings:
+    show:
+      title: Partage de compte
+      subtitle: Contrôlez qui peut voir ce compte et interagir avec lui
+      member: Membre
+      permission: Permission
+      shared: Partagé
+      no_members: Aucun autre membre dans votre %{moniker} avec qui partager
+      permissions:
+        full_control: Contrôle total
+        full_control_description: Peut voir, modifier et gérer les transactions
+        read_write: Peut annoter
+        read_write_description: Peut catégoriser, étiqueter et ajouter des notes
+        read_only: Lecture seule
+        read_only_description: Peut uniquement voir les données du compte
+      save: Enregistrer les paramètres de partage
+      owner_label: "Propriétaire : %{name}"
+      shared_with_count:
+        one: Partagé avec 1 membre
+        other: "Partagé avec %{count} membres"
+      include_in_finances: Inclure dans mes budgets et rapports
+      exclude_from_finances: Exclure de mes budgets et rapports
+      finance_toggle_description: Compter ce compte dans votre patrimoine net, vos budgets et vos rapports
+    update:
+      success: Paramètres de partage mis à jour
+      not_owner: Seul le propriétaire du compte peut gérer le partage
+      finance_toggle_success: Préférence d'inclusion financière mise à jour
diff --git a/config/locales/views/account_sharings/hu.yml b/config/locales/views/account_sharings/hu.yml
new file mode 100644
index 000000000..37634c80c
--- /dev/null
+++ b/config/locales/views/account_sharings/hu.yml
@@ -0,0 +1,29 @@
+---
+hu:
+  account_sharings:
+    show:
+      title: Fiókmegosztás
+      subtitle: Szabályozd, ki láthatja és kezelheti ezt a fiókot
+      member: Tag
+      permission: Jogosultság
+      shared: Megosztva
+      no_members: Nincs más tag a(z) %{moniker} csoportodban, akivel megoszthatnád
+      permissions:
+        full_control: Teljes hozzáférés
+        full_control_description: Megtekinthet, szerkeszthet és kezelhet tranzakciókat
+        read_write: Megjegyzést írhat
+        read_write_description: Kategorizálhat, címkézhet és megjegyzést adhat hozzá
+        read_only: Csak megtekintés
+        read_only_description: Csak a fiókadatokat tekintheti meg
+      save: Megosztási beállítások mentése
+      owner_label: "Tulajdonos: %{name}"
+      shared_with_count:
+        one: 1 taggal megosztva
+        other: "%{count} taggal megosztva"
+      include_in_finances: Beleszámít a költségvetésembe és riportjaimba
+      exclude_from_finances: Kizárás a költségvetésemből és riportjaimból
+      finance_toggle_description: Ez a fiók beleszámít a nettó vagyonodba, költségvetésedbe és riportjaidba
+    update:
+      success: Megosztási beállítások frissítve
+      not_owner: Csak a fiók tulajdonosa kezelheti a megosztást
+      finance_toggle_success: Pénzügyi befoglalási beállítás frissítve
diff --git a/config/locales/views/account_statements/ca.yml b/config/locales/views/account_statements/ca.yml
new file mode 100644
index 000000000..84f732424
--- /dev/null
+++ b/config/locales/views/account_statements/ca.yml
@@ -0,0 +1,119 @@
+---
+ca:
+  account_statements:
+    account_tab:
+      coverage_description: Mesos històrics coberts amb extractes pujats i comprovacions
+        de saldo.
+      coverage_range: "%{start} - %{end}"
+      coverage_title: Cobertura d'extractes
+      empty: Encara no hi ha extractes enllaçats a aquest compte.
+      open_inbox: Safata d'entrada
+      statements_title: Extractes
+      year_label: Any de cobertura
+    balance:
+      unknown: Desconegut
+    coverage:
+      status:
+        ambiguous: Ambigu
+        covered: Cobert
+        duplicate: Duplicat
+        mismatched: No coincideix
+        missing: Falta
+        not_expected: No previst
+    create:
+      duplicates:
+        one: S'ha omès 1 extracte duplicat.
+        other: S'han omès %{count} extractes duplicats.
+      invalid_file_type: Puja un extracte en PDF, CSV o XLSX dins del límit de mida.
+      no_files: Selecciona com a mínim un fitxer d'extracte.
+      success:
+        one: 1 extracte pujat.
+        other: "%{count} extractes pujats."
+    destroy:
+      failure: No s'ha pogut eliminar l'extracte.
+      success: Extracte eliminat.
+    form:
+      account_upload: Puja l'extracte
+      files_hint: PDF, CSV o XLSX. Màxim %{max_size}MB per fitxer.
+      files_label: Fitxers d'extracte
+      inbox_upload: Puja
+    index:
+      account_label: Compte
+      confidence: Coincidència %{confidence}
+      empty_linked: Encara no hi ha extractes enllaçats.
+      empty_unmatched: La safata sense aparellar està buida.
+      leave_unmatched: Deixa sense aparellar
+      linked_title: Extractes enllaçats
+      no_suggestion: Sense suggeriment
+      storage_used: Emmagatzematge utilitzat
+      title: Arxiu d'extractes
+      unmatched_title: Safata sense aparellar
+      upload_description: Puja extractes a la safata, o tria un compte per enllaçar-los
+        immediatament.
+      upload_title: Puja extractes
+    link:
+      no_account: Tria un compte abans d'enllaçar aquest extracte.
+      success: Extracte enllaçat a %{account}.
+    period:
+      unknown: Període desconegut
+    reconciliation:
+      checks:
+        closing_balance: Saldo final
+        opening_balance: Saldo inicial
+        period_movement: Moviment del període
+        unknown_check: Comprovació desconeguda
+      matched: Coincideix
+      mismatched: No coincideix
+      unavailable: No comprovat
+    reject:
+      success: Coincidència d'extracte rebutjada.
+    show:
+      account_label: Compte
+      account_last4_hint: Últims quatre dígits del compte
+      account_name_hint: Pista del nom del compte
+      closing_balance: Saldo final
+      currency: Divisa
+      delete: Elimina
+      difference: Diferència
+      download: Descarrega
+      institution_name_hint: Pista de la institució
+      ledger_amount: Llibre de Sure
+      link_suggestion: Suggeriment d'enllaç
+      linked_to: Enllaçat a %{account}.
+      linking_title: Enllaç del compte
+      metadata_title: Metadades de l'extracte
+      no_suggestion: Encara no hi ha cap suggeriment de compte.
+      opening_balance: Saldo inicial
+      period_end_on: Final del període
+      period_start_on: Inici del període
+      reconciliation_title: Conciliació
+      reconciliation_unavailable: Afegeix un període d'extracte i un saldo inicial
+        o final, i comprova que Sure tingui historial de saldos per a aquestes dates.
+      reject: Rebutja
+      save: Desa l'extracte
+      statement_amount: Extracte
+      suggested_account: El compte suggerit és %{account} (confiança %{confidence}).
+      title: Extracte
+      unknown_value: Desconegut
+      unlink: Desenllaça
+      unmatched_account: Safata sense aparellar
+    status:
+      linked: Enllaçat
+      rejected: Rebutjat
+      unmatched: Sense aparellar
+    table:
+      account: Compte
+      actions: Accions
+      download: Descarrega
+      file: Fitxer
+      link_suggestion: Suggeriment d'enllaç
+      period: Període
+      reconciliation: Conciliació
+      reject: Rebutja el suggeriment
+      suggestion: Suggeriment
+      unlink: Desenllaça
+      view: Visualitza
+    unlink:
+      success: Extracte mogut de nou a la safata sense aparellar.
+    update:
+      success: Extracte actualitzat.
diff --git a/config/locales/views/account_statements/en.yml b/config/locales/views/account_statements/en.yml
new file mode 100644
index 000000000..78e21ae57
--- /dev/null
+++ b/config/locales/views/account_statements/en.yml
@@ -0,0 +1,116 @@
+---
+en:
+  account_statements:
+    account_tab:
+      coverage_title: Statement coverage
+      coverage_description: Historical months backed by uploaded statements and balance checks.
+      coverage_range: "%{start} - %{end}"
+      empty: No statements linked to this account yet.
+      open_inbox: Inbox
+      statements_title: Statements
+      year_label: Coverage year
+    balance:
+      unknown: Unknown
+    coverage:
+      status:
+        ambiguous: Ambiguous
+        covered: Covered
+        duplicate: Duplicate
+        mismatched: Mismatched
+        missing: Missing
+        not_expected: Not expected
+    create:
+      duplicates:
+        one: 1 duplicate statement was skipped.
+        other: "%{count} duplicate statements were skipped."
+      invalid_file_type: Upload a PDF, CSV, or XLSX statement under the size limit.
+      no_files: Select at least one statement file.
+      success:
+        one: 1 statement uploaded.
+        other: "%{count} statements uploaded."
+    destroy:
+      failure: Statement could not be deleted.
+      success: Statement deleted.
+    form:
+      account_upload: Upload statement
+      files_hint: PDF, CSV, or XLSX. %{max_size}MB max per file.
+      files_label: Statement files
+      inbox_upload: Upload
+    index:
+      account_label: Account
+      confidence: "%{confidence} match"
+      empty_linked: No linked statements yet.
+      empty_unmatched: The statement inbox is clear.
+      leave_unmatched: Leave unmatched
+      linked_title: Linked statements
+      no_suggestion: No suggestion
+      storage_used: Storage used
+      title: Statement Vault
+      unmatched_title: Unmatched inbox
+      upload_description: Upload statements to the inbox, or choose an account to link immediately.
+      upload_title: Upload statements
+    link:
+      no_account: Choose an account before linking this statement.
+      success: Linked statement to %{account}.
+    period:
+      unknown: Period unknown
+    reconciliation:
+      checks:
+        closing_balance: Closing balance
+        opening_balance: Opening balance
+        period_movement: Period movement
+        unknown_check: Unknown check
+      matched: Matched
+      mismatched: Mismatched
+      unavailable: Not checked
+    reject:
+      success: Statement match rejected.
+    show:
+      account_label: Account
+      account_last4_hint: Account last four
+      account_name_hint: Account name hint
+      closing_balance: Closing balance
+      currency: Currency
+      delete: Delete
+      difference: Difference
+      download: Download
+      institution_name_hint: Institution hint
+      ledger_amount: Sure ledger
+      linked_to: Linked to %{account}.
+      linking_title: Account link
+      link_suggestion: Link suggestion
+      metadata_title: Statement metadata
+      no_suggestion: No account suggestion yet.
+      opening_balance: Opening balance
+      period_end_on: Period end
+      period_start_on: Period start
+      reconciliation_title: Reconciliation
+      reconciliation_unavailable: Add a statement period and opening or closing balance, then make sure Sure has balance history for those dates.
+      reject: Reject
+      save: Save statement
+      statement_amount: Statement
+      suggested_account: Suggested account is %{account} (%{confidence} confidence).
+      title: Statement
+      unlink: Unlink
+      unmatched_account: Unmatched inbox
+      unknown_value: Unknown
+    status:
+      linked: Linked
+      rejected: Rejected
+      unmatched: Unmatched
+    table:
+      account: Account
+      actions: Actions
+      download: Download
+      file: File
+      link_suggestion: Link suggestion
+      period: Period
+      reconciliation: Reconciliation
+      reject: Reject suggestion
+      suggestion: Suggestion
+      unlink: Unlink
+      view: View
+    unlink:
+      success: Statement moved back to the unmatched inbox.
+    update:
+      success: Statement updated.
diff --git a/config/locales/views/account_statements/hu.yml b/config/locales/views/account_statements/hu.yml
new file mode 100644
index 000000000..0a3fc5966
--- /dev/null
+++ b/config/locales/views/account_statements/hu.yml
@@ -0,0 +1,116 @@
+---
+hu:
+  account_statements:
+    account_tab:
+      coverage_title: Kimutatás lefedettség
+      coverage_description: Feltöltött kimutatásokkal és egyenlegellenőrzésekkel lefedett korábbi hónapok.
+      coverage_range: "%{start} - %{end}"
+      empty: Még nincs ehhez a számlához kapcsolt kimutatás.
+      open_inbox: Beérkező
+      statements_title: Kimutatások
+      year_label: Lefedési év
+    balance:
+      unknown: Ismeretlen
+    coverage:
+      status:
+        ambiguous: Kétértelmű
+        covered: Lefedett
+        duplicate: Duplikált
+        mismatched: Eltérő
+        missing: Hiányzó
+        not_expected: Nem várt
+    create:
+      duplicates:
+        one: 1 duplikált kimutatás ki lett hagyva.
+        other: "%{count} duplikált kimutatás ki lett hagyva."
+      invalid_file_type: PDF, CSV vagy XLSX kimutatást tölts fel a méretkorláton belül.
+      no_files: Válassz legalább egy kimutatásfájlt.
+      success:
+        one: 1 kimutatás feltöltve.
+        other: "%{count} kimutatás feltöltve."
+    destroy:
+      failure: A kimutatást nem sikerült törölni.
+      success: Kimutatás törölve.
+    form:
+      account_upload: Kimutatás feltöltése
+      files_hint: PDF, CSV vagy XLSX. Maximum %{max_size} MB fájlonként.
+      files_label: Kimutatásfájlok
+      inbox_upload: Feltöltés
+    index:
+      account_label: Számla
+      confidence: "%{confidence} egyezés"
+      empty_linked: Még nincs kapcsolt kimutatás.
+      empty_unmatched: A kimutatás beérkező üres.
+      leave_unmatched: Hagyja párosítatlanul
+      linked_title: Kapcsolt kimutatások
+      no_suggestion: Nincs javaslat
+      storage_used: Felhasznált tárhely
+      title: Kimutatástár
+      unmatched_title: Párosítatlan beérkező
+      upload_description: Töltsd fel a kimutatásokat a beérkezőbe, vagy válassz számlát az azonnali összekapcsoláshoz.
+      upload_title: Kimutatások feltöltése
+    link:
+      no_account: Válassz számlát, mielőtt összekapcsolod ezt a kimutatást.
+      success: "Kimutatás összekapcsolva ezzel a számlával: %{account}."
+    period:
+      unknown: Az időszak ismeretlen
+    reconciliation:
+      checks:
+        closing_balance: Záró egyenleg
+        opening_balance: Nyitóegyenleg
+        period_movement: Időszaki mozgás
+        unknown_check: Ismeretlen ellenőrzés
+      matched: Egyezik
+      mismatched: Eltérő
+      unavailable: Nem ellenőrzött
+    reject:
+      success: Kimutatás-egyezési javaslat elutasítva.
+    show:
+      account_label: Számla
+      account_last4_hint: Számla utolsó négy számjegye
+      account_name_hint: Számlanév-tipp
+      closing_balance: Záró egyenleg
+      currency: Pénznem
+      delete: Törlés
+      difference: Különbség
+      download: Letöltés
+      institution_name_hint: Intézménynév-tipp
+      ledger_amount: Sure főkönyv
+      linked_to: "Összekapcsolva ezzel a számlával: %{account}."
+      linking_title: Számlakapcsolat
+      link_suggestion: Kapcsolati javaslat
+      metadata_title: Kimutatás metaadatok
+      no_suggestion: Még nincs számlajavaslat.
+      opening_balance: Nyitóegyenleg
+      period_end_on: Időszak vége
+      period_start_on: Időszak kezdete
+      reconciliation_title: Egyeztetés
+      reconciliation_unavailable: Adj meg egy kimutatási időszakot és nyitó- vagy záróegyenleget, majd győződj meg arról, hogy a Sure rendelkezik egyenlegelőzményekkel ezekre a dátumokra.
+      reject: Elutasítás
+      save: Kimutatás mentése
+      statement_amount: Kimutatás
+      suggested_account: A javasolt számla %{account} (%{confidence} bizonyossággal).
+      title: Kimutatás
+      unlink: Szétkapcsolás
+      unmatched_account: Párosítatlan beérkező
+      unknown_value: Ismeretlen
+    status:
+      linked: Összekapcsolt
+      rejected: Elutasított
+      unmatched: Párosítatlan
+    table:
+      account: Számla
+      actions: Műveletek
+      download: Letöltés
+      file: Fájl
+      link_suggestion: Kapcsolati javaslat
+      period: Időszak
+      reconciliation: Egyeztetés
+      reject: Javaslat elutasítása
+      suggestion: Javaslat
+      unlink: Szétkapcsolás
+      view: Megtekintés
+    unlink:
+      success: Kimutatás visszahelyezve a párosítatlan beérkezőbe.
+    update:
+      success: Kimutatás frissítve.
diff --git a/config/locales/views/accounts/ca.yml b/config/locales/views/accounts/ca.yml
index 47ea78944..ed1919ea0 100644
--- a/config/locales/views/accounts/ca.yml
+++ b/config/locales/views/accounts/ca.yml
@@ -3,31 +3,41 @@ ca:
   account:
     entries:
       destroy:
-        success: Èxit
+        success: Entrada eliminada correctament.
   accounts:
     account:
+      change_simplefin_account: Canvia el compte de SimpleFIN
+      complete_setup: Completa la configuració
+      default_label: Per defecte
+      delete: Elimina el compte
+      disable: Desactiva el compte
+      edit: Edita
+      enable: Activa el compte
       link_lunchflow: Enllaça amb Lunch Flow
       link_provider: Enllaça amb proveïdor
+      remove_default: Treu com a predeterminat
+      set_default: Estableix com a predeterminat
+      sharing: Compartició
       troubleshoot: Resolució de problemes
       unlink_provider: Desenllaça del proveïdor
     chart:
       data_not_available: Dades no disponibles per al període seleccionat
     confirm_unlink:
       confirm_button: Confirma i desenllaça
-      description_html: Estàs a punt de desenllaçar <strong>%{account_name}</strong> de
-        <strong>%{provider_name}</strong>. Això el convertirà en un compte manual.
+      description_html: Estàs a punt de desenllaçar <strong>%{account_name}</strong>
+        de <strong>%{provider_name}</strong>. Això el convertirà en un compte manual.
       title: Vols desenllaçar el compte del proveïdor?
-      warning_can_delete: Després de desenllaçar-lo, podràs eliminar el compte
-        si és necessari
-      warning_manual_updates: Hauràs d'afegir transaccions i actualitzar saldos
-        manualment
-      warning_no_sync: El compte ja no sincronitzarà automàticament amb el teu proveïdor
+      warning_can_delete: Després de desenllaçar-lo, podràs eliminar el compte si
+        és necessari
+      warning_manual_updates: Hauràs d'afegir transaccions i actualitzar saldos manualment
+      warning_no_sync: El compte ja no es sincronitzarà automàticament amb el teu proveïdor
       warning_title: Això significa
       warning_transactions_kept: Totes les transaccions i saldos existents es conservaran
     create:
       success: Compte %{type} creat
     destroy:
-      cannot_delete_linked: No es pot eliminar un compte enllaçat. Si us plau, desenllaça'l primer.
+      cannot_delete_linked: No es pot eliminar un compte enllaçat. Desenllaça'l primer.
+      failed: No s'ha pogut eliminar el recurs. Torna-ho a provar més tard.
       success: El compte %{type} s'ha programat per a l'eliminació
     empty:
       empty_message: Afegeix un compte mitjançant connexió, importació o introducció
@@ -36,16 +46,17 @@ ca:
       no_accounts: Encara no hi ha cap compte
     form:
       additional_details: Detalls addicionals
-      balance: Saldo actual
-      institution_domain_label: Domini de l'institució
+      balance: 'Saldo a la data:'
+      institution_domain_label: Domini de la institució
       institution_domain_placeholder: p. ex., chase.com
-      institution_name_label: Nom de l'institució
+      institution_name_label: Nom de la institució
       institution_name_placeholder: p. ex., Chase Bank
       name_label: Nom del compte
       name_placeholder: Exemple de nom de compte
       notes_label: Notes
-      notes_placeholder: Emmagatzema informació addicional com números de compte, codis de sortida,
-        IBAN, números de ruta, etc.
+      notes_placeholder: Emmagatzema informació addicional com números de compte,
+        codis de sortida, IBAN, números de ruta, etc.
+      opening_balance_date_label: Data del saldo inicial
     index:
       accounts: Comptes
       manual_accounts:
@@ -53,6 +64,10 @@ ca:
       new_account: Nou compte
       sync: Sincronitza-ho tot
     new:
+      container:
+        close: Tanca
+        navigate: Navega
+        select: Selecciona
       import_accounts: Importa comptes
       method_selector:
         connected_entry: Enllaça el compte
@@ -62,11 +77,15 @@ ca:
         manual_entry: Introdueix el saldo del compte
         title: Com vols afegir-lo?
       title: Què vols afegir?
+    not_authorized: No tens permís per gestionar aquest compte
     select_provider:
       already_linked: Aquest compte ja està enllaçat a un proveïdor
       description: Tria quin proveïdor vols utilitzar per enllaçar %{account_name}
       no_providers: Actualment no hi ha cap proveïdor configurat
       title: Selecciona un proveïdor per enllaçar
+    set_default:
+      depository_only: Només els comptes d'efectiu i de targeta de crèdit es poden
+        establir com a predeterminats.
     show:
       activity:
         amount: Import
@@ -77,17 +96,27 @@ ca:
         entry: entrada
         filter: Filtra
         new: Nou
+        new_activity: Nova activitat
         new_balance: Nou saldo
+        new_trade: Nova operació
         new_transaction: Nova transacció
+        new_transfer: Nova transferència
         no_entries: No s'han trobat entrades
         pending: Pendent
         search:
           placeholder: Cerca entrades per nom
+        search_placeholder: Cerca entrades per nom
         status: Estat
         title: Activitat
       chart:
         balance: Saldo
         owed: Import degut
+      header:
+        complete_setup: Completa la configuració
+      limited_fx_history_warning: L'historial de tipus de canvi només està disponible
+        a partir del %{date}. Les transaccions anteriors a aquesta data utilitzen
+        conversions de divisa aproximades — això pot passar quan el proveïdor de FX
+        només ofereix una finestra històrica limitada.
       menu:
         confirm_accept: Elimina "%{name}"
         confirm_body_html: "<p>En eliminar aquest compte, s'esborrarà l'historial
@@ -97,9 +126,19 @@ ca:
           restaurar la informació del compte perquè hauràs d'afegir-lo com un compte
           nou.</p>"
         confirm_title: Vols eliminar el compte?
+        delete_account: Elimina el compte
         edit: Edita
         import: Importa transaccions
+        import_trades: Importa operacions
+        import_transactions: Importa transaccions
         manage: Gestiona els comptes
+        sharing: Compartició
+        statements: Extractes
+      tabs:
+        activity: Activitat
+        holdings: Posicions
+        overview: Resum
+        statements: Extractes
     sidebar:
       configure_providers: Configura els teus proveïdors aquí.
       missing_data: Falten dades històriques
@@ -114,8 +153,26 @@ ca:
         all: Tots
         assets: Actius
         debts: Deutes
+    subtype_regions:
+      au: Austràlia
+      ca: Canadà
+      eu: Europa
+      generic: General
+      in: Índia
+      uk: Regne Unit
+      us: Estats Units
     sync_all:
       syncing: Sincronitzant comptes...
+    tax_treatment_descriptions:
+      tax_advantaged: Beneficis fiscals especials amb condicions
+      tax_deferred: Aportacions deduïbles, tributació en retirar
+      tax_exempt: Aportacions després d'impostos, guanys no tributats
+      taxable: Guanys tributats en realitzar-se
+    tax_treatments:
+      tax_advantaged: Amb avantatge fiscal
+      tax_deferred: Tributació diferida
+      tax_exempt: Exempt d'impostos
+      taxable: Subjecte a impostos
     types:
       credit_card: Targeta de crèdit
       crypto: Cripto
@@ -123,12 +180,22 @@ ca:
       investment: Inversió
       loan: Préstec
       other_asset: Altre actiu
-      other_liability: Altra passiu
+      other_liability: Altre passiu
       property: Propietat
       vehicle: Vehicle
+    types_plural:
+      credit_card: Targetes de crèdit
+      crypto: Cripto
+      depository: Efectiu
+      investment: Inversions
+      loan: Préstecs
+      other_asset: Altres actius
+      other_liability: Altres passius
+      property: Propietats
+      vehicle: Vehicles
     unlink:
-      error: "No s'ha pogut desenllaçar el compte: %{error}"
-      generic_error: S'ha produït un error inesperat. Si us plau, torna-ho a intentar.
+      error: 'No s''ha pogut desenllaçar el compte: %{error}'
+      generic_error: S'ha produït un error inesperat. Torna-ho a intentar.
       not_linked: El compte no està enllaçat a cap proveïdor
       success: El compte s'ha desenllaçat correctament. Ara és un compte manual.
     update:
diff --git a/config/locales/views/accounts/en.yml b/config/locales/views/accounts/en.yml
index 23af6cfab..a18a3de41 100644
--- a/config/locales/views/accounts/en.yml
+++ b/config/locales/views/accounts/en.yml
@@ -1,12 +1,18 @@
 ---
 en:
+  account:
+    entries:
+      destroy:
+        success: "Entry deleted successfully."
   accounts:
     not_authorized: "You don't have permission to manage this account"
     account:
+      complete_setup: Complete setup
       edit: Edit
       link_lunchflow: Link with Lunch Flow
       link_provider: Link with provider
       unlink_provider: Unlink from provider
+      change_simplefin_account: Change SimpleFIN account
       troubleshoot: Troubleshoot
       enable: Enable account
       disable: Disable account
@@ -51,6 +57,10 @@ en:
       syncing: "Syncing accounts..."
     new:
       import_accounts: Import accounts
+      container:
+        select: Select
+        navigate: Navigate
+        close: Close
       method_selector:
         connected_entry: Link account
         connected_entry_eu: Link EU account
@@ -60,6 +70,12 @@ en:
         title: How would you like to add it?
       title: What would you like to add?
     show:
+      limited_fx_history_warning: "Exchange rate history is only available from %{date} onwards. Transactions before this date use approximate currency conversions — this can happen when the FX provider only offers a limited historical window."
+      tabs:
+        activity: Activity
+        holdings: Holdings
+        overview: Overview
+        statements: Statements
       activity:
         amount: Amount
         balance: Balance
@@ -78,11 +94,14 @@ en:
         pending: Pending
         search:
           placeholder: Search entries by name
+        search_placeholder: Search entries by name
         status: Status
         title: Activity
       chart:
         balance: Balance
         owed: Amount owed
+      header:
+        complete_setup: Complete setup
       menu:
         confirm_accept: Delete "%{name}"
         confirm_body_html: "<p>By deleting this account, you will erase its value
@@ -91,11 +110,14 @@ en:
           graphs.</p><br /> <p>After deletion, there is no way you'll be able to restore
           the account information because you'll need to add it as a new account.</p>"
         confirm_title: Delete account?
+        delete_account: Delete account
         edit: Edit
         import: Import transactions
         import_trades: Import trades
         import_transactions: Import transactions
         manage: Manage accounts
+        sharing: Sharing
+        statements: Statements
     update:
       success: "%{type} account updated"
     sidebar:
@@ -120,6 +142,16 @@ en:
       credit_card: Credit Card
       loan: Loan
       other_liability: Other Liability
+    types_plural:
+      depository: Cash
+      investment: Investments
+      crypto: Crypto
+      property: Properties
+      vehicle: Vehicles
+      other_asset: Other Assets
+      credit_card: Credit Cards
+      loan: Loans
+      other_liability: Other Liabilities
     tax_treatments:
       taxable: Taxable
       tax_deferred: Tax-Deferred
@@ -136,6 +168,7 @@ en:
       ca: Canada
       au: Australia
       eu: Europe
+      in: India
       generic: General
     confirm_unlink:
       title: Unlink account from provider?
diff --git a/config/locales/views/accounts/es.yml b/config/locales/views/accounts/es.yml
index 613bf93ce..5101705eb 100644
--- a/config/locales/views/accounts/es.yml
+++ b/config/locales/views/accounts/es.yml
@@ -1,11 +1,13 @@
 ---
 es:
   accounts:
+    not_authorized: No tienes permiso para gestionar esta cuenta
     account:
       edit: Editar
       link_lunchflow: Vincular con Lunch Flow
       link_provider: Vincular con proveedor
       unlink_provider: Desvincular de proveedor
+      change_simplefin_account: Cambiar cuenta de SimpleFIN
       troubleshoot: Solucionar problemas
       enable: Activar cuenta
       disable: Desactivar cuenta
@@ -13,6 +15,7 @@ es:
       remove_default: Quitar predeterminada
       default_label: Predeterminada
       delete: Eliminar cuenta
+      sharing: Compartir
     chart:
       data_not_available: Datos no disponibles para el período seleccionado
     create:
@@ -22,12 +25,14 @@ es:
     destroy:
       success: "Cuenta %{type} programada para eliminación"
       cannot_delete_linked: "No se puede eliminar una cuenta vinculada. Por favor, desvincúlela primero."
+      failed: "No se pudo eliminar el recurso. Inténtalo de nuevo más tarde."
     empty:
       empty_message: Añade una cuenta mediante conexión, importación o introducción manual.
       new_account: Nueva cuenta
       no_accounts: Aún no hay cuentas
     form:
       balance: Saldo actual
+      opening_balance_date_label: Fecha del saldo inicial
       name_label: Nombre de la cuenta
       name_placeholder: Ejemplo de nombre de cuenta
       additional_details: Detalles adicionales
@@ -56,6 +61,7 @@ es:
         title: ¿Cómo te gustaría añadirla?
       title: ¿Qué te gustaría añadir?
     show:
+      limited_fx_history_warning: "El historial de tipos de cambio solo está disponible desde %{date}. Las transacciones anteriores a esa fecha usan conversiones de divisa aproximadas; esto puede ocurrir cuando el proveedor de tipos de cambio solo ofrece una ventana histórica limitada."
       activity:
         amount: Cantidad
         balance: Saldo
@@ -128,6 +134,7 @@ es:
       ca: Canadá
       au: Australia
       eu: Europa
+      in: India
       generic: General
     confirm_unlink:
       title: ¿Desvincular cuenta del proveedor?
diff --git a/config/locales/views/accounts/fr.yml b/config/locales/views/accounts/fr.yml
index 7d2eafcb8..6c153edcb 100644
--- a/config/locales/views/accounts/fr.yml
+++ b/config/locales/views/accounts/fr.yml
@@ -1,11 +1,13 @@
 ---
 fr:
   accounts:
+    not_authorized: "Vous n'avez pas la permission de gérer ce compte"
     account:
       edit: Modifier
       link_lunchflow: Lier avec Lunch Flow
       link_provider: Lier avec un fournisseur
       unlink_provider: Délier du fournisseur
+      change_simplefin_account: Changer le compte SimpleFIN
       troubleshoot: Dépannage
       enable: Activer le compte
       disable: Désactiver le compte
@@ -13,6 +15,7 @@ fr:
       remove_default: Retirer par défaut
       default_label: Par défaut
       delete: Supprimer le compte
+      sharing: Partage
     chart:
       data_not_available: Données non disponibles pour la période sélectionnée
     create:
@@ -22,12 +25,14 @@ fr:
     destroy:
       success: "Le compte %{type} a été préparé à la suppression"
       cannot_delete_linked: "Impossible de supprimer un compte lié. Veuillez d'abord le délier."
+      failed: "La suppression de la ressource a échoué. Veuillez réessayer plus tard."
     empty:
       empty_message: Ajoutez un compte via une connexion, une importation ou en entrant manuellement.
       new_account: Nouveau compte
       no_accounts: Aucun compte pour l'instant
     form:
-      balance: Solde actuel
+      balance: "Solde à la date :"
+      opening_balance_date_label: Date du solde d'ouverture
       name_label: Nom du compte
       name_placeholder: Nom de compte d'exemple
       additional_details: Détails supplémentaires
@@ -44,7 +49,7 @@ fr:
       new_account: Nouveau compte
       sync: Tout synchroniser
     sync_all:
-      syncing: "Synchronisation des comptes..."
+      syncing: "Synchronisation des comptes…"
     new:
       import_accounts: Importer des comptes
       method_selector:
@@ -56,6 +61,7 @@ fr:
         title: Comment voulez-vous l'ajouter ?
       title: Que voulez-vous ajouter ?
     show:
+      limited_fx_history_warning: "L'historique des taux de change n'est disponible qu'à partir du %{date}. Les transactions antérieures à cette date utilisent des conversions de devises approximatives — cela peut se produire lorsque le fournisseur FX n'offre qu'une fenêtre historique limitée."
       activity:
         amount: Montant
         balance: Solde
@@ -65,8 +71,11 @@ fr:
         entry: entrée
         filter: Filtrer
         new: Nouveau
+        new_activity: Nouvelle activité
         new_balance: Nouveau solde
+        new_trade: Nouvelle transaction boursière
         new_transaction: Nouvelle transaction
+        new_transfer: Nouveau virement
         no_entries: Aucune entrée trouvée
         pending: En attente
         search:
@@ -83,6 +92,8 @@ fr:
         confirm_title: Supprimer le compte ?
         edit: Modifier
         import: Importer des transactions
+        import_trades: Importer des transactions boursières
+        import_transactions: Importer des transactions
         manage: Gérer les comptes
     update:
       success: "Compte %{type} mis à jour"
@@ -102,12 +113,29 @@ fr:
       depository: Liquidités
       investment: Investissement
       crypto: Crypto
-      property: Propriété
+      property: Bien immobilier
       vehicle: Véhicule
       other_asset: Autre actif
       credit_card: Carte de crédit
       loan: Prêt
       other_liability: Autre passif
+    tax_treatments:
+      taxable: Imposable
+      tax_deferred: Imposition différée
+      tax_exempt: Exonéré d'impôt
+      tax_advantaged: Fiscalement avantagé
+    tax_treatment_descriptions:
+      taxable: Gains imposés lors de leur réalisation
+      tax_deferred: Contributions déductibles, imposées au retrait
+      tax_exempt: Contributions après impôt, gains non imposés
+      tax_advantaged: Avantages fiscaux particuliers sous conditions
+    subtype_regions:
+      us: États-Unis
+      uk: Royaume-Uni
+      ca: Canada
+      au: Australie
+      eu: Europe
+      generic: Général
     confirm_unlink:
       title: Délier le compte du fournisseur ?
       description_html: "Vous êtes sur le point de délier <strong>%{account_name}</strong> de <strong>%{provider_name}</strong>. Cela le convertira en compte manuel."
diff --git a/config/locales/views/accounts/hu.yml b/config/locales/views/accounts/hu.yml
new file mode 100644
index 000000000..6041d3d91
--- /dev/null
+++ b/config/locales/views/accounts/hu.yml
@@ -0,0 +1,192 @@
+---
+hu:
+  account:
+    entries:
+      destroy:
+        success: "Tétel sikeresen törölve."
+  accounts:
+    not_authorized: "Nincs jogosultságod ennek a számlának a kezeléséhez"
+    account:
+      complete_setup: Beállítás befejezése
+      edit: Szerkesztés
+      link_lunchflow: Összekapcsolás a Lunch Flow-val
+      link_provider: Összekapcsolás szolgáltatóval
+      unlink_provider: Leválasztás a szolgáltatóról
+      change_simplefin_account: SimpleFIN fiók módosítása
+      troubleshoot: Hibakeresés
+      enable: Számla engedélyezése
+      disable: Számla letiltása
+      set_default: Beállítás alapértelmezettként
+      remove_default: Alapértelmezett eltávolítása
+      default_label: Alapértelmezett
+      delete: Számla törlése
+      sharing: Megosztás
+    chart:
+      data_not_available: A kiválasztott időszakra nem állnak rendelkezésre adatok
+    create:
+      success: "%{type} számla létrehozva"
+    set_default:
+      depository_only: "Csak készpénz- és hitelkártya-számlák állíthatók be alapértelmezettként."
+    destroy:
+      success: "%{type} számla törlésre ütemezve"
+      cannot_delete_linked: "Összekapcsolt számla nem törölhető. Először válaszd le a szolgáltatóról."
+      failed: "Az erőforrás törlése sikertelen. Próbáld meg később."
+    empty:
+      empty_message: Állítson be számlát szinkronizálással, importálással vagy manuális rögzítéssel.
+      new_account: Új számla
+      no_accounts: Még nincsenek számlái
+    form:
+      balance: "Egyenleg a dátumon:"
+      opening_balance_date_label: Nyitóegyenleg dátuma
+      name_label: Számla neve
+      name_placeholder: Példa számlanév
+      additional_details: További részletek
+      institution_name_label: Pénzintézet neve
+      institution_name_placeholder: pl. OTP Bank
+      institution_domain_label: Pénzintézet domainje
+      institution_domain_placeholder: pl. otpbank.hu
+      notes_label: Megjegyzések
+      notes_placeholder: További információk tárolása, pl. számlaszám, IBAN, routing szám stb.
+    index:
+      accounts: Számlák
+      manual_accounts:
+        other_accounts: Egyéb számlák
+      new_account: Új számla
+      sync: Összes szinkronizálása
+    sync_all:
+      syncing: "Számlák szinkronizálása..."
+    new:
+      import_accounts: Számlák importálása
+      container:
+        select: Kiválasztás
+        navigate: Navigálás
+        close: Bezárás
+      method_selector:
+        connected_entry: Számla összekapcsolása
+        connected_entry_eu: EU-s számla összekapcsolása
+        link_with_provider: "Összekapcsolás: %{provider}"
+        lunchflow_entry: Lunch Flow számla összekapcsolása
+        manual_entry: Egyenleg manuális megadása
+        title: Hogyan szeretnéd hozzáadni?
+      title: Mit szeretnél hozzáadni?
+    show:
+      limited_fx_history_warning: "Az árfolyam-előzmények csak %{date} dátumtól érhetők el. Az ezt megelőző tranzakciókhoz közelítő árfolyamok kerülnek alkalmazásra – ez akkor fordulhat elő, ha a devizaárfolyam-szolgáltató csak korlátozott előzményadatokat kínál."
+      tabs:
+        activity: Tevékenység
+        holdings: Portfólió
+        overview: Áttekintés
+        statements: Kimutatások
+      activity:
+        amount: Összeg
+        balance: Egyenleg
+        confirmed: Megerősített
+        date: Dátum
+        entries: tétel
+        entry: tétel
+        filter: Szűrő
+        new: Új
+        new_activity: Új tevékenység
+        new_balance: Új egyenleg
+        new_trade: Új ügylet
+        new_transaction: Új tranzakció
+        new_transfer: Új átutalás
+        no_entries: Nem található tétel
+        pending: Függőben lévő
+        search:
+          placeholder: Tételek keresése név alapján
+        search_placeholder: Tételek keresése név alapján
+        status: Állapot
+        title: Tevékenység
+      chart:
+        balance: Egyenleg
+        owed: Tartozás összege
+      header:
+        complete_setup: Beállítás befejezése
+      menu:
+        confirm_accept: '"%{name}" törlése'
+        confirm_body_html: "<p>A számla törlésével törlöd az értéktörténetét is, ami hatással van az összesített fiókodra. Ez közvetlenül befolyásolja a nettó vagyonszámítást és a számlagrafikonokat.</p><br /> <p>A törlés után a számla adatait nem lehet visszaállítani – ha szükséges, új számlaként kell hozzáadni.</p>"
+        confirm_title: Törlöd a számlát?
+        delete_account: Számla törlése
+        edit: Szerkesztés
+        import: Tranzakciók importálása
+        import_trades: Ügyletek importálása
+        import_transactions: Tranzakciók importálása
+        manage: Számlák kezelése
+        sharing: Megosztás
+        statements: Kimutatások
+    update:
+      success: "%{type} számla frissítve"
+    sidebar:
+      missing_data: Hiányzó előzményadatok
+      missing_data_description: "%{product} harmadik feles szolgáltatóktól kéri le a historikus árfolyamokat, értékpapír-árakat és egyéb adatokat. Ezek szükségesek a pontos számlaegyenleg-előzmények kiszámításához."
+      configure_providers: Konfiguráld itt a szolgáltatóidat.
+      tabs:
+        all: Összes
+        assets: Vagyon
+        debts: Kötelezettségek
+      new_asset: Új vagyonelem
+      new_debt: Új kötelezettség
+      new_account: Új számla
+      new_account_group: "Új %{account_group}"
+    types:
+      depository: Készpénz
+      investment: Befektetés
+      crypto: Kripto
+      property: Ingatlan
+      vehicle: Jármű
+      other_asset: Egyéb vagyon
+      credit_card: Hitelkártya
+      loan: Hitel
+      other_liability: Egyéb kötelezettség
+    types_plural:
+      depository: Készpénz
+      investment: Befektetések
+      crypto: Kripto
+      property: Ingatlanok
+      vehicle: Járművek
+      other_asset: Egyéb vagyon
+      credit_card: Hitelkártyák
+      loan: Hitelek
+      other_liability: Egyéb kötelezettségek
+    tax_treatments:
+      taxable: Adóköteles
+      tax_deferred: Halasztott adózású
+      tax_exempt: Adómentes
+      tax_advantaged: Adókedvezményes
+    tax_treatment_descriptions:
+      taxable: A nyereség realizáláskor adóköteles
+      tax_deferred: A befizetések levonhatók, kivétkor adóköteles
+      tax_exempt: Adózott befizetések, a nyereség nem adóköteles
+      tax_advantaged: Különleges adókedvezmények feltételekkel
+    subtype_regions:
+      us: Egyesült Államok
+      uk: Egyesült Királyság
+      ca: Kanada
+      au: Ausztrália
+      eu: Európa
+      in: India
+      generic: Általános
+    confirm_unlink:
+      title: Leválasztod a számlát a szolgáltatóról?
+      description_html: "Készülsz leválasztani a <strong>%{account_name}</strong> számlát a <strong>%{provider_name}</strong> szolgáltatóról. Ez manuális számlává alakítja át."
+      warning_title: Mit jelent ez
+      warning_no_sync: A számla többé nem szinkronizál automatikusan a szolgáltatóval
+      warning_manual_updates: A tranzakciókat manuálisan kell hozzáadnod, az egyenleget manuálisan kell frissítened
+      warning_transactions_kept: Minden meglévő tranzakció és egyenleg megmarad
+      warning_can_delete: A leválasztás után szükség esetén törölheted a számlát
+      confirm_button: Megerősítés és leválasztás
+    unlink:
+      success: "A számla sikeresen leválasztva. Mostantól manuális számla."
+      not_linked: "A számla nincs összekapcsolva szolgáltatóval"
+      error: "Nem sikerült leválasztani a számlát: %{error}"
+      generic_error: "Váratlan hiba történt. Kérjük, próbáld újra."
+    select_provider:
+      title: Válassz szolgáltatót a csatlakozáshoz
+      description: "Válaszd ki, melyik szolgáltatón keresztül szeretnéd összekapcsolni: %{account_name}"
+      already_linked: "A számla már össze van kapcsolva egy szolgáltatóval"
+      no_providers: "Jelenleg nincs konfigurált szolgáltató"
+
+  email_confirmations:
+    new:
+      invalid_token: Érvénytelen vagy lejárt megerősítő hivatkozás.
+      success_login: Az e-mail-cím megerősítve. Kérjük, jelentkezz be az új e-mail-címeddel.
diff --git a/config/locales/views/admin/invitations/ca.yml b/config/locales/views/admin/invitations/ca.yml
new file mode 100644
index 000000000..0d12897a7
--- /dev/null
+++ b/config/locales/views/admin/invitations/ca.yml
@@ -0,0 +1,8 @@
+---
+ca:
+  admin:
+    invitations:
+      destroy:
+        success: Invitació eliminada.
+      destroy_all:
+        success: S'han eliminat totes les invitacions d'aquesta família.
diff --git a/config/locales/views/admin/invitations/hu.yml b/config/locales/views/admin/invitations/hu.yml
new file mode 100644
index 000000000..4a22208e0
--- /dev/null
+++ b/config/locales/views/admin/invitations/hu.yml
@@ -0,0 +1,8 @@
+---
+hu:
+  admin:
+    invitations:
+      destroy:
+        success: "Meghívó törölve."
+      destroy_all:
+        success: "A család összes meghívója törölve."
diff --git a/config/locales/views/admin/sso_providers/ca.yml b/config/locales/views/admin/sso_providers/ca.yml
index 3906fd918..41ba67d6a 100644
--- a/config/locales/views/admin/sso_providers/ca.yml
+++ b/config/locales/views/admin/sso_providers/ca.yml
@@ -5,8 +5,8 @@ ca:
       create:
         success: El proveïdor SSO s'ha creat correctament.
       destroy:
-        confirm: Estàs segur que vols eliminar aquest proveïdor? Aquesta acció no es
-          pot desfer.
+        confirm: Segur que vols eliminar aquest proveïdor? Aquesta acció no es pot
+          desfer.
         success: El proveïdor SSO s'ha eliminat correctament.
       edit:
         description: Actualitza la configuració per a %{label}
@@ -18,99 +18,130 @@ ca:
         cancel: Cancel·la
         client_id_help: ID del client OAuth del teu proveïdor d'identitat
         client_id_label: ID del client
-        client_id_placeholder: el-teu-id-client
+        client_id_placeholder: el-teu-id-de-client
         client_secret_help: Secret del client OAuth (xifrat a la base de dades)
-        client_secret_help_existing: " - deixa en blanc per mantenir l'existent"
+        client_secret_help_existing: Deixa-ho en blanc per mantenir el secret existent
         client_secret_label: Secret del client
-        client_secret_placeholder_existing: "••••••••••••••••"
-        client_secret_placeholder_new: el-teu-secret-client
+        client_secret_placeholder_existing: "••••••••"
+        client_secret_placeholder_new: el-teu-secret-de-client
         copy_button: Copia
-        default_role_help: Rol assignat als usuaris creats mitjançant aprovisionament
+        create_provider: Crea el proveïdor
+        default_role_help: Rol assignat als usuaris creats mitjançant l'aprovisionament
           de comptes SSO just-in-time (JIT). Per defecte és Membre.
         default_role_label: Rol per defecte per a nous usuaris
-        enabled_help: Els usuaris poden iniciar sessió amb aquest proveïdor quan està
-          habilitat
-        enabled_label: Habilita aquest proveïdor
-        errors_title: "%{count} error ha prohibit que aquest proveïdor s' desa:"
-        groups_help: Llista separada per comes dels noms de grups del IdP. Usa * per coincidir
-          amb tots els grups.
-        icon_help: Nom de la icona Lucide (opcional)
-        icon_label: Icona
-        icon_placeholder: p. ex., key, google, github
-        idp_cert_fingerprint: Emprempta del certificat (alternativa)
+        enabled_help: Els usuaris podran iniciar sessió amb aquest proveïdor quan
+          estigui activat
+        enabled_label: Activa aquest proveïdor
+        errors_title:
+          one: "%{count} error ha impedit desar aquest proveïdor:"
+          other: "%{count} errors han impedit desar aquest proveïdor:"
+        groups_help: Llista separada per comes amb els noms dels grups del IdP. Fes
+          servir * per fer coincidir tots els grups.
+        guest_groups: Grups de convidats
+        icon_help: Nom de la icona Lucide per al botó d'inici de sessió
+        icon_label: Icona (opcional)
+        icon_placeholder: p. ex., key, shield
+        idp_cert_fingerprint: Empremta del certificat (alternativa)
         idp_certificate: Certificat del IdP
-        idp_certificate_help: Certificat X.509 en format PEM. Obligatori si no s'utilitza
-          l'URL de metadades.
+        idp_certificate_help: Certificat X.509 en format PEM. Obligatori si no fas
+          servir l'URL de metadades.
         idp_metadata_url: URL de metadades del IdP
-        idp_metadata_url_help: URL a les metadades SAML del teu IdP. Si es proporciona,
-          altres configuracions SAML es configuraran automàticament.
+        idp_metadata_url_help: URL de les metadades SAML del teu IdP. Si la indiques,
+          la resta de paràmetres SAML es configuraran automàticament.
         idp_slo_url: URL SLO del IdP (opcional)
         idp_sso_url: URL SSO del IdP
-        issuer_help: URL emisor OIDC (validarà el punt final .well-known/openid-configuration)
-        issuer_label: Emisor
-        issuer_placeholder: https://accounts.google.com
+        issuer_help: URL de l'emissor OIDC (valida .well-known/openid-configuration)
+        issuer_label: URL de l'emissor
+        issuer_placeholder: https://el-teu-idp.exemple.com/realms/el-teu-realm
         label_help: Text del botó que es mostra als usuaris
-        label_label: Etiqueta
+        label_label: Etiqueta del botó
         label_placeholder: p. ex., Inicia sessió amb Keycloak
-        manual_saml_config: Configuració manual (si no s'utilitza l'URL de metadades)
-        manual_saml_help: Només utilitza aquesta configuració si el teu IdP no proporciona
+        manual_saml_config: Configuració manual (si no fas servir URL de metadades)
+        manual_saml_help: Fes servir aquesta configuració només si el teu IdP no proporciona
           una URL de metadades.
         member_groups: Grups de membres
-        name_help: Identificador únic (només minúscules, números, subratllats)
+        name_help: Identificador únic (només minúscules, números i guions baixos)
         name_id_email: Adreça de correu electrònic (per defecte)
         name_id_format: Format NameID
         name_id_persistent: Persistent
         name_id_transient: Transient
         name_id_unspecified: No especificat
         name_label: Nom
-        name_placeholder: p. ex., openid_connect, keycloak, authentik
+        name_placeholder: p. ex., keycloak, authentik
         oauth_configuration: Configuració OAuth/OIDC
-        prompt_consent: Força consentiment (autoritzar de nou)
+        prompt_consent: Força el consentiment (torna a autoritzar)
         prompt_default: Per defecte (decideix el IdP)
-        prompt_help: Controla com el IdP demana a l'usuari durant l'autenticació.
-        prompt_label: Prompt d'autenticació
-        prompt_login: Força inici de sessió (torna a autenticar)
-        prompt_none: Sense prompt (autenticació silenciosa)
-        prompt_select_account: Selecció de compte (triar compte)
-        provisioning_title: Proveïment d'usuaris
-        redirect_uri_help: URL de callback per configurar al teu proveïdor d'identitat
-        redirect_uri_label: URI de redirecció
-        redirect_uri_placeholder: https://teudomini.com/auth/openid_connect/callback
+        prompt_help: Controla com el IdP demana l'autenticació a l'usuari.
+        prompt_label: Indicador d'autenticació
+        prompt_login: Força l'inici de sessió (torna a autenticar)
+        prompt_none: Sense indicador (autenticació silenciosa)
+        prompt_select_account: Selecció de compte (tria el compte)
+        provisioning_title: Aprovisionament d'usuaris
+        redirect_uri_help: Configura aquesta URL al teu proveïdor d'identitat
+        redirect_uri_label: URL de retorn
+        redirect_uri_placeholder: https://elteudomini.com/auth/openid_connect/callback
         role_admin: Administrador
-        role_mapping_help: Mapa els grups/claims del IdP als rols de l'aplicació. Als usuaris
-          se'ls assigna el rol més alt que coincideix. Deixa en blanc per utilitzar el rol per defecte
-          de dalt.
-        role_mapping_title: Mapa de grups a rols (Opcional)
+        role_guest: Convidat
+        role_mapping_help: Mapeja els grups/claims del IdP als rols de l'aplicació.
+          Als usuaris se'ls assigna el rol més alt que coincideixi. Deixa-ho en blanc
+          per utilitzar el rol per defecte de dalt.
+        role_mapping_title: Mapatge de grups a rols (opcional)
         role_member: Membre
         role_super_admin: Super administrador
         saml_configuration: Configuració SAML
-        scopes_help: Llista separada per espais d'àmbits OIDC. Deixa en blanc per defecte
-          (openid email profile). Afegeix 'groups' per recuperar claims de grup.
+        saml_sp_callback_url_help: Configura aquesta URL com a URL del servei consumidor
+          d'assercions al teu IdP
+        saml_sp_callback_url_label: URL de retorn del SP (URL ACS)
+        scopes_help: Llista separada per espais amb els àmbits OIDC. Deixa-ho en blanc
+          per als valors per defecte (openid email profile). Afegeix 'groups' per
+          recuperar els claims de grup.
         scopes_label: Àmbits personalitzats
-        strategy_help: L'estratègia d'autenticació a utilitzar
+        strategy_github: GitHub
+        strategy_google_oauth2: Google OAuth2
+        strategy_help: L'estratègia d'autenticació que cal utilitzar
         strategy_label: Estratègia
+        strategy_openid_connect: OpenID Connect
+        strategy_saml: SAML 2.0
         submit: Desa el proveïdor
         super_admin_groups: Grups de super administradors
         test_connection: Prova la connexió
+        update_provider: Actualitza el proveïdor
       index:
         add_provider: Afegeix proveïdor
-        description: Gestiona proveïdors d'autenticació d'inici de sessió únic per a la teva instància
+        configuration_mode: Mode de configuració
+        configured_providers: Proveïdors configurats
+        db_backed_providers: Proveïdors basats en base de dades
+        db_backed_providers_description: Carrega els proveïdors des de la base de
+          dades en lloc de la configuració YAML
+        db_backed_providers_help_html: Defineix <code class="bg-surface px-1 py-0.5
+          rounded text-xs">AUTH_PROVIDERS_SOURCE=db</code> per activar els proveïdors
+          basats en base de dades. Això permet fer canvis sense reiniciar el servidor.
+        delete: Elimina
+        description: Gestiona proveïdors d'autenticació d'inici de sessió únic per
+          a la teva instància.
+        disable: Desactiva
+        disabled: Desactivat
+        edit: Edita
+        enable: Activa
+        enabled: Activat
         env_configured: Entorn/YAML
         legacy_providers_notice: Aquests proveïdors estan configurats mitjançant variables
-          d'entorn o YAML i no es poden gestionar mitjançant aquesta interfície. Per gestionar-los
-          aquí, migrant-los a proveïdors basats en base de dades activant AUTH_PROVIDERS_SOURCE=db
-          i recreant-los a la interfície d'usuari.
-        legacy_providers_title: Proveïdors configurats a l'entorn
-        no_providers_message: Comença afegint el teu primer proveïdor SSO.
+          d'entorn o YAML i no es poden gestionar des d'aquesta interfície. Per gestionar-los
+          aquí, migra'ls a proveïdors basats en base de dades activant AUTH_PROVIDERS_SOURCE=db
+          i recreant-los a la interfície.
+        legacy_providers_title: Proveïdors configurats per entorn
+        no_providers_message: Encara no hi ha proveïdors SSO configurats.
         no_providers_title: No hi ha proveïdors SSO
-        note: Els canvis als proveïdors SSO requereixen un reinici del servidor per fer efecte.
-          Alternativament, activa la bandera de característica AUTH_PROVIDERS_SOURCE=db per carregar
-          proveïdors de la base de dades de manera dinàmica.
+        note: Els canvis als proveïdors SSO requereixen un reinici del servidor per
+          fer efecte. Alternativament, activa la bandera de característica AUTH_PROVIDERS_SOURCE=db
+          per carregar els proveïdors des de la base de dades de manera dinàmica.
+        page_title: Proveïdors SSO
+        restart_required: Els canvis requereixen un reinici del servidor per fer efecte.
         table:
           actions: Accions
           disabled: Desactivat
-          enabled: Actiu
-          issuer: Emisor
+          enabled: Activat
+          issuer: Emissor
           name: Nom
           status: Estat
           strategy: Estratègia
@@ -119,8 +150,8 @@ ca:
         description: Configura un nou proveïdor d'autenticació d'inici de sessió únic
         title: Afegeix proveïdor SSO
       toggle:
-        confirm_disable: Estàs segur que vols desactivar aquest proveïdor?
-        confirm_enable: Estàs segur que vols activar aquest proveïdor?
+        confirm_disable: Segur que vols desactivar aquest proveïdor?
+        confirm_enable: Segur que vols activar aquest proveïdor?
         success_disabled: El proveïdor SSO s'ha desactivat correctament.
         success_enabled: El proveïdor SSO s'ha activat correctament.
       update:
diff --git a/config/locales/views/admin/sso_providers/en.yml b/config/locales/views/admin/sso_providers/en.yml
index 9957e56b8..bca7ac709 100644
--- a/config/locales/views/admin/sso_providers/en.yml
+++ b/config/locales/views/admin/sso_providers/en.yml
@@ -4,12 +4,25 @@ en:
     unauthorized: "You are not authorized to access this area."
     sso_providers:
       index:
+        page_title: "SSO Providers"
         title: "SSO Providers"
-        description: "Manage single sign-on authentication providers for your instance"
+        description: "Manage single sign-on authentication providers for your instance."
+        restart_required: "Changes require a server restart to take effect."
+        configured_providers: "Configured Providers"
         add_provider: "Add Provider"
         no_providers_title: "No SSO Providers"
-        no_providers_message: "Get started by adding your first SSO provider."
+        no_providers_message: "No SSO providers configured yet."
         note: "Changes to SSO providers require a server restart to take effect. Alternatively, enable the AUTH_PROVIDERS_SOURCE=db feature flag to load providers from the database dynamically."
+        enabled: "Enabled"
+        disabled: "Disabled"
+        edit: "Edit"
+        enable: "Enable"
+        disable: "Disable"
+        delete: "Delete"
+        configuration_mode: "Configuration Mode"
+        db_backed_providers: "Database-backed providers"
+        db_backed_providers_description: "Load providers from database instead of YAML config"
+        db_backed_providers_help_html: "Set <code class=\"bg-surface px-1 py-0.5 rounded text-xs\">AUTH_PROVIDERS_SOURCE=db</code> to enable database-backed providers. This allows changes without server restarts."
         table:
           name: "Name"
           strategy: "Strategy"
@@ -44,35 +57,45 @@ en:
         oauth_configuration: "OAuth/OIDC Configuration"
         strategy_label: "Strategy"
         strategy_help: "The authentication strategy to use"
+        strategy_openid_connect: "OpenID Connect"
+        strategy_saml: "SAML 2.0"
+        strategy_google_oauth2: "Google OAuth2"
+        strategy_github: "GitHub"
         name_label: "Name"
-        name_placeholder: "e.g., openid_connect, keycloak, authentik"
+        name_placeholder: "e.g., keycloak, authentik"
         name_help: "Unique identifier (lowercase, numbers, underscores only)"
-        label_label: "Label"
+        label_label: "Button Label"
         label_placeholder: "e.g., Sign in with Keycloak"
         label_help: "Button text shown to users"
-        icon_label: "Icon"
-        icon_placeholder: "e.g., key, google, github"
-        icon_help: "Lucide icon name (optional)"
+        icon_label: "Icon (optional)"
+        icon_placeholder: "e.g., key, shield"
+        icon_help: "Lucide icon name for the login button"
         enabled_label: "Enable this provider"
         enabled_help: "Users can sign in with this provider when enabled"
-        issuer_label: "Issuer"
-        issuer_placeholder: "https://accounts.google.com"
-        issuer_help: "OIDC issuer URL (will validate .well-known/openid-configuration endpoint)"
+        issuer_label: "Issuer URL"
+        issuer_placeholder: "https://your-idp.example.com/realms/your-realm"
+        issuer_help: "OIDC issuer URL (validates .well-known/openid-configuration)"
         client_id_label: "Client ID"
         client_id_placeholder: "your-client-id"
         client_id_help: "OAuth client ID from your identity provider"
         client_secret_label: "Client Secret"
         client_secret_placeholder_new: "your-client-secret"
-        client_secret_placeholder_existing: "••••••••••••••••"
+        client_secret_placeholder_existing: "••••••••"
         client_secret_help: "OAuth client secret (encrypted in database)"
-        client_secret_help_existing: " - leave blank to keep existing"
-        redirect_uri_label: "Redirect URI"
+        client_secret_help_existing: "Leave blank to keep existing secret"
+        redirect_uri_label: "Callback URL"
         redirect_uri_placeholder: "https://yourdomain.com/auth/openid_connect/callback"
-        redirect_uri_help: "Callback URL to configure in your identity provider"
+        redirect_uri_help: "Configure this URL in your identity provider"
+        saml_sp_callback_url_label: "SP Callback URL (ACS URL)"
+        saml_sp_callback_url_help: "Configure this URL as the Assertion Consumer Service URL in your IdP"
         copy_button: "Copy"
         cancel: "Cancel"
         submit: "Save Provider"
-        errors_title: "%{count} error prohibited this provider from being saved:"
+        create_provider: "Create Provider"
+        update_provider: "Update Provider"
+        errors_title:
+          one: "An error prohibited this provider from being saved:"
+          other: "%{count} errors prohibited this provider from being saved:"
         provisioning_title: "User Provisioning"
         default_role_label: "Default Role for New Users"
         default_role_help: "Role assigned to users created via just-in-time (JIT) SSO account provisioning. Defaults to Member."
diff --git a/config/locales/views/admin/sso_providers/fr.yml b/config/locales/views/admin/sso_providers/fr.yml
index da1324b9f..28e1337a6 100644
--- a/config/locales/views/admin/sso_providers/fr.yml
+++ b/config/locales/views/admin/sso_providers/fr.yml
@@ -76,6 +76,7 @@ fr:
         provisioning_title: "Provisionnement des utilisateurs"
         default_role_label: "Rôle par défaut pour les nouveaux utilisateurs"
         default_role_help: "Rôle attribué aux utilisateurs créés via le provisionnement SSO juste-à-temps (JIT). Par défaut : Membre."
+        role_guest: "Invité"
         role_member: "Membre"
         role_admin: "Administrateur"
         role_super_admin: "Super Administrateur"
@@ -83,6 +84,7 @@ fr:
         role_mapping_help: "Mappez les groupes/claims IdP aux rôles de l'application. Les utilisateurs se voient attribuer le rôle correspondant le plus élevé. Laisser vide pour utiliser le rôle par défaut ci-dessus."
         super_admin_groups: "Groupes Super Admin"
         admin_groups: "Groupes Admin"
+        guest_groups: "Groupes Invité"
         member_groups: "Groupes Membre"
         groups_help: "Liste de noms de groupes IdP séparés par des virgules. Utilisez * pour correspondre à tous les groupes."
         advanced_title: "Paramètres OIDC avancés"
diff --git a/config/locales/views/admin/sso_providers/hu.yml b/config/locales/views/admin/sso_providers/hu.yml
new file mode 100644
index 000000000..e08bfcb7b
--- /dev/null
+++ b/config/locales/views/admin/sso_providers/hu.yml
@@ -0,0 +1,136 @@
+---
+hu:
+  admin:
+    unauthorized: "Nincs jogosultságod ehhez a területhez."
+    sso_providers:
+      index:
+        page_title: "SSO-szolgáltatók"
+        title: "SSO-szolgáltatók"
+        description: "Az egyszeri bejelentkezési hitelesítési szolgáltatók kezelése a példányodhoz"
+        restart_required: "A módosítások érvénybe lépéséhez szerver-újraindítás szükséges."
+        configured_providers: "Konfigurált szolgáltatók"
+        add_provider: "Szolgáltató hozzáadása"
+        no_providers_title: "Nincsenek SSO-szolgáltatók"
+        no_providers_message: "Kezdd az első SSO-szolgáltató hozzáadásával."
+        note: "Az SSO-szolgáltatók módosításaihoz szerver-újraindítás szükséges. Alternatívaként engedélyezd az AUTH_PROVIDERS_SOURCE=db feature flag-et, hogy a szolgáltatók dinamikusan töltődjenek be az adatbázisból."
+        enabled: "Engedélyezve"
+        disabled: "Letiltva"
+        edit: "Szerkesztés"
+        enable: "Engedélyezés"
+        disable: "Letiltás"
+        delete: "Törlés"
+        configuration_mode: "Konfigurációs mód"
+        db_backed_providers: "Adatbázis-alapú szolgáltatók"
+        db_backed_providers_description: "Szolgáltatók betöltése az adatbázisból YAML konfiguráció helyett"
+        db_backed_providers_help_html: "Állítsd be az <code class=\"bg-surface px-1 py-0.5 rounded text-xs\">AUTH_PROVIDERS_SOURCE=db</code> értéket az adatbázis-alapú szolgáltatók engedélyezéséhez. Ez lehetővé teszi a módosításokat szerver-újraindítás nélkül."
+        table:
+          name: "Név"
+          strategy: "Stratégia"
+          status: "Állapot"
+          issuer: "Kiállító"
+          actions: "Műveletek"
+          enabled: "Engedélyezve"
+          disabled: "Letiltva"
+        legacy_providers_title: "Környezeti változóval konfigurált szolgáltatók"
+        legacy_providers_notice: "Ezek a szolgáltatók környezeti változókon vagy YAML-en keresztül vannak konfigurálva, és nem kezelhetők ezen a felületen. A kezeléshez itt migráld őket adatbázis-alapú szolgáltatókra az AUTH_PROVIDERS_SOURCE=db engedélyezésével, és hozd létre újra a felületen."
+        env_configured: "Env/YAML"
+      new:
+        title: "SSO-szolgáltató hozzáadása"
+        description: "Új egyszeri bejelentkezési hitelesítési szolgáltató konfigurálása"
+      edit:
+        title: "SSO-szolgáltató szerkesztése"
+        description: "Konfiguráció frissítése: %{label}"
+      create:
+        success: "Az SSO-szolgáltató sikeresen létrehozva."
+      update:
+        success: "Az SSO-szolgáltató sikeresen frissítve."
+      destroy:
+        success: "Az SSO-szolgáltató sikeresen törölve."
+        confirm: "Biztosan törölni szeretnéd ezt a szolgáltatót? Ez a művelet nem vonható vissza."
+      toggle:
+        success_enabled: "Az SSO-szolgáltató sikeresen engedélyezve."
+        success_disabled: "Az SSO-szolgáltató sikeresen letiltva."
+        confirm_enable: "Biztosan engedélyezni szeretnéd ezt a szolgáltatót?"
+        confirm_disable: "Biztosan letiltani szeretnéd ezt a szolgáltatót?"
+      form:
+        basic_information: "Alapinformációk"
+        oauth_configuration: "OAuth/OIDC konfiguráció"
+        strategy_label: "Stratégia"
+        strategy_help: "A használandó hitelesítési stratégia"
+        strategy_openid_connect: "OpenID Connect"
+        strategy_saml: "SAML 2.0"
+        strategy_google_oauth2: "Google OAuth2"
+        strategy_github: "GitHub"
+        name_label: "Név"
+        name_placeholder: "pl.: openid_connect, keycloak, authentik"
+        name_help: "Egyedi azonosító (csak kisbetűk, számok és aláhúzás)"
+        label_label: "Felirat"
+        label_placeholder: "pl.: Bejelentkezés Keycloak-kal"
+        label_help: "A felhasználóknak megjelenő gombfelirat"
+        icon_label: "Ikon"
+        icon_placeholder: "pl.: key, google, github"
+        icon_help: "Lucide ikonnév (nem kötelező)"
+        enabled_label: "Szolgáltató engedélyezése"
+        enabled_help: "Ha engedélyezve van, a felhasználók bejelentkezhetnek ezzel a szolgáltatóval"
+        issuer_label: "Kiállító"
+        issuer_placeholder: "https://accounts.google.com"
+        issuer_help: "OIDC kiállítói URL (érvényesíti a .well-known/openid-configuration végpontot)"
+        client_id_label: "Kliens-azonosító"
+        client_id_placeholder: "a-te-kliens-azonositod"
+        client_id_help: "OAuth kliens-azonosító az identitásszolgáltatódtól"
+        client_secret_label: "Kliens-titok"
+        client_secret_placeholder_new: "a-te-kliens-titkod"
+        client_secret_placeholder_existing: "••••••••••••••••"
+        client_secret_help: "OAuth kliens-titok (titkosítva az adatbázisban)"
+        client_secret_help_existing: " – hagyd üresen a meglévő megtartásához"
+        redirect_uri_label: "Átirányítási URI"
+        redirect_uri_placeholder: "https://a-te-domainedet.com/auth/openid_connect/callback"
+        redirect_uri_help: "Visszahívási URL, amelyet konfigurálni kell az identitásszolgáltatódban"
+        saml_sp_callback_url_label: "SP visszahívási URL (ACS URL)"
+        saml_sp_callback_url_help: "Ezt az URL-t kell megadni az Assertion Consumer Service URL-ként az IdP-ben"
+        copy_button: "Másolás"
+        cancel: "Mégse"
+        submit: "Szolgáltató mentése"
+        create_provider: "Szolgáltató létrehozása"
+        update_provider: "Szolgáltató frissítése"
+        errors_title: "%{count} hiba akadályozta meg a szolgáltató mentését:"
+        provisioning_title: "Felhasználói kiépítés"
+        default_role_label: "Alapértelmezett szerepkör az új felhasználókhoz"
+        default_role_help: "Az SSO-n keresztüli just-in-time (JIT) fiókprovisioning során létrehozott felhasználókhoz rendelt szerepkör. Alapértelmezés: Tag."
+        role_guest: "Vendég"
+        role_member: "Tag"
+        role_admin: "Admin"
+        role_super_admin: "Super Admin"
+        role_mapping_title: "Csoport–szerepkör leképezés (nem kötelező)"
+        role_mapping_help: "IdP-csoportok/jogigények leképezése alkalmazásszerepkörökre. A felhasználók a legjobban egyező szerepkört kapják. Hagyd üresen az alapértelmezett szerepkör használatához."
+        super_admin_groups: "Super Admin csoportok"
+        admin_groups: "Admin csoportok"
+        guest_groups: "Vendég csoportok"
+        member_groups: "Tag csoportok"
+        groups_help: "Vesszővel elválasztott IdP-csoportneveket. Használj * karaktert az összes csoport egyezéséhez."
+        advanced_title: "Speciális OIDC beállítások"
+        scopes_label: "Egyéni hatókörök"
+        scopes_help: "Szóközzel elválasztott OIDC hatókörök listája. Hagyd üresen az alapértelmezettekhez (openid email profile). Add hozzá a 'groups' elemet a csoportigények lekéréséhez."
+        prompt_label: "Hitelesítési prompt"
+        prompt_default: "Alapértelmezett (az IdP dönt)"
+        prompt_login: "Bejelentkezés kényszerítése (újrahitelesítés)"
+        prompt_consent: "Hozzájárulás kényszerítése (újraengedélyezés)"
+        prompt_select_account: "Fiókválasztás (fiók kiválasztása)"
+        prompt_none: "Nincs prompt (csendes hitelesítés)"
+        prompt_help: "Meghatározza, hogyan kéri az IdP a felhasználótól a hitelesítést."
+        test_connection: "Kapcsolat tesztelése"
+        saml_configuration: "SAML konfiguráció"
+        idp_metadata_url: "IdP metaadat URL"
+        idp_metadata_url_help: "Az IdP SAML metaadatának URL-je. Ha meg van adva, a többi SAML beállítás automatikusan konfigurálódik."
+        manual_saml_config: "Manuális konfiguráció (ha nem használsz metaadat URL-t)"
+        manual_saml_help: "Csak akkor használd ezeket a beállításokat, ha az IdP nem biztosít metaadat URL-t."
+        idp_sso_url: "IdP SSO URL"
+        idp_slo_url: "IdP SLO URL (nem kötelező)"
+        idp_certificate: "IdP tanúsítvány"
+        idp_certificate_help: "X.509 tanúsítvány PEM formátumban. Kötelező, ha nem metaadat URL-t használsz."
+        idp_cert_fingerprint: "Tanúsítvány ujjlenyomata (alternatíva)"
+        name_id_format: "NameID formátum"
+        name_id_email: "E-mail cím (alapértelmezett)"
+        name_id_persistent: "Állandó"
+        name_id_transient: "Ideiglenes"
+        name_id_unspecified: "Meghatározatlan"
diff --git a/config/locales/views/admin/users/ca.yml b/config/locales/views/admin/users/ca.yml
index e0fa5149a..adb977c85 100644
--- a/config/locales/views/admin/users/ca.yml
+++ b/config/locales/views/admin/users/ca.yml
@@ -3,26 +3,58 @@ ca:
   admin:
     users:
       index:
-        description: Gestiona els rols d'usuari per a la teva instància. Els super administradors poden accedir
-          a la configuració de proveïdors SSO i la gestió d'usuaris.
+        description: Gestiona els rols d'usuari per a la teva instància. Els super
+          administradors poden accedir a la configuració de proveïdors SSO i a la
+          gestió d'usuaris.
+        family_summary: "%{members} membres · %{accounts} comptes · %{transactions}
+          transaccions"
+        filters:
+          role: Rol
+          role_all: Tots els rols
+          submit: Filtra
+          trial_all: Tots
+          trial_expiring_soon: Caduca en 7 dies
+          trial_status: Estat de la prova
+          trial_trialing: En prova
+        invitations:
+          delete: Elimina
+          delete_all: Elimina-ho tot
+          expires: Caduca %{date}
+          pending_label: Convidat (pendent)
+        no_subscription: Sense subscripció
         no_users: No s'han trobat usuaris.
+        not_available: n/d
         role_descriptions:
-          admin: Administrador familiar. Pot accedir a configuracions avançades com claus API,
-            importacions i prompts d'IA.
+          admin: Administrador familiar. Pot accedir a configuracions avançades com
+            claus API, importacions i prompts d'IA.
+          guest: Experiència centrada en l'assistent amb permisos restringits intencionadament
+            per a fluxos d'introducció.
           member: Accés bàsic d'usuari. Pot gestionar els seus propis comptes, transaccions
             i configuracions.
-          super_admin: Administrador d'instància. Pot gestionar proveïdors SSO, rols d'usuari
-            i personificar usuaris per suport.
-        role_descriptions_title: Descripcions de rols
+          super_admin: Administrador d'instància. Pot gestionar proveïdors SSO, rols
+            d'usuari i personificar usuaris per donar suport.
+        role_descriptions_title: Descripcions dels rols
         roles:
           admin: Administrador
+          guest: Convidat
           member: Membre
           super_admin: Super administrador
-        section_title: Usuaris
+        section_title: Famílies / Grups
+        summary:
+          trials_expiring_7_days: Proves que caduquen en els pròxims 7 dies
+        table:
+          family_accounts: Comptes familiars
+          family_transactions: Transaccions familiars
+          last_login: Últim inici de sessió
+          never: Mai
+          role: Rol
+          session_count: Nombre de sessions
+          trial_ends_at: Fi de la prova
+          user: Usuari
         title: Gestió d'usuaris
+        trial_ends_at: Fi de la prova
+        unnamed_family: Família/grup sense nom
         you: "(Tu)"
-        trial_ends_at: Fi de prova
-        not_available: n/a
       update:
         failure: No s'ha pogut actualitzar el rol d'usuari.
-        success: El rol d'usuari s'ha actualitzat correctament.
+        success: Rol d'usuari actualitzat correctament.
diff --git a/config/locales/views/admin/users/fr.yml b/config/locales/views/admin/users/fr.yml
index eaee30343..41ca3c2a8 100644
--- a/config/locales/views/admin/users/fr.yml
+++ b/config/locales/views/admin/users/fr.yml
@@ -5,20 +5,49 @@ fr:
       index:
         title: "Gestion des utilisateurs"
         description: "Gérez les rôles des utilisateurs pour votre instance. Les super administrateurs peuvent accéder aux paramètres des fournisseurs SSO et à la gestion des utilisateurs."
-        section_title: "Utilisateurs"
+        section_title: "Familles / Groupes"
         you: "(Vous)"
         trial_ends_at: "Fin de l'essai"
         not_available: "n/a"
         no_users: "Aucun utilisateur trouvé."
+        unnamed_family: "Famille/Groupe sans nom"
+        no_subscription: "Aucun abonnement"
+        family_summary: "%{members} membres · %{accounts} comptes · %{transactions} transactions"
+        filters:
+          role: "Rôle"
+          role_all: "Tous les rôles"
+          trial_status: "Statut de l'essai"
+          trial_all: "Tous"
+          trial_expiring_soon: "Expire dans 7 jours"
+          trial_trialing: "En essai"
+          submit: "Filtrer"
+        summary:
+          trials_expiring_7_days: "Essais expirant dans les 7 prochains jours"
+        table:
+          user: "Utilisateur"
+          trial_ends_at: "Fin de l'essai"
+          family_accounts: "Comptes de la famille"
+          family_transactions: "Transactions de la famille"
+          last_login: "Dernière connexion"
+          session_count: "Nombre de sessions"
+          never: "Jamais"
+          role: "Rôle"
         role_descriptions_title: "Description des rôles"
         roles:
+          guest: "Invité"
           member: "Membre"
           admin: "Administrateur"
           super_admin: "Super Administrateur"
         role_descriptions:
+          guest: "Expérience axée sur l'assistant avec des permissions volontairement restreintes pour les parcours d'introduction."
           member: "Accès utilisateur de base. Peut gérer ses propres comptes, transactions et paramètres."
           admin: "Administrateur familial. Peut accéder aux paramètres avancés comme les clés API, les importations et les prompts IA."
           super_admin: "Administrateur de l'instance. Peut gérer les fournisseurs SSO, les rôles des utilisateurs et usurper l'identité des utilisateurs pour le support."
+        invitations:
+          pending_label: "Invité (en attente)"
+          expires: "Expire le %{date}"
+          delete: "Supprimer"
+          delete_all: "Tout supprimer"
       update:
         success: "Rôle de l'utilisateur mis à jour avec succès."
         failure: "Échec de la mise à jour du rôle de l'utilisateur."
diff --git a/config/locales/views/admin/users/hu.yml b/config/locales/views/admin/users/hu.yml
new file mode 100644
index 000000000..ee4719c30
--- /dev/null
+++ b/config/locales/views/admin/users/hu.yml
@@ -0,0 +1,53 @@
+---
+hu:
+  admin:
+    users:
+      index:
+        title: "Felhasználókezelés"
+        description: "Felhasználói szerepkörök kezelése a példányodhoz. A szuperadminok hozzáférnek az SSO-szolgáltató beállításaihoz és a felhasználókezeléshez."
+        section_title: "Családok / Csoportok"
+        you: "(Te)"
+        trial_ends_at: "Próbaidő vége"
+        not_available: "n/a"
+        no_users: "Nem találhatók felhasználók."
+        unnamed_family: "Névtelen család/csoport"
+        no_subscription: "Nincs előfizetés"
+        family_summary: "%{members} tag · %{accounts} fiók · %{transactions} tranzakció"
+        filters:
+          role: "Szerepkör"
+          role_all: "Minden szerepkör"
+          trial_status: "Próbaidő állapota"
+          trial_all: "Minden"
+          trial_expiring_soon: "7 napon belül lejár"
+          trial_trialing: "Próbaidőn"
+          submit: "Szűrés"
+        summary:
+          trials_expiring_7_days: "A következő 7 napban lejáró próbaidők"
+        table:
+          user: "Felhasználó"
+          trial_ends_at: "Próbaidő vége"
+          family_accounts: "Családi fiókok"
+          family_transactions: "Családi tranzakciók"
+          last_login: "Utolsó bejelentkezés"
+          session_count: "Munkamenetek száma"
+          never: "Soha"
+          role: "Szerepkör"
+        role_descriptions_title: "Szerepkörök leírása"
+        roles:
+          guest: "Vendég"
+          member: "Tag"
+          admin: "Admin"
+          super_admin: "Super Admin"
+        role_descriptions:
+          guest: "Asszisztens-első élmény, szándékosan korlátozott jogosultságokkal az alapszintű munkafolyamatokhoz."
+          member: "Alap felhasználói hozzáférés. Kezelheti saját fiókjait, tranzakcióit és beállításait."
+          admin: "Családi rendszergazda. Hozzáférhet a fejlett beállításokhoz, mint az API-kulcsok, importálások és AI-promptok."
+          super_admin: "Példány-rendszergazda. Kezelheti az SSO-szolgáltatókat, a felhasználói szerepköröket, és megszemélyesíthet felhasználókat támogatási céllal."
+        invitations:
+          pending_label: "Meghívva (függőben)"
+          expires: "Lejár: %{date}"
+          delete: "Törlés"
+          delete_all: "Összes törlése"
+      update:
+        success: "A felhasználói szerepkör sikeresen frissítve."
+        failure: "Nem sikerült frissíteni a felhasználói szerepkört."
diff --git a/config/locales/views/application/hu.yml b/config/locales/views/application/hu.yml
new file mode 100644
index 000000000..b4b9e8062
--- /dev/null
+++ b/config/locales/views/application/hu.yml
@@ -0,0 +1,10 @@
+---
+hu:
+  number:
+    currency:
+      format:
+        delimiter: " "
+        format: "%n %u"
+        precision: 0
+        separator: ","
+        unit: "Ft"
diff --git a/config/locales/views/beta/ca.yml b/config/locales/views/beta/ca.yml
new file mode 100644
index 000000000..9484728c3
--- /dev/null
+++ b/config/locales/views/beta/ca.yml
@@ -0,0 +1,5 @@
+---
+ca:
+  beta:
+    not_enabled: Aquesta funció està en beta. Activa les funcions beta a Configuració
+      → Preferències per provar-la.
diff --git a/config/locales/views/binance_items/ca.yml b/config/locales/views/binance_items/ca.yml
new file mode 100644
index 000000000..c33580047
--- /dev/null
+++ b/config/locales/views/binance_items/ca.yml
@@ -0,0 +1,81 @@
+---
+ca:
+  binance_item:
+    syncer:
+      accounts_need_setup:
+        one: "%{count} compte necessita configuració"
+        other: "%{count} comptes necessiten configuració"
+      calculating_balances: Calculant saldos...
+      checking_configuration: Comprovant la configuració del compte...
+      checking_credentials: Comprovant credencials...
+      credentials_invalid: Credencials de l'API no vàlides. Revisa la teva clau API
+        i el secret.
+      importing_accounts: Important comptes des de Binance...
+      processing_accounts: Processant dades del compte...
+  binance_items:
+    binance_item:
+      delete: Elimina
+      deletion_in_progress: Eliminant...
+      import_accounts_menu: Importa compte
+      no_accounts_message: El teu portafoli de Binance apareixerà aquí després de
+        sincronitzar.
+      no_accounts_title: No s'han trobat comptes
+      provider_name: Binance
+      reconnect: Les credencials necessiten actualització
+      setup_action: Importa compte
+      setup_description: Selecciona quins portafolis de Binance vols seguir.
+      setup_needed: Compte a punt per importar
+      stale_rate_warning: El saldo és aproximat — el tipus de canvi exacte per a %{date}
+        no estava disponible. S'actualitzarà a la propera sincronització.
+      status: Darrera sincronització fa %{timestamp}
+      status_never: Mai sincronitzat
+      status_with_summary: Darrera sincronització fa %{timestamp} - %{summary}
+      sync_status:
+        all_synced:
+          one: "%{count} compte sincronitzat"
+          other: "%{count} comptes sincronitzats"
+        no_accounts: No s'han trobat comptes
+        partial_sync: "%{linked_count} sincronitzats, %{unlinked_count} necessiten
+          configuració"
+      syncing: Sincronitzant...
+      update_credentials: Actualitza les credencials
+    complete_account_setup:
+      no_accounts: No hi ha comptes per importar
+      none_selected: No s'ha seleccionat cap compte
+      success:
+        one: S'ha importat %{count} compte
+        other: S'han importat %{count} comptes
+    create:
+      default_name: Binance
+      success: S'ha connectat correctament a Binance! El teu compte s'està sincronitzant.
+    destroy:
+      success: S'ha programat la connexió Binance per a la seva eliminació.
+    link_existing_account:
+      errors:
+        invalid_binance_account: Compte Binance no vàlid
+        only_manual: Només els comptes manuals es poden enllaçar a Binance
+      success: S'ha enllaçat correctament al compte Binance
+    select_existing_account:
+      cancel: Cancel·la
+      check_provider_health: Comprova que les teves credencials de l'API de Binance
+        siguin vàlides
+      currently_linked_to: 'Actualment enllaçat a: %{account_name}'
+      link: Enllaça
+      no_accounts_found: No s'han trobat comptes Binance.
+      title: Enllaça compte Binance
+      wait_for_sync: Espera que Binance acabi la sincronització
+    setup_accounts:
+      accounts_count:
+        one: "%{count} compte disponible"
+        other: "%{count} comptes disponibles"
+      cancel: Cancel·la
+      creating: Important...
+      import_selected: Importa els seleccionats
+      instructions: Selecciona els portafolis de Binance que vols importar. Només
+        es mostren els portafolis amb saldos.
+      no_accounts: Tots els comptes s'han importat.
+      select_all: Selecciona-ho tot
+      subtitle: Selecciona quins portafolis vols seguir
+      title: Importa compte Binance
+    update:
+      success: La configuració de Binance s'ha actualitzat correctament.
diff --git a/config/locales/views/binance_items/fr.yml b/config/locales/views/binance_items/fr.yml
new file mode 100644
index 000000000..9ec085aa4
--- /dev/null
+++ b/config/locales/views/binance_items/fr.yml
@@ -0,0 +1,75 @@
+---
+fr:
+  binance_items:
+    create:
+      default_name: Binance
+      success: Connexion à Binance réussie. Votre compte est en cours de synchronisation.
+    update:
+      success: Configuration Binance mise à jour.
+    destroy:
+      success: Connexion Binance mise en file d'attente pour suppression.
+    setup_accounts:
+      title: Importer le compte Binance
+      subtitle: Sélectionnez les portefeuilles à suivre
+      instructions: Sélectionnez les portefeuilles Binance que vous souhaitez importer. Seuls les portefeuilles avec un solde sont affichés.
+      no_accounts: Tous les comptes ont été importés.
+      accounts_count:
+        one: "%{count} compte disponible"
+        other: "%{count} comptes disponibles"
+      select_all: Tout sélectionner
+      import_selected: Importer la sélection
+      cancel: Annuler
+      creating: Importation…
+    complete_account_setup:
+      success:
+        one: "%{count} compte importé"
+        other: "%{count} comptes importés"
+      none_selected: Aucun compte sélectionné
+      no_accounts: Aucun compte à importer
+    binance_item:
+      provider_name: Binance
+      syncing: Synchronisation…
+      reconnect: Identifiants à mettre à jour
+      deletion_in_progress: Suppression…
+      sync_status:
+        no_accounts: Aucun compte trouvé
+        all_synced:
+          one: "%{count} compte synchronisé"
+          other: "%{count} comptes synchronisés"
+        partial_sync: "%{linked_count} synchronisé(s), %{unlinked_count} à configurer"
+      status: "Dernière synchronisation il y a %{timestamp}"
+      status_with_summary: "Dernière synchronisation il y a %{timestamp} - %{summary}"
+      status_never: Jamais synchronisé
+      update_credentials: Mettre à jour les identifiants
+      delete: Supprimer
+      no_accounts_title: Aucun compte trouvé
+      no_accounts_message: Votre portefeuille Binance apparaîtra ici après la synchronisation.
+      setup_needed: Compte prêt à être importé
+      setup_description: Sélectionnez les portefeuilles Binance que vous souhaitez suivre.
+      setup_action: Importer le compte
+      import_accounts_menu: Importer le compte
+      stale_rate_warning: "Solde approximatif — le taux de change exact du %{date} n'était pas disponible. Il sera mis à jour lors de la prochaine synchronisation."
+    select_existing_account:
+      title: Lier un compte Binance
+      no_accounts_found: Aucun compte Binance trouvé.
+      wait_for_sync: Attendez que Binance termine la synchronisation
+      check_provider_health: Vérifiez que vos identifiants API Binance sont valides
+      currently_linked_to: "Actuellement lié à : %{account_name}"
+      link: Lier
+      cancel: Annuler
+    link_existing_account:
+      success: Compte Binance lié avec succès
+      errors:
+        only_manual: Seuls les comptes manuels peuvent être liés à Binance
+        invalid_binance_account: Compte Binance invalide
+  binance_item:
+    syncer:
+      checking_credentials: Vérification des identifiants…
+      credentials_invalid: Identifiants API invalides. Veuillez vérifier votre clé API et votre secret.
+      importing_accounts: Importation des comptes depuis Binance…
+      checking_configuration: Vérification de la configuration du compte…
+      accounts_need_setup:
+        one: "%{count} compte à configurer"
+        other: "%{count} comptes à configurer"
+      processing_accounts: Traitement des données du compte…
+      calculating_balances: Calcul des soldes…
diff --git a/config/locales/views/binance_items/hu.yml b/config/locales/views/binance_items/hu.yml
new file mode 100644
index 000000000..45606eb91
--- /dev/null
+++ b/config/locales/views/binance_items/hu.yml
@@ -0,0 +1,75 @@
+---
+hu:
+  binance_items:
+    create:
+      default_name: Binance
+      success: Sikeresen csatlakoztál a Binance-hez! A számlád szinkronizálása folyamatban van.
+    update:
+      success: A Binance konfiguráció sikeresen frissítve.
+    destroy:
+      success: A Binance kapcsolat törlése ütemezve.
+    setup_accounts:
+      title: Binance számla importálása
+      subtitle: Válaszd ki, melyik portfóliókat szeretnéd követni
+      instructions: Válaszd ki, melyik Binance portfóliókat szeretnéd importálni. Csak az egyenleggel rendelkező portfóliók jelennek meg.
+      no_accounts: Minden számla importálva lett.
+      accounts_count:
+        one: "%{count} számla elérhető"
+        other: "%{count} számla elérhető"
+      select_all: Összes kijelölése
+      import_selected: Kijelöltek importálása
+      cancel: Mégse
+      creating: Importálás...
+    complete_account_setup:
+      success:
+        one: "%{count} számla importálva"
+        other: "%{count} számla importálva"
+      none_selected: Nincs kijelölt számla
+      no_accounts: Nincs importálható számla
+    binance_item:
+      provider_name: Binance
+      syncing: Szinkronizálás...
+      reconnect: A hitelesítő adatok frissítése szükséges
+      deletion_in_progress: Törlés folyamatban...
+      sync_status:
+        no_accounts: Nem találhatók számlák
+        all_synced:
+          one: "%{count} számla szinkronizálva"
+          other: "%{count} számla szinkronizálva"
+        partial_sync: "%{linked_count} szinkronizálva, %{unlinked_count} beállítást igényel"
+      status: "Utolsó szinkronizálás: %{timestamp} ezelőtt"
+      status_with_summary: "Utolsó szinkronizálás: %{timestamp} ezelőtt – %{summary}"
+      status_never: Még nem volt szinkronizálva
+      update_credentials: Hitelesítő adatok frissítése
+      delete: Töröl
+      no_accounts_title: Nem találhatók számlák
+      no_accounts_message: A Binance portfóliód szinkronizálás után fog megjelenni itt.
+      setup_needed: Számla importálásra kész
+      setup_description: Válaszd ki, melyik Binance portfóliókat szeretnéd követni.
+      setup_action: Számla importálása
+      import_accounts_menu: Számla importálása
+      stale_rate_warning: "Az egyenleg közelítő érték – a(z) %{date}-i pontos árfolyam nem volt elérhető. A következő szinkronizáláskor frissülni fog."
+    select_existing_account:
+      title: Binance számla összekapcsolása
+      no_accounts_found: Nem találhatók Binance számlák.
+      wait_for_sync: Várd meg, amíg a Binance befejezi a szinkronizálást
+      check_provider_health: Ellenőrizd, hogy a Binance API hitelesítő adataid érvényesek-e
+      currently_linked_to: "Jelenleg összekapcsolva: %{account_name}"
+      link: Összekapcsolás
+      cancel: Mégse
+    link_existing_account:
+      success: Sikeresen összekapcsolva a Binance számlával
+      errors:
+        only_manual: Csak manuális számlák kapcsolhatók össze a Binance-szel
+        invalid_binance_account: Érvénytelen Binance számla
+  binance_item:
+    syncer:
+      checking_credentials: Hitelesítő adatok ellenőrzése...
+      credentials_invalid: Érvénytelen API hitelesítő adatok. Kérjük, ellenőrizd az API kulcsodat és a titkos kódodat.
+      importing_accounts: Számlák importálása a Binance-ből...
+      checking_configuration: Számlakonfiguráció ellenőrzése...
+      accounts_need_setup:
+        one: "%{count} számla beállítást igényel"
+        other: "%{count} számla beállítást igényel"
+      processing_accounts: Számlaadatok feldolgozása...
+      calculating_balances: Egyenlegek kiszámítása...
diff --git a/config/locales/views/brex_items/ca.yml b/config/locales/views/brex_items/ca.yml
new file mode 100644
index 000000000..cbe5595c7
--- /dev/null
+++ b/config/locales/views/brex_items/ca.yml
@@ -0,0 +1,308 @@
+---
+ca:
+  brex_items:
+    account_metadata:
+      provider: Brex
+      separator: " • "
+    api_error:
+      common_issues: 'Problemes habituals:'
+      expired_credentials: Genera un nou token API des de Brex.
+      expired_credentials_label: 'Credencials caducades:'
+      heading: No s'ha pogut connectar a Brex
+      invalid_token: Revisa el teu token API a la configuració del proveïdor.
+      invalid_token_label: 'Token API no vàlid:'
+      network: Comprova la teva connexió a internet.
+      network_label: 'Problema de xarxa:'
+      permissions: Assegura't que el teu token té els permisos necessaris només de
+        lectura per a comptes i transaccions.
+      permissions_label: 'Permisos insuficients:'
+      service: L'API de Brex pot estar temporalment no disponible.
+      service_label: 'Servei caigut:'
+      settings_link: Revisa la configuració del proveïdor
+      title: Error de connexió Brex
+    brex_item:
+      accounts_need_setup: Els comptes necessiten configuració
+      delete: Elimina la connexió
+      deletion_in_progress: eliminació en curs...
+      error: Error
+      no_accounts_description: Aquesta connexió encara no té comptes enllaçats.
+      no_accounts_title: No hi ha comptes
+      setup_action: Configura els nous comptes
+      setup_description: "%{linked} de %{total} comptes enllaçats. Tria els tipus
+        de compte per als teus nous comptes Brex importats."
+      setup_needed: Nous comptes a punt per configurar
+      status: Sincronitzat fa %{timestamp}
+      status_never: Mai sincronitzat
+      status_with_summary: Darrera sincronització fa %{timestamp} - %{summary}
+      syncing: Sincronitzant...
+      total: Total
+      unlinked: Sense enllaç
+    complete_account_setup:
+      all_skipped: S'han omès tots els comptes. No s'ha creat cap compte.
+      creation_failed: 'No s''han pogut crear els comptes: %{error}'
+      creation_failed_count: No s'han pogut crear %{count} compte(s).
+      no_accounts: No hi ha comptes per configurar.
+      partial_skipped: S'han creat correctament %{created_count} compte(s); s'han
+        omès %{skipped_count} compte(s).
+      partial_success: S'han creat correctament %{created_count} compte(s), però %{failed_count}
+        compte(s) han fallat.
+      success: S'han creat correctament %{count} compte(s).
+      unexpected_error: S'ha produït un error inesperat.
+    create:
+      success: La connexió Brex s'ha creat correctament
+    default_card_name: Targeta Brex
+    default_cash_name: Brex Cash %{id}
+    default_connection_name: Connexió Brex
+    destroy:
+      success: La connexió Brex s'ha eliminat
+    entries:
+      default_name: Transacció Brex
+    errors:
+      unexpected_error: S'ha produït un error inesperat. Torna-ho a provar més tard.
+    index:
+      title: Connexions Brex
+    institution_summary:
+      count:
+        one: "%{count} entitat"
+        other: "%{count} entitats"
+      none: No hi ha entitats connectades
+      one: "%{name}"
+    kinds:
+      card: Targeta
+      cash: Efectiu
+    link_accounts:
+      all_already_linked:
+        one: El compte seleccionat (%{names}) ja està enllaçat
+        other: 'Tots els %{count} comptes seleccionats ja estan enllaçats: %{names}'
+      api_error: 'Error de l''API: %{message}'
+      invalid_account_names:
+        one: No es pot enllaçar un compte sense nom
+        other: No es poden enllaçar %{count} comptes sense nom
+      invalid_account_type: Tipus de compte Brex no admès
+      link_failed: No s'han pogut enllaçar els comptes
+      no_accounts_selected: Selecciona almenys un compte
+      no_api_token: No s'ha trobat el token API de Brex. Configura'l a la configuració
+        del proveïdor.
+      partial_invalid: S'han enllaçat correctament %{created_count} compte(s), %{already_linked_count}
+        compte(s) ja estaven enllaçats, %{invalid_count} compte(s) tenien noms no
+        vàlids
+      partial_success: 'S''han enllaçat correctament %{created_count} compte(s). %{already_linked_count}
+        compte(s) ja estaven enllaçats: %{already_linked_names}'
+      select_connection: Tria una connexió Brex abans d'enllaçar comptes.
+      success:
+        one: S'ha enllaçat correctament %{count} compte
+        other: S'han enllaçat correctament %{count} comptes
+    link_existing_account:
+      account_already_linked: Aquest compte ja està enllaçat a un proveïdor
+      api_error: 'Error de l''API: %{message}'
+      invalid_account_name: No es pot enllaçar un compte sense nom
+      missing_parameters: Falten paràmetres obligatoris
+      no_account_specified: No s'ha especificat cap compte
+      no_api_token: No s'ha trobat el token API de Brex. Configura'l a la configuració
+        del proveïdor.
+      provider_account_already_linked: Aquest compte Brex ja està enllaçat a un altre
+        compte
+      provider_account_not_found: No s'ha trobat el compte Brex
+      select_connection: Tria una connexió Brex abans d'enllaçar comptes.
+      success: S'ha enllaçat correctament %{account_name} amb Brex
+    loading:
+      loading_message: Carregant comptes Brex...
+      loading_title: Carregant
+    provider_connection:
+      default_description: Connecta't al teu compte Brex
+      default_name: Brex
+      description: Connecta amb %{name}
+      name: Brex - %{name}
+    provider_panel:
+      accounts_link: Comptes
+      add_connection: Afegeix connexió Brex
+      base_url_label: URL base (opcional)
+      base_url_placeholder: https://api.brex.com
+      configured_html: Configurat i a punt per utilitzar. Visita la pestanya %{accounts_link}
+        per gestionar i configurar comptes.
+      connection_name_label: Nom de la connexió
+      connection_name_placeholder: Compte corrent d'empresa
+      default_connection_name: Connexió Brex
+      disconnect_confirm: Vols desconnectar %{name}?
+      disconnect_label: Desconnecta %{name}
+      encryption_warning:
+        message: Configura les claus de xifrat d'Active Record abans d'afegir tokens
+          de Brex en producció. Sense claus de xifrat, Sure emmagatzema les credencials
+          i les instantànies del proveïdor Brex en text pla com altres registres de
+          proveïdors.
+        title: El xifrat de la base de dades no està configurat
+      instructions:
+        copy_token_html: Copia el token i afegeix-lo com a connexió amb nom a continuació.
+          Sure emmagatzema el token només per sincronitzar aquesta família.
+        create_token: 'Crea un token API amb aquests permisos només de lectura: accounts.cash.readonly,
+          accounts.card.readonly, transactions.cash.readonly, transactions.card.readonly'
+        open_tokens: Ves a la configuració de tokens API/desenvolupador de Brex per
+          a l'empresa que vols connectar
+        sign_in_html: Visita %{link} i inicia sessió al compte que vols connectar
+      keep_token_placeholder: Deixa-ho en blanc per mantenir el token actual
+      not_configured: No configurat
+      sandbox_note_html: Utilitza una connexió amb nom separada per a cada empresa/token
+        API de Brex que vulguis sincronitzar. Deixa l'URL base en blanc per a producció.
+        El staging està limitat a les proves aprovades per Brex i no funciona amb tokens
+        de clients.
+      setup_accounts: Configura comptes
+      setup_title: 'Instruccions de configuració:'
+      sync: Sincronitza
+      token_label: Token
+      token_placeholder: Enganxa el token aquí
+      update_connection: Actualitza la connexió
+    select_accounts:
+      accounts_selected: comptes seleccionats
+      api_error: 'Error de l''API: %{message}'
+      cancel: Cancel·la
+      configure_name_in_brex: No es pot importar — configura el nom del compte a Brex
+      description: Selecciona els comptes que vols enllaçar al teu compte de %{product_name}.
+      link_accounts: Enllaça els comptes seleccionats
+      no_accounts_found: No s'han trobat comptes. Comprova la configuració del teu
+        token API.
+      no_api_token: No s'ha trobat el token API de Brex. Configura'l a la configuració
+        del proveïdor.
+      no_credentials_configured: Primer, configura el teu token API de Brex a la configuració
+        del proveïdor.
+      no_name_placeholder: "(Sense nom)"
+      select_connection: Tria una connexió Brex a la configuració del proveïdor.
+      title: Selecciona comptes Brex
+      unexpected_error: S'ha produït un error inesperat. Torna-ho a provar més tard.
+    select_existing_account:
+      account_already_linked: Aquest compte ja està enllaçat a un proveïdor
+      all_accounts_already_linked: Tots els comptes Brex ja estan enllaçats
+      api_error: 'Error de l''API: %{message}'
+      cancel: Cancel·la
+      configure_name_in_brex: No es pot importar — configura el nom del compte a Brex
+      description: Selecciona un compte Brex per enllaçar-lo amb aquest compte. Les
+        transaccions es sincronitzaran i deduplicaran automàticament.
+      link_account: Enllaça compte
+      no_account_specified: No s'ha especificat cap compte
+      no_accounts_found: No s'han trobat comptes Brex. Comprova la configuració del
+        teu token API.
+      no_api_token: No s'ha trobat el token API de Brex. Configura'l a la configuració
+        del proveïdor.
+      no_credentials_configured: Primer, configura el teu token API de Brex a la configuració
+        del proveïdor.
+      no_name_placeholder: "(Sense nom)"
+      select_connection: Tria una connexió Brex a la configuració del proveïdor.
+      title: Enllaça %{account_name} amb Brex
+      unexpected_error: S'ha produït un error inesperat. Torna-ho a provar més tard.
+    setup_accounts:
+      account_type_label: 'Tipus de compte:'
+      account_types:
+        credit_card: Targeta de crèdit
+        depository: Compte corrent o d'estalvis
+        investment: Compte d'inversió
+        loan: Préstec o hipoteca
+        other_asset: Altre actiu
+        skip: Omet aquest compte
+      all_accounts_linked: Tots els teus comptes Brex ja s'han configurat.
+      api_error: 'Error de l''API: %{message}'
+      balance: Saldo
+      cancel: Cancel·la
+      choose_account_type: 'Tria el tipus de compte correcte per a cada compte Brex:'
+      create_accounts: Crea comptes
+      creating_accounts: Creant comptes...
+      fetch_failed: No s'han pogut obtenir els comptes
+      historical_data_range: 'Rang de dades històriques:'
+      no_accounts_to_setup: No hi ha comptes per configurar
+      no_api_token: No s'ha trobat el token API de Brex. Configura'l a la configuració
+        del proveïdor.
+      subtitle: Tria els tipus de compte correctes per als teus comptes importats
+      subtype_labels:
+        credit_card: ''
+        depository: 'Subtipus de compte:'
+        investment: 'Tipus d''inversió:'
+        loan: 'Tipus de préstec:'
+        other_asset: ''
+      subtype_messages:
+        credit_card: Les targetes de crèdit es configuraran automàticament com a comptes
+          de targeta de crèdit.
+        other_asset: No calen opcions addicionals per a altres actius.
+      subtypes:
+        depository:
+          cd: Certificat de dipòsit
+          checking: Compte corrent
+          hsa: Compte d'estalvi per a salut
+          money_market: Mercat monetari
+          savings: Estalvis
+        investment:
+          401k: 401(k)
+          403b: 403(b)
+          529_plan: Pla 529
+          angel: Inversió àngel
+          brokerage: Corredoria
+          hsa: Compte d'estalvi per a salut
+          ira: IRA tradicional
+          mutual_fund: Fons d'inversió
+          pension: Pensió
+          retirement: Jubilació
+          roth_401k: Roth 401(k)
+          roth_ira: IRA Roth
+          tsp: Pla d'estalvis de jubilació (TSP)
+        loan:
+          auto: Préstec d'automòbil
+          mortgage: Hipoteca
+          other: Altre préstec
+          student: Préstec d'estudis
+      sync_start_date_help: Selecciona fins on vols sincronitzar l'historial de transaccions.
+        Hi ha un màxim de 3 anys d'historial disponible.
+      sync_start_date_label: 'Comença a sincronitzar transaccions des de:'
+      title: Configura els teus comptes Brex
+    setup_required:
+      description: Abans d'enllaçar comptes Brex, has de configurar el teu token API
+        de Brex.
+      heading: Token API no configurat
+      settings_link: Ves a la configuració del proveïdor
+      setup_steps: 'Passos de configuració:'
+      steps:
+        enter_token: Introdueix el teu token API de Brex
+        find_section_html: Localitza la secció <strong>Brex</strong>
+        open_settings_html: Ves a <strong>Configuració > Proveïdors</strong>
+        return_to_link: Torna aquí per enllaçar els teus comptes
+      title: Cal configurar Brex
+    statuses:
+      ACTIVE: Actiu
+      CLOSED: Tancat
+      FROZEN: Congelat
+      active: Actiu
+      closed: Tancat
+      frozen: Congelat
+    subtype_select:
+      placeholder:
+        subtype: Selecciona el subtipus
+        type: Selecciona el tipus
+    sync:
+      success: Sincronització iniciada
+    sync_status:
+      all_synced:
+        one: "%{count} compte sincronitzat"
+        other: "%{count} comptes sincronitzats"
+      no_accounts: No s'han trobat comptes
+      partial_setup: "%{synced} sincronitzats, %{pending} necessiten configuració"
+    syncer:
+      account_processing_failed:
+        one: "%{count} compte Brex ha fallat durant el processament."
+        other: "%{count} comptes Brex han fallat durant el processament."
+      account_sync_failed:
+        one: "%{count} sincronització de compte Brex no s'ha pogut programar."
+        other: "%{count} sincronitzacions de compte Brex no s'han pogut programar."
+      accounts_failed:
+        one: "%{count} compte Brex no s'ha pogut importar."
+        other: "%{count} comptes Brex no s'han pogut importar."
+      accounts_need_setup:
+        one: "%{count} compte necessita configuració..."
+        other: "%{count} comptes necessiten configuració..."
+      calculating_balances: Calculant saldos...
+      checking_account_configuration: Comprovant la configuració dels comptes...
+      credentials_invalid: Token API de Brex no vàlid o permisos del compte incorrectes
+      failed: La sincronització ha fallat. Torna-ho a provar o contacta amb el suport.
+      import_failed: La importació de Brex ha fallat.
+      importing_accounts: Important comptes des de Brex...
+      processing_transactions: Processant transaccions...
+      transactions_failed:
+        one: "%{count} compte Brex ha tingut errors d'importació de transaccions."
+        other: "%{count} comptes Brex han tingut errors d'importació de transaccions."
+    update:
+      success: La connexió Brex s'ha actualitzat
diff --git a/config/locales/views/brex_items/en.yml b/config/locales/views/brex_items/en.yml
new file mode 100644
index 000000000..d090cb6dd
--- /dev/null
+++ b/config/locales/views/brex_items/en.yml
@@ -0,0 +1,277 @@
+---
+en:
+  brex_items:
+    default_connection_name: Brex Connection
+    account_metadata:
+      provider: Brex
+      separator: " • "
+    kinds:
+      cash: Cash
+      card: Card
+    statuses:
+      ACTIVE: Active
+      active: Active
+      CLOSED: Closed
+      closed: Closed
+      frozen: Frozen
+      FROZEN: Frozen
+    create:
+      success: Brex connection created successfully
+    default_card_name: Brex Card
+    default_cash_name: "Brex Cash %{id}"
+    destroy:
+      success: Brex connection removed
+    index:
+      title: Brex Connections
+    institution_summary:
+      none: No institutions connected
+      one: "%{name}"
+      count:
+        one: "%{count} institution"
+        other: "%{count} institutions"
+    sync_status:
+      no_accounts: No accounts found
+      all_synced:
+        one: "%{count} account synced"
+        other: "%{count} accounts synced"
+      partial_setup: "%{synced} synced, %{pending} need setup"
+    api_error:
+      common_issues: "Common issues:"
+      expired_credentials: Generate a new API token from Brex.
+      expired_credentials_label: "Expired credentials:"
+      heading: Unable to connect to Brex
+      invalid_token: Check your API token in Provider Settings.
+      invalid_token_label: "Invalid API token:"
+      network: Check your internet connection.
+      network_label: "Network issue:"
+      permissions: Ensure your token has the required read-only account and transaction scopes.
+      permissions_label: "Insufficient permissions:"
+      service: Brex API may be temporarily unavailable.
+      service_label: "Service down:"
+      settings_link: Check Provider Settings
+      title: Brex Connection Error
+    errors:
+      unexpected_error: An unexpected error occurred. Please try again later.
+    entries:
+      default_name: Brex transaction
+    loading:
+      loading_message: Loading Brex accounts...
+      loading_title: Loading
+    link_accounts:
+      all_already_linked:
+        one: "The selected account (%{names}) is already linked"
+        other: "All %{count} selected accounts are already linked: %{names}"
+      api_error: "API error: %{message}"
+      invalid_account_names:
+        one: "Cannot link account with blank name"
+        other: "Cannot link %{count} accounts with blank names"
+      invalid_account_type: Unsupported Brex account type
+      link_failed: Failed to link accounts
+      no_accounts_selected: Please select at least one account
+      no_api_token: Brex API token not found. Please configure it in Provider Settings.
+      partial_invalid: "Successfully linked %{created_count} account(s), %{already_linked_count} account(s) were already linked, %{invalid_count} account(s) had invalid names"
+      partial_success: "Successfully linked %{created_count} account(s). %{already_linked_count} account(s) were already linked: %{already_linked_names}"
+      select_connection: Choose a Brex connection before linking accounts.
+      success:
+        one: "Successfully linked %{count} account"
+        other: "Successfully linked %{count} accounts"
+    brex_item:
+      accounts_need_setup: Accounts need setup
+      delete: Delete connection
+      deletion_in_progress: deletion in progress...
+      error: Error
+      no_accounts_description: This connection has no linked accounts yet.
+      no_accounts_title: No accounts
+      setup_action: Set Up New Accounts
+      setup_description: "%{linked} of %{total} accounts linked. Choose account types for your newly imported Brex accounts."
+      setup_needed: New accounts ready to set up
+      status: "Synced %{timestamp} ago"
+      status_never: Never synced
+      status_with_summary: "Last synced %{timestamp} ago - %{summary}"
+      syncing: Syncing...
+      total: Total
+      unlinked: Unlinked
+    provider_panel:
+      accounts_link: Accounts
+      add_connection: Add Brex connection
+      base_url_label: Base URL (optional)
+      base_url_placeholder: https://api.brex.com
+      configured_html: "Configured and ready to use. Visit the %{accounts_link} tab to manage and set up accounts."
+      connection_name_label: Connection name
+      connection_name_placeholder: Business checking
+      default_connection_name: Brex Connection
+      disconnect_label: "Disconnect %{name}"
+      disconnect_confirm: "Disconnect %{name}?"
+      encryption_warning:
+        title: Database encryption is not configured
+        message: Configure Active Record encryption keys before adding Brex tokens in production. Without encryption keys, Sure stores Brex provider credentials and snapshots in plaintext like other provider records.
+      instructions:
+        copy_token_html: "Copy the token and add it as a named connection below. Sure stores the token only for syncing this family."
+        create_token: "Create an API token with these read-only scopes: accounts.cash.readonly, accounts.card.readonly, transactions.cash.readonly, transactions.card.readonly"
+        open_tokens: Go to the Brex developer/API token settings for the company you want to connect
+        sign_in_html: "Visit %{link} and log in to the account you want to connect"
+      keep_token_placeholder: Leave blank to keep the current token
+      not_configured: Not configured
+      sandbox_note_html: "Use a separate named connection for each Brex company/API token you want to sync. Leave Base URL blank for production. Staging is limited to Brex-approved testing and does not work with customer tokens."
+      setup_accounts: Set up accounts
+      setup_title: "Setup instructions:"
+      sync: Sync
+      token_label: Token
+      token_placeholder: Paste token here
+      update_connection: Update connection
+    provider_connection:
+      default_description: Connect to your Brex account
+      default_name: Brex
+      description: "Connect using %{name}"
+      name: "Brex - %{name}"
+    select_accounts:
+      accounts_selected: accounts selected
+      api_error: "API error: %{message}"
+      cancel: Cancel
+      configure_name_in_brex: Cannot import - please configure account name in Brex
+      description: Select the accounts you want to link to your %{product_name} account.
+      link_accounts: Link selected accounts
+      no_accounts_found: No accounts found. Please check your API token configuration.
+      no_api_token: Brex API token not found. Please configure it in Provider Settings.
+      no_credentials_configured: Please configure your Brex API token first in Provider Settings.
+      no_name_placeholder: "(No name)"
+      select_connection: Choose a Brex connection in Provider Settings.
+      title: Select Brex Accounts
+      unexpected_error: An unexpected error occurred. Please try again later.
+    select_existing_account:
+      account_already_linked: This account is already linked to a provider
+      all_accounts_already_linked: All Brex accounts are already linked
+      api_error: "API error: %{message}"
+      cancel: Cancel
+      configure_name_in_brex: Cannot import - please configure account name in Brex
+      description: Select a Brex account to link with this account. Transactions will be synced and deduplicated automatically.
+      link_account: Link account
+      no_account_specified: No account specified
+      no_accounts_found: No Brex accounts found. Please check your API token configuration.
+      no_api_token: Brex API token not found. Please configure it in Provider Settings.
+      no_credentials_configured: Please configure your Brex API token first in Provider Settings.
+      no_name_placeholder: "(No name)"
+      select_connection: Choose a Brex connection in Provider Settings.
+      title: "Link %{account_name} with Brex"
+      unexpected_error: An unexpected error occurred. Please try again later.
+    setup_required:
+      description: Before you can link Brex accounts, you need to configure your Brex API token.
+      heading: API Token Not Configured
+      settings_link: Go to Provider Settings
+      setup_steps: "Setup steps:"
+      steps:
+        enter_token: Enter your Brex API token
+        find_section_html: "Find the <strong>Brex</strong> section"
+        open_settings_html: "Go to <strong>Settings > Providers</strong>"
+        return_to_link: Return here to link your accounts
+      title: Brex Setup Required
+    subtype_select:
+      placeholder:
+        subtype: Select subtype
+        type: Select type
+    link_existing_account:
+      account_already_linked: This account is already linked to a provider
+      api_error: "API error: %{message}"
+      invalid_account_name: Cannot link account with blank name
+      missing_parameters: Missing required parameters
+      no_account_specified: No account specified
+      no_api_token: Brex API token not found. Please configure it in Provider Settings.
+      provider_account_already_linked: This Brex account is already linked to another account
+      provider_account_not_found: Brex account not found
+      select_connection: Choose a Brex connection before linking accounts.
+      success: "Successfully linked %{account_name} with Brex"
+    setup_accounts:
+      account_type_label: "Account Type:"
+      all_accounts_linked: "All your Brex accounts have already been set up."
+      api_error: "API error: %{message}"
+      fetch_failed: "Failed to Fetch Accounts"
+      no_accounts_to_setup: "No Accounts to Set Up"
+      no_api_token: Brex API token not found. Please configure it in Provider Settings.
+      account_types:
+        skip: Skip this account
+        depository: Checking or Savings Account
+        credit_card: Credit Card
+        investment: Investment Account
+        loan: Loan or Mortgage
+        other_asset: Other Asset
+      subtype_labels:
+        depository: "Account Subtype:"
+        credit_card: ""
+        investment: "Investment Type:"
+        loan: "Loan Type:"
+        other_asset: ""
+      subtype_messages:
+        credit_card: "Credit cards will be automatically set up as credit card accounts."
+        other_asset: "No additional options needed for Other Assets."
+      subtypes:
+        depository:
+          checking: Checking
+          savings: Savings
+          hsa: Health Savings Account
+          cd: Certificate of Deposit
+          money_market: Money Market
+        investment:
+          brokerage: Brokerage
+          pension: Pension
+          retirement: Retirement
+          "401k": "401(k)"
+          roth_401k: "Roth 401(k)"
+          "403b": "403(b)"
+          tsp: Thrift Savings Plan
+          "529_plan": "529 Plan"
+          hsa: Health Savings Account
+          mutual_fund: Mutual Fund
+          ira: Traditional IRA
+          roth_ira: Roth IRA
+          angel: Angel
+        loan:
+          mortgage: Mortgage
+          student: Student Loan
+          auto: Auto Loan
+          other: Other Loan
+      balance: Balance
+      cancel: Cancel
+      choose_account_type: "Choose the correct account type for each Brex account:"
+      create_accounts: Create Accounts
+      creating_accounts: Creating Accounts...
+      historical_data_range: "Historical Data Range:"
+      subtitle: Choose the correct account types for your imported accounts
+      sync_start_date_help: Select how far back you want to sync transaction history. Maximum 3 years of history available.
+      sync_start_date_label: "Start syncing transactions from:"
+      title: Set Up Your Brex Accounts
+    complete_account_setup:
+      all_skipped: "All accounts were skipped. No accounts were created."
+      creation_failed: "Failed to create accounts: %{error}"
+      creation_failed_count: "Failed to create %{count} account(s)."
+      no_accounts: "No accounts to set up."
+      partial_skipped: "Successfully created %{created_count} account(s); %{skipped_count} account(s) were skipped."
+      partial_success: "Successfully created %{created_count} account(s), but %{failed_count} account(s) failed."
+      success: "Successfully created %{count} account(s)."
+      unexpected_error: An unexpected error occurred.
+    sync:
+      success: Sync started
+    syncer:
+      account_processing_failed:
+        one: "%{count} Brex account failed while processing."
+        other: "%{count} Brex accounts failed while processing."
+      account_sync_failed:
+        one: "%{count} Brex account sync could not be scheduled."
+        other: "%{count} Brex account syncs could not be scheduled."
+      accounts_need_setup:
+        one: "%{count} account needs setup..."
+        other: "%{count} accounts need setup..."
+      accounts_failed:
+        one: "%{count} Brex account failed to import."
+        other: "%{count} Brex accounts failed to import."
+      calculating_balances: Calculating balances...
+      checking_account_configuration: Checking account configuration...
+      credentials_invalid: Invalid Brex API token or account permissions
+      failed: Sync failed. Please try again or contact support.
+      import_failed: Brex import failed.
+      importing_accounts: Importing accounts from Brex...
+      processing_transactions: Processing transactions...
+      transactions_failed:
+        one: "%{count} Brex account had transaction import failures."
+        other: "%{count} Brex accounts had transaction import failures."
+    update:
+      success: Brex connection updated
diff --git a/config/locales/views/brex_items/hu.yml b/config/locales/views/brex_items/hu.yml
new file mode 100644
index 000000000..6d182321a
--- /dev/null
+++ b/config/locales/views/brex_items/hu.yml
@@ -0,0 +1,277 @@
+---
+hu:
+  brex_items:
+    default_connection_name: Brex kapcsolat
+    account_metadata:
+      provider: Brex
+      separator: " • "
+    kinds:
+      cash: Készpénz
+      card: Kártya
+    statuses:
+      ACTIVE: Aktív
+      active: Aktív
+      CLOSED: Lezárt
+      closed: Lezárt
+      frozen: Befagyasztott
+      FROZEN: Befagyasztott
+    create:
+      success: Brex kapcsolat sikeresen létrehozva
+    default_card_name: Brex kártya
+    default_cash_name: "Brex készpénz %{id}"
+    destroy:
+      success: Brex kapcsolat eltávolítva
+    index:
+      title: Brex kapcsolatok
+    institution_summary:
+      none: Nincs csatlakoztatott intézmény
+      one: "%{name}"
+      count:
+        one: "%{count} intézmény"
+        other: "%{count} intézmény"
+    sync_status:
+      no_accounts: Nem találhatók számlák
+      all_synced:
+        one: "%{count} számla szinkronizálva"
+        other: "%{count} számla szinkronizálva"
+      partial_setup: "%{synced} szinkronizálva, %{pending} beállítást igényel"
+    api_error:
+      common_issues: "Gyakori problémák:"
+      expired_credentials: Generálj új API-tokent a Brex-ből.
+      expired_credentials_label: "Lejárt hitelesítő adatok:"
+      heading: Nem sikerült csatlakozni a Brex-hez
+      invalid_token: Ellenőrizd az API-tokenedet a Szolgáltatói beállításokban.
+      invalid_token_label: "Érvénytelen API-token:"
+      network: Ellenőrizd az internetkapcsolatodat.
+      network_label: "Hálózati probléma:"
+      permissions: Győződj meg róla, hogy a token rendelkezik a szükséges csak olvasható fiók- és tranzakciós hatókörökkel.
+      permissions_label: "Elégtelen jogosultságok:"
+      service: A Brex API ideiglenesen nem elérhető.
+      service_label: "Szolgáltatás leállása:"
+      settings_link: Szolgáltatói beállítások ellenőrzése
+      title: Brex kapcsolódási hiba
+    errors:
+      unexpected_error: Váratlan hiba történt. Kérlek próbáld újra később.
+    entries:
+      default_name: Brex tranzakció
+    loading:
+      loading_message: Brex számlák betöltése...
+      loading_title: Betöltés
+    link_accounts:
+      all_already_linked:
+        one: "A kiválasztott számla (%{names}) már össze van kapcsolva"
+        other: "Mind a(z) %{count} kiválasztott számla már össze van kapcsolva: %{names}"
+      api_error: "API hiba: %{message}"
+      invalid_account_names:
+        one: "Nem lehet összekapcsolni üres nevű számlát"
+        other: "Nem lehet összekapcsolni %{count} üres nevű számlát"
+      invalid_account_type: Nem támogatott Brex számlatípus
+      link_failed: Nem sikerült összekapcsolni a számlákat
+      no_accounts_selected: Kérlek válassz legalább egy számlát
+      no_api_token: Brex API-token nem található. Kérlek állítsd be a Szolgáltatói beállításokban.
+      partial_invalid: "%{created_count} számla sikeresen összekapcsolva, %{already_linked_count} már össze volt kapcsolva, %{invalid_count} számla nevei érvénytelenek"
+      partial_success: "%{created_count} számla sikeresen összekapcsolva. %{already_linked_count} már össze volt kapcsolva: %{already_linked_names}"
+      select_connection: Válassz Brex kapcsolatot a számlák összekapcsolása előtt.
+      success:
+        one: "%{count} számla sikeresen összekapcsolva"
+        other: "%{count} számla sikeresen összekapcsolva"
+    brex_item:
+      accounts_need_setup: Számlák beállítást igényelnek
+      delete: Kapcsolat törlése
+      deletion_in_progress: törlés folyamatban...
+      error: Hiba
+      no_accounts_description: Ehhez a kapcsolathoz még nincsenek összekapcsolt számlák.
+      no_accounts_title: Nincsenek számlák
+      setup_action: Új számlák beállítása
+      setup_description: "%{linked} / %{total} számla összekapcsolva. Válaszd ki az újonnan importált Brex számlák típusait."
+      setup_needed: Új számlák beállításra várnak
+      status: "Szinkronizálva %{timestamp} ezelőtt"
+      status_never: Még nem szinkronizált
+      status_with_summary: "Utolsó szinkronizálás %{timestamp} ezelőtt - %{summary}"
+      syncing: Szinkronizálás...
+      total: Összesen
+      unlinked: Nincs összekapcsolva
+    provider_panel:
+      accounts_link: Számlák
+      add_connection: Brex kapcsolat hozzáadása
+      base_url_label: Alap URL (opcionális)
+      base_url_placeholder: https://api.brex.com
+      configured_html: "Konfigurálva és használatra kész. Látogass el a %{accounts_link} fülre a számlák kezeléséhez és beállításához."
+      connection_name_label: Kapcsolat neve
+      connection_name_placeholder: Üzleti folyószámla
+      default_connection_name: Brex kapcsolat
+      disconnect_label: "%{name} szétkapcsolása"
+      disconnect_confirm: "%{name} szétkapcsolása?"
+      encryption_warning:
+        title: Az adatbázis-titkosítás nincs konfigurálva
+        message: Állítsd be az Active Record titkosítási kulcsokat, mielőtt Brex tokeneket adsz hozzá az éles környezetben. Titkosítási kulcsok nélkül a Sure a Brex szolgáltatói hitelesítő adatokat és pillanatfelvételeket más szolgáltatói rekordokhoz hasonlóan titkosítatlanul tárolja.
+      instructions:
+        copy_token_html: "Másold ki a tokent és add hozzá alább megnevezett kapcsolatként. A Sure csak a token nevű szinkronizáláshoz tárolja azt ehhez a háztartáshoz."
+        create_token: "Hozz létre API-tokent ezekkel a csak olvasható hatókörökkel: accounts.cash.readonly, accounts.card.readonly, transactions.cash.readonly, transactions.card.readonly"
+        open_tokens: Menj a csatlakoztatni kívánt vállalat Brex fejlesztői/API-token beállításaiba
+        sign_in_html: "Látogass el ide: %{link}, és lépj be a csatlakoztatni kívánt fiókba"
+      keep_token_placeholder: Hagyd üresen az aktuális token megtartásához
+      not_configured: Nincs beállítva
+      sandbox_note_html: "Minden szinkronizálni kívánt Brex vállalathoz/API-tokenhez használj külön megnevezett kapcsolatot. Az Alap URL-t hagyd üresen az éles környezethez. A tesztkörnyezet csak a Brex által jóváhagyott tesztelésre korlátozódik, és nem működik ügyfél tokenekkel."
+      setup_accounts: Számlák beállítása
+      setup_title: "Beállítási utasítások:"
+      sync: Szinkronizálás
+      token_label: Token
+      token_placeholder: Illeszt be tokent ide
+      update_connection: Kapcsolat frissítése
+    provider_connection:
+      default_description: Csatlakozás Brex fiókhoz
+      default_name: Brex
+      description: "Csatlakozás ezzel: %{name}"
+      name: "Brex - %{name}"
+    select_accounts:
+      accounts_selected: kiválasztott számla
+      api_error: "API hiba: %{message}"
+      cancel: Mégse
+      configure_name_in_brex: Nem importálható — kérlek állítsd be a számla nevét a Brex-ben
+      description: "Válaszd ki azokat a számlákat, amelyeket össze szeretnél kapcsolni a(z) %{product_name} fiókkal."
+      link_accounts: Kiválasztott számlák összekapcsolása
+      no_accounts_found: Nem találhatók számlák. Kérlek ellenőrizd az API-token konfigurációdat.
+      no_api_token: Brex API-token nem található. Kérlek állítsd be a Szolgáltatói beállításokban.
+      no_credentials_configured: Kérlek előbb állítsd be a Brex API-tokenedet a Szolgáltatói beállításokban.
+      no_name_placeholder: "(Nincs név)"
+      select_connection: Válassz Brex kapcsolatot a Szolgáltatói beállításokban.
+      title: Brex számlák kiválasztása
+      unexpected_error: Váratlan hiba történt. Kérlek próbáld újra később.
+    select_existing_account:
+      account_already_linked: Ez a számla már össze van kapcsolva egy szolgáltatóval
+      all_accounts_already_linked: Minden Brex számla már össze van kapcsolva
+      api_error: "API hiba: %{message}"
+      cancel: Mégse
+      configure_name_in_brex: Nem importálható — kérlek állítsd be a számla nevét a Brex-ben
+      description: Válassz egy Brex számlát, amelyet ehhez a számlához szeretnél kapcsolni. A tranzakciók automatikusan szinkronizálásra és deduplikálásra kerülnek.
+      link_account: Számla összekapcsolása
+      no_account_specified: Nem lett megadva számla
+      no_accounts_found: Nem találhatók Brex számlák. Kérlek ellenőrizd az API-token konfigurációdat.
+      no_api_token: Brex API-token nem található. Kérlek állítsd be a Szolgáltatói beállításokban.
+      no_credentials_configured: Kérlek előbb állítsd be a Brex API-tokenedet a Szolgáltatói beállításokban.
+      no_name_placeholder: "(Nincs név)"
+      select_connection: Válassz Brex kapcsolatot a Szolgáltatói beállításokban.
+      title: "%{account_name} összekapcsolása a Brex-szel"
+      unexpected_error: Váratlan hiba történt. Kérlek próbáld újra később.
+    setup_required:
+      description: A Brex számlák összekapcsolása előtt be kell állítanod a Brex API-tokenedet.
+      heading: Az API-token nincs beállítva
+      settings_link: Szolgáltatói beállítások megnyitása
+      setup_steps: "Beállítási lépések:"
+      steps:
+        enter_token: Add meg a Brex API-tokenedet
+        find_section_html: "Keresd meg a <strong>Brex</strong> részt"
+        open_settings_html: "Menj a <strong>Beállítások > Szolgáltatók</strong> menübe"
+        return_to_link: Térj vissza ide a számlák összekapcsolásához
+      title: Brex beállítás szükséges
+    subtype_select:
+      placeholder:
+        subtype: Altípus kiválasztása
+        type: Típus kiválasztása
+    link_existing_account:
+      account_already_linked: Ez a számla már össze van kapcsolva egy szolgáltatóval
+      api_error: "API hiba: %{message}"
+      invalid_account_name: Nem lehet összekapcsolni üres nevű számlát
+      missing_parameters: Hiányzó kötelező paraméterek
+      no_account_specified: Nem lett megadva számla
+      no_api_token: Brex API-token nem található. Kérlek állítsd be a Szolgáltatói beállításokban.
+      provider_account_already_linked: Ez a Brex számla már össze van kapcsolva egy másik számlával
+      provider_account_not_found: Brex számla nem található
+      select_connection: Válassz Brex kapcsolatot a számlák összekapcsolása előtt.
+      success: "%{account_name} sikeresen összekapcsolva a Brex-szel"
+    setup_accounts:
+      account_type_label: "Számla típusa:"
+      all_accounts_linked: "Minden Brex számlád már be van állítva."
+      api_error: "API hiba: %{message}"
+      fetch_failed: "Nem sikerült lekérni a számlákat"
+      no_accounts_to_setup: "Nincs beállítandó számla"
+      no_api_token: Brex API-token nem található. Kérlek állítsd be a Szolgáltatói beállításokban.
+      account_types:
+        skip: Számla kihagyása
+        depository: Folyó- vagy megtakarítási számla
+        credit_card: Hitelkártya
+        investment: Befektetési számla
+        loan: Hitel vagy jelzálog
+        other_asset: Egyéb vagyon
+      subtype_labels:
+        depository: "Számla altípusa:"
+        credit_card: ""
+        investment: "Befektetés típusa:"
+        loan: "Hitel típusa:"
+        other_asset: ""
+      subtype_messages:
+        credit_card: "A hitelkártyák automatikusan hitelkártya számlákként lesznek beállítva."
+        other_asset: "Az egyéb vagyonelemekhez nincs szükség további beállításokra."
+      subtypes:
+        depository:
+          checking: Folyószámla
+          savings: Megtakarítási számla
+          hsa: Egészségügyi megtakarítási számla
+          cd: Lekötött betét
+          money_market: Pénzpiaci számla
+        investment:
+          brokerage: Brókeri számla
+          pension: Nyugdíjalap
+          retirement: Nyugdíj-megtakarítás
+          "401k": "401(k)"
+          roth_401k: "Roth 401(k)"
+          "403b": "403(b)"
+          tsp: Thrift Savings Plan
+          "529_plan": "529 Terv"
+          hsa: Egészségügyi megtakarítási számla
+          mutual_fund: Befektetési alap
+          ira: Hagyományos IRA
+          roth_ira: Roth IRA
+          angel: Angyal befektető
+        loan:
+          mortgage: Jelzálog
+          student: Diákhitel
+          auto: Autóhitel
+          other: Egyéb hitel
+      balance: Egyenleg
+      cancel: Mégse
+      choose_account_type: "Válaszd ki a megfelelő számlatípust minden Brex számlához:"
+      create_accounts: Számlák létrehozása
+      creating_accounts: Számlák létrehozása...
+      historical_data_range: "Előzmények időtartama:"
+      subtitle: Válaszd ki az importált számlák helyes típusait
+      sync_start_date_help: "Válaszd ki, milyen messzire szeretnél visszamenni a tranzakciós előzmények szinkronizálásában. Maximum 3 év előzmény érhető el."
+      sync_start_date_label: "Tranzakciók szinkronizálásának kezdete:"
+      title: Brex számlák beállítása
+    complete_account_setup:
+      all_skipped: "Minden számla ki lett hagyva. Nem jött létre számla."
+      creation_failed: "Nem sikerült létrehozni a számlákat: %{error}"
+      creation_failed_count: "%{count} számla létrehozása sikertelen."
+      no_accounts: "Nincs beállítandó számla."
+      partial_skipped: "%{created_count} számla sikeresen létrehozva; %{skipped_count} számla ki lett hagyva."
+      partial_success: "%{created_count} számla sikeresen létrehozva, de %{failed_count} számla sikertelen volt."
+      success: "%{count} számla sikeresen létrehozva."
+      unexpected_error: Váratlan hiba történt.
+    sync:
+      success: Szinkronizálás elindítva
+    syncer:
+      account_processing_failed:
+        one: "%{count} Brex számla feldolgozása sikertelen volt."
+        other: "%{count} Brex számla feldolgozása sikertelen volt."
+      account_sync_failed:
+        one: "%{count} Brex számla szinkronizálása nem ütemezható."
+        other: "%{count} Brex számla szinkronizálása nem ütemezható."
+      accounts_need_setup:
+        one: "%{count} számla beállítást igényel..."
+        other: "%{count} számla beállítást igényel..."
+      accounts_failed:
+        one: "%{count} Brex számla importálása sikertelen volt."
+        other: "%{count} Brex számla importálása sikertelen volt."
+      calculating_balances: Egyenlegek kiszámítása...
+      checking_account_configuration: Számlakonfiguráció ellenőrzése...
+      credentials_invalid: Érvénytelen Brex API-token vagy számlajogosultságok
+      failed: A szinkronizálás sikertelen volt. Kérlek próbáld újra, vagy lépj kapcsolatba a támogatással.
+      import_failed: Brex importálás sikertelen.
+      importing_accounts: Számlák importálása a Brex-ből...
+      processing_transactions: Tranzakciók feldolgozása...
+      transactions_failed:
+        one: "%{count} Brex számlánál tranzakciós importálási hibák léptek fel."
+        other: "%{count} Brex számlánál tranzakciós importálási hibák léptek fel."
+    update:
+      success: Brex kapcsolat frissítve
diff --git a/config/locales/views/budgets/ca.yml b/config/locales/views/budgets/ca.yml
index dd581e49c..c1131fece 100644
--- a/config/locales/views/budgets/ca.yml
+++ b/config/locales/views/budgets/ca.yml
@@ -1,7 +1,102 @@
 ---
 ca:
-  budgets:
+  budget_categories:
+    allocation_progress:
+      budget_exceeded_html: 'Pressupost superat en <span class="text-red-500 privacy-sensitive">%{amount}</span>'
+      left_to_allocate: per assignar
+      over_set: "> 100 % assignat"
+      percent_set: "%{percent} assignat"
+    budget_category_form:
+      monthly_average: "%{amount}/mes (mitjana)"
+      shared_placeholder: Compartit
+      shared_title: Deixa-ho buit per compartir el pressupost de la categoria pare
+    confirm_button:
+      confirm: Confirma
+    index:
+      description: Ajusta els pressupostos per categoria per establir límits de despesa.
+        Els fons no assignats es marcaran automàticament com a sense categoritzar.
+      title: Edita els pressupostos per categoria
+    no_categories:
+      new_category: Nova categoria
+      no_categories_message: Encara no has creat ni assignat cap categoria de despesa
+        a les teves transaccions.
+      oops: Vaja!
+      use_defaults: Usa els valors per defecte (recomanat)
     show:
+      budgeted: Pressupostat
+      category: Categoria
+      left: restant
+      monthly_average_spending: Despesa mensual mitjana
+      monthly_median_spending: Despesa mensual mediana
+      no_transactions: No s'han trobat transaccions per a aquest període pressupostari.
+      overspent: per sobre
+      overview: Resum
+      recent_transactions: Transaccions recents
+      spending: Despesa de %{date}
+      status: Estat
+      view_all_transactions: Veure totes les transaccions de la categoria
+  budgets:
+    actuals_summary:
+      expenses: Despeses
+      income: Ingressos
+    budget_donut:
+      new_budget: Nou pressupost
+      of_budget: de %{amount}
+      spent: Gastat
+      unused: Sense utilitzar
+    budget_header:
+      today: Avui
+    budget_nav:
+      categories: Categories
+      setup: Configuració
+    budgeted_summary:
+      budgeted: Pressupostat
+      earned: "%{amount} guanyats"
+      expected_income: Ingressos esperats
+      left: "%{amount} restants"
+      over: "%{amount} per sobre"
+      spent: "%{amount} gastats"
+    copy_previous:
+      already_initialized: Aquest pressupost ja s'ha configurat
+      no_source: No s'ha trobat cap pressupost anterior per copiar
+      success: Pressupost copiat de %{source_name}
+    copy_previous_prompt:
+      copy_button: Copia de %{source_name}
+      description: Pots copiar el teu pressupost de %{source_name} o començar de zero.
+      fresh_button: Comença de zero
+      title: Configura el teu pressupost
+    edit:
+      autosuggest_description: Es basarà en l'historial de transaccions. La IA pot
+        equivocar-se, verifica-ho abans de continuar.
+      autosuggest_title: Suggereix automàticament el pressupost d'ingressos i despeses
+      budgeted_spending: Despesa pressupostada
+      continue: Continua
+      expected_income: Ingressos esperats
+      setup_description: Introdueix els teus ingressos mensuals i la despesa planificada
+        a sota per configurar el teu pressupost.
+      setup_title: Configura el teu pressupost
+    name:
+      custom_range: "%{start} - %{end_date}"
+      month_year: "%{month}"
+    over_allocation_warning:
+      fix_allocations: Corregeix les assignacions
+      over_allocated_message: Has assignat per sobre del teu pressupost. Corregeix
+        les assignacions.
+    show:
+      categories:
+        amount: Import
+        edit: Edita
+        title: Categories
+      filter:
+        all: Totes
+        on_track: Sota control
+        over_budget: Pressupost superat
+      on_track_categories:
+        short_title: Sota control
+        title: Sota control
+      over_budget_categories:
+        short_title: Pressupost superat
+        title: Pressupost superat
       tabs:
         actual: Real
         budgeted: Pressupostat
diff --git a/config/locales/views/budgets/de.yml b/config/locales/views/budgets/de.yml
index 00ac0252b..c02980333 100644
--- a/config/locales/views/budgets/de.yml
+++ b/config/locales/views/budgets/de.yml
@@ -5,6 +5,20 @@ de:
       custom_range: "%{start} - %{end_date}"
       month_year: "%{month}"
     show:
+      categories:
+        amount: Betrag
+        edit: Bearbeiten
+        title: Kategorien
+      on_track_categories:
+        short_title: Im Plan
+        title: Im Plan
+      over_budget_categories:
+        short_title: Uber Budget
+        title: Uber Budget
+      filter:
+        all: Alle
+        on_track: Im Plan
+        over_budget: Uber Budget
       tabs:
         actual: Ist
         budgeted: Budgetiert
diff --git a/config/locales/views/budgets/en.yml b/config/locales/views/budgets/en.yml
index c727dc37c..04f745c61 100644
--- a/config/locales/views/budgets/en.yml
+++ b/config/locales/views/budgets/en.yml
@@ -1,10 +1,55 @@
 ---
 en:
   budgets:
+    budget_donut:
+      spent: "Spent"
+      new_budget: "New budget"
+      of_budget: "of %{amount}"
+      unused: "Unused"
+    budget_header:
+      today: "Today"
+    budget_nav:
+      categories: Categories
+      setup: Setup
+    over_allocation_warning:
+      over_allocated_message: "You have over-allocated your budget. Please fix your allocations."
+      fix_allocations: "Fix allocations"
+    actuals_summary:
+      income: "Income"
+      expenses: "Expenses"
+    budgeted_summary:
+      expected_income: "Expected income"
+      budgeted: "Budgeted"
+      earned: "%{amount} earned"
+      over: "%{amount} over"
+      left: "%{amount} left"
+      spent: "%{amount} spent"
+    edit:
+      setup_title: "Setup your budget"
+      setup_description: "Enter your monthly earnings and planned spending below to setup your budget."
+      budgeted_spending: "Budgeted spending"
+      expected_income: "Expected income"
+      autosuggest_title: "Autosuggest income & spending budget"
+      autosuggest_description: "This will be based on transaction history. AI can make mistakes, verify before continuing."
+      continue: "Continue"
     name:
       custom_range: "%{start} - %{end_date}"
       month_year: "%{month}"
     show:
+      categories:
+        amount: Amount
+        edit: Edit
+        title: Categories
+      on_track_categories:
+        short_title: On Track
+        title: On Track
+      over_budget_categories:
+        short_title: Over Budget
+        title: Over Budget
+      filter:
+        all: All
+        on_track: On Track
+        over_budget: Over Budget
       tabs:
         actual: Actual
         budgeted: Budgeted
@@ -17,3 +62,36 @@ en:
       success: "Budget copied from %{source_name}"
       no_source: "No previous budget found to copy from"
       already_initialized: "This budget has already been set up"
+  budget_categories:
+    allocation_progress:
+      budget_exceeded_html: 'Budget exceeded by <span class="text-red-500 privacy-sensitive">%{amount}</span>'
+      left_to_allocate: left to allocate
+      over_set: "> 100% set"
+      percent_set: "%{percent} set"
+    budget_category_form:
+      monthly_average: "%{amount}/m avg"
+      shared_placeholder: Shared
+      shared_title: Leave empty to share parent's budget
+    confirm_button:
+      confirm: "Confirm"
+    no_categories:
+      oops: "Oops!"
+      no_categories_message: "You have not created or assigned any expense categories to your transactions yet."
+      use_defaults: "Use defaults (recommended)"
+      new_category: "New category"
+    index:
+      title: "Edit your category budgets"
+      description: "Adjust category budgets to set spending limits. Unallocated funds will be automatically assigned as uncategorized."
+    show:
+      category: "Category"
+      overview: "Overview"
+      spending: "%{date} spending"
+      status: "Status"
+      overspent: "overspent"
+      left: "left"
+      budgeted: "Budgeted"
+      monthly_average_spending: "Monthly average spending"
+      monthly_median_spending: "Monthly median spending"
+      recent_transactions: "Recent Transactions"
+      view_all_transactions: "View all category transactions"
+      no_transactions: "No transactions found for this budget period."
diff --git a/config/locales/views/budgets/es.yml b/config/locales/views/budgets/es.yml
index 87bc1649b..4f87cff2c 100644
--- a/config/locales/views/budgets/es.yml
+++ b/config/locales/views/budgets/es.yml
@@ -5,6 +5,20 @@ es:
       custom_range: "%{start} - %{end_date}"
       month_year: "%{month}"
     show:
+      categories:
+        amount: Importe
+        edit: Editar
+        title: Categorías
+      on_track_categories:
+        short_title: En camino
+        title: En camino
+      over_budget_categories:
+        short_title: Sobre presupuesto
+        title: Sobre presupuesto
+      filter:
+        all: Todas
+        on_track: En camino
+        over_budget: Sobre presupuesto
       tabs:
         actual: Real
         budgeted: Presupuestado
\ No newline at end of file
diff --git a/config/locales/views/budgets/fr.yml b/config/locales/views/budgets/fr.yml
new file mode 100644
index 000000000..cf0fe89f6
--- /dev/null
+++ b/config/locales/views/budgets/fr.yml
@@ -0,0 +1,33 @@
+---
+fr:
+  budgets:
+    name:
+      custom_range: "%{start} - %{end_date}"
+      month_year: "%{month}"
+    show:
+      categories:
+        amount: Montant
+        edit: Modifier
+        title: Catégories
+      on_track_categories:
+        short_title: Dans les clous
+        title: Dans les clous
+      over_budget_categories:
+        short_title: Dépassement
+        title: Budget dépassé
+      filter:
+        all: Tous
+        on_track: Dans les clous
+        over_budget: Budget dépassé
+      tabs:
+        actual: Réel
+        budgeted: Budgété
+    copy_previous_prompt:
+      title: "Configurez votre budget"
+      description: "Vous pouvez copier votre budget depuis %{source_name} ou repartir de zéro."
+      copy_button: "Copier depuis %{source_name}"
+      fresh_button: "Repartir de zéro"
+    copy_previous:
+      success: "Budget copié depuis %{source_name}"
+      no_source: "Aucun budget précédent trouvé à copier"
+      already_initialized: "Ce budget a déjà été configuré"
diff --git a/config/locales/views/budgets/hu.yml b/config/locales/views/budgets/hu.yml
new file mode 100644
index 000000000..0d0fc5312
--- /dev/null
+++ b/config/locales/views/budgets/hu.yml
@@ -0,0 +1,85 @@
+---
+hu:
+  budgets:
+    budget_donut:
+      spent: "Elköltve"
+      new_budget: "Új költségvetés"
+      of_budget: "%{amount}-ból/ből"
+      unused: "Felhasználatlan"
+    budget_header:
+      today: "Ma"
+    over_allocation_warning:
+      over_allocated_message: "Túllépted a költségvetési keretét. Kérjük, javítsd az elosztásokat."
+      fix_allocations: "Elosztások javítása"
+    actuals_summary:
+      income: "Bevétel"
+      expenses: "Kiadások"
+    budgeted_summary:
+      expected_income: "Várható bevétel"
+      budgeted: "Tervezett"
+      earned: "%{amount} megkeresve"
+      over: "%{amount} túllépve"
+      left: "%{amount} maradt"
+      spent: "%{amount} elköltve"
+    edit:
+      setup_title: "Állítsd be a költségvetésed"
+      setup_description: "Add meg a havi bevételeidet és tervezett kiadásaidat a költségvetés beállításához."
+      budgeted_spending: "Tervezett kiadások"
+      expected_income: "Várható bevétel"
+      autosuggest_title: "Bevételi és kiadási keret automatikus javaslata"
+      autosuggest_description: "Ez a tranzakcióelőzmények alapján készül. Az AI hibázhat, ellenőrizd folytatás előtt."
+      continue: "Folytatás"
+    name:
+      custom_range: "%{start} - %{end_date}"
+      month_year: "%{month}"
+    show:
+      categories:
+        amount: Összeg
+        edit: Szerkesztés
+        title: Kategóriák
+      on_track_categories:
+        short_title: Ütemben
+        title: Ütemben
+      over_budget_categories:
+        short_title: Túllépve
+        title: Túllépve
+      filter:
+        all: Mind
+        on_track: Ütemben
+        over_budget: Túllépve
+      tabs:
+        actual: Tényleges
+        budgeted: Tervezett
+    copy_previous_prompt:
+      title: "Állítsd be a költségvetésed"
+      description: "Átmásolhatod a költségvetésed innen: %{source_name}, vagy kezdhetsz nulláról."
+      copy_button: "Másolás innen: %{source_name}"
+      fresh_button: "Kezdés nulláról"
+    copy_previous:
+      success: "Költségvetés átmásolva innen: %{source_name}"
+      no_source: "Nem található korábbi költségvetés a másoláshoz"
+      already_initialized: "Ez a költségvetés már be van állítva"
+  budget_categories:
+    confirm_button:
+      confirm: "Megerősítés"
+    no_categories:
+      oops: "Hoppá!"
+      no_categories_message: "Még nem hoztál létre kiadási kategóriákat, és nem rendeltél egyet sem a tranzakcióidhoz."
+      use_defaults: "Alapértelmezések használata (ajánlott)"
+      new_category: "Új kategória"
+    index:
+      title: "Kategóriakereteid szerkesztése"
+      description: "Állítsd be a kategóriakereteket a kiadási limitek meghatározásához. A fel nem osztott összegek automatikusan kategorizálatlanként kerülnek hozzárendelésre."
+    show:
+      category: "Kategória"
+      overview: "Áttekintés"
+      spending: "%{date} kiadásai"
+      status: "Állapot"
+      overspent: "túllépve"
+      left: "maradt"
+      budgeted: "Tervezett"
+      monthly_average_spending: "Havi átlagos kiadás"
+      monthly_median_spending: "Havi mediánkiadás"
+      recent_transactions: "Legutóbbi tranzakciók"
+      view_all_transactions: "Összes kategória tranzakció megtekintése"
+      no_transactions: "Nem találhatók tranzakciók erre a költségvetési időszakra."
diff --git a/config/locales/views/budgets/nl.yml b/config/locales/views/budgets/nl.yml
index f7ba1833d..64265428d 100644
--- a/config/locales/views/budgets/nl.yml
+++ b/config/locales/views/budgets/nl.yml
@@ -1,6 +1,20 @@
 nl:
   budgets:
     show:
+      categories:
+        amount: Bedrag
+        edit: Bewerken
+        title: Categorieën
+      on_track_categories:
+        short_title: Op schema
+        title: Op schema
+      over_budget_categories:
+        short_title: Over budget
+        title: Over budget
+      filter:
+        all: Alles
+        on_track: Op schema
+        over_budget: Over budget
       tabs:
         actual: "Actueel"
         budgeted: "Begroot"
diff --git a/config/locales/views/budgets/zh-CN.yml b/config/locales/views/budgets/zh-CN.yml
index 37115d450..e111d4d91 100644
--- a/config/locales/views/budgets/zh-CN.yml
+++ b/config/locales/views/budgets/zh-CN.yml
@@ -2,6 +2,20 @@
 zh-CN:
   budgets:
     show:
+      categories:
+        amount: 金额
+        edit: 编辑
+        title: 分类
+      on_track_categories:
+        short_title: 正常
+        title: 正常
+      over_budget_categories:
+        short_title: 超预算
+        title: 超预算
+      filter:
+        all: 全部
+        on_track: 正常
+        over_budget: 超预算
       tabs:
         actual: 实际
         budgeted: 预算
diff --git a/config/locales/views/budgets/zh-TW.yml b/config/locales/views/budgets/zh-TW.yml
index e35d802ce..bca3d0cb9 100644
--- a/config/locales/views/budgets/zh-TW.yml
+++ b/config/locales/views/budgets/zh-TW.yml
@@ -2,6 +2,20 @@
 zh-TW:
   budgets:
     show:
+      categories:
+        amount: 金額
+        edit: 編輯
+        title: 分類
+      on_track_categories:
+        short_title: 正常
+        title: 正常
+      over_budget_categories:
+        short_title: 超預算
+        title: 超預算
+      filter:
+        all: 全部
+        on_track: 正常
+        over_budget: 超預算
       tabs:
         actual: 實際
         budgeted: 預算
diff --git a/config/locales/views/categories/ca.yml b/config/locales/views/categories/ca.yml
index 877e1c665..f57ac01e7 100644
--- a/config/locales/views/categories/ca.yml
+++ b/config/locales/views/categories/ca.yml
@@ -4,21 +4,31 @@ ca:
     bootstrap:
       success: Categories per defecte creades correctament
     category:
-      delete: Elimina categoria
-      edit: Edita categoria
+      delete: Elimina la categoria
+      edit: Edita la categoria
     create:
       success: Categoria creada correctament
     destroy:
       success: Categoria eliminada correctament
+    destroy_all:
+      success: Totes les categories eliminades
     edit:
-      edit: Edita categoria
+      edit: Edita la categoria
     form:
+      color: Color
+      icon: Icona
+      name_label: Nom
+      parent_category_label: Categoria pare (opcional)
       placeholder: Nom de la categoria
+      auto_adjust: ajusta'l automàticament.
+      poor_contrast: Contrast insuficient; tria un color més fosc o
+      unassigned: "(sense assignar)"
     index:
       bootstrap: Utilitza les predeterminades (recomanat)
       categories: Categories
       categories_expenses: Categories de despesa
       categories_incomes: Categories d'ingressos
+      delete_all: Elimina-les totes
       empty: No s'han trobat categories
       new: Nova categoria
     menu:
@@ -27,8 +37,16 @@ ca:
       new_category: Nova categoria
     update:
       success: Categoria actualitzada correctament
+    virtual:
+      payment: Pagament
+      trade: Operació
+      transfer: Transferència
   category:
     dropdowns:
       show:
         bootstrap: Genera categories per defecte
         empty: No s'han trobat categories
+        expense: despesa
+        income: ingrés
+        match_transfer: Fes coincidir amb transferència/pagament
+        one_time: "%{type} puntual"
diff --git a/config/locales/views/categories/en.yml b/config/locales/views/categories/en.yml
index 9f089fb73..0422c07cf 100644
--- a/config/locales/views/categories/en.yml
+++ b/config/locales/views/categories/en.yml
@@ -14,11 +14,21 @@ en:
       edit: Edit category
     form:
       placeholder: Category name
+      name_label: Name
+      unassigned: "(unassigned)"
+      parent_category_label: "Parent category (optional)"
+      color: Color
+      icon: Icon
+      auto_adjust: auto-adjust.
+      poor_contrast: "Poor contrast, choose a darker color or"
+    destroy_all:
+      success: All categories deleted
     index:
       bootstrap: Use defaults (recommended)
       categories: Categories
       categories_expenses: Expense categories
       categories_incomes: Income categories
+      delete_all: Delete all
       empty: No categories found
       new: New category
     menu:
@@ -27,8 +37,16 @@ en:
       new_category: New category
     update:
       success: Category updated successfully
+    virtual:
+      transfer: Transfer
+      payment: Payment
+      trade: Trade
   category:
     dropdowns:
       show:
         bootstrap: Generate default categories
         empty: No categories found
+        match_transfer: "Match transfer/payment"
+        one_time: "One-time %{type}"
+        income: "income"
+        expense: "expense"
diff --git a/config/locales/views/categories/hu.yml b/config/locales/views/categories/hu.yml
new file mode 100644
index 000000000..a10c00072
--- /dev/null
+++ b/config/locales/views/categories/hu.yml
@@ -0,0 +1,51 @@
+---
+hu:
+  categories:
+    bootstrap:
+      success: Alapértelmezett kategóriák sikeresen létrehozva
+    category:
+      delete: Kategória törlése
+      edit: Kategória szerkesztése
+    create:
+      success: Kategória sikeresen létrehozva
+    destroy:
+      success: Kategória sikeresen törölve
+    edit:
+      edit: Kategória szerkesztése
+    form:
+      placeholder: Kategória neve
+      name_label: Név
+      unassigned: "(nincs hozzárendelve)"
+      parent_category_label: "Szülőkategória (nem kötelező)"
+      color: Szín
+      icon: Ikon
+      poor_contrast: "Gyenge kontraszt, válassz sötétebb színt vagy"
+    destroy_all:
+      success: Összes kategória törölve
+    index:
+      bootstrap: Alapértelmezések használata (ajánlott)
+      categories: Kategóriák
+      categories_expenses: Kiadás kategóriák
+      categories_incomes: Bevétel kategóriák
+      delete_all: Összes törlése
+      empty: Nem található kategória
+      new: Új kategória
+    menu:
+      loading: Betöltés...
+    new:
+      new_category: Új kategória
+    update:
+      success: Kategória sikeresen frissítve
+    virtual:
+      transfer: Átutalás
+      payment: Fizetés
+      trade: Ügylet
+  category:
+    dropdowns:
+      show:
+        bootstrap: Alapértelmezett kategóriák létrehozása
+        empty: Nem található kategória
+        match_transfer: "Átutalás/fizetés párosítása"
+        one_time: "Egyszeri %{type}"
+        income: "bevétel"
+        expense: "kiadás"
diff --git a/config/locales/views/category/deletions/hu.yml b/config/locales/views/category/deletions/hu.yml
new file mode 100644
index 000000000..92d6fd813
--- /dev/null
+++ b/config/locales/views/category/deletions/hu.yml
@@ -0,0 +1,13 @@
+---
+hu:
+  category:
+    deletions:
+      create:
+        success: Tranzakció kategóriája sikeresen törölve
+      new:
+        category: Kategória
+        delete_and_leave_uncategorized: '"%{category_name}" törlése és kategória nélkül hagyása'
+        delete_and_recategorize: '"%{category_name}" törlése és új kategória hozzárendelése'
+        delete_category: Törlöd a kategóriát?
+        explanation: A kategória törlésével minden tranzakció, amelyhez a "%{category_name}" kategória tartozik, kategória nélkülivé válik. Ahelyett, hogy kategória nélkül hagynád őket, alább hozzárendelhetsz egy új kategóriát.
+        replacement_category_prompt: Kategória kiválasztása
diff --git a/config/locales/views/category/dropdowns/ca.yml b/config/locales/views/category/dropdowns/ca.yml
index c77fc6255..6cfdb1b6c 100644
--- a/config/locales/views/category/dropdowns/ca.yml
+++ b/config/locales/views/category/dropdowns/ca.yml
@@ -3,9 +3,9 @@ ca:
   category:
     dropdowns:
       row:
-        delete: Elimina categoria
-        edit: Edita categoria
+        delete: Elimina la categoria
+        edit: Edita la categoria
       show:
-        clear: Neteja categoria
+        clear: Esborra la categoria
         no_categories: No s'han trobat categories
         search_placeholder: Cerca
diff --git a/config/locales/views/category/dropdowns/hu.yml b/config/locales/views/category/dropdowns/hu.yml
new file mode 100644
index 000000000..70be94cf5
--- /dev/null
+++ b/config/locales/views/category/dropdowns/hu.yml
@@ -0,0 +1,11 @@
+---
+hu:
+  category:
+    dropdowns:
+      row:
+        delete: Kategória törlése
+        edit: Kategória szerkesztése
+      show:
+        clear: Kategória törlése
+        no_categories: Nem található kategória
+        search_placeholder: Keresés
diff --git a/config/locales/views/chats/ca.yml b/config/locales/views/chats/ca.yml
index 2732f3b03..e3d25e036 100644
--- a/config/locales/views/chats/ca.yml
+++ b/config/locales/views/chats/ca.yml
@@ -1,7 +1,54 @@
 ---
 ca:
+  assistant_messages:
+    assistant_message:
+      assistant_reasoning: Raonament de l'assistent
+    tool_calls:
+      arguments: 'Arguments:'
+      function: 'Funció:'
+      tool_calls: Crides a eines
   chats:
-    demo_banner_message: "Estàs utilitzant un LLM Qwen3 de pesos oberts amb crèdits proporcionats
-      per Cloudflare Workers AI. Els resultats poden variar ja que el codi es va provar
-      principalment amb `gpt-4.1` però els teus tokens no van a cap altre lloc per ser entrenats! 🤖"
-    demo_banner_title: Mode de demostració
+    ai_consent:
+      available_description: El xat amb IA pot respondre preguntes financeres i oferir-te
+        anàlisis basades en les teves dades. Per utilitzar aquesta funcionalitat l'has
+        d'activar explícitament.
+      disable_note: Desactiva-ho en qualsevol moment. Totes les dades enviades als
+        nostres proveïdors de LLM són anonimitzades.
+      enable_button: Activa els xats d'IA
+      title: Activa els xats d'IA
+      unavailable_description_html: Per utilitzar l'assistent d'IA, has d'establir
+        la variable d'entorn <code class="bg-surface-inset px-1 py-0.5 rounded font-mono
+        text-xs">OPENAI_ACCESS_TOKEN</code> o configurar-la a la configuració de self hosting
+        de la teva instància.
+    ai_greeting:
+      commands_hint_html: Pots utilitzar <span class="bg-container border border-secondary
+        px-1.5 py-0.5 rounded font-mono text-xs">/</span> per accedir a les ordres
+      evaluate_portfolio: Avalua la cartera d'inversió
+      greeting: Hola %{name}! Sóc una IA / model de llenguatge gran que et pot ajudar
+        amb les teves finances. Tinc accés al web i a les dades del teu compte.
+      questions_intro: 'Aquí tens algunes preguntes que pots fer:'
+      spending_insights: Mostra anàlisi de la despesa
+      there: ''
+      unusual_patterns: Troba patrons inusuals
+    chat:
+      delete_chat: Elimina el xat
+      edit_chat_title: Edita el títol del xat
+    chat_nav:
+      all_chats: Tots els xats
+      delete_chat: Elimina el xat
+      edit_chat_title: Edita el títol del xat
+      start_new_chat: Inicia un xat nou
+    demo_banner_message: "Estàs utilitzant LLM amb crèdits proporcionats per Cloudflare
+      Workers AI. Els resultats poden variar, ja que el codi s'ha provat amb `gpt-4.1`,
+      però els teus tokens no s'envien enlloc més per entrenar-los! 🤖"
+    demo_banner_title: Mode demostració actiu
+    destroy:
+      notice: Xat eliminat correctament
+    error:
+      retry: Torna-ho a provar
+    index:
+      chats: Xats
+      new_chat: Nou xat
+    thinking: Pensant...
+    update:
+      success: Xat actualitzat
diff --git a/config/locales/views/chats/de.yml b/config/locales/views/chats/de.yml
index 2d38fb9aa..844e60bc8 100644
--- a/config/locales/views/chats/de.yml
+++ b/config/locales/views/chats/de.yml
@@ -3,3 +3,4 @@ de:
   chats:
     demo_banner_title: "Demo-Modus aktiv"
     demo_banner_message: "Sie nutzen ein Open-Weight Qwen3-LLM mit Credits von Cloudflare Workers AI. Die Ergebnisse können variieren, da die Codebasis hauptsächlich mit `gpt-4.1` getestet wurde – Ihre Tokens werden jedoch nicht anderswo zum Training verwendet! 🤖"
+    thinking: "Wird verarbeitet ..."
diff --git a/config/locales/views/chats/en.yml b/config/locales/views/chats/en.yml
index 89bd1d152..df4fe0fde 100644
--- a/config/locales/views/chats/en.yml
+++ b/config/locales/views/chats/en.yml
@@ -2,4 +2,43 @@
 en:
   chats:
     demo_banner_title: "Demo Mode Active"
-    demo_banner_message: "You are using an open-weights Qwen3 LLM with credits provided by Cloudflare Workers AI.  Result may vary since the codebase was mostly tested on `gpt-4.1` but your tokens don't go anywhere else to be trained with! 🤖"
+    demo_banner_message: "You are using LLMs via credits provided by Cloudflare Workers AI.  Results may vary since the codebase was tested on `gpt-4.1` but your tokens don't go anywhere else to be trained with! 🤖"
+    thinking: "Thinking ..."
+    ai_greeting:
+      greeting: "Hey %{name}! I'm an AI/large-language-model that can help with your finances. I have access to the web and your account data."
+      there: "there"
+      commands_hint_html: "You can use <span class=\"bg-container border border-secondary px-1.5 py-0.5 rounded font-mono text-xs\">/</span> to access commands"
+      questions_intro: "Here's a few questions you can ask:"
+      evaluate_portfolio: "Evaluate investment portfolio"
+      spending_insights: "Show spending insights"
+      unusual_patterns: "Find unusual patterns"
+    chat:
+      edit_chat_title: "Edit chat title"
+      delete_chat: "Delete chat"
+    chat_nav:
+      all_chats: "All chats"
+      start_new_chat: "Start new chat"
+      edit_chat_title: "Edit chat title"
+      delete_chat: "Delete chat"
+    error:
+      retry: "Retry"
+    destroy:
+      notice: "Chat was successfully deleted"
+    index:
+      chats: "Chats"
+      new_chat: "New chat"
+    update:
+      success: "Chat updated"
+    ai_consent:
+      title: "Enable AI Chats"
+      available_description: "AI chat can answer financial questions and provide insights based on your data. To use this feature you'll need to explicitly enable it."
+      unavailable_description_html: "To use the AI assistant, you need to set the <code class=\"bg-surface-inset px-1 py-0.5 rounded font-mono text-xs\">OPENAI_ACCESS_TOKEN</code> environment variable or configure it in the Self-Hosting settings of your instance."
+      enable_button: "Enable AI Chats"
+      disable_note: "Disable anytime. All data sent to our LLM providers is anonymized."
+  assistant_messages:
+    assistant_message:
+      assistant_reasoning: "Assistant reasoning"
+    tool_calls:
+      tool_calls: "Tool Calls"
+      function: "Function:"
+      arguments: "Arguments:"
diff --git a/config/locales/views/chats/es.yml b/config/locales/views/chats/es.yml
index d1d8ed83f..2e84f813f 100644
--- a/config/locales/views/chats/es.yml
+++ b/config/locales/views/chats/es.yml
@@ -2,4 +2,5 @@
 es:
   chats:
     demo_banner_title: "Modo de demostración activo"
-    demo_banner_message: "Estás utilizando un LLM Qwen3 de pesos abiertos con créditos proporcionados por Cloudflare Workers AI. Los resultados pueden variar, ya que la base de código se probó principalmente con `gpt-4.1`, ¡pero tus tokens no se enviarán a ningún otro lugar para ser entrenados! 🤖"
\ No newline at end of file
+    demo_banner_message: "Estás utilizando un LLM Qwen3 de pesos abiertos con créditos proporcionados por Cloudflare Workers AI. Los resultados pueden variar, ya que la base de código se probó principalmente con `gpt-4.1`, ¡pero tus tokens no se enviarán a ningún otro lugar para ser entrenados! 🤖"
+    thinking: "Procesando ..."
diff --git a/config/locales/views/chats/fr.yml b/config/locales/views/chats/fr.yml
index 5452cc4f3..bb7a4d7e4 100644
--- a/config/locales/views/chats/fr.yml
+++ b/config/locales/views/chats/fr.yml
@@ -3,3 +3,4 @@ fr:
   chats:
     demo_banner_title: "Mode Démo Actif"
     demo_banner_message: "Vous utilisez un LLM Qwen3 open-weights avec des crédits fournis par Cloudflare Workers AI. Les résultats peuvent varier car le code a été principalement testé sur `gpt-4.1` mais vos tokens ne sont envoyés nulle part ailleurs pour être entraînés !"
+    thinking: "Traitement en cours ..."
diff --git a/config/locales/views/chats/hu.yml b/config/locales/views/chats/hu.yml
new file mode 100644
index 000000000..6e4830ac1
--- /dev/null
+++ b/config/locales/views/chats/hu.yml
@@ -0,0 +1,44 @@
+---
+hu:
+  chats:
+    demo_banner_title: "Demo mód aktív"
+    demo_banner_message: "LLM-eket használsz a Cloudflare Workers AI által biztosított krediteken keresztül. Az eredmények változhatnak, mivel a kódot `gpt-4.1`-en tesztelték, de a tokenjeid nem kerülnek sehova tanítás céljából! 🤖"
+    thinking: "Gondolkodás..."
+    ai_greeting:
+      greeting: "Szia, %{name}! Egy AI/nagy nyelvi modell vagyok, aki segíthet pénzügyeid kezelésében. Hozzáférhetek az internethez és a fiókadataidhoz."
+      there: "ott"
+      commands_hint_html: "Használd a <span class=\"bg-container border border-secondary px-1.5 py-0.5 rounded font-mono text-xs\">/</span> jelet a parancsok eléréséhez"
+      questions_intro: "Íme néhány kérdés, amit feltehetsz:"
+      evaluate_portfolio: "Befektetési portfólió értékelése"
+      spending_insights: "Kiadási statisztikák megtekintése"
+      unusual_patterns: "Szokatlan minták keresése"
+    chat:
+      edit_chat_title: "Csevegés nevének szerkesztése"
+      delete_chat: "Csevegés törlése"
+    chat_nav:
+      all_chats: "Összes csevegés"
+      start_new_chat: "Új csevegés indítása"
+      edit_chat_title: "Csevegés nevének szerkesztése"
+      delete_chat: "Csevegés törlése"
+    error:
+      retry: "Újrapróbálás"
+    destroy:
+      notice: "A csevegés sikeresen törölve"
+    index:
+      chats: "Csevegések"
+      new_chat: "Új csevegés"
+    update:
+      success: "Csevegés frissítve"
+    ai_consent:
+      title: "AI-csevegések engedélyezése"
+      available_description: "Az AI-csevegés pénzügyi kérdésekre tud válaszolni és az adataid alapján elemzéseket nyújtani. A funkció használatához explicit engedélyezés szükséges."
+      unavailable_description_html: "Az AI-asszisztens használatához be kell állítanod az <code class=\"bg-surface-inset px-1 py-0.5 rounded font-mono text-xs\">OPENAI_ACCESS_TOKEN</code> környezeti változót, vagy konfigurálnod kell az önálló üzemeltetési beállításokban."
+      enable_button: "AI-csevegések engedélyezése"
+      disable_note: "Bármikor letiltható. Az LLM-szolgáltatóknak küldött összes adat anonimizált."
+  assistant_messages:
+    assistant_message:
+      assistant_reasoning: "Asszisztens gondolkodása"
+    tool_calls:
+      tool_calls: "Eszközhívások"
+      function: "Függvény:"
+      arguments: "Argumentumok:"
diff --git a/config/locales/views/chats/nl.yml b/config/locales/views/chats/nl.yml
index dafc67e16..63cb35c45 100644
--- a/config/locales/views/chats/nl.yml
+++ b/config/locales/views/chats/nl.yml
@@ -2,4 +2,5 @@
 nl:
   chats:
     demo_banner_title: "Demo Modus Actief"
-    demo_banner_message: "U gebruikt een open-weights Qwen3 LLM met credits verstrekt door Cloudflare Workers AI. Resultaten kunnen variëren aangezien de codebase voornamelijk is getest op `gpt-4.1`, maar uw tokens worden nergens anders voor training gebruikt! 🤖"
+    demo_banner_message: "U gebruikt een LLM met credits verstrekt door Cloudflare Workers AI. Resultaten kunnen variëren aangezien de codebase voornamelijk is getest op `gpt-4.1`, maar uw tokens worden nergens anders voor training gebruikt! 🤖"
+    thinking: "Bezig ..."
diff --git a/config/locales/views/chats/pl.yml b/config/locales/views/chats/pl.yml
index 588542fce..9ccad97a7 100644
--- a/config/locales/views/chats/pl.yml
+++ b/config/locales/views/chats/pl.yml
@@ -2,4 +2,5 @@
 pl:
   chats:
     demo_banner_title: "Aktywny tryb demo"
-    demo_banner_message: "Używasz modelu open-weights Qwen3 LLM z kredytami udostępnionymi przez Cloudflare Workers AI. Wyniki mogą się różnić, ponieważ kod aplikacji był głównie testowany na `gpt-4.1`, ale Twoje tokeny nie są nigdzie dalej wykorzystywane do trenowania! 🤖"
+    demo_banner_message: "Używasz modelu LLM z kredytami udostępnionymi przez Cloudflare Workers AI. Wyniki mogą się różnić, ponieważ kod aplikacji był głównie testowany na `gpt-4.1`, ale Twoje tokeny nie są nigdzie dalej wykorzystywane do trenowania! 🤖"
+    thinking: "Przetwarzanie ..."
diff --git a/config/locales/views/chats/zh-CN.yml b/config/locales/views/chats/zh-CN.yml
index 78d1fc802..d2f541a70 100644
--- a/config/locales/views/chats/zh-CN.yml
+++ b/config/locales/views/chats/zh-CN.yml
@@ -3,3 +3,4 @@ zh-CN:
   chats:
     demo_banner_message: "您正在使用由 Cloudflare Workers AI 提供额度的开源权重 Qwen3 大语言模型。由于代码库主要在 `gpt-4.1` 上测试，结果可能有所不同，但您的令牌不会被用于其他地方进行训练！🤖"
     demo_banner_title: 演示模式已激活
+    thinking: "处理中 ..."
diff --git a/config/locales/views/chats/zh-TW.yml b/config/locales/views/chats/zh-TW.yml
index 9bd208f0d..53d4e72fc 100644
--- a/config/locales/views/chats/zh-TW.yml
+++ b/config/locales/views/chats/zh-TW.yml
@@ -3,3 +3,4 @@ zh-TW:
   chats:
     demo_banner_message: "您正在使用由 Cloudflare Workers AI 提供額度的開源權重 Qwen3 大語言模型。由於程式碼庫主要在 `gpt-4.1` 上測試，結果可能有所不同，但您的令牌不會被用於其他地方進行訓練！🤖"
     demo_banner_title: 演示模式已啟動
+    thinking: "處理中 ..."
diff --git a/config/locales/views/coinbase_items/ca.yml b/config/locales/views/coinbase_items/ca.yml
new file mode 100644
index 000000000..2cdb8cf9d
--- /dev/null
+++ b/config/locales/views/coinbase_items/ca.yml
@@ -0,0 +1,83 @@
+---
+ca:
+  coinbase_item:
+    syncer:
+      accounts_need_setup:
+        one: "%{count} compte necessita configuració"
+        other: "%{count} comptes necessiten configuració"
+      calculating_balances: Calculant saldos...
+      checking_configuration: Comprovant la configuració del compte...
+      checking_credentials: Comprovant credencials...
+      credentials_invalid: Credencials de l'API no vàlides. Revisa la teva clau API
+        i el secret.
+      importing_accounts: Important comptes des de Coinbase...
+      processing_accounts: Processant dades del compte...
+  coinbase_items:
+    coinbase_item:
+      delete: Elimina
+      deletion_in_progress: Eliminant...
+      import_wallets_menu: Importa carteres
+      more_wallets_available:
+        one: "%{count} cartera més disponible per importar"
+        other: "%{count} carteres més disponibles per importar"
+      no_accounts_message: Les teves carteres de Coinbase apareixeran aquí després
+        de sincronitzar.
+      no_accounts_title: No s'han trobat comptes
+      provider_name: Coinbase
+      reconnect: Les credencials necessiten actualització
+      setup_action: Importa carteres
+      setup_description: Selecciona quines carteres de Coinbase vols seguir.
+      setup_needed: Carteres a punt per importar
+      status: Darrera sincronització fa %{timestamp}
+      status_never: Mai sincronitzat
+      status_with_summary: Darrera sincronització fa %{timestamp} - %{summary}
+      sync_status:
+        all_synced:
+          one: "%{count} compte sincronitzat"
+          other: "%{count} comptes sincronitzats"
+        no_accounts: No s'han trobat comptes
+        partial_sync: "%{linked_count} sincronitzats, %{unlinked_count} necessiten
+          configuració"
+      syncing: Sincronitzant...
+      update_credentials: Actualitza les credencials
+    complete_account_setup:
+      no_accounts: No hi ha carteres per importar
+      none_selected: No s'ha seleccionat cap cartera
+      success:
+        one: S'ha importat %{count} cartera
+        other: S'han importat %{count} carteres
+    create:
+      default_name: Coinbase
+      success: S'ha connectat correctament a Coinbase! Els teus comptes s'estan sincronitzant.
+    destroy:
+      success: S'ha programat la connexió Coinbase per a la seva eliminació.
+    link_existing_account:
+      errors:
+        invalid_coinbase_account: Compte Coinbase no vàlid
+        only_manual: Només els comptes manuals es poden enllaçar a Coinbase
+      success: S'ha enllaçat correctament al compte Coinbase
+    select_existing_account:
+      balance: Saldo
+      cancel: Cancel·la
+      check_provider_health: Comprova que les teves credencials de l'API de Coinbase
+        siguin vàlides
+      currently_linked_to: 'Actualment enllaçat a: %{account_name}'
+      link: Enllaça
+      no_accounts_found: No s'han trobat comptes Coinbase.
+      title: Enllaça compte Coinbase
+      wait_for_sync: Espera que Coinbase acabi la sincronització
+    setup_accounts:
+      accounts_count:
+        one: "%{count} cartera disponible"
+        other: "%{count} carteres disponibles"
+      cancel: Cancel·la
+      creating: Important...
+      import_selected: Importa les seleccionades
+      instructions: Selecciona les carteres que vols importar. Les carteres no seleccionades
+        quedaran disponibles si les vols afegir més tard.
+      no_accounts: Totes les carteres s'han importat.
+      select_all: Selecciona-ho tot
+      subtitle: Selecciona quines carteres vols seguir
+      title: Importa carteres Coinbase
+    update:
+      success: La configuració de Coinbase s'ha actualitzat correctament.
diff --git a/config/locales/views/coinbase_items/fr.yml b/config/locales/views/coinbase_items/fr.yml
new file mode 100644
index 000000000..28fc47638
--- /dev/null
+++ b/config/locales/views/coinbase_items/fr.yml
@@ -0,0 +1,78 @@
+---
+fr:
+  coinbase_items:
+    create:
+      default_name: Coinbase
+      success: Connexion à Coinbase réussie. Vos comptes sont en cours de synchronisation.
+    update:
+      success: Configuration Coinbase mise à jour.
+    destroy:
+      success: Connexion Coinbase mise en file d'attente pour suppression.
+    setup_accounts:
+      title: Importer les portefeuilles Coinbase
+      subtitle: Sélectionnez les portefeuilles à suivre
+      instructions: Sélectionnez les portefeuilles que vous souhaitez importer. Les portefeuilles non sélectionnés resteront disponibles si vous souhaitez les ajouter plus tard.
+      no_accounts: Tous les portefeuilles ont été importés.
+      accounts_count:
+        one: "%{count} portefeuille disponible"
+        other: "%{count} portefeuilles disponibles"
+      select_all: Tout sélectionner
+      import_selected: Importer la sélection
+      cancel: Annuler
+      creating: Importation…
+    complete_account_setup:
+      success:
+        one: "%{count} portefeuille importé"
+        other: "%{count} portefeuilles importés"
+      none_selected: Aucun portefeuille sélectionné
+      no_accounts: Aucun portefeuille à importer
+    coinbase_item:
+      provider_name: Coinbase
+      syncing: Synchronisation…
+      reconnect: Identifiants à mettre à jour
+      deletion_in_progress: Suppression…
+      sync_status:
+        no_accounts: Aucun compte trouvé
+        all_synced:
+          one: "%{count} compte synchronisé"
+          other: "%{count} comptes synchronisés"
+        partial_sync: "%{linked_count} synchronisé(s), %{unlinked_count} à configurer"
+      status: "Dernière synchronisation il y a %{timestamp}"
+      status_with_summary: "Dernière synchronisation il y a %{timestamp} - %{summary}"
+      status_never: Jamais synchronisé
+      update_credentials: Mettre à jour les identifiants
+      delete: Supprimer
+      no_accounts_title: Aucun compte trouvé
+      no_accounts_message: Vos portefeuilles Coinbase apparaîtront ici après la synchronisation.
+      setup_needed: Portefeuilles prêts à être importés
+      setup_description: Sélectionnez les portefeuilles Coinbase que vous souhaitez suivre.
+      setup_action: Importer les portefeuilles
+      import_wallets_menu: Importer les portefeuilles
+      more_wallets_available:
+        one: "%{count} portefeuille supplémentaire disponible à l'importation"
+        other: "%{count} portefeuilles supplémentaires disponibles à l'importation"
+    select_existing_account:
+      title: Lier un compte Coinbase
+      no_accounts_found: Aucun compte Coinbase trouvé.
+      wait_for_sync: Attendez que Coinbase termine la synchronisation
+      check_provider_health: Vérifiez que vos identifiants API Coinbase sont valides
+      balance: Solde
+      currently_linked_to: "Actuellement lié à : %{account_name}"
+      link: Lier
+      cancel: Annuler
+    link_existing_account:
+      success: Compte Coinbase lié avec succès
+      errors:
+        only_manual: Seuls les comptes manuels peuvent être liés à Coinbase
+        invalid_coinbase_account: Compte Coinbase invalide
+  coinbase_item:
+    syncer:
+      checking_credentials: Vérification des identifiants…
+      credentials_invalid: Identifiants API invalides. Veuillez vérifier votre clé API et votre secret.
+      importing_accounts: Importation des comptes depuis Coinbase…
+      checking_configuration: Vérification de la configuration du compte…
+      accounts_need_setup:
+        one: "%{count} compte à configurer"
+        other: "%{count} comptes à configurer"
+      processing_accounts: Traitement des données du compte…
+      calculating_balances: Calcul des soldes…
diff --git a/config/locales/views/coinbase_items/hu.yml b/config/locales/views/coinbase_items/hu.yml
new file mode 100644
index 000000000..2fc329880
--- /dev/null
+++ b/config/locales/views/coinbase_items/hu.yml
@@ -0,0 +1,78 @@
+---
+hu:
+  coinbase_items:
+    create:
+      default_name: Coinbase
+      success: Sikeresen csatlakoztál a Coinbase-hez! A számláid szinkronizálása folyamatban van.
+    update:
+      success: A Coinbase konfiguráció sikeresen frissítve.
+    destroy:
+      success: A Coinbase kapcsolat törlése ütemezve.
+    setup_accounts:
+      title: Coinbase pénztárcák importálása
+      subtitle: Válaszd ki, melyik pénztárcákat szeretnéd követni
+      instructions: Válaszd ki, melyik pénztárcákat szeretnéd importálni. A ki nem jelölt pénztárcák elérhetők maradnak, ha később hozzá szeretnéd adni őket.
+      no_accounts: Minden pénztárca importálva lett.
+      accounts_count:
+        one: "%{count} pénztárca elérhető"
+        other: "%{count} pénztárca elérhető"
+      select_all: Összes kijelölése
+      import_selected: Kijelöltek importálása
+      cancel: Mégse
+      creating: Importálás...
+    complete_account_setup:
+      success:
+        one: "%{count} pénztárca importálva"
+        other: "%{count} pénztárca importálva"
+      none_selected: Nincs kijelölt pénztárca
+      no_accounts: Nincs importálható pénztárca
+    coinbase_item:
+      provider_name: Coinbase
+      syncing: Szinkronizálás...
+      reconnect: A hitelesítő adatok frissítése szükséges
+      deletion_in_progress: Törlés folyamatban...
+      sync_status:
+        no_accounts: Nem találhatók számlák
+        all_synced:
+          one: "%{count} számla szinkronizálva"
+          other: "%{count} számla szinkronizálva"
+        partial_sync: "%{linked_count} szinkronizálva, %{unlinked_count} beállítást igényel"
+      status: "Utolsó szinkronizálás: %{timestamp} ezelőtt"
+      status_with_summary: "Utolsó szinkronizálás: %{timestamp} ezelőtt – %{summary}"
+      status_never: Még nem volt szinkronizálva
+      update_credentials: Hitelesítő adatok frissítése
+      delete: Törölés
+      no_accounts_title: Nem találhatók számlák
+      no_accounts_message: A Coinbase pénztárcáid szinkronizálás után fognak megjelenni itt.
+      setup_needed: Pénztárcák importálásra készen
+      setup_description: Válaszd ki, melyik Coinbase pénztárcákat szeretnéd követni.
+      setup_action: Pénztárcák importálása
+      import_wallets_menu: Pénztárcák importálása
+      more_wallets_available:
+        one: "%{count} további pénztárca elérhető importálásra"
+        other: "%{count} további pénztárca elérhető importálásra"
+    select_existing_account:
+      title: Coinbase számla összekapcsolása
+      no_accounts_found: Nem találhatók Coinbase számlák.
+      wait_for_sync: Várd meg, amíg a Coinbase befejezi a szinkronizálást
+      check_provider_health: Ellenőrizd, hogy a Coinbase API hitelesítő adataid érvényesek-e
+      balance: Egyenleg
+      currently_linked_to: "Jelenleg összekapcsolva: %{account_name}"
+      link: Összekapcsolás
+      cancel: Mégse
+    link_existing_account:
+      success: Sikeresen összekapcsolva a Coinbase számlával
+      errors:
+        only_manual: Csak manuális számlák kapcsolhatók össze a Coinbase-szel
+        invalid_coinbase_account: Érvénytelen Coinbase számla
+  coinbase_item:
+    syncer:
+      checking_credentials: Hitelesítő adatok ellenőrzése...
+      credentials_invalid: Érvénytelen API hitelesítő adatok. Kérjük, ellenőrizd az API kulcsodat és a titkos kódodat.
+      importing_accounts: Számlák importálása a Coinbase-ből...
+      checking_configuration: Számlakonfiguráció ellenőrzése...
+      accounts_need_setup:
+        one: "%{count} számla beállítást igényel"
+        other: "%{count} számla beállítást igényel"
+      processing_accounts: Számlaadatok feldolgozása...
+      calculating_balances: Egyenlegek kiszámítása...
diff --git a/config/locales/views/coinstats_items/ca.yml b/config/locales/views/coinstats_items/ca.yml
index 470fd3add..9694cfc41 100644
--- a/config/locales/views/coinstats_items/ca.yml
+++ b/config/locales/views/coinstats_items/ca.yml
@@ -3,61 +3,86 @@ ca:
   coinstats_items:
     coinstats_item:
       delete: Elimina
-      deletion_in_progress: S'estan esborrant les dades de la cartera de criptomonedes...
-      no_wallets_message: Actualment no hi ha carteres de criptomonedes connectades a CoinStats.
-      no_wallets_title: No hi ha carteres de criptomonedes connectades
+      deletion_in_progress: S'estan eliminant les dades de la cartera de cripto...
+      no_wallets_message: Actualment no hi ha carteres de cripto connectades a CoinStats.
+      no_wallets_title: No hi ha carteres de cripto connectades
       provider_name: CoinStats
-      reconnect: Torna a connectar
-      status: Sincronitzat per última vegada %{timestamp} fa
+      reconnect: Reconnecta
+      status: Darrera sincronització fa %{timestamp}
       status_never: Mai sincronitzat
-      status_with_summary: Sincronitzat per última vegada %{timestamp} fa • %{summary}
+      status_with_summary: Darrera sincronització fa %{timestamp} • %{summary}
       sync_status:
         all_synced:
-          one: "%{count} cartera de criptomonedes sincronitzada"
-          other: "%{count} carteres de criptomonedes sincronitzades"
-        no_accounts: No s'han trobat carteres de criptomonedes
-        partial_sync: "%{linked_count} carteres de criptomonedes sincronitzades, %{unlinked_count} necessiten configuració"
+          one: "%{count} cartera de cripto sincronitzada"
+          other: "%{count} carteres de cripto sincronitzades"
+        no_accounts: No s'han trobat carteres de cripto
+        partial_sync: "%{linked_count} carteres de cripto sincronitzades, %{unlinked_count}
+          necessiten configuració"
       syncing: Sincronitzant...
-      update_api_key: Actualitzar clau API
+      update_api_key: Actualitza la clau API
     create:
       default_name: Connexió CoinStats
       errors:
-        validation_failed: "La validació ha fallat: %{message}."
+        validation_failed: 'La validació ha fallat: %{message}.'
       success: La connexió amb el proveïdor CoinStats s'ha configurat correctament.
     destroy:
-      success: La connexió amb el proveïdor CoinStats està programada per a la seva eliminació.
+      success: La connexió amb el proveïdor CoinStats està programada per a la seva
+        eliminació.
+    link_exchange:
+      error: 'No s''ha pogut enllaçar l''exchange: %{message}.'
+      failed: No s'ha pogut enllaçar l'exchange.
+      invalid_exchange: L'exchange seleccionat ja no està admès.
+      missing_params: Cal l'exchange i les credencials.
+      success: S'ha enllaçat l'exchange %{name}.
     link_wallet:
-      error: "L'enllaç de la cartera de criptomonedes ha fallat: %{message}."
+      error: 'L''enllaç de la cartera de criptomonedes ha fallat: %{message}.'
       failed: L'enllaç de la cartera de criptomonedes ha fallat.
-      missing_params: "Falten els paràmetres requerits: adreça i blockchain."
+      missing_params: 'Falten els paràmetres requerits: adreça i blockchain.'
       success: "%{count} cartera(s) de criptomonedes enllaçades correctament."
     new:
       address_label: Adreça
-      address_placeholder: Requerit
+      address_placeholder: Obligatori
       api_key_label: Clau API
-      api_key_placeholder: Requerit
-      blockchain_fetch_error: No s'han pogut carregar els Blockchains. Torna a intentar-ho més tard.
+      api_key_placeholder: Obligatori
+      blockchain_fetch_error: No s'han pogut carregar les blockchains. Torna-ho a
+        provar més tard.
       blockchain_label: Blockchain
-      blockchain_placeholder: Requerit
-      blockchain_select_blank: Selecciona un Blockchain
+      blockchain_placeholder: Obligatori
+      blockchain_select_blank: Selecciona una blockchain
       configure: Configura
       default_name: Connexió CoinStats
-      go_to_settings: Anar a la configuració del proveïdor
-      link: Enllaça una cartera de criptomonedes
-      not_configured_message: Per enllaçar una cartera de criptomonedes, primer has de configurar la connexió amb el proveïdor CoinStats.
+      exchange_label: Exchange
+      exchange_select_blank: Selecciona un exchange
+      go_to_settings: Ves a la configuració del proveïdor
+      link_exchange_description: Utilitza una clau API d'exchange només de lectura
+        perquè CoinStats pugui sincronitzar saldos i transaccions de Bitvavo, Binance
+        i altres exchanges admesos.
+      link_exchange_note: Si el teu exchange requereix activació de la clau API o
+        confirmació per correu, completa aquest pas abans d'enllaçar-lo aquí.
+      link_exchange_submit: Enllaça l'exchange
+      link_exchange_title: Enllaça l'API de l'exchange
+      link_wallet_description: Fes el seguiment d'una cartera autocustodiada o d'una
+        sola adreça on-chain a través de CoinStats.
+      link_wallet_submit: Enllaça la cartera de cripto
+      link_wallet_title: Enllaça l'adreça de la cartera
+      not_configured_message: Per enllaçar una cartera de cripto o un exchange, primer
+        has de configurar la connexió amb el proveïdor CoinStats.
       not_configured_step1_html: Ves a <strong>Configuració → Proveïdors</strong>
       not_configured_step2_html: Localitza el proveïdor <strong>CoinStats</strong>
-      not_configured_step3_html: Segueix les <strong>instruccions de configuració</strong> proporcionades per completar la configuració del proveïdor
+      not_configured_step3_html: Segueix les <strong>instruccions de configuració</strong>
+        proporcionades per completar la configuració del proveïdor
       not_configured_title: La connexió amb el proveïdor CoinStats no està configurada
-      setup_instructions: "Instruccions de configuració:"
-      status_configured_html: Llest per utilitzar
-      status_not_configured: No configurat
-      step1_html: Ves al <a href="https://openapi.coinstats.app/" class="link" target="_blank" rel="noopener noreferrer">Panell de l'API Pública de CoinStats</a> per obtenir una clau API.
+      setup_instructions: 'Instruccions de configuració:'
+      step1_html: Visita el <a href="https://openapi.coinstats.app/" class="link"
+        target="_blank" rel="noopener noreferrer">panell de l'API pública de CoinStats</a>
+        per obtenir una clau API.
       step2: Introdueix la teva clau API a continuació i fes clic a Configura.
-      step3_html: Després d'una connexió reeixida, ves a la pestanya <a href="%{accounts_url}" class="link" data-turbo-frame="_top">Comptes</a> per configurar les carteres de criptomonedes.
-      title: Enllaça una cartera de criptomonedes amb CoinStats
-      update_configuration: Torna a configurar
+      step3_html: Després d'una connexió correcta, ves a la pestanya <a href="%{accounts_url}"
+        class="link" data-turbo-frame="_top">Comptes</a> per configurar els teus comptes
+        de cripto.
+      title: Enllaça cripto amb CoinStats
+      update_configuration: Reconfigura
     update:
       errors:
-        validation_failed: "La validació ha fallat: %{message}."
-      success: La connexió amb el proveïdor CoinStats s'ha actualitzat correctament.
\ No newline at end of file
+        validation_failed: 'La validació ha fallat: %{message}.'
+      success: La connexió amb el proveïdor CoinStats s'ha actualitzat correctament.
diff --git a/config/locales/views/coinstats_items/de.yml b/config/locales/views/coinstats_items/de.yml
index 56ce87bd8..d54f1e4fe 100644
--- a/config/locales/views/coinstats_items/de.yml
+++ b/config/locales/views/coinstats_items/de.yml
@@ -41,8 +41,6 @@ de:
       configure: Konfigurieren
       update_configuration: Neu konfigurieren
       default_name: CoinStats-Verbindung
-      status_configured_html: Bereit zur Nutzung
-      status_not_configured: Nicht konfiguriert
     coinstats_item:
       deletion_in_progress: Krypto-Wallet-Daten werden gelöscht…
       provider_name: CoinStats
diff --git a/config/locales/views/coinstats_items/en.yml b/config/locales/views/coinstats_items/en.yml
index ecd41109b..982aa8db3 100644
--- a/config/locales/views/coinstats_items/en.yml
+++ b/config/locales/views/coinstats_items/en.yml
@@ -55,8 +55,6 @@ en:
       configure: Configure
       update_configuration: Reconfigure
       default_name: CoinStats Connection
-      status_configured_html: Ready to use
-      status_not_configured: Not configured
     coinstats_item:
       deletion_in_progress: Crypto wallet data is being deleted…
       provider_name: CoinStats
diff --git a/config/locales/views/coinstats_items/es.yml b/config/locales/views/coinstats_items/es.yml
index 36744d53e..ca54f463b 100644
--- a/config/locales/views/coinstats_items/es.yml
+++ b/config/locales/views/coinstats_items/es.yml
@@ -41,8 +41,6 @@ es:
       configure: Configurar
       update_configuration: Reconfigurar
       default_name: Conexión de CoinStats
-      status_configured_html: Listo para usar
-      status_not_configured: No configurado
     coinstats_item:
       deletion_in_progress: Los datos de la cartera de criptomonedas se están eliminando…
       provider_name: CoinStats
diff --git a/config/locales/views/coinstats_items/fr.yml b/config/locales/views/coinstats_items/fr.yml
index f7fec5e58..84a89d621 100644
--- a/config/locales/views/coinstats_items/fr.yml
+++ b/config/locales/views/coinstats_items/fr.yml
@@ -17,17 +17,31 @@ fr:
       missing_params: "Paramètres requis manquants : adresse et blockchain."
       failed: Échec de la liaison du portefeuille crypto.
       error: "Échec de la liaison du portefeuille crypto : %{message}."
+    link_exchange:
+      success: "Plateforme d'échange %{name} liée."
+      missing_params: La plateforme d'échange et les identifiants sont requis.
+      invalid_exchange: La plateforme d'échange sélectionnée n'est plus prise en charge.
+      failed: Échec de la liaison de la plateforme d'échange.
+      error: "Échec de la liaison de la plateforme d'échange : %{message}."
     new:
       title: Lier un portefeuille crypto avec CoinStats
       blockchain_fetch_error: Échec du chargement des blockchains. Veuillez réessayer plus tard.
+      link_wallet_title: Lier une adresse de portefeuille
+      link_wallet_description: Suivez un portefeuille en auto-conservation ou une adresse on-chain unique via CoinStats.
       address_label: Adresse
       address_placeholder: Requis
       blockchain_label: Blockchain
       blockchain_placeholder: Requis
       blockchain_select_blank: Sélectionnez une blockchain
-      link: Lier le portefeuille crypto
+      link_wallet_submit: Lier le portefeuille crypto
+      link_exchange_title: Lier l'API d'une plateforme d'échange
+      link_exchange_description: Utilisez une clé API de plateforme d'échange en lecture seule pour que CoinStats puisse synchroniser les soldes et les transactions depuis Bitvavo, Binance et d'autres plateformes prises en charge.
+      link_exchange_note: Si votre plateforme d'échange nécessite l'activation de la clé API ou la confirmation par e-mail, effectuez cette étape avant de la lier ici.
+      exchange_select_blank: Sélectionnez une plateforme d'échange
+      exchange_label: Plateforme d'échange
+      link_exchange_submit: Lier la plateforme d'échange
       not_configured_title: Connexion au fournisseur CoinStats non configurée
-      not_configured_message: Pour lier un portefeuille crypto, vous devez d'abord configurer la connexion au fournisseur CoinStats.
+      not_configured_message: Pour lier un portefeuille crypto ou une plateforme d'échange, vous devez d'abord configurer la connexion au fournisseur CoinStats.
       not_configured_step1_html: Allez dans <strong>Paramètres → Fournisseurs</strong>
       not_configured_step2_html: Localisez le fournisseur <strong>CoinStats</strong>
       not_configured_step3_html: Suivez les <strong>instructions de configuration</strong> fournies pour terminer la configuration du fournisseur
@@ -41,8 +55,6 @@ fr:
       configure: Configurer
       update_configuration: Reconfigurer
       default_name: Connexion CoinStats
-      status_configured_html: Prêt à utiliser
-      status_not_configured: Non configuré
     coinstats_item:
       deletion_in_progress: Les données du portefeuille crypto sont en cours de suppression…
       provider_name: CoinStats
diff --git a/config/locales/views/coinstats_items/hu.yml b/config/locales/views/coinstats_items/hu.yml
new file mode 100644
index 000000000..3a3dbad56
--- /dev/null
+++ b/config/locales/views/coinstats_items/hu.yml
@@ -0,0 +1,75 @@
+---
+hu:
+  coinstats_items:
+    create:
+      success: A CoinStats szolgáltató kapcsolat sikeresen beállítva.
+      default_name: CoinStats kapcsolat
+      errors:
+        validation_failed: "Érvényesítési hiba: %{message}."
+    update:
+      success: A CoinStats szolgáltató kapcsolat sikeresen frissítve.
+      errors:
+        validation_failed: "Érvényesítési hiba: %{message}."
+    destroy:
+      success: A CoinStats szolgáltató kapcsolat törlése ütemezve.
+    link_wallet:
+      success: "%{count} kriptó pénztárca sikeresen összekapcsolva."
+      missing_params: "Hiányzó kötelező paraméterek: cím és blokklánc."
+      failed: A kriptó pénztárca összekapcsolása sikertelen.
+      error: "A kriptó pénztárca összekapcsolása sikertelen: %{message}."
+    link_exchange:
+      success: "%{name} tőzsde összekapcsolva."
+      missing_params: A tőzsde és a hitelesítő adatok megadása kötelező.
+      invalid_exchange: A kiválasztott tőzsde már nem támogatott.
+      failed: Nem sikerült összekapcsolni a tőzsdét.
+      error: "Nem sikerült összekapcsolni a tőzsdét: %{message}."
+    new:
+      title: Kriptó összekapcsolása CoinStats-szal
+      blockchain_fetch_error: Nem sikerült betölteni a blokkláncokat. Kérjük, próbáld újra később.
+      link_wallet_title: Pénztárca cím összekapcsolása
+      link_wallet_description: Kövess egy önőrzésű pénztárcát vagy egyetlen on-chain címet a CoinStats segítségével.
+      address_label: Cím
+      address_placeholder: Kötelező
+      blockchain_label: Blokklánc
+      blockchain_placeholder: Kötelező
+      blockchain_select_blank: Válassz blokkláncot
+      link_wallet_submit: Kriptó pénztárca összekapcsolása
+      link_exchange_title: Tőzsde API összekapcsolása
+      link_exchange_description: Használj csak olvasható tőzsde API kulcsot, hogy a CoinStats szinkronizálni tudja az egyenlegeket és a tranzakciókat a Bitvavo, Binance és más támogatott tőzsdékről.
+      link_exchange_note: Ha a tőzsdéd API-kulcs aktiválást vagy e-mailes megerősítést igényel, végezd el ezt a lépést az összekapcsolás előtt.
+      exchange_select_blank: Válassz tőzsdét
+      exchange_label: Tőzsde
+      link_exchange_submit: Tőzsde összekapcsolása
+      not_configured_title: A CoinStats szolgáltató kapcsolat nincs beállítva
+      not_configured_message: Kriptó pénztárca vagy tőzsde összekapcsolásához először be kell állítanod a CoinStats szolgáltató kapcsolatot.
+      not_configured_step1_html: Menj a <strong>Beállítások → Szolgáltatók</strong> oldalra
+      not_configured_step2_html: Keresd meg a <strong>CoinStats</strong> szolgáltatót
+      not_configured_step3_html: Kövesd a megadott <strong>beállítási utasításokat</strong> a szolgáltató konfigurálásának befejezéséhez
+      go_to_settings: Szolgáltatói beállítások megnyitása
+      setup_instructions: "Beállítási utasítások:"
+      step1_html: Látogass el a <a href="https://openapi.coinstats.app/" class="link" target="_blank" rel="noopener noreferrer">CoinStats Public API Dashboard</a> oldalra egy API kulcs megszerzéséhez.
+      step2: Add meg az API kulcsodat lent, majd kattints a Konfigurálás gombra.
+      step3_html: Sikeres csatlakozás után látogasd meg a <a href="%{accounts_url}" class="link" data-turbo-frame="_top">Számlák</a> fület a kriptó számláid beállításához.
+      api_key_label: API kulcs
+      api_key_placeholder: Kötelező
+      configure: Konfigurálás
+      update_configuration: Újrakonfigurálás
+      default_name: CoinStats kapcsolat
+    coinstats_item:
+      deletion_in_progress: A kriptó pénztárca adatai törlés alatt…
+      provider_name: CoinStats
+      syncing: Szinkronizálás…
+      sync_status:
+        no_accounts: Nem találhatók kriptó pénztárcák
+        all_synced:
+          one: "%{count} kriptó pénztárca szinkronizálva"
+          other: "%{count} kriptó pénztárca szinkronizálva"
+        partial_sync: "%{linked_count} kriptó pénztárca szinkronizálva, %{unlinked_count} beállítást igényel"
+      reconnect: Újracsatlakozás
+      status: Utolsó szinkronizálás %{timestamp} ezelőtt
+      status_never: Még nem volt szinkronizálva
+      status_with_summary: "Utolsó szinkronizálás: %{timestamp} ezelőtt • %{summary}"
+      update_api_key: API kulcs frissítése
+      delete: Töröl
+      no_wallets_title: Nincs csatlakoztatott kriptó pénztárca
+      no_wallets_message: Jelenleg nincs kriptó pénztárca csatlakoztatva a CoinStats-hoz.
diff --git a/config/locales/views/coinstats_items/nl.yml b/config/locales/views/coinstats_items/nl.yml
index 7c0918599..da6b19b55 100644
--- a/config/locales/views/coinstats_items/nl.yml
+++ b/config/locales/views/coinstats_items/nl.yml
@@ -43,8 +43,6 @@ nl:
       configure: Configureren
       update_configuration: Opnieuw configureren
       default_name: CoinStats Verbinding
-      status_configured_html: Klaar voor gebruik
-      status_not_configured: Niet geconfigureerd
     coinstats_item:
       deletion_in_progress: Crypto wallet gegevens worden verwijderd…
       provider_name: CoinStats
diff --git a/config/locales/views/coinstats_items/pl.yml b/config/locales/views/coinstats_items/pl.yml
index 968c9aa0b..15d0c66b4 100644
--- a/config/locales/views/coinstats_items/pl.yml
+++ b/config/locales/views/coinstats_items/pl.yml
@@ -45,8 +45,6 @@ pl:
       configure: Skonfiguruj
       update_configuration: Skonfiguruj ponownie
       default_name: Połączenie CoinStats
-      status_configured_html: Gotowe do użycia
-      status_not_configured: Nieskonfigurowane
     coinstats_item:
       deletion_in_progress: Trwa usuwanie danych portfela kryptowalutowego…
       provider_name: CoinStats
diff --git a/config/locales/views/components/ca.yml b/config/locales/views/components/ca.yml
index c5dcbeb11..adc046526 100644
--- a/config/locales/views/components/ca.yml
+++ b/config/locales/views/components/ca.yml
@@ -1,5 +1,98 @@
 ---
 ca:
+  UI:
+    account:
+      activity_date:
+        balance_tooltip: Saldo al final del dia, després de totes les transaccions
+          i ajustos
+        no_balance_data: No hi ha dades de saldo per a aquesta data
+      activity_feed:
+        toggle_selection_checkboxes: Commuta la selecció
+      balance_reconciliation:
+        labels:
+          adjustments: Ajustos
+          buys: Compres
+          change_in_brokerage_cash: Variació de l'efectiu del broker
+          change_in_holdings_market: Variació de les posicions (preu de mercat)
+          change_in_holdings_trades: Variació de les posicions (compres/vendes)
+          charges: Càrrecs
+          end_balance: Saldo final
+          end_principal: Capital final
+          end_value: Valor final
+          final_balance: Saldo final del dia
+          final_principal: Capital final del dia
+          final_value: Valor final del dia
+          market_changes: Variacions de mercat
+          net_cash_flow: Flux net d'efectiu
+          net_principal_change: Variació neta del capital
+          net_value_change: Variació neta del valor
+          payments: Pagaments
+          sells: Vendes
+          start_balance: Saldo inicial
+          start_principal: Capital inicial
+          start_value: Valor inicial
+        tooltips:
+          adjustments: Conciliacions manuals o altres ajustos
+          adjustments_asset: Ajustos de valor manuals o taxacions
+          buys: Compres de cripto durant el dia
+          change_in_brokerage_cash: Variació neta de l'efectiu per dipòsits, retirades
+            i operacions
+          change_in_holdings_market: Variació del valor de les posicions per moviments
+            del preu de mercat
+          change_in_holdings_trades: Impacte sobre les posicions per compres i vendes
+            de valors
+          charges: Nous càrrecs realitzats durant el dia
+          end_balance: Saldo calculat després de totes les transaccions
+          end_balance_investment: Saldo calculat després de tota l'activitat
+          end_principal: Capital calculat després de totes les transaccions
+          end_value: Valor calculat després de tots els canvis
+          final_balance: Saldo final del compte del dia
+          final_balance_credit: Saldo deutor final del dia
+          final_balance_crypto: Valor final de les posicions cripto del dia
+          final_balance_investment: Valor final de la cartera del dia
+          final_principal: Capital final del préstec del dia
+          final_value: Valor final de l'actiu del dia
+          market_changes: Variacions de valor pels moviments del preu de mercat
+          net_cash_flow: Variació neta del saldo per totes les transaccions del dia
+          net_principal_change: Pagaments de capital i nous préstecs durant el dia
+          net_value_change: Totes les variacions de valor incloent millores i depreciació
+          payments: Pagaments fets a la targeta durant el dia
+          sells: Vendes de cripto durant el dia
+          start_balance: Saldo del compte a l'inici del dia
+          start_balance_credit: Saldo deutor a l'inici del dia
+          start_balance_crypto: Valor de les posicions cripto a l'inici del dia
+          start_balance_investment: Valor total de la cartera a l'inici del dia
+          start_principal: Saldo del capital a l'inici del dia
+          start_value: Valor de l'actiu a l'inici del dia
+      chart:
+        no_data_available: No hi ha dades disponibles
+        title:
+          balance: Saldo
+          cash_value: Valor de l'efectiu
+          debt_balance: Saldo del deute
+          estimated_property_value: Valor estimat de l'immoble
+          estimated_vehicle_value: Valor estimat del vehicle
+          holdings_value: Valor de les posicions
+          remaining_principal_balance: Capital pendent
+          total_account_value: Valor total del compte
+        views:
+          cash: Efectiu
+          holdings: Posicions
+          total_value: Valor total
+        vs_available_history: vs. historial disponible
+  ds:
+    alert:
+      variants:
+        destructive: Error
+        error: Error
+        info: Informació
+        success: Èxit
+        warning: Avís
+    dialog:
+      close: Tanca
+    pill:
+      aria_label: "%{label}"
+      default_label: Experimental
   provider_sync_summary:
     accounts:
       institutions: 'Institucions: %{count}'
@@ -20,8 +113,8 @@ ca:
       rate_limited: Sota límit de %{time_ago}
       recently: recentment
       stale_pending:
-        one: "%{count} transacció pendent obsoleta (exclòs dels pressupostos)"
-        other: "%{count} transaccions pendents obsoletes (exclòs dels pressupostos)"
+        one: "%{count} transacció pendent obsoleta (exclosa dels pressupostos)"
+        other: "%{count} transaccions pendents obsoletes (excloses dels pressupostos)"
       stale_pending_count:
         one: "%{count} transacció"
         other: "%{count} transaccions"
@@ -34,6 +127,7 @@ ca:
       title: Estat
       view_data_quality: Veure detalls de qualitat de dades
       view_duplicate_suggestions: Veure duplicades suggerides
+      view_error_details: Veure detalls de l'error
       view_reconciled: Veure transaccions conciliades
       view_stale_pending: Veure comptes afectats
       view_stale_unmatched: Veure transaccions que necessiten revisió
@@ -42,10 +136,25 @@ ca:
       processed: 'Processat: %{count}'
       title: Posicions
     last_sync: 'Última sincronització: fa %{time_ago}'
+    skip_reasons:
+      excluded: Excloses
+      import_locked: Importació CSV
+      protected: Protegides
+      user_modified: Modificades per l'usuari
     title: Resum de sincronització
-    transactions:
+    trades:
+      fetching: Recuperant activitats del broker...
       imported: 'Importat: %{count}'
+      skipped: 'Omès: %{count}'
+      title: Operacions
+    transactions:
+      fetching: Recuperant del broker...
+      imported: 'Importat: %{count}'
+      protected:
+        one: "%{count} entrada protegida (no sobreescrita)"
+        other: "%{count} entrades protegides (no sobreescrites)"
       seen: 'Vist: %{count}'
       skipped: 'Omès: %{count}'
       title: Transaccions
       updated: 'Actualitzat: %{count}'
+      view_protected: Veure entrades protegides
diff --git a/config/locales/views/components/en.yml b/config/locales/views/components/en.yml
index 9230a79ec..e0dfca1ab 100644
--- a/config/locales/views/components/en.yml
+++ b/config/locales/views/components/en.yml
@@ -1,5 +1,100 @@
 ---
 en:
+  UI:
+    account:
+      activity_feed:
+        toggle_selection_checkboxes: Toggle selection
+      balance_reconciliation:
+        labels:
+          adjustments: Adjustments
+          buys: Buys
+          change_in_brokerage_cash: Change in brokerage cash
+          change_in_holdings_market: Change in holdings (market price activity)
+          change_in_holdings_trades: Change in holdings (buys/sells)
+          charges: Charges
+          end_balance: End balance
+          end_principal: End principal
+          end_value: End value
+          final_balance: Final balance
+          final_principal: Final principal
+          final_value: Final value
+          market_changes: Market changes
+          net_cash_flow: Net cash flow
+          net_principal_change: Net principal change
+          net_value_change: Net value change
+          payments: Payments
+          sells: Sells
+          start_balance: Start balance
+          start_principal: Start principal
+          start_value: Start value
+        tooltips:
+          adjustments: Manual reconciliations or other adjustments
+          adjustments_asset: Manual value adjustments or appraisals
+          buys: Crypto purchases during the day
+          change_in_brokerage_cash: Net change in cash from deposits, withdrawals, and trades
+          change_in_holdings_market: Change in holdings value from market price movements
+          change_in_holdings_trades: Impact on holdings from buying and selling securities
+          charges: New charges made during the day
+          end_balance: The calculated balance after all transactions
+          end_balance_investment: The calculated balance after all activity
+          end_principal: The calculated principal after all transactions
+          end_value: The calculated value after all changes
+          final_balance: The final account balance for the day
+          final_balance_credit: The final balance owed for the day
+          final_balance_crypto: The final crypto holdings value for the day
+          final_balance_investment: The final portfolio value for the day
+          final_principal: The final principal balance for the day
+          final_value: The final asset value for the day
+          market_changes: Value changes from market price movements
+          net_cash_flow: Net change in balance from all transactions during the day
+          net_principal_change: Principal payments and new borrowing during the day
+          net_value_change: All value changes including improvements and depreciation
+          payments: Payments made to the card during the day
+          sells: Crypto sales during the day
+          start_balance: The account balance at the beginning of this day
+          start_balance_credit: The balance owed at the beginning of this day
+          start_balance_crypto: The crypto holdings value at the beginning of this day
+          start_balance_investment: The total portfolio value at the beginning of this day
+          start_principal: The principal balance at the beginning of this day
+          start_value: The asset value at the beginning of this day
+      chart:
+        no_data_available: "No data available"
+        title:
+          balance: Balance
+          cash_value: Cash value
+          debt_balance: Debt balance
+          estimated_property_value: Estimated property value
+          estimated_vehicle_value: Estimated vehicle value
+          holdings_value: Holdings value
+          remaining_principal_balance: Remaining principal balance
+          total_account_value: Total account value
+        views:
+          cash: Cash
+          holdings: Holdings
+          total_value: Total value
+        vs_available_history: vs. available history
+      activity_date:
+        balance_tooltip: "The end of day balance, after all transactions and adjustments"
+        no_balance_data: "No balance data available for this date"
+  ds:
+    alert:
+      variants:
+        info: Info
+        success: Success
+        warning: Warning
+        error: Error
+        destructive: Error
+    pill:
+      aria_label: "%{label}"
+      default_label: Preview
+    dialog:
+      close: Close
+    popover:
+      avatar_default_label: Open menu
+    tooltip:
+      trigger_label: More info
+    link:
+      opens_in_new_tab: (opens in new tab)
   provider_sync_summary:
     title: Sync summary
     last_sync: "Last sync: %{time_ago} ago"
diff --git a/config/locales/views/components/es.yml b/config/locales/views/components/es.yml
index 4587a0088..639beff3f 100644
--- a/config/locales/views/components/es.yml
+++ b/config/locales/views/components/es.yml
@@ -63,4 +63,8 @@ es:
         other: "%{count} transacciones"
       data_warnings: "Avisos de datos: %{count}"
       notices: "Avisos: %{count}"
-      view_data_quality: Ver detalles de calidad de datos
\ No newline at end of file
+      view_data_quality: Ver detalles de calidad de datos
+  ds:
+    pill:
+      aria_label: "%{label}"
+      default_label: Experimental
\ No newline at end of file
diff --git a/config/locales/views/components/fr.yml b/config/locales/views/components/fr.yml
index 9a67503ae..7774ddd38 100644
--- a/config/locales/views/components/fr.yml
+++ b/config/locales/views/components/fr.yml
@@ -15,12 +15,28 @@ fr:
       imported: "Importées : %{count}"
       updated: "Mises à jour : %{count}"
       skipped: "Ignorées : %{count}"
+      fetching: "Récupération depuis le courtier…"
+      protected:
+        one: "%{count} entrée protégée (non écrasée)"
+        other: "%{count} entrées protégées (non écrasées)"
+      view_protected: Voir les entrées protégées
+    skip_reasons:
+      excluded: Exclu
+      user_modified: Modifié par l'utilisateur
+      import_locked: Import CSV
+      protected: Protégé
     holdings:
       title: Avoirs
       found: "Trouvés : %{count}"
       processed: "Traités : %{count}"
+    trades:
+      title: Transactions boursières
+      imported: "Importées : %{count}"
+      skipped: "Ignorées : %{count}"
+      fetching: "Récupération des activités depuis le courtier…"
     health:
       title: Santé
+      view_error_details: Voir les détails de l'erreur
       rate_limited: "Limité %{time_ago}"
       recently: récemment
       errors: "Erreurs : %{count}"
diff --git a/config/locales/views/components/hu.yml b/config/locales/views/components/hu.yml
new file mode 100644
index 000000000..7eaea51d6
--- /dev/null
+++ b/config/locales/views/components/hu.yml
@@ -0,0 +1,86 @@
+---
+hu:
+  UI:
+    account:
+      activity_feed:
+        toggle_selection_checkboxes: Kijelölés be-/kikapcsolása
+      chart:
+        no_data_available: "Nincs elérhető adat"
+      activity_date:
+        balance_tooltip: "A nap végi egyenleg, az összes tranzakció és korrekció után"
+        no_balance_data: "Erre a dátumra nincs elérhető egyenlegadat"
+  ds:
+    alert:
+      variants:
+        info: Információ
+        success: Siker
+        warning: Figyelmeztetés
+        error: Hiba
+        destructive: Hiba
+    dialog:
+      close: Bezárás
+  provider_sync_summary:
+    title: Szinkronizálás összegzése
+    last_sync: "Utolsó szinkronizálás: %{time_ago} ezelőtt"
+    accounts:
+      title: Számlák
+      total: "Összesen: %{count}"
+      linked: "Csatlakoztatva: %{count}"
+      unlinked: "Nincs csatlakoztatva: %{count}"
+      institutions: "Intézmények: %{count}"
+    transactions:
+      title: Tranzakciók
+      seen: "Látott: %{count}"
+      imported: "Importálva: %{count}"
+      updated: "Frissítve: %{count}"
+      skipped: "Kihagyva: %{count}"
+      fetching: "Lekérés a brókertől..."
+      protected:
+        one: "%{count} bejegyzés védett (nem lett felülírva)"
+        other: "%{count} bejegyzés védett (nem lett felülírva)"
+      view_protected: Védett bejegyzések megtekintése
+    skip_reasons:
+      excluded: Kizárva
+      user_modified: Felhasználó módosította
+      import_locked: CSV importálás
+      protected: Védett
+    holdings:
+      title: Portfólió
+      found: "Megtalálva: %{count}"
+      processed: "Feldolgozva: %{count}"
+    trades:
+      title: Kereskedések
+      imported: "Importálva: %{count}"
+      skipped: "Kihagyva: %{count}"
+      fetching: "Tevékenységek lekérése a brókertől..."
+    health:
+      title: Állapot
+      view_error_details: Hibák részleteinek megtekintése
+      rate_limited: "Forgalomkorlátozva %{time_ago}"
+      recently: nemrég
+      errors: "Hibák: %{count}"
+      pending_reconciled:
+        one: "%{count} duplikált függő tranzakció egyeztetve"
+        other: "%{count} duplikált függő tranzakció egyeztetve"
+      view_reconciled: Egyeztetett tranzakciók megtekintése
+      duplicate_suggestions:
+        one: "%{count} lehetséges duplikátum felülvizsgálatra vár"
+        other: "%{count} lehetséges duplikátum felülvizsgálatra vár"
+      view_duplicate_suggestions: Javasolt duplikátumok megtekintése
+      stale_pending:
+        one: "%{count} elavult függő tranzakció (kizárva a költségvetésekből)"
+        other: "%{count} elavult függő tranzakció (kizárva a költségvetésekből)"
+      view_stale_pending: Érintett számlák megtekintése
+      stale_pending_count:
+        one: "%{count} tranzakció"
+        other: "%{count} tranzakció"
+      stale_unmatched:
+        one: "%{count} függő tranzakció manuális felülvizsgálatra vár"
+        other: "%{count} függő tranzakció manuális felülvizsgálatra vár"
+      view_stale_unmatched: Felülvizsgálatra váró tranzakciók megtekintése
+      stale_unmatched_count:
+        one: "%{count} tranzakció"
+        other: "%{count} tranzakció"
+      data_warnings: "Adatfigyelmeztetések: %{count}"
+      notices: "Értesítések: %{count}"
+      view_data_quality: Adatminőség részleteinek megtekintése
diff --git a/config/locales/views/credit_cards/ca.yml b/config/locales/views/credit_cards/ca.yml
index 9f6ad0003..6ac6a7515 100644
--- a/config/locales/views/credit_cards/ca.yml
+++ b/config/locales/views/credit_cards/ca.yml
@@ -20,6 +20,7 @@ ca:
       annual_fee: Quota anual
       apr: TAE
       available_credit: Crèdit disponible
+      edit_account_details: Edita els detalls del compte
       expiration_date: Data de caducitat
       minimum_payment: Pagament mínim
       unknown: Desconegut
diff --git a/config/locales/views/credit_cards/en.yml b/config/locales/views/credit_cards/en.yml
index f0131d218..ac5871982 100644
--- a/config/locales/views/credit_cards/en.yml
+++ b/config/locales/views/credit_cards/en.yml
@@ -20,6 +20,7 @@ en:
       annual_fee: Annual Fee
       apr: APR
       available_credit: Available Credit
+      edit_account_details: Edit account details
       expiration_date: Expiration Date
       minimum_payment: Minimum Payment
       unknown: Unknown
diff --git a/config/locales/views/credit_cards/hu.yml b/config/locales/views/credit_cards/hu.yml
new file mode 100644
index 000000000..be82b379d
--- /dev/null
+++ b/config/locales/views/credit_cards/hu.yml
@@ -0,0 +1,26 @@
+---
+hu:
+  credit_cards:
+    edit:
+      edit: '%{account} szerkesztése'
+    form:
+      annual_fee: Éves díj
+      annual_fee_placeholder: '99'
+      apr: THM
+      apr_placeholder: '15.99'
+      available_credit: Rendelkezésre álló hitelkeret
+      available_credit_placeholder: '10000'
+      expiration_date: Lejárati dátum
+      minimum_payment: Minimális törlesztőrészlet
+      minimum_payment_placeholder: '100'
+    new:
+      title: Add meg a hitelkártya adatait
+    overview:
+      amount_owed: Tartozás összege
+      annual_fee: Éves díj
+      apr: THM
+      available_credit: Rendelkezésre álló hitelkeret
+      edit_account_details: Számlaadatok szerkesztése
+      expiration_date: Lejárati dátum
+      minimum_payment: Minimális törlesztőrészlet
+      unknown: Ismeretlen
diff --git a/config/locales/views/cryptos/ca.yml b/config/locales/views/cryptos/ca.yml
index 597bd3cbe..fb41ce5bc 100644
--- a/config/locales/views/cryptos/ca.yml
+++ b/config/locales/views/cryptos/ca.yml
@@ -3,5 +3,20 @@ ca:
   cryptos:
     edit:
       edit: Edita %{account}
+    form:
+      subtype_label: Tipus de compte
+      subtype_none: Cap
+      subtype_prompt: Selecciona el tipus de compte
+      tax_treatment_hint: La majoria de les criptomonedes es tenen en comptes subjectes
+        a impostos. Selecciona una altra opció si es tenen en un compte amb avantatges
+        fiscals.
+      tax_treatment_label: Tractament fiscal
     new:
       title: Introdueix el saldo del compte
+    subtypes:
+      exchange:
+        long: Exchange de cripto
+        short: Exchange
+      wallet:
+        long: Cartera de cripto
+        short: Cartera
diff --git a/config/locales/views/cryptos/fr.yml b/config/locales/views/cryptos/fr.yml
index 005207903..acef7c30a 100644
--- a/config/locales/views/cryptos/fr.yml
+++ b/config/locales/views/cryptos/fr.yml
@@ -3,5 +3,18 @@ fr:
   cryptos:
     edit:
       edit: Éditer %{account}
+    form:
+      subtype_label: Type de compte
+      subtype_prompt: Sélectionner un type de compte
+      subtype_none: Aucun
+      tax_treatment_label: Traitement fiscal
+      tax_treatment_hint: La plupart des cryptomonnaies sont détenues dans des comptes imposables. Sélectionnez une autre option si elles sont détenues dans un compte fiscalement avantageux.
     new:
       title: Saisir le solde du compte
+    subtypes:
+      wallet:
+        short: Portefeuille
+        long: Portefeuille crypto
+      exchange:
+        short: Plateforme d'échange
+        long: Plateforme d'échange crypto
diff --git a/config/locales/views/cryptos/hu.yml b/config/locales/views/cryptos/hu.yml
new file mode 100644
index 000000000..b7ecc1c80
--- /dev/null
+++ b/config/locales/views/cryptos/hu.yml
@@ -0,0 +1,20 @@
+---
+hu:
+  cryptos:
+    edit:
+      edit: '%{account} szerkesztése'
+    form:
+      subtype_label: Számlatípus
+      subtype_prompt: Válassz számlatípust
+      subtype_none: Nincs
+      tax_treatment_label: Adózási besorolás
+      tax_treatment_hint: A legtöbb kriptovalutát adóköteles számlán tartják. Válassz másik lehetőséget, ha adókedvezményes számlán van.
+    new:
+      title: Add meg a számlaegyenleget
+    subtypes:
+      wallet:
+        short: Tárca
+        long: Kriptotárca
+      exchange:
+        short: Tőzsde
+        long: Kriptotőzsde
diff --git a/config/locales/views/depositories/ca.yml b/config/locales/views/depositories/ca.yml
index 59d4cb0de..8f4327d69 100644
--- a/config/locales/views/depositories/ca.yml
+++ b/config/locales/views/depositories/ca.yml
@@ -8,3 +8,21 @@ ca:
       subtype_prompt: Selecciona el tipus de compte
     new:
       title: Introdueix el saldo del compte
+    subtypes:
+      cd:
+        long: Certificat de dipòsit
+        short: CD
+      checking:
+        long: Corrent
+        short: Corrent
+      hsa:
+        long: Compte d'estalvi per a salut
+        short: HSA
+      money_market:
+        long: Mercat monetari
+        short: MM
+      savings:
+        long: Estalvis
+        short: Estalvis
+    types_plural:
+      depository: Comptes corrents i estalvis
diff --git a/config/locales/views/depositories/en.yml b/config/locales/views/depositories/en.yml
index 081d14679..99cc944d1 100644
--- a/config/locales/views/depositories/en.yml
+++ b/config/locales/views/depositories/en.yml
@@ -8,3 +8,19 @@ en:
       subtype_prompt: Select account type
     new:
       title: Enter account balance
+    subtypes:
+      cd:
+        long: Certificate of Deposit
+        short: CD
+      checking:
+        long: Checking
+        short: Checking
+      hsa:
+        long: Health Savings Account
+        short: HSA
+      money_market:
+        long: Money Market
+        short: MM
+      savings:
+        long: Savings
+        short: Savings
diff --git a/config/locales/views/depositories/hu.yml b/config/locales/views/depositories/hu.yml
new file mode 100644
index 000000000..d0d763755
--- /dev/null
+++ b/config/locales/views/depositories/hu.yml
@@ -0,0 +1,10 @@
+---
+hu:
+  depositories:
+    edit:
+      edit: '%{account} szerkesztése'
+    form:
+      none: Nincs
+      subtype_prompt: Válassz számlatípust
+    new:
+      title: Add meg a számlaegyenleget
diff --git a/config/locales/views/email_confirmation_mailer/hu.yml b/config/locales/views/email_confirmation_mailer/hu.yml
new file mode 100644
index 000000000..f78f41665
--- /dev/null
+++ b/config/locales/views/email_confirmation_mailer/hu.yml
@@ -0,0 +1,9 @@
+---
+hu:
+  email_confirmation_mailer:
+    confirmation_email:
+      body: Nemrég kérted az e-mail címed megváltoztatását. Kattints az alábbi gombra a változtatás megerősítéséhez.
+      cta: E-mail-változtatás megerősítése
+      expiry_notice: Ez a link %{hours} óra múlva lejár.
+      greeting: Szia!
+      subject: '%{product_name}: E-mail-változtatás megerősítése'
diff --git a/config/locales/views/enable_banking_items/ca.yml b/config/locales/views/enable_banking_items/ca.yml
index a2ee3c9bf..432240782 100644
--- a/config/locales/views/enable_banking_items/ca.yml
+++ b/config/locales/views/enable_banking_items/ca.yml
@@ -2,52 +2,131 @@
 ca:
   enable_banking_items:
     authorize:
-      authorization_failed: No s'ha pogut iniciar l'autorització
-      bank_required: Si us plau, selecciona un banc.
-      invalid_redirect: L'URL d'autorització rebuta no és vàlida. Si us plau, torna-ho
-        a provar o contacta amb l'assistència.
-      redirect_uri_not_allowed: Redirecció no permesa. Si us plau, configura `%{callback_url}`
-        a la configuració de l'aplicació Enable Banking.
-      unexpected_error: S'ha produït un error inesperat. Si us plau, torna-ho a provar.
+      authorization_failed: 'No s''ha pogut iniciar l''autorització: %{message}'
+      bank_required: Selecciona un banc.
+      decoupled_not_supported: Aquest banc utilitza un mètode d'autenticació amb dispositiu
+        separat que encara no està admès. Afegeix aquest compte manualment.
+      invalid_redirect: L'URL d'autorització rebuda no és vàlida. Torna-ho a provar.
+      redirect_uri_not_allowed: Redirecció no permesa. Configura `%{callback_url}`
+        a la configuració de la teva aplicació Enable Banking.
+      unexpected_error: S'ha produït un error inesperat. Torna-ho a provar.
     callback:
       authorization_error: L'autorització ha fallat
       invalid_callback: Paràmetres de callback no vàlids.
       item_not_found: Connexió no trobada.
       session_failed: No s'ha pogut completar l'autorització
-      success: S'ha connectat correctament amb el teu banc. Les teves comptes s'estan sincronitzant.
-      unexpected_error: S'ha produït un error inesperat. Si us plau, torna-ho a provar.
+      success: T'has connectat correctament al teu banc. Els teus comptes s'estan
+        sincronitzant.
+      unexpected_error: S'ha produït un error inesperat. Torna-ho a provar.
     complete_account_setup:
-      all_skipped: S'han omès tots els comptes. Pots configurar-los més tard a la pàgina
-        de comptes.
+      all_skipped: S'han omès tots els comptes. Pots configurar-los més tard a la
+        pàgina de comptes.
       no_accounts: No hi ha comptes disponibles per configurar.
       success: S'han creat correctament %{count} comptes!
     create:
       success: La configuració d'Enable Banking s'ha fet amb èxit.
     destroy:
       success: La connexió d'Enable Banking s'ha posat a la cua per a l'eliminació.
+    enable_banking_item:
+      delete: Elimina
+      deletion_in_progress: Eliminació en curs
+      last_synced: Darrera sincronització fa %{time}
+      never_synced: Mai sincronitzat
+      no_accounts_found: No s'han trobat comptes
+      no_accounts_found_description: No s'han trobat comptes a Enable Banking. Torna
+        a sincronitzar.
+      provider_name: Enable Banking
+      reconnect: Reconnecta
+      set_up_accounts: Configura comptes
+      setup_needed: Cal configuració
+      setup_needed_description:
+        one: 1 compte importat d'Enable Banking necessita configuració
+        other: "%{count} comptes importats d'Enable Banking necessiten configuració"
+      syncing: Sincronitzant...
+      update: Actualitza
+    errors:
+      api_error: S'ha produït un error de comunicació amb el banc.
+      network_unreachable: El servei bancari està temporalment inaccessible. Torna-ho
+        a provar més tard.
+      session_invalid: La sessió ha caducat. Torna a connectar el teu banc.
+      unexpected: S'ha produït un error inesperat durant la sincronització.
     link_accounts:
-      already_linked: Els comptes seleccionats ja estan vinculats.
-      link_failed: No s'ha pogut vincular els comptes
+      already_linked: Els comptes seleccionats ja estan enllaçats.
+      link_failed: No s'han pogut enllaçar els comptes
       no_accounts_selected: No s'han seleccionat comptes.
-      no_session: No hi ha connexió activa d'Enable Banking. Si us plau, connecta't a un banc primer.
-      success: S'han vinculat correctament %{count} comptes.
+      no_session: No hi ha cap connexió activa d'Enable Banking. Primer connecta't
+        a un banc.
+      success: S'han enllaçat correctament %{count} comptes.
     link_existing_account:
       errors:
-        invalid_enable_banking_account: S'ha seleccionat un compte d'Enable Banking no vàlid
-        only_manual: Només es poden vincular comptes manuals
-      success: Compte vinculat correctament a Enable Banking
+        invalid_enable_banking_account: S'ha seleccionat un compte d'Enable Banking
+          no vàlid
+        only_manual: Només els comptes manuals es poden enllaçar
+      success: El compte s'ha enllaçat correctament a Enable Banking
     new:
-      link_enable_banking_title: Vincula Enable Banking
+      add_connection: Afegeix connexió
+      configured: Configurat
+      connect_bank: Connecta el banc
+      connected_bank: Banc connectat
+      connection: Connexió
+      go_to_provider_settings: Ves a la configuració del proveïdor
+      link_enable_banking_title: Enllaça Enable Banking
+      not_configured: Connexió d'Enable Banking no configurada
+      not_configured_description: Abans d'enllaçar comptes d'Enable Banking, has de
+        configurar la teva connexió d'Enable Banking.
+      ready_to_connect: A punt per connectar un banc
+      reconnect: Reconnecta
+      remove: Elimina
+      remove_confirm: Segur que vols eliminar aquesta connexió?
+      session_expired: La sessió ha caducat — cal tornar a autoritzar
+      session_expires: La sessió caduca
+      setup_step_1_html: Ves a <strong>Configuració → Proveïdors</strong>
+      setup_step_2_html: Localitza la secció <strong>Enable Banking</strong>
+      setup_step_3: Introdueix les teves credencials d'Enable Banking
+      setup_step_4: Torna aquí per enllaçar els teus comptes
+      setup_steps_title: 'Passos de configuració:'
+      sync: Sincronitza
+      unknown: Desconegut
     reauthorize:
-      invalid_redirect: L'URL d'autorització rebuta no és vàlida. Si us plau, torna-ho
-        a provar o contacta amb l'assistència.
+      invalid_redirect: L'URL d'autorització rebuda no és vàlida. Torna-ho a provar.
       reauthorization_failed: La reautorització ha fallat
     select_bank:
+      beta_label: Beta
       cancel: Cancel·la
-      check_country: Si us plau, revisa els teus codis de país.
-      credentials_required: Si us plau, configura les teves credencials d'Enable Banking primer.
+      check_country: Revisa la configuració del codi de país.
+      credentials_required: Primer configura les teves credencials d'Enable Banking.
       description: Selecciona el banc al qual vols connectar els teus comptes.
-      no_banks: No hi ha bancs disponibles per aquest país/regió.
+      no_banks: No hi ha bancs disponibles per a aquest país/regió.
+      no_search_results: Cap banc coincideix amb la teva cerca.
+      search_label: Cerca el teu banc
+      search_placeholder: Cerca el teu banc...
       title: Selecciona el teu banc
+    select_existing_account:
+      all_linked: Sembla que tots els comptes d'Enable Banking ja estan enllaçats.
+      balance: Saldo
+      cancel: Cancel·la
+      link: Enllaça
+      title: Enllaça compte d'Enable Banking
+      try_after_sync: Si acabes de connectar o sincronitzar, torna-ho a provar després
+        que la sincronització acabi.
+      unlink_to_move: Per enllaçar un compte diferent, primer desenllaça'l del menú
+        d'accions del compte.
+    setup_accounts:
+      account_type_label: 'Tipus de compte:'
+      balance: Saldo
+      cancel: Cancel·la
+      choose_account_type: 'Tria el tipus de compte correcte per a cada compte d''Enable
+        Banking:'
+      create_accounts: Crea comptes
+      creating_accounts: Creant comptes...
+      header_subtitle: Tria els tipus de compte correctes per als teus comptes importats
+      historical_data_range: 'Rang de dades històriques:'
+      psd2_savings_notice: 'Nota: alguns comptes d''estalvi regulats francesos (Livret
+        A, PEL, LEP, LDDS) tenen accés limitat o nul a través de l''Open Banking (PSD2).
+        Si manca un compte d''estalvi, pots afegir-lo manualment.'
+      sync_start_date_help: Selecciona fins on vols sincronitzar l'historial de transaccions.
+        Hi ha un màxim de 2 anys d'historial disponible.
+      sync_start_date_label: 'Comença a sincronitzar transaccions des de:'
+      title: Configura els teus comptes d'Enable Banking
     update:
       success: La configuració d'Enable Banking s'ha actualitzat.
diff --git a/config/locales/views/enable_banking_items/en.yml b/config/locales/views/enable_banking_items/en.yml
index dfbcd8501..ab6061433 100644
--- a/config/locales/views/enable_banking_items/en.yml
+++ b/config/locales/views/enable_banking_items/en.yml
@@ -1,9 +1,15 @@
 ---
 en:
   enable_banking_items:
+    errors:
+      api_error: "A communication error occurred with the bank."
+      network_unreachable: "The banking service is temporarily unreachable. Please try again later."
+      session_invalid: "Session expired. Please reconnect your bank."
+      unexpected: "An unexpected error occurred during synchronization."
     authorize:
-      authorization_failed: Failed to initiate authorization
+      authorization_failed: "Failed to initiate authorization: %{message}"
       bank_required: Please select a bank.
+      decoupled_not_supported: This bank uses a separate device authentication method which is not yet supported. Please add this account manually.
       invalid_redirect: The authorization URL received is invalid. Please try again.
       redirect_uri_not_allowed: Redirect not allowed. Please configure `%{callback_url}` in your Enable Banking app settings.
       unexpected_error: An unexpected error occurred. Please try again.
@@ -33,17 +39,78 @@ en:
       errors:
         only_manual: Only manual accounts can be linked
         invalid_enable_banking_account: Invalid Enable Banking account selected
+    enable_banking_item:
+      deletion_in_progress: Deletion in progress
+      provider_name: Enable Banking
+      syncing: Syncing...
+      reconnect: Reconnect
+      last_synced: Last synced %{time} ago
+      never_synced: Never synced
+      update: Update
+      delete: Delete
+      setup_needed: Setup needed
+      setup_needed_description:
+        one: 1 account imported from Enable Banking needs to be set up
+        other: "%{count} accounts imported from Enable Banking need to be set up"
+      set_up_accounts: Set up accounts
+      no_accounts_found: No accounts found
+      no_accounts_found_description: No accounts were found from Enable Banking. Try syncing again.
+    select_existing_account:
+      title: Link Enable Banking account
+      all_linked: All Enable Banking accounts appear to be linked already.
+      try_after_sync: If you just connected or synced, try again after the sync completes.
+      unlink_to_move: To link a different account, first unlink it from the account's actions menu.
+      balance: Balance
+      link: Link
+      cancel: Cancel
+    setup_accounts:
+      title: Set Up Your Enable Banking Accounts
+      header_subtitle: Choose the correct account types for your imported accounts
+      choose_account_type: "Choose the correct account type for each Enable Banking account:"
+      historical_data_range: "Historical Data Range:"
+      sync_start_date_label: "Start syncing transactions from:"
+      sync_start_date_help: Select how far back you want to sync transaction history. Maximum 2 years of history available.
+      account_type_label: "Account Type:"
+      balance: Balance
+      create_accounts: Create Accounts
+      creating_accounts: Creating Accounts...
+      cancel: Cancel
     new:
       link_enable_banking_title: Link Enable Banking
+      session_expired: Session expired - re-authorization required
+      connected_bank: Connected Bank
+      session_expires: "Session expires"
+      unknown: Unknown
+      connection: Connection
+      configured: Configured
+      ready_to_connect: Ready to connect a bank
+      sync: Sync
+      reconnect: Reconnect
+      connect_bank: Connect Bank
+      remove_confirm: Are you sure you want to remove this connection?
+      remove: Remove
+      add_connection: Add Connection
+      not_configured: Enable Banking connection not configured
+      not_configured_description: Before you can link Enable Banking accounts, you need to configure your Enable Banking connection.
+      setup_steps_title: "Setup Steps:"
+      setup_step_1_html: "Go to <strong>Settings → Providers</strong>"
+      setup_step_2_html: "Find the <strong>Enable Banking</strong> section"
+      setup_step_3: Enter your Enable Banking credentials
+      setup_step_4: Return here to link your accounts
+      go_to_provider_settings: Go to Provider Settings
     reauthorize:
       invalid_redirect: The authorization URL received is invalid. Please try again.
       reauthorization_failed: Reauthorization failed
     select_bank:
+      beta_label: Beta
       cancel: Cancel
       check_country: Please check your country code settings.
       credentials_required: Please configure your Enable Banking credentials first.
       description: Select the bank you want to connect to your accounts.
       no_banks: No banks available for this country/region.
+      no_search_results: No banks match your search.
+      search_label: Search for your bank
+      search_placeholder: Search for your bank...
       title: Select Your Bank
     update:
       success: Enable Banking configuration updated.
diff --git a/config/locales/views/enable_banking_items/fr.yml b/config/locales/views/enable_banking_items/fr.yml
index d4e3bccb0..1c6684aac 100644
--- a/config/locales/views/enable_banking_items/fr.yml
+++ b/config/locales/views/enable_banking_items/fr.yml
@@ -1,9 +1,15 @@
 ---
 fr:
   enable_banking_items:
+    errors:
+      api_error: "Erreur de communication avec la banque."
+      network_unreachable: "Le service bancaire est temporairement injoignable. Veuillez réessayer plus tard."
+      session_invalid: "Session expirée. Veuillez reconnecter votre banque."
+      unexpected: "Une erreur inattendue est survenue lors de la synchronisation."
     authorize:
       authorization_failed: Échec de l'initiation de l'autorisation
       bank_required: Veuillez sélectionner une banque.
+      decoupled_not_supported: Cette banque utilise une méthode d'authentification sur un appareil séparé qui n'est pas encore prise en charge. Veuillez ajouter ce compte manuellement.
       invalid_redirect: L'URL d'autorisation reçue est invalide. Veuillez réessayer.
       redirect_uri_not_allowed: Redirection non autorisée. Veuillez configurer `%{callback_url}` dans les paramètres de votre application Enable Banking.
       unexpected_error: Une erreur inattendue s'est produite. Veuillez réessayer.
@@ -39,11 +45,17 @@ fr:
       invalid_redirect: L'URL d'autorisation reçue est invalide. Veuillez réessayer.
       reauthorization_failed: Échec de la réautorisation
     select_bank:
+      beta_label: Bêta
       cancel: Annuler
       check_country: Veuillez vérifier les paramètres de votre code pays.
       credentials_required: Veuillez d'abord configurer vos identifiants Enable Banking.
       description: Sélectionnez la banque que vous souhaitez connecter à vos comptes.
       no_banks: Aucune banque disponible pour ce pays/région.
+      no_search_results: "Aucun établissement ne correspond à votre recherche."
+      search_placeholder: Recherchez votre banque...
+      search_label: "Rechercher votre banque"
       title: Sélectionnez votre banque
+    setup_accounts:
+      psd2_savings_notice: "Remarque : Certains comptes d'épargne réglementés français (Livret A, PEL, LEP, LDDS) peuvent avoir un accès limité ou inexistant via l'Open Banking (DSP2). Si un compte d'épargne est manquant, vous pouvez l'ajouter manuellement."
     update:
       success: Configuration d'Enable Banking mise à jour.
diff --git a/config/locales/views/enable_banking_items/hu.yml b/config/locales/views/enable_banking_items/hu.yml
new file mode 100644
index 000000000..79a3282f0
--- /dev/null
+++ b/config/locales/views/enable_banking_items/hu.yml
@@ -0,0 +1,117 @@
+---
+hu:
+  enable_banking_items:
+    errors:
+      api_error: "Kommunikációs hiba lépett fel a bankkal."
+      network_unreachable: "A banki szolgáltatás átmenetileg nem érhető el. Kérjük, próbáld újra később."
+      session_invalid: "A munkamenet lejárt. Kérjük, csatlakoztasd újra a bankod."
+      unexpected: "Váratlan hiba történt a szinkronizálás során."
+    authorize:
+      authorization_failed: "Nem sikerült elindítani az engedélyezést: %{message}"
+      bank_required: Kérjük, válassz bankot.
+      decoupled_not_supported: Ez a bank egy különálló eszközös hitelesítési módszert használ, amely jelenleg nem támogatott. Kérjük, add hozzá ezt a számlát manuálisan.
+      invalid_redirect: A kapott engedélyezési URL érvénytelen. Kérjük, próbáld újra.
+      redirect_uri_not_allowed: Az átirányítás nem engedélyezett. Kérjük, konfiguráld a `%{callback_url}` címet az Enable Banking alkalmazás beállításaiban.
+      unexpected_error: Váratlan hiba történt. Kérjük, próbáld újra.
+    callback:
+      authorization_error: Az engedélyezés sikertelen
+      invalid_callback: Érvénytelen visszahívási paraméterek.
+      item_not_found: A kapcsolat nem található.
+      session_failed: Az engedélyezés nem sikerült befejezni
+      success: Sikeresen csatlakoztál a bankodhoz. A számlák szinkronizálódnak.
+      unexpected_error: Váratlan hiba történt. Kérjük, próbáld újra.
+    complete_account_setup:
+      all_skipped: Minden számla ki lett hagyva. Beállíthatod őket később a számlák oldalon.
+      no_accounts: Nincs elérhető beállítandó számla.
+      success: Sikeresen létrehozva %{count} számla!
+    create:
+      success: Az Enable Banking konfigurálása sikeres.
+    destroy:
+      success: Az Enable Banking kapcsolat törlési sorba került.
+    link_accounts:
+      already_linked: A kiválasztott számlák már össze vannak kapcsolva.
+      link_failed: A számlák összekapcsolása sikertelen
+      no_accounts_selected: Nincs kiválasztott számla.
+      no_session: Nincs aktív Enable Banking kapcsolat. Kérjük, először csatlakozz egy bankhoz.
+      success: Sikeresen összekapcsolva %{count} számla.
+    link_existing_account:
+      success: A számla sikeresen össze lett kapcsolva az Enable Banking-gel
+      errors:
+        only_manual: Csak manuális számlákat lehet összekapcsolni
+        invalid_enable_banking_account: Érvénytelen Enable Banking-számla választva
+    enable_banking_item:
+      deletion_in_progress: Törlés folyamatban
+      provider_name: Enable Banking
+      syncing: Szinkronizálás...
+      reconnect: Újracsatlakozás
+      last_synced: Utoljára szinkronizálva %{time} ezelőtt
+      never_synced: Még nem szinkronizált
+      update: Frissítés
+      delete: Törlés
+      setup_needed: Beállítás szükséges
+      setup_needed_description:
+        one: 1 Enable Banking-ből importált számla beállítása szükséges
+        other: "%{count} Enable Banking-ből importált számla beállítása szükséges"
+      set_up_accounts: Számlák beállítása
+      no_accounts_found: Nem található számla
+      no_accounts_found_description: Nem található számla az Enable Banking-ből. Próbálj újra szinkronizálni.
+    select_existing_account:
+      title: Enable Banking-számla összekapcsolása
+      all_linked: Úgy tűnik, minden Enable Banking-számla már össze van kapcsolva.
+      try_after_sync: Ha most csatlakoztál vagy szinkronizáltál, próbálj újra a szinkronizálás befejezése után.
+      unlink_to_move: Másik számla összekapcsolásához először válaszd le a számlán a műveletek menüből.
+      balance: Egyenleg
+      link: Összekapcsolás
+      cancel: Mégse
+    new:
+      link_enable_banking_title: Enable Banking összekapcsolása
+      session_expired: A munkamenet lejárt – újraengedélyezés szükséges
+      connected_bank: Csatlakoztatott bank
+      session_expires: "Munkamenet lejárata"
+      unknown: Ismeretlen
+      connection: Kapcsolat
+      configured: Konfigurálva
+      ready_to_connect: Kész egy bank csatlakoztatására
+      sync: Szinkronizálás
+      reconnect: Újracsatlakozás
+      connect_bank: Bank csatlakoztatása
+      remove_confirm: Biztosan el szeretnéd távolítani ezt a kapcsolatot?
+      remove: Eltávolítás
+      add_connection: Kapcsolat hozzáadása
+      not_configured: Az Enable Banking kapcsolat nincs konfigurálva
+      not_configured_description: Mielőtt Enable Banking-számlákat kapcsolnál össze, konfigurálnod kell az Enable Banking kapcsolatot.
+      setup_steps_title: "Beállítási lépések:"
+      setup_step_1_html: "Menj a <strong>Beállítások → Szolgáltatók</strong> menübe"
+      setup_step_2_html: "Keresd meg az <strong>Enable Banking</strong> részt"
+      setup_step_3: Add meg az Enable Banking hitelesítő adatait
+      setup_step_4: Térj vissza ide a számlák összekapcsolásához
+      go_to_provider_settings: Ugrás a szolgáltató beállításaihoz
+    reauthorize:
+      invalid_redirect: A kapott engedélyezési URL érvénytelen. Kérjük, próbáld újra.
+      reauthorization_failed: Az újraengedélyezés sikertelen
+    select_bank:
+      beta_label: Béta
+      cancel: Mégse
+      check_country: Kérjük, ellenőrizd az országkód beállításait.
+      credentials_required: Kérjük, először konfiguráld az Enable Banking hitelesítő adatait.
+      description: Válaszd ki azt a bankot, amelyet össze szeretnél kapcsolni a számlákkal.
+      no_banks: Nem érhető el bank ehhez az országhoz/régióhoz.
+      no_search_results: Nincs a keresésnek megfelelő bank.
+      search_label: Keresd meg a bankod
+      search_placeholder: Keresd meg a bankod...
+      title: Válaszd ki a bankod
+    setup_accounts:
+      title: Enable Banking-számlák beállítása
+      header_subtitle: Válaszd ki a megfelelő számlatípusokat az importált számlákhoz
+      choose_account_type: "Válaszd ki az egyes Enable Banking-számlák megfelelő számlatípusát:"
+      historical_data_range: "Historikus adatok tartománya:"
+      sync_start_date_label: "Tranzakciók szinkronizálásának kezdete:"
+      sync_start_date_help: Válaszd meg, milyen messzire nyúljon vissza a tranzakciótörténet szinkronizálása. Legfeljebb 2 év előzmény érhető el.
+      account_type_label: "Számlatípus:"
+      balance: Egyenleg
+      create_accounts: Számlák létrehozása
+      creating_accounts: Számlák létrehozása...
+      cancel: Mégse
+      psd2_savings_notice: "Megjegyzés: Egyes szabályozott francia megtakarítási számlákhoz (Livret A, PEL, LEP, LDDS) korlátozott vagy semmilyen hozzáférés nem áll rendelkezésre az Open Banking (PSD2) révén. Ha egy megtakarítási számla hiányzik, manuálisan is hozzáadhatod."
+    update:
+      success: Az Enable Banking konfiguráció frissítve.
diff --git a/config/locales/views/entries/ca.yml b/config/locales/views/entries/ca.yml
index 4ece9e3aa..5e9e0d459 100644
--- a/config/locales/views/entries/ca.yml
+++ b/config/locales/views/entries/ca.yml
@@ -10,5 +10,16 @@ ca:
       title: No s'han trobat entrades
     loading:
       loading: Carregant entrades...
+    protection:
+      description: Les teves edicions a aquesta entrada no se sobreescriuran amb la
+        sincronització del proveïdor.
+      locked_fields_label: 'Camps bloquejats:'
+      title: Protegida de la sincronització
+      tooltip: Protegida de la sincronització
+      unlock_button: Permet que la sincronització l'actualitzi
+      unlock_confirm: Vols permetre que la sincronització actualitzi aquesta entrada?
+        Els teus canvis es poden sobreescriure a la pròxima sincronització.
+    unlock:
+      success: Entrada desbloquejada. Pot ser actualitzada a la pròxima sincronització.
     update:
       success: Entrada actualitzada
diff --git a/config/locales/views/entries/fr.yml b/config/locales/views/entries/fr.yml
index 7f8c0d492..9130dcba3 100644
--- a/config/locales/views/entries/fr.yml
+++ b/config/locales/views/entries/fr.yml
@@ -12,3 +12,12 @@ fr:
       loading: Chargement des entrées...
     update:
       success: Entrée mise à jour
+    unlock:
+      success: Entrée déverrouillée. Elle pourra être mise à jour lors de la prochaine synchronisation.
+    protection:
+      tooltip: Protégée contre la synchronisation
+      title: Protégée contre la synchronisation
+      description: Vos modifications sur cette entrée ne seront pas écrasées par la synchronisation du fournisseur.
+      locked_fields_label: "Champs verrouillés :"
+      unlock_button: Autoriser la mise à jour par la synchronisation
+      unlock_confirm: Autoriser la synchronisation à mettre à jour cette entrée ? Vos modifications pourraient être écrasées lors de la prochaine synchronisation.
diff --git a/config/locales/views/entries/hu.yml b/config/locales/views/entries/hu.yml
new file mode 100644
index 000000000..8b704a630
--- /dev/null
+++ b/config/locales/views/entries/hu.yml
@@ -0,0 +1,23 @@
+---
+hu:
+  entries:
+    create:
+      success: Bejegyzés létrehozva
+    destroy:
+      success: Bejegyzés törölve
+    empty:
+      description: Próbálj meg bejegyzést hozzáadni, szűrőket módosítani vagy finomítani a kereséseden
+      title: Nem található bejegyzés
+    loading:
+      loading: Bejegyzések betöltése...
+    update:
+      success: Bejegyzés frissítve
+    unlock:
+      success: Bejegyzés feloldva. A következő szinkronizálásnál frissülhet.
+    protection:
+      tooltip: Szinkronizálástól védve
+      title: Szinkronizálástól védve
+      description: A bejegyzésen végzett módosításaidat nem írja felül a szolgáltató szinkronizálása.
+      locked_fields_label: "Zárolt mezők:"
+      unlock_button: Szinkronizálás engedélyezése a frissítéshez
+      unlock_confirm: Engedélyezed a szinkronizálásnak, hogy frissítse ezt a bejegyzést? A módosításaid felülíródhatnak a következő szinkronizáláskor.
diff --git a/config/locales/views/family_exports/ca.yml b/config/locales/views/family_exports/ca.yml
index 9056ea5c6..04a517f20 100644
--- a/config/locales/views/family_exports/ca.yml
+++ b/config/locales/views/family_exports/ca.yml
@@ -3,29 +3,46 @@ ca:
   family_exports:
     access_denied: Accés denegat
     create:
-      success: Exportació iniciada. Podràs descarregar-la aviat.
-    delete_confirmation: Estàs segur que vols eliminar aquesta exportació? Aquesta acció no es pot desfer.
-    delete_failed_confirmation: Estàs segur que vols eliminar aquesta exportació fallida?
+      success: Exportació iniciada. La podràs descarregar aviat.
+    delete_confirmation: Segur que vols eliminar aquesta exportació? Aquesta acció
+      no es pot desfer.
+    delete_failed_confirmation: Segur que vols eliminar aquesta exportació fallida?
     destroy:
-      success: Exportació eliminada amb èxit
-    export_not_ready: L'exportació no està llesta per descarregar
+      success: Exportació eliminada correctament
+    export_not_ready: L'exportació no està a punt per descarregar
     exporting: Exportant...
     index:
-      title: Exportacions
       new: Nova exportació
-    table:
       title: Exportacions
+    new:
+      accounts_and_balances: Tots els comptes i saldos
+      cancel: Cancel·la
+      categories_tags_rules: Categories, etiquetes i regles
+      dialog_subtitle: Descarrega totes les teves dades financeres
+      dialog_title: Exporta les teves dades
+      export_data: Exporta les dades
+      investment_trades: Operacions d'inversió
+      note_description: Aquesta exportació inclou totes les teves dades, però només
+        se'n pot importar de nou una part mitjançant la funció d'importació CSV. Donem
+        suport a la importació de comptes, transaccions (amb categoria i etiquetes)
+        i operacions. La resta de dades del compte no es poden importar i són només
+        per als teus registres.
+      note_label: Nota
+      transaction_history: Historial de transaccions
+      whats_included: 'Què s''inclou:'
+    table:
+      empty: Encara no hi ha exportacions.
       header:
+        actions: Accions
         date: Data
         filename: Nom del fitxer
         status: Estat
-        actions: Accions
       row:
-        status:
-          in_progress: En curs
-          complete: Completat
-          failed: Error
         actions:
           delete: Elimina
-          download: Descarregar
-      empty: Encara no hi ha exportacions.
+          download: Descarrega
+        status:
+          complete: Completat
+          failed: Error
+          in_progress: En curs
+      title: Exportacions
diff --git a/config/locales/views/family_exports/en.yml b/config/locales/views/family_exports/en.yml
index 7b0d8b08d..f81c29b49 100644
--- a/config/locales/views/family_exports/en.yml
+++ b/config/locales/views/family_exports/en.yml
@@ -10,6 +10,18 @@ en:
       success: Export deleted successfully
     export_not_ready: Export not ready for download
     exporting: Exporting...
+    new:
+      dialog_title: Export your data
+      dialog_subtitle: Download all your financial data
+      whats_included: "What's included:"
+      accounts_and_balances: All accounts and balances
+      transaction_history: Transaction history
+      investment_trades: Investment trades
+      categories_tags_rules: Categories, tags and rules
+      note_label: Note
+      note_description: This export includes all of your data, but only some of the data can be imported back via the CSV import feature. We support account, transaction (with category and tags), and trade imports. Other account data cannot be imported and is for your records only.
+      cancel: Cancel
+      export_data: Export data
     index:
       title: Exports
       new: New Export
diff --git a/config/locales/views/family_exports/hu.yml b/config/locales/views/family_exports/hu.yml
new file mode 100644
index 000000000..35f49accb
--- /dev/null
+++ b/config/locales/views/family_exports/hu.yml
@@ -0,0 +1,43 @@
+---
+hu:
+  family_exports:
+    access_denied: Hozzáférés megtagadva
+    create:
+      success: Az exportálás elindult. Hamarosan letöltheted.
+    delete_confirmation: Biztosan törlöd ezt az exportot? Ez a művelet nem vonható vissza.
+    delete_failed_confirmation: Biztosan törlöd ezt a sikertelen exportot?
+    destroy:
+      success: Az export sikeresen törölve
+    export_not_ready: Az export még nem áll készen a letöltésre
+    exporting: Exportálás folyamatban...
+    new:
+      dialog_title: Adataid exportálása
+      dialog_subtitle: Töltsd le az összes pénzügyi adatodat
+      whats_included: "Mi kerül bele:"
+      accounts_and_balances: Összes számla és egyenleg
+      transaction_history: Tranzakciótörténet
+      investment_trades: Befektetési ügyletek
+      categories_tags_rules: Kategóriák, címkék és szabályok
+      note_label: Megjegyzés
+      note_description: Ez az export tartalmazza az összes adatodat, de csak egy részük importálható vissza a CSV importálás funkcióval. Számlák, tranzakciók (kategóriával és címkékkel) és kereskedések importálása támogatott. Más számlaadat nem importálható, csak nyilvántartás céljából szerepel.
+      cancel: Mégse
+      export_data: Adatok exportálása
+    index:
+      title: Exportok
+      new: Új export
+    table:
+      title: Exportok
+      header:
+        date: Dátum
+        filename: Fájlnév
+        status: Állapot
+        actions: Műveletek
+      row:
+        status:
+          in_progress: Folyamatban
+          complete: Kész
+          failed: Sikertelen
+        actions:
+          delete: Törlés
+          download: Letöltés
+      empty: Még nincsenek exportok.
diff --git a/config/locales/views/holdings/ca.yml b/config/locales/views/holdings/ca.yml
index ea6b8e0dd..899da5016 100644
--- a/config/locales/views/holdings/ca.yml
+++ b/config/locales/views/holdings/ca.yml
@@ -2,23 +2,28 @@
 ca:
   holdings:
     cash:
-      brokerage_cash: Efectiu de broker
+      brokerage_cash: Efectiu del broker
     cost_basis_cell:
       cancel: Cancel·la
-      or_per_share_label: 'O entra per acció:'
+      or_per_share_label: 'O introdueix per acció:'
       overwrite_confirm_body: Això reemplaçarà el cost base actual de %{current}.
       overwrite_confirm_title: Reemplaça el cost base?
       per_share: per acció
       save: Desa
-      set_cost_basis_header: Estableix el cost base per %{ticker} (%{qty} accions)
+      set: Estableix
+      set_cost_basis_header: Estableix el cost base per a %{ticker} (%{qty} accions)
       total_cost_basis_label: Cost base total
       unknown: "--"
     cost_basis_sources:
-      calculated: Des de les operacions
+      calculated: A partir de les operacions
       manual: Establert per l'usuari
-      provider: Des del proveïdor
+      provider: Del proveïdor
     destroy:
+      cannot_delete: No pots eliminar aquesta posició
       success: Posició eliminada
+    errors:
+      security_collision: 'No es pot reassignar: ja tens una posició per a %{ticker}
+        a %{date}.'
     holding:
       no_cost_basis: Sense cost base
       per_share: per acció
@@ -28,38 +33,84 @@ ca:
       average_cost: Cost mitjà
       holdings: Posicions
       name: Nom
-      new_holding: Nova transacció
+      new_holding: Nova activitat
       no_holdings: No hi ha posicions per mostrar.
       return: Rendiment total
       weight: Pes
     missing_price_tooltip:
-      description: Aquesta inversió té valors que falten i no hem pogut calcular-ne
-        el rendiment o el valor.
+      description: Aquesta inversió té valors que falten i no se n'han pogut calcular
+        el rendiment ni el valor.
       missing_data: Falten dades
+    remap_security:
+      security_not_found: No s'ha pogut trobar el valor seleccionat.
+      success: Valor actualitzat correctament.
+    reset_security:
+      success: Valor restablert al del proveïdor.
     show:
       avg_cost_label: Cost mitjà
-      cost_basis_locked_description: El cost base establert manualment no canviarà
+      book_value_label: Valor comptable
+      cancel: Cancel·la
+      cost_basis_locked_description: El cost base establert manualment no es modificarà
         amb les sincronitzacions.
       cost_basis_locked_label: El cost base està bloquejat
       current_market_price_label: Preu de mercat actual
       delete: Elimina
       delete_subtitle: Això eliminarà la posició i totes les operacions associades
         d'aquest compte. Aquesta acció no es pot desfer.
-      delete_title: Elimina posició
+      delete_title: Elimina la posició
+      edit_security: Edita el valor
       history: Historial
+      last_price_update: Última actualització de preu
+      market_data_label: Dades de mercat
+      market_data_sync_button: Actualitza
+      market_value_label: Valor de mercat
+      never: Mai
+      no_security_provider: Proveïdor de valors no configurat. No es poden cercar
+        valors.
+      no_trade_history: No hi ha historial d'operacions per a aquesta posició.
+      originally: era %{ticker}
       overview: Resum
-      portfolio_weight_label: Pes al portafolis
+      portfolio_weight_label: Pes a la cartera
+      provider_disabled_warning: Actualitzacions de preu en pausa — el proveïdor %{provider}
+        està desactivat. Canvia a un altre proveïdor o torna'l a activar a Configuració.
+      provider_sent: 'El proveïdor ha enviat: %{ticker}'
+      remap_security: Desa
+      reset_confirm_body: Això canviarà el valor de %{current} a %{original} i mourà
+        totes les operacions associades.
+      reset_confirm_title: Restablir el valor al del proveïdor?
+      reset_to_provider: Restableix al del proveïdor
+      search_security: Cerca valor
+      search_security_placeholder: Cerca per símbol o nom
+      security_label: Valor
+      security_remapped_label: Valor reassignat
       settings: Configuració
-      ticker_label: Ticker
+      shares_label: Accions
+      switch_provider_button: Canvia
+      switch_provider_description: "%{provider} està desactivat. Cerca aquest valor
+        en un altre proveïdor activat."
+      switch_provider_label: Canvia de proveïdor
+      syncing: Sincronitzant...
+      ticker_label: Símbol
       total_return_label: Rendiment total
       trade_history_entry: "%{qty} accions de %{security} a %{price}"
+      truncated_history_warning: L'historial de preus només està disponible a partir
+        del %{date}. Les dates anteriors no tenen dades del proveïdor seleccionat
+        — això pot passar quan l'actiu es va llistar després de la data de l'operació,
+        o quan el proveïdor només ofereix una finestra històrica limitada al seu pla
+        actual.
       unknown: Desconegut
-      unlock_confirm_body: Això permetrà que el cost base s'actualitzi per sincronitzacions
-        del proveïdor o càlculs d'operacions.
-      unlock_confirm_title: Desbloqueja el cost base?
+      unlock_confirm_body: Això permetrà que el cost base s'actualitzi per les sincronitzacions
+        del proveïdor o pels càlculs d'operacions.
+      unlock_confirm_title: Desbloquejar el cost base?
       unlock_cost_basis: Desbloqueja
+    sync_prices:
+      provider_error: No s'han pogut obtenir els preus més recents. Torna-ho a provar
+        d'aquí a uns minuts.
+      success: Dades de mercat sincronitzades correctament.
+      unavailable: La sincronització de dades de mercat no està disponible per a valors
+        sense connexió.
     unlock_cost_basis:
-      success: El cost base s'ha desbloquejat. Pot actualitzar-se en la següent sincronització.
+      success: Cost base desbloquejat. Pot actualitzar-se a la propera sincronització.
     update:
       error: Valor de cost base no vàlid.
       success: Cost base desat.
diff --git a/config/locales/views/holdings/en.yml b/config/locales/views/holdings/en.yml
index 4fe40c9e6..824619c0a 100644
--- a/config/locales/views/holdings/en.yml
+++ b/config/locales/views/holdings/en.yml
@@ -5,6 +5,7 @@ en:
       brokerage_cash: Brokerage cash
     destroy:
       success: Holding deleted
+      cannot_delete: You cannot delete this holding
     update:
       success: Cost basis saved.
       error: Invalid cost basis value.
@@ -27,6 +28,7 @@ en:
       provider: From provider
     cost_basis_cell:
       unknown: "--"
+      set: Set
       set_cost_basis_header: "Set cost basis for %{ticker} (%{qty} shares)"
       total_cost_basis_label: Total cost basis
       or_per_share_label: "Or enter per share:"
@@ -71,6 +73,11 @@ en:
       search_security_placeholder: Search by ticker or name
       cancel: Cancel
       remap_security: Save
+      provider_disabled_warning: "Price updates paused — %{provider} provider is disabled. Switch to another provider below or re-enable it in Settings."
+      truncated_history_warning: "Price history is only available from %{date} onwards. Earlier dates have no data from the selected provider — this can happen when the asset was listed after your trade date, or when the provider only offers a limited historical window on its current plan."
+      switch_provider_label: Switch provider
+      switch_provider_description: "%{provider} is disabled. Search for this security from another enabled provider."
+      switch_provider_button: Switch
       no_security_provider: Security provider not configured. Cannot search for securities.
       security_remapped_label: Security remapped
       provider_sent: "Provider sent: %{ticker}"
diff --git a/config/locales/views/holdings/fr.yml b/config/locales/views/holdings/fr.yml
index 2959132a1..4d2c360d0 100644
--- a/config/locales/views/holdings/fr.yml
+++ b/config/locales/views/holdings/fr.yml
@@ -4,36 +4,97 @@ fr:
     cash:
       brokerage_cash: Liquidités de courtage
     destroy:
-      success: Position supprimée
+      success: Avoir supprimé
+    update:
+      success: Coût de revient enregistré.
+      error: Valeur de coût de revient invalide.
+    unlock_cost_basis:
+      success: Coût de revient déverrouillé. Il pourra être mis à jour lors de la prochaine synchronisation.
+    remap_security:
+      success: Titre mis à jour avec succès.
+      security_not_found: Impossible de trouver le titre sélectionné.
+    reset_security:
+      success: Titre réinitialisé à la valeur du fournisseur.
+    sync_prices:
+      success: Données de marché synchronisées avec succès.
+      unavailable: La synchronisation des données de marché n'est pas disponible pour les titres hors ligne.
+      provider_error: Impossible de récupérer les derniers cours. Veuillez réessayer dans quelques minutes.
+    errors:
+      security_collision: "Réaffectation impossible : vous avez déjà un avoir pour %{ticker} au %{date}."
+    cost_basis_sources:
+      manual: Défini par l'utilisateur
+      calculated: À partir des transactions boursières
+      provider: Depuis le fournisseur
+    cost_basis_cell:
+      unknown: "--"
+      set_cost_basis_header: "Définir le coût de revient pour %{ticker} (%{qty} actions)"
+      total_cost_basis_label: Coût de revient total
+      or_per_share_label: "Ou saisir par action :"
+      per_share: par action
+      cancel: Annuler
+      save: Enregistrer
+      overwrite_confirm_title: Écraser le coût de revient ?
+      overwrite_confirm_body: "Cela remplacera le coût de revient actuel de %{current}."
     holding:
       per_share: par action
       shares: "%{qty} actions"
+      unknown: "--"
+      no_cost_basis: Aucun coût de revient
     index:
       average_cost: Coût moyen
-      holdings: Positions
+      holdings: Avoirs
       name: Nom
-      new_holding: Nouvelle position
-      no_holdings: Aucune position à afficher.
+      new_holding: Nouvelle activité
+      no_holdings: Aucun avoir à afficher.
       return: Rendement total
       weight: Poids
     missing_price_tooltip:
       description: Cet investissement a des valeurs manquantes et nous ne pouvons pas calculer
-        son retour ou sa valeur.
+        son rendement ou sa valeur.
       missing_data: Données manquantes
     show:
       avg_cost_label: Coût moyen
       current_market_price_label: Prix de marché actuel
       delete: Supprimer
-      delete_subtitle: Cela supprimera la position et toutes vos opérations associées sur ce compte. Cette action ne peut pas être annulée.
-      delete_title: Supprimer la position
+      delete_subtitle: Cela supprimera l'avoir et toutes vos transactions boursières associées sur ce compte. Cette action ne peut pas être annulée.
+      delete_title: Supprimer l'avoir
+      edit_security: Modifier le titre
       history: Historique
+      no_trade_history: Aucun historique de transactions boursières disponible pour cet avoir.
       overview: Aperçu
       portfolio_weight_label: Poids du portefeuille
       settings: Paramètres
+      security_label: Titre
+      originally: "était %{ticker}"
+      search_security: Rechercher un titre
+      search_security_placeholder: Rechercher par ticker ou par nom
+      cancel: Annuler
+      remap_security: Enregistrer
+      provider_disabled_warning: "Mises à jour des cours en pause — le fournisseur %{provider} est désactivé. Passez à un autre fournisseur ci-dessous ou réactivez-le dans les Paramètres."
+      truncated_history_warning: "L'historique des cours n'est disponible qu'à partir du %{date}. Les dates antérieures ne disposent d'aucune donnée du fournisseur sélectionné — cela peut se produire lorsque l'actif a été coté après la date de votre transaction boursière, ou lorsque le fournisseur n'offre qu'une fenêtre historique limitée avec son forfait actuel."
+      switch_provider_label: Changer de fournisseur
+      switch_provider_description: "%{provider} est désactivé. Recherchez ce titre auprès d'un autre fournisseur activé."
+      switch_provider_button: Changer
+      no_security_provider: Aucun fournisseur de titres configuré. Impossible de rechercher des titres.
+      security_remapped_label: Titre réaffecté
+      provider_sent: "Envoyé par le fournisseur : %{ticker}"
+      reset_to_provider: Réinitialiser au fournisseur
+      reset_confirm_title: Réinitialiser le titre au fournisseur ?
+      reset_confirm_body: "Cela changera le titre de %{current} à %{original} et déplacera toutes les transactions boursières associées."
       ticker_label: Ticker
       trade_history_entry: "%{qty} actions de %{security} à %{price}"
       total_return_label: Rendement total
+      unknown: Inconnu
+      cost_basis_locked_label: Le coût de revient est verrouillé
+      cost_basis_locked_description: Votre coût de revient défini manuellement ne sera pas modifié par les synchronisations.
+      unlock_cost_basis: Déverrouiller
+      unlock_confirm_title: Déverrouiller le coût de revient ?
+      unlock_confirm_body: Cela permettra au coût de revient d'être mis à jour par les synchronisations du fournisseur ou les calculs de transactions boursières.
       shares_label: Actions
       book_value_label: Valeur comptable
       market_value_label: Valeur marchande
-      unknown: Inconnu
+      market_data_label: Données de marché
+      market_data_sync_button: Actualiser
+      last_price_update: Dernière mise à jour du cours
+      syncing: Synchronisation…
+      never: Jamais
diff --git a/config/locales/views/holdings/hu.yml b/config/locales/views/holdings/hu.yml
new file mode 100644
index 000000000..c685e9803
--- /dev/null
+++ b/config/locales/views/holdings/hu.yml
@@ -0,0 +1,101 @@
+---
+hu:
+  holdings:
+    cash:
+      brokerage_cash: Brókeri készpénz
+    destroy:
+      success: Pozíció törölve
+      cannot_delete: Ez a pozíció nem törölhető
+    update:
+      success: Bekerülési érték mentve.
+      error: Érvénytelen bekerülési érték.
+    unlock_cost_basis:
+      success: Bekerülési érték feloldva. A következő szinkronizáláskor frissülhet.
+    remap_security:
+      success: Értékpapír sikeresen frissítve.
+      security_not_found: A kiválasztott értékpapír nem található.
+    reset_security:
+      success: Értékpapír visszaállítva a szolgáltató értékére.
+    sync_prices:
+      success: Piaci adatok sikeresen szinkronizálva.
+      unavailable: Az offline értékpapíroknál a piaci adatok szinkronizálása nem elérhető.
+      provider_error: Nem sikerült lekérni a legújabb árakat. Próbáld meg újra néhány perc múlva.
+    errors:
+      security_collision: "Nem lehet átrendeli: már van egy pozíciód a(z) %{ticker} részvényből %{date} dátummal."
+    cost_basis_sources:
+      manual: Felhasználó által megadott
+      calculated: Ügyletekből számított
+      provider: Szolgáltatótól
+    cost_basis_cell:
+      unknown: "--"
+      set: Megadás
+      set_cost_basis_header: "Bekerülési érték megadása: %{ticker} (%{qty} részvény)"
+      total_cost_basis_label: Teljes bekerülési érték
+      or_per_share_label: "Vagy add meg részvényenként:"
+      per_share: részvényenként
+      cancel: Mégse
+      save: Mentés
+      overwrite_confirm_title: Felülírja a bekerülési értéket?
+      overwrite_confirm_body: "Ez felváltja a jelenlegi %{current} bekerülési értéket."
+    holding:
+      per_share: részvényenként
+      shares: "%{qty} részvény"
+      unknown: "--"
+      no_cost_basis: Nincs bekerülési érték
+    index:
+      average_cost: Átlagos bekerülési érték
+      holdings: Pozíciók
+      name: Név
+      new_holding: Új tevékenység
+      no_holdings: Nincs megjeleníthető pozíció.
+      return: Teljes hozam
+      weight: Súly
+    missing_price_tooltip:
+      description: Ennél a befektetésnél hiányoznak adatok, ezért a hozamot és az értéket nem lehetett kiszámítani.
+      missing_data: Hiányzó adatok
+    show:
+      avg_cost_label: Átlagos bekerülési érték
+      current_market_price_label: Aktuális piaci ár
+      delete: Törlés
+      delete_subtitle: Ez törli a pozíciót és az összes kapcsolódó ügyletet ezen a számlán. Ez a művelet nem vonható vissza.
+      delete_title: Pozíció törlése
+      edit_security: Értékpapír szerkesztése
+      history: Előzmények
+      no_trade_history: Ehhez a pozícióhoz nem áll rendelkezésre ügyleti előzmény.
+      overview: Áttekintés
+      portfolio_weight_label: Portfólió-súly
+      settings: Beállítások
+      security_label: Értékpapír
+      originally: "korábban: %{ticker}"
+      search_security: Értékpapír keresése
+      search_security_placeholder: Keresés szimbólum vagy név alapján
+      cancel: Mégse
+      remap_security: Mentés
+      provider_disabled_warning: "Az árfrissítés szünetel – a(z) %{provider} szolgáltató le van tiltva. Válassz másik szolgáltatót alább, vagy engedélyezd újra a Beállításokban."
+      truncated_history_warning: "Az árfolyamtörténet csak %{date} dátumtól érhető el. A korábbi dátumoknál a kiválasztott szolgáltatótól nem érkeztek adatok – ez akkor fordulhat elő, ha az eszközt az ügyletkötés után vezették be, vagy a szolgáltató az aktuális csomagján korlátozott historikus ablakot kínál."
+      switch_provider_label: Szolgáltató váltása
+      switch_provider_description: "A(z) %{provider} le van tiltva. Keress rá erre az értékpapírra egy másik engedélyezett szolgáltatónál."
+      switch_provider_button: Váltás
+      no_security_provider: Az értékpapír-szolgáltató nincs beállítva. Nem lehet értékpapírt keresni.
+      security_remapped_label: Értékpapír átrendeli
+      provider_sent: "Szolgáltató által küldött: %{ticker}"
+      reset_to_provider: Visszaállítás a szolgáltató értékére
+      reset_confirm_title: Visszaállítja az értékpapírt a szolgáltató értékére?
+      reset_confirm_body: "Ez megváltoztatja az értékpapírt %{current} helyett %{original} értékre, és áthelyezi az összes kapcsolódó ügyletet."
+      ticker_label: Tőzsdei szimbólum
+      trade_history_entry: "%{qty} részvény %{security} értékpapírból, %{price} áron"
+      total_return_label: Teljes hozam
+      unknown: Ismeretlen
+      cost_basis_locked_label: A bekerülési érték zárolva van
+      cost_basis_locked_description: A kézzel megadott bekerülési értéket a szinkronizálások nem módosítják.
+      unlock_cost_basis: Feloldás
+      unlock_confirm_title: Feloldja a bekerülési értéket?
+      unlock_confirm_body: Ez lehetővé teszi, hogy a bekerülési értéket a szolgáltatói szinkronizálások vagy az ügyleti számítások frissítsék.
+      shares_label: Részvények
+      book_value_label: Könyv szerinti érték
+      market_value_label: Piaci érték
+      market_data_label: Piaci adatok
+      market_data_sync_button: Frissítés
+      last_price_update: Utolsó árfrissítés
+      syncing: Szinkronizálás...
+      never: Soha
diff --git a/config/locales/views/ibkr_items/ca.yml b/config/locales/views/ibkr_items/ca.yml
new file mode 100644
index 000000000..7cf62c8ba
--- /dev/null
+++ b/config/locales/views/ibkr_items/ca.yml
@@ -0,0 +1,101 @@
+---
+ca:
+  ibkr_items:
+    complete_account_setup:
+      none_created: No s'ha creat cap compte.
+      none_selected: No s'ha seleccionat cap compte.
+      success:
+        one: S'ha creat correctament %{count} compte d'Interactive Brokers.
+        other: S'han creat correctament %{count} comptes d'Interactive Brokers.
+    create:
+      success: Interactive Brokers s'ha configurat correctament.
+    defaults:
+      name: Interactive Brokers
+    destroy:
+      success: S'ha programat la connexió Interactive Brokers per a la seva eliminació.
+    ibkr_item:
+      accounts_need_setup: Els comptes necessiten configuració
+      accounts_need_setup_description: Alguns comptes d'IBKR necessiten ser enllaçats
+        a comptes de Sure.
+      delete: Elimina
+      deletion_in_progress: Eliminació en curs
+      error: Error
+      flex_web_service: Flex Web Service
+      never_synced: Mai sincronitzat.
+      no_accounts_discovered: Encara no s'han descobert comptes d'IBKR.
+      no_accounts_discovered_description: Executa una sincronització després de configurar
+        la teva consulta Flex per descobrir comptes.
+      requires_update: Les credencials necessiten atenció
+      setup_accounts: Configura comptes
+      synced: Sincronitzat fa %{time}. %{summary}.
+      syncing: Sincronitzant
+    link_existing_account:
+      already_linked: Aquest compte d'Interactive Brokers ja està enllaçat.
+      failed: No s'ha pogut enllaçar el compte d'Interactive Brokers.
+      not_found: No s'ha trobat el compte o la configuració d'Interactive Brokers.
+      only_manual_investment: Només els comptes d'inversió manuals es poden enllaçar
+        a Interactive Brokers.
+      success: S'ha enllaçat correctament al compte d'Interactive Brokers.
+    select_accounts:
+      not_configured: Interactive Brokers no està configurat.
+    select_existing_account:
+      balance: Saldo
+      cancel: Cancel·la
+      link: Enllaça
+      no_accounts_available: Encara no hi ha comptes d'Interactive Brokers sense enllaçar
+        disponibles.
+      run_sync_hint: Executa una sincronització des de Configuració > Proveïdors després
+        d'actualitzar la teva consulta Flex.
+      title: Enllaça compte d'Interactive Brokers
+      wait_for_sync: Espera que la sincronització de descobriment de comptes acabi.
+    setup_accounts:
+      available_accounts:
+        account_id: 'ID del compte: %{account_id}'
+        account_summary: "%{account_type} • Saldo: %{balance}"
+        account_type_investment: Inversió
+        title: Comptes disponibles
+      buttons:
+        back_to_settings: Torna a la configuració
+        cancel: Cancel·la
+        create_selected_accounts: Crea els comptes seleccionats
+        done: Fet
+        link: Enllaça
+        refresh: Actualitza
+      dialog_title: Configura els teus comptes d'Interactive Brokers
+      info_box:
+        items:
+          item_1: Posicions amb preus i quantitats actuals
+          item_2: Cost base per posició
+          item_3: Operacions, dividends, comissions i dipòsits o retirades d'efectiu
+        title: Importació de la consulta Flex d'IBKR
+        warning: L'activitat històrica està limitada a la finestra de l'informe de
+          la consulta Flex
+      link_existing:
+        description: O enllaça un compte d'IBKR descobert a un compte d'inversió manual
+          existent.
+        manual_account_option: "%{name} (%{balance})"
+        select_prompt: Selecciona un compte...
+      linked_accounts:
+        linked_to_html: 'Enllaçat a: %{account}'
+        title: Ja enllaçats
+      page_title: Configura els comptes d'Interactive Brokers
+      status:
+        fetching_accounts: Obtenint comptes d'Interactive Brokers...
+        no_accounts_found_description: Sure no ha pogut trobar cap compte d'IBKR a
+          l'últim informe Flex.
+        no_accounts_found_title: No s'han trobat comptes.
+      subtitle: Selecciona quins comptes de broker d'IBKR vols enllaçar.
+    sync_status:
+      all_linked:
+        one: 1 compte enllaçat
+        other: "%{count} comptes enllaçats"
+      no_accounts: Encara no s'han descobert comptes d'IBKR
+      partial: "%{linked} enllaçats, %{unlinked} necessiten configuració"
+    update:
+      success: La configuració d'Interactive Brokers s'ha actualitzat correctament.
+  providers:
+    ibkr:
+      connection_description: Connecta un informe de Flex Web Service d'Interactive
+        Brokers
+      institution_name: Interactive Brokers
+      name: Interactive Brokers
diff --git a/config/locales/views/ibkr_items/en.yml b/config/locales/views/ibkr_items/en.yml
new file mode 100644
index 000000000..45666b2e4
--- /dev/null
+++ b/config/locales/views/ibkr_items/en.yml
@@ -0,0 +1,92 @@
+---
+en:
+  providers:
+    ibkr:
+      name: Interactive Brokers
+      connection_description: Connect an Interactive Brokers Flex Web Service report
+      institution_name: Interactive Brokers
+  ibkr_items:
+    defaults:
+      name: Interactive Brokers
+    ibkr_item:
+      deletion_in_progress: Deletion in progress
+      flex_web_service: Flex Web Service
+      syncing: Syncing
+      requires_update: Credentials need attention
+      error: Error
+      synced: Synced %{time} ago. %{summary}.
+      never_synced: Never synced.
+      setup_accounts: Set up accounts
+      delete: Delete
+      accounts_need_setup: Accounts need setup
+      accounts_need_setup_description: Some accounts from IBKR need to be linked to Sure accounts.
+      no_accounts_discovered: No IBKR accounts discovered yet.
+      no_accounts_discovered_description: Run a sync after configuring your Flex query to discover accounts.
+    setup_accounts:
+      page_title: Set Up Interactive Brokers Accounts
+      dialog_title: Set Up Your Interactive Brokers Accounts
+      subtitle: Select which IBKR brokerage accounts to link.
+      info_box:
+        title: IBKR Flex Query Import
+        items:
+          item_1: Holdings with current prices and quantities
+          item_2: Cost basis per position
+          item_3: Trades, dividends, commissions, and cash deposits or withdrawals
+        warning: Historical activity is limited to the report window of the Flex Query
+      status:
+        fetching_accounts: Fetching accounts from Interactive Brokers...
+        no_accounts_found_title: No accounts found.
+        no_accounts_found_description: Sure could not find any IBKR accounts in the latest Flex report.
+      available_accounts:
+        title: Available accounts
+        account_type_investment: Investment
+        account_summary: "%{account_type} • Balance: %{balance}"
+        account_id: "Account ID: %{account_id}"
+      link_existing:
+        description: Or link a discovered IBKR account to an existing manual investment account.
+        manual_account_option: "%{name} (%{balance})"
+        select_prompt: Select an account...
+      linked_accounts:
+        title: Already linked
+        linked_to_html: "Linked to: %{account}"
+      buttons:
+        refresh: Refresh
+        cancel: Cancel
+        back_to_settings: Back to Settings
+        create_selected_accounts: Create selected accounts
+        link: Link
+        done: Done
+    sync_status:
+      no_accounts: No IBKR accounts discovered yet
+      all_linked:
+        one: 1 account linked
+        other: "%{count} accounts linked"
+      partial: "%{linked} linked, %{unlinked} need setup"
+    select_existing_account:
+      title: Link Interactive Brokers account
+      no_accounts_available: No unlinked Interactive Brokers accounts are available yet.
+      run_sync_hint: "Run a sync from Settings > Providers after updating your Flex query."
+      wait_for_sync: Wait for the account discovery sync to finish.
+      balance: Balance
+      link: Link
+      cancel: Cancel
+    create:
+      success: Successfully configured Interactive Brokers.
+    update:
+      success: Successfully updated Interactive Brokers configuration.
+    destroy:
+      success: Scheduled Interactive Brokers connection for deletion.
+    select_accounts:
+      not_configured: Interactive Brokers is not configured.
+    link_existing_account:
+      not_found: Account or Interactive Brokers configuration not found.
+      only_manual_investment: Only manual investment accounts can be linked to Interactive Brokers.
+      already_linked: This Interactive Brokers account is already linked.
+      success: Successfully linked to Interactive Brokers account.
+      failed: Failed to link Interactive Brokers account.
+    complete_account_setup:
+      success:
+        one: Successfully created %{count} Interactive Brokers account.
+        other: Successfully created %{count} Interactive Brokers accounts.
+      none_selected: No accounts were selected.
+      none_created: No accounts were created.
diff --git a/config/locales/views/ibkr_items/hu.yml b/config/locales/views/ibkr_items/hu.yml
new file mode 100644
index 000000000..d24742859
--- /dev/null
+++ b/config/locales/views/ibkr_items/hu.yml
@@ -0,0 +1,92 @@
+---
+hu:
+  providers:
+    ibkr:
+      name: Interactive Brokers
+      connection_description: Csatlakozás egy Interactive Brokers Flex Web Service jelentéshez
+      institution_name: Interactive Brokers
+  ibkr_items:
+    defaults:
+      name: Interactive Brokers
+    ibkr_item:
+      deletion_in_progress: Törlés folyamatban
+      flex_web_service: Flex Web Service
+      syncing: Szinkronizálás
+      requires_update: A hitelesítő adatok figyelmet igényelnek
+      error: Hiba
+      synced: Szinkronizálva %{time} ezelőtt. %{summary}.
+      never_synced: Még nem szinkronizált.
+      setup_accounts: Számlák beállítása
+      delete: Törlés
+      accounts_need_setup: A számlák beállítást igényelnek
+      accounts_need_setup_description: Az IBKR-ből importált néhány számlát össze kell kapcsolni a Sure-számlákkal.
+      no_accounts_discovered: Még nem találhatók IBKR-számlák.
+      no_accounts_discovered_description: Futtass egy szinkronizálást a Flex-lekérdezés konfigurálása után a számlák felderítéséhez.
+    setup_accounts:
+      page_title: Interactive Brokers-számlák beállítása
+      dialog_title: Interactive Brokers-számlák beállítása
+      subtitle: Válaszd ki, melyik IBKR brókerszámlákat szeretnéd összekapcsolni.
+      info_box:
+        title: IBKR Flex Query importálás
+        items:
+          item_1: Pozíciók aktuális árakkal és mennyiségekkel
+          item_2: Bekerülési érték pozíciónként
+          item_3: Ügyletek, osztalékok, jutalékok és készpénzbefizetések vagy -kifizetések
+        warning: A historikus tevékenység a Flex Query jelentési ablakára korlátozódik
+      status:
+        fetching_accounts: Számlák lekérése az Interactive Brokers-től...
+        no_accounts_found_title: Nem található számla.
+        no_accounts_found_description: A Sure nem talált IBKR-számlákat a legutóbbi Flex-jelentésben.
+      available_accounts:
+        title: Elérhető számlák
+        account_type_investment: Befektetés
+        account_summary: "%{account_type} • Egyenleg: %{balance}"
+        account_id: "Számlaazonosító: %{account_id}"
+      link_existing:
+        description: Vagy kapcsolj össze egy felderített IBKR-számlát egy meglévő manuális befektetési számlával.
+        manual_account_option: "%{name} (%{balance})"
+        select_prompt: Válassz számlát...
+      linked_accounts:
+        title: Már összekapcsolt
+        linked_to_html: "Összekapcsolva: %{account}"
+      buttons:
+        refresh: Frissítés
+        cancel: Mégse
+        back_to_settings: Vissza a beállításokhoz
+        create_selected_accounts: Kijelölt számlák létrehozása
+        link: Összekapcsolás
+        done: Kész
+    sync_status:
+      no_accounts: Még nem találhatók IBKR-számlák
+      all_linked:
+        one: 1 számla összekapcsolva
+        other: "%{count} számla összekapcsolva"
+      partial: "%{linked} összekapcsolt, %{unlinked} beállítást igényel"
+    select_existing_account:
+      title: Interactive Brokers-számla összekapcsolása
+      no_accounts_available: Még nem érhető el összekapcsolatlan Interactive Brokers-számla.
+      run_sync_hint: "Futtass szinkronizálást a Beállítások > Szolgáltatók menüből a Flex-lekérdezés frissítése után."
+      wait_for_sync: Várd meg, amíg a számlafelderítési szinkronizálás befejeződik.
+      balance: Egyenleg
+      link: Összekapcsolás
+      cancel: Mégse
+    create:
+      success: Az Interactive Brokers sikeresen konfigurálva.
+    update:
+      success: Az Interactive Brokers konfigurációja sikeresen frissítve.
+    destroy:
+      success: Az Interactive Brokers kapcsolat törlési sorba került.
+    select_accounts:
+      not_configured: Az Interactive Brokers nincs konfigurálva.
+    link_existing_account:
+      not_found: A számla vagy az Interactive Brokers konfiguráció nem található.
+      only_manual_investment: Csak manuális befektetési számlák kapcsolhatók össze az Interactive Brokers-szel.
+      already_linked: Ez az Interactive Brokers-számla már össze van kapcsolva.
+      success: Sikeresen összekapcsolva az Interactive Brokers-számlával.
+      failed: Nem sikerült összekapcsolni az Interactive Brokers-számlával.
+    complete_account_setup:
+      success:
+        one: Sikeresen létrehozva %{count} Interactive Brokers-számla.
+        other: Sikeresen létrehozva %{count} Interactive Brokers-számla.
+      none_selected: Nem lett számla kijelölve.
+      none_created: Nem lett számla létrehozva.
diff --git a/config/locales/views/impersonation_sessions/ca.yml b/config/locales/views/impersonation_sessions/ca.yml
index ca1a23e07..71932d26d 100644
--- a/config/locales/views/impersonation_sessions/ca.yml
+++ b/config/locales/views/impersonation_sessions/ca.yml
@@ -13,3 +13,13 @@ ca:
       success: Has sortit de la sessió
     reject:
       success: Sol·licitud rebutjada
+    super_admin_bar:
+      impersonating: Personificant
+      jobs: Tasques
+      join: Uneix-te
+      join_a_session: Uneix-te a una sessió
+      leave: Surt
+      request_impersonation: Sol·licita personificació
+      super_admin: Super administrador
+      terminate: Finalitza
+      uuid_placeholder: UUID
diff --git a/config/locales/views/impersonation_sessions/en.yml b/config/locales/views/impersonation_sessions/en.yml
index 202822bfe..8c3a030d9 100644
--- a/config/locales/views/impersonation_sessions/en.yml
+++ b/config/locales/views/impersonation_sessions/en.yml
@@ -13,3 +13,13 @@ en:
       success: Left session
     reject:
       success: Request rejected
+    super_admin_bar:
+      super_admin: Super Admin
+      jobs: Jobs
+      impersonating: Impersonating
+      leave: Leave
+      terminate: Terminate
+      join_a_session: Join a session
+      join: Join
+      uuid_placeholder: UUID
+      request_impersonation: Request Impersonation
diff --git a/config/locales/views/impersonation_sessions/hu.yml b/config/locales/views/impersonation_sessions/hu.yml
new file mode 100644
index 000000000..d8a1a672d
--- /dev/null
+++ b/config/locales/views/impersonation_sessions/hu.yml
@@ -0,0 +1,25 @@
+---
+hu:
+  impersonation_sessions:
+    approve:
+      success: Kérés jóváhagyva
+    complete:
+      success: Munkamenet befejezve
+    create:
+      success: Kérés elküldve a felhasználónak. Jóváhagyásra vár.
+    join:
+      success: Csatlakozás a munkamenethez megtörtént
+    leave:
+      success: Kilépés a munkamenetből megtörtént
+    reject:
+      success: Kérés elutasítva
+    super_admin_bar:
+      super_admin: Super Admin
+      jobs: Feladatok
+      impersonating: Megszemélyesítés
+      leave: Kilépés
+      terminate: Befejezés
+      join_a_session: Csatlakozás munkamenethez
+      join: Csatlakozás
+      uuid_placeholder: UUID
+      request_impersonation: Megszemélyesítés kérése
diff --git a/config/locales/views/imports/ca.yml b/config/locales/views/imports/ca.yml
index 8de803977..723d6471e 100644
--- a/config/locales/views/imports/ca.yml
+++ b/config/locales/views/imports/ca.yml
@@ -3,19 +3,51 @@ ca:
   import:
     cleans:
       show:
+        all_rows: Totes les files
+        data_cleaned: Les teves dades s'han netejat
         description: Edita les teves dades a la taula de sota. Les cel·les vermelles
           són invàlides.
+        error_rows: Files amb errors
         errors_notice: Hi ha errors a les teves dades. Passa el cursor per sobre de
           l'error per veure'n els detalls.
         errors_notice_mobile: Hi ha errors a les teves dades. Toca la icona d'error
           per veure'n els detalls.
+        next_step: Pas següent
+        not_configured: Configura la teva importació abans de continuar.
         title: Neteja les teves dades
     configurations:
+      account_import:
+        apply_configuration: Aplica la configuració
+        balance: Saldo
+        balance_date: Data del saldo
+        currency: Divisa
+        date_format: Format de data
+        default: Per defecte
+        entity_type: Tipus d'entitat
+        leave_empty: Deixa-ho buit
+        name: Nom
+        select_format: Selecciona el format
+      actual_import:
+        account_label: Compte (opcional)
+        amount_label: Import
+        apply_configuration: Aplica la configuració
+        category_label: Categoria (opcional)
+        date_format_label: Format de data
+        date_label: Data
+        incomes_are_negative: Els ingressos són negatius
+        incomes_are_positive: Els ingressos són positius
+        leave_empty: Deixa-ho buit
+        name_label: Beneficiari (opcional)
+        notes_label: Notes (opcional)
+        preconfigured_notice: Hem preconfigurat la teva importació d'Actual Budget.
+          Continua al pas següent.
+        signage_convention_label: Convenció de signes
       category_import:
         button_label: Continua
         description: Puja un fitxer CSV senzill (com el que generem quan exportes
           les teves dades). Automàticament maparem les columnes per tu.
-        instructions: Selecciona continuar per analitzar el teu CSV i passar al pas de neteja.
+        instructions: Selecciona continuar per analitzar el teu CSV i passar al pas
+          de neteja.
       mint_import:
         date_format_label: Format de data
       rule_import:
@@ -28,13 +60,65 @@ ca:
         description: Selecciona les columnes que corresponen a cada camp del teu CSV.
         title: Configura la teva importació
       trade_import:
+        account_label: Compte
+        apply_configuration: Aplica la configuració
+        buys_are_negative: Les compres tenen quantitat negativa
+        buys_are_positive: Les compres tenen quantitat positiva
+        currency_label: Divisa
         date_format_label: Format de data
+        date_label: Data
+        default: Per defecte
+        format_label: Format
+        leave_empty: Deixa-ho buit
+        name_label: Nom
+        no_security_provider_warning: El proveïdor de preus de valors no està configurat.
+          Les teves importacions d'operacions funcionaran, però Sure no recuperarà
+          l'historial de preus. Ves a la configuració per configurar-ho.
+        note_label: Nota
+        price_label: Preu
+        quantity_label: Quantitat
+        select_column: Selecciona la columna
+        select_format: Selecciona el format
+        stock_exchange_code_label: Codi de borsa
+        ticker_label: Ticker
       transaction_import:
+        account_label: Compte
+        amount_label: Import
+        amount_type_label: Tipus d'import
+        amount_type_strategy_label: Estratègia del tipus d'import
+        apply_configuration: Aplica la configuració
+        as_amount_type_column: com a columna del tipus d'import
+        as_identifier_value: com a valor identificador
+        category_label: Categoria
+        currency_label: Divisa
         date_format_label: Format de data
+        date_label: Data
+        default: Per defecte
+        expense_outflow: Despesa (sortida)
+        format_label: Format
+        income_inflow: Ingrés (entrada)
+        incomes_are_negative: Els ingressos són negatius
+        incomes_are_positive: Els ingressos són positius
+        leave_empty: Deixa-ho buit
+        name_label: Nom
+        notes_label: Notes
+        rows_to_skip_label: Omet les primeres n files
+        select_column: Selecciona la columna
+        select_convention: Selecciona la convenció
+        select_format: Selecciona el format
+        select_strategy: Selecciona l'estratègia
+        select_type: Selecciona el tipus
+        select_value: Selecciona el valor
+        set: Estableix
+        tags_label: Etiquetes
+        treat_as_html: Tracta «<span class="font-medium">%{value}</span>» com a
+      update:
+        success: Importació configurada correctament.
     confirms:
       mappings:
         create_account: Crea un compte
         csv_mapping_label: "%{mapping} al CSV"
+        next: Següent
         no_accounts: Encara no tens cap compte. Crea un compte que puguem utilitzar
           per a les files (sense assignar) del teu CSV o torna al pas de Neteja i
           proporciona un nom de compte que puguem utilitzar.
@@ -43,75 +127,347 @@ ca:
         unassigned_account: Necessites crear un nou compte per a les files sense assignar?
       show:
         account_mapping_description: Assigna tots els comptes del teu fitxer importat
-          als comptes existents de Maybe. També pots afegir nous comptes o deixar-los
+          als comptes existents. També pots afegir nous comptes o deixar-los
           sense categoria.
         account_mapping_title: Assigna els teus comptes
         account_type_mapping_description: Assigna tots els tipus de compte del teu
-          fitxer importat als de Maybe
+          fitxer importat als existents
         account_type_mapping_title: Assigna els teus tipus de compte
         category_mapping_description: Assigna totes les categories del teu fitxer
-          importat a les categories existents de Maybe. També pots afegir-ne de noves
+          importat a les categories existents. També pots afegir-ne de noves
           o deixar-les sense categoria.
         category_mapping_title: Assigna les teves categories
+        invalid_data: Hi ha dades invàlides; edita-les fins que es resolguin tots
+          els errors
         tag_mapping_description: Assigna totes les etiquetes del teu fitxer importat
-          a les etiquetes existents de Maybe. També pots afegir-ne de noves o deixar-les
+          a les etiquetes existents. També pots afegir-ne de noves o deixar-les
           sense categoria.
         tag_mapping_title: Assigna les teves etiquetes
-    uploads:
+      sure_import:
+        cancel: Cancel·la
+        description: Revisa les dades que s'importaran del teu fitxer d'exportació.
+        empty_summary: No s'han trobat registres importables en aquest fitxer. Pot
+          estar buit, o les línies no coincideixen amb el format d'exportació esperat
+          (cada línia ha de ser un objecte JSON amb les claus «type» i «data», amb
+          tipus admesos per aquesta importació).
+        publish_button: Inicia la importació
+        summary: Resum de la importació
+        title: Confirma la teva importació
+    qif_category_selections:
       show:
+        categories_found:
+          one: 1 categoria trobada
+          other: "%{count} categories trobades"
+        categories_heading: Categories
+        category_name_col: Nom de la categoria
+        description: Revisa el format de data detectat i tria quines categories i
+          etiquetes del teu fitxer QIF vols importar a %{product_name}.
+        empty_state_primary: No s'han trobat categories ni etiquetes en aquest fitxer
+          QIF.
+        empty_state_secondary: Totes les transaccions s'importaran sense categories
+          ni etiquetes.
+        split_badge: dividida
+        split_warning_description: Aquest fitxer QIF conté transaccions dividides.
+          Les divisions encara no estan suportades, així que cada transacció dividida
+          s'importarà com una sola transacció amb el seu import complet i sense categoria.
+          El detall individual de cada divisió no es conservarà.
+        split_warning_title: Transaccions dividides detectades
+        submit: Continua per revisar
+        tag_name_col: Nom de l'etiqueta
+        tags_found:
+          one: 1 etiqueta trobada
+          other: "%{count} etiquetes trobades"
+        tags_heading: Etiquetes
+        title: Configura i selecciona
+        transactions_col: Transaccions
+        txn_count:
+          one: 1 trans.
+          other: "%{count} trans."
+      update:
+        success: Categories i etiquetes desades.
+    uploads:
+      handle_qif_upload:
+        qif_uploaded: Fitxer QIF pujat correctament.
+      show:
+        account_optional_label: Compte (opcional)
+        browse: Explora
+        copy_paste_tab: Copia i enganxa
+        csv_file_prompt: per afegir aquí el teu fitxer CSV
+        csv_invalid: Ha de ser un CSV vàlid amb capçaleres i com a mínim una fila
+          de dades
         description: Enganxa o puja el teu fitxer CSV a continuació. Revisa les instruccions
           de la taula abans de començar.
+        download_sample_csv: Descarrega un CSV d'exemple
+        drop_csv_subtitle: El teu fitxer es pujarà automàticament
+        drop_csv_title: Deixa anar el CSV per pujar-lo
         instructions_1: A sota hi ha un exemple de CSV amb columnes disponibles per
           importar.
         instructions_2: El teu CSV ha de tenir una fila d'encapçalament
         instructions_3: Pots posar el nom que vulguis a les columnes. Les maparàs
           en un pas posterior.
         instructions_4: Les columnes marcades amb un asterisc (*) són obligatòries.
-        instructions_5: Sense comes, símbols de moneda ni parèntesis als números.
+        instructions_5: Sense comes, símbols de divisa ni parèntesis als números.
+        multi_account_import: Importació multicompte
+        paste_csv_placeholder: Enganxa aquí el contingut del teu fitxer CSV
+        qif_account_label: Compte
+        qif_account_placeholder: Selecciona un compte…
+        qif_description: Selecciona el compte al qual pertany aquest fitxer QIF i
+          puja la teva exportació .qif de Quicken.
+        qif_file_hint: només fitxers .qif
+        qif_file_prompt: per afegir aquí el teu fitxer QIF
+        qif_submit: Puja QIF
+        qif_title: Puja el fitxer QIF
         title: Importa les teves dades
+        to_see_format: per veure el format CSV requerit
+        upload_csv_button: Puja CSV
+        upload_csv_tab: Puja CSV
+      sure_import:
+        browse: Explora
+        browse_hint: per afegir aquí el teu fitxer all.ndjson
+        description: Puja el fitxer all.ndjson de la teva exportació de dades per
+          restaurar els teus comptes, transaccions, categories i més.
+        drop_subtitle: El teu fitxer es pujarà automàticament
+        drop_title: Deixa anar el NDJSON per pujar-lo
+        hint_html: Puja el fitxer <strong>all.ndjson</strong> del teu ZIP d'exportació
+          de dades
+        ndjson_invalid: Ha de ser un NDJSON vàlid amb com a mínim un registre
+        title: Importa des d'una exportació
+        upload_button: Puja NDJSON
+      update:
+        qif_uploaded: Fitxer QIF pujat correctament.
   imports:
+    apply_template:
+      no_template_found: No s'ha trobat cap plantilla; configura manualment la teva
+        importació.
+      template_applied: Plantilla aplicada.
+    column_labels:
+      account: Compte
+      amount: Import
+      category: Categoria
+      category_color: Color
+      category_icon: Icona Lucide
+      category_parent: Categoria pare
+      currency: Divisa
+      date: Data
+      entity_type: Tipus
+      exchange: Borsa
+      name: Nom
+      notes: Notes
+      price: Preu
+      qty: Quantitat
+      tags: Etiquetes
+      ticker: Ticker
+    create:
+      csv_uploaded: CSV pujat correctament.
+      document_provider_not_configured: No hi ha cap magatzem vectorial configurat per
+        a la pujada de documents.
+      document_too_large: El fitxer del document és massa gran. La mida màxima és
+        %{max_size}MB.
+      document_upload_failed: No hem pogut pujar el document al magatzem vectorial.
+        Torna-ho a provar.
+      document_uploaded: Document pujat correctament.
+      file_too_large: El fitxer és massa gran. La mida màxima és %{max_size}MB.
+      invalid_document_file_type: Tipus de fitxer de document no vàlid per a l'arxiu
+        vectorial actiu.
+      invalid_file_type: Tipus de fitxer no vàlid. Puja un fitxer CSV.
+      invalid_ndjson_file_type: Tipus o format de fitxer no vàlid. Puja un fitxer
+        d'exportació .ndjson o .json vàlid.
+      invalid_pdf: El fitxer pujat no és un PDF vàlid.
+      ndjson_uploaded: Fitxer NDJSON pujat correctament.
+      pdf_processing: El teu PDF s'està processant. Rebràs un correu electrònic quan
+        l'anàlisi estigui completa.
+      pdf_too_large: El fitxer PDF és massa gran. La mida màxima és %{max_size}MB.
+    date_format:
+      description: El format de data s'ha detectat automàticament del teu fitxer.
+        Canvia'l si les dates no es veuen correctament.
+      error_description: Cap dels formats de data suportats ha pogut analitzar les
+        dates d'aquest fitxer. Comprova que el fitxer contingui entrades de data vàlides.
+      error_title: No s'ha pogut detectar el format de data
+      heading: Format de data
+      preview: Primera data analitzada
+    destroy:
+      deleted: La teva importació s'ha eliminat.
+    document_types:
+      bank_statement: Extracte bancari
+      contract: Contracte
+      credit_card_statement: Extracte de targeta de crèdit
+      financial_document: Document financer
+      investment_statement: Extracte d'inversions
+      other: Altre document
+      unknown: Document desconegut
+    empty:
+      message: No s'ha trobat cap importació.
+    errors:
+      custom_column_requires_inflow: Les importacions amb columna personalitzada requereixen
+        seleccionar una columna d'entrada
+    failure:
+      description: Comprova el format del fitxer, els errors i que tots els camps
+        obligatoris estiguin omplerts, i torna-ho a provar.
+      title: Importació fallida
+      try_again: Torna-ho a provar
+    importing:
+      back_to_dashboard: Tornar al tauler
+      check_status: Comprova l'estat
+      description: La teva importació està en curs. Consulta el menú d'importacions
+        per veure l'estat o clica «Comprova l'estat» per actualitzar la pàgina. Pots
+        continuar utilitzant l'aplicació.
+      title: Importació en curs
     index:
-      title: Importacions
       new: Nova importació
+      title: Importacions
+    mapping_labels:
+      account: Compte
+      account_type: Tipus de compte
+      category: Categoria
+      tag: Etiqueta
+    new:
+      coming_soon: Properament
+      description: Importa des d'una eina financera o puja fitxers de dades sense
+        processar.
+      import_accounts: Importa comptes
+      import_actual: Importa des d'Actual Budget
+      import_categories: Importa categories
+      import_file: Importa document
+      import_file_description: Anàlisi amb IA per a PDFs i pujada de fitxers cercables
+      import_mint: Importa des de Mint
+      import_portfolio: Importa inversions
+      import_qif: Importa des de Quicken (QIF)
+      import_rules: Importa regles
+      import_sure: Importa des de Sure
+      import_sure_description: Fitxer .ndjson d'exportació completa
+      import_transactions: Importa transaccions
+      import_ynab: Importa des de YNAB
+      requires_account: Importa comptes primer per desbloquejar aquesta opció.
+      resume: Reprèn %{type}
+      sources: Fonts
+      tab_financial_tools: Eines financeres i fitxers
+      tab_raw_data: Dades sense processar
+      title: Nova importació
+    pdf_import:
+      back_to_dashboard: Tornar al tauler
+      back_to_imports: Tornar a les importacions
+      check_status: Comprova l'estat
+      complete_description: Hem analitzat el teu PDF i això és el que hem trobat.
+      complete_title: Document analitzat
+      create_account: Crea un compte
+      delete_import: Elimina la importació
+      document_type_label: Tipus de document
+      email_sent_notice: T'hem enviat un correu electrònic amb els passos següents.
+      failed_description: No hem pogut processar el teu document PDF. Torna-ho a provar
+        o contacta amb el suport.
+      failed_title: El processament ha fallat
+      no_accounts: No hi ha comptes disponibles. Crea un compte primer.
+      processing_description: Estem analitzant el teu document amb IA. Pot trigar
+        un moment. Rebràs un correu electrònic quan l'anàlisi estigui completa.
+      processing_failed_generic: 'El processament ha fallat: %{error}'
+      processing_failed_with_message: "%{message}"
+      processing_title: Processant el teu PDF
+      publish_transactions:
+        one: Publica %{count} transacció
+        other: Publica %{count} transaccions
+      ready_for_review_description: Hem extret %{count} transaccions del teu extracte.
+        Revisa-les i publica-les per afegir-les al teu compte.
+      ready_for_review_title: A punt per revisar
+      review_transactions: Revisa les transaccions
+      save_account: Desa
+      select_account: Importa al compte
+      select_account_hint: Tria a quin compte vols importar aquestes transaccions.
+      select_account_placeholder: Selecciona un compte...
+      select_account_to_continue: Selecciona un compte a dalt per continuar.
+      summary_label: Resum
+      transactions_extracted: Transaccions extretes
+      transactions_extracted_count:
+        one: "%{count} transacció"
+        other: "%{count} transaccions"
+      try_again: Torna-ho a provar
+      unknown_document_type: Desconegut
+      unknown_state_description: Aquesta importació es troba en un estat inesperat.
+        Torna a les importacions.
+      unknown_state_title: Estat desconegut
+    publish:
+      max_rows_exceeded: La teva importació supera el límit màxim de %{max} files.
+      started: La teva importació s'ha iniciat en segon pla.
+    ready:
+      back_to_imports: Tornar a les importacions
+      description: Aquí tens un resum dels nous elements que s'afegiran al teu compte
+        un cop publiquis aquesta importació.
+      empty_summary: No s'han trobat registres importables en aquest fitxer. Pot estar
+        buit, o les línies no coincideixen amb el format d'exportació esperat (cada
+        línia ha de ser un objecte JSON amb les claus «type» i «data», amb tipus admesos
+        per aquesta importació).
+      publish_import: Publica la importació
+      summary_count_label: Quantitat
+      summary_item_label: Element
+      title: Confirma les teves dades d'importació
+    revert:
+      started: La importació s'està revertint en segon pla.
+    revert_failure:
+      description: Torna-ho a provar
+      title: La reversió de la importació ha fallat
+      try_again: Torna-ho a provar
+    show:
+      finalize_mappings: Finalitza els teus mapatges abans de continuar.
+      finalize_upload: Finalitza la pujada del fitxer.
+    steps:
+      clean: Neteja
+      configure: Configuració
+      confirm: Confirma
+      map: Mapatge
+      progress: Pas %{step} de %{total}
+      select: Selecciona
+      upload: Pujada
+    success:
+      back_to_dashboard: Tornar al tauler
+      description: Les teves dades importades s'han afegit correctament a l'aplicació
+        i ja es poden utilitzar.
+      title: Importació correcta
     table:
-      title: Imports
+      empty: Encara no hi ha importacions.
       header:
+        actions: Accions
         date: Data
         operation: Operació
         status: Estat
-        actions: Accions
       row:
+        actions:
+          confirm_revert: Això eliminarà les transaccions que s'han importat, però
+            encara podràs revisar i tornar a importar les teves dades en qualsevol
+            moment.
+          delete: Elimina
+          revert: Reverteix
+          view: Veure
         status:
-          in_progress: En curs
-          uploading: Processant files
-          reverting: Revertint
-          revert_failed: Reversió fallida
           complete: Completat
           failed: Error
-        actions:
-          revert: Revertir
-          confirm_revert: Això suprimirà les transaccions que s'han importat, però encara podràs revisar i tornar a importar les teves dades en qualsevol moment.
-          delete: Elimina
-          view: Veure
-      empty: Encara no hi ha importacions.
-    new:
-      description: Pots importar manualment diversos tipus de dades via CSV o utilitzar
-        una de les nostres plantilles d'importació com Mint.
-      import_accounts: Importa comptes
-      import_categories: Importa categories
-      import_mint: Importa des de Mint
-      import_portfolio: Importa inversions
-      import_rules: Importa regles
-      import_transactions: Importa transaccions
-      resume: Reprèn %{type}
-      sources: Fonts
-      title: Nova importació CSV
-    ready:
-      description: Aquí tens un resum dels nous elements que s'afegiran al teu compte
-        un cop publiquis aquesta importació.
-      title: Confirma les teves dades d'importació
-      summary_item_label: Element
-      summary_count_label: Quantitat
-      empty_summary: No s'han trobat registres importables en aquest fitxer. Pot estar buit, o les línies no coincideixen amb el format d'exportació esperat (cada línia ha de ser un objecte JSON amb les claus «type» i «data», amb tipus admesos per aquesta importació).
-      publish_import: Publicar la importació
-      back_to_imports: Tornar a les importacions
+          in_progress: En curs
+          revert_failed: Reversió fallida
+          reverting: Revertint
+          uploading: Processant files
+        type_labels:
+          account_import: Compte
+          actual_import: Actual
+          category_import: Categoria
+          document_import: Document
+          mint_import: Mint
+          pdf_import: PDF
+          qif_import: QIF
+          rule_import: Regla
+          sure_import: Sure
+          trade_import: Operació
+          transaction_import: Transacció
+      title: Importacions
+    type_labels:
+      account_import: Importació de comptes
+      actual_import: Importació d'Actual
+      category_import: Importació de categories
+      document_import: Importació de documents
+      mint_import: Importació de Mint
+      pdf_import: Importació PDF
+      qif_import: Importació QIF
+      rule_import: Importació de regles
+      sure_import: Importació Sure
+      trade_import: Importació d'operacions
+      transaction_import: Importació de transaccions
+    update:
+      account_saved: Compte desat.
+      invalid_account: No s'ha trobat el compte.
diff --git a/config/locales/views/imports/de.yml b/config/locales/views/imports/de.yml
index faab67cc0..bd733bc77 100644
--- a/config/locales/views/imports/de.yml
+++ b/config/locales/views/imports/de.yml
@@ -61,13 +61,13 @@ de:
         rows_label: Zeilen
         unassigned_account: Neues Konto für nicht zugewiesene Zeilen erstellen?
       show:
-        account_mapping_description: Weise alle Konten aus deiner importierten Datei den bestehenden Konten in %{product_name} zu. Du kannst auch neue Konten hinzufügen oder sie ohne Kategorie lassen.
+        account_mapping_description: Weise alle Konten aus deiner importierten Datei den bestehenden Konten in %{product} zu. Du kannst auch neue Konten hinzufügen oder sie ohne Kategorie lassen.
         account_mapping_title: Konten zuweisen
-        account_type_mapping_description: Weise alle Kontotypen aus deiner importierten Datei den Kontotypen in %{product_name} zu.
+        account_type_mapping_description: Weise alle Kontotypen aus deiner importierten Datei den Kontotypen in %{product} zu.
         account_type_mapping_title: Kontotypen zuweisen
-        category_mapping_description: Weise alle Kategorien aus deiner importierten Datei den bestehenden Kategorien in %{product_name} zu. Du kannst auch neue Kategorien hinzufügen oder sie ohne Kategorie lassen.
+        category_mapping_description: Weise alle Kategorien aus deiner importierten Datei den bestehenden Kategorien in %{product} zu. Du kannst auch neue Kategorien hinzufügen oder sie ohne Kategorie lassen.
         category_mapping_title: Kategorien zuweisen
-        tag_mapping_description: Weise alle Tags aus deiner importierten Datei den bestehenden Tags in %{product_name} zu. Du kannst auch neue Tags hinzufügen oder sie ohne Kategorie lassen.
+        tag_mapping_description: Weise alle Tags aus deiner importierten Datei den bestehenden Tags in %{product} zu. Du kannst auch neue Tags hinzufügen oder sie ohne Kategorie lassen.
         tag_mapping_title: Tags zuweisen
     uploads:
       show:
diff --git a/config/locales/views/imports/en.yml b/config/locales/views/imports/en.yml
index 9f41ab712..270b7d2f6 100644
--- a/config/locales/views/imports/en.yml
+++ b/config/locales/views/imports/en.yml
@@ -2,6 +2,8 @@
 en:
   import:
     qif_category_selections:
+      update:
+        success: "Categories and tags saved."
       show:
         title: "Configure & select"
         description: "Review the detected date format, then choose which categories and tags from your QIF file to bring into %{product_name}."
@@ -27,15 +29,82 @@ en:
         submit: Continue to review
     cleans:
       show:
+        not_configured: "Please configure your import before proceeding."
         description: Edit your data in the table below.  Red cells are invalid.
         errors_notice: You have errors in your data.  Hover over the error to see
           details.
         errors_notice_mobile: You have errors in your data.  Tap over the error tooltip to see
           details.
         title: Clean your data
+        data_cleaned: Your data has been cleaned
+        next_step: Next step
+        all_rows: All rows
+        error_rows: Error rows
     configurations:
       update:
         success: Import configured successfully.
+      account_import:
+        leave_empty: Leave empty
+        default: Default
+        entity_type: Entity Type
+        name: Name
+        balance: Balance
+        currency: Currency
+        balance_date: Balance Date
+        date_format: Date Format
+        select_format: Select format
+        apply_configuration: Apply configuration
+      transaction_import:
+        date_label: Date
+        select_column: Select column
+        select_format: Select format
+        amount_label: Amount
+        default: Default
+        currency_label: Currency
+        format_label: Format
+        amount_type_strategy_label: Amount type strategy
+        select_strategy: Select strategy
+        set: Set
+        as_amount_type_column: as amount type column
+        select_value: Select value
+        as_identifier_value: as identifier value
+        treat_as_html: "Treat \"<span class=\"font-medium\">%{value}</span>\" as"
+        income_inflow: Income (inflow)
+        expense_outflow: Expense (outflow)
+        select_type: Select type
+        leave_empty: Leave empty
+        account_label: Account
+        name_label: Name
+        category_label: Category
+        tags_label: Tags
+        notes_label: Notes
+        apply_configuration: Apply configuration
+        incomes_are_positive: Incomes are positive
+        incomes_are_negative: Incomes are negative
+        amount_type_label: Amount type
+        select_convention: Select convention
+        date_format_label: Date format
+        rows_to_skip_label: Skip first n rows
+      trade_import:
+        select_column: Select column
+        date_label: Date
+        quantity_label: Quantity
+        buys_are_positive: Buys are positive qty
+        buys_are_negative: Buys are negative qty
+        default: Default
+        currency_label: Currency
+        format_label: Format
+        select_format: Select format
+        ticker_label: Ticker
+        leave_empty: Leave empty
+        stock_exchange_code_label: Stock exchange code
+        price_label: Price
+        account_label: Account
+        name_label: Name
+        note_label: Note
+        no_security_provider_warning: The security prices provider is not configured.  Your trade imports will work, but Sure will not backfill price history.  Please go to your settings to configure this.
+        date_format_label: Date format
+        apply_configuration: Apply configuration
       category_import:
         button_label: Continue
         description: Upload a simple CSV file (like the one we generate when you
@@ -43,6 +112,20 @@ en:
         instructions: Select continue to parse your CSV and move on to the clean step.
       mint_import:
         date_format_label: Date format
+      actual_import:
+        preconfigured_notice: We have pre-configured your Actual Budget import for you. Please proceed to the next step.
+        leave_empty: Leave empty
+        date_label: Date
+        date_format_label: Date format
+        amount_label: Amount
+        signage_convention_label: Signage convention
+        incomes_are_negative: Incomes are negative
+        incomes_are_positive: Incomes are positive
+        account_label: Account (optional)
+        name_label: Payee (optional)
+        category_label: Category (optional)
+        notes_label: Notes (optional)
+        apply_configuration: Apply configuration
       rule_import:
         description: Configure your rule import. Rules will be created or updated based
           on the CSV data.
@@ -51,11 +134,6 @@ en:
       show:
         description: Select the columns that correspond to each field in your CSV.
         title: Configure your import
-      trade_import:
-        date_format_label: Date format
-      transaction_import:
-        date_format_label: Date format
-        rows_to_skip_label: Skip first n rows
     confirms:
       sure_import:
         title: Confirm your import
@@ -73,7 +151,9 @@ en:
           and provide an account name we can use.
         rows_label: Rows
         unassigned_account: Need to create a new account for unassigned rows?
+        next: Next
       show:
+        invalid_data: "You have invalid data, please edit until all errors are resolved"
         account_mapping_description: Assign all of your imported file's accounts to
           Maybe's existing accounts.  You can also add new accounts or leave them
           uncategorized.
@@ -89,7 +169,20 @@ en:
           existing tags.  You can also add new tags or leave them uncategorized.
         tag_mapping_title: Assign your tags
     uploads:
+      update:
+        qif_uploaded: "QIF file uploaded successfully."
       show:
+        csv_invalid: "Must be valid CSV with headers and at least one row of data"
+        drop_csv_title: Drop CSV to upload
+        drop_csv_subtitle: Your file will be uploaded automatically
+        upload_csv_tab: Upload CSV
+        copy_paste_tab: Copy & Paste
+        account_optional_label: Account (optional)
+        multi_account_import: Multi-account import
+        upload_csv_button: Upload CSV
+        paste_csv_placeholder: Paste your CSV file contents here
+        download_sample_csv: Download a sample CSV
+        to_see_format: to see the required CSV format
         qif_title: Upload QIF file
         qif_description: Select the account this QIF file belongs to, then upload your .qif export from Quicken.
         qif_account_label: Account
@@ -119,6 +212,84 @@ en:
         hint_html: Upload the <strong>all.ndjson</strong> file from your data export ZIP
         ndjson_invalid: Must be valid NDJSON with at least one record
   imports:
+    mapping_labels:
+      account_type: "Account Type"
+      account: "Account"
+      category: "Category"
+      tag: "Tag"
+    dry_run_resources:
+      transactions: "Transactions"
+      balances: "Balances"
+      accounts: "Accounts"
+      categories: "Categories"
+      tags: "Tags"
+      rules: "Rules"
+      merchants: "Merchants"
+      recurring_transactions: "Recurring Transactions"
+      transfers: "Transfers"
+      rejected_transfers: "Rejected Transfers"
+      trades: "Trades"
+      holdings: "Holdings"
+      valuations: "Valuations"
+      budgets: "Budgets"
+      budget_categories: "Budget Categories"
+    column_labels:
+      date: "Date"
+      amount: "Amount"
+      name: "Name"
+      currency: "Currency"
+      category: "Category"
+      tags: "Tags"
+      account: "Account"
+      notes: "Notes"
+      qty: "Quantity"
+      ticker: "Ticker"
+      exchange: "Exchange"
+      price: "Price"
+      entity_type: "Type"
+      category_parent: "Parent category"
+      category_color: "Color"
+      category_icon: "Lucide icon"
+    update:
+      account_saved: "Account saved."
+      invalid_account: "Account not found."
+    publish:
+      started: "Your import has started in the background."
+      max_rows_exceeded: "Your import exceeds the maximum row count of %{max}."
+    revert:
+      started: "Import is reverting in the background."
+    apply_template:
+      template_applied: "Template applied."
+      no_template_found: "No template found, please manually configure your import."
+    destroy:
+      deleted: "Your import has been deleted."
+    failure:
+      title: Import failed
+      description: Please check that your file format, for any errors and that all required fields are filled, then come back and try again.
+      try_again: Try again
+    success:
+      title: Import successful
+      description: Your imported data has been successfully added to the app and is now ready for use.
+      back_to_dashboard: Back to dashboard
+      verification:
+        title: Readback verification
+        checked: Checked
+        mismatches: Mismatches
+        status:
+          not_verified: Not verified
+          matched: Matched
+          mismatch: Mismatch
+          failed: Failed
+          reverted: Reverted
+    importing:
+      title: Import in progress
+      description: "Your import is in progress. Check the imports menu for status updates or click 'Check Status' to refresh the page for updates. Feel free to continue using the app."
+      check_status: Check status
+      back_to_dashboard: Back to dashboard
+    revert_failure:
+      title: Reverting import failed
+      description: Please try again
+      try_again: Try again
     date_format:
       heading: Date format
       description: "The date format was auto-detected from your file. Change it if dates look incorrect."
@@ -130,6 +301,7 @@ en:
       trade_import: "Trade import"
       account_import: "Account import"
       mint_import: "Mint import"
+      actual_import: "Actual import"
       qif_import: "QIF import"
       category_import: "Category import"
       rule_import: "Rule import"
@@ -143,6 +315,9 @@ en:
       map: Map
       confirm: Confirm
       select: Select
+      progress: "Step %{step} of %{total}"
+    empty:
+      message: No imports found.
     index:
       title: Imports
       new: New Import
@@ -159,6 +334,7 @@ en:
           trade_import: "Trade"
           account_import: "Account"
           mint_import: "Mint"
+          actual_import: "Actual"
           qif_import: "QIF"
           category_import: "Category"
           rule_import: "Rule"
@@ -187,6 +363,7 @@ en:
       import_accounts: Import accounts
       import_categories: Import categories
       import_mint: Import from Mint
+      import_actual: Import from Actual Budget
       import_portfolio: Import investments
       import_rules: Import rules
       import_transactions: Import transactions
@@ -255,3 +432,21 @@ en:
       unknown_state_description: This import is in an unexpected state. Please return to imports.
       processing_failed_with_message: "%{message}"
       processing_failed_generic: "Processing failed: %{error}"
+      ready_for_review_title: Ready for Review
+      ready_for_review_description: "We extracted %{count} transactions from your statement. Review and publish them to add to your account."
+      transactions_extracted: Transactions Extracted
+      transactions_extracted_count:
+        one: "%{count} transaction"
+        other: "%{count} transactions"
+      select_account: Import to Account
+      select_account_placeholder: Select an account...
+      select_account_hint: Choose which account to import these transactions into.
+      no_accounts: No accounts available. Please create an account first.
+      create_account: Create Account
+      save_account: Save
+      publish_transactions:
+        one: "Publish %{count} Transaction"
+        other: "Publish %{count} Transactions"
+      review_transactions: Review Transactions
+      select_account_to_continue: Please select an account above to continue.
+      unknown_document_type: Unknown
diff --git a/config/locales/views/imports/fr.yml b/config/locales/views/imports/fr.yml
index 4a34d031f..0ca426ad2 100644
--- a/config/locales/views/imports/fr.yml
+++ b/config/locales/views/imports/fr.yml
@@ -19,12 +19,12 @@ fr:
         txn_count:
           one: "1 opération"
           other: "%{count} opérations"
-        empty_state_primary: Aucune catégorie ou étiquette trouvée dans ce fichier QIF.
-        empty_state_secondary: Toutes les transactions seront importées sans catégories ni étiquettes.
-        submit: Continuer vers la revue
         split_warning_title: Transactions scindées détectées
         split_warning_description: "Ce fichier QIF contient des transactions scindées. Les transactions scindées ne sont pas encore prises en charge : chaque transaction scindée sera importée comme une transaction unique avec son montant total et sans catégorie. Les ventilations individuelles ne seront pas conservées."
         split_badge: scindée
+        empty_state_primary: Aucune catégorie ou étiquette trouvée dans ce fichier QIF.
+        empty_state_secondary: Toutes les transactions seront importées sans catégories ni étiquettes.
+        submit: Continuer vers la revue
     cleans:
       show:
         description: Modifiez vos données dans le tableau ci-dessous. Les cellules rouges sont invalides.
@@ -111,6 +111,17 @@ fr:
       preview: "Première date analysée"
       error_title: "Impossible de détecter le format de date"
       error_description: "Aucun des formats de date pris en charge n'a pu analyser les dates dans ce fichier. Veuillez vérifier que le fichier contient des entrées de date valides."
+    type_labels:
+      transaction_import: "Import de transactions"
+      trade_import: "Import de transactions boursières"
+      account_import: "Import de comptes"
+      mint_import: "Import Mint"
+      qif_import: "Import QIF"
+      category_import: "Import de catégories"
+      rule_import: "Import de règles"
+      pdf_import: "Import PDF"
+      document_import: "Import de document"
+      sure_import: "Import Sure"
     steps:
       upload: Téléverser
       configure: Configurer
@@ -120,7 +131,6 @@ fr:
       select: Sélectionner
     index:
       title: Importations
-      imports: Imports
       new: Nouvelle importation
     table:
       title: Imports
@@ -130,6 +140,17 @@ fr:
         status: Statut
         actions: Actions
       row:
+        type_labels:
+          transaction_import: "Transaction"
+          trade_import: "Transaction boursière"
+          account_import: "Compte"
+          mint_import: "Mint"
+          qif_import: "QIF"
+          category_import: "Catégorie"
+          rule_import: "Règle"
+          pdf_import: "PDF"
+          document_import: "Document"
+          sure_import: "Sure"
         status:
           in_progress: En cours
           uploading: Traitement des lignes
@@ -144,7 +165,11 @@ fr:
           view: Afficher
       empty: Aucune importation pour l'instant.
     new:
-      description: Vous pouvez manuellement importer divers types de données via CSV ou utiliser un des modèles d'importation que nous proposons comme Mint.
+      description: Importez depuis un outil financier ou téléversez des fichiers de données bruts.
+      tab_financial_tools: Outils financiers et fichiers
+      tab_raw_data: Données brutes
+      coming_soon: Bientôt disponible
+      import_ynab: Importer depuis YNAB
       import_accounts: Importer les comptes
       import_categories: Importer les catégories
       import_mint: Importer depuis Mint
@@ -152,16 +177,19 @@ fr:
       import_rules: Importer les règles
       import_transactions: Importer les transactions
       import_qif: Importer depuis Quicken (QIF)
+      import_sure: Importer depuis Sure
+      import_sure_description: Fichier .ndjson d'export complet
       import_file: Importer un document
-      import_file_description: Analyse par IA pour les PDFs et téléversement avec recherche pour les autres fichiers pris en charge
+      import_file_description: Analyse par IA pour les PDF et téléversement de fichiers avec recherche
       requires_account: Importez d'abord des comptes pour débloquer cette option.
       resume: Reprendre %{type}
       sources: Sources
-      title: Nouvelle importation CSV
+      title: Nouvelle importation
     create:
       file_too_large: Le fichier est trop volumineux. La taille maximale est de %{max_size} Mo.
       invalid_file_type: Type de fichier invalide. Veuillez téléverser un fichier CSV.
       csv_uploaded: CSV téléversé avec succès.
+      ndjson_uploaded: Fichier NDJSON téléversé avec succès.
       pdf_too_large: Le fichier PDF est trop volumineux. La taille maximale est de %{max_size} Mo.
       pdf_processing: Votre PDF est en cours de traitement. Vous recevrez un e-mail lorsque l'analyse sera terminée.
       invalid_pdf: Le fichier téléversé n'est pas un PDF valide.
@@ -169,10 +197,19 @@ fr:
       invalid_document_file_type: Type de fichier de document invalide pour le magasin de vecteurs actif.
       document_uploaded: Document téléversé avec succès.
       document_upload_failed: Nous n'avons pas pu téléverser le document dans le magasin de vecteurs. Veuillez réessayer.
+      invalid_ndjson_file_type: Type ou format de fichier invalide. Veuillez téléverser un fichier d'export .ndjson ou .json valide.
       document_provider_not_configured: Aucun magasin de vecteurs n'est configuré pour les téléversements de documents.
     show:
       finalize_upload: Veuillez finaliser le téléversement de votre fichier.
       finalize_mappings: Veuillez finaliser vos correspondances avant de continuer.
+    ready:
+      description: Voici un résumé des nouveaux éléments qui seront ajoutés à votre compte une fois que vous aurez publié cette importation.
+      title: Confirmez vos données d'importation
+      summary_item_label: Élément
+      summary_count_label: Nombre
+      empty_summary: Aucun enregistrement importable n'a été trouvé dans ce fichier. Il est peut-être vide, ou les lignes ne correspondent pas au format d'export attendu (chaque ligne doit être un objet JSON avec les clés « type » et « data », pour des types pris en charge par cet import).
+      publish_import: Publier l'importation
+      back_to_imports: Retour aux importations
     errors:
       custom_column_requires_inflow: "Les importations de colonnes personnalisées nécessitent la sélection d'une colonne d'entrée"
     document_types:
@@ -202,11 +239,3 @@ fr:
       unknown_state_description: Cette importation est dans un état inattendu. Veuillez retourner aux importations.
       processing_failed_with_message: "%{message}"
       processing_failed_generic: "Traitement échoué : %{error}"
-    ready:
-      description: Voici un résumé des nouveaux éléments qui seront ajoutés à votre compte une fois que vous aurez publié cette importation.
-      title: Confirmez vos données d'importation
-      summary_item_label: Élément
-      summary_count_label: Nombre
-      empty_summary: Aucun enregistrement importable n'a été trouvé dans ce fichier. Il est peut-être vide, ou les lignes ne correspondent pas au format d'export attendu (chaque ligne doit être un objet JSON avec les clés « type » et « data », pour des types pris en charge par cet import).
-      publish_import: Publier l'importation
-      back_to_imports: Retour aux importations
diff --git a/config/locales/views/imports/hu.yml b/config/locales/views/imports/hu.yml
new file mode 100644
index 000000000..8221e18fe
--- /dev/null
+++ b/config/locales/views/imports/hu.yml
@@ -0,0 +1,393 @@
+---
+hu:
+  import:
+    qif_category_selections:
+      update:
+        success: "Kategóriák és címkék mentve."
+      show:
+        title: "Konfigurálás és kiválasztás"
+        description: "Ellenőrizd az automatikusan felismert dátumformátumot, majd válaszd ki, mely kategóriákat és címkéket szeretnéd beimportálni a QIF fájlodból a %{product_name} alkalmazásba."
+        categories_heading: Kategóriák
+        categories_found:
+          one: "1 kategória található"
+          other: "%{count} kategória található"
+        category_name_col: Kategória neve
+        transactions_col: Tranzakciók
+        tags_heading: Címkék
+        tags_found:
+          one: "1 címke található"
+          other: "%{count} címke található"
+        tag_name_col: Címke neve
+        txn_count:
+          one: "1 tranzakció"
+          other: "%{count} tranzakció"
+        split_warning_title: Felosztott tranzakciók észlelve
+        split_warning_description: "Ez a QIF fájl felosztott tranzakciókat tartalmaz. A felosztott tranzakciókat még nem támogatjuk, ezért minden ilyen tranzakció teljes összegével, kategória nélkül kerül importálásra. Az egyes felosztási részletek nem őrződnek meg."
+        split_badge: felosztott
+        empty_state_primary: Ebben a QIF fájlban nem találhatók kategóriák vagy címkék.
+        empty_state_secondary: Minden tranzakció kategóriák és címkék nélkül kerül importálásra.
+        submit: Tovább az áttekintéshez
+    cleans:
+      show:
+        not_configured: "Kérjük, konfiguráld az importálást a folytatás előtt."
+        description: Szerkeszd az adatokat az alábbi táblázatban. A piros cellák érvénytelen adatokat tartalmaznak.
+        errors_notice: Hibák vannak az adataidban. Vidd az egeret a hiba fölé a részletekért.
+        errors_notice_mobile: Hibák vannak az adataidban. Koppints a hibajelzőre a részletekért.
+        title: Adatok megtisztítása
+        data_cleaned: Az adataid megtisztítva
+        next_step: Következő lépés
+        all_rows: Összes sor
+        error_rows: Hibasorok
+    configurations:
+      update:
+        success: Az importálás konfigurálása sikeresen megtörtént.
+      account_import:
+        leave_empty: Hagyd üresen
+        default: Alapértelmezett
+        entity_type: Entitástípus
+        name: Név
+        balance: Egyenleg
+        currency: Pénznem
+        balance_date: Egyenleg dátuma
+        date_format: Dátumformátum
+        select_format: Formátum kiválasztása
+        apply_configuration: Konfiguráció alkalmazása
+      transaction_import:
+        date_label: Dátum
+        select_column: Oszlop kiválasztása
+        select_format: Formátum kiválasztása
+        amount_label: Összeg
+        default: Alapértelmezett
+        currency_label: Pénznem
+        format_label: Formátum
+        amount_type_strategy_label: Összeg típusának stratégiája
+        select_strategy: Stratégia kiválasztása
+        set: Beállítás
+        as_amount_type_column: összeg típusa oszlopként
+        select_value: Érték kiválasztása
+        as_identifier_value: azonosítóértékként
+        treat_as_html: "Kezeld a \"<span class=\"font-medium\">%{value}</span>\" értéket így:"
+        income_inflow: Bevétel (beérkező)
+        expense_outflow: Kiadás (kimenő)
+        select_type: Típus kiválasztása
+        leave_empty: Hagyd üresen
+        account_label: Számla
+        name_label: Név
+        category_label: Kategória
+        tags_label: Címkék
+        notes_label: Megjegyzések
+        apply_configuration: Konfiguráció alkalmazása
+        incomes_are_positive: A bevételek pozitívak
+        incomes_are_negative: A bevételek negatívak
+        amount_type_label: Összeg típusa
+        select_convention: Egyezmény kiválasztása
+        date_format_label: Dátumformátum
+        rows_to_skip_label: Első n sor kihagyása
+      trade_import:
+        select_column: Oszlop kiválasztása
+        date_label: Dátum
+        quantity_label: Mennyiség
+        buys_are_positive: A vételek pozitív mennyiségűek
+        buys_are_negative: A vételek negatív mennyiségűek
+        default: Alapértelmezett
+        currency_label: Pénznem
+        format_label: Formátum
+        select_format: Formátum kiválasztása
+        ticker_label: Tőzsdei szimbólum
+        leave_empty: Hagyd üresen
+        stock_exchange_code_label: Tőzsde kódja
+        price_label: Ár
+        account_label: Számla
+        name_label: Név
+        note_label: Megjegyzés
+        no_security_provider_warning: Az értékpapír-árszolgáltató nincs konfigurálva. Az ügyletek importálása működni fog, de a Sure nem tölti fel a korábbi árfolyamadatokat. Kérjük, menj a beállításokhoz és konfiguráld.
+        date_format_label: Dátumformátum
+        apply_configuration: Konfiguráció alkalmazása
+      category_import:
+        button_label: Folytatás
+        description: Tölts fel egy egyszerű CSV fájlt (például olyat, amit az adatexportáláskor generálunk). Az oszlopokat automatikusan leképezzük neked.
+        instructions: Kattints a Folytatás gombra a CSV feldolgozásához és a megtisztítási lépéshez való továbblépéshez.
+      mint_import:
+        date_format_label: Dátumformátum
+      rule_import:
+        description: Konfiguráld a szabályimportálást. A szabályok a CSV adatok alapján lesznek létrehozva vagy frissítve.
+        process_button: Szabályok feldolgozása
+        process_help: Kattints az alábbi gombra a CSV feldolgozásához és a szabálysorok generálásához.
+      show:
+        description: Válaszd ki, melyik oszlopok felelnek meg a CSV egyes mezőinek.
+        title: Importálás konfigurálása
+    confirms:
+      sure_import:
+        title: Importálás megerősítése
+        description: Ellenőrizd az exportfájlból importálandó adatokat.
+        summary: Importálás összefoglalója
+        empty_summary: Nem találtunk importálható rekordokat ebben a fájlban. Lehetséges, hogy üres, vagy a sorok nem felelnek meg a várt exportformátumnak (minden sornak egy JSON objektumnak kell lennie „type" és „data" kulcsokkal, az importálás által támogatott típusokkal).
+        publish_button: Importálás indítása
+        cancel: Mégse
+      mappings:
+        create_account: Számla létrehozása
+        csv_mapping_label: "%{mapping} a CSV-ben"
+        sure_mapping_label: "%{mapping} a %{product_name} alkalmazásban"
+        no_accounts: Még nincs egyetlen számlád sem. Kérjük, hozz létre egy számlát a CSV-ben nem hozzárendelt sorokhoz, vagy lépj vissza a Megtisztítás lépéshez, és adj meg egy használható számlanevet.
+        rows_label: Sorok
+        unassigned_account: Új számlát kell létrehoznod a nem hozzárendelt sorokhoz?
+        next: Tovább
+      show:
+        invalid_data: "Érvénytelen adatok találhatók, kérjük szerkeszd, amíg minden hibát ki nem javítasz"
+        account_mapping_description: Rendeld hozzá az importált fájl számláit a Maybe meglévő számláihoz. Új számlákat is hozzáadhatsz, vagy hagyhatod őket kategorizálatlanul.
+        account_mapping_title: Számlák hozzárendelése
+        account_type_mapping_description: Rendeld hozzá az importált fájl számlatípusait a Maybe típusaihoz.
+        account_type_mapping_title: Számlatípusok hozzárendelése
+        category_mapping_description: Rendeld hozzá az importált fájl kategóriáit a Maybe meglévő kategóriáihoz. Új kategóriákat is hozzáadhatsz, vagy hagyhatod őket kategorizálatlanul.
+        category_mapping_title: Kategóriák hozzárendelése
+        tag_mapping_description: Rendeld hozzá az importált fájl címkéit a Maybe meglévő címkéihez. Új címkéket is hozzáadhatsz, vagy hagyhatod őket kategorizálatlanul.
+        tag_mapping_title: Címkék hozzárendelése
+    uploads:
+      update:
+        qif_uploaded: "QIF fájl sikeresen feltöltve."
+      show:
+        csv_invalid: "Érvényes CSV szükséges fejlécekkel és legalább egy adatsorral"
+        drop_csv_title: Húzd ide a CSV fájlt a feltöltéshez
+        drop_csv_subtitle: A fájl automatikusan feltöltődik
+        upload_csv_tab: CSV feltöltése
+        copy_paste_tab: Másolás és beillesztés
+        account_optional_label: Számla (nem kötelező)
+        multi_account_import: Több számlás importálás
+        upload_csv_button: CSV feltöltése
+        paste_csv_placeholder: Illeszd be ide a CSV fájl tartalmát
+        download_sample_csv: Minta CSV letöltése
+        to_see_format: a szükséges CSV formátum megtekintéséhez
+        qif_title: QIF fájl feltöltése
+        qif_description: Válaszd ki azt a számlát, amelyhez ez a QIF fájl tartozik, majd töltsd fel a Quickenből exportált .qif fájlodat.
+        qif_account_label: Számla
+        qif_account_placeholder: Válassz számlát…
+        qif_file_prompt: a QIF fájl idehelyezéséhez
+        qif_file_hint: Csak .qif fájlok
+        qif_submit: QIF feltöltése
+        browse: Tallózás
+        csv_file_prompt: a CSV fájl idehelyezéséhez
+        description: Illeszd be vagy töltsd fel az alábbi CSV fájlodat. Kérjük, az importálás megkezdése előtt tekintsd át az alábbi táblázatban lévő útmutatót.
+        instructions_1: Az alábbiakban egy példa CSV látható az importáláshoz elérhető oszlopokkal.
+        instructions_2: A CSV-nek fejlécsorral kell rendelkeznie
+        instructions_3: Az oszlopokat tetszőlegesen elnevezheted. Egy későbbi lépésben fogod majd leképezni őket.
+        instructions_4: A csillaggal (*) jelölt oszlopok kötelező adatokat tartalmaznak.
+        instructions_5: Számokban ne szerepeljen vessző, pénznemjel vagy zárójel.
+        title: Adatok importálása
+      sure_import:
+        title: Importálás exportból
+        description: Töltsd fel az all.ndjson fájlt az adatexportodból a számlák, tranzakciók, kategóriák és egyéb adatok visszaállításához.
+        drop_title: Húzd ide az NDJSON fájlt a feltöltéshez
+        drop_subtitle: A fájl automatikusan feltöltődik
+        browse: Tallózás
+        browse_hint: az all.ndjson fájl hozzáadásához
+        upload_button: NDJSON feltöltése
+        hint_html: Töltsd fel az <strong>all.ndjson</strong> fájlt az adatexport ZIP archívumból
+        ndjson_invalid: Érvényes NDJSON szükséges, legalább egy rekorddal
+  imports:
+    mapping_labels:
+      account_type: "Számlatípus"
+      account: "Számla"
+      category: "Kategória"
+      tag: "Címke"
+    column_labels:
+      date: "Dátum"
+      amount: "Összeg"
+      name: "Név"
+      currency: "Pénznem"
+      category: "Kategória"
+      tags: "Címkék"
+      account: "Számla"
+      notes: "Megjegyzések"
+      qty: "Mennyiség"
+      ticker: "Tőzsdei szimbólum"
+      exchange: "Tőzsde"
+      price: "Ár"
+      entity_type: "Típus"
+      category_parent: "Szülőkategória"
+      category_color: "Szín"
+      category_icon: "Lucide ikon"
+    update:
+      account_saved: "Számla mentve."
+      invalid_account: "Számla nem található."
+    publish:
+      started: "Az importálás a háttérben elindult."
+      max_rows_exceeded: "Az importálás meghaladja a maximális %{max} soros korlátot."
+    revert:
+      started: "Az importálás visszavonása a háttérben folyamatban van."
+    apply_template:
+      template_applied: "Sablon alkalmazva."
+      no_template_found: "Nem található sablon, kérjük konfiguráld manuálisan az importálást."
+    destroy:
+      deleted: "Az importálás törölve."
+    failure:
+      title: Az importálás sikertelen
+      description: Kérjük, ellenőrizd a fájlformátumot, az esetleges hibákat és hogy minden kötelező mező ki van töltve, majd próbáld újra.
+      try_again: Újrapróbálkozás
+    success:
+      title: Importálás sikeres
+      description: Az importált adatok sikeresen hozzáadásra kerültek az alkalmazáshoz, és most már használhatók.
+      back_to_dashboard: Vissza az irányítópultra
+    importing:
+      title: Importálás folyamatban
+      description: "Az importálás folyamatban van. Az állapotfrissítéseket az importálások menüben ellenőrizheted, vagy kattints az 'Állapot ellenőrzése' gombra az oldal frissítéséhez. Nyugodtan folytasd az alkalmazás használatát."
+      check_status: Állapot ellenőrzése
+      back_to_dashboard: Vissza az irányítópultra
+    revert_failure:
+      title: Az importálás visszavonása sikertelen
+      description: Kérjük, próbáld újra
+      try_again: Újrapróbálkozás
+    date_format:
+      heading: Dátumformátum
+      description: "A dátumformátum automatikusan lett felismerve a fájlból. Módosítsd, ha a dátumok helytelenül jelennek meg."
+      preview: "Első feldolgozott dátum"
+      error_title: "Nem sikerült felismerni a dátumformátumot"
+      error_description: "A támogatott dátumformátumok egyike sem tudta feldolgozni a fájlban szereplő dátumokat. Ellenőrizd, hogy a fájl érvényes dátumbejegyzéseket tartalmaz-e."
+    type_labels:
+      transaction_import: "Tranzakcióimportálás"
+      trade_import: "Kereskedésimportálás"
+      account_import: "Számlaimportálás"
+      mint_import: "Mint importálás"
+      qif_import: "QIF importálás"
+      category_import: "Kategóriaimportálás"
+      rule_import: "Szabályimportálás"
+      pdf_import: "PDF importálás"
+      document_import: "Dokumentumimportálás"
+      sure_import: "Sure importálás"
+    steps:
+      upload: Feltöltés
+      configure: Konfigurálás
+      clean: Megtisztítás
+      map: Leképezés
+      confirm: Megerősítés
+      select: Kiválasztás
+      progress: "%{step}. lépés / %{total}"
+    empty:
+      message: Nem található importálás.
+    index:
+      title: Importálások
+      new: Új importálás
+    table:
+      title: Importálások
+      header:
+        date: Dátum
+        operation: Művelet
+        status: Állapot
+        actions: Műveletek
+      row:
+        type_labels:
+          transaction_import: "Tranzakció"
+          trade_import: "Kereskedés"
+          account_import: "Számla"
+          mint_import: "Mint"
+          qif_import: "QIF"
+          category_import: "Kategória"
+          rule_import: "Szabály"
+          pdf_import: "PDF"
+          document_import: "Dokumentum"
+          sure_import: "Sure"
+        status:
+          in_progress: Folyamatban
+          uploading: Sorok feldolgozása
+          reverting: Visszavonás folyamatban
+          revert_failed: Visszavonás sikertelen
+          complete: Kész
+          failed: Sikertelen
+        actions:
+          revert: Visszavonás
+          confirm_revert: Ez törli az importált tranzakciókat, de bármikor megtekintheted és újra importálhatod az adataidat.
+          delete: Törlés
+          view: Megtekintés
+      empty: Még nincs importálás.
+    new:
+      description: Importálás pénzügyi eszközből vagy nyers adatfájlok feltöltése.
+      tab_financial_tools: Pénzügyi eszközök és fájlok
+      tab_raw_data: Nyers adatok
+      coming_soon: Hamarosan
+      import_ynab: Importálás YNAB-ból
+      import_accounts: Számlák importálása
+      import_categories: Kategóriák importálása
+      import_mint: Importálás Mint-ből
+      import_portfolio: Befektetések importálása
+      import_rules: Szabályok importálása
+      import_transactions: Tranzakciók importálása
+      import_qif: Importálás Quickenből (QIF)
+      import_sure: Importálás Sure-ból
+      import_sure_description: Teljes exportból készült .ndjson fájl
+      import_file: Dokumentum importálása
+      import_file_description: Mesterséges intelligenciával segített PDF-elemzés és kereshető fájlfeltöltés
+      requires_account: Először importálj számlákat a lehetőség feloldásához.
+      resume: "%{type} folytatása"
+      sources: Források
+      title: Új importálás
+    create:
+      file_too_large: A fájl túl nagy. A maximális méret %{max_size} MB.
+      invalid_file_type: Érvénytelen fájltípus. Kérjük, tölts fel CSV fájlt.
+      csv_uploaded: A CSV sikeresen feltöltve.
+      ndjson_uploaded: Az NDJSON fájl sikeresen feltöltve.
+      pdf_too_large: A PDF fájl túl nagy. A maximális méret %{max_size} MB.
+      pdf_processing: A PDF feldolgozás alatt áll. Az elemzés elkészültéről e-mailben értesítünk.
+      invalid_pdf: A feltöltött fájl nem érvényes PDF.
+      document_too_large: A dokumentumfájl túl nagy. A maximális méret %{max_size} MB.
+      invalid_document_file_type: Érvénytelen dokumentumfájl-típus az aktív vektortárhoz.
+      document_uploaded: A dokumentum sikeresen feltöltve.
+      document_upload_failed: Nem sikerült feltölteni a dokumentumot a vektortárba. Kérjük, próbáld újra.
+      invalid_ndjson_file_type: Érvénytelen fájltípus vagy formátum. Kérjük, tölts fel érvényes .ndjson vagy .json exportfájlt.
+      document_provider_not_configured: Nincs vektortár konfigurálva dokumentumfeltöltéshez.
+    show:
+      finalize_upload: Kérjük, fejezd be a fájlfeltöltést.
+      finalize_mappings: Kérjük, véglegesítsd a leképezéseket a továbblépés előtt.
+    ready:
+      description: Íme egy összefoglaló azokról az új elemekről, amelyek a számládhoz kerülnek, miután közzéteszed ezt az importálást.
+      title: Importált adatok megerősítése
+      summary_item_label: Elem
+      summary_count_label: Darab
+      empty_summary: Nem találtunk importálható rekordokat ebben a fájlban. Lehetséges, hogy üres, vagy a sorok nem felelnek meg a várt exportformátumnak (minden sornak egy JSON objektumnak kell lennie „type" és „data" kulcsokkal, az importálás által támogatott típusokkal).
+      publish_import: Importálás közzététele
+      back_to_imports: Vissza az importálásokhoz
+    errors:
+      custom_column_requires_inflow: "Az egyéni oszlopos importáláshoz be kell jelölni egy beérkező összeg oszlopot"
+    document_types:
+      bank_statement: Bankszámlakivonat
+      credit_card_statement: Hitelkártyakivonat
+      investment_statement: Befektetési kimutatás
+      financial_document: Pénzügyi dokumentum
+      contract: Szerződés
+      other: Egyéb dokumentum
+      unknown: Ismeretlen dokumentum
+    pdf_import:
+      processing_title: PDF feldolgozása folyamatban
+      processing_description: Mesterséges intelligenciával elemezzük a dokumentumodat. Ez eltarthat egy ideig. Az elemzés elkészültéről e-mailben értesítünk.
+      check_status: Állapot ellenőrzése
+      back_to_dashboard: Vissza az irányítópultra
+      failed_title: Feldolgozás sikertelen
+      failed_description: Nem sikerült feldolgozni a PDF dokumentumodat. Kérjük, próbáld újra, vagy vedd fel a kapcsolatot az ügyfélszolgálattal.
+      try_again: Újrapróbálkozás
+      delete_import: Importálás törlése
+      complete_title: Dokumentum elemezve
+      complete_description: Elemeztük a PDF-edet, és íme, amit találtunk.
+      document_type_label: Dokumentum típusa
+      summary_label: Összefoglaló
+      email_sent_notice: E-mailben elküldtük a következő lépéseket.
+      back_to_imports: Vissza az importálásokhoz
+      unknown_state_title: Ismeretlen állapot
+      unknown_state_description: Ez az importálás váratlan állapotban van. Kérjük, térj vissza az importálásokhoz.
+      processing_failed_with_message: "%{message}"
+      processing_failed_generic: "Feldolgozási hiba: %{error}"
+      ready_for_review_title: Felülvizsgálatra kész
+      ready_for_review_description: "%{count} tranzakciót vontunk ki a kimutatásodból. Ellenőrizd és tedd közzé, hogy hozzáadódjon a számládhoz."
+      transactions_extracted: Kinyert tranzakciók
+      transactions_extracted_count:
+        one: "%{count} tranzakció"
+        other: "%{count} tranzakció"
+      select_account: Importálás számlára
+      select_account_placeholder: Válassz számlát...
+      select_account_hint: Válaszd ki, melyik számlára szeretnéd importálni ezeket a tranzakciókat.
+      no_accounts: Nincs elérhető számla. Kérjük, először hozz létre egyet.
+      create_account: Számla létrehozása
+      save_account: Mentés
+      publish_transactions:
+        one: "%{count} tranzakció közzététele"
+        other: "%{count} tranzakció közzététele"
+      review_transactions: Tranzakciók áttekintése
+      select_account_to_continue: A folytatáshoz kérjük, válassz fentebb számlát.
+      unknown_document_type: Ismeretlen
diff --git a/config/locales/views/imports/nl.yml b/config/locales/views/imports/nl.yml
index 31a2d3678..3d40a4e90 100644
--- a/config/locales/views/imports/nl.yml
+++ b/config/locales/views/imports/nl.yml
@@ -37,13 +37,13 @@ nl:
         rows_label: Rijen
         unassigned_account: Moet u een nieuw account aanmaken voor niet-toegewezen rijen?
       show:
-        account_mapping_description: Wijs alle accounts van uw geïmporteerde bestand toe aan bestaande %{product_name} accounts. U kunt ook nieuwe accounts toevoegen of ze ongecategoriseerd laten.
+        account_mapping_description: Wijs alle accounts van uw geïmporteerde bestand toe aan bestaande %{product} accounts. U kunt ook nieuwe accounts toevoegen of ze ongecategoriseerd laten.
         account_mapping_title: Uw accounts toewijzen
-        account_type_mapping_description: Wijs alle accounttypen van uw geïmporteerde bestand toe aan %{product_name} accounttypen
+        account_type_mapping_description: Wijs alle accounttypen van uw geïmporteerde bestand toe aan %{product} accounttypen
         account_type_mapping_title: Uw accounttypen toewijzen
-        category_mapping_description: Wijs alle categorieën van uw geïmporteerde bestand toe aan bestaande %{product_name} categorieën. U kunt ook nieuwe categorieën toevoegen of ze ongecategoriseerd laten.
+        category_mapping_description: Wijs alle categorieën van uw geïmporteerde bestand toe aan bestaande %{product} categorieën. U kunt ook nieuwe categorieën toevoegen of ze ongecategoriseerd laten.
         category_mapping_title: Uw categorieën toewijzen
-        tag_mapping_description: Wijs alle tags van uw geïmporteerde bestand toe aan bestaande %{product_name} tags. U kunt ook nieuwe tags toevoegen of ze ongecategoriseerd laten.
+        tag_mapping_description: Wijs alle tags van uw geïmporteerde bestand toe aan bestaande %{product} tags. U kunt ook nieuwe tags toevoegen of ze ongecategoriseerd laten.
         tag_mapping_title: Uw tags toewijzen
     uploads:
       show:
diff --git a/config/locales/views/imports/pt-BR.yml b/config/locales/views/imports/pt-BR.yml
index 84edb7b83..15b71dc0e 100644
--- a/config/locales/views/imports/pt-BR.yml
+++ b/config/locales/views/imports/pt-BR.yml
@@ -36,18 +36,18 @@ pt-BR:
         unassigned_account: Precisa criar uma nova conta para linhas não atribuídas?
       show:
         account_mapping_description: Atribua todas as contas do seu arquivo importado às
-          contas existentes no %{product_name}. Você também pode adicionar novas contas ou deixá-las
+          contas existentes no %{product}. Você também pode adicionar novas contas ou deixá-las
           sem categoria.
         account_mapping_title: Atribuir suas contas
         account_type_mapping_description: Atribuir todos os tipos de conta do seu arquivo importado aos
-          do %{product_name}
+          do %{product}
         account_type_mapping_title: Atribuir seus tipos de conta
         category_mapping_description: Atribua todas as categorias do seu arquivo importado às
-          categorias existentes no %{product_name}. Você também pode adicionar novas categorias ou deixá-las
+          categorias existentes no %{product}. Você também pode adicionar novas categorias ou deixá-las
           sem categoria.
         category_mapping_title: Atribuir suas categorias
         tag_mapping_description: Atribua todas as tags do seu arquivo importado às 
-          tags existentes no %{product_name}. Você também pode adicionar novas tags ou deixá-las
+          tags existentes no %{product}. Você também pode adicionar novas tags ou deixá-las
           sem categoria.
         tag_mapping_title: Atribuir suas tags
     uploads:
diff --git a/config/locales/views/imports/tr.yml b/config/locales/views/imports/tr.yml
index 8296d655c..7aaaaf079 100644
--- a/config/locales/views/imports/tr.yml
+++ b/config/locales/views/imports/tr.yml
@@ -26,13 +26,13 @@ tr:
         rows_label: Satırlar
         unassigned_account: Atanmamış satırlar için yeni bir hesap oluşturmak ister misiniz?
       show:
-        account_mapping_description: "İçe aktardığınız dosyadaki tüm hesapları %{product_name}'deki mevcut hesaplara eşleyin. Ayrıca yeni hesaplar ekleyebilir veya kategorize etmeden bırakabilirsiniz."
+        account_mapping_description: "İçe aktardığınız dosyadaki tüm hesapları %{product}'deki mevcut hesaplara eşleyin. Ayrıca yeni hesaplar ekleyebilir veya kategorize etmeden bırakabilirsiniz."
         account_mapping_title: Hesaplarınızı eşleyin
-        account_type_mapping_description: "İçe aktardığınız dosyadaki tüm hesap türlerini %{product_name}'deki hesap türlerine eşleyin."
+        account_type_mapping_description: "İçe aktardığınız dosyadaki tüm hesap türlerini %{product}'deki hesap türlerine eşleyin."
         account_type_mapping_title: Hesap türlerinizi eşleyin
-        category_mapping_description: "İçe aktardığınız dosyadaki tüm kategorileri %{product_name}'deki mevcut kategorilere eşleyin. Ayrıca yeni kategoriler ekleyebilir veya kategorize etmeden bırakabilirsiniz."
+        category_mapping_description: "İçe aktardığınız dosyadaki tüm kategorileri %{product}'deki mevcut kategorilere eşleyin. Ayrıca yeni kategoriler ekleyebilir veya kategorize etmeden bırakabilirsiniz."
         category_mapping_title: Kategorilerinizi eşleyin
-        tag_mapping_description: "İçe aktardığınız dosyadaki tüm etiketleri %{product_name}'deki mevcut etiketlere eşleyin. Ayrıca yeni etiketler ekleyebilir veya kategorize etmeden bırakabilirsiniz."
+        tag_mapping_description: "İçe aktardığınız dosyadaki tüm etiketleri %{product}'deki mevcut etiketlere eşleyin. Ayrıca yeni etiketler ekleyebilir veya kategorize etmeden bırakabilirsiniz."
         tag_mapping_title: Etiketlerinizi eşleyin
     uploads:
       show:
diff --git a/config/locales/views/imports/zh-CN.yml b/config/locales/views/imports/zh-CN.yml
index 8ea66765b..3c5493f86 100644
--- a/config/locales/views/imports/zh-CN.yml
+++ b/config/locales/views/imports/zh-CN.yml
@@ -34,13 +34,13 @@ zh-CN:
         sure_mapping_label: "%{product_name} 中的 %{mapping}"
         unassigned_account: 需要为未分配行创建新账户？
       show:
-        account_mapping_description: 将导入文件中的所有账户分配到 %{product_name} 的现有账户。您也可以新建账户或保留为未分类。
+        account_mapping_description: 将导入文件中的所有账户分配到 %{product} 的现有账户。您也可以新建账户或保留为未分类。
         account_mapping_title: 分配账户
-        account_type_mapping_description: 将导入文件中的所有账户类型分配到 %{product_name} 的账户类型
+        account_type_mapping_description: 将导入文件中的所有账户类型分配到 %{product} 的账户类型
         account_type_mapping_title: 分配账户类型
-        category_mapping_description: 将导入文件中的所有分类分配到 %{product_name} 的现有分类。您也可以新建分类或保留为未分类。
+        category_mapping_description: 将导入文件中的所有分类分配到 %{product} 的现有分类。您也可以新建分类或保留为未分类。
         category_mapping_title: 分配分类
-        tag_mapping_description: 将导入文件中的所有标签分配到 %{product_name} 的现有标签。您也可以新建标签或保留为未分类。
+        tag_mapping_description: 将导入文件中的所有标签分配到 %{product} 的现有标签。您也可以新建标签或保留为未分类。
         tag_mapping_title: 分配标签
     uploads:
       show:
diff --git a/config/locales/views/indexa_capital_items/ca.yml b/config/locales/views/indexa_capital_items/ca.yml
new file mode 100644
index 000000000..e8daf63ac
--- /dev/null
+++ b/config/locales/views/indexa_capital_items/ca.yml
@@ -0,0 +1,249 @@
+---
+ca:
+  indexa_capital_items:
+    complete_account_setup:
+      all_skipped: S'han omès tots els comptes. No s'ha creat cap compte.
+      creation_failed: 'No s''han pogut crear els comptes: %{error}'
+      no_accounts: No hi ha comptes per configurar.
+      success: S'han creat correctament %{count} compte(s).
+    create:
+      success: La connexió Indexa Capital s'ha creat correctament
+    destroy:
+      success: La connexió Indexa Capital s'ha eliminat
+    errors:
+      provider_not_configured: El proveïdor Indexa Capital no està configurat
+    index:
+      title: Connexions Indexa Capital
+    indexa_capital_item:
+      accounts_need_setup: Els comptes necessiten configuració
+      delete: Elimina la connexió
+      deletion_in_progress: eliminació en curs...
+      error: Error
+      more_accounts_available:
+        one: "%{count} compte més disponible"
+        other: "%{count} comptes més disponibles"
+      no_accounts_description: Aquesta connexió encara no té comptes enllaçats.
+      no_accounts_title: No hi ha comptes
+      provider_name: Indexa Capital
+      requires_update: La connexió necessita actualització
+      setup_action: Configura els nous comptes
+      setup_description: "%{linked} de %{total} comptes enllaçats. Tria els tipus
+        de compte per als teus nous comptes Indexa Capital importats."
+      setup_needed: Nous comptes a punt per configurar
+      status: Sincronitzat fa %{timestamp} — %{summary}
+      status_never: Mai sincronitzat
+      syncing: Sincronitzant...
+      total: Total
+      unlinked: Sense enllaç
+      update_credentials: Actualitza les credencials
+    institution_summary:
+      count:
+        one: "%{count} entitat"
+        other: "%{count} entitats"
+      none: No hi ha entitats connectades
+    link_accounts:
+      all_already_linked:
+        one: El compte seleccionat (%{names}) ja està enllaçat
+        other: 'Tots els %{count} comptes seleccionats ja estan enllaçats: %{names}'
+      api_error: 'Error de l''API: %{message}'
+      invalid_account_names:
+        one: No es pot enllaçar un compte sense nom
+        other: No es poden enllaçar %{count} comptes sense nom
+      link_failed: No s'han pogut enllaçar els comptes
+      no_accounts_selected: Selecciona almenys un compte
+      no_api_key: No s'han trobat les credencials d'Indexa Capital. Configura-les a
+        la configuració del proveïdor.
+      partial_invalid: S'han enllaçat correctament %{created_count} compte(s), %{already_linked_count}
+        ja estaven enllaçats, %{invalid_count} compte(s) tenien noms no vàlids
+      partial_success: 'S''han enllaçat correctament %{created_count} compte(s). %{already_linked_count}
+        compte(s) ja estaven enllaçats: %{already_linked_names}'
+      success:
+        one: S'ha enllaçat correctament %{count} compte
+        other: S'han enllaçat correctament %{count} comptes
+    link_existing_account:
+      account_already_linked: Aquest compte ja està enllaçat a un proveïdor
+      api_error: 'Error de l''API: %{message}'
+      invalid_account_name: No es pot enllaçar un compte sense nom
+      missing_parameters: Falten paràmetres obligatoris
+      no_api_key: No s'han trobat les credencials d'Indexa Capital. Configura-les a
+        la configuració del proveïdor.
+      provider_account_already_linked: Aquest compte Indexa Capital ja està enllaçat
+        a un altre compte
+      provider_account_not_found: No s'ha trobat el compte Indexa Capital
+      success: S'ha enllaçat correctament %{account_name} amb Indexa Capital
+    loading:
+      loading_message: Carregant comptes d'Indexa Capital...
+      loading_title: Carregant
+    panel:
+      alternative_auth: O utilitza l'autenticació amb nom d'usuari/contrasenya...
+      field_descriptions: 'Descripció dels camps:'
+      fields:
+        api_token:
+          description: El teu token API només de lectura del panell d'Indexa Capital
+          label: Token API
+          placeholder_new: Enganxa el teu token API aquí
+          placeholder_update: Introdueix un nou token API per actualitzar
+        document:
+          description: El teu document/ID d'Indexa Capital
+          label: ID del document
+          placeholder_new: Enganxa l'ID del document aquí
+          placeholder_update: Introdueix un nou ID de document per actualitzar
+        password:
+          description: La teva contrasenya d'Indexa Capital
+          label: Contrasenya
+          placeholder_new: Enganxa la contrasenya aquí
+          placeholder_update: Introdueix una nova contrasenya per actualitzar
+        username:
+          description: El teu nom d'usuari/correu electrònic d'Indexa Capital
+          label: Nom d'usuari
+          placeholder_new: Enganxa el nom d'usuari aquí
+          placeholder_update: Introdueix un nou nom d'usuari per actualitzar
+      optional: "(opcional)"
+      optional_with_default: "(opcional, per defecte %{default_value})"
+      required: "(obligatori)"
+      save_button: Desa la configuració
+      setup_instructions: 'Instruccions de configuració:'
+      step_1: Visita el teu panell d'Indexa Capital per generar un token API només
+        de lectura
+      step_2: Enganxa el teu token API a continuació i fes clic a Desa
+      step_3: Després d'una connexió correcta, ves a la pestanya Comptes per configurar
+        nous comptes
+      update_button: Actualitza la configuració
+    preload_accounts:
+      no_credentials_configured: Primer, configura les teves credencials d'Indexa Capital
+        a la configuració del proveïdor.
+    select_accounts:
+      accounts_selected: comptes seleccionats
+      api_error: 'Error de l''API: %{message}'
+      cancel: Cancel·la
+      configure_name_in_provider: No es pot importar — configura el nom del compte
+        a Indexa Capital
+      description: Selecciona els comptes que vols enllaçar al teu compte de %{product_name}.
+      link_accounts: Enllaça els comptes seleccionats
+      no_accounts_found: No s'han trobat comptes. Comprova les teves credencials d'Indexa Capital.
+      no_api_key: Les credencials d'Indexa Capital no estan configurades. Configura-les
+        a la configuració.
+      no_credentials_configured: Primer, configura les teves credencials d'Indexa Capital
+        a la configuració del proveïdor.
+      no_name_placeholder: "(Sense nom)"
+      title: Selecciona comptes Indexa Capital
+    select_existing_account:
+      account_already_linked: Aquest compte ja està enllaçat a un proveïdor
+      all_accounts_already_linked: Tots els comptes Indexa Capital ja estan enllaçats
+      api_error: 'Error de l''API: %{message}'
+      balance_label: 'Saldo:'
+      cancel: Cancel·la
+      cancel_button: Cancel·la
+      configure_name_in_provider: No es pot importar — configura el nom del compte
+        a Indexa Capital
+      connect_hint: Connecta un compte Indexa Capital per habilitar la sincronització
+        automàtica.
+      description: Selecciona un compte Indexa Capital per enllaçar-lo amb aquest compte.
+        Les transaccions es sincronitzaran i deduplicaran automàticament.
+      header: Enllaça amb Indexa Capital
+      link_account: Enllaça compte
+      link_button: Enllaça aquest compte
+      linking_to: 'Enllaçant a:'
+      no_account_specified: No s'ha especificat cap compte
+      no_accounts: No s'han trobat comptes Indexa Capital sense enllaçar.
+      no_accounts_found: No s'han trobat comptes Indexa Capital. Comprova les teves
+        credencials.
+      no_api_key: Les credencials d'Indexa Capital no estan configurades. Configura-les
+        a la configuració.
+      no_credentials_configured: Primer, configura les teves credencials d'Indexa Capital
+        a la configuració del proveïdor.
+      no_name_placeholder: "(Sense nom)"
+      settings_link: Ves a la configuració del proveïdor
+      subtitle: Tria un compte Indexa Capital
+      title: Enllaça %{account_name} amb Indexa Capital
+    setup_accounts:
+      account_type_label: 'Tipus de compte:'
+      account_types:
+        credit_card: Targeta de crèdit
+        crypto: Compte de criptomonedes
+        depository: Compte corrent o d'estalvis
+        investment: Compte d'inversió
+        loan: Préstec o hipoteca
+        other_asset: Altre actiu
+        skip: Omet aquest compte
+      accounts_count:
+        one: "%{count} compte disponible"
+        other: "%{count} comptes disponibles"
+      all_accounts_linked: Tots els teus comptes Indexa Capital ja s'han configurat.
+      api_error: 'Error de l''API: %{message}'
+      balance: Saldo
+      cancel: Cancel·la
+      choose_account_type: 'Tria el tipus de compte correcte per a cada compte Indexa Capital:'
+      create_accounts: Crea comptes
+      creating: Creant comptes...
+      creating_accounts: Creant comptes...
+      fetch_failed: No s'han pogut obtenir els comptes
+      historical_data_range: 'Rang de dades històriques:'
+      import_selected: Importa els comptes seleccionats
+      instructions: Selecciona els comptes que vols importar des d'Indexa Capital.
+        Pots triar diversos comptes.
+      no_accounts: No s'han trobat comptes sense enllaçar d'aquesta connexió Indexa Capital.
+      no_accounts_to_setup: No hi ha comptes per configurar
+      no_api_key: Les credencials d'Indexa Capital no estan configurades. Revisa la
+        configuració de la connexió.
+      select_all: Selecciona-ho tot
+      subtitle: Tria els tipus de compte correctes per als teus comptes importats
+      subtype_labels:
+        credit_card: ''
+        crypto: ''
+        depository: 'Subtipus de compte:'
+        investment: 'Tipus d''inversió:'
+        loan: 'Tipus de préstec:'
+        other_asset: ''
+      subtype_messages:
+        credit_card: Les targetes de crèdit es configuraran automàticament com a comptes
+          de targeta de crèdit.
+        crypto: Els comptes de criptomonedes es configuraran per fer el seguiment
+          de posicions i transaccions.
+        other_asset: No calen opcions addicionals per a altres actius.
+      subtypes:
+        depository:
+          cd: Certificat de dipòsit
+          checking: Compte corrent
+          hsa: Compte d'estalvi per a salut
+          money_market: Mercat monetari
+          savings: Estalvis
+        investment:
+          401k: 401(k)
+          403b: 403(b)
+          529_plan: Pla 529
+          angel: Inversió àngel
+          brokerage: Corredoria
+          hsa: Compte d'estalvi per a salut
+          ira: IRA tradicional
+          mutual_fund: Fons d'inversió
+          pension: Pensió
+          retirement: Jubilació
+          roth_401k: Roth 401(k)
+          roth_ira: IRA Roth
+          tsp: Pla d'estalvis de jubilació (TSP)
+        loan:
+          auto: Préstec d'automòbil
+          mortgage: Hipoteca
+          other: Altre préstec
+          student: Préstec d'estudis
+      sync_start_date_help: Selecciona fins on vols sincronitzar l'historial de transaccions.
+      sync_start_date_label: 'Comença a sincronitzar transaccions des de:'
+      title: Configura els teus comptes Indexa Capital
+    sync:
+      status:
+        calculating: Calculant saldos...
+        checking_setup: Comprovant la configuració dels comptes...
+        importing: Important comptes des d'Indexa Capital...
+        importing_data: Important dades del compte...
+        needs_setup: "%{count} comptes necessiten configuració..."
+        processing: Processant posicions i activitats...
+      success: Sincronització iniciada
+    sync_status:
+      no_accounts: No s'han trobat comptes
+      synced:
+        one: "%{count} compte sincronitzat"
+        other: "%{count} comptes sincronitzats"
+      synced_with_setup: "%{linked} sincronitzats, %{unlinked} necessiten configuració"
+    update:
+      success: La connexió Indexa Capital s'ha actualitzat
diff --git a/config/locales/views/indexa_capital_items/de.yml b/config/locales/views/indexa_capital_items/de.yml
index 09d0e2a22..e9c50dbfa 100644
--- a/config/locales/views/indexa_capital_items/de.yml
+++ b/config/locales/views/indexa_capital_items/de.yml
@@ -39,8 +39,6 @@ de:
       alternative_auth: "Oder nutzen Sie Benutzername/Passwort-Anmeldung..."
       save_button: "Konfiguration speichern"
       update_button: "Konfiguration aktualisieren"
-      status_configured_html: "Konfiguriert und einsatzbereit. Besuchen Sie die Registerkarte <a href=\"%{accounts_path}\" class=\"link\">Konten</a>, um Konten zu verwalten und einzurichten."
-      status_not_configured: "Nicht konfiguriert"
       fields:
         api_token:
           label: "API-Token"
diff --git a/config/locales/views/indexa_capital_items/en.yml b/config/locales/views/indexa_capital_items/en.yml
index a3a448b7c..774bca112 100644
--- a/config/locales/views/indexa_capital_items/en.yml
+++ b/config/locales/views/indexa_capital_items/en.yml
@@ -40,8 +40,6 @@ en:
       alternative_auth: "Or use username/password authentication instead..."
       save_button: "Save Configuration"
       update_button: "Update Configuration"
-      status_configured_html: "Configured and ready to use. Visit the <a href=\"%{accounts_path}\" class=\"link\">Accounts</a> tab to manage and set up accounts."
-      status_not_configured: "Not configured"
       fields:
         api_token:
           label: "API Token"
diff --git a/config/locales/views/indexa_capital_items/es.yml b/config/locales/views/indexa_capital_items/es.yml
index f63db32d8..82f9247a1 100644
--- a/config/locales/views/indexa_capital_items/es.yml
+++ b/config/locales/views/indexa_capital_items/es.yml
@@ -37,8 +37,6 @@ es:
       alternative_auth: "O usa la autenticación por usuario/contraseña en su lugar..."
       save_button: "Guardar configuración"
       update_button: "Actualizar configuración"
-      status_configured_html: "Configurado y listo para usar. Visita la pestaña de <a href=\"%{accounts_path}\" class=\"link\">Cuentas</a> para gestionar y configurar tus cuentas."
-      status_not_configured: "No configurado"
       fields:
         api_token:
           label: "Token de API"
diff --git a/config/locales/views/indexa_capital_items/fr.yml b/config/locales/views/indexa_capital_items/fr.yml
new file mode 100644
index 000000000..66dce0d18
--- /dev/null
+++ b/config/locales/views/indexa_capital_items/fr.yml
@@ -0,0 +1,252 @@
+---
+fr:
+  indexa_capital_items:
+    # Model method strings (i18n for item_model.rb)
+    sync_status:
+      no_accounts: "Aucun compte trouvé"
+      synced:
+        one: "%{count} compte synchronisé"
+        other: "%{count} comptes synchronisés"
+      synced_with_setup: "%{linked} synchronisé(s), %{unlinked} à configurer"
+    institution_summary:
+      none: "Aucune institution connectée"
+      count:
+        one: "%{count} institution"
+        other: "%{count} institutions"
+    errors:
+      provider_not_configured: "Le fournisseur Indexa Capital n'est pas configuré"
+
+    # Syncer status messages
+    sync:
+      status:
+        importing: "Importation des comptes depuis Indexa Capital…"
+        processing: "Traitement des avoirs et des activités…"
+        calculating: "Calcul des soldes…"
+        importing_data: "Importation des données du compte…"
+        checking_setup: "Vérification de la configuration du compte…"
+        needs_setup: "%{count} comptes à configurer…"
+      success: "Synchronisation démarrée"
+
+    # Panel (settings view)
+    panel:
+      setup_instructions: "Instructions de configuration :"
+      step_1: "Rendez-vous sur votre tableau de bord Indexa Capital pour générer un jeton API en lecture seule"
+      step_2: "Collez votre jeton API ci-dessous et cliquez sur Enregistrer"
+      step_3: "Après une connexion réussie, rendez-vous sur l'onglet Comptes pour configurer les nouveaux comptes"
+      field_descriptions: "Description des champs :"
+      optional: "(Facultatif)"
+      required: "(obligatoire)"
+      optional_with_default: "(facultatif, valeur par défaut : %{default_value})"
+      alternative_auth: "Ou utilisez plutôt l'authentification par nom d'utilisateur / mot de passe…"
+      save_button: "Enregistrer la configuration"
+      update_button: "Mettre à jour la configuration"
+      fields:
+        api_token:
+          label: "Jeton API"
+          description: "Votre jeton API en lecture seule depuis le tableau de bord Indexa Capital"
+          placeholder_new: "Collez votre jeton API ici"
+          placeholder_update: "Saisissez un nouveau jeton API pour mettre à jour"
+        username:
+          label: "Nom d'utilisateur"
+          description: "Votre nom d'utilisateur / e-mail Indexa Capital"
+          placeholder_new: "Collez le nom d'utilisateur ici"
+          placeholder_update: "Saisissez un nouveau nom d'utilisateur pour mettre à jour"
+        document:
+          label: "Identifiant du document"
+          description: "Votre document / identifiant Indexa Capital"
+          placeholder_new: "Collez l'identifiant du document ici"
+          placeholder_update: "Saisissez un nouvel identifiant de document pour mettre à jour"
+        password:
+          label: "Mot de passe"
+          description: "Votre mot de passe Indexa Capital"
+          placeholder_new: "Collez le mot de passe ici"
+          placeholder_update: "Saisissez un nouveau mot de passe pour mettre à jour"
+
+    # CRUD success messages
+    create:
+      success: "Connexion Indexa Capital créée avec succès"
+    update:
+      success: "Connexion Indexa Capital mise à jour"
+    destroy:
+      success: "Connexion Indexa Capital supprimée"
+    index:
+      title: "Connexions Indexa Capital"
+
+    # Loading states
+    loading:
+      loading_message: "Chargement des comptes Indexa Capital…"
+      loading_title: "Chargement"
+
+    # Account linking
+    link_accounts:
+      all_already_linked:
+        one: "Le compte sélectionné (%{names}) est déjà lié"
+        other: "Les %{count} comptes sélectionnés sont déjà liés : %{names}"
+      api_error: "Erreur API : %{message}"
+      invalid_account_names:
+        one: "Impossible de lier un compte sans nom"
+        other: "Impossible de lier %{count} comptes sans nom"
+      link_failed: "Échec de la liaison des comptes"
+      no_accounts_selected: "Veuillez sélectionner au moins un compte"
+      no_api_key: "Identifiants Indexa Capital introuvables. Veuillez les configurer dans les paramètres du fournisseur."
+      partial_invalid: "%{created_count} compte(s) lié(s) avec succès, %{already_linked_count} étaient déjà liés, %{invalid_count} compte(s) avaient des noms invalides"
+      partial_success: "%{created_count} compte(s) lié(s) avec succès. %{already_linked_count} compte(s) étaient déjà liés : %{already_linked_names}"
+      success:
+        one: "%{count} compte lié avec succès"
+        other: "%{count} comptes liés avec succès"
+
+    # Provider item display (used in _item partial)
+    indexa_capital_item:
+      accounts_need_setup: "Des comptes doivent être configurés"
+      delete: "Supprimer la connexion"
+      deletion_in_progress: "suppression en cours…"
+      error: "Erreur"
+      more_accounts_available:
+        one: "%{count} compte supplémentaire disponible"
+        other: "%{count} comptes supplémentaires disponibles"
+      no_accounts_description: "Cette connexion n'a pas encore de comptes liés."
+      no_accounts_title: "Aucun compte"
+      provider_name: "Indexa Capital"
+      requires_update: "Connexion à mettre à jour"
+      setup_action: "Configurer les nouveaux comptes"
+      setup_description: "%{linked} sur %{total} comptes liés. Choisissez les types de compte pour vos comptes Indexa Capital nouvellement importés."
+      setup_needed: "Nouveaux comptes prêts à être configurés"
+      status: "Synchronisé il y a %{timestamp} — %{summary}"
+      status_never: "Jamais synchronisé"
+      syncing: "Synchronisation…"
+      total: "Total"
+      unlinked: "Non lié"
+      update_credentials: "Mettre à jour les identifiants"
+
+    # Select accounts view
+    select_accounts:
+      accounts_selected: "comptes sélectionnés"
+      api_error: "Erreur API : %{message}"
+      cancel: "Annuler"
+      configure_name_in_provider: "Impossible d'importer - veuillez configurer le nom du compte dans Indexa Capital"
+      description: "Sélectionnez les comptes que vous souhaitez lier à votre compte %{product_name}."
+      link_accounts: "Lier les comptes sélectionnés"
+      no_accounts_found: "Aucun compte trouvé. Veuillez vérifier vos identifiants Indexa Capital."
+      no_api_key: "Les identifiants Indexa Capital ne sont pas configurés. Veuillez les configurer dans les Paramètres."
+      no_credentials_configured: "Veuillez d'abord configurer vos identifiants Indexa Capital dans les paramètres du fournisseur."
+      no_name_placeholder: "(Sans nom)"
+      title: "Sélectionner les comptes Indexa Capital"
+
+    # Select existing account view
+    select_existing_account:
+      account_already_linked: "Ce compte est déjà lié à un fournisseur"
+      all_accounts_already_linked: "Tous les comptes Indexa Capital sont déjà liés"
+      api_error: "Erreur API : %{message}"
+      balance_label: "Solde :"
+      cancel: "Annuler"
+      cancel_button: "Annuler"
+      configure_name_in_provider: "Impossible d'importer - veuillez configurer le nom du compte dans Indexa Capital"
+      connect_hint: "Connectez un compte Indexa Capital pour activer la synchronisation automatique."
+      description: "Sélectionnez un compte Indexa Capital à lier avec ce compte. Les transactions seront synchronisées et dédupliquées automatiquement."
+      header: "Lier avec Indexa Capital"
+      link_account: "Lier le compte"
+      link_button: "Lier ce compte"
+      linking_to: "Liaison à :"
+      no_account_specified: "Aucun compte spécifié"
+      no_accounts: "Aucun compte Indexa Capital non lié trouvé."
+      no_accounts_found: "Aucun compte Indexa Capital trouvé. Veuillez vérifier vos identifiants."
+      no_api_key: "Les identifiants Indexa Capital ne sont pas configurés. Veuillez les configurer dans les Paramètres."
+      no_credentials_configured: "Veuillez d'abord configurer vos identifiants Indexa Capital dans les paramètres du fournisseur."
+      no_name_placeholder: "(Sans nom)"
+      settings_link: "Aller aux paramètres du fournisseur"
+      subtitle: "Choisissez un compte Indexa Capital"
+      title: "Lier %{account_name} avec Indexa Capital"
+
+    # Link existing account
+    link_existing_account:
+      account_already_linked: "Ce compte est déjà lié à un fournisseur"
+      api_error: "Erreur API : %{message}"
+      invalid_account_name: "Impossible de lier un compte sans nom"
+      provider_account_already_linked: "Ce compte Indexa Capital est déjà lié à un autre compte"
+      provider_account_not_found: "Compte Indexa Capital introuvable"
+      missing_parameters: "Paramètres requis manquants"
+      no_api_key: "Identifiants Indexa Capital introuvables. Veuillez les configurer dans les paramètres du fournisseur."
+      success: "%{account_name} lié avec succès à Indexa Capital"
+
+    # Setup accounts wizard
+    setup_accounts:
+      account_type_label: "Type de compte :"
+      accounts_count:
+        one: "%{count} compte disponible"
+        other: "%{count} comptes disponibles"
+      all_accounts_linked: "Tous vos comptes Indexa Capital ont déjà été configurés."
+      api_error: "Erreur API : %{message}"
+      creating: "Création des comptes…"
+      fetch_failed: "Échec de la récupération des comptes"
+      import_selected: "Importer les comptes sélectionnés"
+      instructions: "Sélectionnez les comptes que vous souhaitez importer depuis Indexa Capital. Vous pouvez choisir plusieurs comptes."
+      no_accounts: "Aucun compte non lié trouvé pour cette connexion Indexa Capital."
+      no_accounts_to_setup: "Aucun compte à configurer"
+      no_api_key: "Les identifiants Indexa Capital ne sont pas configurés. Veuillez vérifier les paramètres de connexion."
+      select_all: "Tout sélectionner"
+      account_types:
+        skip: "Ignorer ce compte"
+        depository: "Compte courant ou épargne"
+        credit_card: "Carte de crédit"
+        investment: "Compte d'investissement"
+        crypto: "Compte de cryptomonnaie"
+        loan: "Prêt ou hypothèque"
+        other_asset: "Autre actif"
+      subtype_labels:
+        depository: "Sous-type de compte :"
+        credit_card: ""
+        investment: "Type d'investissement :"
+        crypto: ""
+        loan: "Type de prêt :"
+        other_asset: ""
+      subtype_messages:
+        credit_card: "Les cartes de crédit seront automatiquement configurées comme comptes de carte de crédit."
+        other_asset: "Aucune option supplémentaire nécessaire pour les autres actifs."
+        crypto: "Les comptes de cryptomonnaie seront configurés pour suivre les avoirs et les transactions."
+      subtypes:
+        depository:
+          checking: "Compte courant"
+          savings: "Compte épargne"
+          hsa: "Compte épargne santé"
+          cd: "Certificat de dépôt"
+          money_market: "Compte du marché monétaire"
+        investment:
+          brokerage: "Courtage"
+          pension: "Pension"
+          retirement: "Retraite"
+          "401k": "401(k)"
+          roth_401k: "Roth 401(k)"
+          "403b": "403(b)"
+          tsp: "Plan d'épargne Thrift"
+          "529_plan": "Plan 529"
+          hsa: "Compte épargne santé"
+          mutual_fund: "Fonds commun de placement"
+          ira: "IRA traditionnel"
+          roth_ira: "Roth IRA"
+          angel: "Investissement providentiel"
+        loan:
+          mortgage: "Hypothèque"
+          student: "Prêt étudiant"
+          auto: "Prêt auto"
+          other: "Autre prêt"
+      balance: "Solde"
+      cancel: "Annuler"
+      choose_account_type: "Choisissez le type de compte correct pour chaque compte Indexa Capital :"
+      create_accounts: "Créer les comptes"
+      creating_accounts: "Création des comptes…"
+      historical_data_range: "Plage de données historiques :"
+      subtitle: "Choisissez les types de compte corrects pour vos comptes importés"
+      sync_start_date_help: "Sélectionnez jusqu'où vous souhaitez synchroniser l'historique des transactions."
+      sync_start_date_label: "Commencer la synchronisation des transactions à partir de :"
+      title: "Configurer vos comptes Indexa Capital"
+
+    # Complete account setup
+    complete_account_setup:
+      all_skipped: "Tous les comptes ont été ignorés. Aucun compte n'a été créé."
+      creation_failed: "Échec de la création des comptes : %{error}"
+      no_accounts: "Aucun compte à configurer."
+      success: "%{count} compte(s) créé(s) avec succès."
+
+    # Preload accounts
+    preload_accounts:
+      no_credentials_configured: "Veuillez d'abord configurer vos identifiants Indexa Capital dans les paramètres du fournisseur."
diff --git a/config/locales/views/indexa_capital_items/hu.yml b/config/locales/views/indexa_capital_items/hu.yml
new file mode 100644
index 000000000..defbd74fe
--- /dev/null
+++ b/config/locales/views/indexa_capital_items/hu.yml
@@ -0,0 +1,239 @@
+---
+hu:
+  indexa_capital_items:
+    sync_status:
+      no_accounts: "Nem találhatók számlák"
+      synced:
+        one: "%{count} számla szinkronizálva"
+        other: "%{count} számla szinkronizálva"
+      synced_with_setup: "%{linked} szinkronizálva, %{unlinked} beállítást igényel"
+    institution_summary:
+      none: "Nincs csatlakoztatott intézmény"
+      count:
+        one: "%{count} intézmény"
+        other: "%{count} intézmény"
+    errors:
+      provider_not_configured: "Az IndexaCapital szolgáltató nincs beállítva"
+
+    sync:
+      status:
+        importing: "Számlák importálása az IndexaCapital-ból..."
+        processing: "Portfólió és tevékenységek feldolgozása..."
+        calculating: "Egyenlegek kiszámítása..."
+        importing_data: "Számlaadatok importálása..."
+        checking_setup: "Számlakonfiguráció ellenőrzése..."
+        needs_setup: "%{count} számla beállítást igényel..."
+      success: "Szinkronizálás elindítva"
+
+    panel:
+      setup_instructions: "Beállítási utasítások:"
+      step_1: "Látogass el az Indexa Capital irányítópultra egy csak olvasható API token létrehozásához"
+      step_2: "Illeszd be az API tokenedet alább, majd kattints a Mentésre"
+      step_3: "Sikeres csatlakozás után menj a Számlák lapra az új számlák beállításához"
+      field_descriptions: "Mezőleírások:"
+      optional: "(opcionális)"
+      required: "(kötelező)"
+      optional_with_default: "(opcionális, alapértelmezett: %{default_value})"
+      alternative_auth: "Vagy használj felhasználónév/jelszó hitelesítést helyette..."
+      save_button: "Konfiguráció mentése"
+      update_button: "Konfiguráció frissítése"
+      fields:
+        api_token:
+          label: "API token"
+          description: "Az Indexa Capital irányítópultról származó csak olvasható API tokened"
+          placeholder_new: "Illeszd be ide az API tokenedet"
+          placeholder_update: "Add meg az új API tokent a frissítéshez"
+        username:
+          label: "Felhasználónév"
+          description: "Az Indexa Capital felhasználóneved/e-mail-ed"
+          placeholder_new: "Illeszd be ide a felhasználónevet"
+          placeholder_update: "Add meg az új felhasználónevet a frissítéshez"
+        document:
+          label: "Dokumentum azonosító"
+          description: "Az Indexa Capital dokumentum/azonosítód"
+          placeholder_new: "Illeszd be ide a dokumentum azonosítót"
+          placeholder_update: "Add meg az új dokumentum azonosítót a frissítéshez"
+        password:
+          label: "Jelszó"
+          description: "Az Indexa Capital jelszavad"
+          placeholder_new: "Illeszd be ide a jelszót"
+          placeholder_update: "Add meg az új jelszót a frissítéshez"
+
+    create:
+      success: "IndexaCapital kapcsolat sikeresen létrehozva"
+    update:
+      success: "IndexaCapital kapcsolat frissítve"
+    destroy:
+      success: "IndexaCapital kapcsolat eltávolítva"
+    index:
+      title: "IndexaCapital kapcsolatok"
+
+    loading:
+      loading_message: "IndexaCapital számlák betöltése..."
+      loading_title: "Betöltés"
+
+    link_accounts:
+      all_already_linked:
+        one: "A kiválasztott számla (%{names}) már össze van kapcsolva"
+        other: "Mind a(z) %{count} kiválasztott számla már össze van kapcsolva: %{names}"
+      api_error: "API hiba: %{message}"
+      invalid_account_names:
+        one: "Nem lehet összekapcsolni üres nevű számlát"
+        other: "Nem lehet összekapcsolni %{count} üres nevű számlát"
+      link_failed: "Nem sikerült összekapcsolni a számlákat"
+      no_accounts_selected: "Kérlek válassz legalább egy számlát"
+      no_api_key: "Nem találhatók az IndexaCapital hitelesítő adatok. Kérlek állítsd be őket a Szolgáltatói beállításokban."
+      partial_invalid: "%{created_count} számla sikeresen összekapcsolva, %{already_linked_count} már össze volt kapcsolva, %{invalid_count} számla nevei érvénytelenek"
+      partial_success: "%{created_count} számla sikeresen összekapcsolva. %{already_linked_count} számla már össze volt kapcsolva: %{already_linked_names}"
+      success:
+        one: "%{count} számla sikeresen összekapcsolva"
+        other: "%{count} számla sikeresen összekapcsolva"
+
+    indexa_capital_item:
+      accounts_need_setup: "Számlák beállítást igényelnek"
+      delete: "Kapcsolat törlése"
+      deletion_in_progress: "törlés folyamatban..."
+      error: "Hiba"
+      more_accounts_available:
+        one: "%{count} további elérhető számla"
+        other: "%{count} további elérhető számla"
+      no_accounts_description: "Ehhez a kapcsolathoz még nincsenek összekapcsolt számlák."
+      no_accounts_title: "Nincsenek számlák"
+      provider_name: "IndexaCapital"
+      requires_update: "A kapcsolat frissítést igényel"
+      setup_action: "Új számlák beállítása"
+      setup_description: "%{linked} / %{total} számla összekapcsolva. Válaszd ki az újonnan importált IndexaCapital számlák típusait."
+      setup_needed: "Új számlák beállításra várnak"
+      status: "Szinkronizálva %{timestamp} ezelőtt — %{summary}"
+      status_never: "Még nem szinkronizált"
+      syncing: "Szinkronizálás..."
+      total: "Összesen"
+      unlinked: "Nincs összekapcsolva"
+      update_credentials: "Hitelesítő adatok frissítése"
+
+    select_accounts:
+      accounts_selected: "kiválasztott számla"
+      api_error: "API hiba: %{message}"
+      cancel: "Mégse"
+      configure_name_in_provider: "Nem importálható — kérlek állítsd be a számla nevét az IndexaCapital-ban"
+      description: "Válaszd ki azokat a számlákat, amelyeket össze szeretnél kapcsolni a(z) %{product_name} fiókkal."
+      link_accounts: "Kiválasztott számlák összekapcsolása"
+      no_accounts_found: "Nem találhatók számlák. Kérlek ellenőrizd az IndexaCapital hitelesítő adataidat."
+      no_api_key: "Az IndexaCapital hitelesítő adatok nincsenek beállítva. Kérlek állítsd be őket a Beállításokban."
+      no_credentials_configured: "Kérlek előbb állítsd be az IndexaCapital hitelesítő adataidat a Szolgáltatói beállításokban."
+      no_name_placeholder: "(Nincs név)"
+      title: "IndexaCapital számlák kiválasztása"
+
+    select_existing_account:
+      account_already_linked: "Ez a számla már össze van kapcsolva egy szolgáltatóval"
+      all_accounts_already_linked: "Minden IndexaCapital számla már össze van kapcsolva"
+      api_error: "API hiba: %{message}"
+      balance_label: "Egyenleg:"
+      cancel: "Mégse"
+      cancel_button: "Mégse"
+      configure_name_in_provider: "Nem importálható — kérlek állítsd be a számla nevét az IndexaCapital-ban"
+      connect_hint: "Csatlakoztass egy IndexaCapital számlát az automatikus szinkronizálás engedélyezéséhez."
+      description: "Válassz egy IndexaCapital számlát, amelyet ehhez a számlához szeretnél kapcsolni. A tranzakciók automatikusan szinkronizálásra és deduplikálásra kerülnek."
+      header: "Összekapcsolás az IndexaCapital-lal"
+      link_account: "Számla összekapcsolása"
+      link_button: "Ez a számla összekapcsolása"
+      linking_to: "Összekapcsolás:"
+      no_account_specified: "Nem lett megadva számla"
+      no_accounts: "Nem találhatók nem összekapcsolt IndexaCapital számlák."
+      no_accounts_found: "Nem találhatók IndexaCapital számlák. Kérlek ellenőrizd a hitelesítő adataidat."
+      no_api_key: "Az IndexaCapital hitelesítő adatok nincsenek beállítva. Kérlek állítsd be őket a Beállításokban."
+      no_credentials_configured: "Kérlek előbb állítsd be az IndexaCapital hitelesítő adataidat a Szolgáltatói beállításokban."
+      no_name_placeholder: "(Nincs név)"
+      settings_link: "Szolgáltatói beállítások megnyitása"
+      subtitle: "Válassz egy IndexaCapital számlát"
+      title: "%{account_name} összekapcsolása az IndexaCapital-lal"
+
+    link_existing_account:
+      account_already_linked: "Ez a számla már össze van kapcsolva egy szolgáltatóval"
+      api_error: "API hiba: %{message}"
+      invalid_account_name: "Nem lehet összekapcsolni üres nevű számlát"
+      provider_account_already_linked: "Ez az IndexaCapital számla már össze van kapcsolva egy másik számlával"
+      provider_account_not_found: "Nem található az IndexaCapital számla"
+      missing_parameters: "Hiányzó kötelező paraméterek"
+      no_api_key: "Nem találhatók az IndexaCapital hitelesítő adatok. Kérlek állítsd be őket a Szolgáltatói beállításokban."
+      success: "%{account_name} sikeresen összekapcsolva az IndexaCapital-lal"
+
+    setup_accounts:
+      account_type_label: "Számla típusa:"
+      accounts_count:
+        one: "%{count} elérhető számla"
+        other: "%{count} elérhető számla"
+      all_accounts_linked: "Minden IndexaCapital számlád már be van állítva."
+      api_error: "API hiba: %{message}"
+      creating: "Számlák létrehozása..."
+      fetch_failed: "Nem sikerült lekérni a számlákat"
+      import_selected: "Kiválasztott számlák importálása"
+      instructions: "Válaszd ki az IndexaCapital-ból importálni kívánt számlákat. Több számlát is választhatsz."
+      no_accounts: "Nem találhatók nem összekapcsolt számlák ebből az IndexaCapital kapcsolatból."
+      no_accounts_to_setup: "Nincs beállítandó számla"
+      no_api_key: "Az IndexaCapital hitelesítő adatok nincsenek beállítva. Kérlek ellenőrizd a kapcsolati beállításaidat."
+      select_all: "Összes kijelölése"
+      account_types:
+        skip: "Számla kihagyása"
+        depository: "Folyó- vagy megtakarítási számla"
+        credit_card: "Hitelkártya"
+        investment: "Befektetési számla"
+        crypto: "Kriptovaluta számla"
+        loan: "Hitel vagy jelzálog"
+        other_asset: "Egyéb vagyon"
+      subtype_labels:
+        depository: "Számla altípusa:"
+        credit_card: ""
+        investment: "Befektetés típusa:"
+        crypto: ""
+        loan: "Hitel típusa:"
+        other_asset: ""
+      subtype_messages:
+        credit_card: "A hitelkártyák automatikusan hitelkártya számlákként lesznek beállítva."
+        other_asset: "Az egyéb vagyonelemekhez nincs szükség további beállításokra."
+        crypto: "A kriptovaluta számlák pozíciók és tranzakciók nyomon követésére lesznek beállítva."
+      subtypes:
+        depository:
+          checking: "Folyószámla"
+          savings: "Megtakarítási számla"
+          hsa: "Egészségügyi megtakarítási számla"
+          cd: "Lekötött betét"
+          money_market: "Pénzpiaci számla"
+        investment:
+          brokerage: "Brókeri számla"
+          pension: "Nyugdíjalap"
+          retirement: "Nyugdíj-megtakarítás"
+          "401k": "401(k)"
+          roth_401k: "Roth 401(k)"
+          "403b": "403(b)"
+          tsp: "Thrift Savings Plan"
+          "529_plan": "529 Terv"
+          hsa: "Egészségügyi megtakarítási számla"
+          mutual_fund: "Befektetési alap"
+          ira: "Hagyományos IRA"
+          roth_ira: "Roth IRA"
+          angel: "Angyal befektető"
+        loan:
+          mortgage: "Jelzálog"
+          student: "Diákhitel"
+          auto: "Autóhitel"
+          other: "Egyéb hitel"
+      balance: "Egyenleg"
+      cancel: "Mégse"
+      choose_account_type: "Válaszd ki a megfelelő számlatípust minden IndexaCapital számlához:"
+      create_accounts: "Számlák létrehozása"
+      creating_accounts: "Számlák létrehozása..."
+      historical_data_range: "Előzmények időtartama:"
+      subtitle: "Válaszd ki az importált számlák helyes típusait"
+      sync_start_date_help: "Válaszd ki, milyen messzire szeretnél visszamenni a tranzakciós előzmények szinkronizálásában."
+      sync_start_date_label: "Tranzakciók szinkronizálásának kezdete:"
+      title: "IndexaCapital számlák beállítása"
+
+    complete_account_setup:
+      all_skipped: "Minden számla ki lett hagyva. Nem jött létre számla."
+      creation_failed: "Nem sikerült létrehozni a számlákat: %{error}"
+      no_accounts: "Nincs beállítandó számla."
+      success: "%{count} számla sikeresen létrehozva."
+
+    preload_accounts:
+      no_credentials_configured: "Kérlek előbb állítsd be az IndexaCapital hitelesítő adataidat a Szolgáltatói beállításokban."
diff --git a/config/locales/views/indexa_capital_items/pl.yml b/config/locales/views/indexa_capital_items/pl.yml
index abab63caa..4ae96d462 100644
--- a/config/locales/views/indexa_capital_items/pl.yml
+++ b/config/locales/views/indexa_capital_items/pl.yml
@@ -39,8 +39,6 @@ pl:
       alternative_auth: Lub użyj uwierzytelniania loginem i hasłem...
       save_button: Zapisz konfigurację
       update_button: Zaktualizuj konfigurację
-      status_configured_html: Skonfigurowano i gotowe do użycia. Przejdź do zakładki <a href="%{accounts_path}" class="link">Konta</a>, aby zarządzać kontami i je konfigurować.
-      status_not_configured: Nie skonfigurowano
       fields:
         api_token:
           label: Token API
diff --git a/config/locales/views/investments/ca.yml b/config/locales/views/investments/ca.yml
index a7a0cd9b9..3325ed665 100644
--- a/config/locales/views/investments/ca.yml
+++ b/config/locales/views/investments/ca.yml
@@ -10,9 +10,181 @@ ca:
       title: Introdueix el saldo del compte
     show:
       chart_title: Valor total
+    subtypes:
+      401k:
+        long: 401(k)
+        short: 401(k)
+      403b:
+        long: 403(b)
+        short: 403(b)
+      457b:
+        long: 457(b)
+        short: 457(b)
+      529_plan:
+        long: Pla 529 d'estalvi per a l'educació
+        short: Pla 529
+      angel:
+        long: Inversió àngel
+        short: Àngel
+      apy:
+        long: Atal Pension Yojana
+        short: APY
+      brokerage:
+        long: Compte de broker
+        short: Broker
+      corporate_bond:
+        long: Bo corporatiu
+        short: Bo corporatiu
+      fd:
+        long: Dipòsit a termini fix
+        short: FD
+      g_sec:
+        long: Valors governamentals (G-Secs)
+        short: G-Sec
+      gold:
+        long: Or (físic o digital)
+        short: Or
+      gold_etf:
+        long: ETF d'or
+        short: ETF d'or
+      gold_mf:
+        long: Fons mutu d'or
+        short: MF d'or
+      hsa:
+        long: Compte d'estalvi sanitari
+        short: HSA
+      indian_equity:
+        long: Renda variable índia
+        short: Renda variable índia
+      indian_etf:
+        long: ETF indi
+        short: ETF indi
+      indian_stocks:
+        long: Accions índies (Demat)
+        short: Accions índies
+      infrastructure_bond:
+        long: Bo d'infraestructures
+        short: Bo d'infraestr.
+      ira:
+        long: IRA tradicional
+        short: IRA
+      isa:
+        long: Compte d'estalvi individual
+        short: ISA
+      kvp:
+        long: Kisan Vikas Patra
+        short: KVP
+      life_insurance:
+        long: Assegurança de vida
+        short: Assegurança de vida
+      lira:
+        long: Compte de jubilació bloquejat
+        short: LIRA
+      lisa:
+        long: ISA vitalícia
+        short: LISA
+      mutual_fund:
+        long: Fons d'inversió
+        short: Fons d'inversió
+      nps:
+        long: Sistema nacional de pensions
+        short: NPS
+      nsc:
+        long: Certificat nacional d'estalvi
+        short: NSC
+      other:
+        long: Altra inversió
+        short: Altres
+      pea:
+        long: Plan d'Épargne en Actions
+        short: PEA
+      pension:
+        long: Pensió
+        short: Pensió
+      pillar_3a:
+        long: Pensió privada (Pilar 3a)
+        short: Pilar 3a
+      pomis:
+        long: Pla mensual de l'oficina de correus
+        short: POMIS
+      ppf:
+        long: Fons provident públic
+        short: PPF
+      rd:
+        long: Dipòsit recurrent
+        short: RD
+      resp:
+        long: Pla registrat d'estalvi per a l'educació
+        short: RESP
+      retirement:
+        long: Compte de jubilació
+        short: Jubilació
+      riester:
+        long: Riester-Rente
+        short: Riester
+      roth_401k:
+        long: Roth 401(k)
+        short: Roth 401(k)
+      roth_ira:
+        long: Roth IRA
+        short: Roth IRA
+      rrif:
+        long: Fons registrat d'ingressos de jubilació
+        short: RRIF
+      rrsp:
+        long: Pla registrat d'estalvi per a la jubilació
+        short: RRSP
+      scss:
+        long: Pla d'estalvi per a gent gran
+        short: SCSS
+      sdl:
+        long: Préstecs de desenvolupament estatal (SDL)
+        short: SDL
+      sep_ira:
+        long: SEP IRA
+        short: SEP IRA
+      sgb:
+        long: Bo sobirà d'or
+        short: SGB
+      simple_ira:
+        long: SIMPLE IRA
+        short: SIMPLE IRA
+      sipp:
+        long: Pensió personal autoinvertida
+        short: SIPP
+      smsf:
+        long: Fons de superannuació autogestionat
+        short: SMSF
+      ssy:
+        long: Sukanya Samriddhi Yojana
+        short: SSY
+      super:
+        long: Superannuació
+        short: Super
+      tax_free_bond:
+        long: Bo exempt d'impostos
+        short: Bo exempt
+      tfsa:
+        long: Compte d'estalvi lliure d'impostos
+        short: TFSA
+      trust:
+        long: Fideïcomís
+        short: Fideïcomís
+      tsp:
+        long: Thrift Savings Plan
+        short: TSP
+      ugma:
+        long: Compte custodi UGMA
+        short: UGMA
+      utma:
+        long: Compte custodi UTMA
+        short: UTMA
+      workplace_pension_uk:
+        long: Pensió laboral
+        short: Pensió
     value_tooltip:
       cash: Efectiu
       holdings: Posicions
-      total: Saldo del portafolis
-      total_value_tooltip: El saldo total del portafolis és la suma de l'efectiu de
+      total: Saldo de la cartera
+      total_value_tooltip: El saldo total de la cartera és la suma de l'efectiu del
         broker (disponible per operar) i el valor de mercat actual de les teves posicions.
diff --git a/config/locales/views/investments/en.yml b/config/locales/views/investments/en.yml
index 7a4875ba1..63a12c0de 100644
--- a/config/locales/views/investments/en.yml
+++ b/config/locales/views/investments/en.yml
@@ -100,6 +100,73 @@ en:
       riester:
         short: Riester
         long: Riester-Rente
+      # India
+      nps:
+        short: NPS
+        long: National Pension System
+      apy:
+        short: APY
+        long: Atal Pension Yojana
+      indian_stocks:
+        short: Indian Stocks
+        long: Indian Stocks (Demat)
+      indian_equity:
+        short: Indian Equity
+        long: Indian Equity
+      indian_etf:
+        short: Indian ETF
+        long: Indian ETF
+      life_insurance:
+        short: Life Insurance
+        long: Life Insurance
+      ppf:
+        short: PPF
+        long: Public Provident Fund
+      ssy:
+        short: SSY
+        long: Sukanya Samriddhi Yojana
+      nsc:
+        short: NSC
+        long: National Savings Certificate
+      scss:
+        short: SCSS
+        long: Senior Citizens' Savings Scheme
+      fd:
+        short: FD
+        long: Fixed Deposit
+      rd:
+        short: RD
+        long: Recurring Deposit
+      pomis:
+        short: POMIS
+        long: Post Office Monthly Income Scheme
+      kvp:
+        short: KVP
+        long: Kisan Vikas Patra
+      gold_etf:
+        short: Gold ETF
+        long: Gold ETF
+      gold_mf:
+        short: Gold MF
+        long: Gold Mutual Fund
+      sgb:
+        short: SGB
+        long: Sovereign Gold Bond
+      g_sec:
+        short: G-Sec
+        long: Government Securities (G-Secs)
+      sdl:
+        short: SDL
+        long: State Development Loans (SDLs)
+      corporate_bond:
+        short: Corporate Bond
+        long: Corporate Bond
+      infrastructure_bond:
+        short: Infra Bond
+        long: Infrastructure Bond
+      tax_free_bond:
+        short: Tax-Free Bond
+        long: Tax-Free Bond
       # Generic
       pension:
         short: Pension
@@ -110,6 +177,9 @@ en:
       mutual_fund:
         short: Mutual Fund
         long: Mutual Fund
+      gold:
+        short: Gold
+        long: Gold (physical or digital)
       angel:
         short: Angel
         long: Angel Investment
diff --git a/config/locales/views/investments/fr.yml b/config/locales/views/investments/fr.yml
index 413cf2375..865bb546b 100644
--- a/config/locales/views/investments/fr.yml
+++ b/config/locales/views/investments/fr.yml
@@ -10,6 +10,115 @@ fr:
       title: Saisir le solde du compte
     show:
       chart_title: Valeur totale
+    subtypes:
+      # United States
+      brokerage:
+        short: Courtier
+        long: Courtier
+      401k:
+        short: 401(k)
+        long: 401(k)
+      roth_401k:
+        short: Roth 401(k)
+        long: Roth 401(k)
+      403b:
+        short: 403(b)
+        long: 403(b)
+      457b:
+        short: 457(b)
+        long: 457(b)
+      tsp:
+        short: TSP
+        long: Plan d'épargne fédéral américain (TSP)
+      ira:
+        short: IRA
+        long: Compte de retraite individuel (IRA)
+      roth_ira:
+        short: Roth IRA
+        long: Compte de retraite individuel Roth (Roth IRA)
+      sep_ira:
+        short: SEP IRA
+        long: Plan de retraite simplifié pour employés (SEP-IRA)
+      simple_ira:
+        short: SIMPLE IRA
+        long: Plan d'épargne salariale (SIMPLE IRA)
+      529_plan:
+        short: Plan 529
+        long: Plan 529 d'épargne-études
+      hsa:
+        short: HSA
+        long: Compte d'épargne santé
+      ugma:
+        short: UGMA
+        long: Compte de garde UGMA
+      utma:
+        short: UTMA
+        long: Compte de garde UTMA
+      # United Kingdom
+      isa:
+        short: ISA
+        long: Plan d'épargne individuel britannique (ISA)
+      lisa:
+        short: LISA
+        long: Plan d'épargne individuel à vie (LISA)
+      sipp:
+        short: SIPP
+        long: Plan de retraite individuel auto-géré (SIPP)
+      workplace_pension_uk:
+        short: Pension
+        long: Pension d'entreprise
+      # Canada
+      rrsp:
+        short: REER
+        long: Régime enregistré d'épargne-retraite
+      tfsa:
+        short: CELI
+        long: Compte d'épargne libre d'impôt
+      resp:
+        short: REEE
+        long: Régime enregistré d'épargne-études
+      lira:
+        short: CRI
+        long: Compte de retraite immobilisé
+      rrif:
+        short: FERR
+        long: Fonds enregistré de revenu de retraite
+      # Australia
+      super:
+        short: Super
+        long: Superannuation
+      smsf:
+        short: SMSF
+        long: Self-Managed Super Fund
+      # Europe
+      pea:
+        short: PEA
+        long: Plan d'Épargne en Actions
+      pillar_3a:
+        short: Pilier 3a
+        long: Prévoyance privée (Pilier 3a)
+      riester:
+        short: Riester
+        long: Riester-Rente
+      # Generic
+      pension:
+        short: Retraite
+        long: Retraite
+      retirement:
+        short: Retraite
+        long: Compte de retraite
+      mutual_fund:
+        short: Fonds commun
+        long: Fonds commun de placement
+      angel:
+        short: Business angel
+        long: Investissement providentiel
+      trust:
+        short: Fiducie
+        long: Fiducie
+      other:
+        short: Autre
+        long: Autre investissement
     value_tooltip:
       cash: Liquidités
       holdings: Titres
diff --git a/config/locales/views/investments/hu.yml b/config/locales/views/investments/hu.yml
new file mode 100644
index 000000000..7bca28675
--- /dev/null
+++ b/config/locales/views/investments/hu.yml
@@ -0,0 +1,189 @@
+---
+hu:
+  investments:
+    edit:
+      edit: '%{account} szerkesztése'
+    form:
+      none: Nincs
+      subtype_prompt: Válassz befektetéstípust
+    new:
+      title: Add meg a számlaegyenleget
+    show:
+      chart_title: Teljes értéke
+    subtypes:
+      brokerage:
+        short: Brókerzámla
+        long: Brókerzámla
+      401k:
+        short: 401(k)
+        long: 401(k)
+      roth_401k:
+        short: Roth 401(k)
+        long: Roth 401(k)
+      403b:
+        short: 403(b)
+        long: 403(b)
+      457b:
+        short: 457(b)
+        long: 457(b)
+      tsp:
+        short: TSP
+        long: Thrift Savings Plan
+      ira:
+        short: IRA
+        long: Traditional IRA
+      roth_ira:
+        short: Roth IRA
+        long: Roth IRA
+      sep_ira:
+        short: SEP IRA
+        long: SEP IRA
+      simple_ira:
+        short: SIMPLE IRA
+        long: SIMPLE IRA
+      529_plan:
+        short: 529 Plan
+        long: 529 oktatási megtakarítási terv
+      hsa:
+        short: HSA
+        long: Egészségmegtakarítási számla
+      ugma:
+        short: UGMA
+        long: UGMA letéti számla
+      utma:
+        short: UTMA
+        long: UTMA letéti számla
+      isa:
+        short: ISA
+        long: Individual Savings Account
+      lisa:
+        short: LISA
+        long: Lifetime ISA
+      sipp:
+        short: SIPP
+        long: Self-Invested Personal Pension
+      workplace_pension_uk:
+        short: Nyugdíjalap
+        long: Munkahelyi nyugdíjalap
+      rrsp:
+        short: RRSP
+        long: Regisztrált nyugdíj-megtakarítási terv
+      tfsa:
+        short: TFSA
+        long: Adómentes megtakarítási számla
+      resp:
+        short: RESP
+        long: Registered Education Savings Plan
+      lira:
+        short: LIRA
+        long: Locked-In Retirement Account
+      rrif:
+        short: RRIF
+        long: Registered Retirement Income Fund
+      super:
+        short: Super
+        long: Superannuation
+      smsf:
+        short: SMSF
+        long: Self-Managed Super Fund
+      pea:
+        short: PEA
+        long: Plan d'Épargne en Actions
+      pillar_3a:
+        short: Pillar 3a
+        long: Magánnyugdíj (3a pillér)
+      riester:
+        short: Riester
+        long: Riester-Rente
+      pension:
+        short: Nyugdíjalap
+        long: Nyugdíjalap
+      retirement:
+        short: Nyugdíj
+        long: Nyugdíjszámla
+      mutual_fund:
+        short: Befektetési alap
+        long: Befektetési alap
+      angel:
+        short: Angyal
+        long: Angyal-befektetés
+      nps:
+        short: NPS
+        long: Nemzeti Nyugdíjrendszer
+      apy:
+        short: APY
+        long: Atal Pension Yojana
+      indian_stocks:
+        short: Indiai részvények
+        long: Indiai részvények (Demat)
+      indian_equity:
+        short: Indiai tőke
+        long: Indiai tőke
+      indian_etf:
+        short: Indiai ETF
+        long: Indiai ETF
+      life_insurance:
+        short: Életbiztosítás
+        long: Életbiztosítás
+      ppf:
+        short: PPF
+        long: Közszféra megtakarítási alap
+      ssy:
+        short: SSY
+        long: Sukanya Samriddhi Yojana
+      nsc:
+        short: NSC
+        long: Nemzeti megtakarítási igazolás
+      scss:
+        short: SCSS
+        long: Idősek megtakarítási rendszere
+      fd:
+        short: FD
+        long: Lekötött betét
+      rd:
+        short: RD
+        long: Ismétlődő betét
+      pomis:
+        short: POMIS
+        long: Postai havi jövedelmi program
+      kvp:
+        short: KVP
+        long: Kisan Vikas Patra
+      gold_etf:
+        short: Arany ETF
+        long: Arany ETF
+      gold_mf:
+        short: Arany befektetési alap
+        long: Arany befektetési alap
+      sgb:
+        short: SGB
+        long: Szuverén aranykötvény
+      g_sec:
+        short: G-Sec
+        long: Állampapírok
+      sdl:
+        short: SDL
+        long: Állami fejlesztési kötvények
+      corporate_bond:
+        short: Vállalati kötvény
+        long: Vállalati kötvény
+      infrastructure_bond:
+        short: Infrastrukturális kötvény
+        long: Infrastrukturális kötvény
+      tax_free_bond:
+        short: Adómentes kötvény
+        long: Adómentes kötvény
+      gold:
+        short: Arany
+        long: Arany (fizikai vagy digitális)
+      trust:
+        short: Bizalmi alap
+        long: Bizalmi alap
+      other:
+        short: Egyéb
+        long: Egyéb befektetés
+    value_tooltip:
+      cash: Készpénz
+      holdings: Portfólió
+      total: Portfólió egyenlege
+      total_value_tooltip: A teljes portfólió egyenlege a brókerzámlán lévő készpénz (kereskedésre rendelkezésre álló) és a portfólió aktuális piaci értékének összege.
diff --git a/config/locales/views/invitation_mailer/ca.yml b/config/locales/views/invitation_mailer/ca.yml
index da59026b1..31f2f8295 100644
--- a/config/locales/views/invitation_mailer/ca.yml
+++ b/config/locales/views/invitation_mailer/ca.yml
@@ -3,6 +3,6 @@ ca:
   invitation_mailer:
     invite_email:
       accept_button: Accepta la invitació
-      body: "%{inviter} t'ha convidat a unir-te a la família %{family} a %{product_name}!"
+      body: "%{inviter} t'ha convidat a unir-te a %{family} (%{moniker}) a %{product_name}!"
       expiry_notice: Aquesta invitació caducarà en %{days} dies
       greeting: Benvingut/da a %{product_name}!
diff --git a/config/locales/views/invitation_mailer/hu.yml b/config/locales/views/invitation_mailer/hu.yml
new file mode 100644
index 000000000..c8efed152
--- /dev/null
+++ b/config/locales/views/invitation_mailer/hu.yml
@@ -0,0 +1,8 @@
+---
+hu:
+  invitation_mailer:
+    invite_email:
+      accept_button: Meghívó elfogadása
+      body: "%{inviter} meghívott, hogy csatlakozz a(z) %{family} %{moniker} fiókhoz a(z) %{product_name} alkalmazásban!"
+      expiry_notice: Ez a meghívó %{days} nap múlva lejár
+      greeting: Üdvözöl a(z) %{product_name}!
diff --git a/config/locales/views/invitations/ca.yml b/config/locales/views/invitations/ca.yml
index e065d17d4..5c11e701b 100644
--- a/config/locales/views/invitations/ca.yml
+++ b/config/locales/views/invitations/ca.yml
@@ -1,7 +1,14 @@
 ---
 ca:
   invitations:
+    accept_choice:
+      create_account: Crea un compte nou
+      joined_household: T'has unit a la llar.
+      message: "%{inviter} t'ha convidat a unir-te com a %{role}."
+      sign_in_existing: Ja tinc un compte
+      title: Uneix-te a %{family}
     create:
+      existing_user_added: S'ha afegit l'usuari a la teva llar.
       failure: No s'ha pogut enviar la invitació
       success: Invitació enviada correctament
     destroy:
@@ -12,8 +19,9 @@ ca:
       email_label: Correu electrònic
       email_placeholder: Introdueix el correu electrònic
       role_admin: Administrador/a
+      role_guest: Convidat/da
       role_label: Rol
       role_member: Membre
-      submit: Envia invitació
-      subtitle: Envia una invitació per unir-te al teu compte familiar a %{product_name}
+      submit: Envia la invitació
+      subtitle: Envia una invitació perquè s'uneixi al teu compte de %{product_name}
       title: Convida algú
diff --git a/config/locales/views/invitations/fr.yml b/config/locales/views/invitations/fr.yml
index 8d6e9b29f..89901ea69 100644
--- a/config/locales/views/invitations/fr.yml
+++ b/config/locales/views/invitations/fr.yml
@@ -1,7 +1,14 @@
 ---
 fr:
   invitations:
+    accept_choice:
+      create_account: Créer un nouveau compte
+      joined_household: Vous avez rejoint le foyer.
+      message: "%{inviter} vous a invité(e) à rejoindre en tant que %{role}."
+      sign_in_existing: J'ai déjà un compte
+      title: Rejoindre %{family}
     create:
+      existing_user_added: L'utilisateur a été ajouté à votre foyer.
       failure: Impossible d'envoyer l'invitation
       success: Invitation envoyée avec succès
     destroy:
@@ -12,8 +19,9 @@ fr:
       email_label: Adresse e-mail
       email_placeholder: Saisissez une adresse e-mail
       role_admin: Administrateur
+      role_guest: Invité
       role_label: Rôle
       role_member: Membre
       submit: Envoyer l'invitation
-      subtitle: Envoyez une invitation pour rejoindre votre compte familial sur %{product_name}
+      subtitle: Envoyez une invitation pour rejoindre votre compte %{moniker} sur %{product_name}
       title: Inviter quelqu'un
diff --git a/config/locales/views/invitations/hu.yml b/config/locales/views/invitations/hu.yml
new file mode 100644
index 000000000..ca1e06daa
--- /dev/null
+++ b/config/locales/views/invitations/hu.yml
@@ -0,0 +1,27 @@
+---
+hu:
+  invitations:
+    accept_choice:
+      create_account: Új fiók létrehozása
+      joined_household: Csatlakoztál a háztartáshoz.
+      message: "%{inviter} meghívott, hogy csatlakozz %{role} szerepkörben."
+      sign_in_existing: Már van fiókom
+      title: "Csatlakozz a következőhöz: %{family}"
+    create:
+      existing_user_added: A felhasználó hozzá lett adva a háztartásodhoz.
+      failure: Nem sikerült elküldeni a meghívót.
+      success: A meghívó sikeresen elküldve.
+    destroy:
+      failure: Hiba történt a meghívó eltávolítása során.
+      not_authorized: Nincs jogosultságod a meghívók kezeléséhez.
+      success: A meghívó sikeresen eltávolítva.
+    new:
+      email_label: E-mail cím
+      email_placeholder: Add meg az e-mail címet
+      role_admin: Rendszergazda
+      role_guest: Vendég
+      role_label: Szerepkör
+      role_member: Tag
+      submit: Meghívó küldése
+      subtitle: Küldj meghívót, hogy valaki csatlakozzon a(z) %{moniker} fiókodhoz a(z) %{product_name} alkalmazásban
+      title: Valaki meghívása
diff --git a/config/locales/views/invite_codes/ca.yml b/config/locales/views/invite_codes/ca.yml
index e9485d61d..26633cd4f 100644
--- a/config/locales/views/invite_codes/ca.yml
+++ b/config/locales/views/invite_codes/ca.yml
@@ -1,6 +1,10 @@
 ---
 ca:
   invite_codes:
+    create:
+      success: Codi generat
+    destroy:
+      success: Codi eliminat
     index:
       invite_code_description: Genera un nou codi per veure'l aquí. Els codis generats
         que s'hagin utilitzat ja no es mostraran.
diff --git a/config/locales/views/invite_codes/en.yml b/config/locales/views/invite_codes/en.yml
index 8517ae827..a74e8e96f 100644
--- a/config/locales/views/invite_codes/en.yml
+++ b/config/locales/views/invite_codes/en.yml
@@ -1,6 +1,10 @@
 ---
 en:
   invite_codes:
+    create:
+      success: "Code generated"
+    destroy:
+      success: "Code deleted"
     index:
       invite_code_description: Generate a new code to see it displayed here. Generated
         codes that have been used will no longer be shown.
diff --git a/config/locales/views/invite_codes/hu.yml b/config/locales/views/invite_codes/hu.yml
new file mode 100644
index 000000000..3474d5bd9
--- /dev/null
+++ b/config/locales/views/invite_codes/hu.yml
@@ -0,0 +1,10 @@
+---
+hu:
+  invite_codes:
+    create:
+      success: "Kód létrehozva"
+    destroy:
+      success: "Kód törölve"
+    index:
+      invite_code_description: Generálj új kódot, hogy az megjelenjen itt. A már felhasznált generált kódok nem jelennek meg tovább.
+      no_invite_codes: Nincs megjeleníthető kód
diff --git a/config/locales/views/kraken_items/ca.yml b/config/locales/views/kraken_items/ca.yml
new file mode 100644
index 000000000..1bbe2c645
--- /dev/null
+++ b/config/locales/views/kraken_items/ca.yml
@@ -0,0 +1,95 @@
+---
+ca:
+  kraken_item:
+    syncer:
+      accounts_need_setup:
+        one: "%{count} compte necessita configuració"
+        other: "%{count} comptes necessiten configuració"
+      calculating_balances: Calculant saldos...
+      checking_configuration: Comprovant la configuració del compte...
+      checking_credentials: Comprovant credencials...
+      credentials_invalid: Credencials de l'API de Kraken no vàlides. Revisa la teva
+        clau API i el secret.
+      importing_accounts: Important comptes des de Kraken...
+      processing_accounts: Processant dades del compte...
+  kraken_items:
+    complete_account_setup:
+      no_accounts: No hi ha comptes per importar
+      none_selected: No s'ha seleccionat cap compte
+      success:
+        one: S'ha importat %{count} compte
+        other: S'han importat %{count} comptes
+    create:
+      default_name: Kraken
+      success: S'ha connectat correctament a Kraken. El teu compte de l'exchange s'està
+        sincronitzant.
+    destroy:
+      success: S'ha programat la connexió Kraken per a la seva eliminació.
+    kraken_item:
+      delete: Elimina
+      deletion_in_progress: Eliminant...
+      import_accounts_menu: Importa compte
+      no_accounts_message: El teu compte de l'exchange Kraken apareixerà aquí després
+        de sincronitzar.
+      no_accounts_title: No s'han trobat comptes
+      provider_name: Kraken
+      reconnect: Les credencials necessiten actualització
+      setup_action: Importa compte
+      setup_description: Importa aquesta connexió Kraken com a compte d'exchange de
+        cripto.
+      setup_needed: Compte a punt per importar
+      stale_rate_warning: El saldo és aproximat perquè el tipus de canvi exacte per
+        a %{date} no estava disponible. S'actualitzarà a la propera sincronització.
+      status: Darrera sincronització fa %{timestamp}
+      status_never: Mai sincronitzat
+      status_with_summary: Darrera sincronització fa %{timestamp} - %{summary}
+      sync_status:
+        all_synced:
+          one: "%{count} compte sincronitzat"
+          other: "%{count} comptes sincronitzats"
+        no_accounts: No s'han trobat comptes
+        partial_sync: "%{linked_count} sincronitzats, %{unlinked_count} necessiten
+          configuració"
+      syncing: Sincronitzant...
+    link_accounts:
+      select_connection: Tria una connexió Kraken abans d'enllaçar comptes.
+    link_existing_account:
+      errors:
+        invalid_kraken_account: Compte Kraken no vàlid
+        kraken_account_already_linked: Aquest compte Kraken ja està enllaçat
+        only_manual: Només els comptes manuals d'exchange de cripto sense un enllaç
+          de proveïdor existent es poden enllaçar a Kraken
+      select_connection: Tria una connexió Kraken abans d'enllaçar comptes.
+      success: S'ha enllaçat correctament al compte Kraken
+    provider_connection:
+      default_description: Enllaça amb un compte de l'exchange Kraken
+      default_name: Kraken
+      description: Enllaça amb %{name}
+      name: Kraken - %{name}
+    select_accounts:
+      no_credentials_configured: Afegeix les credencials de l'API de Kraken abans
+        de configurar els comptes.
+      select_connection: Tria una connexió Kraken a la configuració del proveïdor.
+    select_existing_account:
+      cancel: Cancel·la
+      check_provider_health: Comprova que les teves credencials de l'API de Kraken
+        siguin vàlides.
+      link: Enllaça
+      no_accounts_found: No s'han trobat comptes Kraken.
+      title: Enllaça compte Kraken
+      wait_for_sync: Espera que Kraken acabi la sincronització.
+    setup_accounts:
+      accounts_count:
+        one: "%{count} compte disponible"
+        other: "%{count} comptes disponibles"
+      cancel: Cancel·la
+      creating: Important...
+      import_selected: Importa els seleccionats
+      instructions: Kraken importa un compte d'exchange de cripto combinat per a aquesta
+        connexió, només amb posicions i execucions d'operacions al comptat.
+      no_accounts: Tots els comptes Kraken s'han importat.
+      select_all: Selecciona-ho tot
+      subtitle: Selecciona el compte de l'exchange per fer-ne el seguiment
+      title: Importa compte Kraken
+    update:
+      success: La connexió Kraken s'ha actualitzat correctament.
diff --git a/config/locales/views/kraken_items/en.yml b/config/locales/views/kraken_items/en.yml
new file mode 100644
index 000000000..eec60a9e4
--- /dev/null
+++ b/config/locales/views/kraken_items/en.yml
@@ -0,0 +1,85 @@
+---
+en:
+  kraken_items:
+    provider_connection:
+      default_name: Kraken
+      default_description: Link to a Kraken exchange account
+      name: "Kraken - %{name}"
+      description: "Link to %{name}"
+    create:
+      default_name: Kraken
+      success: Successfully connected to Kraken. Your exchange account is being synced.
+    update:
+      success: Successfully updated Kraken connection.
+    destroy:
+      success: Scheduled Kraken connection for deletion.
+    select_accounts:
+      select_connection: Choose a Kraken connection in Provider Settings.
+      no_credentials_configured: Add Kraken API credentials before setting up accounts.
+    link_accounts:
+      select_connection: Choose a Kraken connection before linking accounts.
+    select_existing_account:
+      title: Link Kraken Account
+      no_accounts_found: No Kraken accounts found.
+      wait_for_sync: Wait for Kraken to finish syncing.
+      check_provider_health: Check that your Kraken API credentials are valid.
+      link: Link
+      cancel: Cancel
+    link_existing_account:
+      success: Successfully linked to Kraken account
+      select_connection: Choose a Kraken connection before linking accounts.
+      errors:
+        only_manual: Only manual Crypto exchange accounts without an existing provider link can be linked to Kraken
+        invalid_kraken_account: Invalid Kraken account
+        kraken_account_already_linked: This Kraken account is already linked
+    setup_accounts:
+      title: Import Kraken Account
+      subtitle: Select the exchange account to track
+      instructions: Kraken imports one combined Crypto exchange account for this connection, with holdings and spot trade fills only.
+      no_accounts: All Kraken accounts have been imported.
+      accounts_count:
+        one: "%{count} account available"
+        other: "%{count} accounts available"
+      select_all: Select all
+      import_selected: Import Selected
+      cancel: Cancel
+      creating: Importing...
+    complete_account_setup:
+      success:
+        one: "Imported %{count} account"
+        other: "Imported %{count} accounts"
+      none_selected: No accounts selected
+      no_accounts: No accounts to import
+    kraken_item:
+      provider_name: Kraken
+      syncing: Syncing...
+      reconnect: Credentials need updating
+      deletion_in_progress: Deleting...
+      sync_status:
+        no_accounts: No accounts found
+        all_synced:
+          one: "%{count} account synced"
+          other: "%{count} accounts synced"
+        partial_sync: "%{linked_count} synced, %{unlinked_count} need setup"
+      status: "Last synced %{timestamp} ago"
+      status_with_summary: "Last synced %{timestamp} ago - %{summary}"
+      status_never: Never synced
+      delete: Delete
+      no_accounts_title: No accounts found
+      no_accounts_message: Your Kraken exchange account will appear here after syncing.
+      setup_needed: Account ready to import
+      setup_description: Import this Kraken connection as a Crypto exchange account.
+      setup_action: Import Account
+      import_accounts_menu: Import Account
+      stale_rate_warning: "Balance is approximate because the exact exchange rate for %{date} was unavailable. Will update on next sync."
+  kraken_item:
+    syncer:
+      checking_credentials: Checking credentials...
+      credentials_invalid: Invalid Kraken API credentials. Please check your API key and secret.
+      importing_accounts: Importing accounts from Kraken...
+      checking_configuration: Checking account configuration...
+      accounts_need_setup:
+        one: "%{count} account needs setup"
+        other: "%{count} accounts need setup"
+      processing_accounts: Processing account data...
+      calculating_balances: Calculating balances...
diff --git a/config/locales/views/kraken_items/hu.yml b/config/locales/views/kraken_items/hu.yml
new file mode 100644
index 000000000..be4ef5d0f
--- /dev/null
+++ b/config/locales/views/kraken_items/hu.yml
@@ -0,0 +1,85 @@
+---
+hu:
+  kraken_items:
+    provider_connection:
+      default_name: Kraken
+      default_description: Kapcsolódás Kraken tőzsdei számlához
+      name: "Kraken - %{name}"
+      description: "Kapcsolódás ehhez: %{name}"
+    create:
+      default_name: Kraken
+      success: Sikeresen csatlakoztatva a Krakenhez. A tőzsdei számlád szinkronizálása folyamatban van.
+    update:
+      success: Kraken kapcsolat sikeresen frissítve.
+    destroy:
+      success: Kraken kapcsolat törlése ütemezve.
+    select_accounts:
+      select_connection: Válassz Kraken kapcsolatot a Szolgáltatói beállításokban.
+      no_credentials_configured: Add meg a Kraken API hitelesítő adatokat a számlák beállítása előtt.
+    link_accounts:
+      select_connection: Válassz Kraken kapcsolatot a számlák összekapcsolása előtt.
+    select_existing_account:
+      title: Kraken számla összekapcsolása
+      no_accounts_found: Nem találhatók Kraken számlák.
+      wait_for_sync: Várd meg, amíg a Kraken befejezi a szinkronizálást.
+      check_provider_health: Ellenőrizd, hogy a Kraken API hitelesítő adataid érvényesek-e.
+      link: Összekapcsolás
+      cancel: Mégse
+    link_existing_account:
+      success: Sikeresen összekapcsolva Kraken számlával
+      select_connection: Válassz Kraken kapcsolatot a számlák összekapcsolása előtt.
+      errors:
+        only_manual: Csak olyan manuális kriptopiaci számlák kapcsolhatók a Krakenhez, amelyekhez még nincs meglévő szolgáltatói kapcsolat
+        invalid_kraken_account: Érvénytelen Kraken számla
+        kraken_account_already_linked: Ez a Kraken számla már össze van kapcsolva
+    setup_accounts:
+      title: Kraken számla importálása
+      subtitle: Válaszd ki a nyomon követendő tőzsdei számlát
+      instructions: A Kraken egy kombinált kriptotőzsdei számlát importál ehhez a kapcsolathoz, csak portfólióelemekkel és azonnali ügyletteljesítésekkel.
+      no_accounts: Minden Kraken számla importálva lett.
+      accounts_count:
+        one: "%{count} elérhető számla"
+        other: "%{count} elérhető számla"
+      select_all: Összes kijelölése
+      import_selected: Kijelöltek importálása
+      cancel: Mégse
+      creating: Importálás...
+    complete_account_setup:
+      success:
+        one: "%{count} számla importálva"
+        other: "%{count} számla importálva"
+      none_selected: Nincs kijelölt számla
+      no_accounts: Nincs importálható számla
+    kraken_item:
+      provider_name: Kraken
+      syncing: Szinkronizálás...
+      reconnect: A hitelesítő adatok frissítést igényelnek
+      deletion_in_progress: Törlés folyamatban...
+      sync_status:
+        no_accounts: Nem találhatók számlák
+        all_synced:
+          one: "%{count} számla szinkronizálva"
+          other: "%{count} számla szinkronizálva"
+        partial_sync: "%{linked_count} szinkronizálva, %{unlinked_count} beállítást igényel"
+      status: "Utolsó szinkronizálás %{timestamp} ezelőtt"
+      status_with_summary: "Utolsó szinkronizálás %{timestamp} ezelőtt - %{summary}"
+      status_never: Még nem szinkronizált
+      delete: Törlés
+      no_accounts_title: Nem találhatók számlák
+      no_accounts_message: A Kraken tőzsdei számlád szinkronizálás után jelenik meg itt.
+      setup_needed: Számla importálásra kész
+      setup_description: Importáld ezt a Kraken kapcsolatot kriptotőzsdei számlaként.
+      setup_action: Számla importálása
+      import_accounts_menu: Számla importálása
+      stale_rate_warning: "Az egyenleg közelítő értékű, mert a(z) %{date} pontos árfolyama nem volt elérhető. A következő szinkronizáláskor frissül."
+  kraken_item:
+    syncer:
+      checking_credentials: Hitelesítő adatok ellenőrzése...
+      credentials_invalid: Érvénytelen Kraken API hitelesítő adatok. Kérlek ellenőrizd az API-kulcsodat és a titkos kulcsodat.
+      importing_accounts: Számlák importálása a Krakenből...
+      checking_configuration: Számlakonfiguráció ellenőrzése...
+      accounts_need_setup:
+        one: "%{count} számla beállítást igényel"
+        other: "%{count} számla beállítást igényel"
+      processing_accounts: Számlaadat-feldolgozás...
+      calculating_balances: Egyenlegek kiszámítása...
diff --git a/config/locales/views/layout/ca.yml b/config/locales/views/layout/ca.yml
index 8868c451c..f7bf5a2b4 100644
--- a/config/locales/views/layout/ca.yml
+++ b/config/locales/views/layout/ca.yml
@@ -2,23 +2,28 @@
 ca:
   layouts:
     application:
-      privacy_mode: Alternar mode de privadesa
       nav:
         assistant: Assistent
         budgets: Pressupostos
         home: Inici
         reports: Informes
         transactions: Transaccions
+      privacy_mode: Commuta el mode de privadesa
+      skip_to_main: Salta al contingut principal
     auth:
       existing_account: Ja tens un compte?
-      no_account: Nou a %{product_name}?
+      no_account: Ets nou a %{product_name}?
       sign_in: Inicia sessió
       sign_up: Crea un compte
     shared:
+      confirm_dialog:
+        are_you_sure: Segur que vols continuar?
+        cannot_be_undone: Aquesta acció no es pot desfer.
+        confirm: Confirma
       footer:
-        privacy_policy: Política de privacitat
-        terms_of_service: Termes del servei
+        privacy_policy: Política de privadesa
+        terms_of_service: Condicions del servei
     trial:
-      open_demo: Demo oberta
+      contribute: Contribueix
       data_deleted_in_days: Les dades s'eliminaran en %{days} dies
-      contribute: Contribuir
\ No newline at end of file
+      open_demo: Demostració oberta
diff --git a/config/locales/views/layout/de.yml b/config/locales/views/layout/de.yml
index 4738880b3..158a13fe6 100644
--- a/config/locales/views/layout/de.yml
+++ b/config/locales/views/layout/de.yml
@@ -3,6 +3,7 @@ de:
   layouts:
     application:
       privacy_mode: Datenschutzmodus umschalten
+      skip_to_main: Zum Hauptinhalt springen
       nav:
         assistant: Assistent
         budgets: Budgets
diff --git a/config/locales/views/layout/en.yml b/config/locales/views/layout/en.yml
index dfb4ffaed..09ed41ddb 100644
--- a/config/locales/views/layout/en.yml
+++ b/config/locales/views/layout/en.yml
@@ -3,6 +3,7 @@ en:
   layouts:
     application:
       privacy_mode: Toggle privacy mode
+      skip_to_main: Skip to main content
       nav:
         assistant: Assistant
         budgets: Budgets
@@ -19,6 +20,10 @@ en:
       footer:
         privacy_policy: Privacy Policy
         terms_of_service: Terms of Service
+      confirm_dialog:
+        are_you_sure: Are you sure?
+        cannot_be_undone: This action cannot be undone.
+        confirm: Confirm
     trial:
       open_demo: Open demo
       data_deleted_in_days: Data deleted in %{days} days
diff --git a/config/locales/views/layout/es.yml b/config/locales/views/layout/es.yml
index b1627fd14..080d6e37a 100644
--- a/config/locales/views/layout/es.yml
+++ b/config/locales/views/layout/es.yml
@@ -3,6 +3,7 @@ es:
   layouts:
     application:
       privacy_mode: Alternar modo de privacidad
+      skip_to_main: Saltar al contenido principal
       nav:
         assistant: Asistente
         budgets: Presupuestos
diff --git a/config/locales/views/layout/fr.yml b/config/locales/views/layout/fr.yml
index 54f9cca4b..0cec20575 100644
--- a/config/locales/views/layout/fr.yml
+++ b/config/locales/views/layout/fr.yml
@@ -3,6 +3,7 @@ fr:
   layouts:
     application:
       privacy_mode: Activer/désactiver le mode confidentialité
+      skip_to_main: Aller au contenu principal
       nav:
         assistant: Assistant
         budgets: Budgets
diff --git a/config/locales/views/layout/hu.yml b/config/locales/views/layout/hu.yml
new file mode 100644
index 000000000..299aaac90
--- /dev/null
+++ b/config/locales/views/layout/hu.yml
@@ -0,0 +1,29 @@
+---
+hu:
+  layouts:
+    application:
+      privacy_mode: Adatvédelmi mód váltása
+      skip_to_main: Ugrás a fő tartalomhoz
+      nav:
+        assistant: Asszisztens
+        budgets: Költségvetések
+        home: Kezdőlap
+        reports: Jelentések
+        transactions: Tranzakciók
+    auth:
+      existing_account: Már van fiókod?
+      no_account: Még nem ismered a %{product_name}-t?
+      sign_in: Bejelentkezés
+      sign_up: Fiók létrehozása
+    shared:
+      footer:
+        privacy_policy: Adatvédelmi irányelvek
+        terms_of_service: Felhasználási feltételek
+      confirm_dialog:
+        are_you_sure: Biztosan?
+        cannot_be_undone: Ez a művelet nem vonható vissza.
+        confirm: Megerősítés
+    trial:
+      open_demo: Demo megnyitása
+      data_deleted_in_days: Az adatok törlődnek %{days} nap múlva
+      contribute: Közreműködés
diff --git a/config/locales/views/layout/nb.yml b/config/locales/views/layout/nb.yml
index ebabc16cf..be6aed666 100644
--- a/config/locales/views/layout/nb.yml
+++ b/config/locales/views/layout/nb.yml
@@ -3,6 +3,7 @@ nb:
   layouts:
     application:
       privacy_mode: Veksle personvernmodus
+      skip_to_main: Hopp til hovedinnhold
       nav:
         assistant: Assistent
         budgets: Budsjett
diff --git a/config/locales/views/layout/nl.yml b/config/locales/views/layout/nl.yml
index 9ee7a2b1b..322f87195 100644
--- a/config/locales/views/layout/nl.yml
+++ b/config/locales/views/layout/nl.yml
@@ -3,6 +3,7 @@ nl:
   layouts:
     application:
       privacy_mode: Privacymodus in-/uitschakelen
+      skip_to_main: Ga naar hoofdinhoud
       nav:
         assistant: Assistent
         budgets: Budgetten
diff --git a/config/locales/views/layout/pl.yml b/config/locales/views/layout/pl.yml
index fe70cadf6..1f68d3cf8 100644
--- a/config/locales/views/layout/pl.yml
+++ b/config/locales/views/layout/pl.yml
@@ -3,6 +3,7 @@ pl:
   layouts:
     application:
       privacy_mode: Przełącz tryb prywatności
+      skip_to_main: Przejdź do głównej treści
       nav:
         assistant: Asystent
         budgets: Budżety
diff --git a/config/locales/views/layout/pt-BR.yml b/config/locales/views/layout/pt-BR.yml
index 2f76fecca..61a25ddf2 100644
--- a/config/locales/views/layout/pt-BR.yml
+++ b/config/locales/views/layout/pt-BR.yml
@@ -3,6 +3,7 @@ pt-BR:
   layouts:
     application:
       privacy_mode: Alternar modo de privacidade
+      skip_to_main: Pular para o conteúdo principal
       nav:
         assistant: Assistente
         budgets: Orçamentos
diff --git a/config/locales/views/layout/ro.yml b/config/locales/views/layout/ro.yml
index 15ed02dac..218d33e36 100644
--- a/config/locales/views/layout/ro.yml
+++ b/config/locales/views/layout/ro.yml
@@ -3,6 +3,7 @@ ro:
   layouts:
     application:
       privacy_mode: Comutare mod confidențialitate
+      skip_to_main: Sari la conținutul principal
       nav:
         assistant: Asistent
         budgets: Bugete
diff --git a/config/locales/views/layout/tr.yml b/config/locales/views/layout/tr.yml
index d7a482e42..5a8ad2877 100644
--- a/config/locales/views/layout/tr.yml
+++ b/config/locales/views/layout/tr.yml
@@ -3,6 +3,7 @@ tr:
   layouts:
     application:
       privacy_mode: Gizlilik modunu değiştir
+      skip_to_main: Ana içeriğe atla
       nav:
         assistant: Asistan
         budgets: Bütçeler
diff --git a/config/locales/views/layout/zh-CN.yml b/config/locales/views/layout/zh-CN.yml
index 8fc58045e..0cd552d11 100644
--- a/config/locales/views/layout/zh-CN.yml
+++ b/config/locales/views/layout/zh-CN.yml
@@ -4,6 +4,7 @@ zh-CN:
   layouts:
     application:
       privacy_mode: 切换隐私模式
+      skip_to_main: 跳到主要内容
       nav:
         assistant: 智能助手
         budgets: 预算管理
diff --git a/config/locales/views/layout/zh-TW.yml b/config/locales/views/layout/zh-TW.yml
index 091625bea..597dd971c 100644
--- a/config/locales/views/layout/zh-TW.yml
+++ b/config/locales/views/layout/zh-TW.yml
@@ -3,6 +3,7 @@ zh-TW:
   layouts:
     application:
       privacy_mode: 切換隱私模式
+      skip_to_main: 跳至主要內容
       nav:
         assistant: 助手
         budgets: 預算
diff --git a/config/locales/views/loans/ca.yml b/config/locales/views/loans/ca.yml
index 74a8f1a52..c22103a32 100644
--- a/config/locales/views/loans/ca.yml
+++ b/config/locales/views/loans/ca.yml
@@ -7,7 +7,10 @@ ca:
       initial_balance: Saldo inicial del préstec
       interest_rate: Tipus d'interès
       interest_rate_placeholder: '5.25'
-      rate_type: Tipus d'interès
+      none: Cap
+      rate_type: Modalitat del tipus
+      subtype_none: Cap
+      subtype_prompt: Selecciona el tipus de préstec
       term_months: Termini (mesos)
       term_months_placeholder: '360'
     new:
@@ -23,6 +26,7 @@ ca:
       unknown: Desconegut
     tabs:
       overview:
+        edit_loan_details: Edita els detalls del préstec
         interest_rate: Tipus d'interès
         monthly_payment: Quota mensual
         not_applicable: No aplicable
diff --git a/config/locales/views/loans/en.yml b/config/locales/views/loans/en.yml
index 157c01cf2..1c60d31d0 100644
--- a/config/locales/views/loans/en.yml
+++ b/config/locales/views/loans/en.yml
@@ -10,6 +10,7 @@ en:
       rate_type: Rate type
       term_months: Term (months)
       term_months_placeholder: '360'
+      none: None
       subtype_prompt: Select loan type
       subtype_none: None
     new:
@@ -23,3 +24,14 @@ en:
       term: Term
       type: Type
       unknown: Unknown
+    tabs:
+      overview:
+        interest_rate: Interest Rate
+        monthly_payment: Monthly Payment
+        not_applicable: N/A
+        original_principal: Original Principal
+        remaining_principal: Remaining Principal
+        term: Term
+        type: Type
+        unknown: Unknown
+        edit_loan_details: "Edit loan details"
diff --git a/config/locales/views/loans/es.yml b/config/locales/views/loans/es.yml
index bb6e526ce..42e397484 100644
--- a/config/locales/views/loans/es.yml
+++ b/config/locales/views/loans/es.yml
@@ -10,6 +10,8 @@ es:
       rate_type: Tipo de interés
       term_months: Plazo (meses)
       term_months_placeholder: '360'
+      subtype_prompt: Selecciona el tipo de préstamo
+      subtype_none: Ninguno
     new:
       title: Introduce los detalles del préstamo
     overview:
diff --git a/config/locales/views/loans/fr.yml b/config/locales/views/loans/fr.yml
index 9cfa25bc3..fb3d14b0e 100644
--- a/config/locales/views/loans/fr.yml
+++ b/config/locales/views/loans/fr.yml
@@ -10,6 +10,8 @@ fr:
       rate_type: Type de taux
       term_months: Durée (mois)
       term_months_placeholder: '360'
+      subtype_prompt: Sélectionner le type de prêt
+      subtype_none: Aucun
     new:
       title: Saisir les détails du prêt
     overview:
diff --git a/config/locales/views/loans/hu.yml b/config/locales/views/loans/hu.yml
new file mode 100644
index 000000000..3a2141329
--- /dev/null
+++ b/config/locales/views/loans/hu.yml
@@ -0,0 +1,37 @@
+---
+hu:
+  loans:
+    edit:
+      edit: '%{account} szerkesztése'
+    form:
+      interest_rate: Kamatláb
+      interest_rate_placeholder: '5.25'
+      initial_balance: Eredeti hitelösszeg
+      rate_type: Kamat típusa
+      term_months: Futamidő (hónap)
+      term_months_placeholder: '360'
+      none: Nincs
+      subtype_prompt: Válassz hiteltípust
+      subtype_none: Nincs
+    new:
+      title: Add meg a hitel adatait
+    overview:
+      interest_rate: Kamatláb
+      monthly_payment: Havi törlesztőrészlet
+      not_applicable: N/A
+      original_principal: Eredeti tőkeösszeg
+      remaining_principal: Fennmaradó tőkeösszeg
+      term: Futamidő
+      type: Típus
+      unknown: Ismeretlen
+    tabs:
+      overview:
+        interest_rate: Kamatláb
+        monthly_payment: Havi törlesztőrészlet
+        not_applicable: N/A
+        original_principal: Eredeti tőkeösszeg
+        remaining_principal: Fennmaradó tőkeösszeg
+        term: Futamidő
+        type: Típus
+        unknown: Ismeretlen
+        edit_loan_details: "Hitel adatainak szerkesztése"
diff --git a/config/locales/views/lunchflow_items/ca.yml b/config/locales/views/lunchflow_items/ca.yml
index 525e285ee..0df27fcba 100644
--- a/config/locales/views/lunchflow_items/ca.yml
+++ b/config/locales/views/lunchflow_items/ca.yml
@@ -1,9 +1,22 @@
 ---
 ca:
   lunchflow_items:
+    api_error:
+      check_provider_settings: Revisa la configuració del proveïdor
+      common_issues: 'Problemes habituals:'
+      expired_credentials_desc: Genera una nova clau API des de Lunch Flow
+      expired_credentials_label: Credencials caducades
+      invalid_api_key_desc: Revisa la teva clau API a la configuració del proveïdor
+      invalid_api_key_label: Clau API no vàlida
+      network_issue_desc: Comprova la teva connexió a internet
+      network_issue_label: Problema de xarxa
+      service_down_desc: L'API de Lunch Flow pot estar temporalment no disponible
+      service_down_label: Servei caigut
+      title: Error de connexió Lunch Flow
+      unable_to_connect: No s'ha pogut connectar a Lunch Flow
     complete_account_setup:
       all_skipped: S'han omès tots els comptes. No s'ha creat cap compte.
-      creation_failed: "No s'han pogut crear els comptes: %{error}"
+      creation_failed: 'No s''han pogut crear els comptes: %{error}'
       no_accounts: No hi ha comptes per configurar.
       success: S'han creat correctament %{count} compte(s).
     create:
@@ -15,80 +28,88 @@ ca:
     link_accounts:
       all_already_linked:
         one: El compte seleccionat (%{names}) ja està enllaçat
-        other: "Tots els %{count} comptes seleccionats ja estan enllaçats: %{names}"
-      api_error: "Error d'API: %{message}"
+        other: 'Tots els %{count} comptes seleccionats ja estan enllaçats: %{names}'
+      api_error: 'Error de l''API: %{message}'
       invalid_account_names:
         one: No es pot enllaçar un compte sense nom
         other: No es poden enllaçar %{count} comptes sense nom
       link_failed: No s'han pogut enllaçar els comptes
-      no_accounts_selected: Si us plau, selecciona almenys un compte
-      no_api_key: No hi ha clau API
+      no_accounts_selected: Selecciona almenys un compte
+      no_api_key: La clau API de Lunch Flow no està configurada. Configura-la a la
+        configuració.
+      no_credentials_configured: Configura primer la teva clau API de Lunch Flow a
+        la configuració del proveïdor.
       partial_invalid: S'han enllaçat correctament %{created_count} compte(s), %{already_linked_count}
         ja estaven enllaçats, %{invalid_count} compte(s) tenien noms no vàlids
-      partial_success: "S'han enllaçat correctament %{created_count} compte(s). %{already_linked_count}
-        compte(s) ja estaven enllaçats: %{already_linked_names}"
+      partial_success: 'S''han enllaçat correctament %{created_count} compte(s). %{already_linked_count}
+        compte(s) ja estaven enllaçats: %{already_linked_names}'
       success:
         one: S'ha enllaçat correctament %{count} compte
         other: S'han enllaçat correctament %{count} comptes
     link_existing_account:
       account_already_linked: Aquest compte ja està enllaçat a un proveïdor
-      api_error: "Error d'API: %{message}"
+      api_error: 'Error de l''API: %{message}'
       invalid_account_name: No es pot enllaçar un compte sense nom
       lunchflow_account_already_linked: Aquest compte de Lunch Flow ja està enllaçat
         a un altre compte
       lunchflow_account_not_found: No s'ha trobat el compte de Lunch Flow
-      missing_parameters: Falten els paràmetres requerits
-      no_api_key: No hi ha clau API
+      missing_parameters: Falten paràmetres obligatoris
+      no_api_key: La clau API de Lunch Flow no està configurada. Configura-la a la
+        configuració.
       success: S'ha enllaçat correctament %{account_name} amb Lunch Flow
     loading:
       loading_message: Carregant comptes de Lunch Flow...
       loading_title: Carregant
     lunchflow_item:
       accounts_need_setup: Els comptes necessiten configuració
-      delete: Eliminar connexió
-      deletion_in_progress: s'està eliminant...
+      delete: Elimina la connexió
+      deletion_in_progress: eliminació en curs...
       error: Error
       no_accounts_description: Aquesta connexió encara no té comptes enllaçats.
       no_accounts_title: No hi ha comptes
-      setup_action: Configurar nous comptes
-      setup_description: "%{linked} de %{total} comptes enllaçats. Tria els tipus de comptes
-        per als teus comptes de Lunch Flow importats recentment."
-      setup_needed: Nous comptes preparats per a la configuració
-      status: Sincronitzat %{timestamp} fa
+      setup_action: Configura els nous comptes
+      setup_description: "%{linked} de %{total} comptes enllaçats. Tria els tipus
+        de compte per als teus nous comptes Lunch Flow importats."
+      setup_needed: Nous comptes a punt per configurar
+      status: Sincronitzat fa %{timestamp}
       status_never: Mai sincronitzat
-      status_with_summary: Sincronitzat per última vegada %{timestamp} fa • %{summary}
+      status_with_summary: Darrera sincronització fa %{timestamp} • %{summary}
       syncing: Sincronitzant...
       total: Total
       unlinked: Sense enllaç
     select_accounts:
       accounts_selected: comptes seleccionats
-      api_error: "Error d'API: %{message}"
+      api_error: 'Error de l''API: %{message}'
       cancel: Cancel·la
-      configure_name_in_lunchflow: No es pot importar - si us plau, configura el nom del compte a
-        Lunchflow
-      description: Selecciona els comptes que vols enllaçar amb el teu compte de %{product_name}.
+      configure_name_in_lunchflow: No es pot importar — configura el nom del compte
+        a Lunch Flow
+      description: Selecciona els comptes que vols enllaçar al teu compte de %{product_name}.
       link_accounts: Enllaça els comptes seleccionats
-      no_accounts_found: No s'han trobat comptes. Si us plau, comprova la configuració de la teva clau API.
-      no_api_key: La clau API de Lunch Flow no està configurada. Configura-la a Configuració.
-      no_credentials_configured: Primer, configura la teva clau API de Lunch Flow a
-        Configuració de proveïdors.
+      no_accounts_found: No s'han trobat comptes. Comprova la configuració de la teva
+        clau API.
+      no_api_key: La clau API de Lunch Flow no està configurada. Configura-la a la
+        configuració.
+      no_credentials_configured: Configura primer la teva clau API de Lunch Flow a
+        la configuració del proveïdor.
       no_name_placeholder: "(Sense nom)"
       title: Selecciona comptes de Lunch Flow
     select_existing_account:
       account_already_linked: Aquest compte ja està enllaçat a un proveïdor
       all_accounts_already_linked: Tots els comptes de Lunch Flow ja estan enllaçats
-      api_error: "Error d'API: %{message}"
+      api_error: 'Error de l''API: %{message}'
       cancel: Cancel·la
-      configure_name_in_lunchflow: No es pot importar - si us plau, configura el nom del compte a
-        Lunchflow
-      description: Selecciona un compte de Lunch Flow per enllaçar-lo amb aquest compte. Les transaccions
-        se sincronitzaran i deduplicaran automàticament.
+      configure_name_in_lunchflow: No es pot importar — configura el nom del compte
+        a Lunch Flow
+      description: Selecciona un compte de Lunch Flow per enllaçar-lo amb aquest compte.
+        Les transaccions es sincronitzaran i deduplicaran automàticament.
       link_account: Enllaça compte
       no_account_specified: No s'ha especificat cap compte
-      no_accounts_found: No s'han trobat comptes de Lunch Flow. Si us plau, comprova la configuració de la teva clau API.
-      no_api_key: La clau API de Lunch Flow no està configurada. Configura-la a Configuració.
-      no_credentials_configured: Primer, configura la teva clau API de Lunch Flow a
-        Configuració de proveïdors.
+      no_accounts_found: No s'han trobat comptes de Lunch Flow. Comprova la configuració
+        de la teva clau API.
+      no_api_key: La clau API de Lunch Flow no està configurada. Configura-la a la
+        configuració.
+      no_credentials_configured: Configura primer la teva clau API de Lunch Flow a
+        la configuració del proveïdor.
       no_name_placeholder: "(Sense nom)"
       title: Enllaça %{account_name} amb Lunch Flow
     setup_accounts:
@@ -97,62 +118,75 @@ ca:
         credit_card: Targeta de crèdit
         depository: Compte corrent o d'estalvis
         investment: Compte d'inversió
-        loan: Prèstec o hipoteca
-        other_asset: Alt actiu
+        loan: Préstec o hipoteca
+        other_asset: Altre actiu
         skip: Omet aquest compte
       all_accounts_linked: Tots els teus comptes de Lunch Flow ja s'han configurat.
-      api_error: "Error d'API: %{message}"
+      api_error: 'Error de l''API: %{message}'
       balance: Saldo
       cancel: Cancel·la
-      choose_account_type: 'Tria el tipus de compte correcte per a cada compte de Lunch Flow:'
-      create_accounts: Crear comptes
+      choose_account_type: 'Tria el tipus de compte correcte per a cada compte de
+        Lunch Flow:'
+      create_accounts: Crea comptes
       creating_accounts: Creant comptes...
       fetch_failed: No s'han pogut obtenir els comptes
       historical_data_range: 'Rang de dades històriques:'
       no_accounts_to_setup: No hi ha comptes per configurar
-      no_api_key: La clau API de Lunch Flow no està configurada. Si us plau, comprova la configuració
+      no_api_key: La clau API de Lunch Flow no està configurada. Revisa la configuració
         de la connexió.
-      subtitle: Tria els tipus de comptes correctes per als teus comptes importats
+      subtitle: Tria els tipus de compte correctes per als teus comptes importats
       subtype_labels:
-        credit_card: Targeta de crèdit
+        credit_card: ''
         depository: 'Subtipus de compte:'
-        investment: "Tipus d'inversió:"
-        loan: "Tipus de préstec:"
-        other_asset: Alt actiu
+        investment: 'Tipus d''inversió:'
+        loan: 'Tipus de préstec:'
+        other_asset: ''
       subtype_messages:
-        credit_card: Les targetes de crèdit es configuraran automàticament com a comptes de targeta de crèdit.
-        other_asset: No calen opcions addicionals per als Altres Actius.
+        credit_card: Les targetes de crèdit es configuraran automàticament com a comptes
+          de targeta de crèdit.
+        other_asset: No calen opcions addicionals per a altres actius.
       subtypes:
         depository:
-          cd: Certificat de Dipòsit
+          cd: Certificat de dipòsit
           checking: Compte corrent
-          hsa: Compte d'estalvis de salut
-          money_market: Fons mercant
-          savings: Compte d'estalvis
+          hsa: Compte d'estalvi per a salut
+          money_market: Mercat monetari
+          savings: Estalvis
         investment:
           401k: 401(k)
           403b: 403(b)
           529_plan: Pla 529
-          angel: Àngel
+          angel: Inversió àngel
           brokerage: Corredoria
-          hsa: Compte d'estalvis de salut
+          hsa: Compte d'estalvi per a salut
           ira: IRA tradicional
-          mutual_fund: Fons comú d'inversió
-          pension: Jubilació
+          mutual_fund: Fons d'inversió
+          pension: Pensió
           retirement: Jubilació
-          roth_401k: 401(k) Roth
+          roth_401k: Roth 401(k)
           roth_ira: IRA Roth
-          tsp: Pla d'estalvis de retirada (TSP)
+          tsp: Pla d'estalvis de jubilació (TSP)
         loan:
-          auto: Prèstec de vehicle
+          auto: Préstec d'automòbil
           mortgage: Hipoteca
-          other: Alt préstec
-          student: Prèstec estudiantil
+          other: Altre préstec
+          student: Préstec d'estudis
       sync_start_date_help: Selecciona fins on vols sincronitzar l'historial de transaccions.
-        Està disponible un màxim de 3 anys d'historial.
-      sync_start_date_label: 'Començar a sincronitzar transaccions des de:'
+        Hi ha un màxim de 3 anys d'historial disponible.
+      sync_start_date_label: 'Comença a sincronitzar transaccions des de:'
       title: Configura els teus comptes de Lunch Flow
+    setup_required:
+      api_key_description: Abans d'enllaçar comptes Lunch Flow, has de configurar
+        la teva clau API de Lunch Flow.
+      api_key_not_configured: Clau API no configurada
+      go_to_provider_settings: Ves a la configuració del proveïdor
+      setup_step_1_html: Ves a <strong>Configuració → Proveïdors</strong>
+      setup_step_2_html: Localitza la secció <strong>Lunch Flow</strong>
+      setup_step_3: Introdueix la teva clau API de Lunch Flow
+      setup_step_4: Torna aquí per enllaçar els teus comptes
+      setup_steps_title: 'Passos de configuració:'
+      title: Cal configurar Lunch Flow
     sync:
-      success: S'ha iniciat la sincronització
+      success: Sincronització iniciada
     update:
       success: La connexió amb Lunch Flow s'ha actualitzat
diff --git a/config/locales/views/lunchflow_items/en.yml b/config/locales/views/lunchflow_items/en.yml
index df7534395..50ebe2ced 100644
--- a/config/locales/views/lunchflow_items/en.yml
+++ b/config/locales/views/lunchflow_items/en.yml
@@ -1,6 +1,29 @@
 ---
 en:
   lunchflow_items:
+    api_error:
+      title: Lunch Flow Connection Error
+      unable_to_connect: Unable to connect to Lunch Flow
+      common_issues: "Common Issues:"
+      invalid_api_key_label: Invalid API Key
+      invalid_api_key_desc: Check your API key in Provider Settings
+      expired_credentials_label: Expired Credentials
+      expired_credentials_desc: Generate a new API key from Lunch Flow
+      network_issue_label: Network Issue
+      network_issue_desc: Check your internet connection
+      service_down_label: Service Down
+      service_down_desc: Lunch Flow API may be temporarily unavailable
+      check_provider_settings: Check Provider Settings
+    setup_required:
+      title: Lunch Flow Setup Required
+      api_key_not_configured: API Key Not Configured
+      api_key_description: Before you can link Lunch Flow accounts, you need to configure your Lunch Flow API key.
+      setup_steps_title: "Setup Steps:"
+      setup_step_1_html: "Go to <strong>Settings → Providers</strong>"
+      setup_step_2_html: "Find the <strong>Lunch Flow</strong> section"
+      setup_step_3: Enter your Lunch Flow API key
+      setup_step_4: Return here to link your accounts
+      go_to_provider_settings: Go to Provider Settings
     create:
       success: Lunch Flow connection created successfully
     destroy:
diff --git a/config/locales/views/lunchflow_items/hu.yml b/config/locales/views/lunchflow_items/hu.yml
new file mode 100644
index 000000000..ebbc76dc2
--- /dev/null
+++ b/config/locales/views/lunchflow_items/hu.yml
@@ -0,0 +1,166 @@
+---
+hu:
+  lunchflow_items:
+    api_error:
+      title: Lunch Flow kapcsolódási hiba
+      unable_to_connect: Nem sikerült csatlakozni a Lunch Flow-hoz
+      common_issues: "Gyakori problémák:"
+      invalid_api_key_label: Érvénytelen API-kulcs
+      invalid_api_key_desc: Ellenőrizd az API-kulcsodat a Szolgáltatói beállításokban
+      expired_credentials_label: Lejárt hitelesítő adatok
+      expired_credentials_desc: Generálj új API-kulcsot a Lunch Flow-ban
+      network_issue_label: Hálózati probléma
+      network_issue_desc: Ellenőrizd az internetkapcsolatodat
+      service_down_label: Szolgáltatás leállása
+      service_down_desc: A Lunch Flow API ideiglenesen nem érhető el
+      check_provider_settings: Szolgáltatói beállítások ellenőrzése
+    setup_required:
+      title: Lunch Flow beállítás szükséges
+      api_key_not_configured: Az API-kulcs nincs beállítva
+      api_key_description: A Lunch Flow számlák összekapcsolása előtt be kell állítanod a Lunch Flow API-kulcsodat.
+      setup_steps_title: "Beállítási lépések:"
+      setup_step_1_html: "Menj a <strong>Beállítások → Szolgáltatók</strong> menübe"
+      setup_step_2_html: "Keresd meg a <strong>Lunch Flow</strong> részt"
+      setup_step_3: Add meg a Lunch Flow API-kulcsodat
+      setup_step_4: Térj vissza ide a számlák összekapcsolásához
+      go_to_provider_settings: Szolgáltatói beállítások megnyitása
+    create:
+      success: Lunch Flow kapcsolat sikeresen létrehozva
+    destroy:
+      success: Lunch Flow kapcsolat eltávolítva
+    index:
+      title: Lunch Flow kapcsolatok
+    loading:
+      loading_message: Lunch Flow számlák betöltése...
+      loading_title: Betöltés
+    link_accounts:
+      all_already_linked:
+        one: "A kiválasztott számla (%{names}) már össze van kapcsolva"
+        other: "Mind a(z) %{count} kiválasztott számla már össze van kapcsolva: %{names}"
+      api_error: "API hiba: %{message}"
+      invalid_account_names:
+        one: "Nem lehet összekapcsolni üres nevű számlát"
+        other: "Nem lehet összekapcsolni %{count} üres nevű számlát"
+      link_failed: Nem sikerült összekapcsolni a számlákat
+      no_accounts_selected: Kérlek válassz legalább egy számlát
+      partial_invalid: "%{created_count} számla sikeresen összekapcsolva, %{already_linked_count} már össze volt kapcsolva, %{invalid_count} számla nevei érvénytelenek"
+      partial_success: "%{created_count} számla sikeresen összekapcsolva. %{already_linked_count} számla már össze volt kapcsolva: %{already_linked_names}"
+      success:
+        one: "%{count} számla sikeresen összekapcsolva"
+        other: "%{count} számla sikeresen összekapcsolva"
+    lunchflow_item:
+      accounts_need_setup: Számlák beállítást igényelnek
+      delete: Kapcsolat törlése
+      deletion_in_progress: törlés folyamatban...
+      error: Hiba
+      no_accounts_description: Ehhez a kapcsolathoz még nincsenek összekapcsolt számlák.
+      no_accounts_title: Nincsenek számlák
+      setup_action: Új számlák beállítása
+      setup_description: "%{linked} / %{total} számla összekapcsolva. Válaszd ki az újonnan importált Lunch Flow számlák típusait."
+      setup_needed: Új számlák beállításra várnak
+      status: "Szinkronizálva %{timestamp} ezelőtt"
+      status_never: Még nem szinkronizált
+      status_with_summary: "Utolsó szinkronizálás %{timestamp} ezelőtt • %{summary}"
+      syncing: Szinkronizálás...
+      total: Összesen
+      unlinked: Nincs összekapcsolva
+    select_accounts:
+      accounts_selected: kiválasztott számla
+      api_error: "API hiba: %{message}"
+      cancel: Mégse
+      configure_name_in_lunchflow: Nem importálható — kérlek állítsd be a számla nevét a Lunch Flow-ban
+      description: "Válaszd ki azokat a számlákat, amelyeket össze szeretnél kapcsolni a(z) %{product_name} fiókkal."
+      link_accounts: Kiválasztott számlák összekapcsolása
+      no_accounts_found: Nem találhatók számlák. Kérlek ellenőrizd az API-kulcs konfigurációdat.
+      no_api_key: A Lunch Flow API-kulcs nincs beállítva. Kérlek állítsd be a Beállításokban.
+      no_name_placeholder: "(Nincs név)"
+      title: Lunch Flow számlák kiválasztása
+    select_existing_account:
+      account_already_linked: Ez a számla már össze van kapcsolva egy szolgáltatóval
+      all_accounts_already_linked: Minden Lunch Flow számla már össze van kapcsolva
+      api_error: "API hiba: %{message}"
+      cancel: Mégse
+      configure_name_in_lunchflow: Nem importálható — kérlek állítsd be a számla nevét a Lunchflow-ban
+      description: Válassz egy Lunch Flow számlát, amelyet ehhez a számlához szeretnél kapcsolni. A tranzakciók automatikusan szinkronizálásra és deduplikálásra kerülnek.
+      link_account: Számla összekapcsolása
+      no_account_specified: Nem lett megadva számla
+      no_accounts_found: Nem találhatók Lunch Flow számlák. Kérlek ellenőrizd az API-kulcs konfigurációdat.
+      no_api_key: A Lunch Flow API-kulcs nincs beállítva. Kérlek állítsd be a Beállításokban.
+      no_name_placeholder: "(Nincs név)"
+      title: "%{account_name} összekapcsolása a Lunch Flow-val"
+    link_existing_account:
+      account_already_linked: Ez a számla már össze van kapcsolva egy szolgáltatóval
+      api_error: "API hiba: %{message}"
+      invalid_account_name: Nem lehet összekapcsolni üres nevű számlát
+      lunchflow_account_already_linked: Ez a Lunch Flow számla már össze van kapcsolva egy másik számlával
+      lunchflow_account_not_found: Lunch Flow számla nem található
+      missing_parameters: Hiányzó kötelező paraméterek
+      success: "%{account_name} sikeresen összekapcsolva a Lunch Flow-val"
+    setup_accounts:
+      account_type_label: "Számla típusa:"
+      all_accounts_linked: "Minden Lunch Flow számlád már be van állítva."
+      api_error: "API hiba: %{message}"
+      fetch_failed: "Nem sikerült lekérni a számlákat"
+      no_accounts_to_setup: "Nincs beállítandó számla"
+      no_api_key: "A Lunch Flow API-kulcs nincs beállítva. Kérlek ellenőrizd a kapcsolati beállításaidat."
+      account_types:
+        skip: Számla kihagyása
+        depository: Folyó- vagy megtakarítási számla
+        credit_card: Hitelkártya
+        investment: Befektetési számla
+        loan: Hitel vagy jelzálog
+        other_asset: Egyéb vagyon
+      subtype_labels:
+        depository: "Számla altípusa:"
+        credit_card: ""
+        investment: "Befektetés típusa:"
+        loan: "Hitel típusa:"
+        other_asset: ""
+      subtype_messages:
+        credit_card: "A hitelkártyák automatikusan hitelkártya számlákként lesznek beállítva."
+        other_asset: "Az egyéb vagyonelemekhez nincs szükség további beállításokra."
+      subtypes:
+        depository:
+          checking: Folyószámla
+          savings: Megtakarítási számla
+          hsa: Egészségügyi megtakarítási számla
+          cd: Lekötött betét
+          money_market: Pénzpiaci számla
+        investment:
+          brokerage: Brókeri számla
+          pension: Nyugdíjalap
+          retirement: Nyugdíj-megtakarítás
+          "401k": "401(k)"
+          roth_401k: "Roth 401(k)"
+          "403b": "403(b)"
+          tsp: Thrift Savings Plan
+          "529_plan": "529 Terv"
+          hsa: Egészségügyi megtakarítási számla
+          mutual_fund: Befektetési alap
+          ira: Hagyományos IRA
+          roth_ira: Roth IRA
+          angel: Angyal befektető
+        loan:
+          mortgage: Jelzálog
+          student: Diákhitel
+          auto: Autóhitel
+          other: Egyéb hitel
+      balance: Egyenleg
+      cancel: Mégse
+      choose_account_type: "Válaszd ki a megfelelő számlatípust minden Lunch Flow számlához:"
+      create_accounts: Számlák létrehozása
+      creating_accounts: Számlák létrehozása...
+      historical_data_range: "Előzmények időtartama:"
+      subtitle: Válaszd ki az importált számlák helyes típusait
+      sync_start_date_help: "Válaszd ki, milyen messzire szeretnél visszamenni a tranzakciós előzmények szinkronizálásában. Maximum 3 év előzmény érhető el."
+      sync_start_date_label: "Tranzakciók szinkronizálásának kezdete:"
+      title: Lunch Flow számlák beállítása
+    complete_account_setup:
+      all_skipped: "Minden számla ki lett hagyva. Nem jött létre számla."
+      creation_failed: "Nem sikerült létrehozni a számlákat: %{error}"
+      no_accounts: "Nincs beállítandó számla."
+      success: "%{count} számla sikeresen létrehozva."
+    sync:
+      success: Szinkronizálás elindítva
+    update:
+      success: Lunch Flow kapcsolat frissítve
diff --git a/config/locales/views/merchants/ca.yml b/config/locales/views/merchants/ca.yml
index 96de7b12e..5ac3254f1 100644
--- a/config/locales/views/merchants/ca.yml
+++ b/config/locales/views/merchants/ca.yml
@@ -9,20 +9,37 @@ ca:
       unlinked_success: El comerç s'ha eliminat de les teves transaccions
     edit:
       title: Edita el comerç
+    enhance:
+      already_running: La millora ja està en curs. Espera que acabi.
+      success: S'ha iniciat la millora de comerços del proveïdor. Aviat es milloraran
+        els comerços i es fusionaran els duplicats.
+    family_merchant:
+      delete: Elimina
+      edit: Edita
     form:
       name_placeholder: Nom del comerç
+      website_hint: Introdueix el lloc web del comerç per mostrar-ne automàticament
+        el logotip
+      website_placeholder: Lloc web (p. ex., starbucks.com)
     index:
       empty: Encara no hi ha comerços
-      family_empty: Encara no hi ha comerços familiars
-      family_title: Comerços familiars
+      enhance_button: Millora amb IA
+      enhance_info:
+        one: A %{count} comerç del proveïdor li falta informació del lloc web. Millora
+          amb IA per detectar llocs web, mostrar logotips i fusionar comerços duplicats.
+        other: A %{count} comerços del proveïdor els falta informació del lloc web.
+          Millora amb IA per detectar llocs web, mostrar logotips i fusionar comerços
+          duplicats.
+      family_empty: Encara no hi ha comerços
+      family_title: Els teus comerços
       merge: Fusiona comerços
       new: Nou comerç
-      provider_empty: Encara no hi ha comerços del proveïdor vinculats a aquesta família
-      provider_info: Aquests comerços es van detectar automàticament mitjançant les teves connexions
-        bancàries o IA. Pots editar-los per crear la teva pròpia còpia, o eliminar-los per desvincular-los
-        de les teves transaccions.
-      provider_read_only: Els comerços del proveïdor se sincronitzen automàticament
-        amb les institucions connectades. No es poden editar aquí.
+      provider_empty: Encara no hi ha comerços del proveïdor vinculats
+      provider_info: Aquests comerços es van detectar automàticament mitjançant les
+        teves connexions bancàries o l'IA. Pots editar-los per crear-ne una còpia
+        pròpia, o eliminar-los per desvincular-los de les teves transaccions.
+      provider_read_only: Els comerços del proveïdor se sincronitzen des de les teves
+        institucions connectades. No es poden editar aquí.
       provider_title: Comerços del proveïdor
       table:
         actions: Accions
@@ -30,8 +47,9 @@ ca:
         source: Origen
       title: Comerços
       unlinked_info: Aquests comerços s'han eliminat recentment de les teves transaccions.
-        Desapareixeran d'aquesta llista després de 30 dies a menys que s'assignin novament a una transacció.
-      unlinked_title: Recently unlinked
+        Desapareixeran d'aquesta llista al cap de 30 dies si no s'assignen novament
+        a una transacció.
+      unlinked_title: Desvinculats recentment
     merchant:
       confirm_accept: Elimina el comerç
       confirm_body: Segur que vols eliminar aquest comerç? Si l'elimines, es desvincularan
@@ -40,29 +58,31 @@ ca:
       delete: Elimina el comerç
       edit: Edita el comerç
     merge:
-      description: Select a target merchant and the merchants to merge into it. All
-        transactions from merged merchants will be reassigned to the target.
-      select_target: Select target merchant...
-      sources_hint: Selected merchants will be merged into the target. Family merchants
-        will be deleted, provider merchants will be unlinked.
-      sources_label: Merchants to merge
-      submit: Merge selected
-      target_label: Merge into (target)
-      title: Merge merchants
+      description: Selecciona un comerç de destinació i els comerços que hi vols fusionar.
+        Totes les transaccions dels comerços fusionats es reassignaran a la destinació.
+      select_target: Selecciona el comerç de destinació...
+      sources_hint: Els comerços seleccionats es fusionaran amb el de destinació.
+        Els comerços de la família s'eliminaran, els del proveïdor es desvincularan.
+      sources_label: Comerços per fusionar
+      submit: Fusiona els seleccionats
+      target_label: Fusiona amb (destinació)
+      title: Fusiona comerços
     new:
       title: Nou comerç
     perform_merge:
-      invalid_merchants: Invalid merchants selected
-      no_merchants_selected: No merchants selected to merge
-      success: Successfully merged %{count} merchants
-      target_not_found: Target merchant not found
+      invalid_merchants: Comerços seleccionats no vàlids
+      no_merchants_selected: No s'ha seleccionat cap comerç per fusionar
+      success:
+        one: S'ha fusionat correctament %{count} comerç
+        other: S'han fusionat correctament %{count} comerços
+      target_not_found: No s'ha trobat el comerç de destinació
     provider_merchant:
-      edit: Edit
-      remove: Remove
-      remove_confirm_body: Are you sure you want to remove %{name}? This will unlink
-        all associated transactions from this merchant but will not delete the merchant
-        itself.
-      remove_confirm_title: Remove merchant?
+      edit: Edita
+      remove: Elimina
+      remove_confirm_body: Segur que vols eliminar %{name}? Això desvincularà totes
+        les transaccions associades d'aquest comerç, però no eliminarà el comerç en
+        si.
+      remove_confirm_title: Vols eliminar el comerç?
     update:
-      converted_success: Merchant converted and updated successfully
+      converted_success: Comerç convertit i actualitzat correctament
       success: Comerç actualitzat correctament
diff --git a/config/locales/views/merchants/en.yml b/config/locales/views/merchants/en.yml
index 3b4907cf4..7c99f3e68 100644
--- a/config/locales/views/merchants/en.yml
+++ b/config/locales/views/merchants/en.yml
@@ -34,6 +34,9 @@ en:
         merchant: Merchant
         actions: Actions
         source: Source
+    family_merchant:
+      edit: Edit
+      delete: Delete
     merchant:
       confirm_accept: Delete merchant
       confirm_body: Are you sure you want to delete this merchant? Removing this merchant
@@ -52,7 +55,9 @@ en:
     new:
       title: New merchant
     perform_merge:
-      success: Successfully merged %{count} merchants
+      success:
+        one: Successfully merged %{count} merchant
+        other: Successfully merged %{count} merchants
       no_merchants_selected: No merchants selected to merge
       target_not_found: Target merchant not found
       invalid_merchants: Invalid merchants selected
diff --git a/config/locales/views/merchants/fr.yml b/config/locales/views/merchants/fr.yml
index f6291b4cb..e395d388b 100644
--- a/config/locales/views/merchants/fr.yml
+++ b/config/locales/views/merchants/fr.yml
@@ -6,14 +6,34 @@ fr:
       success: Marchand créé avec succès
     destroy:
       success: Marchand supprimé avec succès
+      unlinked_success: Marchand retiré de vos transactions
     edit:
       title: Modifier le marchand
     form:
       name_placeholder: Nom du marchand
+      website_placeholder: "Site web (ex. : starbucks.com)"
+      website_hint: Saisissez le site web du marchand pour afficher automatiquement son logo
     index:
       empty: Aucun marchand pour l'instant
       new: Nouveau marchand
+      merge: Fusionner des marchands
       title: Marchands
+      family_title: "Marchands %{moniker}"
+      family_empty: "Aucun marchand %{moniker} pour l'instant"
+      provider_title: Marchands du fournisseur
+      provider_empty: "Aucun marchand du fournisseur lié à ce %{moniker} pour l'instant"
+      provider_read_only: Les marchands du fournisseur sont synchronisés depuis vos institutions connectées. Ils ne peuvent pas être modifiés ici.
+      provider_info: Ces marchands ont été détectés automatiquement par vos connexions bancaires ou par l'IA. Vous pouvez les modifier pour créer votre propre copie, ou les retirer pour les dissocier de vos transactions.
+      enhance_info:
+        one: "%{count} marchand du fournisseur n'a pas d'informations de site web. Améliorez avec l'IA pour détecter les sites web, afficher les logos et fusionner les marchands en double."
+        other: "%{count} marchands du fournisseur n'ont pas d'informations de site web. Améliorez avec l'IA pour détecter les sites web, afficher les logos et fusionner les marchands en double."
+      enhance_button: Améliorer avec l'IA
+      unlinked_title: Récemment dissociés
+      unlinked_info: Ces marchands ont été récemment retirés de vos transactions. Ils disparaîtront de cette liste après 30 jours s'ils ne sont pas réaffectés à une transaction.
+      table:
+        merchant: Marchand
+        actions: Actions
+        source: Source
     merchant:
       confirm_accept: Supprimer le marchand
       confirm_body: Êtes-vous sûr de vouloir supprimer ce marchand ? La suppression de ce marchand
@@ -21,7 +41,31 @@ fr:
       confirm_title: Supprimer le marchand ?
       delete: Supprimer le marchand
       edit: Modifier le marchand
+    merge:
+      title: Fusionner des marchands
+      description: Sélectionnez un marchand cible et les marchands à fusionner avec lui. Toutes les transactions des marchands fusionnés seront réaffectées à la cible.
+      target_label: Fusionner vers (cible)
+      select_target: Sélectionnez le marchand cible…
+      sources_label: Marchands à fusionner
+      sources_hint: Les marchands sélectionnés seront fusionnés avec la cible. Les marchands de la famille seront supprimés, les marchands du fournisseur seront dissociés.
+      submit: Fusionner la sélection
     new:
       title: Nouveau marchand
+    perform_merge:
+      success:
+        one: "%{count} marchand fusionné avec succès"
+        other: "%{count} marchands fusionnés avec succès"
+      no_merchants_selected: Aucun marchand sélectionné à fusionner
+      target_not_found: Marchand cible introuvable
+      invalid_merchants: Marchands sélectionnés invalides
+    provider_merchant:
+      edit: Modifier
+      remove: Retirer
+      remove_confirm_title: Retirer le marchand ?
+      remove_confirm_body: Êtes-vous sûr de vouloir retirer %{name} ? Cela dissociera toutes les transactions associées à ce marchand, mais ne supprimera pas le marchand lui-même.
+    enhance:
+      success: L'amélioration des marchands du fournisseur a démarré. Les marchands seront améliorés et les doublons fusionnés sous peu.
+      already_running: Une amélioration est déjà en cours. Veuillez attendre qu'elle se termine.
     update:
       success: Marchand mis à jour avec succès
+      converted_success: Marchand converti et mis à jour avec succès
diff --git a/config/locales/views/merchants/hu.yml b/config/locales/views/merchants/hu.yml
new file mode 100644
index 000000000..f6979411c
--- /dev/null
+++ b/config/locales/views/merchants/hu.yml
@@ -0,0 +1,73 @@
+---
+hu:
+  family_merchants:
+    create:
+      error: 'Hiba a kereskedő létrehozásakor: %{error}'
+      success: Új kereskedő sikeresen létrehozva
+    destroy:
+      success: Kereskedő sikeresen törölve
+      unlinked_success: Kereskedő eltávolítva a tranzakcióidból
+    edit:
+      title: Kereskedő szerkesztése
+    form:
+      name_placeholder: Kereskedő neve
+      website_placeholder: Weboldal (pl. starbucks.com)
+      website_hint: Add meg a kereskedő weboldalát, hogy automatikusan megjelenjen a logójuk
+    index:
+      empty: Még nincsenek kereskedők
+      new: Új kereskedő
+      merge: Kereskedők egyesítése
+      title: Kereskedők
+      family_title: "%{moniker} kereskedők"
+      family_empty: "Még nincsenek %{moniker} kereskedők"
+      provider_title: Szolgáltatói kereskedők
+      provider_empty: "Ehhez a(z) %{moniker}-hoz még nincs összekapcsolt szolgáltatói kereskedő"
+      provider_read_only: A szolgáltatói kereskedők az összekapcsolt pénzintézeteidből szinkronizálódnak. Itt nem szerkeszthetők.
+      provider_info: Ezeket a kereskedőket a bankkapcsolataid vagy a mesterséges intelligencia automatikusan észlelte. Szerkesztheted őket saját verzió létrehozásához, vagy eltávolíthatod, hogy leválaszd a tranzakcióidról.
+      enhance_info:
+        one: "%{count} szolgáltatói kereskedőnél hiányzik a weboldal-információ. Fejleszd AI-jal a weboldalak felismeréséhez, logók megjelenítéséhez és az ismétlődő kereskedők egyesítéséhez."
+        other: "%{count} szolgáltatói kereskedőnél hiányzik a weboldal-információ. Fejleszd AI-jal a weboldalak felismeréséhez, logók megjelenítéséhez és az ismétlődő kereskedők egyesítéséhez."
+      enhance_button: Fejlesztés AI-jal
+      unlinked_title: Nemrég leválasztva
+      unlinked_info: Ezeket a kereskedőket nemrég távolítottad el a tranzakcióidból. 30 nap után eltűnnek erről a listáról, hacsak nem rendelik hozzá újra egy tranzakcióhoz.
+      table:
+        merchant: Kereskedő
+        actions: Műveletek
+        source: Forrás
+    family_merchant:
+      edit: Szerkesztés
+      delete: Törlés
+    merchant:
+      confirm_accept: Kereskedő törlése
+      confirm_body: Biztosan törlöd ezt a kereskedőt? A törlés megszünteti az összes kapcsolódó tranzakció hozzárendelését, ami hatással lehet a jelentéseidre.
+      confirm_title: Törlöd a kereskedőt?
+      delete: Kereskedő törlése
+      edit: Kereskedő szerkesztése
+    merge:
+      title: Kereskedők egyesítése
+      description: Válassz egy célkereskedőt és az abba beolvasztandó kereskedőket. Az egyesített kereskedők tranzakciói átkerülnek a célkereskedőhöz.
+      target_label: Beolvasztás ebbe (cél)
+      select_target: Célkereskedő kiválasztása...
+      sources_label: Beolvasztandó kereskedők
+      sources_hint: A kiválasztott kereskedők beolvadnak a célkereskedőbe. A saját kereskedők törlésre kerülnek, a szolgáltatói kereskedők leválasztásra kerülnek.
+      submit: Kijelöltek egyesítése
+    new:
+      title: Új kereskedő
+    perform_merge:
+      success:
+        one: "%{count} kereskedő sikeresen egyesítve"
+        other: "%{count} kereskedő sikeresen egyesítve"
+      no_merchants_selected: Nincs kiválasztott kereskedő az egyesítéshez
+      target_not_found: A célkereskedő nem található
+      invalid_merchants: Érvénytelen kereskedők vannak kiválasztva
+    provider_merchant:
+      edit: Szerkesztés
+      remove: Eltávolítás
+      remove_confirm_title: Eltávolítod a kereskedőt?
+      remove_confirm_body: Biztosan eltávolítod a(z) %{name} kereskedőt? Ez leválasztja az összes kapcsolódó tranzakciót erről a kereskedőről, de maga a kereskedő nem törlődik.
+    enhance:
+      success: A szolgáltatói kereskedők fejlesztése elindult. A kereskedők hamarosan frissülnek, és az ismétlődők egyesítésre kerülnek.
+      already_running: A fejlesztés már folyamatban van. Kérjük, várj, amíg befejeződik.
+    update:
+      success: Kereskedő sikeresen frissítve
+      converted_success: Kereskedő sikeresen konvertálva és frissítve
diff --git a/config/locales/views/mercury_items/ca.yml b/config/locales/views/mercury_items/ca.yml
new file mode 100644
index 000000000..0f8636dd4
--- /dev/null
+++ b/config/locales/views/mercury_items/ca.yml
@@ -0,0 +1,233 @@
+---
+ca:
+  mercury_items:
+    api_error:
+      check_provider_settings: Revisa la configuració del proveïdor
+      common_issues: 'Problemes habituals:'
+      expired_credentials_desc: Genera un nou token API des de Mercury
+      expired_credentials_label: Credencials caducades
+      insufficient_permissions_desc: Assegura't que el teu token té accés només de
+        lectura
+      insufficient_permissions_label: Permisos insuficients
+      invalid_api_token_desc: Revisa el teu token API a la configuració del proveïdor
+      invalid_api_token_label: Token API no vàlid
+      network_issue_desc: Comprova la teva connexió a internet
+      network_issue_label: Problema de xarxa
+      service_down_desc: L'API de Mercury pot estar temporalment no disponible
+      service_down_label: Servei caigut
+      title: Error de connexió Mercury
+      unable_to_connect: No s'ha pogut connectar a Mercury
+    complete_account_setup:
+      all_skipped: S'han omès tots els comptes. No s'ha creat cap compte.
+      creation_failed: 'No s''han pogut crear els comptes: %{error}'
+      no_accounts: No hi ha comptes per configurar.
+      success: S'han creat correctament %{count} compte(s).
+    create:
+      success: La connexió Mercury s'ha creat correctament
+    destroy:
+      success: La connexió Mercury s'ha eliminat
+    index:
+      title: Connexions Mercury
+    link_accounts:
+      all_already_linked:
+        one: El compte seleccionat (%{names}) ja està enllaçat
+        other: 'Tots els %{count} comptes seleccionats ja estan enllaçats: %{names}'
+      api_error: 'Error de l''API: %{message}'
+      invalid_account_names:
+        one: No es pot enllaçar un compte sense nom
+        other: No es poden enllaçar %{count} comptes sense nom
+      link_failed: No s'han pogut enllaçar els comptes
+      no_accounts_selected: Selecciona almenys un compte
+      no_api_token: No s'ha trobat el token API de Mercury. Configura'l a la configuració
+        del proveïdor.
+      partial_invalid: S'han enllaçat correctament %{created_count} compte(s), %{already_linked_count}
+        ja estaven enllaçats, %{invalid_count} compte(s) tenien noms no vàlids
+      partial_success: 'S''han enllaçat correctament %{created_count} compte(s). %{already_linked_count}
+        compte(s) ja estaven enllaçats: %{already_linked_names}'
+      select_connection: Tria una connexió Mercury abans d'enllaçar comptes.
+      success:
+        one: S'ha enllaçat correctament %{count} compte
+        other: S'han enllaçat correctament %{count} comptes
+    link_existing_account:
+      account_already_linked: Aquest compte ja està enllaçat a un proveïdor
+      api_error: 'Error de l''API: %{message}'
+      invalid_account_name: No es pot enllaçar un compte sense nom
+      mercury_account_already_linked: Aquest compte Mercury ja està enllaçat a un
+        altre compte
+      mercury_account_not_found: No s'ha trobat el compte Mercury
+      missing_parameters: Falten paràmetres obligatoris
+      no_api_token: No s'ha trobat el token API de Mercury. Configura'l a la configuració
+        del proveïdor.
+      select_connection: Tria una connexió Mercury abans d'enllaçar comptes.
+      success: S'ha enllaçat correctament %{account_name} amb Mercury
+    loading:
+      loading_message: Carregant comptes Mercury...
+      loading_title: Carregant
+    mercury_item:
+      accounts_need_setup: Els comptes necessiten configuració
+      delete: Elimina la connexió
+      deletion_in_progress: eliminació en curs...
+      error: Error
+      no_accounts_description: Aquesta connexió encara no té comptes enllaçats.
+      no_accounts_title: No hi ha comptes
+      setup_action: Configura els nous comptes
+      setup_description: "%{linked} de %{total} comptes enllaçats. Tria els tipus
+        de compte per als teus nous comptes Mercury importats."
+      setup_needed: Nous comptes a punt per configurar
+      status: Sincronitzat fa %{timestamp}
+      status_never: Mai sincronitzat
+      status_with_summary: Darrera sincronització fa %{timestamp} - %{summary}
+      syncing: Sincronitzant...
+      total: Total
+      unlinked: Sense enllaç
+    mercury_item_selection_error_payload:
+      select_connection: Tria una connexió Mercury abans de carregar comptes.
+    provider_connection:
+      default_description: Connecta't al teu banc a través de Mercury
+      default_name: Mercury
+      description: Connecta amb %{name}
+      name: Mercury - %{name}
+    provider_panel:
+      add_connection: Afegeix connexió Mercury
+      base_url_label: URL base (opcional)
+      base_url_placeholder: https://api.mercury.com/api/v1 (per defecte)
+      connection_name_label: Nom de la connexió
+      connection_name_placeholder: Compte corrent d'empresa
+      default_connection_name: Connexió Mercury
+      disconnect_confirm: Vols desconnectar %{name}?
+      instructions:
+        copy_token_html: Copia el <strong>token sencer</strong> (incloent el prefix
+          <code>secret-token:</code>) i afegeix-lo com a connexió amb nom a continuació
+        create_token: Crea un nou token API amb accés "només de lectura"
+        open_tokens: Ves a Configuració > Desenvolupador > Tokens API
+        sign_in_html: Visita %{link} i inicia sessió al compte que vols connectar
+        whitelist_ip_html: "<strong>Important:</strong> afegeix l'adreça IP del teu
+          servidor a la llista blanca del token"
+      keep_token_placeholder: Deixa-ho en blanc per mantenir el token actual
+      sandbox_note_html: Utilitza una connexió amb nom separada per a cada inici de
+        sessió/token API de Mercury que vulguis sincronitzar. Per a proves en sandbox,
+        utilitza <code>https://api-sandbox.mercury.com/api/v1</code> com a URL base.
+        Mercury requereix llistes blanques d'IP — assegura't d'afegir la teva IP al
+        panell de Mercury.
+      setup_accounts: Configura comptes
+      setup_title: 'Instruccions de configuració:'
+      sync: Sincronitza
+      token_label: Token
+      token_placeholder: Enganxa el token aquí
+      update_connection: Actualitza la connexió
+    render_mercury_item_selection_failure:
+      no_credentials_configured: Primer, configura el teu token API de Mercury a la
+        configuració del proveïdor.
+      select_connection: Tria una connexió Mercury a la configuració del proveïdor.
+    select_accounts:
+      accounts_selected: comptes seleccionats
+      api_error: 'Error de l''API: %{message}'
+      cancel: Cancel·la
+      configure_name_in_mercury: No es pot importar — configura el nom del compte
+        a Mercury
+      description: Selecciona els comptes que vols enllaçar al teu compte de %{product_name}.
+      link_accounts: Enllaça els comptes seleccionats
+      no_accounts_found: No s'han trobat comptes. Comprova la configuració del teu
+        token API.
+      no_api_token: El token API de Mercury no està configurat. Configura'l a la configuració.
+      no_credentials_configured: Primer, configura el teu token API de Mercury a la
+        configuració del proveïdor.
+      no_name_placeholder: "(Sense nom)"
+      select_connection: Tria una connexió Mercury a la configuració del proveïdor.
+      title: Selecciona comptes Mercury
+    select_existing_account:
+      account_already_linked: Aquest compte ja està enllaçat a un proveïdor
+      all_accounts_already_linked: Tots els comptes Mercury ja estan enllaçats
+      api_error: 'Error de l''API: %{message}'
+      cancel: Cancel·la
+      configure_name_in_mercury: No es pot importar — configura el nom del compte
+        a Mercury
+      description: Selecciona un compte Mercury per enllaçar-lo amb aquest compte.
+        Les transaccions es sincronitzaran i deduplicaran automàticament.
+      link_account: Enllaça compte
+      no_account_specified: No s'ha especificat cap compte
+      no_accounts_found: No s'han trobat comptes Mercury. Comprova la configuració
+        del teu token API.
+      no_api_token: El token API de Mercury no està configurat. Configura'l a la configuració.
+      no_credentials_configured: Primer, configura el teu token API de Mercury a la
+        configuració del proveïdor.
+      no_name_placeholder: "(Sense nom)"
+      select_connection: Tria una connexió Mercury a la configuració del proveïdor.
+      title: Enllaça %{account_name} amb Mercury
+    setup_accounts:
+      account_type_label: 'Tipus de compte:'
+      account_types:
+        credit_card: Targeta de crèdit
+        depository: Compte corrent o d'estalvis
+        investment: Compte d'inversió
+        loan: Préstec o hipoteca
+        other_asset: Altre actiu
+        skip: Omet aquest compte
+      all_accounts_linked: Tots els teus comptes Mercury ja s'han configurat.
+      api_error: 'Error de l''API: %{message}'
+      balance: Saldo
+      cancel: Cancel·la
+      choose_account_type: 'Tria el tipus de compte correcte per a cada compte Mercury:'
+      create_accounts: Crea comptes
+      creating_accounts: Creant comptes...
+      fetch_failed: No s'han pogut obtenir els comptes
+      historical_data_range: 'Rang de dades històriques:'
+      no_accounts_to_setup: No hi ha comptes per configurar
+      no_api_token: El token API de Mercury no està configurat. Revisa la configuració
+        de la connexió.
+      subtitle: Tria els tipus de compte correctes per als teus comptes importats
+      subtype_labels:
+        credit_card: ''
+        depository: 'Subtipus de compte:'
+        investment: 'Tipus d''inversió:'
+        loan: 'Tipus de préstec:'
+        other_asset: ''
+      subtype_messages:
+        credit_card: Les targetes de crèdit es configuraran automàticament com a comptes
+          de targeta de crèdit.
+        other_asset: No calen opcions addicionals per a altres actius.
+      subtypes:
+        depository:
+          cd: Certificat de dipòsit
+          checking: Compte corrent
+          hsa: Compte d'estalvi per a salut
+          money_market: Mercat monetari
+          savings: Estalvis
+        investment:
+          401k: 401(k)
+          403b: 403(b)
+          529_plan: Pla 529
+          angel: Inversió àngel
+          brokerage: Corredoria
+          hsa: Compte d'estalvi per a salut
+          ira: IRA tradicional
+          mutual_fund: Fons d'inversió
+          pension: Pensió
+          retirement: Jubilació
+          roth_401k: Roth 401(k)
+          roth_ira: IRA Roth
+          tsp: Pla d'estalvis de jubilació (TSP)
+        loan:
+          auto: Préstec d'automòbil
+          mortgage: Hipoteca
+          other: Altre préstec
+          student: Préstec d'estudis
+      sync_start_date_help: Selecciona fins on vols sincronitzar l'historial de transaccions.
+        Hi ha un màxim de 3 anys d'historial disponible.
+      sync_start_date_label: 'Comença a sincronitzar transaccions des de:'
+      title: Configura els teus comptes Mercury
+    setup_required:
+      api_token_description: Abans d'enllaçar comptes Mercury, has de configurar el
+        teu token API de Mercury.
+      api_token_not_configured: Token API no configurat
+      go_to_provider_settings: Ves a la configuració del proveïdor
+      setup_step_1_html: Ves a <strong>Configuració > Proveïdors</strong>
+      setup_step_2_html: Localitza la secció <strong>Mercury</strong>
+      setup_step_3: Introdueix el teu token API de Mercury
+      setup_step_4: Torna aquí per enllaçar els teus comptes
+      setup_steps_title: 'Passos de configuració:'
+      title: Cal configurar Mercury
+    sync:
+      success: Sincronització iniciada
+    update:
+      success: La connexió Mercury s'ha actualitzat
diff --git a/config/locales/views/mercury_items/en.yml b/config/locales/views/mercury_items/en.yml
index dc45ca889..dd423be17 100644
--- a/config/locales/views/mercury_items/en.yml
+++ b/config/locales/views/mercury_items/en.yml
@@ -1,6 +1,31 @@
 ---
 en:
   mercury_items:
+    api_error:
+      title: Mercury Connection Error
+      unable_to_connect: Unable to connect to Mercury
+      common_issues: "Common Issues:"
+      invalid_api_token_label: Invalid API Token
+      invalid_api_token_desc: Check your API token in Provider Settings
+      expired_credentials_label: Expired Credentials
+      expired_credentials_desc: Generate a new API token from Mercury
+      insufficient_permissions_label: Insufficient Permissions
+      insufficient_permissions_desc: Ensure your token has read-only access
+      network_issue_label: Network Issue
+      network_issue_desc: Check your internet connection
+      service_down_label: Service Down
+      service_down_desc: Mercury API may be temporarily unavailable
+      check_provider_settings: Check Provider Settings
+    setup_required:
+      title: Mercury Setup Required
+      api_token_not_configured: API Token Not Configured
+      api_token_description: Before you can link Mercury accounts, you need to configure your Mercury API token.
+      setup_steps_title: "Setup Steps:"
+      setup_step_1_html: "Go to <strong>Settings > Providers</strong>"
+      setup_step_2_html: "Find the <strong>Mercury</strong> section"
+      setup_step_3: Enter your Mercury API token
+      setup_step_4: Return here to link your accounts
+      go_to_provider_settings: Go to Provider Settings
     create:
       success: Mercury connection created successfully
     destroy:
@@ -23,6 +48,7 @@ en:
       no_api_token: Mercury API token not found. Please configure it in Provider Settings.
       partial_invalid: "Successfully linked %{created_count} account(s), %{already_linked_count} were already linked, %{invalid_count} account(s) had invalid names"
       partial_success: "Successfully linked %{created_count} account(s). %{already_linked_count} account(s) were already linked: %{already_linked_names}"
+      select_connection: Choose a Mercury connection before linking accounts.
       success:
         one: "Successfully linked %{count} account"
         other: "Successfully linked %{count} accounts"
@@ -42,6 +68,33 @@ en:
       syncing: Syncing...
       total: Total
       unlinked: Unlinked
+    provider_panel:
+      add_connection: Add Mercury connection
+      base_url_label: Base URL (optional)
+      base_url_placeholder: https://api.mercury.com/api/v1 (default)
+      connection_name_label: Connection name
+      connection_name_placeholder: Business checking
+      default_connection_name: Mercury Connection
+      disconnect_confirm: "Disconnect %{name}?"
+      instructions:
+        copy_token_html: "Copy the <strong>full token</strong> (including the <code>secret-token:</code> prefix) and add it as a named connection below"
+        create_token: Create a new API token with "Read Only" access
+        open_tokens: Go to Settings > Developer > API Tokens
+        sign_in_html: "Visit %{link} and log in to the account you want to connect"
+        whitelist_ip_html: "<strong>Important:</strong> Add your server's IP address to the token's whitelist"
+      keep_token_placeholder: Leave blank to keep the current token
+      sandbox_note_html: "Use a separate named connection for each Mercury login/API token you want to sync. For sandbox testing, use <code>https://api-sandbox.mercury.com/api/v1</code> as the Base URL. Mercury requires IP whitelisting - make sure to add your IP in the Mercury dashboard."
+      setup_accounts: Set up accounts
+      setup_title: "Setup instructions:"
+      sync: Sync
+      token_label: Token
+      token_placeholder: Paste token here
+      update_connection: Update connection
+    provider_connection:
+      default_description: Connect to your bank via Mercury
+      default_name: Mercury
+      description: "Connect using %{name}"
+      name: "Mercury - %{name}"
     select_accounts:
       accounts_selected: accounts selected
       api_error: "API error: %{message}"
@@ -53,6 +106,7 @@ en:
       no_api_token: Mercury API token is not configured. Please configure it in Settings.
       no_credentials_configured: Please configure your Mercury API token first in Provider Settings.
       no_name_placeholder: "(No name)"
+      select_connection: Choose a Mercury connection in Provider Settings.
       title: Select Mercury Accounts
     select_existing_account:
       account_already_linked: This account is already linked to a provider
@@ -67,6 +121,7 @@ en:
       no_api_token: Mercury API token is not configured. Please configure it in Settings.
       no_credentials_configured: Please configure your Mercury API token first in Provider Settings.
       no_name_placeholder: "(No name)"
+      select_connection: Choose a Mercury connection in Provider Settings.
       title: "Link %{account_name} with Mercury"
     link_existing_account:
       account_already_linked: This account is already linked to a provider
@@ -76,6 +131,7 @@ en:
       mercury_account_not_found: Mercury account not found
       missing_parameters: Missing required parameters
       no_api_token: Mercury API token not found. Please configure it in Provider Settings.
+      select_connection: Choose a Mercury connection before linking accounts.
       success: "Successfully linked %{account_name} with Mercury"
     setup_accounts:
       account_type_label: "Account Type:"
@@ -145,3 +201,8 @@ en:
       success: Sync started
     update:
       success: Mercury connection updated
+    mercury_item_selection_error_payload:
+      select_connection: Choose a Mercury connection before loading accounts.
+    render_mercury_item_selection_failure:
+      select_connection: Choose a Mercury connection in Provider Settings.
+      no_credentials_configured: Please configure your Mercury API token first in Provider Settings.
diff --git a/config/locales/views/mercury_items/fr.yml b/config/locales/views/mercury_items/fr.yml
new file mode 100644
index 000000000..3a879a11d
--- /dev/null
+++ b/config/locales/views/mercury_items/fr.yml
@@ -0,0 +1,147 @@
+---
+fr:
+  mercury_items:
+    create:
+      success: Connexion Mercury créée avec succès
+    destroy:
+      success: Connexion Mercury supprimée
+    index:
+      title: Connexions Mercury
+    loading:
+      loading_message: Chargement des comptes Mercury…
+      loading_title: Chargement
+    link_accounts:
+      all_already_linked:
+        one: "Le compte sélectionné (%{names}) est déjà lié"
+        other: "Les %{count} comptes sélectionnés sont déjà liés : %{names}"
+      api_error: "Erreur API : %{message}"
+      invalid_account_names:
+        one: "Impossible de lier un compte sans nom"
+        other: "Impossible de lier %{count} comptes sans nom"
+      link_failed: Échec de la liaison des comptes
+      no_accounts_selected: Veuillez sélectionner au moins un compte
+      no_api_token: Jeton API Mercury introuvable. Veuillez le configurer dans les paramètres du fournisseur.
+      partial_invalid: "%{created_count} compte(s) lié(s) avec succès, %{already_linked_count} étaient déjà liés, %{invalid_count} compte(s) avaient des noms invalides"
+      partial_success: "%{created_count} compte(s) lié(s) avec succès. %{already_linked_count} compte(s) étaient déjà liés : %{already_linked_names}"
+      success:
+        one: "%{count} compte lié avec succès"
+        other: "%{count} comptes liés avec succès"
+    mercury_item:
+      accounts_need_setup: Des comptes doivent être configurés
+      delete: Supprimer la connexion
+      deletion_in_progress: suppression en cours…
+      error: Erreur
+      no_accounts_description: Cette connexion n'a pas encore de comptes liés.
+      no_accounts_title: Aucun compte
+      setup_action: Configurer les nouveaux comptes
+      setup_description: "%{linked} sur %{total} comptes liés. Choisissez les types de compte pour vos comptes Mercury nouvellement importés."
+      setup_needed: Nouveaux comptes prêts à être configurés
+      status: "Synchronisé il y a %{timestamp}"
+      status_never: Jamais synchronisé
+      status_with_summary: "Dernière synchronisation il y a %{timestamp} - %{summary}"
+      syncing: Synchronisation…
+      total: Total
+      unlinked: Non lié
+    select_accounts:
+      accounts_selected: comptes sélectionnés
+      api_error: "Erreur API : %{message}"
+      cancel: Annuler
+      configure_name_in_mercury: Impossible d'importer - veuillez configurer le nom du compte dans Mercury
+      description: Sélectionnez les comptes que vous souhaitez lier à votre compte %{product_name}.
+      link_accounts: Lier les comptes sélectionnés
+      no_accounts_found: Aucun compte trouvé. Veuillez vérifier la configuration de votre jeton API.
+      no_api_token: Le jeton API Mercury n'est pas configuré. Veuillez le configurer dans les Paramètres.
+      no_credentials_configured: Veuillez d'abord configurer votre jeton API Mercury dans les paramètres du fournisseur.
+      no_name_placeholder: "(Sans nom)"
+      title: Sélectionner les comptes Mercury
+    select_existing_account:
+      account_already_linked: Ce compte est déjà lié à un fournisseur
+      all_accounts_already_linked: Tous les comptes Mercury sont déjà liés
+      api_error: "Erreur API : %{message}"
+      cancel: Annuler
+      configure_name_in_mercury: Impossible d'importer - veuillez configurer le nom du compte dans Mercury
+      description: Sélectionnez un compte Mercury à lier avec ce compte. Les transactions seront synchronisées et dédupliquées automatiquement.
+      link_account: Lier le compte
+      no_account_specified: Aucun compte spécifié
+      no_accounts_found: Aucun compte Mercury trouvé. Veuillez vérifier la configuration de votre jeton API.
+      no_api_token: Le jeton API Mercury n'est pas configuré. Veuillez le configurer dans les Paramètres.
+      no_credentials_configured: Veuillez d'abord configurer votre jeton API Mercury dans les paramètres du fournisseur.
+      no_name_placeholder: "(Sans nom)"
+      title: "Lier %{account_name} avec Mercury"
+    link_existing_account:
+      account_already_linked: Ce compte est déjà lié à un fournisseur
+      api_error: "Erreur API : %{message}"
+      invalid_account_name: Impossible de lier un compte sans nom
+      mercury_account_already_linked: Ce compte Mercury est déjà lié à un autre compte
+      mercury_account_not_found: Compte Mercury introuvable
+      missing_parameters: Paramètres requis manquants
+      no_api_token: Jeton API Mercury introuvable. Veuillez le configurer dans les paramètres du fournisseur.
+      success: "%{account_name} lié avec succès à Mercury"
+    setup_accounts:
+      account_type_label: "Type de compte :"
+      all_accounts_linked: "Tous vos comptes Mercury ont déjà été configurés."
+      api_error: "Erreur API : %{message}"
+      fetch_failed: "Échec de la récupération des comptes"
+      no_accounts_to_setup: "Aucun compte à configurer"
+      no_api_token: "Le jeton API Mercury n'est pas configuré. Veuillez vérifier les paramètres de connexion."
+      account_types:
+        skip: Ignorer ce compte
+        depository: Compte courant ou épargne
+        credit_card: Carte de crédit
+        investment: Compte d'investissement
+        loan: Prêt ou hypothèque
+        other_asset: Autre actif
+      subtype_labels:
+        depository: "Sous-type de compte :"
+        credit_card: ""
+        investment: "Type d'investissement :"
+        loan: "Type de prêt :"
+        other_asset: ""
+      subtype_messages:
+        credit_card: "Les cartes de crédit seront automatiquement configurées comme comptes de carte de crédit."
+        other_asset: "Aucune option supplémentaire nécessaire pour les autres actifs."
+      subtypes:
+        depository:
+          checking: Compte courant
+          savings: Compte épargne
+          hsa: Compte épargne santé
+          cd: Certificat de dépôt
+          money_market: Compte du marché monétaire
+        investment:
+          brokerage: Courtage
+          pension: Pension
+          retirement: Retraite
+          "401k": "401(k)"
+          roth_401k: "Roth 401(k)"
+          "403b": "403(b)"
+          tsp: Plan d'épargne Thrift
+          "529_plan": "Plan 529"
+          hsa: Compte épargne santé
+          mutual_fund: Fonds commun de placement
+          ira: IRA traditionnel
+          roth_ira: Roth IRA
+          angel: Investissement providentiel
+        loan:
+          mortgage: Hypothèque
+          student: Prêt étudiant
+          auto: Prêt auto
+          other: Autre prêt
+      balance: Solde
+      cancel: Annuler
+      choose_account_type: "Choisissez le type de compte correct pour chaque compte Mercury :"
+      create_accounts: Créer les comptes
+      creating_accounts: Création des comptes…
+      historical_data_range: "Plage de données historiques :"
+      subtitle: Choisissez les types de compte corrects pour vos comptes importés
+      sync_start_date_help: Sélectionnez jusqu'où vous souhaitez synchroniser l'historique des transactions. Maximum 3 ans d'historique disponible.
+      sync_start_date_label: "Commencer la synchronisation des transactions à partir de :"
+      title: Configurer vos comptes Mercury
+    complete_account_setup:
+      all_skipped: "Tous les comptes ont été ignorés. Aucun compte n'a été créé."
+      creation_failed: "Échec de la création des comptes : %{error}"
+      no_accounts: "Aucun compte à configurer."
+      success: "%{count} compte(s) créé(s) avec succès."
+    sync:
+      success: Synchronisation démarrée
+    update:
+      success: Connexion Mercury mise à jour
diff --git a/config/locales/views/mercury_items/hu.yml b/config/locales/views/mercury_items/hu.yml
new file mode 100644
index 000000000..011e8a4d7
--- /dev/null
+++ b/config/locales/views/mercury_items/hu.yml
@@ -0,0 +1,208 @@
+---
+hu:
+  mercury_items:
+    api_error:
+      title: Mercury kapcsolati hiba
+      unable_to_connect: Nem sikerült csatlakozni a Mercury-hoz
+      common_issues: "Gyakori problémák:"
+      invalid_api_token_label: Érvénytelen API token
+      invalid_api_token_desc: Ellenőrizd az API tokenedet a Szolgáltatói beállításokban
+      expired_credentials_label: Lejárt hitelesítő adatok
+      expired_credentials_desc: Generálj új API tokent a Mercury-ban
+      insufficient_permissions_label: Elégtelen jogosultságok
+      insufficient_permissions_desc: Győződj meg róla, hogy a tokened csak olvasási hozzáféréssel rendelkezik
+      network_issue_label: Hálózati hiba
+      network_issue_desc: Ellenőrizd az internetkapcsolatodat
+      service_down_label: Szolgáltatás nem elérhető
+      service_down_desc: A Mercury API átmenetileg nem elérhető
+      check_provider_settings: Szolgáltatói beállítások ellenőrzése
+    setup_required:
+      title: Mercury beállítás szükséges
+      api_token_not_configured: Az API token nincs beállítva
+      api_token_description: Mielőtt Mercury-számlákat kapcsolnál össze, be kell állítanod a Mercury API tokenedet.
+      setup_steps_title: "Beállítási lépések:"
+      setup_step_1_html: "Menj a <strong>Beállítások > Szolgáltatók</strong> menübe"
+      setup_step_2_html: "Keresd meg a <strong>Mercury</strong> részt"
+      setup_step_3: Add meg a Mercury API tokenedet
+      setup_step_4: Térj vissza ide a számlák összekapcsolásához
+      go_to_provider_settings: Ugrás a szolgáltatói beállításokhoz
+    create:
+      success: Mercury kapcsolat sikeresen létrehozva
+    destroy:
+      success: Mercury kapcsolat eltávolítva
+    index:
+      title: Mercury kapcsolatok
+    loading:
+      loading_message: Mercury számlák betöltése...
+      loading_title: Betöltés
+    link_accounts:
+      all_already_linked:
+        one: "A kiválasztott számla (%{names}) már össze van kapcsolva"
+        other: "Mind a(z) %{count} kiválasztott számla már össze van kapcsolva: %{names}"
+      api_error: "API hiba: %{message}"
+      invalid_account_names:
+        one: "Nem lehet összekapcsolni üres nevű számlát"
+        other: "Nem lehet összekapcsolni %{count} üres nevű számlát"
+      link_failed: Nem sikerült összekapcsolni a számlákat
+      no_accounts_selected: Kérlek válassz legalább egy számlát
+      no_api_token: Mercury API token nem található. Kérlek állítsd be a Szolgáltatói beállításokban.
+      partial_invalid: "%{created_count} számla sikeresen összekapcsolva, %{already_linked_count} már össze volt kapcsolva, %{invalid_count} számla nevei érvénytelenek"
+      partial_success: "%{created_count} számla sikeresen összekapcsolva. %{already_linked_count} számla már össze volt kapcsolva: %{already_linked_names}"
+      select_connection: Válassz Mercury kapcsolatot a számlák összekapcsolása előtt.
+      success:
+        one: "%{count} számla sikeresen összekapcsolva"
+        other: "%{count} számla sikeresen összekapcsolva"
+    mercury_item:
+      accounts_need_setup: Számlák beállítást igényelnek
+      delete: Kapcsolat törlése
+      deletion_in_progress: törlés folyamatban...
+      error: Hiba
+      no_accounts_description: Ehhez a kapcsolathoz még nincsenek összekapcsolt számlák.
+      no_accounts_title: Nincsenek számlák
+      setup_action: Új számlák beállítása
+      setup_description: "%{linked} / %{total} számla összekapcsolva. Válaszd ki az újonnan importált Mercury számlák típusait."
+      setup_needed: Új számlák beállításra várnak
+      status: "Szinkronizálva %{timestamp} ezelőtt"
+      status_never: Még nem szinkronizált
+      status_with_summary: "Utolsó szinkronizálás %{timestamp} ezelőtt - %{summary}"
+      syncing: Szinkronizálás...
+      total: Összesen
+      unlinked: Nincs összekapcsolva
+    provider_panel:
+      add_connection: Mercury kapcsolat hozzáadása
+      base_url_label: Alap URL (opcionális)
+      base_url_placeholder: https://api.mercury.com/api/v1 (alapértelmezett)
+      connection_name_label: Kapcsolat neve
+      connection_name_placeholder: Üzleti folyószámla
+      default_connection_name: Mercury kapcsolat
+      disconnect_confirm: "%{name} lecsatlakoztatása?"
+      instructions:
+        copy_token_html: "Másold ki a <strong>teljes tokent</strong> (beleértve a <code>secret-token:</code> előtagot), és add hozzá alább elnevezett kapcsolatként"
+        create_token: Hozz létre egy új API tokent „Csak olvasható" hozzáféréssel
+        open_tokens: Menj a Beállítások > Fejlesztő > API tokenek menübe
+        sign_in_html: "Látogass el a(z) %{link} oldalra, és lépj be az összekapcsolni kívánt fiókba"
+        whitelist_ip_html: "<strong>Fontos:</strong> Add a szervered IP-címét a token engedélyezési listájához"
+      keep_token_placeholder: Hagyd üresen az aktuális token megtartásához
+      sandbox_note_html: "Minden Mercury bejelentkezéshez/API tokenhez használj külön elnevezett kapcsolatot. Sandbox teszteléshez használd a <code>https://api-sandbox.mercury.com/api/v1</code> alap URL-t. A Mercury IP engedélyezési listát igényel — győződj meg róla, hogy hozzáadtad az IP-d a Mercury irányítópulton."
+      setup_accounts: Számlák beállítása
+      setup_title: "Beállítási utasítások:"
+      sync: Szinkronizálás
+      token_label: Token
+      token_placeholder: Illeszd be ide a tokent
+      update_connection: Kapcsolat frissítése
+    provider_connection:
+      default_description: Csatlakozás a bankhoz a Mercury-n keresztül
+      default_name: Mercury
+      description: "Csatlakozás a következőn keresztül: %{name}"
+      name: "Mercury - %{name}"
+    select_accounts:
+      accounts_selected: kiválasztott számla
+      api_error: "API hiba: %{message}"
+      cancel: Mégse
+      configure_name_in_mercury: Nem importálható — kérlek állítsd be a számla nevét a Mercury-ban
+      description: "Válaszd ki azokat a számlákat, amelyeket össze szeretnél kapcsolni a(z) %{product_name} fiókkal."
+      link_accounts: Kiválasztott számlák összekapcsolása
+      no_accounts_found: Nem találhatók számlák. Kérlek ellenőrizd az API token konfigurációdat.
+      no_api_token: A Mercury API token nincs beállítva. Kérlek állítsd be a Beállításokban.
+      no_credentials_configured: Kérlek előbb állítsd be a Mercury API tokenedet a Szolgáltatói beállításokban.
+      no_name_placeholder: "(Nincs név)"
+      select_connection: Válassz Mercury kapcsolatot a Szolgáltatói beállításokban.
+      title: Mercury számlák kiválasztása
+    select_existing_account:
+      account_already_linked: Ez a számla már össze van kapcsolva egy szolgáltatóval
+      all_accounts_already_linked: Minden Mercury számla már össze van kapcsolva
+      api_error: "API hiba: %{message}"
+      cancel: Mégse
+      configure_name_in_mercury: Nem importálható — kérlek állítsd be a számla nevét a Mercury-ban
+      description: Válassz egy Mercury számlát, amelyet ehhez a számlához szeretnél kapcsolni. A tranzakciók automatikusan szinkronizálásra és deduplikálásra kerülnek.
+      link_account: Számla összekapcsolása
+      no_account_specified: Nem lett megadva számla
+      no_accounts_found: Nem találhatók Mercury számlák. Kérlek ellenőrizd az API token konfigurációdat.
+      no_api_token: A Mercury API token nincs beállítva. Kérlek állítsd be a Beállításokban.
+      no_credentials_configured: Kérlek előbb állítsd be a Mercury API tokenedet a Szolgáltatói beállításokban.
+      no_name_placeholder: "(Nincs név)"
+      select_connection: Válassz Mercury kapcsolatot a Szolgáltatói beállításokban.
+      title: "%{account_name} összekapcsolása a Mercury-val"
+    link_existing_account:
+      account_already_linked: Ez a számla már össze van kapcsolva egy szolgáltatóval
+      api_error: "API hiba: %{message}"
+      invalid_account_name: Nem lehet összekapcsolni üres nevű számlát
+      mercury_account_already_linked: Ez a Mercury számla már össze van kapcsolva egy másik számlával
+      mercury_account_not_found: Mercury számla nem található
+      missing_parameters: Hiányzó kötelező paraméterek
+      no_api_token: Mercury API token nem található. Kérlek állítsd be a Szolgáltatói beállításokban.
+      select_connection: Válassz Mercury kapcsolatot a számlák összekapcsolása előtt.
+      success: "%{account_name} sikeresen összekapcsolva a Mercury-val"
+    setup_accounts:
+      account_type_label: "Számla típusa:"
+      all_accounts_linked: "Minden Mercury számlád már be van állítva."
+      api_error: "API hiba: %{message}"
+      fetch_failed: "Nem sikerült lekérni a számlákat"
+      no_accounts_to_setup: "Nincs beállítandó számla"
+      no_api_token: "A Mercury API token nincs beállítva. Kérlek ellenőrizd a kapcsolati beállításaidat."
+      account_types:
+        skip: Számla kihagyása
+        depository: Folyó- vagy megtakarítási számla
+        credit_card: Hitelkártya
+        investment: Befektetési számla
+        loan: Hitel vagy jelzálog
+        other_asset: Egyéb vagyon
+      subtype_labels:
+        depository: "Számla altípusa:"
+        credit_card: ""
+        investment: "Befektetés típusa:"
+        loan: "Hitel típusa:"
+        other_asset: ""
+      subtype_messages:
+        credit_card: "A hitelkártyák automatikusan hitelkártya számlákként lesznek beállítva."
+        other_asset: "Az egyéb vagyonelemekhez nincs szükség további beállításokra."
+      subtypes:
+        depository:
+          checking: Folyószámla
+          savings: Megtakarítási számla
+          hsa: Egészségügyi megtakarítási számla
+          cd: Lekötött betét
+          money_market: Pénzpiaci számla
+        investment:
+          brokerage: Brókeri számla
+          pension: Nyugdíjalap
+          retirement: Nyugdíj-megtakarítás
+          "401k": "401(k)"
+          roth_401k: "Roth 401(k)"
+          "403b": "403(b)"
+          tsp: Thrift Savings Plan
+          "529_plan": "529 Terv"
+          hsa: Egészségügyi megtakarítási számla
+          mutual_fund: Befektetési alap
+          ira: Hagyományos IRA
+          roth_ira: Roth IRA
+          angel: Angyal befektető
+        loan:
+          mortgage: Jelzálog
+          student: Diákhitel
+          auto: Autóhitel
+          other: Egyéb hitel
+      balance: Egyenleg
+      cancel: Mégse
+      choose_account_type: "Válaszd ki a megfelelő számlatípust minden Mercury számlához:"
+      create_accounts: Számlák létrehozása
+      creating_accounts: Számlák létrehozása...
+      historical_data_range: "Előzmények időtartama:"
+      subtitle: Válaszd ki az importált számlák helyes típusait
+      sync_start_date_help: "Válaszd ki, milyen messzire szeretnél visszamenni a tranzakciós előzmények szinkronizálásában. Maximum 3 év előzmény érhető el."
+      sync_start_date_label: "Tranzakciók szinkronizálásának kezdete:"
+      title: Mercury számlák beállítása
+    complete_account_setup:
+      all_skipped: "Minden számla ki lett hagyva. Nem jött létre számla."
+      creation_failed: "Nem sikerült létrehozni a számlákat: %{error}"
+      no_accounts: "Nincs beállítandó számla."
+      success: "%{count} számla sikeresen létrehozva."
+    sync:
+      success: Szinkronizálás elindítva
+    update:
+      success: Mercury kapcsolat frissítve
+    mercury_item_selection_error_payload:
+      select_connection: Válassz Mercury kapcsolatot a számlák betöltése előtt.
+    render_mercury_item_selection_failure:
+      select_connection: Válassz Mercury kapcsolatot a Szolgáltatói beállításokban.
+      no_credentials_configured: Kérlek előbb állítsd be a Mercury API tokenedet a Szolgáltatói beállításokban.
diff --git a/config/locales/views/messages/ca.yml b/config/locales/views/messages/ca.yml
new file mode 100644
index 000000000..1eaca20ef
--- /dev/null
+++ b/config/locales/views/messages/ca.yml
@@ -0,0 +1,6 @@
+---
+ca:
+  messages:
+    chat_form:
+      disclaimer: Les respostes de la IA són només informatives. No són consells financers!
+      placeholder: Pregunta el que vulguis ...
diff --git a/config/locales/views/messages/en.yml b/config/locales/views/messages/en.yml
new file mode 100644
index 000000000..dee376568
--- /dev/null
+++ b/config/locales/views/messages/en.yml
@@ -0,0 +1,6 @@
+---
+en:
+  messages:
+    chat_form:
+      placeholder: "Ask anything ..."
+      disclaimer: "AI responses are informational only. Not financial advice!"
diff --git a/config/locales/views/messages/hu.yml b/config/locales/views/messages/hu.yml
new file mode 100644
index 000000000..df1edc25e
--- /dev/null
+++ b/config/locales/views/messages/hu.yml
@@ -0,0 +1,6 @@
+---
+hu:
+  messages:
+    chat_form:
+      placeholder: "Kérdezz bármit..."
+      disclaimer: "Az AI-válaszok csak tájékoztató jellegűek. Nem pénzügyi tanácsadás!"
diff --git a/config/locales/views/mfa/ca.yml b/config/locales/views/mfa/ca.yml
index 18cb4ffe5..e53541c1a 100644
--- a/config/locales/views/mfa/ca.yml
+++ b/config/locales/views/mfa/ca.yml
@@ -13,27 +13,36 @@ ca:
     create:
       invalid_code: Codi de verificació invàlid. Torna-ho a provar.
     disable:
-      success: L'autenticació en dos passos s'ha desactivat
+      success: L'autenticació de dos factors s'ha desactivat
     new:
       code_label: Codi de verificació
       code_placeholder: Introdueix el codi de 6 dígits
-      description: Millora la seguretat del teu compte activant l'autenticació en
-        dos passos
-      page_title: Configuració de l'autenticació en dos passos
+      description: Millora la seguretat del teu compte activant l'autenticació de
+        dos factors
+      page_title: Configuració de l'autenticació de dos factors
       scan_description: Utilitza una app d'autenticació com Google Authenticator o
         1Password per escanejar aquest codi QR
       scan_title: 1. Escaneja el codi QR
       secret_description: Si no pots escanejar el codi QR, introdueix aquesta clau
         manualment a la teva app d'autenticació
       secret_title: Codi d'entrada manual
-      title: Activa l'autenticació en dos passos
+      title: Activa l'autenticació de dos factors
       verify_button: Verifica i activa 2FA
       verify_description: Introdueix el codi de 6 dígits de la teva app d'autenticació
       verify_title: 2. Introdueix el codi de verificació
     verify:
       description: Introdueix el codi de la teva app d'autenticació per continuar
-      page_title: Verifica l'autenticació en dos passos
-      title: Autenticació en dos passos
+      or: o
+      page_title: Verifica l'autenticació de dos factors
+      title: Autenticació de dos factors
       verify_button: Verifica
+      webauthn_button: Utilitza una clau d'accés o de seguretat
+      webauthn_unsupported: Aquest navegador no admet claus d'accés ni de seguretat.
     verify_code:
       invalid_code: Codi d'autenticació invàlid. Torna-ho a provar.
+    verify_webauthn:
+      invalid_credential: No s'ha pogut verificar aquesta clau d'accés o de seguretat.
+        Torna-ho a provar.
+    webauthn_options:
+      unavailable: No hi ha claus d'accés ni de seguretat disponibles per a aquest
+        compte.
diff --git a/config/locales/views/mfa/en.yml b/config/locales/views/mfa/en.yml
index 786f52594..7ac8e0c19 100644
--- a/config/locales/views/mfa/en.yml
+++ b/config/locales/views/mfa/en.yml
@@ -31,8 +31,15 @@ en:
       verify_title: 2. Enter Verification Code
     verify:
       description: Enter the code from your authenticator app to continue
+      or: or
       page_title: Verify Two-Factor Authentication
       title: Two-Factor Authentication
       verify_button: Verify
+      webauthn_button: Use passkey or security key
+      webauthn_unsupported: This browser does not support passkeys or security keys.
     verify_code:
       invalid_code: Invalid authentication code. Please try again.
+    verify_webauthn:
+      invalid_credential: Could not verify that passkey or security key. Please try again.
+    webauthn_options:
+      unavailable: No passkeys or security keys are available for this account.
diff --git a/config/locales/views/mfa/es.yml b/config/locales/views/mfa/es.yml
index c6db6fb0a..def1e4b5d 100644
--- a/config/locales/views/mfa/es.yml
+++ b/config/locales/views/mfa/es.yml
@@ -31,8 +31,15 @@ es:
       verify_title: 2. Ingresa el Código de Verificación
     verify:
       description: Ingresa el código de tu aplicación de autenticación para continuar
+      or: o
       page_title: Verificar la Autenticación de Dos Factores
       title: Autenticación de Dos Factores
       verify_button: Verificar
+      webauthn_button: Usar passkey o llave de seguridad
+      webauthn_unsupported: Este navegador no admite passkeys ni llaves de seguridad.
     verify_code:
       invalid_code: Código de autenticación inválido. Por favor, inténtalo de nuevo.
+    verify_webauthn:
+      invalid_credential: No se pudo verificar esa passkey o llave de seguridad. Inténtalo de nuevo.
+    webauthn_options:
+      unavailable: No hay passkeys ni llaves de seguridad disponibles para esta cuenta.
diff --git a/config/locales/views/mfa/hu.yml b/config/locales/views/mfa/hu.yml
new file mode 100644
index 000000000..929518303
--- /dev/null
+++ b/config/locales/views/mfa/hu.yml
@@ -0,0 +1,41 @@
+---
+hu:
+  mfa:
+    backup_codes:
+      backup_codes_description: Minden kód csak egyszer használható. Tartsd ezeket a kódokat biztonságos helyen.
+      backup_codes_title: A tartalékkódjaid
+      continue: Folytatás a biztonsági beállításokhoz
+      description: Tárold ezeket a tartalékkódokat biztonságos helyen – szükséged lesz rájuk, ha elveszíted a hozzáférést a hitelesítő alkalmazásodhoz
+      page_title: Tartalékkódok
+      title: Mentsd el a tartalékkódjaidat
+    create:
+      invalid_code: Érvénytelen ellenőrzőkód. Kérjük, próbáld újra.
+    disable:
+      success: A kétlépéses hitelesítés le lett tiltva
+    new:
+      code_label: Ellenőrzőkód
+      code_placeholder: Add meg a 6 jegyű kódot
+      description: Növeld a fiókod biztonságát a kétlépéses hitelesítés beállításával
+      page_title: Kétlépéses hitelesítés beállítása
+      scan_description: Használj egy hitelesítő alkalmazást, például a Google Authenticatort vagy az 1Passwordöt a QR-kód beolvasásához
+      scan_title: 1. QR-kód beolvasása
+      secret_description: Ha nem tudod beolvasni a QR-kódot, add meg ezt a titkos kulcsot manuálisan a hitelesítő alkalmazásodban
+      secret_title: Manuális beviteli kód
+      title: Kétlépéses hitelesítés beállítása
+      verify_button: Ellenőrzés és 2FA engedélyezése
+      verify_description: Add meg a 6 jegyű kódot a hitelesítő alkalmazásodból
+      verify_title: 2. Ellenőrzőkód megadása
+    verify:
+      description: Add meg a hitelesítő alkalmazásodban lévő kódot a folytatáshoz
+      or: vagy
+      page_title: Kétlépéses hitelesítés ellenőrzése
+      title: Kétlépéses hitelesítés
+      verify_button: Ellenőrzés
+      webauthn_button: Jelszókulcs vagy biztonsági kulcs használata
+      webauthn_unsupported: Ez a böngésző nem támogatja a jelszókulcsokat vagy biztonsági kulcsokat.
+    verify_code:
+      invalid_code: Érvénytelen hitelesítési kód. Kérjük, próbáld újra.
+    verify_webauthn:
+      invalid_credential: Nem sikerült ellenőrizni a jelszókulcsot vagy biztonsági kulcsot. Kérjük, próbáld újra.
+    webauthn_options:
+      unavailable: Ehhez a fiókhoz nem áll rendelkezésre jelszókulcs vagy biztonsági kulcs.
diff --git a/config/locales/views/oidc_accounts/ca.yml b/config/locales/views/oidc_accounts/ca.yml
index 06ad64409..568f549a9 100644
--- a/config/locales/views/oidc_accounts/ca.yml
+++ b/config/locales/views/oidc_accounts/ca.yml
@@ -1,33 +1,49 @@
 ---
 ca:
   oidc_accounts:
+    create_link:
+      no_pending_oidc: No s'ha trobat cap autenticació OIDC pendent
+    create_user:
+      account_created: Benvingut/da! S'ha creat el teu compte.
+      account_creation_disabled: La creació de comptes SSO està desactivada. Contacta
+        amb un administrador.
+      no_pending_oidc: No s'ha trobat cap autenticació OIDC pendent
     link:
-      title_link: Enllaçar compte OIDC
-      title_create: Crear compte
-      verify_heading: Verificar la vostra identitat
-      verify_description_html: "Per enllaçar el vostre compte %{provider}%{email_suffix}, verifiqueu la vostra identitat introduint la contrasenya."
-      email_suffix_html: " (<strong>%{email}</strong>)"
+      account_creation_disabled: La creació de nous comptes mitjançant inici de sessió
+        únic està desactivada. Contacta amb un administrador per crear el teu compte.
+      cancel: Cancel·la
+      create_description_html: No s'ha trobat cap compte amb el correu electrònic
+        <strong>%{email}</strong>. Fes clic a sota per crear un compte nou amb la
+        teva identitat de %{provider}.
+      create_heading: Crea un compte nou
       email_label: Correu electrònic
-      email_placeholder: Introduïu el vostre correu electrònic
+      email_placeholder: Introdueix el teu correu electrònic
+      email_suffix_html: " (<strong>%{email}</strong>)"
+      info_email: 'Correu electrònic:'
+      info_name: 'Nom:'
+      no_pending_oidc: No s'ha trobat cap autenticació OIDC pendent
       password_label: Contrasenya
-      password_placeholder: Introduïu la vostra contrasenya
-      verify_hint: Això garanteix que només vós pugueu enllaçar comptes externs al vostre perfil.
-      submit_link: Enllaçar compte
-      create_heading: Crear compte nou
-      create_description_html: "No s'ha trobat cap compte amb el correu electrònic <strong>%{email}</strong>. Feu clic a baix per crear un compte nou amb la vostra identitat %{provider}."
-      info_email: "Correu electrònic:"
-      info_name: "Nom:"
-      submit_create: Crear compte
-      account_creation_disabled: La creació de comptes mitjançant l'inici de sessió únic està desactivada. Contacteu amb un administrador.
-      cancel: Cancel·lar
+      password_placeholder: Introdueix la teva contrasenya
+      submit_accept_invitation: Accepta la invitació
+      submit_create: Crea el compte
+      submit_link: Enllaça el compte
+      title_create: Crea un compte
+      title_link: Enllaça el compte OIDC
+      verify_description_html: Per enllaçar el teu compte %{provider}%{email_suffix},
+        verifica la teva identitat introduint la contrasenya.
+      verify_heading: Verifica la teva identitat
+      verify_hint: Així garantim que només tu pots enllaçar comptes externs al teu
+        perfil.
     new_user:
-      title: Completar el compte
-      heading: Crear el compte
-      description: Confirmeu les vostres dades per completar la creació del compte amb la vostra identitat %{provider}.
+      cancel: Cancel·la
+      description: Confirma les teves dades per completar la creació del compte amb
+        la teva identitat de %{provider}.
       email_label: Correu electrònic (del proveïdor SSO)
       first_name_label: Nom
-      first_name_placeholder: Introduïu el vostre nom
+      first_name_placeholder: Introdueix el teu nom
+      heading: Crea el teu compte
       last_name_label: Cognom
-      last_name_placeholder: Introduïu el vostre cognom
-      submit: Crear compte
-      cancel: Cancel·lar
\ No newline at end of file
+      last_name_placeholder: Introdueix el teu cognom
+      no_pending_oidc: No s'ha trobat cap autenticació OIDC pendent
+      submit: Crea el compte
+      title: Completa el teu compte
diff --git a/config/locales/views/oidc_accounts/en.yml b/config/locales/views/oidc_accounts/en.yml
index e04729307..2e01ea323 100644
--- a/config/locales/views/oidc_accounts/en.yml
+++ b/config/locales/views/oidc_accounts/en.yml
@@ -2,6 +2,7 @@
 en:
   oidc_accounts:
     link:
+      no_pending_oidc: No pending OIDC authentication found
       title_link: Link OIDC Account
       title_create: Create Account
       verify_heading: Verify Your Identity
@@ -21,7 +22,10 @@ en:
       submit_accept_invitation: Accept Invitation
       account_creation_disabled: New account creation via single sign-on is disabled. Please contact an administrator to create your account.
       cancel: Cancel
+    create_link:
+      no_pending_oidc: No pending OIDC authentication found
     new_user:
+      no_pending_oidc: No pending OIDC authentication found
       title: Complete Your Account
       heading: Create Your Account
       description: Please confirm your details to complete account creation with your %{provider} identity.
@@ -32,3 +36,7 @@ en:
       last_name_placeholder: Enter your last name
       submit: Create Account
       cancel: Cancel
+    create_user:
+      no_pending_oidc: No pending OIDC authentication found
+      account_creation_disabled: SSO account creation is disabled. Please contact an administrator.
+      account_created: "Welcome! Your account has been created."
diff --git a/config/locales/views/oidc_accounts/fr.yml b/config/locales/views/oidc_accounts/fr.yml
index 9260f97af..771ee1884 100644
--- a/config/locales/views/oidc_accounts/fr.yml
+++ b/config/locales/views/oidc_accounts/fr.yml
@@ -18,6 +18,7 @@ fr:
       info_email: "E-mail :"
       info_name: "Nom :"
       submit_create: Créer un compte
+      submit_accept_invitation: Accepter l'invitation
       account_creation_disabled: La création de compte via l'authentification unique est désactivée. Veuillez contacter un administrateur.
       cancel: Annuler
     new_user:
@@ -30,4 +31,4 @@ fr:
       last_name_label: Nom de famille
       last_name_placeholder: Saisissez votre nom de famille
       submit: Créer un compte
-      cancel: Annuler
\ No newline at end of file
+      cancel: Annuler
diff --git a/config/locales/views/oidc_accounts/hu.yml b/config/locales/views/oidc_accounts/hu.yml
new file mode 100644
index 000000000..90c9783f4
--- /dev/null
+++ b/config/locales/views/oidc_accounts/hu.yml
@@ -0,0 +1,42 @@
+---
+hu:
+  oidc_accounts:
+    link:
+      no_pending_oidc: Nem található függőben lévő OIDC-hitelesítés
+      title_link: OIDC-fiók összekapcsolása
+      title_create: Fiók létrehozása
+      verify_heading: Igazold az azonosságodat
+      verify_description_html: "A(z) %{provider} fiókod%{email_suffix} összekapcsolásához kérjük, igazold az azonosságodat a jelszavad megadásával."
+      email_suffix_html: " (<strong>%{email}</strong>)"
+      email_label: E-mail
+      email_placeholder: Add meg az e-mail címedet
+      password_label: Jelszó
+      password_placeholder: Add meg a jelszavadat
+      verify_hint: Ez segít biztosítani, hogy csak te tudhass külső fiókokat összekapcsolni a profiloddal.
+      submit_link: Fiók összekapcsolása
+      create_heading: Új fiók létrehozása
+      create_description_html: "Nem található fiók a(z) <strong>%{email}</strong> e-mail címhez. Kattints az alábbira, hogy új fiókot hozz létre a(z) %{provider} azonosítóddal."
+      info_email: "E-mail:"
+      info_name: "Név:"
+      submit_create: Fiók létrehozása
+      submit_accept_invitation: Meghívó elfogadása
+      account_creation_disabled: Az egyszeri bejelentkezésen keresztüli új fiók létrehozása le van tiltva. Kérjük, lépj kapcsolatba egy rendszergazdával a fiókod létrehozásához.
+      cancel: Mégse
+    create_link:
+      no_pending_oidc: Nem található függőben lévő OIDC-hitelesítés
+    new_user:
+      no_pending_oidc: Nem található függőben lévő OIDC-hitelesítés
+      title: Fiókod véglegesítése
+      heading: Hozd létre a fiókodat
+      description: Kérjük, erősítsd meg az adataidat a fiókod létrehozásának befejezéséhez a(z) %{provider} azonosítóddal.
+      email_label: E-mail (az SSO-szolgáltatótól)
+      first_name_label: Keresztnév
+      first_name_placeholder: Add meg a keresztnevedet
+      last_name_label: Vezetéknév
+      last_name_placeholder: Add meg a vezetéknevedet
+      submit: Fiók létrehozása
+      cancel: Mégse
+    create_user:
+      no_pending_oidc: Nem található függőben lévő OIDC-hitelesítés
+      account_creation_disabled: Az SSO-fiók létrehozása le van tiltva. Kérjük, lépj kapcsolatba egy rendszergazdával.
+      account_created: "Üdvözlünk! A fiókod sikeresen létrejött."
diff --git a/config/locales/views/onboardings/ca.yml b/config/locales/views/onboardings/ca.yml
index 9036a1efe..919d84017 100644
--- a/config/locales/views/onboardings/ca.yml
+++ b/config/locales/views/onboardings/ca.yml
@@ -1,61 +1,71 @@
 ---
 ca:
   onboardings:
+    goals:
+      ai_insights: Deixar que la IA m'ajudi a entendre les meves finances
+      budgeting: Gestionar plans financers i pressupostos
+      cashflow: Entendre el flux de caixa i les despeses
+      investments: Fer el seguiment d'inversions
+      optimization: Analitzar i optimitzar comptes
+      partner: Gestionar les finances amb la parella
+      reduce_stress: Reduir l'estrès o l'ansietat financera
+      submit: Següent
+      subtitle: Selecciona un o més objectius que tens amb %{product_name} com a eina
+        de finances personals.
+      title: Què t'ha portat aquí?
+      unified_accounts: Veure tots els meus comptes en un sol lloc
     header:
-      sign_out: Tancar sessió
-      setup: Configuració
-      preferences: Preferències
       goals: Objectius
+      preferences: Preferències
+      setup: Configuració
+      sign_out: Tanca la sessió
       start: Inici
     logout:
-      sign_out: Tancar sessió
+      sign_out: Tanca la sessió
+    preferences:
+      color_theme: Tema de color
+      currency: Divisa
+      date_format: Format de data
+      example: Compte d'exemple
+      locale: Idioma
+      preview: Previsualitza com es mostren les dades segons les preferències.
+      submit: Finalitza
+      subtitle: Configurem les teves preferències.
+      theme_dark: Fosc
+      theme_light: Clar
+      theme_system: Sistema
+      title: Configura les teves preferències
     show:
-      title: Configurem el teu compte
-      subtitle: Primer de tot, completem el teu perfil.
+      country: País
       first_name: Nom
       first_name_placeholder: Nom
-      last_name: Cognom
-      last_name_placeholder: Cognom
+      group_name: Nom del grup
+      group_name_placeholder: Nom del grup
       household_name: Nom de la llar
       household_name_placeholder: Nom de la llar
-      country: País
-      submit: Continuar
-    preferences:
-      title: Configura les teves preferències
-      subtitle: Configurem les teves preferències.
-      example: Compte d'exemple
-      preview: Previsualitza com es mostren les dades segons les preferències.
-      color_theme: Tema de colors
-      theme_system: Sistema
-      theme_light: Clar
-      theme_dark: Fosc
-      locale: Idioma
-      currency: Moneda
-      date_format: Format de data
-      submit: Completar
-    goals:
-      title: Què t'ha portat aquí?
-      subtitle: Selecciona un o més objectius que tens amb %{product_name} com a eina de finances personals.
-      unified_accounts: Veure tots els meus comptes en un sol lloc
-      cashflow: Entendre el flux de caixa i les despeses
-      budgeting: Gestionar plans financers i pressupostos
-      partner: Gestionar finances amb la parella
-      investments: Seguir les inversions
-      ai_insights: Deixar que la IA m'ajudi a entendre les meves finances
-      optimization: Analitzar i optimitzar comptes
-      reduce_stress: Reduir l'estrès financer o l'ansietat
-      submit: Següent
+      last_name: Cognom
+      last_name_placeholder: Cognom
+      moniker_family: Membres de la família (tu sol/a o amb la teva parella, fills,
+        etc.)
+      moniker_group: Grup de persones (empresa, club, associació, qualsevol altre
+        tipus)
+      moniker_prompt: Faràs servir %{product_name} amb...
+      submit: Continua
+      subtitle: Primer de tot, completem el teu perfil.
+      title: Configurem el teu compte
     trial:
-      title: Prova Sure durant 45 dies
+      continue_trial: Continua la prova
       data_deletion: Les dades s'eliminaran després
-      description_html: A partir d'avui pots provar el producte a fons.<br/>Si t'agrada, allotja'l tu mateix o contribueix per continuar usant-lo aquí.
-      try_button: Provar Sure durant 45 dies
-      continue_trial: Continuar la prova
-      upgrade: Actualitzar
-      how_it_works: Com funciona
+      description_html: A partir d'avui pots fer una bona ullada al producte.<br/>Si
+        t'agrada, autoallotja'l o contribueix per continuar fent-lo servir aquí.
+      how_it_works: Com funcionen les coses aquí
+      in_40_days: D'aquí 40 dies (%{date})
+      in_40_days_description: T'avisarem perquè recordis exportar les teves dades.
+      in_45_days: D'aquí 45 dies (%{date})
+      in_45_days_description: Eliminarem les teves dades — contribueix per continuar
+        fent servir Sure aquí!
+      title: Prova Sure durant 45 dies
       today: Avui
       today_description: Tindràs accés gratuït a Sure durant 45 dies al nostre AWS.
-      in_40_days: En 40 dies (%{date})
-      in_40_days_description: Et notificarem per recordar-te d'exportar les teves dades.
-      in_45_days: En 45 dies (%{date})
-      in_45_days_description: Eliminarem les teves dades — contribueix per continuar usant Sure aquí!
\ No newline at end of file
+      try_button: Prova Sure durant 45 dies
+      upgrade: Actualitza
diff --git a/config/locales/views/onboardings/fr.yml b/config/locales/views/onboardings/fr.yml
index 72598204a..d93acd519 100644
--- a/config/locales/views/onboardings/fr.yml
+++ b/config/locales/views/onboardings/fr.yml
@@ -16,8 +16,13 @@ fr:
       first_name_placeholder: Prénom
       last_name: Nom de famille
       last_name_placeholder: Nom de famille
+      group_name: Nom du groupe
+      group_name_placeholder: Nom du groupe
       household_name: Nom du foyer
       household_name_placeholder: Nom du foyer
+      moniker_prompt: "Vous utiliserez %{product_name} avec…"
+      moniker_family: Membres de la famille (seul ou avec votre partenaire, vos enfants, etc.)
+      moniker_group: Groupe de personnes (entreprise, club, association, ou tout autre type)
       country: Pays
       submit: Continuer
     preferences:
@@ -58,4 +63,4 @@ fr:
       in_40_days: Dans 40 jours (%{date})
       in_40_days_description: Nous vous notifierons pour vous rappeler d'exporter vos données.
       in_45_days: Dans 45 jours (%{date})
-      in_45_days_description: Nous supprimons vos données — contribuez pour continuer à utiliser Sure ici !
\ No newline at end of file
+      in_45_days_description: Nous supprimons vos données — contribuez pour continuer à utiliser Sure ici !
diff --git a/config/locales/views/onboardings/hu.yml b/config/locales/views/onboardings/hu.yml
new file mode 100644
index 000000000..da81b485f
--- /dev/null
+++ b/config/locales/views/onboardings/hu.yml
@@ -0,0 +1,66 @@
+---
+hu:
+  onboardings:
+    header:
+      sign_out: Kijelentkezés
+      setup: Beállítás
+      preferences: Beállítások
+      goals: Célok
+      start: Kezdés
+    logout:
+      sign_out: Kijelentkezés
+    show:
+      title: Hozzuk létre a fiókodat
+      subtitle: Először is állítsuk be a profilodat.
+      first_name: Keresztnév
+      first_name_placeholder: Keresztnév
+      last_name: Vezetéknév
+      last_name_placeholder: Vezetéknév
+      group_name: Csoport neve
+      group_name_placeholder: Csoport neve
+      household_name: Háztartás neve
+      household_name_placeholder: Háztartás neve
+      moniker_prompt: "A(z) %{product_name} alkalmazást ... fogom használni"
+      moniker_family: Családtagokkal (csak magam vagy partnerrel, tinédzserekkel stb.)
+      moniker_group: Emberek egy csoportjával (cég, klub, egyesület vagy bármilyen más típus)
+      country: Ország
+      submit: Folytatás
+    preferences:
+      title: Állítsd be a preferenciáidat
+      subtitle: Konfiguráljuk a preferenciáidat.
+      example: Példa számla
+      preview: Előnézet a beállítások alapján megjelenő adatokról.
+      color_theme: Színtéma
+      theme_system: Rendszer
+      theme_light: Világos
+      theme_dark: Sötét
+      locale: Nyelv
+      currency: Pénznem
+      date_format: Dátumformátum
+      submit: Befejezés
+    goals:
+      title: Mi hozott ide?
+      subtitle: Válassz ki egy vagy több célt, amelyet el szeretnél érni a %{product_name} személyes pénzügyi eszközzel.
+      unified_accounts: Lássam az összes számlámat egy helyen
+      cashflow: Megértsem a pénzforgalmat és a kiadásokat
+      budgeting: Pénzügyi tervek és költségvetés kezelése
+      partner: Pénzügyek kezelése partnerrel együtt
+      investments: Befektetések nyomon követése
+      ai_insights: Hadd segítsen az AI a pénzügyeim megértésében
+      optimization: Számlák elemzése és optimalizálása
+      reduce_stress: Pénzügyi stressz vagy szorongás csökkentése
+      submit: Tovább
+    trial:
+      title: Próbáld ki a Sure-t 45 napig
+      data_deletion: Ezután az adatok törlődnek
+      description_html: Ma kezdve alaposan megismerheted a terméket.<br/>Ha megtetszik, üzemeltesd saját magad, vagy járulj hozzá a fejlesztéshez, hogy tovább használhasd.
+      try_button: Próbáld ki a Sure-t 45 napig
+      continue_trial: Próbaidőszak folytatása
+      upgrade: Frissítés
+      how_it_works: Hogyan működik ez
+      today: Ma
+      today_description: 45 napig ingyenesen hozzáférsz a Sure-höz az AWS-ünkön.
+      in_40_days: 40 nap múlva (%{date})
+      in_40_days_description: Értesítünk, hogy exportáld az adataidat.
+      in_45_days: 45 nap múlva (%{date})
+      in_45_days_description: Töröljük az adataidat – járulj hozzá a fejlesztéshez, hogy tovább használhasd a Sure-t!
diff --git a/config/locales/views/other_assets/ca.yml b/config/locales/views/other_assets/ca.yml
index b157b7ef7..1894503db 100644
--- a/config/locales/views/other_assets/ca.yml
+++ b/config/locales/views/other_assets/ca.yml
@@ -2,10 +2,12 @@
 ca:
   other_assets:
     edit:
-      balance_tracking_info: L'estat dels Altres Actius es segueix mitjançant valoracions manuals
-        utilitzant 'Nou saldo', no transaccions. El flux de caixa no afectarà el saldo del compte.
+      balance_tracking_info: Els altres actius es segueixen mitjançant valoracions
+        manuals utilitzant 'Nou saldo', no transaccions. El flux de caixa no afectarà
+        el saldo del compte.
       edit: Edita %{account}
     new:
-      balance_tracking_info: L'estat dels Altres Actius es segueix mitjançant valoracions manuals
-        utilitzant 'Nou saldo', no transaccions. El flux de caixa no afectarà el saldo del compte.
+      balance_tracking_info: Els altres actius es segueixen mitjançant valoracions
+        manuals utilitzant 'Nou saldo', no transaccions. El flux de caixa no afectarà
+        el saldo del compte.
       title: Introdueix els detalls de l'actiu
diff --git a/config/locales/views/other_assets/fr.yml b/config/locales/views/other_assets/fr.yml
index bb80324e4..c34fa85e2 100644
--- a/config/locales/views/other_assets/fr.yml
+++ b/config/locales/views/other_assets/fr.yml
@@ -3,5 +3,7 @@ fr:
   other_assets:
     edit:
       edit: Modifier %{account}
+      balance_tracking_info: "Les autres actifs sont suivis via des valorisations manuelles à l'aide de 'Nouveau solde', et non via des transactions. Les flux de trésorerie n'affecteront pas le solde du compte."
     new:
       title: Saisir les détails de l'actif
+      balance_tracking_info: "Les autres actifs sont suivis via des valorisations manuelles à l'aide de 'Nouveau solde', et non via des transactions. Les flux de trésorerie n'affecteront pas le solde du compte."
diff --git a/config/locales/views/other_assets/hu.yml b/config/locales/views/other_assets/hu.yml
new file mode 100644
index 000000000..38cd263ed
--- /dev/null
+++ b/config/locales/views/other_assets/hu.yml
@@ -0,0 +1,9 @@
+---
+hu:
+  other_assets:
+    edit:
+      edit: '%{account} szerkesztése'
+      balance_tracking_info: 'Az egyéb vagyonelemek értékét manuális értékelésekkel lehet követni az „Új egyenleg” funkcióval, nem tranzakciókkal. A pénzforgalom nem befolyásolja a számlaegyenleget.'
+    new:
+      title: Add meg a vagyonelem adatait
+      balance_tracking_info: 'Az egyéb vagyonelemek értékét manuális értékelésekkel lehet követni az „Új egyenleg” funkcióval, nem tranzakciókkal. A pénzforgalom nem befolyásolja a számlaegyenleget.'
diff --git a/config/locales/views/other_liabilities/hu.yml b/config/locales/views/other_liabilities/hu.yml
new file mode 100644
index 000000000..c8e8dd1a2
--- /dev/null
+++ b/config/locales/views/other_liabilities/hu.yml
@@ -0,0 +1,7 @@
+---
+hu:
+  other_liabilities:
+    edit:
+      edit: '%{account} szerkesztése'
+    new:
+      title: Add meg a kötelezettség adatait
diff --git a/config/locales/views/pages/ca.yml b/config/locales/views/pages/ca.yml
index 4b0fdf4c7..13f95e886 100644
--- a/config/locales/views/pages/ca.yml
+++ b/config/locales/views/pages/ca.yml
@@ -6,8 +6,20 @@ ca:
     dashboard:
       balance_sheet:
         add_accounts: Afegeix els teus comptes de %{name} per veure'n el detall complet
+        add_asset_accounts: Afegeix els teus comptes d'actius per veure'n el detall
+          complet
+        add_liability_accounts: Afegeix els teus comptes de passius per veure'n el
+          detall complet
+        classifications:
+          asset: Actius
+          liability: Passius
+        name: Nom
+        no_asset: Encara no hi ha actius
         no_items: Encara no hi ha %{name}
+        no_liability: Encara no hi ha passius
         title: Balanç patrimonial
+        value: Valor
+        weight: Pes
       cashflow_sankey:
         add_transaction: Afegeix una transacció
         no_data_description: Afegeix transaccions per mostrar dades de flux de caixa
@@ -16,15 +28,15 @@ ca:
         title: Flux de caixa
       drag_to_reorder: Arrossega per reordenar la secció
       investment_summary:
-        add_investment: Afegeix un compte d'inversió per seguir el teu portafoli
-        contributions: Contribucions
+        add_investment: Afegeix un compte d'inversió per seguir la teva cartera
+        contributions: Aportacions
         holding: Posició
         no_investments: No hi ha comptes d'inversió
-        period_activity: "Activitat del %{period}"
+        period_activity: 'Activitat — %{period}'
         return: Rendiment
         title: Inversions
         total_return: Rendiment total
-        trades: Negocis
+        trades: Operacions
         value: Valor
         weight: Pes
         withdrawals: Retirades
@@ -44,10 +56,50 @@ ca:
         title: Encara no hi ha comptes
       outflows_donut:
         categories: Categories
-        title: Sortides
-        total_outflows: Total sortides
+        title: Sortides de caixa
+        total_outflows: Total de sortides de caixa
         value: Valor
         weight: Pes
       subtitle: Això és el que està passant amb les teves finances
       toggle_section: Commuta la visibilitat de la secció
       welcome: Benvingut/da de nou, %{name}
+    feedback:
+      bug_report: Informa d'un error
+      description: Fes-nos saber si tens cap comentari específic. No dubtis a incloure
+        enllaços a vídeos o captures de pantalla.
+      discuss: Comenta %{product} amb d'altres
+      feature_request: Sol·licita una funcionalitat
+      heading: Deixa un comentari
+      title: Comentaris
+    intro:
+      coming_soon: Experiència d'introducció properament
+      description: Estem creant una experiència d'inici més rica per conèixer els
+        teus objectius, fites i necessitats diàries. De moment, ves a la barra lateral
+        del xat per iniciar una conversa amb Sure i explica'ns on et trobes al teu
+        recorregut financer.
+      not_authorized: La introducció només està disponible per a usuaris convidats.
+      start_chatting: Comença a xatejar
+      welcome: Benvingut/da!
+    privacy:
+      heading: Política de privadesa
+      placeholder: El contingut de la política de privadesa es mostrarà aquí.
+      title: Política de privadesa
+    redis_configuration_error:
+      heading: Cal configurar Redis
+      page_title: Cal configurar Redis - Sure
+      refresh_hint: Un cop hagis configurat Redis, recarrega aquesta pàgina per continuar.
+      refresh_page: Recarrega la pàgina
+      setup_guide_hint: Segueix la nostra guia completa de configuració de Docker
+        per configurar Redis
+      subheading: La teva instal·lació de Sure amb self hosting necessita Redis configurat
+        correctament.
+      view_setup_guide: Veure la guia de configuració
+      why_required_body: Sure utilitza Redis per executar les tasques en segon pla
+        de Sidekiq, com ara la sincronització de dades de comptes, el processament
+        d'importacions i altres operacions de fons que mantenen les teves dades financeres
+        actualitzades.
+      why_required_title: Per què cal Redis?
+    terms:
+      heading: Condicions del servei
+      placeholder: El contingut de les condicions del servei es mostrarà aquí.
+      title: Condicions del servei
diff --git a/config/locales/views/pages/en.yml b/config/locales/views/pages/en.yml
index bded845ee..df0a8a70c 100644
--- a/config/locales/views/pages/en.yml
+++ b/config/locales/views/pages/en.yml
@@ -1,6 +1,29 @@
 ---
 en:
   pages:
+    feedback:
+      title: Feedback
+      heading: Leave feedback
+      description: Let us know if you have any specific feedback. Feel free to include links to videos or screenshots.
+      feature_request: Write a feature request
+      bug_report: File a bug report
+      discuss: "Discuss %{product} with others"
+    intro:
+      not_authorized: "Intro is only available to guest users."
+      welcome: "Welcome!"
+      coming_soon: Intro experience coming soon
+      description: "We're building a richer onboarding journey to learn about your goals, milestones, and day-to-day needs. For now, head over to the chat sidebar to start a conversation with Sure and let us know where you are in your financial journey."
+      start_chatting: Start chatting
+    redis_configuration_error:
+      page_title: Redis Configuration Required - Sure
+      heading: Redis Configuration Required
+      subheading: Your self-hosted Sure installation needs Redis to be properly configured.
+      why_required_title: Why is Redis required?
+      why_required_body: Sure uses Redis to power Sidekiq background jobs for tasks like syncing account data, processing imports, and other background operations that keep your financial data up to date.
+      view_setup_guide: View Setup Guide
+      setup_guide_hint: Follow our complete Docker setup guide to configure Redis
+      refresh_hint: "Once you've configured Redis, refresh this page to continue."
+      refresh_page: Refresh Page
     changelog:
       title: What's new
     privacy:
@@ -28,8 +51,19 @@ en:
         title: "Balance Sheet"
         no_items: "No %{name} yet"
         add_accounts: "Add your %{name} accounts to see a full breakdown"
+        no_asset: "No assets yet"
+        no_liability: "No liabilities yet"
+        add_asset_accounts: "Add your asset accounts to see a full breakdown"
+        add_liability_accounts: "Add your liability accounts to see a full breakdown"
+        name: "Name"
+        weight: "Weight"
+        value: "Value"
+        classifications:
+          asset: "Assets"
+          liability: "Liabilities"
       cashflow_sankey:
         title: "Cashflow"
+        zoom_out: "Back to full cashflow"
         no_data_title: "No cash flow data for this time period"
         no_data_description: "Add transactions to display cash flow data or expand the time period"
         add_transaction: "Add transaction"
diff --git a/config/locales/views/pages/fr.yml b/config/locales/views/pages/fr.yml
index 4eff5bc09..bfd6ed1c1 100644
--- a/config/locales/views/pages/fr.yml
+++ b/config/locales/views/pages/fr.yml
@@ -3,23 +3,56 @@ fr:
   pages:
     changelog:
       title: Nouveautés
+    privacy:
+      title: Politique de confidentialité
+      heading: Politique de confidentialité
+      placeholder: Le contenu de la politique de confidentialité sera affiché ici.
+    terms:
+      title: Conditions d'utilisation
+      heading: Conditions d'utilisation
+      placeholder: Le contenu des conditions d'utilisation sera affiché ici.
     dashboard:
-      welcome_back: Content de vous revoir
-      happening_with_finance: Voici ce qui se passe avec vos finances
-      new: Nouveau
-      cashflow:
-        title: Flux de trésorerie
-        no_cashflow: Aucune donnée de flux de trésorerie pour cette période
-        add_transactions_to_display_cashflow: Ajoutez des transactions pour afficher les données de flux de trésorerie ou étendre la période
-        new: Ajouter une transaction
+      welcome: "Content de vous revoir, %{name}"
+      subtitle: "Voici ce qui se passe avec vos finances"
+      new: "Nouveau"
+      drag_to_reorder: "Glisser pour réorganiser la section"
+      toggle_section: "Afficher/masquer la section"
       net_worth_chart:
         data_not_available: Données indisponibles pour la période sélectionnée
-        title: Valeur nette
+        title: Patrimoine net
       no_account_empty_state:
         new_account: Nouveau compte
         no_account_subtitle: Comme aucun compte n'a été ajouté, il n'y a pas de données à afficher. Ajoutez vos premiers comptes pour commencer à consulter les données du tableau de bord.
         no_account_title: Pas encore de comptes
-      no_account_graph_placeholder:
-        no_account_yet: Pas encore de compte
-        add_account_to_display: Ajouter des comptes pour afficher les données de valeur nette
-        new: Ajouter un compte
+      balance_sheet:
+        title: "Bilan"
+        no_items: "Aucun %{name} pour l'instant"
+        add_accounts: "Ajoutez vos comptes %{name} pour voir une ventilation complète"
+      cashflow_sankey:
+        title: "Flux de trésorerie"
+        no_data_title: "Aucune donnée de flux de trésorerie pour cette période"
+        no_data_description: "Ajoutez des transactions pour afficher les données de flux de trésorerie ou étendez la période"
+        add_transaction: "Ajouter une transaction"
+      no_accounts:
+        title: "Pas encore de comptes"
+        description: "Ajoutez des comptes pour afficher les données de patrimoine net"
+        add_account: "Ajouter un compte"
+      outflows_donut:
+        title: "Sorties"
+        total_outflows: "Total des sorties"
+        categories: "Catégories"
+        value: "Valeur"
+        weight: "Poids"
+      investment_summary:
+        title: "Investissements"
+        total_return: "Rendement total"
+        holding: "Avoir"
+        weight: "Poids"
+        value: "Valeur"
+        return: "Rendement"
+        period_activity: "Activité %{period}"
+        contributions: "Apports"
+        withdrawals: "Retraits"
+        trades: "Transactions boursières"
+        no_investments: "Aucun compte d'investissement"
+        add_investment: "Ajoutez un compte d'investissement pour suivre votre portefeuille"
diff --git a/config/locales/views/pages/hu.yml b/config/locales/views/pages/hu.yml
new file mode 100644
index 000000000..b1393e2b7
--- /dev/null
+++ b/config/locales/views/pages/hu.yml
@@ -0,0 +1,91 @@
+---
+hu:
+  pages:
+    feedback:
+      title: Visszajelzés
+      heading: Visszajelzés küldése
+      description: Oszd meg velünk, ha konkrét visszajelzésed van. Nyugodtan csatolhatsz videóhivatkozásokat vagy képernyőképeket.
+      feature_request: Funkcióigény beküldése
+      bug_report: Hibajelentés
+      discuss: "%{product} megbeszélése másokkal"
+    intro:
+      not_authorized: "Az intro csak vendégfelhasználók számára érhető el."
+      welcome: "Üdvözöllek!"
+      coming_soon: Az intro hamarosan elérhető
+      description: "Gazdagabb bevezetési élményt fejlesztünk, hogy megismerjük a céljaidat, mérföldköveidet és mindennapi igényeidet. Addig is menj a csevegőoldalsávba, indíts egy beszélgetést a Sure-ral, és mesélj a pénzügyi útjaidról."
+      start_chatting: Csevegés indítása
+    redis_configuration_error:
+      page_title: Redis konfiguráció szükséges – Sure
+      heading: Redis konfiguráció szükséges
+      subheading: Az önállóan üzemeltetett Sure telepítésedhez megfelelően konfigurált Redis szükséges.
+      why_required_title: Miért szükséges a Redis?
+      why_required_body: A Sure Redis-t használ a Sidekiq háttérfeladatokhoz, például a számlaadatok szinkronizálásához, importálások feldolgozásához és más háttérműveletekhez, amelyek naprakészen tartják a pénzügyi adataidat.
+      view_setup_guide: Beállítási útmutató megtekintése
+      setup_guide_hint: Kövesd az átfogó Docker beállítási útmutatónkat a Redis konfigurálásához
+      refresh_hint: "Ha konfigurálta a Redis-t, frissítsd ezt az oldalt a folytatáshoz."
+      refresh_page: Oldal frissítése
+    changelog:
+      title: Újdonságok
+    privacy:
+      title: Adatvédelmi irányelvek
+      heading: Adatvédelmi irányelvek
+      placeholder: Az adatvédelmi irányelvek tartalma itt jelenik meg.
+    terms:
+      title: Felhasználási feltételek
+      heading: Felhasználási feltételek
+      placeholder: A felhasználási feltételek tartalma itt jelenik meg.
+    dashboard:
+      welcome: "Üdvözöllek újra, %{name}"
+      subtitle: "Íme, mi történik a pénzügyeiddel"
+      new: "Új"
+      drag_to_reorder: "Húzd át a szakasz átrendezéséhez"
+      toggle_section: "Szakasz láthatóságának váltása"
+      net_worth_chart:
+        data_not_available: A kiválasztott időszakra nincs elérhető adat
+        title: Nettó vagyon
+      no_account_empty_state:
+        new_account: Új számla
+        no_account_subtitle: Mivel még nem adtál hozzá számlát, nincs megjeleníthető adat. Add hozzá az első számláidat, hogy elkezdhess irányítópult-adatokat megtekinteni.
+        no_account_title: Még nincs számla
+      balance_sheet:
+        title: "Mérleg"
+        no_items: "Még nincsenek %{name}"
+        add_accounts: "Add hozzá %{name} számláidat a teljes áttekintésért"
+        no_asset: "Még nincs vagyonod"
+        no_liability: "Még nincsenek kötelezettségeid"
+        add_asset_accounts: "Adj hozzá vagyonszámlákat a teljes pénzügyi áttekintésért"
+        add_liability_accounts: "Adj hozzá kötelezettségszámlákat a teljes pénzügyi áttekintésért"
+        name: "Név"
+        weight: "Arány"
+        value: "Érték"
+        classifications:
+          asset: "Vagyon"
+          liability: "Kötelezettségek"
+      cashflow_sankey:
+        title: "Pénzforgalom"
+        no_data_title: "Nincs pénzforgalmi adat erre az időszakra"
+        no_data_description: "Adj hozzá tranzakciókat a pénzforgalmi adatok megjelenítéséhez, vagy bővítsd az időszakot"
+        add_transaction: "Tranzakció hozzáadása"
+      no_accounts:
+        title: "Még nincs számla"
+        description: "Adj hozzá számlákat a nettó vagyon adatok megjelenítéséhez"
+        add_account: "Számla hozzáadása"
+      outflows_donut:
+        title: "Kiadások"
+        total_outflows: "Összes kiadás"
+        categories: "Kategóriák"
+        value: "Érték"
+        weight: "Arány"
+      investment_summary:
+        title: "Befektetések"
+        total_return: "Teljes hozam"
+        holding: "Befektetés"
+        weight: "Arány"
+        value: "Érték"
+        return: "Hozam"
+        period_activity: "%{period} aktivitás"
+        contributions: "Befizetések"
+        withdrawals: "Kifizetések"
+        trades: "Ügyletek"
+        no_investments: "Nincs befektetési számla"
+        add_investment: "Adj hozzá befektetési számlát a portfóliód nyomon követéséhez"
diff --git a/config/locales/views/password_mailer/hu.yml b/config/locales/views/password_mailer/hu.yml
new file mode 100644
index 000000000..fd00980af
--- /dev/null
+++ b/config/locales/views/password_mailer/hu.yml
@@ -0,0 +1,8 @@
+---
+hu:
+  password_mailer:
+    password_reset:
+      cta: Jelszó visszaállítása
+      ignore_if_not_requested: Ha nem te kezdeményezted ezt a kérést, figyelmen kívül hagyhatod ezt az e-mailt.
+      request_made: Kérés érkezett a(z) %{product_name} jelszavad visszaállítására. Kattints a linkre a visszaállításhoz.
+      subject: '%{product_name}: Jelszó visszaállítása'
diff --git a/config/locales/views/password_resets/ca.yml b/config/locales/views/password_resets/ca.yml
index 310a33cfa..8c91bb633 100644
--- a/config/locales/views/password_resets/ca.yml
+++ b/config/locales/views/password_resets/ca.yml
@@ -1,14 +1,18 @@
+---
 ca:
   password_resets:
-    disabled: "El restabliment de la contrasenya a través de Sure està desactivat. Si us plau, restableix la teva contrasenya a través del teu proveïdor d'identitat."
+    disabled: El restabliment de contrasenya a través de Sure està desactivat. Restableix
+      la teva contrasenya a través del teu proveïdor d'identitat.
     edit:
-      title: "Restableix la contrasenya"
+      title: Restableix la contrasenya
     new:
-      back: "Enrere"
-      requested: "Si us plau, revisa el teu correu electrònic; hi trobaràs un enllaç per restablir la contrasenya."
-      submit: "Restableix la contrasenya"
-      title: "Restableix la contrasenya"
-    sso_only_user: "El teu compte utilitza SSO per a l'autenticació. Si us plau, contacta amb l'administrador per gestionar les teves credencials."
+      back: Enrere
+      requested: Revisa el teu correu electrònic; hi trobaràs un enllaç per restablir
+        la contrasenya.
+      submit: Restableix la contrasenya
+      title: Restableix la contrasenya
+    sso_only_user: El teu compte utilitza SSO per a l'autenticació. Contacta amb el
+      teu administrador per gestionar les credencials.
     update:
-      invalid_token: "El codi de verificació (token) no és vàlid."
-      success: "La teva contrasenya s'ha restablert correctament."
\ No newline at end of file
+      invalid_token: El token no és vàlid.
+      success: La teva contrasenya s'ha restablert.
diff --git a/config/locales/views/password_resets/fr.yml b/config/locales/views/password_resets/fr.yml
index e7ba3798f..df1fbe5c9 100644
--- a/config/locales/views/password_resets/fr.yml
+++ b/config/locales/views/password_resets/fr.yml
@@ -1,6 +1,8 @@
 ---
 fr:
   password_resets:
+    disabled: La réinitialisation du mot de passe via Sure est désactivée. Veuillez réinitialiser votre mot de passe via votre fournisseur d'identité.
+    sso_only_user: Votre compte utilise le SSO pour l'authentification. Veuillez contacter votre administrateur pour gérer vos identifiants.
     edit:
       title: Réinitialiser votre mot de passe
     new:
diff --git a/config/locales/views/password_resets/hu.yml b/config/locales/views/password_resets/hu.yml
new file mode 100644
index 000000000..627baa7bc
--- /dev/null
+++ b/config/locales/views/password_resets/hu.yml
@@ -0,0 +1,15 @@
+---
+hu:
+  password_resets:
+    disabled: A jelszó-visszaállítás a Sure-n keresztül le van tiltva. Kérjük, állítsd vissza a jelszavadat az identitásszolgáltatódon keresztül.
+    sso_only_user: A fiókod egyszeri bejelentkezést használ hitelesítéshez. Kérjük, lépj kapcsolatba a rendszergazdával a hitelesítési adatok kezeléséhez.
+    edit:
+      title: Jelszó visszaállítása
+    new:
+      requested: Kérjük, ellenőrizd az e-mailedet, ahol megtalálod a jelszó-visszaállításhoz szükséges linket.
+      submit: Jelszó visszaállítása
+      title: Jelszó visszaállítása
+      back: Vissza
+    update:
+      invalid_token: Érvénytelen token.
+      success: A jelszavad sikeresen visszaállítva.
diff --git a/config/locales/views/passwords/ca.yml b/config/locales/views/passwords/ca.yml
index 300a17fd5..0163cb1a9 100644
--- a/config/locales/views/passwords/ca.yml
+++ b/config/locales/views/passwords/ca.yml
@@ -4,7 +4,7 @@ ca:
     edit:
       password: Nova contrasenya
       password_challenge: Contrasenya actual
-      submit: Restableix contrasenya
-      title: Actualitza contrasenya
+      submit: Restableix la contrasenya
+      title: Actualitza la contrasenya
     update:
       success: La teva contrasenya s'ha restablert.
diff --git a/config/locales/views/passwords/hu.yml b/config/locales/views/passwords/hu.yml
new file mode 100644
index 000000000..d48f47625
--- /dev/null
+++ b/config/locales/views/passwords/hu.yml
@@ -0,0 +1,10 @@
+---
+hu:
+  passwords:
+    edit:
+      password: Új jelszó
+      password_challenge: Jelenlegi jelszó
+      submit: Jelszó visszaállítása
+      title: Jelszó frissítése
+    update:
+      success: A jelszavad sikeresen visszaállítva.
diff --git a/config/locales/views/pdf_import_mailer/ca.yml b/config/locales/views/pdf_import_mailer/ca.yml
new file mode 100644
index 000000000..a46919bd6
--- /dev/null
+++ b/config/locales/views/pdf_import_mailer/ca.yml
@@ -0,0 +1,21 @@
+---
+ca:
+  pdf_import_mailer:
+    next_steps:
+      document_stored_note: Aquest document s'ha desat per a la teva referència. Es
+        pot fer servir per donar context en futures converses amb la IA.
+      document_type_label: Tipus de document
+      footer_note: Aquest és un missatge automàtic. No responguis directament a aquest
+        correu electrònic.
+      greeting: Hola %{name},
+      intro: Hem acabat d'analitzar el document PDF que has pujat a %{product}.
+      next_steps_intro: 'Tens diverses opcions:'
+      next_steps_label: Què cal fer ara?
+      option_delete: Elimina aquesta importació si ja no la necessites
+      option_extract_transactions: Extreu transaccions d'aquest extracte
+      option_keep_reference: Mantén aquest document com a referència per a futures
+        converses amb la IA
+      summary_label: Resum d'IA
+      transactions_note: Sembla que aquest document conté transaccions. Ara pots extreure-les
+        i revisar-les.
+      view_import_button: Mira els detalls de la importació
diff --git a/config/locales/views/pdf_import_mailer/fr.yml b/config/locales/views/pdf_import_mailer/fr.yml
new file mode 100644
index 000000000..93115a3c5
--- /dev/null
+++ b/config/locales/views/pdf_import_mailer/fr.yml
@@ -0,0 +1,17 @@
+---
+fr:
+  pdf_import_mailer:
+    next_steps:
+      greeting: "Bonjour %{name},"
+      intro: "Nous avons terminé l'analyse du document PDF que vous avez téléversé sur %{product}."
+      document_type_label: Type de document
+      summary_label: Résumé IA
+      transactions_note: Ce document semble contenir des transactions. Vous pouvez les extraire et les consulter maintenant.
+      document_stored_note: Ce document a été stocké pour votre référence. Il peut être utilisé pour fournir du contexte dans vos futures conversations avec l'IA.
+      next_steps_label: Et maintenant ?
+      next_steps_intro: "Plusieurs options s'offrent à vous :"
+      option_extract_transactions: Extraire les transactions de ce relevé
+      option_keep_reference: Conserver ce document pour référence dans vos futures conversations avec l'IA
+      option_delete: Supprimer cet import si vous n'en avez plus besoin
+      view_import_button: Voir les détails de l'import
+      footer_note: Ceci est un message automatique. Veuillez ne pas répondre directement à cet e-mail.
diff --git a/config/locales/views/pdf_import_mailer/hu.yml b/config/locales/views/pdf_import_mailer/hu.yml
new file mode 100644
index 000000000..14e6ce604
--- /dev/null
+++ b/config/locales/views/pdf_import_mailer/hu.yml
@@ -0,0 +1,17 @@
+---
+hu:
+  pdf_import_mailer:
+    next_steps:
+      greeting: "Szia, %{name}!"
+      intro: "Befejeztük a(z) %{product} alkalmazásba feltöltött PDF-dokumentum elemzését."
+      document_type_label: Dokumentumtípus
+      summary_label: AI-összefoglaló
+      transactions_note: Úgy tűnik, hogy ez a dokumentum tranzakciókat tartalmaz. Most kibonthatod és áttekintheted azokat.
+      document_stored_note: Ez a dokumentum el lett mentve referenciaként. Felhasználható kontextusként a jövőbeli AI-párbeszédekben.
+      next_steps_label: Mi a következő lépés?
+      next_steps_intro: "Több lehetőséged is van:"
+      option_extract_transactions: Tranzakciók kibontása ebből a kivonatból
+      option_keep_reference: Megőrzöm ezt a dokumentumot referenciaként a jövőbeli AI-párbeszédekhez
+      option_delete: Törlöm ezt az importot, ha már nincs rá szükségem
+      view_import_button: Importálás részleteinek megtekintése
+      footer_note: Ez egy automatikus üzenet. Kérjük, ne válaszolj közvetlenül erre az e-mailre.
diff --git a/config/locales/views/pending_duplicate_merges/ca.yml b/config/locales/views/pending_duplicate_merges/ca.yml
new file mode 100644
index 000000000..c57fdfc09
--- /dev/null
+++ b/config/locales/views/pending_duplicate_merges/ca.yml
@@ -0,0 +1,23 @@
+---
+ca:
+  pending_duplicate_merges:
+    create:
+      invalid_transaction: La transacció seleccionada per fusionar no és vàlida
+      merge_failed: No s'han pogut fusionar les transaccions
+      merge_success: Transacció pendent fusionada amb la transacció comptabilitzada
+      no_posted_selected: Selecciona una transacció comptabilitzada amb la qual fusionar
+    new:
+      next: 10 següents →
+      no_candidates: No s'ha trobat cap transacció comptabilitzada en aquest compte.
+      pending_transaction: Transacció pendent
+      previous: "← 10 anteriors"
+      select_posted: Selecciona la transacció comptabilitzada amb la qual fusionar
+      showing_range: Mostrant %{start} - %{end}
+      submit_button: Fusiona transaccions
+      title: Fusiona amb una transacció comptabilitzada
+      warning_description: Fes-ho servir per fusionar manualment una transacció pendent
+        amb la seva versió comptabilitzada. Això eliminarà la transacció pendent i
+        només es conservarà la comptabilitzada.
+      warning_title: Fusió manual de duplicats
+    set_transaction:
+      pending_only: Aquesta funció només està disponible per a transaccions pendents
diff --git a/config/locales/views/pending_duplicate_merges/en.yml b/config/locales/views/pending_duplicate_merges/en.yml
index c62c6e2b0..41d9d5865 100644
--- a/config/locales/views/pending_duplicate_merges/en.yml
+++ b/config/locales/views/pending_duplicate_merges/en.yml
@@ -1,6 +1,13 @@
 ---
 en:
   pending_duplicate_merges:
+    create:
+      no_posted_selected: Please select a posted transaction to merge with
+      invalid_transaction: Invalid transaction selected for merge
+      merge_success: Pending transaction merged with posted transaction
+      merge_failed: Could not merge transactions
+    set_transaction:
+      pending_only: This feature is only available for pending transactions
     new:
       title: Merge with Posted Transaction
       warning_title: Manual Duplicate Merging
diff --git a/config/locales/views/pending_duplicate_merges/fr.yml b/config/locales/views/pending_duplicate_merges/fr.yml
new file mode 100644
index 000000000..16aeabdbc
--- /dev/null
+++ b/config/locales/views/pending_duplicate_merges/fr.yml
@@ -0,0 +1,14 @@
+---
+fr:
+  pending_duplicate_merges:
+    new:
+      title: Fusionner avec une transaction validée
+      warning_title: Fusion manuelle de doublons
+      warning_description: Utilisez cette option pour fusionner manuellement une transaction en attente avec sa version validée. Cela supprimera la transaction en attente et ne conservera que la version validée.
+      pending_transaction: Transaction en attente
+      select_posted: Sélectionner la transaction validée à fusionner
+      showing_range: "Affichage de %{start} - %{end}"
+      previous: "← 10 précédentes"
+      next: "10 suivantes →"
+      no_candidates: Aucune transaction validée trouvée sur ce compte.
+      submit_button: Fusionner les transactions
diff --git a/config/locales/views/pending_duplicate_merges/hu.yml b/config/locales/views/pending_duplicate_merges/hu.yml
new file mode 100644
index 000000000..191592600
--- /dev/null
+++ b/config/locales/views/pending_duplicate_merges/hu.yml
@@ -0,0 +1,21 @@
+---
+hu:
+  pending_duplicate_merges:
+    create:
+      no_posted_selected: Kérlek válassz egy könyvelt tranzakciót az összevonáshoz
+      invalid_transaction: Érvénytelen tranzakció van kijelölve az összevonáshoz
+      merge_success: A függőben lévő tranzakció összevonva a könyvelt tranzakcióval
+      merge_failed: Nem sikerült összevonni a tranzakciókat
+    set_transaction:
+      pending_only: Ez a funkció csak függőben lévő tranzakciókhoz érhető el
+    new:
+      title: Összevonás könyvelt tranzakcióval
+      warning_title: Manuális duplikáció-összevonás
+      warning_description: Ezzel manuálisan vonhatsz össze egy függőben lévő tranzakciót annak könyvelt változatával. A függőben lévő tranzakció törlődik, és csak a könyvelt marad meg.
+      pending_transaction: Függőben lévő tranzakció
+      select_posted: Válaszd ki az összevonandó könyvelt tranzakciót
+      showing_range: "%{start} – %{end} megjelenítve"
+      previous: "← Előző 10"
+      next: "Következő 10 →"
+      no_candidates: Ezen a számlán nem találhatók könyvelt tranzakciók.
+      submit_button: Tranzakciók összevonása
diff --git a/config/locales/views/plaid_items/ca.yml b/config/locales/views/plaid_items/ca.yml
index 7b3387c70..9e8b97259 100644
--- a/config/locales/views/plaid_items/ca.yml
+++ b/config/locales/views/plaid_items/ca.yml
@@ -5,27 +5,33 @@ ca:
       success: Compte enllaçat correctament. Espera mentre es sincronitzen els comptes.
     destroy:
       success: Comptes programats per a l'eliminació.
+    link_existing_account:
+      already_linked: Aquest compte Plaid ja està enllaçat
+      invalid_account: S'ha seleccionat un compte Plaid no vàlid
+      success: El compte s'ha enllaçat correctament a Plaid
     plaid_item:
-      add_new: Afegeix nova connexió
-      confirm_accept: Elimina institució
+      add_new: Afegeix una connexió nova
+      confirm_accept: Elimina l'entitat
       confirm_body: Això eliminarà permanentment tots els comptes d'aquest grup i
         totes les dades associades.
-      confirm_title: Vols eliminar la institució?
+      confirm_title: Vols eliminar l'entitat?
       connection_lost: Connexió perduda
       connection_lost_description: Aquesta connexió ja no és vàlida. Hauràs d'eliminar-la
         i tornar-la a afegir per continuar sincronitzant dades.
       delete: Elimina
       error: S'ha produït un error en sincronitzar les dades
-      no_accounts_description: No hem pogut carregar cap compte d'aquesta entitat
+      no_accounts_description: No s'ha pogut carregar cap compte d'aquesta entitat
         financera.
       no_accounts_title: No s'han trobat comptes
-      requires_update: Cal tornar a autenticar
+      requires_update: Reconnecta
       status: Darrera sincronització fa %{timestamp}
       status_never: Cal sincronitzar dades
       syncing: Sincronitzant...
-      update: Actualitza la connexió
+      update: Actualitza
     select_existing_account:
       cancel: Cancel·la
       description: Selecciona un compte Plaid per enllaçar-lo al teu compte existent
       link_account: Enllaça el compte
+      no_available_accounts: No hi ha comptes Plaid disponibles per enllaçar. Primer
+        connecta un compte Plaid nou.
       title: Enllaça %{account_name} amb Plaid
diff --git a/config/locales/views/plaid_items/en.yml b/config/locales/views/plaid_items/en.yml
index fbb0a51d6..25e87511c 100644
--- a/config/locales/views/plaid_items/en.yml
+++ b/config/locales/views/plaid_items/en.yml
@@ -15,6 +15,7 @@ en:
       connection_lost_description: This connection is no longer valid. You'll need
         to delete this connection and add it again to continue syncing data.
       delete: Delete
+      deletion_in_progress: (deletion in progress...)
       error: Error occurred while syncing data
       no_accounts_description: We could not load any accounts from this financial
         institution.
@@ -25,7 +26,12 @@ en:
       syncing: Syncing...
       update: Update
     select_existing_account:
+      no_available_accounts: No available Plaid accounts to link. Please connect a new Plaid account first.
       title: "Link %{account_name} to Plaid"
       description: Select a Plaid account to link to your existing account
       cancel: Cancel
       link_account: Link account
+    link_existing_account:
+      invalid_account: Invalid Plaid account selected
+      already_linked: This Plaid account is already linked
+      success: Account successfully linked to Plaid
diff --git a/config/locales/views/plaid_items/fr.yml b/config/locales/views/plaid_items/fr.yml
index a6371ccbe..64a627f9f 100644
--- a/config/locales/views/plaid_items/fr.yml
+++ b/config/locales/views/plaid_items/fr.yml
@@ -21,3 +21,8 @@ fr:
       status_never: Synchronisation de données requise
       syncing: Synchronisation...
       update: Mettre à jour la connexion
+    select_existing_account:
+      title: "Lier %{account_name} à Plaid"
+      description: Sélectionnez un compte Plaid à lier à votre compte existant
+      cancel: Annuler
+      link_account: Lier le compte
diff --git a/config/locales/views/plaid_items/hu.yml b/config/locales/views/plaid_items/hu.yml
new file mode 100644
index 000000000..458bb24b9
--- /dev/null
+++ b/config/locales/views/plaid_items/hu.yml
@@ -0,0 +1,33 @@
+---
+hu:
+  plaid_items:
+    create:
+      success: A számla sikeresen össze lett kapcsolva. Kérjük, várj, amíg a számlák szinkronizálódnak.
+    destroy:
+      success: A számlák törlése ütemezve.
+    plaid_item:
+      add_new: Új kapcsolat hozzáadása
+      confirm_accept: Intézmény törlése
+      confirm_body: Ez véglegesen törli az összes számlát ebben a csoportban és az összes kapcsolódó adatot.
+      confirm_title: Töröljük az intézményt?
+      connection_lost: A kapcsolat megszakadt
+      connection_lost_description: Ez a kapcsolat már nem érvényes. Törölnöd kell ezt a kapcsolatot, majd újra hozzá kell adnod az adatok szinkronizálásának folytatásához.
+      delete: Töröl
+      error: Hiba történt az adatok szinkronizálása közben
+      no_accounts_description: Nem sikerült betölteni egyetlen számlát sem erről a pénzintézetről.
+      no_accounts_title: Nem találhatók számlák
+      requires_update: Újracsatlakozás
+      status: Utolsó szinkronizálás %{timestamp} ezelőtt
+      status_never: Adatszinkronizálás szükséges
+      syncing: Szinkronizálás folyamatban...
+      update: Frissítés
+    select_existing_account:
+      no_available_accounts: Nincs elérhető Plaid-számla az összekapcsoláshoz. Először csatlakozz egy új Plaid-fiókhoz.
+      title: "%{account_name} csatlakoztatása Plaid-hez"
+      description: Válassz egy Plaid-számlát a meglévő számlád összekapcsolásához
+      cancel: Mégse
+      link_account: Számla összekapcsolása
+    link_existing_account:
+      invalid_account: Érvénytelen Plaid-számla van kijelölve
+      already_linked: Ez a Plaid-számla már össze van kapcsolva
+      success: A számla sikeresen össze lett kapcsolva a Plaid-del
diff --git a/config/locales/views/preview/ca.yml b/config/locales/views/preview/ca.yml
new file mode 100644
index 000000000..ae13dbd34
--- /dev/null
+++ b/config/locales/views/preview/ca.yml
@@ -0,0 +1,4 @@
+---
+ca:
+  preview:
+    not_enabled: Aquesta funció és experimental. Activa les funcions experimentals a Configuració → Preferències per provar-la.
\ No newline at end of file
diff --git a/config/locales/views/preview/en.yml b/config/locales/views/preview/en.yml
new file mode 100644
index 000000000..9adb55036
--- /dev/null
+++ b/config/locales/views/preview/en.yml
@@ -0,0 +1,4 @@
+---
+en:
+  preview:
+    not_enabled: This feature is in preview. Enable preview features in Settings → Preferences to try it.
diff --git a/config/locales/views/preview/es.yml b/config/locales/views/preview/es.yml
new file mode 100644
index 000000000..bf85bfd41
--- /dev/null
+++ b/config/locales/views/preview/es.yml
@@ -0,0 +1,4 @@
+---
+es:
+  preview:
+    not_enabled: Esta función es experimental. Activa las funciones experimentales en Configuración → Preferencias para probarla.
\ No newline at end of file
diff --git a/config/locales/views/properties/ca.yml b/config/locales/views/properties/ca.yml
index 496c9e355..b56b5d11b 100644
--- a/config/locales/views/properties/ca.yml
+++ b/config/locales/views/properties/ca.yml
@@ -1,6 +1,27 @@
 ---
 ca:
   properties:
+    address:
+      address_line1_label: Adreça línia 1
+      address_line1_placeholder: Carrer Major, 123
+      city_label: Ciutat
+      city_placeholder: Barcelona
+      country_label: País
+      country_placeholder: ESP
+      postal_code_label: Codi postal
+      postal_code_placeholder: '08001'
+      save: Desa
+      state_region_label: Província/Comarca
+      state_region_placeholder: BCN
+      title: Introdueix l'immoble manualment
+    balances:
+      market_value_label: Valor de mercat estimat
+      market_value_tooltip: El valor de mercat estimat del teu immoble. Aquest número
+        sovint es pot trobar a llocs com Idealista o Fotocasa, i mai és un número
+        exacte.
+      next: Següent
+      save: Desa
+      title: Introdueix l'immoble manualment
     edit:
       edit: Edita %{account}
     form:
@@ -22,7 +43,8 @@ ca:
       year_built: Any de construcció
       year_built_placeholder: '2000'
     new:
-      title: Introdueix els detalls de l'immoble
+      next: Següent
+      title: Introdueix l'immoble manualment
     overview:
       living_area: Superfície habitable
       market_value: Valor de mercat
@@ -30,4 +52,40 @@ ca:
       trend: Tendència
       unknown: Desconegut
       year_built: Any de construcció
-
+    overview_fields:
+      area_label: Superfície (opcional)
+      area_placeholder: '1200'
+      area_unit_label: Unitat de superfície
+      name_label: Nom
+      name_placeholder: Segona residència
+      property_type_label: Tipus d'immoble
+      square_feet: Peus quadrats
+      square_meters: Metres quadrats
+      subtype_prompt: Selecciona el tipus
+      year_built_label: Any de construcció (opcional)
+      year_built_placeholder: '1990'
+    subtypes:
+      agri_land:
+        long: Terra agrícola
+        short: Terra agrícola
+      apartment:
+        long: Pis
+        short: Pis
+      commercial:
+        long: Immoble comercial
+        short: Comercial
+      plot:
+        long: Solar / Terreny
+        short: Solar
+      rented:
+        long: Immoble llogat
+        short: Llogat
+    tabs:
+      overview:
+        edit_account_details: Edita els detalls del compte
+        living_area: Superfície habitable
+        market_value: Valor de mercat
+        purchase_price: Preu de compra
+        trend: Tendència
+        unknown: Desconegut
+        year_built: Any de construcció
diff --git a/config/locales/views/properties/en.yml b/config/locales/views/properties/en.yml
index 289335bb8..fabe4d28a 100644
--- a/config/locales/views/properties/en.yml
+++ b/config/locales/views/properties/en.yml
@@ -22,7 +22,39 @@ en:
       year_built: Year built
       year_built_placeholder: '2000'
     new:
-      title: Enter property details
+      title: Enter property manually
+      next: "Next"
+    address:
+      title: "Enter property manually"
+      address_line1_label: "Address Line 1"
+      address_line1_placeholder: "123 Main Street"
+      city_label: "City"
+      city_placeholder: "San Francisco"
+      state_region_label: "State/Region"
+      state_region_placeholder: "CA"
+      postal_code_label: "Postal Code"
+      postal_code_placeholder: "12345"
+      country_label: "Country"
+      country_placeholder: "USA"
+      save: "Save"
+    balances:
+      title: "Enter property manually"
+      market_value_label: "Estimated market value"
+      market_value_tooltip: "The estimated market value of your property. This number can often be found on sites like Zillow or Redfin, and is never an exact number."
+      save: "Save"
+      next: "Next"
+    overview_fields:
+      name_label: "Name"
+      name_placeholder: "Vacation home"
+      subtype_prompt: "Select type"
+      property_type_label: "Property type"
+      year_built_label: "Year Built (optional)"
+      year_built_placeholder: "1990"
+      area_label: "Area (optional)"
+      area_placeholder: "1200"
+      square_feet: "Square Feet"
+      square_meters: "Square Meters"
+      area_unit_label: "Area Unit"
     overview:
       living_area: Living Area
       market_value: Market Value
@@ -30,3 +62,28 @@ en:
       trend: Trend
       unknown: Unknown
       year_built: Year Built
+    tabs:
+      overview:
+        living_area: Living Area
+        market_value: Market Value
+        purchase_price: Purchase Price
+        trend: Trend
+        unknown: Unknown
+        year_built: Year Built
+        edit_account_details: "Edit account details"
+    subtypes:
+      apartment:
+        short: Apartment
+        long: Apartment
+      plot:
+        short: Plot
+        long: Plot / Land
+      commercial:
+        short: Commercial
+        long: Commercial Property
+      rented:
+        short: Rented
+        long: Rented Property
+      agri_land:
+        short: Agri Land
+        long: Agricultural Land
diff --git a/config/locales/views/properties/hu.yml b/config/locales/views/properties/hu.yml
new file mode 100644
index 000000000..4bc7021f9
--- /dev/null
+++ b/config/locales/views/properties/hu.yml
@@ -0,0 +1,89 @@
+---
+hu:
+  properties:
+    edit:
+      edit: '%{account} szerkesztése'
+    form:
+      address_line1: Utca, házszám
+      address_line1_placeholder: Kossuth utca 1.
+      area: Alapterület
+      area_placeholder: '2000'
+      area_unit: Mértékegység
+      country: Ország
+      country_placeholder: HU
+      locality: Város
+      locality_placeholder: Budapest
+      none: Nincs
+      postal_code: Irányítószám
+      postal_code_placeholder: '1011'
+      region: Megye/Kerület
+      region_placeholder: Budapest
+      subtype_prompt: Válassz ingatlantípust
+      year_built: Építési év
+      year_built_placeholder: '2000'
+    new:
+      title: Add meg az ingatlan adatait
+      next: "Tovább"
+    address:
+      title: "Add meg az ingatlan adatait"
+      address_line1_label: "Utca, házszám"
+      address_line1_placeholder: "Kossuth utca 1."
+      city_label: "Város"
+      city_placeholder: "Budapest"
+      state_region_label: "Megye/Kerület"
+      state_region_placeholder: "Budapest"
+      postal_code_label: "Irányítószám"
+      postal_code_placeholder: "1011"
+      country_label: "Ország"
+      country_placeholder: "Magyarország"
+      save: "Mentés"
+    balances:
+      title: "Add meg az ingatlan adatait"
+      market_value_label: "Becsült piaci érték"
+      market_value_tooltip: "Az ingatlan becsült piaci értéke. Ezt az értéket ingatlanértékelő oldalakon találhatod, és soha nem pontos szám."
+      save: "Mentés"
+      next: "Tovább"
+    overview_fields:
+      name_label: "Név"
+      name_placeholder: "Nyaraló"
+      subtype_prompt: "Típus kiválasztása"
+      property_type_label: "Ingatlantípus"
+      year_built_label: "Építési év (nem kötelező)"
+      year_built_placeholder: "1990"
+      area_label: "Alapterület (nem kötelező)"
+      area_placeholder: "1200"
+      square_feet: "Négyzetláb"
+      square_meters: "Négyzetméter"
+      area_unit_label: "Területi egység"
+    overview:
+      living_area: Alapterület
+      market_value: Piaci érték
+      purchase_price: Vételár
+      trend: Tendencia
+      unknown: Ismeretlen
+      year_built: Építési év
+    tabs:
+      overview:
+        living_area: Alapterület
+        market_value: Piaci érték
+        purchase_price: Vételár
+        trend: Tendencia
+        unknown: Ismeretlen
+        year_built: Építési év
+        edit_account_details: "Számlaadatok szerkesztése"
+    subtypes:
+      apartment:
+        short: Lakás
+        long: Lakás
+      plot:
+        short: Telek
+        long: Telek/Föld
+      commercial:
+        short: Kereskedelmi
+        long: Kereskedelmi ingatlan
+      rented:
+        short: Bérelt
+        long: Bérelt ingatlan
+      agri_land:
+        short: Mezőgazdasági
+        long: Mezőgazdasági föld
diff --git a/config/locales/views/recurring_transactions/ca.yml b/config/locales/views/recurring_transactions/ca.yml
index 0e444699b..2c74c907a 100644
--- a/config/locales/views/recurring_transactions/ca.yml
+++ b/config/locales/views/recurring_transactions/ca.yml
@@ -1,53 +1,64 @@
 ---
 ca:
   recurring_transactions:
-    already_exists: A manual recurring transaction already exists for this pattern
+    already_exists: Ja existeix una transacció recurrent manual per a aquest patró
     amount_range: 'Rang: %{min} a %{max}'
     badges:
       manual: Manual
     cleaned_up: S'han netejat %{count} transaccions recurrents obsoletes
-    cleanup_stale: Neteja Obsoletes
+    cleanup_stale: Neteja obsoletes
     confirm_delete: Segur que vols eliminar aquesta transacció recurrent?
     creation_failed: No s'ha pogut crear la transacció recurrent. Comprova els detalls
       de la transacció i torna-ho a provar.
     day_of_month: Dia %{day} del mes
-    deleted: S'ha eliminat la transacció recurrent
+    deleted: Transacció recurrent eliminada
     empty:
-      description: Clica "Identifica Patrons" per detectar automàticament transaccions
+      description: Clica «Identifica patrons» per detectar automàticament transaccions
         recurrents del teu historial de transaccions.
       title: No s'han trobat transaccions recurrents
-    expected_on: S'esperava el %{date}
+    expected_in:
+      one: S'espera d'aquí a %{count} dia
+      other: S'espera d'aquí a %{count} dies
+    expected_today: S'espera avui
     identified: S'han identificat %{count} patrons de transaccions recurrents
     identify_patterns: Identifica patrons
     info:
-      automatic_description: "L'identificació automàtica també s'executa després de:"
+      automatic_description: 'La identificació automàtica també s''executa després
+        de:'
       manual_description: Pots identificar patrons manualment o netejar transaccions
         recurrents obsoletes utilitzant els botons de dalt.
       title: Detecció automàtica de patrons
       triggers:
-        - Importacions CSV completades (transaccions, operacions, comptes, etc.)
-        - Sincronitzacions de proveïdors completades (Plaid, SimpleFIN, etc.)
-    marked_active: S'ha marcat la transacció recurrent com a activa
-    marked_as_recurring: S'ha marcat la transacció com a recurrent
-    marked_inactive: S'ha marcat la transacció recurrent com a inactiva
-    projected: Projectat
+      - Importacions CSV completades (transaccions, operacions, comptes, etc.)
+      - Sincronitzacions de proveïdors completades (Plaid, SimpleFIN, etc.)
+    marked_active: Transacció recurrent marcada com a activa
+    marked_as_recurring: Transacció marcada com a recurrent
+    marked_inactive: Transacció recurrent marcada com a inactiva
+    projected: Projectada
     recurring: Recurrent
     settings:
-      enable_description: Detecta automàticament patrons de transaccions recurrents i
-        mostra les transaccions projectades properes.
-      enable_label: Activa Transaccions Recurrents
-    settings_updated: S'han actualitzat les configuracions de transaccions recurrents
+      enable_description: Detecta automàticament patrons de transaccions recurrents
+        i mostra les properes transaccions projectades.
+      enable_label: Activa les transaccions recurrents
+    settings_updated: S'ha actualitzat la configuració de transaccions recurrents
     status:
       active: Activa
       inactive: Inactiva
     table:
       actions: Accions
       amount: Import
-      expected_day: Dia Esperat
-      last_occurrence: Última Ocurrència
+      expected_day: Dia esperat
+      last_occurrence: Última ocurrència
       merchant: Nom
-      next_date: Propera Data
+      next_date: Pròxima data
       status: Estat
-    title: Transaccions Recurrents
+    title: Transaccions recurrents
+    transfer_already_exists: Ja existeix una transferència recurrent per a aquesta
+      parella de comptes
+    transfer_creation_failed: No s'ha pogut crear la transferència recurrent. Comprova
+      els detalls de la transferència i torna-ho a provar.
+    transfer_feature_disabled: Les transaccions recurrents estan desactivades per
+      a aquesta família
+    transfer_marked_as_recurring: Transferència marcada com a recurrent
     unexpected_error: S'ha produït un error inesperat en crear la transacció recurrent
-    upcoming: Transaccions Recurrents Properes
+    upcoming: Properes transaccions recurrents
diff --git a/config/locales/views/recurring_transactions/en.yml b/config/locales/views/recurring_transactions/en.yml
index 504d321d9..5d57c9306 100644
--- a/config/locales/views/recurring_transactions/en.yml
+++ b/config/locales/views/recurring_transactions/en.yml
@@ -50,3 +50,7 @@ en:
       inactive: Inactive
     badges:
       manual: Manual
+    transfer_marked_as_recurring: Transfer marked as recurring
+    transfer_already_exists: A recurring transfer already exists for this account pair
+    transfer_creation_failed: Failed to create recurring transfer. Please check the transfer details and try again.
+    transfer_feature_disabled: Recurring transactions are disabled for this family
diff --git a/config/locales/views/recurring_transactions/fr.yml b/config/locales/views/recurring_transactions/fr.yml
index e88bd0488..462db1e1d 100644
--- a/config/locales/views/recurring_transactions/fr.yml
+++ b/config/locales/views/recurring_transactions/fr.yml
@@ -5,7 +5,10 @@ fr:
     upcoming: Transactions récurrentes à venir
     projected: Projeté
     recurring: Récurrent
-    expected_on: Attendu le %{date}
+    expected_today: "Attendue aujourd'hui"
+    expected_in:
+      one: "Attendue dans %{count} jour"
+      other: "Attendue dans %{count} jours"
     day_of_month: Jour %{day} du mois
     identify_patterns: Identifier les modèles
     cleanup_stale: Nettoyer les obsolètes
diff --git a/config/locales/views/recurring_transactions/hu.yml b/config/locales/views/recurring_transactions/hu.yml
new file mode 100644
index 000000000..a20ecfade
--- /dev/null
+++ b/config/locales/views/recurring_transactions/hu.yml
@@ -0,0 +1,56 @@
+---
+hu:
+  recurring_transactions:
+    title: Ismétlődő tranzakciók
+    upcoming: Közelgő ismétlődő tranzakciók
+    projected: Várható
+    recurring: Ismétlődő
+    expected_today: "Ma várható"
+    expected_in:
+      one: "%{count} nap múlva várható"
+      other: "%{count} nap múlva várható"
+    day_of_month: A hónap %{day}. napja
+    identify_patterns: Minták azonosítása
+    cleanup_stale: Elavultak törlése
+    settings:
+      enable_label: Ismétlődő tranzakciók engedélyezése
+      enable_description: Automatikusan felismeri az ismétlődő tranzakciós mintákat, és megjeleníti a közelgő várható tranzakciókat.
+    settings_updated: Az ismétlődő tranzakciók beállításai frissítve
+    info:
+      title: Automatikus mintafelismerés
+      manual_description: A fenti gombokkal manuálisan is azonosíthatod a mintákat, vagy törölheted az elavult ismétlődő tranzakciókat.
+      automatic_description: "Az automatikus azonosítás ezután is lefut:"
+      triggers:
+        - CSV importálás befejeztével (tranzakciók, ügyletek, számlák stb.)
+        - Bármely szolgáltatói szinkronizálás befejeztével (Plaid, SimpleFIN stb.)
+    identified: "%{count} ismétlődő tranzakciós minta azonosítva"
+    cleaned_up: "%{count} elavult ismétlődő tranzakció törölve"
+    marked_inactive: Az ismétlődő tranzakció inaktívvá jelölve
+    marked_active: Az ismétlődő tranzakció aktívvá jelölve
+    deleted: Ismétlődő tranzakció törölve
+    confirm_delete: Biztosan törlöd ezt az ismétlődő tranzakciót?
+    marked_as_recurring: Tranzakció ismétlődőként jelölve
+    already_exists: Ehhez a mintához már létezik egy manuálisan rögzített ismétlődő tranzakció
+    creation_failed: Nem sikerült létrehozni az ismétlődő tranzakciót. Ellenőrizd a tranzakció adatait, és próbáld újra.
+    unexpected_error: Váratlan hiba történt az ismétlődő tranzakció létrehozása során
+    amount_range: "Tartomány: %{min} és %{max} között"
+    empty:
+      title: Nem találhatók ismétlődő tranzakciók
+      description: Kattints a „Minták azonosítása" gombra, hogy automatikusan felismerd az ismétlődő tranzakciókat a tranzakcióelőzményeidből.
+    table:
+      merchant: Név
+      amount: Összeg
+      expected_day: Várható nap
+      next_date: Következő dátum
+      last_occurrence: Utolsó előfordulás
+      status: Státusz
+      actions: Műveletek
+    status:
+      active: Aktív
+      inactive: Inaktív
+    badges:
+      manual: Manuális
+    transfer_marked_as_recurring: Átutalás ismétlődőként jelölve
+    transfer_already_exists: Ehhez a számlápárhoz már létezik ismétlődő átutalás
+    transfer_creation_failed: Nem sikerült létrehozni az ismétlődő átutalást. Kérlek ellenőrizd az átutalás adatait, és próbáld újra.
+    transfer_feature_disabled: Az ismétlődő tranzakciók le vannak tiltva ennél a háztartásnál
diff --git a/config/locales/views/registrations/ca.yml b/config/locales/views/registrations/ca.yml
index 5e977ef2f..0069cfe20 100644
--- a/config/locales/views/registrations/ca.yml
+++ b/config/locales/views/registrations/ca.yml
@@ -15,17 +15,18 @@ ca:
       success: T'has registrat correctament.
     new:
       invitation_message: "%{inviter} t'ha convidat a unir-te com a %{role}"
-      join_family_title: Uneix-te a %{family}
+      join_family_title: Uneix-te a %{family} (%{moniker})
       password_placeholder: Introdueix la teva contrasenya
+      password_requirements:
+        case: Majúscules i minúscules
+        length: Mínim 8 caràcters
+        number: Un número (0-9)
+        special: 'Un caràcter especial (!, @, #, $, %, etc)'
       role_admin: administrador/a
+      role_guest: convidat/da
       role_member: membre
       submit: Crea el compte
       title: Crea el teu compte
       welcome_body: Per començar, has de registrar un compte nou. Després podràs configurar
         opcions addicionals dins l'aplicació.
       welcome_title: Benvingut/da a Self Hosted %{product_name}!
-      password_requirements:
-        length: Mínim 8 caràcters
-        case: Majúscules i minúscules
-        number: Un número (0-9)
-        special: "Un caràcter especial (!, @, #, $, %, etc)"
diff --git a/config/locales/views/registrations/fr.yml b/config/locales/views/registrations/fr.yml
index 06ec380f5..f5ab94380 100644
--- a/config/locales/views/registrations/fr.yml
+++ b/config/locales/views/registrations/fr.yml
@@ -15,8 +15,9 @@ fr:
       success: Vous avez été inscrit avec succès.
     new:
       invitation_message: "%{inviter} vous a invité à rejoindre en tant que %{role}"
-      join_family_title: Rejoindre %{family}
+      join_family_title: Rejoindre %{family} %{moniker}
       role_admin: administrateur
+      role_guest: invité
       role_member: membre
       submit: Créer un compte
       title: Créez votre compte
diff --git a/config/locales/views/registrations/hu.yml b/config/locales/views/registrations/hu.yml
new file mode 100644
index 000000000..60056b797
--- /dev/null
+++ b/config/locales/views/registrations/hu.yml
@@ -0,0 +1,31 @@
+---
+hu:
+  helpers:
+    label:
+      user:
+        invite_code: Meghívókód
+    submit:
+      user:
+        create: Folytatás
+  registrations:
+    closed: A regisztráció jelenleg szünetel.
+    create:
+      failure: Hiba történt a regisztráció során.
+      invalid_invite_code: Érvénytelen meghívókód, kérjük, próbáld újra.
+      success: Sikeresen regisztráltál.
+    new:
+      invitation_message: "%{inviter} meghívott, hogy csatlakozz %{role} szerepkörben"
+      join_family_title: Csatlakozz a(z) %{family} %{moniker} fiókhoz
+      role_admin: rendszergazda
+      role_guest: vendég
+      role_member: tag
+      submit: Fiók létrehozása
+      title: Hozd létre a fiókodat
+      welcome_body: A kezdéshez létre kell hoznod egy új fiókot. Ezután az alkalmazáson belül további beállításokat is elvégezhetsz.
+      welcome_title: Üdvözöl az önállóan üzemeltetett %{product_name}!
+      password_placeholder: Add meg a jelszavadat
+      password_requirements:
+        length: Legalább 8 karakter
+        case: Nagy- és kisbetűk vegyesen
+        number: Egy szám (0–9)
+        special: "Egy speciális karakter (!, @, #, $, %, stb.)"
diff --git a/config/locales/views/reports/ca.yml b/config/locales/views/reports/ca.yml
index 144b4fbb5..517dbfbd1 100644
--- a/config/locales/views/reports/ca.yml
+++ b/config/locales/views/reports/ca.yml
@@ -6,6 +6,7 @@ ca:
       no_budgets: No s'ha configurat cap categoria de pressupost per aquest mes
       over_by: Superat per
       remaining: Restant
+      shared: compartit
       spent: Gastat
       status:
         good: Sota control
@@ -14,29 +15,29 @@ ca:
       suggested_daily: "%{amount} suggerits al dia per a %{days} dies restants"
       title: Rendiment del pressupost
     empty_state:
-      add_account: Afegir compte
-      add_transaction: Afegir transacció
-      description: Comença a fer seguiment de les teves finances afegint transaccions o connectant
-        els teus comptes per veure informes complets
+      add_account: Afegeix compte
+      add_transaction: Afegeix transacció
+      description: Comença a fer seguiment de les teves finances afegint transaccions
+        o connectant els teus comptes per veure informes complets
       title: No hi ha dades disponibles
     google_sheets_instructions:
       close: D'acord
       example: Exemple
-      go_to_api_keys: Anar a claus API
+      go_to_api_keys: Ves a claus API
       need_key: Per importar dades a Google Sheets, necessites una clau API.
-      open_sheets: Obrir Google Sheets
+      open_sheets: Obre Google Sheets
       ready: La teva URL CSV (amb clau API) està preparada.
-      security_warning: Aquesta URL inclou la teva clau API. Mantingues-la segura!
-      step1: Anar a Configuració → Claus API
+      security_warning: Aquesta URL inclou la teva clau API. Mantén-la segura!
+      step1: Ves a Configuració → Claus API
       step2: Crea una nova clau API amb permisos de "lectura"
-      step3: Còpia la clau API
-      step4: 'Afegeix-la a aquesta URL com: ?api_key=TEVA_CLAU'
+      step3: Copia la clau API
+      step4: 'Afegeix-la a aquesta URL com: ?api_key=LA_TEVA_CLAU'
       steps: |-
         Per importar a Google Sheets:
         1. Crea un full de Google nou
         2. A la cel·la A1, introdueix la fórmula que es mostra a continuació
-        3. Prem Enter
-      then_use: Després usa l'URL completa amb =IMPORTDATA() a Google Sheets.
+        3. Prem Retorn
+      then_use: Després fes servir l'URL completa amb =IMPORTDATA() a Google Sheets.
       title_no_key: "⚠️ Es requereix clau API"
       title_with_key: "✅ Copia l'URL per a Google Sheets"
     index:
@@ -45,29 +46,70 @@ ca:
         to: Fins a
       drag_to_reorder: Arrossega per reordenar la secció
       export: Exporta CSV
+      next_decade: Dècada següent
+      next_period: Període següent
+      next_year: Any següent
+      period_label:
+        last_6_months: "%{start} – %{end}"
+        past_year: "%{year}"
+        quarterly: T%{quarter} %{year}
+        ytd: Any %{year}
+      period_picker:
+        quarter: T%{quarter} %{year}
+        ytd: Any %{year}
       periods:
         custom: Rang personalitzat
         last_6_months: Últims 6 mesos
         monthly: Mensual
         quarterly: Trimestral
-        ytd: Any fins avui
-      print_report: Imprimir informe
-      showing_period: Mostrant dades des de %{start} fins a %{end}
-      subtitle: Informació completa sobre la teva salut financera
+        ytd: Any en curs
+      previous_decade: Dècada anterior
+      previous_period: Període anterior
+      previous_year: Any anterior
+      print_report: Imprimeix l'informe
+      showing_period: Mostrant dades de %{start} a %{end}
+      subtitle: Visió completa de la teva salut financera
       title: Informes
-      toggle_section: Commutar visibilitat de la secció
-    invalid_date_range: La data final no pot ser anterior a la data inicial. Les dates s'han
-      canviat.
+      today: Avui
+      toggle_section: Commuta la visibilitat de la secció
+    invalid_date_range: La data final no pot ser anterior a la inicial. Les dates
+      s'han intercanviat.
+    investment_flows:
+      contributions: Aportacions
+      contributions_description: Diners afegits a inversions
+      description: Fes el seguiment dels diners que entren i surten dels teus comptes
+        d'inversió mitjançant aportacions i retirades.
+      net_flow: Flux net
+      net_flow_description: Canvi net total
+      title: Fluxos d'inversió
+      withdrawals: Retirades
+      withdrawals_description: Diners retirats de les inversions
     investment_performance:
       accounts: Comptes d'inversió
-      contributions: Contribucions del període
-      holding: Participació
-      portfolio_value: Valor del portfoli
+      and_more: "+%{count} més"
+      contributions: Aportacions del període
+      gains_by_tax_treatment: Guanys per tractament fiscal
+      holding: Posició
+      holdings: Posicions
+      holdings_count:
+        one: "%{count} posició"
+        other: "%{count} posicions"
+      no_data: "-"
+      portfolio_value: Valor de la cartera
+      realized_gains: Guanys realitzats
       return: Rendiment
+      sell_trades: Vendes
+      sells_count:
+        one: "%{count} venda"
+        other: "%{count} vendes"
+      taxable_realized_note: Aquests guanys poden estar subjectes a impostos
       title: Rendiment de la inversió
-      top_holdings: Principals participacions
+      top_holdings: Principals posicions
+      total_gains: Guanys totals
       total_return: Rendiment total
+      unrealized_gains: Guanys no realitzats
       value: Valor
+      view_details: Veure detalls
       weight: Pes
       withdrawals: Retirades del període
     net_worth:
@@ -83,13 +125,13 @@ ca:
       document_title: Informe financer
       generated_on: Generat el %{date}
       investments:
-        contributions: Contribucions
-        holding: Participació
-        portfolio_value: Valor del portfoli
+        contributions: Aportacions
+        holding: Posició
+        portfolio_value: Valor de la cartera
         return: Rendiment
         this_period: aquest període
         title: Inversions
-        top_holdings: Principals participacions
+        top_holdings: Principals posicions
         total_return: Rendiment total
         value: Valor
         weight: Pes
@@ -132,7 +174,7 @@ ca:
       budget_performance: Rendiment del pressupost
       income_minus_expenses: Ingressos menys despeses
       net_savings: Estalvi net
-      no_budget_data: No hi ha dades de pressupost per aquest període
+      no_budget_data: No hi ha dades de pressupost per a aquest període
       of_budget_used: del pressupost utilitzat
       total_expenses: Despeses totals
       total_income: Ingressos totals
@@ -141,23 +183,23 @@ ca:
       export:
         csv: CSV
         excel: Excel
-        google_sheets: Obrir a Google Sheets
-        label: Exportar
+        google_sheets: Obre a Google Sheets
+        label: Exporta
         pdf: PDF
       filters:
         account: Compte
         all_accounts: Tots els comptes
         all_categories: Totes les categories
         all_tags: Totes les etiquetes
-        amount_max: Màxim import
-        amount_min: Mínim import
-        apply: Aplicar filtres
+        amount_max: Import màxim
+        amount_min: Import mínim
+        apply: Aplica filtres
         category: Categoria
-        clear: Esborrar filtres
+        clear: Neteja filtres
         date_range: Rang de dates
         tag: Etiqueta
         title: Filtres
-      no_transactions: No s'ha trobat activitat per al període i filtres seleccionats
+      no_transactions: No s'ha trobat cap activitat per al període i filtres seleccionats
       pagination:
         next: Següent
         previous: Anterior
@@ -168,13 +210,13 @@ ca:
         amount_asc: Import (baix a alt)
         amount_desc: Import (alt a baix)
         date_desc: Data (més recent)
-        label: Ordenar per
+        label: Ordena per
       table:
         amount: Import
         category: Categoria
         entries:
-          one: entrada
-          other: entrades
+          one: "%{count} entrada"
+          other: "%{count} entrades"
         expense: Despeses
         income: Ingressos
         percentage: "% del total"
@@ -189,21 +231,22 @@ ca:
       current: actual
       expenses: Despeses
       income: Ingressos
-      insight_higher_weekday: Gastes %{percent}% més per transacció en dies laborables
+      insight_higher_weekday: Gastes un %{percent}% més per transacció en dies laborables
         que en caps de setmana
-      insight_higher_weekend: Gastes %{percent}% més per transacció en caps de setmana
-        que en dies laborables
-      insight_similar: El teu gast per transacció és similar en dies laborables i caps de setmana
+      insight_higher_weekend: Gastes un %{percent}% més per transacció en caps de
+        setmana que en dies laborables
+      insight_similar: La teva despesa per transacció és similar en dies laborables
+        i caps de setmana
       insight_title: Anàlisi
       month: Mes
       monthly_breakdown: Detall mensual
       net: Net
       no_data: No hi ha dades de tendències disponibles
-      no_spending_data: No hi ha dades de despeses disponibles per aquest període
+      no_spending_data: No hi ha dades de despeses disponibles per a aquest període
       savings_rate: Taxa d'estalvi
       spending_patterns: Patrons de despesa
       title: Tendències i anàlisi
       total: Total
       transactions: Transaccions
-      weekday_spending: Despeses laborables
-      weekend_spending: Despeses de cap de setmana
+      weekday_spending: Despeses en dies laborables
+      weekend_spending: Despeses en caps de setmana
diff --git a/config/locales/views/reports/en.yml b/config/locales/views/reports/en.yml
index 598070944..be792678d 100644
--- a/config/locales/views/reports/en.yml
+++ b/config/locales/views/reports/en.yml
@@ -18,6 +18,21 @@ en:
         from: From
         to: To
       showing_period: "Showing data from %{start} to %{end}"
+      previous_period: "Previous period"
+      next_period: "Next period"
+      today: "Today"
+      period_label:
+        quarterly: "Q%{quarter} %{year}"
+        ytd: "YTD %{year}"
+        past_year: "%{year}"
+        last_6_months: "%{start} – %{end}"
+      period_picker:
+        quarter: "Q%{quarter} %{year}"
+        ytd: "YTD %{year}"
+      previous_year: "Previous year"
+      next_year: "Next year"
+      previous_decade: "Previous decade"
+      next_decade: "Next decade"
     invalid_date_range: "End date cannot be before start date. The dates have been swapped."
     summary:
       total_income: Total Income
@@ -153,10 +168,13 @@ en:
       and_more: "+%{count} more"
     investment_flows:
       title: Investment Flows
-      description: Track money flowing into and out of your investment accounts
+      description: Track money flowing into and out of your investment accounts through contributions and withdrawals.
       contributions: Contributions
+      contributions_description: Money added to investments
       withdrawals: Withdrawals
+      withdrawals_description: Money withdrawn from investments
       net_flow: Net Flow
+      net_flow_description: Total net change
     google_sheets_instructions:
       title_with_key: "✅ Copy URL for Google Sheets"
       title_no_key: "⚠️ API Key Required"
diff --git a/config/locales/views/reports/fr.yml b/config/locales/views/reports/fr.yml
index 885636a6f..fc9d964f0 100644
--- a/config/locales/views/reports/fr.yml
+++ b/config/locales/views/reports/fr.yml
@@ -34,6 +34,7 @@ fr:
       budgeted: Budgété
       remaining: Restant
       over_by: Dépassé de
+      shared: partagé
       suggested_daily: "%{amount} suggéré par jour pour les %{days} jours restants"
       no_budgets: Aucune catégorie de budget définie pour ce mois
       status:
@@ -104,8 +105,8 @@ fr:
         income: Revenus
         uncategorized: Non catégorisé
         entries:
-          one: entrée
-          other: entrées
+          one: "%{count} entrée"
+          other: "%{count} entrées"
         percentage: "% du total"
       pagination:
         showing:
@@ -114,8 +115,8 @@ fr:
         previous: Précédent
         next: Suivant
     net_worth:
-      title: Valeur nette
-      current_net_worth: Valeur nette actuelle
+      title: Patrimoine net
+      current_net_worth: Patrimoine net actuel
       period_change: Variation sur la période
       assets_vs_liabilities: Actifs vs Passifs
       total_assets: Actifs
@@ -134,6 +135,28 @@ fr:
       value: Valeur
       return: Rendement
       accounts: Comptes d'investissement
+      gains_by_tax_treatment: Gains par traitement fiscal
+      unrealized_gains: Plus-values latentes
+      realized_gains: Plus-values réalisées
+      total_gains: Gains totaux
+      taxable_realized_note: Ces gains peuvent être soumis à l'impôt
+      no_data: "-"
+      view_details: Voir les détails
+      holdings_count:
+        one: "%{count} avoir"
+        other: "%{count} avoirs"
+      sells_count:
+        one: "%{count} vente"
+        other: "%{count} ventes"
+      holdings: Avoirs
+      sell_trades: Transactions boursières de vente
+      and_more: "+%{count} de plus"
+    investment_flows:
+      title: Flux d'investissement
+      description: Suivez les flux d'argent entrants et sortants de vos comptes d'investissement
+      contributions: Contributions
+      withdrawals: Retraits
+      net_flow: Flux net
     google_sheets_instructions:
       title_with_key: "✅ Copier l'URL pour Google Sheets"
       title_no_key: "⚠️ Clé API requise"
@@ -164,7 +187,7 @@ fr:
         of_income: "%{percent}% des revenus"
         used: utilisé
       net_worth:
-        title: Valeur nette
+        title: Patrimoine net
         current_balance: Solde actuel
         this_period: cette période
         assets: Actifs
diff --git a/config/locales/views/reports/hu.yml b/config/locales/views/reports/hu.yml
new file mode 100644
index 000000000..c0dee944c
--- /dev/null
+++ b/config/locales/views/reports/hu.yml
@@ -0,0 +1,242 @@
+---
+hu:
+  reports:
+    index:
+      title: Jelentések
+      subtitle: Átfogó betekintés a pénzügyi helyzetedbe
+      export: CSV exportálása
+      print_report: Jelentés nyomtatása
+      drag_to_reorder: "Húzd a szakasz átrendezéséhez"
+      toggle_section: "Szakasz láthatóságának váltása"
+      periods:
+        monthly: Havi
+        quarterly: Negyedéves
+        ytd: Év elejétől
+        last_6_months: Elmúlt 6 hónap
+        custom: Egyéni időszak
+      date_range:
+        from: Kezdő dátum
+        to: Záró dátum
+      showing_period: "Adatok megjelenítése: %{start} – %{end}"
+      previous_period: "Előző időszak"
+      next_period: "Következő időszak"
+      today: "Ma"
+      period_label:
+        quarterly: "N%{quarter} %{year}"
+        ytd: "ÉTD %{year}"
+        past_year: "%{year}"
+        last_6_months: "%{start} – %{end}"
+      period_picker:
+        quarter: "N%{quarter} %{year}"
+        ytd: "ÉTD %{year}"
+      previous_year: "Előző év"
+      next_year: "Következő év"
+      previous_decade: "Előző évtized"
+      next_decade: "Következő évtized"
+    invalid_date_range: "A záró dátum nem lehet korábbi a kezdő dátumnál. A dátumok fel lettek cserélve."
+    summary:
+      total_income: Összes bevétel
+      total_expenses: Összes kiadás
+      net_savings: Nettó megtakarítás
+      budget_performance: Költségvetés teljesítése
+      vs_previous: az előző időszakhoz képest
+      income_minus_expenses: Bevétel mínusz kiadás
+      of_budget_used: a költségvetés felhasználva
+      no_budget_data: Nincs költségvetési adat erre az időszakra
+    budget_performance:
+      title: Költségvetés teljesítése
+      spent: Elköltve
+      budgeted: Tervezett
+      remaining: Maradék
+      over_by: Túllépés
+      shared: megosztott
+      suggested_daily: "Javasolt napi összeg: %{amount} a hátralévő %{days} napra"
+      no_budgets: Erre a hónapra nincsenek beállított költségvetési kategóriák
+      status:
+        good: Tervezett szerint
+        warning: Közel a határhoz
+        over: Túllépte a keretet
+    trends:
+      title: Trendek és elemzések
+      monthly_breakdown: Havi bontás
+      month: Hónap
+      income: Bevétel
+      expenses: Kiadások
+      net: Nettó
+      savings_rate: Megtakarítási ráta
+      current: aktuális
+      avg_monthly_income: Átl. havi bevétel
+      avg_monthly_expenses: Átl. havi kiadás
+      avg_monthly_savings: Átl. havi megtakarítás
+      no_data: Nem áll rendelkezésre trendadat
+      spending_patterns: Költési szokások
+      weekday_spending: Hétköznapi kiadások
+      weekend_spending: Hétvégi kiadások
+      total: Összesen
+      avg_per_transaction: Átl. tranzakciónként
+      transactions: Tranzakciók
+      insight_title: Elemzés
+      insight_higher_weekend: "Hétvégén tranzakciónként %{percent}%-kal többet költesz, mint hétköznapokon"
+      insight_higher_weekday: "Hétköznapokon tranzakciónként %{percent}%-kal többet költesz, mint hétvégén"
+      insight_similar: "A tranzakciónkénti kiadásaid hasonlóak hétköznapokon és hétvégén"
+      no_spending_data: Nincs elérhető kiadási adat erre az időszakra
+    empty_state:
+      title: Nem állnak rendelkezésre adatok
+      description: Kezdj el tranzakciókat rögzíteni vagy kapcsold össze a számláidat az átfogó jelentések megtekintéséhez
+      add_transaction: Tranzakció hozzáadása
+      add_account: Számla hozzáadása
+    transactions_breakdown:
+      title: Tevékenység bontása
+      no_transactions: Nem található tevékenység a kiválasztott időszakra és szűrőkre
+      filters:
+        title: Szűrők
+        category: Kategória
+        account: Számla
+        tag: Címke
+        amount_min: Min összeg
+        amount_max: Max összeg
+        date_range: Időszak
+        all_categories: Összes kategória
+        all_accounts: Összes számla
+        all_tags: Összes címke
+        apply: Szűrők alkalmazása
+        clear: Szűrők törlése
+      sort:
+        label: Rendezés
+        date_desc: Dátum (legújabb elöl)
+        amount_desc: Összeg (csökkenő)
+        amount_asc: Összeg (növekvő)
+      export:
+        label: Exportálás
+        csv: CSV
+        excel: Excel
+        pdf: PDF
+        google_sheets: Megnyitás Google Sheetsben
+      table:
+        category: Kategória
+        amount: Összeg
+        type: Típus
+        expense: Kiadások
+        income: Bevétel
+        uncategorized: Kategorizálatlan
+        entries:
+          one: "%{count} tétel"
+          other: "%{count} tétel"
+        percentage: "% az összesből"
+      pagination:
+        showing:
+          one: "%{count} tétel megjelenítve"
+          other: "%{count} tétel megjelenítve"
+        previous: Előző
+        next: Következő
+    net_worth:
+      title: Nettó vagyon
+      current_net_worth: Jelenlegi nettó vagyon
+      period_change: Időszaki változás
+      assets_vs_liabilities: Vagyon vs. kötelezettségek
+      total_assets: Vagyon
+      total_liabilities: Kötelezettségek
+      no_assets: Nincs vagyon
+      no_liabilities: Nincsenek kötelezettségek
+    investment_performance:
+      title: Befektetési teljesítmény
+      portfolio_value: Portfólió értéke
+      total_return: Teljes hozam
+      contributions: Időszaki befizetések
+      withdrawals: Időszaki kivétek
+      top_holdings: Legjobb pozíciók
+      holding: Pozíció
+      weight: Súly
+      value: Érték
+      return: Hozam
+      accounts: Befektetési számlák
+      gains_by_tax_treatment: Nyereség adózási típus szerint
+      unrealized_gains: Nem realizált nyereség
+      realized_gains: Realizált nyereség
+      total_gains: Teljes nyereség
+      taxable_realized_note: Ezek a nyereségek adókötelesek lehetnek
+      no_data: "-"
+      view_details: Részletek megtekintése
+      holdings_count:
+        one: "%{count} pozíció"
+        other: "%{count} pozíció"
+      sells_count:
+        one: "%{count} eladás"
+        other: "%{count} eladás"
+      holdings: Pozíciók
+      sell_trades: Eladási ügyletek
+      and_more: "+%{count} további"
+    investment_flows:
+      title: Befektetési pénzáramlás
+      description: Kövesd nyomon a befektetési számláidra be- és onnan kiáramló pénzt
+      contributions: Befizetések
+      contributions_description: Befektetésekbe befizetett összeg
+      withdrawals: Kivétek
+      withdrawals_description: Befektetésekből kivett összeg
+      net_flow: Nettó pénzáramlás
+      net_flow_description: Teljes nettó változás
+    google_sheets_instructions:
+      title_with_key: "✅ URL másolása Google Sheetshez"
+      title_no_key: "⚠️ API-kulcs szükséges"
+      ready: A CSV URL (API-kulccsal) készen áll.
+      steps: "Importálás Google Sheetsbe:\n1. Hozz létre egy új Google Sheetet\n2. Az A1 cellába írd be az alábbi képletet\n3. Nyomj Entert"
+      security_warning: "Ez az URL tartalmazza az API-kulcsodat. Tartsd biztonságban!"
+      need_key: Az adatok Google Sheetsbe importálásához API-kulcs szükséges.
+      step1: "Menj a Beállítások → API-kulcsok menüpontra"
+      step2: "Hozz létre egy új API-kulcsot \"olvasás\" jogosultsággal"
+      step3: Másold ki az API-kulcsot
+      step4: "Add hozzá az URL-hez így: ?api_key=A_TE_KULCSOD"
+      example: Példa
+      then_use: Ezután használd a teljes URL-t =IMPORTDATA() képlettel a Google Sheetsben.
+      open_sheets: Google Sheets megnyitása
+      go_to_api_keys: Ugrás az API-kulcsokhoz
+      close: Rendben
+    print:
+      document_title: Pénzügyi jelentés
+      title: Pénzügyi jelentés
+      generated_on: "Generálva: %{date}"
+      summary:
+        title: Összefoglaló
+        income: Bevétel
+        expenses: Kiadások
+        net_savings: Nettó megtakarítás
+        budget: Költségvetés
+        vs_prior: "%{percent}% az előző időszakhoz képest"
+        of_income: "a bevétel %{percent}%-a"
+        used: felhasználva
+      net_worth:
+        title: Nettó vagyon
+        current_balance: Jelenlegi egyenleg
+        this_period: ebben az időszakban
+        assets: Vagyon
+        liabilities: Kötelezettségek
+        no_liabilities: Nincsenek kötelezettségek
+      trends:
+        title: Havi trendek
+        month: Hónap
+        income: Bevétel
+        expenses: Kiadások
+        net: Nettó
+        savings_rate: Megtakarítási ráta
+        average: Átlag
+        current_month_note: "* Aktuális hónap (részleges adat)"
+      investments:
+        title: Befektetések
+        portfolio_value: Portfólió értéke
+        total_return: Teljes hozam
+        contributions: Befizetések
+        withdrawals: Kivétek
+        this_period: ebben az időszakban
+        top_holdings: Legjobb pozíciók
+        holding: Pozíció
+        weight: Súly
+        value: Érték
+        return: Hozam
+      spending:
+        title: Kiadások kategóriánként
+        income: Bevétel
+        expenses: Kiadások
+        category: Kategória
+        amount: Összeg
+        percent: "%"
+        more_categories: "+ %{count} további kategória"
diff --git a/config/locales/views/rules/ca.yml b/config/locales/views/rules/ca.yml
index b1cacb21f..4a6085dd1 100644
--- a/config/locales/views/rules/ca.yml
+++ b/config/locales/views/rules/ca.yml
@@ -1,36 +1,106 @@
 ---
 ca:
+  rule:
+    conditions:
+      condition_group:
+        add_condition: Afegeix condició
+        all: totes
+        and_prefix: i
+        any: qualsevol
+        match: coincideixen
+        of_the_following_conditions: de les condicions següents
   rules:
     actions:
       value_placeholder: Introdueix un valor
     apply_all:
-      ai_cost_message: Això utilitzarà IA per categoritzar fins a %{transactions} transaccions.
-      ai_cost_title: Estimació de Cost d'IA
-      button: Aplica Totes
-      confirm_button: Confirma i Aplica Totes
+      ai_cost_message: Això utilitzarà IA per categoritzar fins a %{transactions}
+        transaccions.
+      ai_cost_title: Estimació de cost d'IA
+      button: Aplica-les totes
+      confirm_button: Confirma i aplica-les totes
       confirm_message: Estàs a punt d'aplicar %{count} regles que afecten %{transactions}
         transaccions úniques. Confirma si vols continuar.
-      confirm_title: Aplica Totes les Regles
+      confirm_title: Aplica totes les regles
       cost_unavailable_model: Estimació de cost no disponible per al model "%{model}".
-      cost_unavailable_no_provider: Estimació de cost no disponible (no hi ha proveïdor LLM configurat).
-      cost_warning: Pots tenir costos, comprova amb el proveïdor del model per als
+      cost_unavailable_no_provider: Estimació de cost no disponible (no hi ha proveïdor
+        d'LLM configurat).
+      cost_warning: Pots tenir costos. Consulta amb el proveïdor del model per als
         preus més actualitzats.
       estimated_cost: 'Cost estimat: ~$%{cost}'
-      success: Totes les regles s'han posat a cua per a execució
-      view_usage: Veure l'historial d'ús
+      success: Totes les regles s'han posat a la cua per executar-se
+      view_usage: Mostra l'historial d'ús
+    clear_ai_cache:
+      button: Buida la memòria cau d'IA
+      confirm_body: Segur que vols buidar la memòria cau d'IA? Això permetrà que les
+        regles d'IA tornin a processar totes les transaccions. Pot generar costos
+        d'API addicionals.
+      confirm_button: Buida la memòria cau
+      confirm_title: Vols buidar la memòria cau d'IA?
+      success: La memòria cau d'IA s'està netejant. Pot trigar uns instants.
+    condition_filters:
+      transaction_type:
+        equal_to: Igual a
+        expense: Despesa
+        income: Ingrés
+        transfer: Transferència
+    confirm:
+      ai_cost_no_estimate_html: Això utilitzarà IA per categoritzar %{count} transaccions.
+      ai_cost_title: Estimació de cost d'IA
+      ai_cost_with_estimate_html: 'Això utilitzarà IA per categoritzar %{count} transaccions.
+        Cost estimat: <span class="font-semibold">~$%{cost}</span>'
+      apply_notice_html: Estàs a punt d'aplicar aquesta regla a <span class="text-primary
+        font-medium">%{count} %{resource}</span> que compleixen els criteris especificats.
+        Confirma si vols continuar amb aquest canvi.
+      confirm_changes: Confirma els canvis
+      cost_unavailable_model: Estimació de cost no disponible per al model "%{model}".
+      cost_unavailable_no_provider: Estimació de cost no disponible (no hi ha proveïdor
+        d'LLM configurat).
+      cost_warning: Pots tenir costos. Consulta amb el proveïdor del model per als
+        preus més actualitzats.
+      title: Confirma els canvis
+      title_with_name: Confirma els canvis a "%{name}"
+      view_usage_history: Mostra l'historial d'ús
+    destroy:
+      success: Regla eliminada
+    destroy_all:
+      success: Totes les regles eliminades
+    form:
+      add_action: Afegeix acció
+      add_condition: Afegeix condició
+      add_condition_group: Afegeix grup de condicions
+      all_past_and_future: Totes les %{resource} passades i futures
+      rule_name_label: Nom de la regla (opcional)
+      rule_name_placeholder: Introdueix un nom per a aquesta regla
+      starting_from: A partir de
+      then: ALESHORES
+    index:
+      ai_cost_warning: Les accions de regla amb IA tenen cost. Filtra el màxim possible
+        per evitar costos innecessaris.
+      delete_all_rules: Elimina totes les regles
+      new_rule: Nova regla
+      no_rules_description: Configura regles per executar accions a les teves transaccions
+        i altres dades a cada sincronització.
+      no_rules_title: Encara no hi ha regles
+      page_title: Regles
+      rules_heading: Regles
+      sort_by: 'Ordena per:'
+      sort_name: Nom
+      sort_updated_at: Data d'actualització
+      toggle_sort_direction: Commuta el sentit d'ordenació
     no_action: Sense acció
     no_condition: Sense condició
     recent_runs:
       columns:
         date_time: Data/Hora
         execution_type: Tipus
-        rule_name: Nom de la Regla
+        rule_name: Nom de la regla
         status: Estat
         transactions_counts:
+          blocked: Bloquejades
           modified: Modificades
           processed: Processades
-          queued: En Cua
-      description: Visualitza l'historial d'execució de les teves regles incloent
+          queued: A la cua
+      description: Visualitza l'historial d'execució de les teves regles, incloent
         l'estat d'èxit/fallada i els recomptes de transaccions.
       execution_types:
         manual: Manual
@@ -39,5 +109,21 @@ ca:
         failed: Fallada
         pending: Pendent
         success: Èxit
-      title: Execucions Recents
-      unnamed_rule: Regla Sense Nom
+      title: Execucions recents
+      unnamed_rule: Regla sense nom
+    rule:
+      action_label_to: "%{label} a %{value}"
+      all_past_and_future: Totes les %{resource} passades i futures
+      and_more_actions:
+        one: i 1 acció més
+        other: i %{count} accions més
+      and_more_conditions:
+        one: i 1 condició més
+        other: i %{count} condicions més
+      delete: Elimina
+      edit: Edita
+      on_or_after: "%{resource} el %{date} o després"
+      re_apply_rule: Torna a aplicar la regla
+      then: ALESHORES
+    update:
+      success: Regla actualitzada
diff --git a/config/locales/views/rules/en.yml b/config/locales/views/rules/en.yml
index 81eccc7e8..3df2feda1 100644
--- a/config/locales/views/rules/en.yml
+++ b/config/locales/views/rules/en.yml
@@ -3,8 +3,61 @@ en:
   rules:
     no_action: No Action
     no_condition: No condition
+    rule:
+      edit: Edit
+      re_apply_rule: Re-apply rule
+      delete: Delete
+      then: THEN
+      and_more_conditions:
+        one: and 1 more condition
+        other: and %{count} more conditions
+      and_more_actions:
+        one: and 1 more action
+        other: and %{count} more actions
+      action_label_to: "%{label} to %{value}"
+      all_past_and_future: All past and future %{resource}
+      on_or_after: "%{resource} on or after %{date}"
+    form:
+      rule_name_label: Rule name (optional)
+      rule_name_placeholder: Enter a name for this rule
+      add_condition: Add condition
+      add_condition_group: Add condition group
+      add_action: Add action
+      all_past_and_future: All past and future %{resource}
+      starting_from: Starting from
+      then: THEN
+    index:
+      page_title: Rules
+      delete_all_rules: Delete all rules
+      new_rule: New rule
+      ai_cost_warning: AI-enabled rule actions will cost money.  Be sure to filter as narrowly as possible to avoid unnecessary costs.
+      rules_heading: Rules
+      sort_by: "Sort by:"
+      sort_name: Name
+      sort_updated_at: Updated At
+      toggle_sort_direction: Toggle sort direction
+      no_rules_title: No rules yet
+      no_rules_description: Set up rules to perform actions to your transactions and other data on every account sync.
+    confirm:
+      title: Confirm changes
+      title_with_name: "Confirm changes to \"%{name}\""
+      apply_notice_html: "You are about to apply this rule to <span class=\"text-primary font-medium\">%{count} %{resource}</span> that meet the specified rule criteria.  Please confirm if you wish to proceed with this change."
+      ai_cost_title: AI Cost Estimation
+      ai_cost_with_estimate_html: "This will use AI to categorize %{count} transaction(s). Estimated cost: <span class=\"font-semibold\">~$%{cost}</span>"
+      ai_cost_no_estimate_html: "This will use AI to categorize %{count} transaction(s)."
+      cost_unavailable_model: "Cost estimation unavailable for model \"%{model}\"."
+      cost_unavailable_no_provider: Cost estimation unavailable (no LLM provider configured).
+      cost_warning: You may incur costs, please check with the model provider for the most up-to-date prices.
+      view_usage_history: View usage history
+      confirm_changes: Confirm changes
     actions:
       value_placeholder: Enter a value
+    update:
+      success: Rule updated
+    destroy:
+      success: Rule deleted
+    destroy_all:
+      success: All rules deleted
     apply_all:
       button: Apply All
       confirm_title: Apply All Rules
@@ -31,6 +84,7 @@ en:
           queued: Queued
           processed: Processed
           modified: Modified
+          blocked: Blocked
       execution_types:
         manual: Manual
         scheduled: Scheduled
@@ -50,3 +104,12 @@ en:
         expense: Expense
         transfer: Transfer
         equal_to: Equal to
+  rule:
+    conditions:
+      condition_group:
+        and_prefix: and
+        match: match
+        all: all
+        any: any
+        of_the_following_conditions: of the following conditions
+        add_condition: Add condition
diff --git a/config/locales/views/rules/fr.yml b/config/locales/views/rules/fr.yml
index dfa7b9755..fac2d1c9d 100644
--- a/config/locales/views/rules/fr.yml
+++ b/config/locales/views/rules/fr.yml
@@ -38,3 +38,15 @@ fr:
         pending: En attente
         success: Réussi
         failed: Échoué
+    clear_ai_cache:
+      button: Réinitialiser le cache IA
+      confirm_title: Réinitialiser le cache IA ?
+      confirm_body: Êtes-vous sûr de vouloir réinitialiser le cache IA ? Cela permettra aux règles IA de retraiter toutes les transactions. Cela pourrait engendrer des coûts API supplémentaires.
+      confirm_button: Réinitialiser le cache
+      success: Le cache IA est en cours de suppression. Cela peut prendre quelques instants.
+    condition_filters:
+      transaction_type:
+        income: Revenu
+        expense: Dépense
+        transfer: Virement
+        equal_to: Égal à
diff --git a/config/locales/views/rules/hu.yml b/config/locales/views/rules/hu.yml
new file mode 100644
index 000000000..23d879ab2
--- /dev/null
+++ b/config/locales/views/rules/hu.yml
@@ -0,0 +1,115 @@
+---
+hu:
+  rules:
+    no_action: Nincs művelet
+    no_condition: Nincs feltétel
+    rule:
+      edit: Szerkesztés
+      re_apply_rule: Szabály újraalkalmazása
+      delete: Törlés
+      then: AKKOR
+      and_more_conditions:
+        one: és 1 további feltétel
+        other: és %{count} további feltétel
+      and_more_actions:
+        one: és 1 további művelet
+        other: és %{count} további művelet
+      action_label_to: "%{label} erre: %{value}"
+      all_past_and_future: Összes korábbi és jövőbeli %{resource}
+      on_or_after: "%{resource} %{date} napon vagy azt követően"
+    form:
+      rule_name_label: Szabály neve (nem kötelező)
+      rule_name_placeholder: Add meg a szabály nevét
+      add_condition: Feltétel hozzáadása
+      add_condition_group: Feltételcsoport hozzáadása
+      add_action: Művelet hozzáadása
+      all_past_and_future: Összes korábbi és jövőbeli %{resource}
+      starting_from: Kezdve
+      then: AKKOR
+    index:
+      page_title: Szabályok
+      delete_all_rules: Összes szabály törlése
+      new_rule: Új szabály
+      ai_cost_warning: Az AI-t igénybe vevő szabályakciók pénzbe kerülnek. Szűrj minél szűkebbre a felesleges költségek elkerülése érdekében.
+      rules_heading: Szabályok
+      sort_by: "Rendezés:"
+      sort_name: Név szerint
+      sort_updated_at: Módosítás dátuma szerint
+      toggle_sort_direction: Rendezési irány váltása
+      no_rules_title: Még nincsenek szabályok
+      no_rules_description: Állíts be szabályokat, amelyek minden fiókszinkronizáláskor automatikusan elvégzik a megadott műveleteket a tranzakciókon és egyéb adatokon.
+    confirm:
+      title: Változtatások megerősítése
+      title_with_name: "Változtatások megerősítése: \"%{name}\""
+      apply_notice_html: "Ezzel a szabályt <span class=\"text-primary font-medium\">%{count} %{resource}</span> elemre alkalmazod, amelyek megfelelnek a feltételeknek. Kérjük, erősítsd meg, ha folytatni szeretnéd."
+      ai_cost_title: AI-költség becslése
+      ai_cost_with_estimate_html: "Ez AI segítségével kategorizál %{count} tranzakciót. Becsült költség: <span class=\"font-semibold\">~$%{cost}</span>"
+      ai_cost_no_estimate_html: "Ez AI segítségével kategorizál %{count} tranzakciót."
+      cost_unavailable_model: "A(z) \"%{model}\" modellhez nem érhető el költségbecslés."
+      cost_unavailable_no_provider: A költségbecslés nem érhető el (nincs LLM-szolgáltató beállítva).
+      cost_warning: Költségek merülhetnek fel – a legfrissebb árakért ellenőrizd a modellszolgáltatónál.
+      view_usage_history: Felhasználási előzmények megtekintése
+      confirm_changes: Változtatások megerősítése
+    actions:
+      value_placeholder: Adj meg egy értéket
+    apply_all:
+      button: Összes alkalmazása
+      confirm_title: Összes szabály alkalmazása
+      confirm_message: Ezzel %{count} szabályt alkalmazol, amelyek %{transactions} egyedi tranzakciót érintenek. Kérjük, erősítsd meg, ha folytatni szeretnéd.
+      confirm_button: Megerősítés és összes alkalmazása
+      success: Minden szabály végrehajtásra van ütemezve
+      ai_cost_title: AI-költség becslése
+      ai_cost_message: Ez AI segítségével kategorizál legfeljebb %{transactions} tranzakciót.
+      estimated_cost: "Becsült költség: ~$%{cost}"
+      cost_unavailable_model: A(z) „%{model}" modellhez nem érhető el költségbecslés.
+      cost_unavailable_no_provider: A költségbecslés nem érhető el (nincs LLM-szolgáltató beállítva).
+      cost_warning: Költségek merülhetnek fel – a legfrissebb árakért ellenőrizd a modellszolgáltatónál.
+      view_usage: Felhasználási előzmények megtekintése
+    update:
+      success: Szabály frissítve
+    destroy:
+      success: Szabály törölve
+    destroy_all:
+      success: Összes szabály törölve
+    recent_runs:
+      title: Legutóbbi futtatások
+      description: Tekintsd meg a szabályok végrehajtási előzményeit, beleértve a sikeres/sikertelen állapotot és a tranzakciók számát.
+      unnamed_rule: Névtelen szabály
+      columns:
+        date_time: Dátum/Idő
+        execution_type: Típus
+        status: Állapot
+        rule_name: Szabály neve
+        transactions_counts:
+          queued: Sorban álló
+          processed: Feldolgozott
+          modified: Módosított
+          blocked: Blokkolt
+      execution_types:
+        manual: Manuális
+        scheduled: Ütemezett
+      statuses:
+        pending: Függőben lévő
+        success: Sikeres
+        failed: Sikertelen
+    clear_ai_cache:
+      button: AI-gyorsítótár visszaállítása
+      confirm_title: Visszaállítod az AI-gyorsítótárat?
+      confirm_body: Biztosan visszaállítod az AI-gyorsítótárat? Ez lehetővé teszi az AI-szabályok számára az összes tranzakció újrafeldolgozását. Ez további API-költségeket okozhat.
+      confirm_button: Gyorsítótár visszaállítása
+      success: Az AI-gyorsítótár törlése folyamatban van. Ez néhány percet igénybe vehet.
+    condition_filters:
+      transaction_type:
+        income: Bevétel
+        expense: Kiadás
+        transfer: Átutalás
+        equal_to: Egyenlő
+  rule:
+    conditions:
+      condition_group:
+        and_prefix: és
+        match: egyezik
+        all: összes
+        any: bármelyik
+        of_the_following_conditions: a következő feltételek közül
+        add_condition: Feltétel hozzáadása
diff --git a/config/locales/views/securities/ca.yml b/config/locales/views/securities/ca.yml
new file mode 100644
index 000000000..629d44140
--- /dev/null
+++ b/config/locales/views/securities/ca.yml
@@ -0,0 +1,14 @@
+---
+ca:
+  securities:
+    combobox:
+      display: "%{symbol} - %{name} (%{exchange})"
+      exchange_label: "%{symbol} (%{exchange})"
+    providers:
+      alpha_vantage: Alpha Vantage
+      binance_public: Binance
+      eodhd: EODHD
+      mfapi: MFAPI.in
+      tiingo: Tiingo
+      twelve_data: Twelve Data
+      yahoo_finance: Yahoo Finance
diff --git a/config/locales/views/securities/en.yml b/config/locales/views/securities/en.yml
index 078dfd0d0..c7243b28e 100644
--- a/config/locales/views/securities/en.yml
+++ b/config/locales/views/securities/en.yml
@@ -4,3 +4,11 @@ en:
     combobox:
       display: "%{symbol} - %{name} (%{exchange})"
       exchange_label: "%{symbol} (%{exchange})"
+    providers:
+      twelve_data: Twelve Data
+      yahoo_finance: Yahoo Finance
+      tiingo: Tiingo
+      eodhd: EODHD
+      alpha_vantage: Alpha Vantage
+      mfapi: MFAPI.in
+      binance_public: Binance
diff --git a/config/locales/views/securities/fr.yml b/config/locales/views/securities/fr.yml
new file mode 100644
index 000000000..f615a2f1c
--- /dev/null
+++ b/config/locales/views/securities/fr.yml
@@ -0,0 +1,14 @@
+---
+fr:
+  securities:
+    combobox:
+      display: "%{symbol} - %{name} (%{exchange})"
+      exchange_label: "%{symbol} (%{exchange})"
+    providers:
+      twelve_data: Twelve Data
+      yahoo_finance: Yahoo Finance
+      tiingo: Tiingo
+      eodhd: EODHD
+      alpha_vantage: Alpha Vantage
+      mfapi: MFAPI.in
+      binance_public: Binance
diff --git a/config/locales/views/securities/hu.yml b/config/locales/views/securities/hu.yml
new file mode 100644
index 000000000..96098788f
--- /dev/null
+++ b/config/locales/views/securities/hu.yml
@@ -0,0 +1,14 @@
+---
+hu:
+  securities:
+    combobox:
+      display: "%{symbol} - %{name} (%{exchange})"
+      exchange_label: "%{symbol} (%{exchange})"
+    providers:
+      twelve_data: Twelve Data
+      yahoo_finance: Yahoo Finance
+      tiingo: Tiingo
+      eodhd: EODHD
+      alpha_vantage: Alpha Vantage
+      mfapi: MFAPI.in
+      binance_public: Binance
diff --git a/config/locales/views/sessions/ca.yml b/config/locales/views/sessions/ca.yml
index 8e87f4b4a..21a73cee8 100644
--- a/config/locales/views/sessions/ca.yml
+++ b/config/locales/views/sessions/ca.yml
@@ -3,34 +3,39 @@ ca:
   sessions:
     create:
       invalid_credentials: Correu electrònic o contrasenya incorrectes.
-      local_login_disabled: L'inici de sessió amb contrasenya local està inhabilitat. Utilitza l'inici de sessió únic.
+      local_login_disabled: L'inici de sessió amb contrasenya local està desactivat.
+        Utilitza l'inici de sessió únic.
     destroy:
       logout_successful: Has tancat la sessió correctament.
     failure:
       failed: No s'ha pogut autenticar.
       sso_failed: L'autenticació d'inici de sessió únic ha fallat. Torna-ho a provar.
-      sso_invalid_response: S'ha rebut una resposta invàlida del proveïdor SSO. Torna-ho
+      sso_invalid_response: S'ha rebut una resposta no vàlida del proveïdor SSO. Torna-ho
         a provar.
-      sso_provider_unavailable: El proveïdor SSO actualment no està disponible. Torna-ho
+      sso_provider_unavailable: El proveïdor SSO no està disponible actualment. Torna-ho
         a provar més tard o contacta amb un administrador.
+    mobile_sso_start:
+      redirecting_html: Redirigint a l'inici de sessió... <a href="%{url}">Fes clic
+        aquí</a> si no se't redirigeix.
     new:
-      demo_banner_message: Aquest és un entorn de demostració. Les credencials d'inici de sessió
-        s'han omplert automàticament per teva comoditat. No introduïis informació real o sensible.
-      demo_banner_title: Mode Demo Actiu
+      demo_banner_message: Aquest és un entorn de demostració. Les credencials d'inici
+        de sessió s'han omplert per comoditat. No introdueixis informació real o sensible.
+      demo_banner_title: Mode demostració actiu
       email: Correu electrònic
       email_placeholder: tu@exemple.com
       forgot_password: Has oblidat la contrasenya?
       google_auth_connect: Inicia sessió amb Google
       local_login_admin_only: L'inici de sessió local està restringit als administradors.
-      no_auth_methods_enabled: Actualment no hi ha cap mètode d'autenticació habilitat. Contacta
-        amb un administrador.
-      openid_connect: Inicia sessió amb OpenID Connect
+      no_auth_methods_enabled: Actualment no hi ha cap mètode d'autenticació habilitat.
+        Contacta amb un administrador.
       oidc: Inicia sessió amb OpenID Connect
+      openid_connect: Inicia sessió amb OpenID Connect
       password: Contrasenya
       password_placeholder: Introdueix la teva contrasenya
       submit: Inicia sessió
-      title: Inicia sessió al teu compte
+      title: Sure
     openid_connect:
+      account_linked: Compte enllaçat correctament a %{provider}
       failed: No s'ha pogut autenticar mitjançant OpenID Connect.
     post_logout:
       logout_successful: Has tancat la sessió correctament.
diff --git a/config/locales/views/sessions/en.yml b/config/locales/views/sessions/en.yml
index ea49a80a0..bf331ca45 100644
--- a/config/locales/views/sessions/en.yml
+++ b/config/locales/views/sessions/en.yml
@@ -16,6 +16,8 @@ en:
       sso_provider_unavailable: "The SSO provider is currently unavailable. Please try again later or contact an administrator."
       sso_invalid_response: "Received an invalid response from the SSO provider. Please try again."
       sso_failed: "Single sign-on authentication failed. Please try again."
+    mobile_sso_start:
+      redirecting_html: "Redirecting to sign in... <a href=\"%{url}\">Click here</a> if not redirected."
     new:
       email: Email address
       email_placeholder: you@example.com
diff --git a/config/locales/views/sessions/fr.yml b/config/locales/views/sessions/fr.yml
index 8e57be388..3f76019af 100644
--- a/config/locales/views/sessions/fr.yml
+++ b/config/locales/views/sessions/fr.yml
@@ -3,8 +3,19 @@ fr:
   sessions:
     create:
       invalid_credentials: Adresse e-mail ou mot de passe invalide.
+      local_login_disabled: La connexion locale par mot de passe est désactivée. Veuillez utiliser l'authentification unique.
     destroy:
       logout_successful: Vous avez été déconnecté avec succès.
+    post_logout:
+      logout_successful: Vous avez été déconnecté avec succès.
+    openid_connect:
+      account_linked: "Compte lié avec succès à %{provider}"
+      failed: Impossible de s'authentifier via OpenID Connect.
+    failure:
+      failed: Impossible de s'authentifier.
+      sso_provider_unavailable: "Le fournisseur SSO est actuellement indisponible. Veuillez réessayer plus tard ou contacter un administrateur."
+      sso_invalid_response: "Réponse invalide reçue du fournisseur SSO. Veuillez réessayer."
+      sso_failed: "Échec de l'authentification unique. Veuillez réessayer."
     new:
       email: Adresse e-mail
       email_placeholder: nom@exemple.fr
@@ -15,3 +26,8 @@ fr:
       password_placeholder: Entrez votre mot de passe
       openid_connect: Se connecter avec OpenID Connect
       oidc: Se connecter avec OpenID Connect
+      google_auth_connect: Se connecter avec Google
+      local_login_admin_only: La connexion locale est réservée aux administrateurs.
+      no_auth_methods_enabled: Aucune méthode d'authentification n'est actuellement activée. Veuillez contacter un administrateur.
+      demo_banner_title: "Mode démo activé"
+      demo_banner_message: "Ceci est un environnement de démonstration. Les identifiants de connexion ont été pré-remplis par commodité. Veuillez ne pas saisir d'informations réelles ou sensibles."
diff --git a/config/locales/views/sessions/hu.yml b/config/locales/views/sessions/hu.yml
new file mode 100644
index 000000000..c1578339f
--- /dev/null
+++ b/config/locales/views/sessions/hu.yml
@@ -0,0 +1,35 @@
+---
+hu:
+  sessions:
+    create:
+      invalid_credentials: Érvénytelen e-mail cím vagy jelszó.
+      local_login_disabled: A helyi jelszavas bejelentkezés le van tiltva. Kérjük, használd az egyszeri bejelentkezést.
+    destroy:
+      logout_successful: Sikeresen kijelentkeztél.
+    post_logout:
+      logout_successful: Sikeresen kijelentkeztél.
+    openid_connect:
+      account_linked: "A fiók sikeresen össze lett kapcsolva a következővel: %{provider}"
+      failed: Nem sikerült hitelesíteni az OpenID Connect segítségével.
+    failure:
+      failed: Nem sikerült hitelesíteni.
+      sso_provider_unavailable: "Az egyszeri bejelentkezés szolgáltatója jelenleg nem elérhető. Kérjük, próbáld újra később, vagy lépj kapcsolatba egy rendszergazdával."
+      sso_invalid_response: "Érvénytelen választ kaptunk az egyszeri bejelentkezés szolgáltatójától. Kérjük, próbáld újra."
+      sso_failed: "Az egyszeri bejelentkezés sikertelen volt. Kérjük, próbáld újra."
+    mobile_sso_start:
+      redirecting_html: "Átirányítás bejelentkezéshez... <a href=\"%{url}\">Kattints ide</a>, ha nincs átirányítás."
+    new:
+      email: E-mail cím
+      email_placeholder: te@pelda.hu
+      forgot_password: Elfelejtetted a jelszavadat?
+      password: Jelszó
+      submit: Bejelentkezés
+      title: Sure
+      password_placeholder: Add meg a jelszavadat
+      openid_connect: Bejelentkezés OpenID Connect segítségével
+      oidc: Bejelentkezés OpenID Connect segítségével
+      google_auth_connect: Bejelentkezés Google-lel
+      local_login_admin_only: A helyi bejelentkezés csak rendszergazdák számára elérhető.
+      no_auth_methods_enabled: Jelenleg nincs engedélyezett hitelesítési módszer. Kérjük, lépj kapcsolatba egy rendszergazdával.
+      demo_banner_title: "Demó mód aktív"
+      demo_banner_message: "Ez egy bemutató környezet. A bejelentkezési adatok előre ki vannak töltve a kényelmed érdekében. Kérjük, ne adj meg valódi vagy érzékeny adatokat."
diff --git a/config/locales/views/settings/api_keys/ca.yml b/config/locales/views/settings/api_keys/ca.yml
index f61afb43b..1082e9419 100644
--- a/config/locales/views/settings/api_keys/ca.yml
+++ b/config/locales/views/settings/api_keys/ca.yml
@@ -2,114 +2,130 @@
 ca:
   settings:
     api_keys:
+      create:
+        success: La teva clau API s'ha creat correctament
       created:
         continue: Continua a la configuració de claus API
         copy_key: Copia la clau API
+        copy_store_securely: Copia i desa aquesta clau de manera segura. La necessitaràs
+          per autenticar les peticions a l'API.
+        created_label: 'Creada:'
         critical_warning_1: Aquesta és l'única vegada que veuràs la teva clau API
           en text pla.
         critical_warning_2: Copia-la i desa-la de manera segura al teu gestor de contrasenyes
           o aplicació.
-        critical_warning_3: Si perds aquesta clau, hauràs de crear-ne una de nova.
-        critical_warning_title: "⚠️ Crític: Desa la teva clau API ara"
+        critical_warning_3: Si perds aquesta clau, n'hauràs de crear una de nova.
+        critical_warning_title: 'Crític: desa ara la teva clau API'
+        key_details_title: Detalls de la clau
         key_name: Nom
+        key_name_label: 'Nom:'
+        key_ready: La teva nova clau API "%{name}" s'ha creat i està a punt per utilitzar.
+        page_title: Clau API creada
         permissions: Permisos
-        success_description: La teva nova clau API està llesta per utilitzar. Assegura't
-          de copiar-la ara, ja que no la podràs tornar a veure.
+        permissions_label: 'Permisos:'
+        security_note_body: Aquesta és l'única vegada que es mostrarà la teva clau
+          API. Assegura't de copiar-la ara i desar-la de manera segura. Si perds aquesta
+          clau, n'hauràs de generar una de nova.
+        security_note_title: Nota de seguretat important
+        success_description: La teva nova clau API s'ha generat correctament.
         success_title: Clau API creada correctament
         title: Clau API creada
         usage_instructions: 'Utilitza la teva clau API incloent-la a la capçalera
           X-Api-Key:'
-        usage_instructions_title: Guia ràpida
-        your_api_key: La teva clau API
-      current_api_key:
-        active: Activa
-        ago: fa
-        created_at: Creat
-        description: La teva clau API activa està llesta per utilitzar. Mantén-la
-          segura i no la comparteixis mai públicament.
-        expires: Caduca
-        key_name: Nom
-        last_used: Últim ús
-        never_expires: No caduca mai
-        never_used: Mai utilitzada
-        permissions: Permisos
-        regenerate_key: Crea nova clau
-        revoke_confirmation: Segur que vols revocar aquesta clau API? Aquesta acció
-          no es pot desfer i desactivarà immediatament totes les aplicacions que utilitzin
-          aquesta clau.
-        revoke_key: Revoca clau
-        title: La teva clau API
-        usage_instructions: 'Inclou la teva clau API a la capçalera X-Api-Key quan
-          facis peticions a l''API de Maybe:'
         usage_instructions_title: Com utilitzar la teva clau API
+        your_api_key: La teva clau API
+      destroy:
+        cannot_revoke: Aquesta clau API no es pot revocar
+        not_found: Clau API no trobada
+        revoke_failed: No s'ha pogut revocar la clau API
+        revoked_successfully: La clau API s'ha revocat correctament
       new:
         cancel: Cancel·la
         create_key: Crea clau API
-        create_new_key: Crea nova clau API
+        create_new_api_key: Crea una nova clau API
         description: Configura la teva nova clau API amb un nom descriptiu i els permisos
           adequats.
-        name_help: Tria un nom descriptiu per identificar la finalitat d'aquesta clau.
+        name_help: Tria un nom descriptiu per ajudar-te a identificar la finalitat
+          d'aquesta clau.
+        name_help_text: Tria un nom descriptiu per ajudar-te a identificar aquesta
+          clau més endavant.
         name_label: Nom de la clau API
-        name_placeholder: p. ex., App Producció, Tauler d'Anàlisi
-        permissions_help: Selecciona els permisos que necessita la teva clau API.
-          Sempre pots crear una nova clau amb permisos diferents.
+        name_placeholder: p. ex., La meva app de pressupost, Seguidor de cartera
+        permissions_help: 'Selecciona els permisos que ha de tenir aquesta clau API:'
         permissions_label: Permisos
+        save_api_key: Desa la clau API
         scope_details:
-          read_accounts: Veure informació de compte, saldos i dades a nivell de compte
-          read_balances: Veure dades històriques de saldo i tendències de valor de
+          read_accounts: Veure informació del compte, saldos i dades a nivell de compte
+          read_balances: Veure dades històriques de saldos i tendències de valor del
             compte
           read_transactions: Veure dades de transaccions, categories i detalls de
             transaccions
-          write_transactions: Crear i actualitzar registres de transaccions (pròximament)
-        security_warning: La teva clau API només es mostrarà una vegada després de
-          la creació. Desa-la de manera segura i no la comparteixis mai públicament.
-          Si la perds, hauràs de crear-ne una de nova.
-        security_warning_title: Avís de seguretat important
+          write_transactions: Crear i actualitzar registres de transaccions (properament)
+        scope_read_only: Només lectura
+        scope_read_only_description: Veure els teus comptes, transaccions i saldos
+        scope_read_write: Lectura/Escriptura
+        scope_read_write_description: Veure les teves dades i crear noves transaccions
+        security_warning: La teva clau API només es mostrarà un cop després de la
+          creació. Desa-la de manera segura i no la comparteixis mai públicament.
+          Si la perds, n'hauràs de crear una de nova.
+        security_warning_body: La teva clau API només es mostrarà un cop després de
+          la creació. Assegura't de copiar-la i desar-la de manera segura. Qualsevol
+          persona amb accés a aquesta clau podrà accedir a les teves dades segons
+          els permisos que seleccionis.
+        security_warning_title: Avís de seguretat
+        subtitle: Genera una nova clau API per accedir a les teves dades de Sure de
+          manera programàtica.
         title: Crea clau API
-      no_api_key:
-        create_api_key: Crea clau API
-        description: Obtingues accés programàtic a les teves dades de Maybe amb una
-          clau API segura.
-        feature_1: Accedeix a les teves dades de compte programàticament
-        feature_2: Construeix integracions i aplicacions personalitzades
-        feature_3: Automatitza la recuperació i anàlisi de dades
-        security_note: La teva clau API tindrà permisos restringits segons els àmbits
-          seleccionats. Només pots tenir una clau API activa alhora.
-        security_note_title: Seguretat primer
-        title: Clau API
-        what_you_can_do: 'Què pots fer amb l''API:'
       show:
         current_api_key:
-          active: Actiu
+          active: Activa
           ago: fa
-          created_at: Creat
-          description: La teva clau API activa està llesta per utilitzar. Mantén-la
+          copy_api_key: Copia la clau API
+          copy_store_securely: Copia i desa aquesta clau de manera segura. La necessitaràs
+            per autenticar les peticions a l'API.
+          created_ago: Creada fa %{time}
+          created_at: Creada
+          description: La teva clau API activa està a punt per utilitzar. Mantén-la
             segura i no la comparteixis mai públicament.
           expires: Caduca
           key_name: Nom
           last_used: Últim ús
+          last_used_ago: Última utilització fa %{time}
           never_expires: No caduca mai
           never_used: Mai utilitzada
           permissions: Permisos
-          regenerate_key: Crea nova clau
+          regenerate_key: Crea una nova clau
           revoke_confirmation: Segur que vols revocar aquesta clau API? Aquesta acció
-            no es pot desfer i desactivarà immediatament totes les aplicacions que utilitzin
-            aquesta clau.
-          revoke_key: Revoca clau
+            no es pot desfer i desactivarà immediatament totes les aplicacions que
+            utilitzin aquesta clau.
+          revoke_key: Revoca la clau
+          scope_read_only: Només lectura
+          scope_read_write: Lectura/Escriptura
           title: La teva clau API
           usage_instructions: 'Inclou la teva clau API a la capçalera X-Api-Key quan
-            facis peticions a l''API de Maybe:'
+            facis peticions a l''API de %{product_name}:'
           usage_instructions_title: Com utilitzar la teva clau API
+        newly_created:
+          continue: Continua a la configuració de claus API
+          copy_api_key: Copia la clau API
+          copy_store_securely: Copia i desa aquesta clau de manera segura. La necessitaràs
+            per autenticar les peticions a l'API.
+          heading: Clau API creada correctament
+          how_to_use: Com utilitzar la teva clau API
+          key_ready: La teva nova clau API "%{name}" s'ha creat i està a punt per
+            utilitzar.
+          page_title: Clau API creada correctament
+          your_api_key: La teva clau API
         no_api_key:
           create_api_key: Crea clau API
-          description: Obtingues accés programàtic a les teves dades de Maybe amb una
-            clau API segura.
-          feature_1: Accedeix a les teves dades de compte programàticament
+          description: Obtén accés programàtic a les teves dades de Sure amb una clau
+            API segura.
+          feature_1: Accedeix a les dades del teu compte de manera programàtica
           feature_2: Construeix integracions i aplicacions personalitzades
           feature_3: Automatitza la recuperació i anàlisi de dades
-          heading: Accedeix a les teves dades de compte programàticament
+          heading: Accedeix a les dades del teu compte de manera programàtica
           security_note: La teva clau API tindrà permisos restringits segons els àmbits
-            seleccionats. Només pots tenir una clau API activa alhora.
+            que seleccionis. Només pots tenir una clau API activa alhora.
           security_note_title: Seguretat primer
           title: Clau API
           what_you_can_do: 'Què pots fer amb l''API:'
diff --git a/config/locales/views/settings/api_keys/en.yml b/config/locales/views/settings/api_keys/en.yml
index 07f25246b..ebc072b88 100644
--- a/config/locales/views/settings/api_keys/en.yml
+++ b/config/locales/views/settings/api_keys/en.yml
@@ -11,6 +11,13 @@ en:
         read_balances: "View Balances"
         write_transactions: "Create Transactions"
     api_keys:
+      create:
+        success: "Your API key has been created successfully"
+      destroy:
+        not_found: "API key not found"
+        cannot_revoke: "This API key cannot be revoked"
+        revoked_successfully: "API key has been revoked successfully"
+        revoke_failed: "Failed to revoke API key"
       show:
         title: "API Key Management"
         no_api_key:
@@ -24,53 +31,85 @@ en:
           security_note_title: "Security First"
           security_note: "Your API key will have restricted permissions based on the scopes you select. You can only have one active API key at a time."
           create_api_key: "Create API Key"
+        newly_created:
+          page_title: "API Key Created Successfully"
+          heading: "API Key Created Successfully!"
+          key_ready: "Your new API key \"%{name}\" has been created and is ready to use."
+          your_api_key: "Your API Key"
+          copy_store_securely: "Copy and store this key securely. You'll need it to authenticate your API requests."
+          copy_api_key: "Copy API Key"
+          how_to_use: "How to use your API key"
+          continue: "Continue to API Key Settings"
         current_api_key:
           title: "Your API Key"
           description: "Your active API key is ready to use. Keep it secure and never share it publicly."
           active: "Active"
           key_name: "Name"
           created_at: "Created"
+          created_ago: "Created %{time} ago"
           last_used: "Last Used"
+          last_used_ago: "Last used %{time} ago"
           expires: "Expires"
           ago: "ago"
           never_used: "Never used"
           never_expires: "Never expires"
           permissions: "Permissions"
+          scope_read_only: "Read Only"
+          scope_read_write: "Read/Write"
+          copy_api_key: "Copy API Key"
+          copy_store_securely: "Copy and store this key securely. You'll need it to authenticate your API requests."
           usage_instructions_title: "How to use your API key"
-          usage_instructions: "Include your API key in the X-Api-Key header when making requests to the Maybe API:"
+          usage_instructions: "Include your API key in the X-Api-Key header when making requests to the %{product_name} API:"
           regenerate_key: "Create New Key"
           revoke_key: "Revoke Key"
           revoke_confirmation: "Are you sure you want to revoke this API key? This action cannot be undone and will immediately disable all applications using this key."
       new:
         title: "Create API Key"
-        create_new_key: "Create New API Key"
+        create_new_api_key: "Create New API Key"
+        subtitle: "Generate a new API key to access your Sure data programmatically."
         description: "Configure your new API key with a descriptive name and appropriate permissions."
         name_label: "API Key Name"
-        name_placeholder: "e.g., Production App, Analytics Dashboard"
+        name_placeholder: "e.g., My Budget App, Portfolio Tracker"
+        name_help_text: "Choose a descriptive name to help you identify this key later."
         name_help: "Choose a descriptive name to help you identify this key's purpose."
         permissions_label: "Permissions"
-        permissions_help: "Select the permissions your API key needs. You can always create a new key with different permissions."
+        permissions_help: "Select the permissions this API key should have:"
+        scope_read_only: "Read Only"
+        scope_read_only_description: "View your accounts, transactions, and balances"
+        scope_read_write: "Read/Write"
+        scope_read_write_description: "View your data and create new transactions"
         scope_details:
           read_accounts: "View account information, balances, and account-level data"
           read_transactions: "View transaction data, categories, and transaction details"
           read_balances: "View historical balance data and account value trends"
           write_transactions: "Create and update transaction records (coming soon)"
-        security_warning_title: "Important Security Notice"
+        security_warning_title: "Security Warning"
+        security_warning_body: "Your API key will be displayed only once after creation. Make sure to copy and store it securely. Anyone with access to this key can access your data according to the permissions you select."
         security_warning: "Your API key will be shown only once after creation. Store it securely and never share it publicly. If you lose it, you'll need to create a new one."
         create_key: "Create API Key"
         cancel: "Cancel"
+        save_api_key: "Save API Key"
       created:
+        page_title: "API Key Created"
         title: "API Key Created"
         success_title: "API Key Created Successfully"
-        success_description: "Your new API key is ready to use. Make sure to copy it now as you won't be able to see it again."
+        success_description: "Your new API key has been generated successfully."
+        key_ready: "Your new API key \"%{name}\" has been created and is ready to use."
         your_api_key: "Your API Key"
+        copy_store_securely: "Copy and store this key securely. You'll need it to authenticate your API requests."
+        key_details_title: "Key Details"
+        key_name_label: "Name:"
+        permissions_label: "Permissions:"
+        created_label: "Created:"
+        security_note_title: "Important Security Note"
+        security_note_body: "This is the only time your API key will be displayed. Make sure to copy it now and store it securely. If you lose this key, you'll need to generate a new one."
+        usage_instructions_title: "How to use your API key"
         key_name: "Name"
         permissions: "Permissions"
-        critical_warning_title: "⚠️ Critical: Save Your API Key Now"
+        critical_warning_title: "Critical: Save Your API Key Now"
         critical_warning_1: "This is the only time you'll see your API key in plain text."
         critical_warning_2: "Copy and store it securely in your password manager or application."
         critical_warning_3: "If you lose this key, you'll need to create a new one."
-        usage_instructions_title: "Quick Start"
         usage_instructions: "Use your API key by including it in the X-Api-Key header:"
         copy_key: "Copy API Key"
         continue: "Continue to API Key Settings"
\ No newline at end of file
diff --git a/config/locales/views/settings/api_keys/fr.yml b/config/locales/views/settings/api_keys/fr.yml
index d039e05c1..9851ab654 100644
--- a/config/locales/views/settings/api_keys/fr.yml
+++ b/config/locales/views/settings/api_keys/fr.yml
@@ -13,39 +13,40 @@ fr:
     api_keys:
       show:
         title: "Gestion des clés API"
-      no_api_key:
-        title: "Clé API"
-        description: "Accédez de manière programmée à vos données %{product_name} avec une clé API sécurisée."
-        what_you_can_do: "Ce que vous pouvez faire avec l'API :"
-        feature_1: "Accéder à vos données de compte de manière automatisée"
-        feature_2: "Construire des intégrations et applications personnalisées"
-        feature_3: "Automatiser la récupération et l'analyse des données"
-        security_note_title: "Sécurité avant tout"
-        security_note: "Votre clé API aura des autorisations limitées en fonction des domaines que vous sélectionnez. Vous ne pouvez avoir qu'une seule clé API active à la fois."
-        create_api_key: "Créer une clé API"
-      current_api_key:
-        title: "Votre Clé API"
-        description: "Votre clé API active est prête à être utilisée. Gardez-la en sécurité et ne la partagez jamais publiquement."
-        active: "Active"
-        key_name: "Nom"
-        created_at: "Créée le"
-        last_used: "Dernière utilisation"
-        expires: "Expire le"
-        ago: "il y a"
-        never_used: "Jamais utilisée"
-        never_expires: "N'expire jamais"
-        permissions: "Autorisations"
-        usage_instructions_title: "Comment utiliser votre clé API"
-        usage_instructions: "Incluez votre clé API dans l'en-tête X-Api-Key lors des requêtes à l'API %{product_name} :"
-        regenerate_key: "Créer une nouvelle clé"
-        revoke_key: "Révoquer la clé"
-        revoke_confirmation: "Êtes-vous sûr de vouloir révoquer cette clé API ? Cette action ne peut pas être annulée et désactivera immédiatement toutes les applications utilisant cette clé."
+        no_api_key:
+          title: "Clé API"
+          heading: "Accédez à vos données de compte par programmation"
+          description: "Accédez de manière programmée à vos données Sure avec une clé API sécurisée."
+          what_you_can_do: "Ce que vous pouvez faire avec l'API :"
+          feature_1: "Accéder à vos données de compte de manière automatisée"
+          feature_2: "Construire des intégrations et applications personnalisées"
+          feature_3: "Automatiser la récupération et l'analyse des données"
+          security_note_title: "Sécurité avant tout"
+          security_note: "Votre clé API aura des autorisations limitées en fonction des domaines que vous sélectionnez. Vous ne pouvez avoir qu'une seule clé API active à la fois."
+          create_api_key: "Créer une clé API"
+        current_api_key:
+          title: "Votre Clé API"
+          description: "Votre clé API active est prête à être utilisée. Gardez-la en sécurité et ne la partagez jamais publiquement."
+          active: "Active"
+          key_name: "Nom"
+          created_at: "Créée le"
+          last_used: "Dernière utilisation"
+          expires: "Expire le"
+          ago: "il y a"
+          never_used: "Jamais utilisée"
+          never_expires: "N'expire jamais"
+          permissions: "Autorisations"
+          usage_instructions_title: "Comment utiliser votre clé API"
+          usage_instructions: "Incluez votre clé API dans l'en-tête X-Api-Key lors des requêtes à l'API %{product_name} :"
+          regenerate_key: "Créer une nouvelle clé"
+          revoke_key: "Révoquer la clé"
+          revoke_confirmation: "Êtes-vous sûr(e) de vouloir révoquer cette clé API ? Cette action ne peut pas être annulée et désactivera immédiatement toutes les applications utilisant cette clé."
       new:
         title: "Créer une clé API"
         create_new_key: "Créer une nouvelle clé API"
         description: "Configurez votre nouvelle clé API avec un nom descriptif et des autorisations appropriées."
         name_label: "Nom de la clé API"
-        name_placeholder: "Application de production, Tableau de bord analytique"
+        name_placeholder: "ex., Application de production, Tableau de bord analytique"
         name_help: "Choisissez un nom descriptif pour vous aider à identifier l'objectif de cette clé."
         permissions_label: "Autorisations"
         permissions_help: "Sélectionnez les autorisations nécessaires pour votre clé API. Vous pouvez toujours créer une nouvelle clé avec des autorisations différentes."
diff --git a/config/locales/views/settings/api_keys/hu.yml b/config/locales/views/settings/api_keys/hu.yml
new file mode 100644
index 000000000..ad0df2325
--- /dev/null
+++ b/config/locales/views/settings/api_keys/hu.yml
@@ -0,0 +1,116 @@
+---
+hu:
+  settings:
+    api_keys_controller:
+      success: "Az API-kulcsod sikeresen létrehozva"
+      revoked_successfully: "Az API-kulcs sikeresen visszavonva"
+      revoke_failed: "Nem sikerült visszavonni az API-kulcsot"
+      scope_descriptions:
+        read_accounts: "Fiókok megtekintése"
+        read_transactions: "Tranzakciók megtekintése"
+        read_balances: "Egyenlegek megtekintése"
+        write_transactions: "Tranzakciók létrehozása"
+    api_keys:
+      create:
+        success: "Az API-kulcsod sikeresen létrehozva"
+      destroy:
+        not_found: "Az API-kulcs nem található"
+        cannot_revoke: "Ez az API-kulcs nem vonható vissza"
+        revoked_successfully: "Az API-kulcs sikeresen visszavonva"
+        revoke_failed: "Nem sikerült visszavonni az API-kulcsot"
+      show:
+        title: "API-kulcs kezelése"
+        no_api_key:
+          title: "API-kulcs"
+          heading: "Fiókadatok elérése API-n keresztül"
+          description: "Szerezz programozható hozzáférést a Sure-adataidhoz egy biztonságos API-kulccsal."
+          what_you_can_do: "Mit tehetsz az API-val:"
+          feature_1: "Fiókadatok elérése API-n keresztül"
+          feature_2: "Egyéni integrációk és alkalmazások készítése"
+          feature_3: "Adatlekérés és -elemzés automatizálása"
+          security_note_title: "Biztonság az első"
+          security_note: "Az API-kulcsodnak korlátozott jogosultságai lesznek a kiválasztott hatókörök alapján. Egyszerre csak egy aktív API-kulcsod lehet."
+          create_api_key: "API-kulcs létrehozása"
+        newly_created:
+          page_title: "API-kulcs sikeresen létrehozva"
+          heading: "API-kulcs sikeresen létrehozva!"
+          key_ready: "Az új \"%{name}\" API-kulcsod létrehozva és készen áll a használatra."
+          your_api_key: "Az API-kulcsod"
+          copy_store_securely: "Másold le és tárold biztonságosan. Szükséged lesz rá az API-kérések hitelesítéséhez."
+          copy_api_key: "API-kulcs másolása"
+          how_to_use: "Az API-kulcs használata"
+          continue: "Tovább az API-kulcs beállításaihoz"
+        current_api_key:
+          title: "Az API-kulcsod"
+          description: "Az aktív API-kulcsod készen áll a használatra. Tartsd biztonságban, és soha ne oszd meg nyilvánosan."
+          active: "Aktív"
+          key_name: "Név"
+          created_at: "Létrehozva"
+          created_ago: "Létrehozva %{time} ezelőtt"
+          last_used: "Utoljára használva"
+          last_used_ago: "Utoljára használva %{time} ezelőtt"
+          expires: "Lejár"
+          ago: "ezelőtt"
+          never_used: "Még nem használt"
+          never_expires: "Nem jár le"
+          permissions: "Jogosultságok"
+          scope_read_only: "Csak olvasható"
+          scope_read_write: "Olvasás/Írás"
+          copy_api_key: "API-kulcs másolása"
+          copy_store_securely: "Másold le és tárold biztonságosan. Szükséged lesz rá az API-kérések hitelesítéséhez."
+          usage_instructions_title: "Az API-kulcs használata"
+          usage_instructions: "Add meg az API-kulcsodat az X-Api-Key fejlécben, amikor kéréseket küldesz a(z) %{product_name} API-nak:"
+          regenerate_key: "Új kulcs létrehozása"
+          revoke_key: "Kulcs visszavonása"
+          revoke_confirmation: "Biztosan vissza szeretnéd vonni ezt az API-kulcsot? Ez a művelet nem vonható vissza, és azonnal letiltja az összes ezt a kulcsot használó alkalmazást."
+      new:
+        title: "API-kulcs létrehozása"
+        create_new_api_key: "Új API-kulcs létrehozása"
+        subtitle: "Generálj új API-kulcsot a Sure-adataid programozható eléréséhez."
+        description: "Konfiguráld az új API-kulcsodat leíró névvel és megfelelő jogosultságokkal."
+        name_label: "API-kulcs neve"
+        name_placeholder: "pl.: Éles alkalmazás, Elemzési irányítópult"
+        name_help_text: "Válassz leíró nevet, amely segít azonosítani a kulcsot."
+        name_help: "Válassz leíró nevet, amely segít azonosítani a kulcs célját."
+        permissions_label: "Jogosultságok"
+        permissions_help: "Válaszd ki az API-kulcsod számára szükséges jogosultságokat:"
+        scope_read_only: "Csak olvasható"
+        scope_read_only_description: "Fiókok, tranzakciók és egyenlegek megtekintése"
+        scope_read_write: "Olvasás/Írás"
+        scope_read_write_description: "Adatok megtekintése és új tranzakciók létrehozása"
+        scope_details:
+          read_accounts: "Fiókinformációk, egyenlegek és fiókszintű adatok megtekintése"
+          read_transactions: "Tranzakciós adatok, kategóriák és tranzakciós részletek megtekintése"
+          read_balances: "Korábbi egyenlegadatok és fiókérték-trendek megtekintése"
+          write_transactions: "Tranzakciók létrehozása és frissítése (hamarosan)"
+        security_warning_title: "Biztonsági figyelmeztetés"
+        security_warning_body: "Az API-kulcsod csak egyszer jelenik meg a létrehozás után. Győződj meg róla, hogy lemásolod és biztonságosan tárolod. Bárki, aki hozzáfér ehhez a kulcshoz, a kiválasztott jogosultságoknak megfelelően hozzáférhet az adataidhoz."
+        security_warning: "Az API-kulcsod csak egyszer jelenik meg a létrehozás után. Tárold biztonságosan, és soha ne oszd meg nyilvánosan. Ha elveszíted, új kulcsot kell létrehoznod."
+        create_key: "API-kulcs létrehozása"
+        cancel: "Mégse"
+        save_api_key: "API-kulcs mentése"
+      created:
+        page_title: "API-kulcs létrehozva"
+        title: "API-kulcs létrehozva"
+        success_title: "API-kulcs sikeresen létrehozva"
+        success_description: "Az új API-kulcsod sikeresen generálva."
+        key_ready: "Az új \"%{name}\" API-kulcsod létrehozva és készen áll a használatra."
+        your_api_key: "Az API-kulcsod"
+        copy_store_securely: "Másold le és tárold biztonságosan. Szükséged lesz rá az API-kérések hitelesítéséhez."
+        key_details_title: "Kulcs adatai"
+        key_name_label: "Név:"
+        permissions_label: "Jogosultságok:"
+        created_label: "Létrehozva:"
+        security_note_title: "Fontos biztonsági megjegyzés"
+        security_note_body: "Ez az egyetlen alkalom, amikor az API-kulcsod megjelenik. Mindenképpen másold le most és tárold biztonságosan. Ha elveszíted, újat kell generálnod."
+        usage_instructions_title: "Az API-kulcs használata"
+        key_name: "Név"
+        permissions: "Jogosultságok"
+        critical_warning_title: "⚠️ Kritikus: Mentsd el az API-kulcsodat most"
+        critical_warning_1: "Ez az egyetlen alkalom, amikor az API-kulcsod egyszerű szövegként látható."
+        critical_warning_2: "Másold le és tárold biztonságosan a jelszókezelődben vagy az alkalmazásodban."
+        critical_warning_3: "Ha elveszíted ezt a kulcsot, újat kell létrehoznod."
+        usage_instructions_title: "Az API-kulcs használata"
+        usage_instructions: "Használd az API-kulcsodat az X-Api-Key fejlécbe illesztve:"
+        copy_key: "API-kulcs másolása"
+        continue: "Tovább az API-kulcs beállításaihoz"
diff --git a/config/locales/views/settings/ca.yml b/config/locales/views/settings/ca.yml
index 5d43209eb..9df987673 100644
--- a/config/locales/views/settings/ca.yml
+++ b/config/locales/views/settings/ca.yml
@@ -1,9 +1,5 @@
 ---
 ca:
-  views:
-    settings:
-      payments:
-        renewal: "La teva contribució continua el %{date}."
   settings:
     ai_prompts:
       show:
@@ -23,18 +19,125 @@ ca:
           subtitle: La IA categoritza automàticament les teves transaccions segons
             les categories definides
           title: Categoritzador de transaccions
-    payments:
+    appearances:
       show:
-        page_title: Pagament
-        subscription_subtitle: Actualitza la teva subscripció i dades de pagament
-        subscription_title: Gestiona la subscripció
+        dashboard_subtitle: Personalitza com es mostra el tauler de control
+        dashboard_title: Tauler de control
+        dashboard_two_column_description: Mostra els ginys del tauler en dues columnes
+          en pantalles grans. Si està desactivat, els ginys s'apilen en una sola columna.
+        dashboard_two_column_title: Disseny a dues columnes
+        page_title: Aparença
+        split_grouped_description: Mostra les transaccions dividides agrupades sota
+          la seva matriu a la llista de transaccions. Si està desactivat, els fills
+          apareixen com a files individuals.
+        split_grouped_title: Agrupa les transaccions dividides
+        theme_dark: Fosc
+        theme_light: Clar
+        theme_subtitle: Tria el tema preferit per a l'aplicació
+        theme_system: Sistema
+        theme_title: Tema
+        transactions_subtitle: Personalitza com es mostren les transaccions
+        transactions_title: Transaccions
+    debugs:
+      show:
+        context:
+          account: account=%{value}
+          account_provider: account_provider=%{value}
+          family: family=%{value}
+          provider: provider=%{value}
+          user: user=%{value}
+        empty: No s'han trobat esdeveniments de depuració.
+        filters:
+          account_id: ID del compte
+          account_provider_id: ID del proveïdor del compte
+          all: Tots
+          category: Categoria
+          end_date: Fins
+          family_id: ID de la família
+          level: Nivell
+          provider: Proveïdor
+          reset: Restableix
+          source: Origen
+          start_date: Des de
+          submit: Filtra
+          user_id: ID de l'usuari
+        missing_value: "-"
+        page_title: Depuració
+        subtitle: Esdeveniments operatius rellevants per a superadministradors. Els
+          més nous primer.
+        table:
+          category: Categoria
+          context: Context
+          level: Nivell
+          message: Missatge
+          metadata: Metadades
+          source: Origen
+          time: Hora
+          view_metadata: Veure
+        title: Registre d'esdeveniments de depuració
     hostings:
       ensure_admin:
         not_authorized: No autoritzat
+    llm_usages:
+      show:
+        avg_cost_per_request: Cost mitjà/sol·licitud
+        based_on_requests: Basat en %{with_cost} de %{total} sol·licituds amb dades
+          de cost
+        col_cost: Cost
+        col_date: Data
+        col_model: Model
+        col_operation: Operació
+        col_tokens: Tokens
+        completion: completació
+        cost_by_model: Cost per model
+        cost_by_operation: Cost per operació
+        cost_estimates_description: Els costos s'estimen segons els preus d'OpenAI
+          de 2025. Els costos reals poden variar. El preu és per cada milió de tokens
+          i varia segons el model. Els models personalitzats o amb self hosting mostraran
+          "N/D" i no s'inclouen als totals de cost.
+        cost_estimates_title: Sobre les estimacions de cost
+        end_date: Data de fi
+        failed: Errades
+        filter: Filtra
+        no_usage_data: No s'han trobat dades d'ús per al període seleccionat
+        page_title: Ús i costos d'LLM
+        prompt: prompt
+        recent_usage: Ús recent
+        start_date: Data d'inici
+        subtitle: Fes el seguiment del teu ús d'IA i els costos estimats
+        total_cost: Cost total
+        total_requests: Total de sol·licituds
+        total_tokens: Total de tokens
+    payments:
+      show:
+        choose_level: Tria un nivell
+        contributions_note: Les contribucions a %{product_name} apareixeran aquí.
+        currently_on_plan: 'Actualment al pla:'
+        manage: Gestiona
+        not_contributing_emphasis: no contribueixes
+        not_contributing_prefix: Actualment
+        page_title: Pagaments
+        payment_via_stripe: Pagament a través de Stripe
+        subscription_subtitle: Actualitza les teves dades de targeta de crèdit
+        subscription_title: Gestiona contribucions
+        trial_days_left:
+          one: Les dades s'eliminaran en %{count} dia
+          other: Les dades s'eliminaran en %{count} dies
+        trialing: Actualment fas servir la demostració oberta de %{product_name}
     preferences:
       show:
+        additional_currencies_label: Divises addicionals
+        base_currency_badge: Divisa base
+        base_currency_label: Divisa base
+        preview:
+          description: Activa funcions en desenvolupament etiquetades com a experimentals o canary.
+          title: Activa funcions experimentals
         country: País
-        currency: Moneda
+        currencies_more: "+%{count} més"
+        currencies_subtitle: Tria quines divises apareixen als camps de diners
+        currencies_title: Divises
+        currency: Divisa
+        currency_search_placeholder: Cerca divises
         date_format: Format de data
         default_account_order: Ordre de comptes per defecte
         default_period: Període per defecte
@@ -42,12 +145,30 @@ ca:
         general_title: General
         language: Idioma
         language_auto: Idioma del navegador
+        manage_currencies: Gestiona divises
+        manage_currencies_subtitle: Desmarca les divises que mai utilitzes, o redueix
+          la llista a unes poques.
+        month_start_day: El mes del pressupost comença el
+        month_start_day_hint: Estableix quan comença el teu mes pressupostari (p.
+          ex., dia de cobrament)
+        month_start_day_warning: Els teus pressupostos i càlculs MTD utilitzaran aquest
+          dia d'inici personalitzat en lloc del dia 1 de cada mes.
+        translations_notice: Tingues en compte que encara estem treballant en les traduccions
+          a diversos idiomes.
+        no_additional_currencies: Cap seleccionada
+        no_matching_currencies: No s'han trobat divises
         page_title: Preferències
-        theme_dark: Fosc
-        theme_light: Clar
-        theme_subtitle: Tria el tema preferit per a l'aplicació
-        theme_system: Sistema
-        theme_title: Tema
+        save_currencies: Desa les divises
+        select_all_currencies: Selecciona-ho tot
+        select_base_only: Només la divisa base
+        selected_currencies_count:
+          one: "%{count} seleccionada"
+          other: "%{count} seleccionades"
+        sharing_default_label: Compartició predeterminada per a comptes nous
+        sharing_private: Mantén privat per defecte
+        sharing_shared: Comparteix amb tots els membres
+        sharing_subtitle: Controla com es comparteixen els comptes entre els membres
+        sharing_title: Compartició de comptes
         timezone: Fus horari
     profiles:
       destroy:
@@ -82,10 +203,13 @@ ca:
           les teves dades i no es podrà desfer.
         email: Correu electrònic
         first_name: Nom
+        group_form_input_placeholder: Introdueix el nom del grup
+        group_form_label: Nom del grup
+        group_title: Membres del grup
         household_form_input_placeholder: Introdueix el nom de la llar
         household_form_label: Nom de la llar
-        household_subtitle: Convida membres de la família, parelles i altres persones.
-          Els convidats podran accedir al teu compte familiar i als comptes compartits.
+        household_subtitle: Els convidats poden iniciar sessió al teu compte de %{moniker}
+          i accedir als recursos compartits.
         household_title: Llar
         invitation_link: Enllaç d'invitació
         invite_member: Afegeix membre
@@ -103,49 +227,346 @@ ca:
         reset_account_with_sample_data_warning: Elimina totes les teves dades existents
           i carrega dades d'exemple per explorar amb un entorn preomplert.
         save: Desa
+    providers:
+      bank_sync:
+        lede: Connecta comptes externs perquè transaccions, saldos i posicions flueixin
+          automàticament a Sure.
+        page_title: Sincronització bancària
+      binance_panel:
+        api_key_label: Clau API
+        api_key_placeholder: Enganxa la teva clau API de Binance
+        api_secret_label: Secret de l'API
+        api_secret_placeholder: Enganxa el teu secret de l'API de Binance
+        connect_button: Connecta Binance
+        disconnect_confirm: Segur que vols desconnectar Binance?
+        ip_hint_body: 'Afegeix la IP de sortida del servidor de l''aplicació a la
+          llista blanca de la clau API de Binance:'
+        ip_hint_contact_admin: Contacta amb el teu administrador per obtenir la IP
+          de sortida del servidor de l'aplicació.
+        ip_hint_title: Cal incloure la IP a la llista blanca
+        no_withdraw_body: No activis permisos de retirada en crear la teva clau API
+          de Binance. Sure només necessita accés de lectura.
+        no_withdraw_title: Només clau de lectura
+        setup_instructions: 'Per connectar Binance, crea una clau API de només lectura:'
+        step1_html: Ves a <a href="https://www.binance.com/en/my/settings/api-management"
+          target="_blank" rel="noopener noreferrer" class="underline">Binance API
+          Management</a>
+        step2: Crea una nova clau API només amb el permís Enable Reading
+        step3: Enganxa la teva clau API i secret a sota
+        sync: Sincronitza
+        syncing: Sincronitzant...
+      clear_filter: Neteja filtres
+      coinbase_panel:
+        api_key_label: Clau API
+        api_key_placeholder: Introdueix la teva clau API de Coinbase
+        api_secret_label: Secret de l'API
+        api_secret_placeholder: Introdueix el teu secret de l'API de Coinbase
+        connect_button: Connecta Coinbase
+        disconnect_confirm: Segur que vols desconnectar aquesta connexió de Coinbase?
+          Els teus comptes sincronitzats passaran a ser comptes manuals.
+        setup_instructions: 'Per connectar Coinbase:'
+        step1_html: Ves a <a href="https://portal.cdp.coinbase.com/projects/api-keys"
+          target="_blank" rel="noopener noreferrer" class="text-primary underline">Coinbase
+          API Settings</a>
+        step2: Crea una nova clau API amb permisos de només lectura (veure comptes,
+          veure transaccions)
+        step3: Copia la teva clau API i secret de l'API i enganxa'ls a sota
+        sync: Sincronitza
+        syncing: Sincronitzant...
+      connect: Connecta
+      drawer_trust_statement: Accés només de lectura. Sure mai no pot moure diners
+        i les teves credencials s'emmagatzemen xifrades.
+      empty_filter: Cap proveïdor coincideix amb el teu filtre.
+      enable_banking_panel:
+        add_connection: Afegeix connexió
+        application_id_label: ID d'aplicació
+        application_id_placeholder_new: Introdueix l'ID d'aplicació
+        application_id_placeholder_update: Introdueix el nou ID per actualitzar
+        callback_url_instruction: Per a l'URL de retorn de trucada, fes servir %{callback_url}.
+        client_certificate_label: Certificat de client (amb clau privada)
+        config_locked_message: Desconnecta tots els bancs vinculats abans de canviar
+          aquestes credencials.
+        config_locked_title: Configuració bloquejada
+        configured: Configurat
+        connect_bank: Connecta banc
+        connected_bank: Banc connectat
+        connection: Connexió
+        connection_error: Error de connexió
+        country_label: País
+        ready_to_link: Llest per enllaçar comptes
+        reconnect: Reconnecta
+        remove: Elimina
+        remove_confirm: Segur que vols eliminar aquesta connexió?
+        save_and_connect: Desa i connecta
+        select_country: Selecciona país...
+        session_expired_reconnect: Sessió expirada — reconnecta
+        session_expires: 'La sessió expira: %{date}'
+        step_1_html: Ves a %{link} i obtén les teves credencials de desenvolupador.
+        step_2: Tria el teu país i enganxa l'ID d'aplicació + certificat de client
+          a sota.
+        step_3: Desa, després utilitza Afegeix connexió per enllaçar el teu banc.
+        sync: Sincronitza
+        syncing: Sincronitzant
+        unknown: Desconegut
+        update_connection: Actualitza connexió
+      encryption_error:
+        message: La sincronització bancària requereix Active Record encryption configurat.
+          Estableix primary_key, deterministic_key i key_derivation_salt a les teves
+          credencials de Rails o variables d'entorn.
+        title: Falten les claus de xifratge
+      groups:
+        available: Disponibles
+        empty_available: Tots els proveïdors disponibles estan connectats.
+        your_connections: Les teves connexions
+      health_strip:
+        accounts_syncing: comptes sincronitzant-se
+        connected: connectats
+        last_synced: Última sincronització fa %{time}
+        needs_attention: necessita atenció
+      ibkr_panel:
+        accounts_tab: Comptes
+        configuration:
+          all_other_options: 'Tota la resta d''opcions de configuració: "No"'
+          date_format: 'Format de data: yyyy-MM-dd'
+          date_time_separator: 'Separador de data/hora: ; (punt i coma)'
+          format: 'Format: XML'
+          models: 'Models: Opcional'
+          period: 'Període: Últims 365 dies naturals'
+          profit_and_loss: 'Pèrdues i guanys: Per defecte'
+          time_format: 'Format d''hora: HH:mm:ss'
+        disconnect_confirm: Vols desconnectar Interactive Brokers?
+        flex_query_details:
+          configuration_heading: Estableix aquestes opcions de consulta
+          eyebrow: Flex Query
+          sections_heading: Activa aquestes seccions i camps
+          summary: Expandeix per veure les seccions, camps i configuració exactes
+            que ha d'incloure la teva Flex Query d'activitat d'IBKR.
+          title: Seccions, camps i configuració
+        not_configured: No configurat.
+        query_id_label: ID de consulta
+        query_id_placeholder_existing: Deixa en blanc per mantenir l'ID actual
+        query_id_placeholder_new: Introdueix el teu ID de Flex Query d'IBKR
+        report_window_note: Els informes Flex d'IBKR estan limitats a la finestra
+          de consulta configurada a IBKR. Sure importarà les posicions actuals completes
+          més fins a 365 dies d'activitat d'aquest informe.
+        save_configuration: Desa la configuració
+        sections:
+          account_information: 'Account Information: Account ID, Currency'
+          cash_report: 'Cash Report:'
+          cash_report_fields: 'Fields: Currency, Ending Cash'
+          cash_report_options: 'Options: None'
+          cash_transactions: 'Cash Transactions:'
+          cash_transactions_fields: 'Fields: Amount, Conid, Currency, FX Rate To Base,
+            Report Date, Transaction ID, Type'
+          cash_transactions_options: 'Options: Dividends, Deposits & Withdrawals,
+            Detail'
+          change_in_position_value_summary: 'Change In Position Value Summary: Currency,
+            End Of Period Value'
+          net_asset_value: 'Net Asset Value (NAV) in Base:'
+          net_asset_value_fields: 'Fields: Currency, Report Date, Total'
+          net_asset_value_options: 'Options: None'
+          open_positions: 'Open Positions:'
+          open_positions_fields: 'Fields: Asset Class, Conid, Cost Basis Price, Currency,
+            FX Rate To Base, Mark Price, Quantity, Report Date, Security ID, Security
+            ID Type, Side, Symbol'
+          open_positions_options: 'Options: Summary'
+          trades: 'Trades:'
+          trades_fields: 'Fields: Asset Class, Buy/Sell, Conid, Currency, FX Rate
+            To Base, IB Commission, IB Commission Currency, Quantity, Symbol, Trade
+            Date, Trade ID, TradePrice, Transaction ID'
+          trades_options: 'Options: Execution'
+        status_configured_prefix: "%{summary}. Visita la"
+        status_configured_suffix: pestanya per gestionar els comptes descoberts.
+        steps:
+          step_1: Al teu IBKR Client Portal, navega a "Performance & Reports" > "Flex
+            Queries".
+          step_2: Fes clic a la icona "+" a la secció "Activity Flex Query" per crear
+            una nova consulta.
+          step_3: Anomena la teva consulta (p. ex., "Sure Sync"), després revisa els
+            detalls de la Flex Query a sota i activa les seccions, camps i opcions
+            de configuració llistades.
+          step_4: Desa la consulta, anota el teu "Query ID", després usa la icona
+            d'engranatge a la secció "Flex Web Service Configuration" per generar
+            un Token d'accés.
+          step_5: Enganxa el teu Query ID i Token a sota, desa la configuració, i
+            ves a Comptes per enllaçar els comptes d'IBKR descoberts.
+        sync: Sincronitza
+        token_label: Token
+        token_placeholder_existing: Deixa en blanc per mantenir el Token actual
+        token_placeholder_new: Introdueix el teu Token d'IBKR Flex Web Service
+        update_configuration: Actualitza la configuració
+      kraken_panel:
+        add_connection: Afegeix connexió Kraken
+        api_key_label: Clau API
+        api_key_placeholder: Enganxa la teva clau API de Kraken
+        api_secret_label: Clau privada
+        api_secret_placeholder: Enganxa la teva clau privada de Kraken
+        connection_name_label: Nom de la connexió
+        connection_name_placeholder: Kraken principal
+        default_connection_name: Kraken
+        disconnect: Desconnecta
+        disconnect_confirm: Segur que vols desconnectar %{name}?
+        keep_api_key_placeholder: Deixa en blanc per mantenir la clau API existent
+        keep_api_secret_placeholder: Deixa en blanc per mantenir la clau privada existent
+        read_only_body: No atorguis permisos de trading, cancel·lació, retirada, exportació,
+          llibre major, Earn, staking o transferència. Sure només importa saldos,
+          posicions i operacions spot.
+        read_only_title: Sincronització només de lectura amb l'exchange
+        setup_accounts: Configura compte
+        step1_html: Ves a <a href="https://pro.kraken.com/app/settings/api" target="_blank"
+          rel="noopener noreferrer" class="underline">Kraken API settings</a>
+        step2: Crea una clau API només amb Query Funds i Query Closed Orders & Trades.
+        step3: Enganxa la clau API i la clau privada a sota.
+        sync: Sincronitza
+        syncing: Sincronitzant...
+        update_connection: Actualitza connexió
+      lunchflow_panel:
+        api_key_label: Clau API
+        api_key_placeholder_new: Enganxa la clau API aquí
+        api_key_placeholder_update: Introdueix la nova clau API per actualitzar
+        base_url_label: URL base (opcional)
+        base_url_placeholder: https://lunchflow.app/api/v1 (per defecte)
+        save_and_connect: Desa i connecta
+        step_1_html: Ves a %{link} i crea una clau API.
+        step_2: Enganxa la teva clau a sota i connecta.
+        step_3: Després ves a Comptes per enllaçar els teus comptes sincronitzats.
+        update_connection: Actualitza connexió
+      maturity:
+        alpha: Alfa
+        beta: Beta
+      meta:
+        last_synced: Sincronitzat fa %{time}
+        no_recent_sync: Sincronització vençuda
+        reconsent_needed:
+          one: Cal renovar el consentiment en 1 dia
+          other: Cal renovar el consentiment en %{count} dies
+        reconsent_required: Cal renovar el consentiment
+        registration_needed: Cal registrar-se
+        sync_error: Error de sincronització
+      not_authorized: No autoritzat
+      not_found: Proveïdor no trobat.
+      plaid_eu_panel:
+        step_1_html: Obre el %{link} i copia el teu Client ID i Secret Key d'UE.
+      plaid_panel:
+        step_1_html: Obre el %{link} i copia el teu Client ID i Secret Key.
+        step_2: Tria un entorn. Fes servir sandbox per a proves i production per a
+          comptes reals.
+        step_3: Enganxa les teves credencials a sota i connecta.
+      recently_synced: Sincronitzat recentment. Torna-ho a provar d'aquí a un moment.
+      search_filters:
+        aria_label: Cerca proveïdors
+        chips:
+          all: Tots
+          bank: Bancs
+          crypto: Cripto
+          investment: Inversions
+        placeholder: Cerca proveïdors
+      setup_steps:
+        eyebrow: Configuració
+        need_help: Necessites ajuda?
+      simplefin_panel:
+        save_and_connect: Desa i connecta
+        setup_token_label: Token de configuració
+        setup_token_placeholder: Enganxa el token de configuració de SimpleFIN
+        step_1_html: Ves a %{link} per obtenir un token d'un sol ús.
+        step_2: Enganxa el token a sota i connecta.
+        step_3: Després ves a Comptes per enllaçar els teus comptes sincronitzats.
+      status:
+        err: Error
+        off: No configurat
+        ok: Connectat
+        warn: Cal acció
+      sync_all: Sincronitza-ho tot
+      sync_all_in_progress: Sincronitzant tots els proveïdors connectats…
+      sync_all_recently: Sincronització ja en curs. Torna-ho a provar d'aquí a un
+        moment.
+      sync_provider: Sincronitza ara
+      sync_provider_in_progress: Sincronització iniciada.
+      sync_provider_no_items: No hi ha connexions disponibles per sincronitzar.
+      taglines:
+        binance: Sincronitza els teus saldos spot de Binance utilitzant una clau API
+          de només lectura.
+        brex: Sincronitza l'activitat d'efectiu i targeta corporativa de Brex amb
+          accés de només lectura.
+        coinbase: Importa les teves posicions cripto de Coinbase i fes el seguiment
+          del rendiment.
+        coinstats: Fes el seguiment de tota la teva cartera cripto a través de carteres
+          i exchanges.
+        enable_banking: Sincronitza comptes bancaris europeus mitjançant l'open banking
+          PSD2.
+        ibkr: Sincronitza comptes d'inversió d'Interactive Brokers mitjançant importacions
+          Flex Query.
+        indexa_capital: Fes el seguiment de la teva cartera d'inversió automatitzada
+          d'Indexa Capital.
+        kraken: Sincronitza saldos i operacions spot de Kraken utilitzant una clau
+          API de només lectura.
+        lunchflow: Connecta més de 20.000 bancs de més de 40 països (Regne Unit, UE,
+          EUA i més!).
+        mercury: Sincronitza automàticament els teus comptes bancaris empresarials
+          de Mercury.
+        plaid: Connecta milers d'institucions financeres dels EUA mitjançant Plaid.
+        plaid_eu: Connecta institucions financeres europees mitjançant Plaid (PSD2
+          / Open Banking).
+        simplefin: Connecta comptes bancaris dels EUA mitjançant el protocol obert
+          SimpleFIN.
+        snaptrade: Connecta comptes d'inversió mitjançant la xarxa d'agregació SnapTrade.
+        sophtron: Connecta bancs i serveis dels EUA i Canadà.
+      update:
+        no_changes: No s'ha fet cap canvi
+        updated_successfully: Configuració del proveïdor actualitzada correctament
     securities:
       show:
-        page_title: Valor
+        page_title: Seguretat
         sso_confirm_body: Segur que vols desconnectar el teu compte de %{provider}?
-          Pots tornar-lo a connectar més tard iniciant sessió amb aquest proveïdor una altra vegada.
+          Pots tornar-lo a connectar més tard iniciant sessió amb aquest proveïdor
+          una altra vegada.
         sso_confirm_button: Desconnecta
         sso_confirm_title: Desconnectar compte?
-        sso_connect_hint: Tanca sessió i inicia amb un proveïdor SSO per connectar un compte.
+        sso_connect_hint: Tanca sessió i inicia amb un proveïdor SSO per connectar
+          un compte.
         sso_disconnect: Desconnecta
         sso_last_used: Darrer ús
         sso_never: Mai
         sso_no_email: Sense correu electrònic
         sso_no_identities: No hi ha comptes SSO connectats
-        sso_subtitle: Gestiona les teves connexions de compte amb inici de sessió únic
+        sso_subtitle: Gestiona les teves connexions de compte amb inici de sessió
+          únic
         sso_title: Comptes connectats
-        sso_warning_message: Aquesta és la teva única mètode d'inici de sessió. Hauries de configurar una contrasenya
-          a la teva configuració de seguretat abans de desconnectar-te, altrament podries quedar blocat
-          fora del teu compte.
+        sso_warning_message: Aquesta és l'única forma d'inici de sessió. Hauries de
+          configurar una contrasenya a la teva configuració de seguretat abans de
+          desconnectar, altrament podries quedar bloquejat/da fora del teu compte.
     settings_nav:
       accounts_label: Comptes
       advanced_section_title: Avançat
       ai_prompts_label: Prompts d'IA
       api_key_label: Clau API
       api_keys_label: Clau API
+      appearance_label: Aparença
       bank_sync_label: Sincronització bancària
-      payment_label: Pagament
       categories_label: Categories
+      debug_label: Depuració
+      exports_label: Exportacions
       feedback_label: Feedback
       general_section_title: General
-      imports_label: Importacions
-      exports_label: Exportacions
       guides_label: Guies
+      imports_label: Importacions
+      llm_usage_label: Ús d'LLM
       logout: Tanca la sessió
       merchants_label: Comerços
       other_section_title: Més
+      payment_label: Pagament
       preferences_label: Preferències
       profile_label: Informació del perfil
+      providers_label: Proveïdors
       recurring_transactions_label: Recurrent
       rules_label: Regles
       security_label: Seguretat
-      self_hosting_label: Autoallotjament
+      self_hosting_label: Self hosting
+      sso_providers_label: Proveïdors SSO
+      statement_vault_label: Arxiu d'extractes
       tags_label: Etiquetes
       transactions_section_title: Transaccions
+      users_label: Usuaris
       whats_new_label: Novetats
     settings_nav_link_large:
       next: Següent
@@ -153,5 +574,10 @@ ca:
     user_avatar_field:
       accepted_formats: JPG o PNG. Màxim 5MB.
       change: Canvia la foto
-      choose: Pujar foto
+      choose: Puja una foto
       choose_label: "(opcional)"
+  views:
+    settings:
+      payments:
+        cancellation: La teva contribució finalitza el %{date}.
+        renewal: La teva contribució continua el %{date}.
diff --git a/config/locales/views/settings/de.yml b/config/locales/views/settings/de.yml
index e8a64d97e..eb17807f2 100644
--- a/config/locales/views/settings/de.yml
+++ b/config/locales/views/settings/de.yml
@@ -167,8 +167,6 @@ de:
         syncing: Wird synchronisiert…
         sync: Synchronisieren
         disconnect_confirm: Bist du sicher, dass du diese Coinbase-Verbindung trennen möchtest? Deine synchronisierten Konten werden zu manuellen Konten.
-        status_connected: Coinbase ist verbunden und synchronisiert deine Krypto-Bestände.
-        status_not_connected: Nicht verbunden. Gib deine API-Zugangsdaten oben ein, um zu starten.
       enable_banking_panel:
         callback_url_instruction: "Für die Callback-URL, verwende %{callback_url}."
         connection_error: Verbindungsfehler
diff --git a/config/locales/views/settings/en.yml b/config/locales/views/settings/en.yml
index 02eda5228..e7abc768f 100644
--- a/config/locales/views/settings/en.yml
+++ b/config/locales/views/settings/en.yml
@@ -6,6 +6,68 @@ en:
         renewal: "Your contribution continues on %{date}."
         cancellation: "Your contribution ends on %{date}."
   settings:
+    debugs:
+      show:
+        page_title: "Debug"
+        title: "Debug event log"
+        subtitle: "Meaningful operational events for super admins. Newest first."
+        empty: "No debug events found."
+        missing_value: "-"
+        filters:
+          all: "All"
+          category: "Category"
+          level: "Level"
+          source: "Source"
+          provider: "Provider"
+          start_date: "From"
+          end_date: "To"
+          family_id: "Family ID"
+          account_id: "Account ID"
+          user_id: "User ID"
+          account_provider_id: "Account provider ID"
+          submit: "Filter"
+          reset: "Reset"
+        table:
+          time: "Time"
+          level: "Level"
+          category: "Category"
+          source: "Source"
+          message: "Message"
+          context: "Context"
+          metadata: "Metadata"
+          view_metadata: "View"
+        context:
+          provider: "provider=%{value}"
+          family: "family=%{value}"
+          account: "account=%{value}"
+          user: "user=%{value}"
+          account_provider: "account_provider=%{value}"
+    llm_usages:
+      show:
+        page_title: "LLM Usage & Costs"
+        subtitle: "Track your AI usage and estimated costs"
+        start_date: "Start Date"
+        end_date: "End Date"
+        filter: "Filter"
+        total_requests: "Total Requests"
+        total_tokens: "Total Tokens"
+        prompt: "prompt"
+        completion: "completion"
+        total_cost: "Total Cost"
+        avg_cost_per_request: "Avg Cost/Request"
+        based_on_requests: "Based on %{with_cost} of %{total} requests with cost data"
+        cost_by_operation: "Cost by Operation"
+        cost_by_model: "Cost by Model"
+        recent_usage: "Recent Usage"
+        col_date: "Date"
+        col_operation: "Operation"
+        col_model: "Model"
+        col_tokens: "Tokens"
+        col_cost: "Cost"
+        failed: "Failed"
+        no_usage_data: "No usage data found for the selected period"
+        cost_estimates_title: "About Cost Estimates"
+        cost_estimates_description: "Costs are estimated based on OpenAI's pricing as of 2025. Actual costs may vary. Pricing is per 1 million tokens and varies by model. Custom or self-hosted models will show \"N/A\" and are not included in cost totals."
     ai_prompts:
       show:
         page_title: AI Prompts
@@ -26,6 +88,17 @@ en:
         page_title: Payments
         subscription_subtitle: Update your credit card details
         subscription_title: Manage contributions
+        currently_on_plan: "Currently on the"
+        trialing: "Currently using the open demo of %{product_name}"
+        trial_days_left:
+          one: "Data will be deleted in %{count} day"
+          other: "Data will be deleted in %{count} days"
+        not_contributing_prefix: "You are currently"
+        not_contributing_emphasis: "not contributing"
+        contributions_note: "Contributions to %{product_name} will show here."
+        manage: "Manage"
+        choose_level: "Choose level"
+        payment_via_stripe: "Payment via Stripe"
     appearances:
       show:
         page_title: Appearance
@@ -58,11 +131,32 @@ en:
         month_start_day: Budget month starts on
         month_start_day_hint: Set when your budget month starts (e.g., payday)
         month_start_day_warning: Your budgets and MTD calculations will use this custom start day instead of the 1st of each month.
+        translations_notice: Please note, we are still working on translations for various languages.
+        currencies_title: "%{moniker} Currencies"
+        currencies_subtitle: Choose which currencies appear in money fields for your %{moniker}
+        base_currency_label: Base currency
+        base_currency_badge: Base currency
+        additional_currencies_label: Additional currencies
+        no_additional_currencies: None selected
+        currencies_more: "+%{count} more"
+        manage_currencies: Manage currencies
+        manage_currencies_subtitle: Deselect the currencies you never use, or reduce the list down to just a few.
+        select_all_currencies: Select all
+        select_base_only: Base currency only
+        currency_search_placeholder: Search currencies
+        no_matching_currencies: No currencies found
+        selected_currencies_count:
+          one: "%{count} selected"
+          other: "%{count} selected"
+        save_currencies: Save currencies
         sharing_title: "%{moniker} Sharing"
         sharing_subtitle: "Control how accounts are shared in your %{moniker}"
         sharing_default_label: Default sharing for new accounts
         sharing_shared: Share with all members
         sharing_private: Keep private by default
+        preview:
+          title: Enable preview features
+          description: Opt in to in-progress features tagged preview or canary.
     profiles:
       destroy:
         cannot_remove_self: You cannot remove yourself from the account.
@@ -144,8 +238,10 @@ en:
       general_section_title: General
       imports_label: Imports
       exports_label: Exports
+      llm_usage_label: LLM Usage
       logout: Logout
       merchants_label: Merchants
+      providers_label: Providers
       guides_label: Guides
       other_section_title: More
       preferences_label: Preferences
@@ -154,12 +250,16 @@ en:
       rules_label: Rules
       security_label: Security
       self_hosting_label: Self-Hosting
+      sso_providers_label: SSO Providers
+      statement_vault_label: Statement Vault
       tags_label: Tags
       transactions_section_title: Transactions
+      users_label: Users
       whats_new_label: What's new
       api_keys_label: API Key
       appearance_label: Appearance
-      bank_sync_label: Bank Sync
+      bank_sync_label: Bank sync
+      debug_label: Debug
     settings_nav_link_large:
       next: Next
       previous: Back
@@ -169,14 +269,84 @@ en:
       choose_label: (optional)
       change: Change photo
     providers:
-      show:
-        coinbase_title: Coinbase
+      update:
+        updated_successfully: Provider settings updated successfully
+        no_changes: No changes were made
+      not_authorized: Not authorized
+      bank_sync:
+        page_title: Bank sync
+        lede: Connect external accounts so transactions, balances and holdings flow into Sure automatically.
+      status:
+        ok: Connected
+        warn: Action needed
+        err: Error
+        off: Not configured
+      maturity:
+        beta: Beta
+        alpha: Alpha
+      drawer_trust_statement: "Read-only access. Sure can never move money, and your credentials are stored encrypted."
+      setup_steps:
+        eyebrow: Setup
+        need_help: "Need help?"
+      connect: Connect
+      groups:
+        your_connections: Your connections
+        available: Available
+        empty_available: All available providers are connected.
+      health_strip:
+        connected: connected
+        needs_attention: needs attention
+        accounts_syncing: accounts syncing
+        last_synced: Last synced %{time} ago
+      meta:
+        sync_error: Sync error
+        no_recent_sync: Sync overdue
+        registration_needed: Registration needed
+        reconsent_required: Re-consent required
+        reconsent_needed:
+          one: Re-consent needed in 1 day
+          other: Re-consent needed in %{count} days
+        last_synced: Synced %{time} ago
+      sync_all: Sync all
+      sync_all_in_progress: Syncing all connected providers…
+      sync_all_recently: Sync already in progress. Try again in a moment.
+      sync_provider: Sync now
+      sync_provider_in_progress: Sync started.
+      recently_synced: Synced recently. Try again in a moment.
+      taglines:
+        simplefin: Connect US bank accounts via the open SimpleFIN protocol.
+        lunchflow: Connect 20k+ banks from 40+ countries (UK, EU, USA and more!)
+        enable_banking: Sync European bank accounts via PSD2 open banking.
+        coinstats: Track your entire crypto portfolio across wallets and exchanges.
+        mercury: Sync your Mercury business banking accounts automatically.
+        brex: Sync Brex cash and corporate card activity with read-only access.
+        coinbase: Import your Coinbase crypto holdings and track performance.
+        binance: Sync your Binance spot balances using a read-only API key.
+        kraken: Sync Kraken balances and spot trade fills using a read-only API key.
+        snaptrade: Connect brokerage accounts via the SnapTrade aggregation network.
+        ibkr: Sync Interactive Brokers investment accounts via Flex Query imports.
+        indexa_capital: Track your Indexa Capital automated investment portfolio.
+        sophtron: Connect US & Canadian banks and utilities.
+        plaid: Connect thousands of US financial institutions via Plaid.
+        plaid_eu: Connect European financial institutions via Plaid (PSD2 / Open Banking).
+      search_filters:
+        aria_label: Search providers
+        placeholder: Search providers
+        chips:
+          all: All
+          bank: Banks
+          crypto: Crypto
+          investment: Investments
+      empty_filter: No providers match your filter.
+      clear_filter: Clear filters
       encryption_error:
-        title: Encryption Configuration Required
-        message: Active Record encryption keys are not configured. Please ensure the encryption credentials (active_record_encryption.primary_key, active_record_encryption.deterministic_key, and active_record_encryption.key_derivation_salt) are properly set up in your Rails credentials or environment variables before using sync providers.
+        title: Encryption keys missing
+        message: "Bank sync needs Active Record encryption configured. Set primary_key, deterministic_key and key_derivation_salt in your Rails credentials or environment variables."
+      provider_form:
+        save_and_connect: "Save and connect"
       coinbase_panel:
         setup_instructions: "To connect Coinbase:"
-        step1_html: Go to <a href="https://portal.cdp.coinbase.com/projects/api-keys" target="_blank" class="text-primary underline">Coinbase API Settings</a>
+        step1_html: Go to <a href="https://portal.cdp.coinbase.com/projects/api-keys" target="_blank" rel="noopener noreferrer" class="text-primary underline">Coinbase API Settings</a>
         step2: Create a new API key with read-only permissions (view accounts, view transactions)
         step3: Copy your API key and API secret and paste them below
         api_key_label: API Key
@@ -187,15 +357,14 @@ en:
         syncing: Syncing...
         sync: Sync
         disconnect_confirm: Are you sure you want to disconnect this Coinbase connection? Your synced accounts will become manual accounts.
-        status_connected: Coinbase is connected and syncing your crypto holdings.
-        status_not_connected: Not connected. Enter your API credentials above to get started.
       binance_panel:
         setup_instructions: "To connect Binance, create a read-only API key:"
-        step1_html: 'Go to <a href="https://www.binance.com/en/my/settings/api-management" target="_blank" class="underline">Binance API Management</a>'
+        step1_html: 'Go to <a href="https://www.binance.com/en/my/settings/api-management" target="_blank" rel="noopener noreferrer" class="underline">Binance API Management</a>'
         step2: "Create a new API key with Enable Reading permission only"
         step3: "Paste your API Key and Secret below"
-        no_withdraw_warning: "Warning: do NOT enable withdrawal permissions"
-        ip_hint_title: "IP Whitelisting Required"
+        no_withdraw_title: "Read-only key only"
+        no_withdraw_body: "Don't enable withdrawal permissions when creating your Binance API key. Sure only needs read access."
+        ip_hint_title: "IP whitelisting required"
         ip_hint_body: "Add the app server's egress IP to the Binance API Key whitelist:"
         ip_hint_contact_admin: "Contact your administrator to obtain the app server's egress IP address."
         api_key_label: API Key
@@ -206,8 +375,136 @@ en:
         syncing: Syncing...
         sync: Sync
         disconnect_confirm: "Are you sure you want to disconnect Binance?"
-        status_connected: Binance connected
-        status_not_connected: Binance not connected
+      kraken_panel:
+        step1_html: 'Go to <a href="https://pro.kraken.com/app/settings/api" target="_blank" rel="noopener noreferrer" class="underline">Kraken API settings</a>'
+        step2: "Create an API key with Query Funds and Query Closed Orders & Trades only."
+        step3: "Paste the API key and private key below."
+        read_only_title: "Read-only exchange sync only"
+        read_only_body: "Do not grant trading, cancellation, withdrawal, export, ledger, Earn, staking, or transfer permissions. Sure only imports balances, holdings, and spot trade fills."
+        default_connection_name: Kraken
+        add_connection: Add Kraken connection
+        update_connection: Update connection
+        connection_name_label: Connection name
+        connection_name_placeholder: Main Kraken
+        api_key_label: API Key
+        api_key_placeholder: Paste your Kraken API key
+        keep_api_key_placeholder: Leave blank to keep the existing API key
+        api_secret_label: Private Key
+        api_secret_placeholder: Paste your Kraken private key
+        keep_api_secret_placeholder: Leave blank to keep the existing private key
+        setup_accounts: Setup account
+        syncing: Syncing...
+        sync: Sync
+        disconnect: Disconnect
+        disconnect_confirm: "Are you sure you want to disconnect %{name}?"
       enable_banking_panel:
         callback_url_instruction: "For the callback URL, use %{callback_url}."
         connection_error: Connection Error
+        step_1_html: "Go to %{link} and grab your developer credentials."
+        step_2: "Pick your country and paste the Application ID + Client Certificate below."
+        step_3: "Save, then use Add Connection to link your bank."
+        config_locked_title: "Configuration locked"
+        config_locked_message: "Disconnect all linked banks before changing these credentials."
+        application_id_label: "Application ID"
+        application_id_placeholder_new: "Enter application ID"
+        application_id_placeholder_update: "Enter new ID to update"
+        client_certificate_label: "Client Certificate (with Private Key)"
+        save_and_connect: "Save and connect"
+        update_connection: "Update connection"
+        connected_bank: "Connected Bank"
+        session_expires: "Session expires: %{date}"
+        unknown: "Unknown"
+        connection: "Connection"
+        session_expired_reconnect: "Session expired - reconnect"
+        configured: "Configured"
+        ready_to_link: "Ready to link accounts"
+        sync: "Sync"
+        reconnect: "Reconnect"
+        connect_bank: "Connect bank"
+        remove: "Remove"
+        remove_confirm: "Are you sure you want to remove this connection?"
+        add_connection: "Add Connection"
+        syncing: "Syncing"
+        select_country: "Select country..."
+        country_label: "Country"
+      lunchflow_panel:
+        step_1_html: "Go to %{link} and create an API key."
+        step_2: "Paste your key below and connect."
+        step_3: "Then head to Accounts to link your synced accounts."
+        api_key_label: "API Key"
+        api_key_placeholder_new: "Paste API key here"
+        api_key_placeholder_update: "Enter new API key to update"
+        base_url_label: "Base URL (Optional)"
+        base_url_placeholder: "https://lunchflow.app/api/v1 (default)"
+        save_and_connect: "Save and connect"
+        update_connection: "Update connection"
+      simplefin_panel:
+        step_1_html: "Go to %{link} for a one-time setup token."
+        step_2: "Paste the token below and connect."
+        step_3: "Then head to Accounts to link your synced accounts."
+        setup_token_label: "Setup Token"
+        setup_token_placeholder: "Paste SimpleFIN setup token"
+        save_and_connect: "Save and connect"
+      plaid_panel:
+        step_1_html: "Open the %{link} and copy your Client ID and Secret Key."
+        step_2: "Pick an environment. Use sandbox for testing and production for real accounts."
+        step_3: "Paste your credentials below and connect."
+      plaid_eu_panel:
+        step_1_html: "Open the %{link} and copy your EU Client ID and Secret Key."
+      not_found: Provider not found.
+      sync_provider_no_items: No connections available to sync.
+      ibkr_panel:
+        steps:
+          step_1: 'In your IBKR Client Portal, navigate to "Performance & Reports" > "Flex Queries".'
+          step_2: 'Click the "+" icon in the "Activity Flex Query" section to create a new query.'
+          step_3: 'Name your query (e.g., "Sure Sync"), then review the Flex Query details below and enable the listed sections, fields, and configuration options.'
+          step_4: 'Save the query, note your "Query ID", then use the gear icon in the "Flex Web Service Configuration" section to generate an access Token.'
+          step_5: "Paste your Query ID and Token below, save the configuration, then head to Accounts to link discovered IBKR accounts."
+        flex_query_details:
+          eyebrow: Flex Query
+          title: Sections, fields, and configuration
+          summary: Expand to see the exact sections, fields, and settings your IBKR Activity Flex Query must include.
+          sections_heading: Enable these sections and fields
+          configuration_heading: Set these query options
+        sections:
+          account_information: "Account Information: Account ID, Currency"
+          cash_report: "Cash Report:"
+          cash_report_options: "Options: None"
+          cash_report_fields: "Fields: Currency, Ending Cash"
+          cash_transactions: "Cash Transactions:"
+          cash_transactions_options: "Options: Dividends, Deposits & Withdrawals, Detail"
+          cash_transactions_fields: "Fields: Amount, Conid, Currency, FX Rate To Base, Report Date, Transaction ID, Type"
+          change_in_position_value_summary: "Change In Position Value Summary: Currency, End Of Period Value"
+          net_asset_value: "Net Asset Value (NAV) in Base:"
+          net_asset_value_options: "Options: None"
+          net_asset_value_fields: "Fields: Currency, Report Date, Total"
+          open_positions: "Open Positions:"
+          open_positions_options: "Options: Summary"
+          open_positions_fields: "Fields: Asset Class, Conid, Cost Basis Price, Currency, FX Rate To Base, Mark Price, Quantity, Report Date, Security ID, Security ID Type, Side, Symbol"
+          trades: "Trades:"
+          trades_options: "Options: Execution"
+          trades_fields: "Fields: Asset Class, Buy/Sell, Conid, Currency, FX Rate To Base, IB Commission, IB Commission Currency, Quantity, Symbol, Trade Date, Trade ID, TradePrice, Transaction ID"
+        configuration:
+          models: "Models: Optional"
+          format: "Format: XML"
+          period: "Period: Last 365 Calendar Days"
+          date_format: "Date Format: yyyy-MM-dd"
+          time_format: "Time Format: HH:mm:ss"
+          date_time_separator: "Date/Time Separator: ; (semi-colon)"
+          profit_and_loss: "Profit and Loss: Default"
+          all_other_options: 'All other configuration options: "No"'
+        report_window_note: "IBKR Flex reports are limited to the query window you configured in IBKR. Sure will import full current holdings plus up to the last 365 days of activity from this report."
+        sync: Sync
+        disconnect_confirm: Disconnect Interactive Brokers?
+        query_id_label: Query ID
+        query_id_placeholder_new: Enter your IBKR Flex Query ID
+        query_id_placeholder_existing: Leave blank to keep the current Query ID
+        token_label: Token
+        token_placeholder_new: Enter your IBKR Flex Web Service Token
+        token_placeholder_existing: Leave blank to keep the current Token
+        save_configuration: Save Configuration
+        update_configuration: Update Configuration
+        status_configured_prefix: "%{summary}. Visit the"
+        accounts_tab: Accounts
+        status_configured_suffix: tab to manage discovered accounts.
+        not_configured: Not configured.
diff --git a/config/locales/views/settings/es.yml b/config/locales/views/settings/es.yml
index b9346a547..1ff5af650 100644
--- a/config/locales/views/settings/es.yml
+++ b/config/locales/views/settings/es.yml
@@ -47,6 +47,9 @@ es:
         month_start_day: El mes de presupuesto comienza el
         month_start_day_hint: Establece cuándo empieza tu mes financiero (ej. el día de cobro)
         month_start_day_warning: Tus presupuestos y cálculos del mes en curso utilizarán este día personalizado en lugar del día 1 de cada mes.
+        preview:
+          title: Habilitar funciones experimentales
+          description: Activa las funciones en desarrollo etiquetadas como experimentales o canary.
     profiles:
       destroy:
         cannot_remove_self: No puedes eliminarte a ti mismo de la cuenta.
@@ -168,8 +171,6 @@ es:
         syncing: Sincronizando...
         sync: Sincronizar
         disconnect_confirm: ¿Estás seguro de que deseas desconectar esta conexión de Coinbase? Tus cuentas sincronizadas pasarán a ser cuentas manuales.
-        status_connected: Coinbase está conectado y sincronizando tus activos de criptomonedas.
-        status_not_connected: No conectado. Introduce tus credenciales de API arriba para comenzar.
       enable_banking_panel:
         callback_url_instruction: "Para la URL de retorno (callback), utiliza %{callback_url}."
         connection_error: Error de conexión
\ No newline at end of file
diff --git a/config/locales/views/settings/fr.yml b/config/locales/views/settings/fr.yml
index 397f387b9..6faca441d 100644
--- a/config/locales/views/settings/fr.yml
+++ b/config/locales/views/settings/fr.yml
@@ -4,6 +4,7 @@ fr:
     settings:
       payments:
         renewal: "Votre contribution se poursuit le %{date}."
+        cancellation: "Votre contribution se termine le %{date}."
   settings:
     ai_prompts:
       show:
@@ -18,13 +19,29 @@ fr:
           title: Catégorisation des transactions
           subtitle: L'IA catégorise automatiquement vos transactions en fonction de vos catégories définies
         merchant_detector:
-          title: Détection du vendeur
-          subtitle: L'IA identifie et enrichit les données de transaction avec des informations sur le vendeur
+          title: Détection du marchand
+          subtitle: L'IA identifie et enrichit les données de transaction avec des informations sur le marchand
     payments:
       show:
-        page_title: Paiement
-        subscription_subtitle: Mettez à jour votre abonnement et vos détails de paiement
-        subscription_title: Gérer l'abonnement
+        page_title: Paiements
+        subscription_subtitle: Mettez à jour les détails de votre carte de crédit
+        subscription_title: Gérer les contributions
+    appearances:
+      show:
+        page_title: Apparence
+        theme_title: Thème
+        theme_subtitle: Choisissez un thème préféré pour l'application
+        theme_dark: Sombre
+        theme_light: Clair
+        theme_system: Système
+        transactions_title: Transactions
+        transactions_subtitle: Personnalisez l'affichage des transactions
+        dashboard_title: Tableau de bord
+        dashboard_subtitle: Personnalisez l'affichage du tableau de bord
+        dashboard_two_column_title: Mise en page à deux colonnes
+        dashboard_two_column_description: Affiche les widgets du tableau de bord sur deux colonnes sur les grands écrans. Lorsque cette option est désactivée, les widgets sont empilés dans une seule colonne.
+        split_grouped_title: Grouper les transactions fractionnées
+        split_grouped_description: Affiche les transactions fractionnées groupées sous leur parent dans la liste des transactions. Lorsque cette option est désactivée, les enfants fractionnés apparaissent comme des lignes individuelles.
     preferences:
       show:
         country: Pays
@@ -37,12 +54,32 @@ fr:
         language: Langue
         language_auto: Langue du navigateur
         page_title: Préférences
-        theme_dark: Sombre
-        theme_light: Clair
-        theme_subtitle: Choisissez un thème préféré pour l'application
-        theme_system: Système
-        theme_title: Thème
         timezone: Fuseau horaire
+        month_start_day: Le mois budgétaire commence le
+        month_start_day_hint: Définissez le jour de début de votre mois budgétaire (ex. jour de paie)
+        month_start_day_warning: Vos budgets et vos calculs MTD utiliseront ce jour de début personnalisé au lieu du 1er de chaque mois.
+        currencies_title: "Devises de %{moniker}"
+        currencies_subtitle: Choisissez les devises qui apparaissent dans les champs monétaires de votre %{moniker}
+        base_currency_label: Devise de base
+        base_currency_badge: Devise de base
+        additional_currencies_label: Devises supplémentaires
+        no_additional_currencies: Aucune sélectionnée
+        currencies_more: "+%{count} de plus"
+        manage_currencies: Gérer les devises
+        manage_currencies_subtitle: Désélectionnez les devises que vous n'utilisez jamais, ou réduisez la liste à quelques-unes seulement.
+        select_all_currencies: Tout sélectionner
+        select_base_only: Devise de base uniquement
+        currency_search_placeholder: Rechercher des devises
+        no_matching_currencies: Aucune devise trouvée
+        selected_currencies_count:
+          one: "%{count} sélectionnée"
+          other: "%{count} sélectionnées"
+        save_currencies: Enregistrer les devises
+        sharing_title: "Partage de %{moniker}"
+        sharing_subtitle: "Contrôlez comment les comptes sont partagés dans votre %{moniker}"
+        sharing_default_label: Partage par défaut pour les nouveaux comptes
+        sharing_shared: Partager avec tous les membres
+        sharing_private: Garder privé par défaut
     profiles:
       destroy:
         cannot_remove_self: Vous ne pouvez pas vous enlever de votre compte.
@@ -54,7 +91,7 @@ fr:
           body: Êtes-vous sûr(e) de vouloir supprimer définitivement votre compte ? Cette action est irréversible.
           title: Supprimer le compte?
         confirm_reset:
-          body: Êtes-vous sûr(e) de vouloir réinitialiser votre compte ? Cela supprimera tous vos comptes, catégories, vendeurs, étiquettes et autres données. Cette action ne peut pas être annulée.
+          body: Êtes-vous sûr(e) de vouloir réinitialiser votre compte ? Cela supprimera tous vos comptes, catégories, marchands, étiquettes et autres données. Cette action ne peut pas être annulée.
           title: Réinitialiser le compte?
         confirm_reset_with_sample_data:
           body: Êtes-vous sûr(e) de vouloir réinitialiser votre compte et charger des données d'exemple ? Cela supprimera vos données existantes et les remplacera par des données de démonstration afin que vous puissiez explorer Sure en toute sécurité.
@@ -69,21 +106,24 @@ fr:
         delete_account: Supprimer le compte
         delete_account_warning: La suppression de votre compte entraînera la suppression permanente de toutes vos données et ne pourra pas être annulée.
         reset_account: Réinitialiser le compte
-        reset_account_warning: La réinitialisation de votre compte supprimera tous vos comptes, catégories, vendeurs, étiquettes et autres données, mais gardera votre compte utilisateur intact.
+        reset_account_warning: La réinitialisation de votre compte supprimera tous vos comptes, catégories, marchands, étiquettes et autres données, mais gardera votre compte utilisateur intact.
         reset_account_with_sample_data: Réinitialiser et précharger
         reset_account_with_sample_data_warning: Supprime toutes vos données existantes puis charge des données d'exemple afin que vous puissiez explorer avec un environnement pré-rempli.
         email: E-mail
         first_name: Prénom
+        group_form_input_placeholder: Entrez le nom du groupe
+        group_form_label: Nom du groupe
+        group_title: Membres du groupe
         household_form_input_placeholder: Entrez le nom du foyer
         household_form_label: Nom du foyer
-        household_subtitle: Invitez des membres de la famille, des partenaires et d'autres personnes. Les personnes invitées peuvent se connecter à votre foyer et accéder aux comptes partagés.
+        household_subtitle: Les personnes invitées peuvent se connecter à votre compte %{moniker} et accéder aux ressources partagées.
         household_title: Foyer
         invitation_link: Lien d'invitation
         invite_member: Ajouter un membre
         last_name: Nom de famille
         page_title: Informations du profil
         pending: En attente
-        profile_subtitle: Personnalisez l'apparence de votre profil sur %{product_name}
+        profile_subtitle: Personnalisez votre apparence sur %{product_name}
         profile_title: Personnel
         remove_invitation: Supprimer l'invitation
         remove_member: Supprimer le membre
@@ -117,9 +157,12 @@ fr:
       categories_label: Catégories
       feedback_label: Retour d'information
       general_section_title: Général
-      imports_label: Importer/Exporter
+      imports_label: Importations
+      exports_label: Exportations
+      llm_usage_label: Utilisation LLM
       logout: Se déconnecter
-      merchants_label: Vendeurs
+      merchants_label: Marchands
+      providers_label: Fournisseurs
       guides_label: Guides
       other_section_title: Plus
       preferences_label: Préférences
@@ -128,11 +171,13 @@ fr:
       rules_label: Règles
       security_label: Sécurité
       self_hosting_label: Auto-hébergement
+      statement_vault_label: Coffre des relevés
       tags_label: Étiquettes
       transactions_section_title: Transactions
       whats_new_label: Dernières nouvelles
       api_keys_label: Clés API
-      bank_sync_label: Synchronisation de la banque
+      appearance_label: Apparence
+      bank_sync_label: Synchronisation bancaire
     settings_nav_link_large:
       next: Suivant
       previous: Précédent
@@ -141,3 +186,42 @@ fr:
       choose: Charger une photo
       choose_label: (facultatif)
       change: Changer de photo
+    providers:
+      show:
+        coinbase_title: Coinbase
+      encryption_error:
+        title: Configuration de chiffrement requise
+        message: Les clés de chiffrement Active Record ne sont pas configurées. Veuillez vous assurer que les identifiants de chiffrement (active_record_encryption.primary_key, active_record_encryption.deterministic_key et active_record_encryption.key_derivation_salt) sont correctement définis dans vos identifiants Rails ou variables d'environnement avant d'utiliser les fournisseurs de synchronisation.
+      coinbase_panel:
+        setup_instructions: "Pour connecter Coinbase :"
+        step1_html: Allez dans les <a href="https://portal.cdp.coinbase.com/projects/api-keys" target="_blank" rel="noopener noreferrer" class="text-primary underline">Paramètres API de Coinbase</a>
+        step2: Créez une nouvelle clé API avec des permissions en lecture seule (voir les comptes, voir les transactions)
+        step3: Copiez votre clé API et votre secret API et collez-les ci-dessous
+        api_key_label: Clé API
+        api_key_placeholder: Entrez votre clé API Coinbase
+        api_secret_label: Secret API
+        api_secret_placeholder: Entrez votre secret API Coinbase
+        connect_button: Connecter Coinbase
+        syncing: Synchronisation…
+        sync: Synchroniser
+        disconnect_confirm: Êtes-vous sûr(e) de vouloir déconnecter cette connexion Coinbase ? Vos comptes synchronisés deviendront des comptes manuels.
+      binance_panel:
+        setup_instructions: "Pour connecter Binance, créez une clé API en lecture seule :"
+        step1_html: 'Allez dans la <a href="https://www.binance.com/en/my/settings/api-management" target="_blank" rel="noopener noreferrer" class="underline">Gestion des API Binance</a>'
+        step2: "Créez une nouvelle clé API avec la permission Enable Reading uniquement"
+        step3: "Collez votre clé API et votre secret ci-dessous"
+        no_withdraw_warning: "Attention : n'activez PAS les permissions de retrait"
+        ip_hint_title: "Liste blanche d'IP requise"
+        ip_hint_body: "Ajoutez l'IP de sortie du serveur de l'application à la liste blanche de la clé API Binance :"
+        ip_hint_contact_admin: "Contactez votre administrateur pour obtenir l'adresse IP de sortie du serveur de l'application."
+        api_key_label: Clé API
+        api_key_placeholder: Collez votre clé API Binance
+        api_secret_label: Secret API
+        api_secret_placeholder: Collez votre secret API Binance
+        connect_button: Connecter Binance
+        syncing: Synchronisation…
+        sync: Synchroniser
+        disconnect_confirm: "Êtes-vous sûr(e) de vouloir déconnecter Binance ?"
+      enable_banking_panel:
+        callback_url_instruction: "Pour l'URL de rappel, utilisez %{callback_url}."
+        connection_error: Erreur de connexion
diff --git a/config/locales/views/settings/hostings/ca.yml b/config/locales/views/settings/hostings/ca.yml
index e435ab6ea..02b1a6282 100644
--- a/config/locales/views/settings/hostings/ca.yml
+++ b/config/locales/views/settings/hostings/ca.yml
@@ -2,61 +2,185 @@
 ca:
   settings:
     hostings:
+      alpha_vantage_settings:
+        description: Introdueix la clau API d'Alpha Vantage. Admet ETF europeus a
+          London Stock Exchange, XETRA i altres mercats.
+        env_configured_message: Configurat correctament mitjançant la variable d'entorn
+          ALPHA_VANTAGE_API_KEY.
+        label: Clau API
+        no_health_check_note: La comprovació de l'estat de la connexió no està disponible
+          per a aquest proveïdor a causa del límit estricte de sol·licituds.
+        placeholder: Introdueix aquí la teva clau API d'Alpha Vantage
+        rate_limit_warning: El nivell gratuït d'Alpha Vantage està limitat a 25 crides
+          d'API al dia. Útil com a proveïdor complementari per a ETF europeus no disponibles
+          en altres proveïdors.
+        show_details: "(mostra detalls)"
+        step_1_html: Visita <a href="https://www.alphavantage.co/support/#api-key"
+          target="_blank" rel="noopener noreferrer" class="underline">alphavantage.co</a>
+          i obté la teva clau API gratuïta.
+        step_2: Copia la clau API i enganxa-la a sota.
+        title: Alpha Vantage
+      assistant_settings:
+        agent_id_help: Encamina cap a un agent específic quan el proveïdor n'allotja
+          diversos. Deixa-ho en blanc per al predeterminat.
+        agent_id_label: ID de l'agent (opcional)
+        agent_id_placeholder: main (predeterminat)
+        confirm_disconnect:
+          body: Això eliminarà l'URL desat, el token i l'ID de l'agent, i canviarà
+            a l'assistent integrat. Pots reconnectar més tard introduint credencials
+            noves.
+          title: Desconnectar l'assistent extern?
+        description: Tria com respon l'assistent del xat. Integrat utilitza el teu
+          proveïdor d'LLM configurat directament. Extern delega en un agent d'IA remot
+          que pot retrucar a les eines financeres de Sure via MCP.
+        disconnect_button: Desconnecta
+        disconnect_description: Elimina la connexió a l'assistent extern i torna a
+          l'assistent integrat.
+        disconnect_title: Connexió externa
+        env_configured_external: Configurat correctament mitjançant variables d'entorn.
+        env_notice: El tipus d'assistent està fixat a '%{type}' mitjançant la variable
+          d'entorn ASSISTANT_TYPE.
+        external_configured: Configurat
+        external_not_configured: No configurat. Introdueix l'URL i el token a sota,
+          o estableix les variables d'entorn EXTERNAL_ASSISTANT_URL i EXTERNAL_ASSISTANT_TOKEN.
+        external_status: Endpoint de l'assistent extern
+        title: Assistent d'IA
+        token_help: El token d'autenticació proporcionat pel teu agent extern. S'envia
+          com a Bearer token a cada sol·licitud.
+        token_label: Token d'API
+        token_placeholder: Introdueix el token del teu proveïdor d'agent
+        type_builtin: Integrat (LLM directe)
+        type_external: Extern (agent remot)
+        type_label: Tipus d'assistent
+        url_help: L'URL complet de l'endpoint d'API del teu agent. El teu proveïdor
+          d'agent te'l donarà.
+        url_label: URL de l'endpoint
+        url_placeholder: https://your-agent-host/v1/chat
       brand_fetch_settings:
         description: Introdueix el Client ID proporcionat per Brand Fetch
+        env_configured_message: Has configurat correctament el teu Client ID de Brand
+          Fetch mitjançant la variable d'entorn BRAND_FETCH_CLIENT_ID.
+        high_res_description: Quan està activat, els logotips es recuperaran amb resolució
+          120×120 en lloc de 40×40. Això proporciona imatges més nítides en pantalles
+          d'alta densitat.
+        high_res_label: Activa logotips d'alta resolució
         label: Client ID
         placeholder: Introdueix aquí el teu Client ID
-        title: Brand Fetch
+        setup_step_1_html: Visita <a href="https://brandfetch.com/developers" target="_blank"
+          rel="noopener noreferrer" class="underline">brandfetch.com</a> i crea un
+          compte de desenvolupador gratuït de Brand Fetch.
+        setup_step_2_html: Ves a la pàgina <a href="https://developers.brandfetch.com/dashboard/logo-api"
+          target="_blank" rel="noopener noreferrer" class="underline">Logo API</a>.
+        setup_step_3: Toca la icona de l'ull a la secció "Your Client ID" per revelar
+          el teu Client ID i enganxa'l a sota.
+        show_details: "(mostra detalls)"
+        title: Configuració de Brand Fetch
       clear_cache:
-        cache_cleared: La memòria cau de dades s'ha netejat. Això pot trigar uns instants
+        cache_cleared: La memòria cau de dades s'ha netejat. Pot trigar uns instants
           a completar-se.
+      disconnect_external_assistant:
+        external_assistant_disconnected: Assistent extern desconnectat
+      ensure_super_admin_for_onboarding:
+        not_authorized: No estàs autoritzat/da a fer aquesta acció
+      eodhd_settings:
+        description: Introdueix el token d'API proporcionat per EODHD. Admet ETF europeus
+          a LSE, XETRA i altres mercats internacionals.
+        env_configured_message: Configurat correctament mitjançant la variable d'entorn
+          EODHD_API_KEY.
+        label: Token d'API
+        placeholder: Introdueix aquí el teu token d'API d'EODHD
+        rate_limit_warning: El nivell gratuït d'EODHD està limitat a 20 crides d'API
+          al dia. Útil com a proveïdor complementari per a ETF europeus no disponibles
+          en altres proveïdors.
+        show_details: "(mostra detalls)"
+        step_1_html: Visita <a href="https://eodhd.com/register" target="_blank" rel="noopener
+          noreferrer" class="underline">eodhd.com</a> i crea un compte gratuït.
+        step_2_html: Ves al teu <a href="https://eodhd.com/cp/dashboard" target="_blank"
+          rel="noopener noreferrer" class="underline">tauler</a> per trobar el teu
+          token d'API.
+        step_3: Copia el teu token d'API i enganxa'l a sota.
+        title: EODHD
       invite_code_settings:
-        description: Cada nou usuari que s'uneixi a la teva instància de %{product}
-          només ho podrà fer mitjançant un codi d'invitació
+        default_family_description: Posa els nous usuaris en aquesta família/grup
+          només si no tenen invitació.
+        default_family_none: Cap (crear nova família)
+        default_family_title: Família predeterminada per a nous usuaris
+        description: Controla com es registra la gent a la teva instància de %{product}.
         email_confirmation_description: Quan està activat, els usuaris hauran de confirmar
           el seu correu electrònic quan el canviïn.
         email_confirmation_title: Requereix confirmació de correu electrònic
-        generate_tokens: Genera nou codi
+        generate_tokens: Genera un nou codi
         generated_tokens: Codis generats
         states:
           closed: Tancat
           invite_only: Només per invitació
           open: Obert
-        title: Requereix codi d'invitació per registrar-se
-      not_authorized: No estàs autoritzat/da per realitzar aquesta acció
+        title: Inici de sessió
+      not_authorized: No estàs autoritzat/da a fer aquesta acció
       openai_settings:
         access_token_label: Token d'accés
         access_token_placeholder: Introdueix aquí el teu token d'accés
+        budget_description: S'aplica a totes les crides d'LLM — historial de xat,
+          autocategorització, detecció de comerç i processament de PDF. Els valors
+          predeterminats són conservadors per a models locals amb context reduït.
+          Augmenta'ls per a models al núvol amb finestres de context més grans.
+        budget_heading: Pressupost de tokens
+        context_window_help: 'Tokens totals que el model acceptarà. Per defecte: 2048
+          — puja a 8192+ per a OpenAI al núvol o models locals amb context gran.'
+        context_window_label: Finestra de context (opcional)
         description: Introdueix el token d'accés i, opcionalment, configura un proveïdor
-          OpenAI compatible personalitzat
+          compatible amb OpenAI personalitzat
         env_configured_message: Configurat correctament mitjançant variables d'entorn.
         json_mode_auto: Auto (recomanat)
         json_mode_help: El mode estricte funciona millor amb models de pensament (qwen-thinking,
-          deepseek-reasoner). El mode None funciona millor amb models estàndard (llama, mistral,
-          gpt-oss).
-        json_mode_json_object: JSON Object
+          deepseek-reasoner). El mode None funciona millor amb models estàndard (llama,
+          mistral, gpt-oss).
+        json_mode_json_object: Objecte JSON
         json_mode_label: Mode JSON
-        json_mode_none: None (millor per models estàndard)
-        json_mode_strict: Estrict (millor per models de pensament)
+        json_mode_none: Cap (millor per a models estàndard)
+        json_mode_strict: Estricte (millor per a models de pensament)
+        max_items_per_call_help: 'Límit superior per als lots d''autocategorització
+          / detecció de comerç. Per defecte: 25. Els lots més grans es divideixen
+          automàticament per encabir-se a la finestra de context.'
+        max_items_per_call_label: Màxim d'elements per lot (opcional)
+        max_response_tokens_help: 'Tokens reservats per a la resposta del model. Per
+          defecte: 512. Redueix per alliberar espai per a un historial més llarg.'
+        max_response_tokens_label: Màxim de tokens de resposta (opcional)
         model_label: Model (opcional)
         model_placeholder: gpt-4.1 (per defecte)
         title: OpenAI
         uri_base_label: URL base de l'API (opcional)
         uri_base_placeholder: https://api.openai.com/v1 (per defecte)
       provider_selection:
-        description: Tria quin servei utilitzar per obtenir tipus de canvi i preus de
-          valors. Yahoo Finance és gratuït i no requereix clau API. Twelve Data
-          requereix una clau API gratuïta però pot oferir més cobertura de dades.
-        env_configured_message: La selecció de proveïdor està inhabilitada perquè les variables
-          d'entorn (EXCHANGE_RATE_PROVIDER o SECURITIES_PROVIDER) estan configurades. Per habilitar
-          la selecció aquí, elimina aquestes variables d'entorn de la teva configuració.
-        exchange_rate_provider_label: Proveïdor de Tipus de Canvi
+        binance_public_hint: gratuït, sense clau API — només cripto (BTC, ETH, etc.)
+        description: Tria un únic proveïdor per obtenir tipus de canvi de divisa.
+        env_configured_message: La selecció de proveïdor està desactivada perquè hi
+          ha variables d'entorn configurades. Per activar la selecció aquí, elimina
+          aquestes variables d'entorn de la teva configuració.
+        exchange_rate_description: Tria un únic proveïdor per obtenir tipus de canvi
+          de divisa.
+        exchange_rate_provider_label: Proveïdor de tipus de canvi
+        exchange_rate_title: Proveïdor de tipus de canvi
+        mfapi_hint: gratuït, sense clau API — només fons mutus indis
         providers:
+          alpha_vantage: Alpha Vantage
+          binance_public: Binance
+          eodhd: EODHD
+          mfapi: MFAPI.in
+          tiingo: Tiingo
           twelve_data: Twelve Data
           yahoo_finance: Yahoo Finance
-        securities_provider_label: Proveïdor de Valors (Preus d'Accions)
-        title: Selecció de Proveïdor
+        requires_api_key: requereix clau API
+        requires_api_key_alpha_vantage: requereix clau API, límit de 25 crides/dia
+        requires_api_key_eodhd: requereix clau API, límit de 20 crides/dia
+        securities_description: Activa un o més proveïdors per obtenir preus d'accions,
+          ETF i fons d'inversió. En cercar, es consulten tots els proveïdors activats
+          i es combinen els resultats.
+        securities_title: Proveïdors de valors
+        twelve_data_hint: requereix clau API, 800 crèdits/dia
+        yahoo_finance_hint: gratuït, no cal clau API
       show:
+        ai_assistant: Assistent d'IA
         clear_cache: Neteja la memòria cau de dades
         clear_cache_warning: Netejar la memòria cau de dades eliminarà tots els tipus
           de canvi, preus de valors, saldos de comptes i altres dades. Això no eliminarà
@@ -65,50 +189,82 @@ ca:
           body: Segur que vols netejar la memòria cau de dades? Això eliminarà tots
             els tipus de canvi, preus de valors, saldos de comptes i altres dades.
             Aquesta acció no es pot desfer.
-          title: Neteja la memòria cau de dades?
+          title: Netejar la memòria cau de dades?
         danger_zone: Zona perillosa
-        financial_data_providers: Proveïdors de Dades Financeres
-        general: Serveis externs
+        financial_data_providers: Proveïdors de dades financeres
+        general: Configuració general
         invites: Codis d'invitació
-        sync_settings: Configuració de Sincronització
-        title: Autoallotjament
+        sync_settings: Configuració de sincronització
+        title: Self hosting
+      sync_auto_sync_scheduler!:
+        scheduler_sync_failed: La configuració s'ha desat, però no s'ha pogut actualitzar
+          la planificació de sincronització. Torna-ho a provar o revisa els registres
+          del servidor.
       sync_settings:
         auto_sync_description: Quan està activat, tots els comptes es sincronitzaran
-          automàticament diàriament a l'hora especificada.
+          automàticament cada dia a l'hora especificada.
         auto_sync_label: Activa la sincronització automàtica
-        auto_sync_time_description: Especifica l'hora del dia quan hauria de produir-se
+        auto_sync_time_description: Especifica l'hora del dia en què s'ha de produir
           la sincronització automàtica.
         auto_sync_time_label: Hora de sincronització (HH:MM)
-        env_configured_message: Aquesta configuració està inhabilitada perquè una variable
-          d'entorn del proveïdor (SIMPLEFIN_INCLUDE_PENDING o PLAID_INCLUDE_PENDING) està configurada. Elimina
-          per habilitar aquesta configuració.
-        include_pending_description: Quan està activat, les transaccions pendents (no liquidades)
-          s'importaran i es reconciliaran automàticament quan es publiquin. Inhabilita si
-          el teu banc proporciona dades pendents no fiables.
+        env_configured_message: Aquesta configuració està desactivada perquè una variable
+          d'entorn del proveïdor (SIMPLEFIN_INCLUDE_PENDING o PLAID_INCLUDE_PENDING)
+          està establerta. Elimina-la per activar aquesta opció.
+        include_pending_description: Quan està activat, les transaccions pendents
+          (no liquidades) s'importaran i es reconciliaran automàticament quan es publiquin.
+          Desactiva-ho si el teu banc proporciona dades pendents poc fiables.
         include_pending_label: Inclou transaccions pendents
+      tiingo_settings:
+        description: Introdueix el token d'API proporcionat per Tiingo. El nivell
+          gratuït admet 50 símbols únics per hora amb més de 30 anys d'historial.
+        env_configured_message: Configurat correctament mitjançant la variable d'entorn
+          TIINGO_API_KEY.
+        label: Token d'API
+        placeholder: Introdueix aquí el teu token d'API de Tiingo
+        show_details: "(mostra detalls)"
+        step_1_html: Visita <a href="https://www.tiingo.com" target="_blank" rel="noopener
+          noreferrer" class="underline">tiingo.com</a> i crea un compte gratuït.
+        step_2_html: Ves a la pàgina <a href="https://www.tiingo.com/account/api/token"
+          target="_blank" rel="noopener noreferrer" class="underline">Token d'API</a>.
+        step_3: Copia el teu token d'API i enganxa'l a sota.
+        title: Tiingo
       twelve_data_settings:
-        api_calls_used: "%{used} / %{limit} crides diàries a l'API utilitzades (%{percentage})"
+        api_calls_used: "%{used} / %{limit} crides diàries d'API utilitzades (%{percentage})"
         description: Introdueix la clau API proporcionada per Twelve Data
         env_configured_message: Configurat correctament mitjançant la variable d'entorn
           TWELVE_DATA_API_KEY.
         label: Clau API
         placeholder: Introdueix aquí la teva clau API
         plan: Pla %{plan}
+        plan_upgrade_warning_description: Els següents símbols de la teva cartera
+          no poden sincronitzar preus amb el teu pla actual de Twelve Data.
+        plan_upgrade_warning_title: Alguns símbols requereixen un pla de pagament
+        requires_plan: requereix el pla %{plan}
+        show_details: "(mostra detalls)"
+        step_1_html: Visita <a href="https://twelvedata.com/register" target="_blank"
+          rel="noopener noreferrer" class="underline">twelvedata.com</a> i crea un
+          compte de desenvolupador gratuït de Twelve Data.
+        step_2_html: Ves a la pàgina <a href="https://twelvedata.com/account/api-keys"
+          target="_blank" rel="noopener noreferrer" class="underline">claus d'API</a>.
+        step_3: Revela la teva Secret Key i enganxa-la a sota.
         title: Twelve Data
+        view_pricing: Veure preus de Twelve Data
       update:
         failure: Valor de configuració invàlid
-        invalid_onboarding_state: Estat d'incorporació invàlid
-        invalid_sync_time: Format d'hora de sincronització invàlid. Utilitza el format HH:MM (p. ex.,
-          02:30).
-        scheduler_sync_failed: S'ha desat la configuració, però no s'ha pogut actualitzar el programa de sincronització.
-          Torna-ho a provar o revisa els registres del servidor.
+        invalid_llm_budget: "%{field} ha de ser un nombre enter ≥ %{minimum}."
+        invalid_onboarding_state: Estat d'inici de sessió invàlid
+        invalid_sync_time: Format d'hora de sincronització invàlid. Utilitza el format
+          HH:MM (p. ex., 02:30).
+        scheduler_sync_failed: La configuració s'ha desat, però no s'ha pogut actualitzar
+          la planificació de sincronització. Torna-ho a provar o revisa els registres
+          del servidor.
         success: Configuració actualitzada
       yahoo_finance_settings:
         connection_failed: No s'ha pogut connectar amb Yahoo Finance
-        description: Yahoo Finance ofereix accés gratuït a preus d'accions, tipus de canvi
-          i dades financeres sense requerir clau API.
+        description: Yahoo Finance ofereix accés gratuït a preus d'accions, tipus
+          de canvi i dades financeres sense necessitat de clau API.
         status_active: Yahoo Finance està actiu i funcionant
         status_inactive: La connexió a Yahoo Finance ha fallat
         title: Yahoo Finance
-        troubleshooting: Comprova la connexió a Internet i la configuració del tallafocs. És possible que
-          Yahoo Finance estigui temporalment no disponible.
+        troubleshooting: Comprova la connexió a Internet i la configuració del tallafoc.
+          És possible que Yahoo Finance estigui temporalment no disponible.
diff --git a/config/locales/views/settings/hostings/en.yml b/config/locales/views/settings/hostings/en.yml
index 814d0b13c..a2f08e4e1 100644
--- a/config/locales/views/settings/hostings/en.yml
+++ b/config/locales/views/settings/hostings/en.yml
@@ -31,14 +31,27 @@ en:
           title: Clear data cache?
           body: Are you sure you want to clear the data cache? This will remove all exchange rates, security prices, account balances, and other data. This action cannot be undone.
       provider_selection:
-        title: Provider Selection
-        description: Choose which service to use for fetching exchange rates and security prices. Yahoo Finance is free and doesn't require an API key. Twelve Data requires a free API key but may offer more data coverage.
+        exchange_rate_title: Exchange Rate Provider
+        exchange_rate_description: Select a single provider for fetching currency exchange rates.
         exchange_rate_provider_label: Exchange Rate Provider
-        securities_provider_label: Securities (Stock Prices) Provider
-        env_configured_message: Provider selection is disabled because environment variables (EXCHANGE_RATE_PROVIDER or SECURITIES_PROVIDER) are set. To enable selection here, remove these environment variables from your configuration.
+        securities_title: Securities Providers
+        securities_description: Enable one or more providers for fetching stock, ETF, and mutual fund prices. When searching, all enabled providers are queried and results are merged.
+        env_configured_message: Provider selection is disabled because environment variables are set. To enable selection here, remove these environment variables from your configuration.
+        twelve_data_hint: requires API key, 800 credits/day
+        yahoo_finance_hint: free, no API key needed
+        requires_api_key: requires API key
+        requires_api_key_eodhd: requires API key, 20 calls/day limit
+        requires_api_key_alpha_vantage: requires API key, 25 calls/day limit
+        mfapi_hint: free, no API key -- Indian mutual funds only
+        binance_public_hint: free, no API key -- crypto only (BTC, ETH, etc.)
         providers:
           twelve_data: Twelve Data
           yahoo_finance: Yahoo Finance
+          tiingo: Tiingo
+          eodhd: EODHD
+          alpha_vantage: Alpha Vantage
+          mfapi: MFAPI.in
+          binance_public: Binance
       assistant_settings:
         title: AI Assistant
         description: Choose how the chat assistant responds. Builtin uses your configured LLM provider directly. External delegates to a remote AI agent that can call back to Sure's financial tools via MCP.
@@ -67,6 +80,11 @@ en:
           body: This will remove the saved URL, token, and agent ID, and switch to the builtin assistant. You can reconnect later by entering new credentials.
       brand_fetch_settings:
         description: Enter the Client ID provided by Brand Fetch
+        env_configured_message: You have successfully configured your Brand Fetch Client ID through the BRAND_FETCH_CLIENT_ID environment variable.
+        show_details: "(show details)"
+        setup_step_1_html: 'Visit <a href="https://brandfetch.com/developers" target="_blank" rel="noopener noreferrer" class="underline">brandfetch.com</a> and create a free Brand Fetch Developer account.'
+        setup_step_2_html: 'Go to the <a href="https://developers.brandfetch.com/dashboard/logo-api" target="_blank" rel="noopener noreferrer" class="underline">Logo API</a> page.'
+        setup_step_3: 'Tap the eye icon under the "Your Client ID" section to reveal your Client ID and paste it below.'
         label: Client ID
         placeholder: Enter your Client ID here
         title: Brand Fetch Settings
@@ -87,6 +105,14 @@ en:
         json_mode_none: None (best for standard models)
         json_mode_json_object: JSON Object
         json_mode_help: "Strict mode works best with thinking models (qwen-thinking, deepseek-reasoner). None mode works best with standard models (llama, mistral, gpt-oss)."
+        budget_heading: Token Budget
+        budget_description: Applies to every LLM call — chat history, auto-categorization, merchant detection, and PDF processing. Defaults are conservative for small-context local models. Raise for cloud models with larger context windows.
+        context_window_label: Context Window (Optional)
+        context_window_help: "Total tokens the model will accept. Default: 2048 — raise to 8192+ for cloud OpenAI or large-context local models."
+        max_response_tokens_label: Max Response Tokens (Optional)
+        max_response_tokens_help: "Tokens reserved for the model's reply. Default: 512. Lower to free up room for longer history."
+        max_items_per_call_label: Max Items Per Batch (Optional)
+        max_items_per_call_help: "Upper bound for auto-categorize / merchant detection batches. Default: 25. Larger batches are auto-sliced to fit the context window."
         title: OpenAI
       yahoo_finance_settings:
         title: Yahoo Finance
@@ -95,12 +121,48 @@ en:
         status_inactive: Yahoo Finance connection failed
         connection_failed: Unable to connect to Yahoo Finance
         troubleshooting: Check your internet connection and firewall settings. Yahoo Finance may be temporarily unavailable.
+      tiingo_settings:
+        title: Tiingo
+        description: Enter the API token provided by Tiingo. Free tier supports 50 unique symbols per hour with 30+ years of historical data.
+        env_configured_message: Successfully configured through the TIINGO_API_KEY environment variable.
+        label: API Token
+        placeholder: Enter your Tiingo API token here
+        show_details: "(show details)"
+        step_1_html: 'Visit <a href="https://www.tiingo.com" target="_blank" rel="noopener noreferrer" class="underline">tiingo.com</a> and create a free account.'
+        step_2_html: 'Go to the <a href="https://www.tiingo.com/account/api/token" target="_blank" rel="noopener noreferrer" class="underline">API Token</a> page.'
+        step_3: Copy your API token and paste it below.
+      eodhd_settings:
+        title: EODHD
+        description: Enter the API token provided by EODHD. Supports EU ETFs on LSE, XETRA, and other international exchanges.
+        env_configured_message: Successfully configured through the EODHD_API_KEY environment variable.
+        label: API Token
+        placeholder: Enter your EODHD API token here
+        show_details: "(show details)"
+        step_1_html: 'Visit <a href="https://eodhd.com/register" target="_blank" rel="noopener noreferrer" class="underline">eodhd.com</a> and create a free account.'
+        step_2_html: 'Go to your <a href="https://eodhd.com/cp/dashboard" target="_blank" rel="noopener noreferrer" class="underline">Dashboard</a> to find your API token.'
+        step_3: Copy your API token and paste it below.
+        rate_limit_warning: "EODHD free tier is limited to 20 API calls per day. Best used as a supplementary provider for EU ETFs not available from other providers."
+      alpha_vantage_settings:
+        title: Alpha Vantage
+        description: Enter the API key from Alpha Vantage. Supports EU ETFs on London Stock Exchange, XETRA, and other exchanges.
+        env_configured_message: Successfully configured through the ALPHA_VANTAGE_API_KEY environment variable.
+        label: API Key
+        placeholder: Enter your Alpha Vantage API key here
+        show_details: "(show details)"
+        step_1_html: 'Visit <a href="https://www.alphavantage.co/support/#api-key" target="_blank" rel="noopener noreferrer" class="underline">alphavantage.co</a> and claim your free API key.'
+        step_2: Copy the API key and paste it below.
+        rate_limit_warning: "Alpha Vantage free tier is limited to 25 API calls per day. Best used as a supplementary provider for EU ETFs not available from other providers."
+        no_health_check_note: "Connection health check is unavailable for this provider due to the strict rate limit."
       twelve_data_settings:
         api_calls_used: "%{used} / %{limit} API daily calls used (%{percentage})"
         description: Enter the API key provided by Twelve Data
         env_configured_message: Successfully configured through the TWELVE_DATA_API_KEY environment variable.
         label: API Key
         placeholder: Enter your API key here
+        show_details: "(show details)"
+        step_1_html: 'Visit <a href="https://twelvedata.com/register" target="_blank" rel="noopener noreferrer" class="underline">twelvedata.com</a> and create a free Twelve Data Developer account.'
+        step_2_html: 'Go to the <a href="https://twelvedata.com/account/api-keys" target="_blank" rel="noopener noreferrer" class="underline">API Keys</a> page.'
+        step_3: Reveal your Secret Key and paste it below.
         plan: "%{plan} plan"
         plan_upgrade_warning_title: Some tickers require a paid plan
         plan_upgrade_warning_description: The following tickers in your portfolio cannot sync prices with your current Twelve Data plan.
@@ -112,12 +174,17 @@ en:
         success: Settings updated
         invalid_onboarding_state: Invalid onboarding state
         invalid_sync_time: Invalid sync time format. Please use HH:MM format (e.g., 02:30).
+        invalid_llm_budget: "%{field} must be a whole number ≥ %{minimum}."
         scheduler_sync_failed: Settings saved, but failed to update the sync schedule. Please try again or check the server logs.
       disconnect_external_assistant:
         external_assistant_disconnected: External assistant disconnected
       clear_cache:
         cache_cleared: Data cache has been cleared. This may take a few moments to complete.
       not_authorized: You are not authorized to perform this action
+      ensure_super_admin_for_onboarding:
+        not_authorized: You are not authorized to perform this action
+      sync_auto_sync_scheduler!:
+        scheduler_sync_failed: Settings saved, but failed to update the sync schedule. Please try again or check the server logs.
       sync_settings:
         auto_sync_label: Enable automatic sync
         auto_sync_description: When enabled, all accounts will be automatically synced daily at the specified time.
diff --git a/config/locales/views/settings/hostings/fr.yml b/config/locales/views/settings/hostings/fr.yml
index a302e0d45..7a42e86ca 100644
--- a/config/locales/views/settings/hostings/fr.yml
+++ b/config/locales/views/settings/hostings/fr.yml
@@ -3,87 +3,183 @@ fr:
   settings:
     hostings:
       invite_code_settings:
-        description: Contrôlez comment les nouvelles personnes s'inscrivent à votre instance de %{product}.
-        email_confirmation_description: Lorsque cette option est activée, les utilisateurs doivent confirmer leur adresse e-mail lors du changement.
-        email_confirmation_title: Exiger la confirmation de l'e-mail
-        generate_tokens: Générer un nouveau code
-        generated_tokens: Codes générés
-        title: Inscription
+        description: "Contrôlez comment les nouvelles personnes s'inscrivent à votre instance de %{product}."
+        email_confirmation_description: "Lorsque cette option est activée, les utilisateurs doivent confirmer leur nouvelle adresse e-mail lorsqu'ils la modifient."
+        email_confirmation_title: "Exiger la confirmation de l'e-mail"
+        default_family_title: "Famille par défaut pour les nouveaux utilisateurs"
+        default_family_description: "Placer les nouveaux utilisateurs dans cette famille/groupe uniquement s'ils n'ont pas d'invitation."
+        default_family_none: "Aucune (créer une nouvelle famille)"
+        generate_tokens: "Générer un nouveau code"
+        generated_tokens: "Codes générés"
+        title: "Inscription des utilisateurs"
         states:
-          open: Ouvert
-          closed: Fermé
-          invite_only: Sur invitation uniquement
+          open: "Ouvert"
+          closed: "Fermé"
+          invite_only: "Sur invitation uniquement"
       show:
-        general: Paramètres généraux
-        financial_data_providers: Fournisseurs de données financières
-        sync_settings: Paramètres de synchronisation
-        invites: Codes d'invitation
-        title: Auto-hébergement
-        danger_zone: Zone dangereuse
-        clear_cache: Effacer le cache de données
-        clear_cache_warning: L'effacement du cache de données supprimera tous les taux de change, les cours des titres, les soldes des comptes et d'autres données. Cela ne supprimera pas les comptes, les transactions, les catégories ou d'autres données possédées par les utilisateurs.
+        general: "Paramètres généraux"
+        ai_assistant: "Assistant IA"
+        financial_data_providers: "Fournisseurs de données financières"
+        sync_settings: "Paramètres de synchronisation"
+        invites: "Codes d'invitation"
+        title: "Auto-hébergement"
+        danger_zone: "Zone dangereuse"
+        clear_cache: "Effacer le cache de données"
+        clear_cache_warning: "L'effacement du cache de données supprimera tous les taux de change, les cours des titres, les soldes des comptes et d'autres données. Cela ne supprimera pas les comptes, les transactions, les catégories ou d'autres données possédées par les utilisateurs."
         confirm_clear_cache:
-          title: Effacer le cache de données ?
-          body: Êtes-vous sûr(e) de vouloir effacer le cache de données ? Cela supprimera tous les taux de change, les cours des titres, les soldes des comptes et d'autres données. Cette action ne peut pas être annulée.
+          title: "Effacer le cache de données ?"
+          body: "Êtes-vous sûr(e) de vouloir effacer le cache de données ? Cela supprimera tous les taux de change, les cours des titres, les soldes des comptes et d'autres données. Cette action ne peut pas être annulée."
       provider_selection:
-        title: Sélection du fournisseur
-        description: Choisissez le service à utiliser pour récupérer les taux de change et les cours des titres. Yahoo Finance est gratuit et ne nécessite pas de clé API. Twelve Data nécessite une clé API gratuite mais peut offrir une meilleure couverture des données.
-        exchange_rate_provider_label: Fournisseur de taux de change
-        securities_provider_label: Fournisseur de titres (cours boursiers)
-        env_configured_message: La sélection du fournisseur est désactivée car des variables d'environnement (EXCHANGE_RATE_PROVIDER ou SECURITIES_PROVIDER) sont définies. Pour activer la sélection ici, supprimez ces variables d'environnement de votre configuration.
+        exchange_rate_title: "Fournisseur de taux de change"
+        exchange_rate_description: "Sélectionnez un seul fournisseur pour récupérer les taux de change des devises."
+        exchange_rate_provider_label: "Fournisseur de taux de change"
+        securities_title: "Fournisseurs de titres"
+        securities_description: "Activez un ou plusieurs fournisseurs pour récupérer les cours des actions, ETF et fonds communs. Lors d'une recherche, tous les fournisseurs activés sont interrogés et les résultats sont fusionnés."
+        env_configured_message: "La sélection du fournisseur est désactivée car des variables d'environnement sont définies. Pour activer la sélection ici, supprimez ces variables d'environnement de votre configuration."
+        twelve_data_hint: "nécessite une clé API, 800 crédits/jour"
+        yahoo_finance_hint: "gratuit, aucune clé API requise"
+        requires_api_key: "nécessite une clé API"
+        requires_api_key_eodhd: "nécessite une clé API, limite de 20 appels/jour"
+        requires_api_key_alpha_vantage: "nécessite une clé API, limite de 25 appels/jour"
+        mfapi_hint: "gratuit, aucune clé API -- fonds communs indiens uniquement"
+        binance_public_hint: "gratuit, aucune clé API -- crypto uniquement (BTC, ETH, etc.)"
         providers:
-          twelve_data: Twelve Data
-          yahoo_finance: Yahoo Finance
+          twelve_data: "Twelve Data"
+          yahoo_finance: "Yahoo Finance"
+          tiingo: "Tiingo"
+          eodhd: "EODHD"
+          alpha_vantage: "Alpha Vantage"
+          mfapi: "MFAPI.in"
+          binance_public: "Binance"
+      assistant_settings:
+        title: "Assistant IA"
+        description: "Choisissez comment l'assistant de discussion répond. Intégré utilise directement votre fournisseur LLM configuré. Externe délègue à un agent IA distant qui peut invoquer les outils financiers de Sure via MCP."
+        type_label: "Type d'assistant"
+        type_builtin: "Intégré (LLM direct)"
+        type_external: "Externe (agent distant)"
+        external_status: "Endpoint de l'assistant externe"
+        external_configured: "Configuré"
+        external_not_configured: "Non configuré. Saisissez l'URL et le token ci-dessous, ou définissez les variables d'environnement EXTERNAL_ASSISTANT_URL et EXTERNAL_ASSISTANT_TOKEN."
+        env_notice: "Le type d'assistant est verrouillé sur '%{type}' via la variable d'environnement ASSISTANT_TYPE."
+        env_configured_external: "Configuré avec succès via les variables d'environnement."
+        url_label: "URL du endpoint"
+        url_placeholder: "https://your-agent-host/v1/chat"
+        url_help: "L'URL complète du endpoint de l'API de votre agent. Votre fournisseur d'agent vous la fournira."
+        token_label: "Token API"
+        token_placeholder: "Saisissez le token de votre fournisseur d'agent"
+        token_help: "Le token d'authentification fourni par votre agent externe. Il est envoyé en tant que Bearer token avec chaque requête."
+        agent_id_label: "ID de l'agent (Optionnel)"
+        agent_id_placeholder: "main (par défaut)"
+        agent_id_help: "Route vers un agent spécifique lorsque le fournisseur en héberge plusieurs. Laisser vide pour la valeur par défaut."
+        disconnect_title: "Connexion externe"
+        disconnect_description: "Supprimer la connexion à l'assistant externe et revenir à l'assistant intégré."
+        disconnect_button: "Déconnecter"
+        confirm_disconnect:
+          title: "Déconnecter l'assistant externe ?"
+          body: "Cela supprimera l'URL, le token et l'ID de l'agent enregistrés, et basculera vers l'assistant intégré. Vous pourrez vous reconnecter ultérieurement en saisissant de nouvelles informations d'identification."
       brand_fetch_settings:
-        description: Saisissez l'ID client fourni par Brand Fetch
-        label: ID client
-        placeholder: Entrez votre ID client ici
-        title: Brand Fetch
+        description: "Saisissez l'ID client fourni par Brand Fetch"
+        label: "ID client"
+        placeholder: "Entrez votre ID client ici"
+        title: "Paramètres Brand Fetch"
+        high_res_label: "Activer les logos haute résolution"
+        high_res_description: "Lorsque cette option est activée, les logos seront récupérés en résolution 120x120 au lieu de 40x40. Cela offre des images plus nettes sur les écrans à haute densité de pixels."
       openai_settings:
-        description: Saisissez le jeton d'accès et configurez éventuellement un fournisseur compatible OpenAI personnalisé
-        env_configured_message: Configuré avec succès via les variables d'environnement.
-        access_token_label: Jeton d'accès
-        access_token_placeholder: Entrez votre jeton d'accès ici
-        uri_base_label: URL de base de l'API (Optionnel)
+        description: "Saisissez le jeton d'accès et configurez éventuellement un fournisseur compatible OpenAI personnalisé"
+        env_configured_message: "Configuré avec succès via les variables d'environnement."
+        access_token_label: "Jeton d'accès"
+        access_token_placeholder: "Entrez votre jeton d'accès ici"
+        uri_base_label: "URL de base de l'API (Optionnel)"
         uri_base_placeholder: "https://api.openai.com/v1 (par défaut)"
-        model_label: Modèle (Optionnel)
+        model_label: "Modèle (Optionnel)"
         model_placeholder: "gpt-4.1 (par défaut)"
-        json_mode_label: Mode JSON
-        json_mode_auto: Auto (recommandé)
-        json_mode_strict: Strict (meilleur pour les modèles de raisonnement)
-        json_mode_none: Aucun (meilleur pour les modèles standard)
-        json_mode_json_object: Objet JSON
+        json_mode_label: "Mode JSON"
+        json_mode_auto: "Auto (recommandé)"
+        json_mode_strict: "Strict (meilleur pour les modèles de raisonnement)"
+        json_mode_none: "Aucun (meilleur pour les modèles standard)"
+        json_mode_json_object: "Objet JSON"
         json_mode_help: "Le mode strict fonctionne mieux avec les modèles de raisonnement (qwen-thinking, deepseek-reasoner). Le mode aucun fonctionne mieux avec les modèles standard (llama, mistral, gpt-oss)."
-        title: OpenAI
+        budget_heading: "Budget de tokens"
+        budget_description: "S'applique à chaque appel LLM — historique de discussion, auto-catégorisation, détection de marchand et traitement PDF. Les valeurs par défaut sont conservatrices pour les modèles locaux à petit contexte. Augmentez-les pour les modèles cloud avec des fenêtres de contexte plus grandes."
+        context_window_label: "Fenêtre de contexte (Optionnel)"
+        context_window_help: "Nombre total de tokens que le modèle acceptera. Par défaut : 2048 — augmenter à 8192+ pour OpenAI cloud ou les modèles locaux à grand contexte."
+        max_response_tokens_label: "Tokens de réponse max (Optionnel)"
+        max_response_tokens_help: "Tokens réservés à la réponse du modèle. Par défaut : 512. Abaisser pour libérer de l'espace pour un historique plus long."
+        max_items_per_call_label: "Nombre maximum d'éléments par lot (Optionnel)"
+        max_items_per_call_help: "Limite supérieure pour les lots d'auto-catégorisation / détection de marchand. Par défaut : 25. Les lots plus grands sont automatiquement découpés pour tenir dans la fenêtre de contexte."
+        title: "OpenAI"
       yahoo_finance_settings:
-        title: Yahoo Finance
-        description: Yahoo Finance fournit un accès gratuit aux cours boursiers, taux de change et données financières sans nécessiter de clé API.
-        status_active: Yahoo Finance est actif et fonctionne
-        status_inactive: La connexion à Yahoo Finance a échoué
-        connection_failed: Impossible de se connecter à Yahoo Finance
-        troubleshooting: Vérifiez votre connexion Internet et les paramètres de votre pare-feu. Yahoo Finance peut être temporairement indisponible.
+        title: "Yahoo Finance"
+        description: "Yahoo Finance fournit un accès gratuit aux cours boursiers, taux de change et données financières sans nécessiter de clé API."
+        status_active: "Yahoo Finance est actif et fonctionne"
+        status_inactive: "La connexion à Yahoo Finance a échoué"
+        connection_failed: "Impossible de se connecter à Yahoo Finance"
+        troubleshooting: "Vérifiez votre connexion Internet et les paramètres de votre pare-feu. Yahoo Finance peut être temporairement indisponible."
+      tiingo_settings:
+        title: "Tiingo"
+        description: "Saisissez le token API fourni par Tiingo. Le forfait gratuit supporte 50 symboles uniques par heure avec plus de 30 ans de données historiques."
+        env_configured_message: "Configuré avec succès via la variable d'environnement TIINGO_API_KEY."
+        label: "Token API"
+        placeholder: "Entrez votre token API Tiingo ici"
+        show_details: "(afficher les détails)"
+        step_1_html: 'Visitez <a href="https://www.tiingo.com" target="_blank" rel="noopener noreferrer" class="underline">tiingo.com</a> et créez un compte gratuit.'
+        step_2_html: 'Accédez à la page <a href="https://www.tiingo.com/account/api/token" target="_blank" rel="noopener noreferrer" class="underline">Token API</a>.'
+        step_3: "Copiez votre token API et collez-le ci-dessous."
+      eodhd_settings:
+        title: "EODHD"
+        description: "Saisissez le token API fourni par EODHD. Supporte les ETF européens sur LSE, XETRA et d'autres places boursières internationales."
+        env_configured_message: "Configuré avec succès via la variable d'environnement EODHD_API_KEY."
+        label: "Token API"
+        placeholder: "Entrez votre token API EODHD ici"
+        show_details: "(afficher les détails)"
+        step_1_html: 'Visitez <a href="https://eodhd.com/register" target="_blank" rel="noopener noreferrer" class="underline">eodhd.com</a> et créez un compte gratuit.'
+        step_2_html: 'Accédez à votre <a href="https://eodhd.com/cp/dashboard" target="_blank" rel="noopener noreferrer" class="underline">Tableau de bord</a> pour trouver votre token API.'
+        step_3: "Copiez votre token API et collez-le ci-dessous."
+        rate_limit_warning: "Le forfait gratuit EODHD est limité à 20 appels API par jour. À utiliser de préférence comme fournisseur complémentaire pour les ETF européens non disponibles chez d'autres fournisseurs."
+      alpha_vantage_settings:
+        title: "Alpha Vantage"
+        description: "Saisissez la clé API d'Alpha Vantage. Supporte les ETF européens sur la Bourse de Londres, XETRA et d'autres places boursières."
+        env_configured_message: "Configuré avec succès via la variable d'environnement ALPHA_VANTAGE_API_KEY."
+        label: "Clé API"
+        placeholder: "Entrez votre clé API Alpha Vantage ici"
+        show_details: "(afficher les détails)"
+        step_1_html: 'Visitez <a href="https://www.alphavantage.co/support/#api-key" target="_blank" rel="noopener noreferrer" class="underline">alphavantage.co</a> et réclamez votre clé API gratuite.'
+        step_2: "Copiez la clé API et collez-la ci-dessous."
+        rate_limit_warning: "Le forfait gratuit Alpha Vantage est limité à 25 appels API par jour. À utiliser de préférence comme fournisseur complémentaire pour les ETF européens non disponibles chez d'autres fournisseurs."
+        no_health_check_note: "La vérification de l'état de la connexion n'est pas disponible pour ce fournisseur en raison de la limite de débit stricte."
       twelve_data_settings:
+        title: "Twelve Data"
         api_calls_used: "%{used} / %{limit} appels API quotidiens utilisés (%{percentage})"
-        description: Saisissez la clé API fournie par Twelve Data
-        env_configured_message: Configurée avec succès via la variable d'environnement TWELVE_DATA_API_KEY.
-        label: Clé API
-        placeholder: Entrez votre clé API ici
-        plan: "Plan %{plan}"
-        title: Twelve Data
+        description: "Saisissez la clé API fournie par Twelve Data"
+        env_configured_message: "Configurée avec succès via la variable d'environnement TWELVE_DATA_API_KEY."
+        label: "Clé API"
+        placeholder: "Entrez votre clé API ici"
+        show_details: "(afficher les détails)"
+        step_1_html: 'Visitez <a href="https://twelvedata.com/register" target="_blank" rel="noopener noreferrer" class="underline">twelvedata.com</a> et créez un compte Twelve Data Developer gratuit.'
+        step_2_html: 'Accédez à la page <a href="https://twelvedata.com/account/api-keys" target="_blank" rel="noopener noreferrer" class="underline">Clés API</a>.'
+        step_3: "Révélez votre clé secrète et collez-la ci-dessous."
+        plan: "Forfait %{plan}"
+        plan_upgrade_warning_title: "Certains tickers nécessitent un forfait payant"
+        plan_upgrade_warning_description: "Les tickers suivants de votre portefeuille ne peuvent pas synchroniser leurs cours avec votre forfait Twelve Data actuel."
+        requires_plan: "nécessite le forfait %{plan}"
+        view_pricing: "Voir les tarifs Twelve Data"
       update:
-        failure: Valeur de paramètre invalide
-        success: Paramètres mis à jour
-        invalid_onboarding_state: État d'inscription invalide
-        invalid_sync_time: Format d'heure de synchronisation invalide. Veuillez utiliser le format HH:MM (ex. 02:30).
-        scheduler_sync_failed: Paramètres enregistrés, mais la mise à jour du planning de synchronisation a échoué. Veuillez réessayer ou vérifier les journaux du serveur.
+        failure: "Valeur de paramètre invalide"
+        success: "Paramètres mis à jour"
+        invalid_onboarding_state: "État d'intégration invalide"
+        invalid_sync_time: "Format d'heure de synchronisation invalide. Veuillez utiliser le format HH:MM (ex. 02:30)."
+        invalid_llm_budget: "%{field} doit être un nombre entier ≥ %{minimum}."
+        scheduler_sync_failed: "Paramètres enregistrés, mais la mise à jour du planning de synchronisation a échoué. Veuillez réessayer ou vérifier les journaux du serveur."
+      disconnect_external_assistant:
+        external_assistant_disconnected: "Assistant externe déconnecté"
       clear_cache:
-        cache_cleared: Le cache de données a été effacé. Cela peut prendre quelques instants.
-      not_authorized: Vous n'êtes pas autorisé(e) à effectuer cette action
+        cache_cleared: "Le cache de données a été effacé. Cela peut prendre quelques instants."
+      not_authorized: "Vous n'êtes pas autorisé(e) à effectuer cette action"
       sync_settings:
-        auto_sync_label: Activer la synchronisation automatique
-        auto_sync_description: Lorsque cette option est activée, tous les comptes seront automatiquement synchronisés quotidiennement à l'heure spécifiée.
-        auto_sync_time_label: Heure de synchronisation (HH:MM)
-        auto_sync_time_description: Spécifiez l'heure à laquelle la synchronisation automatique doit se produire.
-        include_pending_label: Inclure les transactions en attente
-        include_pending_description: Lorsque cette option est activée, les transactions en attente (non confirmées) seront importées et automatiquement réconciliées lors de leur validation. Désactivez si votre banque fournit des données de transactions en attente peu fiables.
-        env_configured_message: Ce paramètre est désactivé car une variable d'environnement du fournisseur (SIMPLEFIN_INCLUDE_PENDING ou PLAID_INCLUDE_PENDING) est définie. Supprimez-la pour activer ce paramètre.
+        auto_sync_label: "Activer la synchronisation automatique"
+        auto_sync_description: "Lorsque cette option est activée, tous les comptes seront automatiquement synchronisés quotidiennement à l'heure spécifiée."
+        auto_sync_time_label: "Heure de synchronisation (HH:MM)"
+        auto_sync_time_description: "Spécifiez l'heure à laquelle la synchronisation automatique doit se produire."
+        include_pending_label: "Inclure les transactions en attente"
+        include_pending_description: "Lorsque cette option est activée, les transactions en attente (non confirmées) seront importées et automatiquement réconciliées lors de leur validation. Désactivez si votre banque fournit des données de transactions en attente peu fiables."
+        env_configured_message: "Ce paramètre est désactivé car une variable d'environnement du fournisseur (SIMPLEFIN_INCLUDE_PENDING ou PLAID_INCLUDE_PENDING) est définie. Supprimez-la pour activer ce paramètre."
diff --git a/config/locales/views/settings/hostings/hu.yml b/config/locales/views/settings/hostings/hu.yml
new file mode 100644
index 000000000..3d0131bfb
--- /dev/null
+++ b/config/locales/views/settings/hostings/hu.yml
@@ -0,0 +1,195 @@
+---
+hu:
+  settings:
+    hostings:
+      invite_code_settings:
+        description: Szabályozd, hogyan regisztrálnak az új felhasználók a(z) %{product} példányodra.
+        email_confirmation_description: Ha engedélyezve van, a felhasználóknak meg kell erősíteniük az e-mail
+          címüket, amikor megváltoztatják azt.
+        email_confirmation_title: E-mail-megerősítés megkövetelése
+        default_family_title: Alapértelmezett csoport az új felhasználóknak
+        default_family_description: "Az új felhasználókat csak akkor helyezd ebbe a csoportba, ha nincs meghívójuk."
+        default_family_none: Nincs (új csoport létrehozása)
+        generate_tokens: Új kód generálása
+        generated_tokens: Generált kódok
+        title: Regisztráció
+        states:
+          open: Nyitott
+          closed: Zárt
+          invite_only: Csak meghívóval
+      show:
+        general: Általános beállítások
+        ai_assistant: AI-asszisztens
+        financial_data_providers: Pénzügyi adatszolgáltatók
+        sync_settings: Szinkronizálási beállítások
+        invites: Meghívókódok
+        title: Lokális futtatás
+        danger_zone: Veszélyzóna
+        clear_cache: Adatcache törlése
+        clear_cache_warning: Az adatcache törlésével eltávolítod az összes árfolyamot, értékpapír-árat, fiókegyenleget és egyéb adatot. Ez nem törli a fiókokat, tranzakciókat, kategóriákat és egyéb felhasználói adatokat.
+        confirm_clear_cache:
+          title: Törli az adatcache-t?
+          body: Biztosan törölni szeretnéd az adatcache-t? Ez eltávolítja az összes árfolyamot, értékpapír-árat, fiókegyenleget és egyéb adatot. Ez a művelet nem vonható vissza.
+      provider_selection:
+        exchange_rate_title: Árfolyam-szolgáltató
+        exchange_rate_description: Válassz egyetlen szolgáltatót az árfolyamok lekéréséhez.
+        exchange_rate_provider_label: Árfolyam-szolgáltató
+        securities_title: Értékpapír-szolgáltatók
+        securities_description: Engedélyezz egy vagy több szolgáltatót részvény-, ETF- és befektetési alap-árak lekéréséhez. Kereséskor az összes engedélyezett szolgáltató le lesz kérdezve, és az eredmények össze lesznek vonva.
+        env_configured_message: A szolgáltatóválasztás le van tiltva, mert környezeti változók vannak beállítva. Az itt történő kiválasztás engedélyezéséhez távolítsd el ezeket a környezeti változókat a konfigurációdból.
+        twelve_data_hint: API-kulcs szükséges, 800 kredit/nap
+        yahoo_finance_hint: ingyenes, nem kell API-kulcs
+        requires_api_key: API-kulcs szükséges
+        requires_api_key_eodhd: API-kulcs szükséges, 20 hívás/nap limit
+        requires_api_key_alpha_vantage: API-kulcs szükséges, 25 hívás/nap limit
+        mfapi_hint: ingyenes, nem kell API-kulcs – csak indiai befektetési alapok
+        binance_public_hint: ingyenes, nem kell API-kulcs – csak kriptó (BTC, ETH stb.)
+        providers:
+          twelve_data: Twelve Data
+          yahoo_finance: Yahoo Finance
+          tiingo: Tiingo
+          eodhd: EODHD
+          alpha_vantage: Alpha Vantage
+          mfapi: MFAPI.in
+          binance_public: Binance
+      assistant_settings:
+        title: AI-asszisztens
+        description: Válaszd ki, hogyan válaszoljon a csevegési asszisztens. A beépített mód közvetlenül a beállított LLM-szolgáltatót használja. A külső mód egy távoli AI-ügynökhöz továbbítja a kérést, amely MCP-n keresztül hozzáférhet a Sure pénzügyi eszközeihez.
+        type_label: Asszisztens típusa
+        type_builtin: Beépített (Built-in LLM)
+        type_external: Külső (távoli ügynök)
+        external_status: Külső asszisztens végpontja
+        external_configured: Konfigurálva
+        external_not_configured: Nincs konfigurálva. Add meg az URL-t és a tokent alább, vagy állítsd be az EXTERNAL_ASSISTANT_URL és EXTERNAL_ASSISTANT_TOKEN környezeti változókat.
+        env_notice: "Az asszisztens típusa '%{type}'-ra van rögzítve az ASSISTANT_TYPE környezeti változó által."
+        env_configured_external: Sikeresen konfigurálva környezeti változókon keresztül.
+        url_label: Végpont URL
+        url_placeholder: "https://a-te-agentszolgaltato-hosztod/v1/chat"
+        url_help: Az ügynök API-végpontjának teljes URL-je. Az ügynökszolgáltatód adja meg ezt.
+        token_label: API-token
+        token_placeholder: Add meg az ügynökszolgáltatódtól kapott tokent
+        token_help: A külső ügynök által biztosított hitelesítési token. Ez minden kéréssel együtt Bearer tokenként kerül elküldésre.
+        agent_id_label: Ügynökazonosító (nem kötelező)
+        agent_id_placeholder: "main (alapértelmezett)"
+        agent_id_help: Egy adott ügynökre irányít, ha a szolgáltató több ügynököt üzemeltet. Hagyd üresen az alapértelmezetthez.
+        disconnect_title: Külső kapcsolat
+        disconnect_description: Távolítsd el a külső asszisztens kapcsolatát, és térj vissza a beépített asszisztenshez.
+        disconnect_button: Kapcsolat bontása
+        confirm_disconnect:
+          title: Bontod a külső asszisztens kapcsolatát?
+          body: Ez eltávolítja a mentett URL-t, tokent és ügynökazonosítót, és visszavált a beépített asszisztensre. Később újra csatlakozhatsz új hitelesítő adatok megadásával.
+      brand_fetch_settings:
+        description: Add meg a Brand Fetch által biztosított kliens-azonosítót
+        env_configured_message: Sikeresen konfiguráltad a Brand Fetch kliens-azonosítódat a BRAND_FETCH_CLIENT_ID környezeti változón keresztül.
+        show_details: "(részletek megjelenítése)"
+        setup_step_1_html: 'Látogass el a <a href="https://brandfetch.com/developers" target="_blank" rel="noopener noreferrer" class="underline">brandfetch.com</a> oldalra, és hozz létre egy ingyenes Brand Fetch fejlesztői fiókot.'
+        setup_step_2_html: 'Menj a <a href="https://developers.brandfetch.com/dashboard/logo-api" target="_blank" rel="noopener noreferrer" class="underline">Logo API</a> oldalra.'
+        setup_step_3: 'Kattints a szem ikonra a „Your Client ID" rész alatt, hogy megjelenítsd a kliens-azonosítódat, majd illeszd be alább.'
+        label: Kliens-azonosító
+        placeholder: Add meg ide a kliens-azonosítódat
+        title: Brand Fetch beállítások
+        high_res_label: Nagy felbontású logók engedélyezése
+        high_res_description: Ha engedélyezve van, a logók 120x120 felbontásban kerülnek lekérésre 40x40 helyett. Ez élesebb képeket biztosít nagy felbontású kijelzőkön.
+      openai_settings:
+        description: Add meg a hozzáférési tokent, és opcionálisan konfigurálj egy egyéni OpenAI-kompatibilis szolgáltatót
+        env_configured_message: Sikeresen konfigurálva környezeti változókon keresztül.
+        access_token_label: Hozzáférési token
+        access_token_placeholder: Add meg ide a hozzáférési tokenedet
+        uri_base_label: API alap URL (nem kötelező)
+        uri_base_placeholder: "https://api.openai.com/v1 (alapértelmezett)"
+        model_label: Modell (nem kötelező)
+        model_placeholder: "gpt-4.1 (alapértelmezett)"
+        json_mode_label: JSON mód
+        json_mode_auto: Automatikus (ajánlott)
+        json_mode_strict: Szigorú (gondolkodó modellekhez a legjobb)
+        json_mode_none: Nincs (standard modellekhez a legjobb)
+        json_mode_json_object: JSON objektum
+        json_mode_help: "A szigorú mód a legjobb a gondolkodó modellekhez (qwen-thinking, deepseek-reasoner). A nincs mód a legjobb a standard modellekhez (llama, mistral, gpt-oss)."
+        budget_heading: Tokenköltségkeret
+        budget_description: Minden LLM-hívásra vonatkozik – csevegési előzmények, automatikus kategorizálás, kereskedő-felismerés és PDF-feldolgozás. Az alapértelmezések konzervatívak a kis kontextusablakú helyi modellekhez. Emeld meg a felhőalapú, nagyobb kontextusablakú modellekhez.
+        context_window_label: Kontextusablak (nem kötelező)
+        context_window_help: "Az összes token, amelyet a modell elfogad. Alapértelmezett: 2048 – emeld 8192+-ra felhőalapú OpenAI vagy nagy kontextusú helyi modelleknél."
+        max_response_tokens_label: Maximális válasz-tokenek (nem kötelező)
+        max_response_tokens_help: "A modell válaszához fenntartott tokenek. Alapértelmezett: 512. Csökkentsd, ha több helyet szeretnél a hosszabb előzményeknek."
+        max_items_per_call_label: Maximális elemek kötegenként (nem kötelező)
+        max_items_per_call_help: "Felső korlát az automatikus kategorizálási / kereskedő-felismerési kötegeknél. Alapértelmezett: 25. A nagyobb kötegek automatikusan felosztódnak a kontextusablakba féréshez."
+        title: OpenAI
+      yahoo_finance_settings:
+        title: Yahoo Finance
+        description: A Yahoo Finance ingyenes hozzáférést biztosít részvényárakhoz, árfolyamokhoz és pénzügyi adatokhoz API-kulcs nélkül.
+        status_active: A Yahoo Finance aktív és működik
+        status_inactive: A Yahoo Finance kapcsolat sikertelen
+        connection_failed: Nem sikerült csatlakozni a Yahoo Finance-hez
+        troubleshooting: Ellenőrizd az internetkapcsolatot és a tűzfal beállításait. A Yahoo Finance átmenetileg nem érhető el.
+      tiingo_settings:
+        title: Tiingo
+        description: Add meg a Tiingo által biztosított API-tokent. Az ingyenes csomag óránként 50 egyedi szimbólumot támogat, 30+ év historikus adattal.
+        env_configured_message: Sikeresen konfigurálva a TIINGO_API_KEY környezeti változón keresztül.
+        label: API-token
+        placeholder: Add meg ide a Tiingo API-tokenedet
+        show_details: "(részletek megjelenítése)"
+        step_1_html: 'Látogass el a <a href="https://www.tiingo.com" target="_blank" rel="noopener noreferrer" class="underline">tiingo.com</a> oldalra, és hozz létre egy ingyenes fiókot.'
+        step_2_html: 'Lépj az <a href="https://www.tiingo.com/account/api/token" target="_blank" rel="noopener noreferrer" class="underline">API Token</a> oldalra.'
+        step_3: Másold ki az API-tokenedet, és illeszd be alább.
+      eodhd_settings:
+        title: EODHD
+        description: Add meg az EODHD által biztosított API-tokent. Támogatja az EU ETF-eket LSE-n, XETRA-n és más nemzetközi tőzsdéken.
+        env_configured_message: Sikeresen konfigurálva az EODHD_API_KEY környezeti változón keresztül.
+        label: API-token
+        placeholder: Add meg ide az EODHD API-tokenedet
+        show_details: "(részletek megjelenítése)"
+        step_1_html: 'Látogass el az <a href="https://eodhd.com/register" target="_blank" rel="noopener noreferrer" class="underline">eodhd.com</a> oldalra, és hozz létre egy ingyenes fiókot.'
+        step_2_html: 'Lépj az <a href="https://eodhd.com/cp/dashboard" target="_blank" rel="noopener noreferrer" class="underline">irányítópultra</a> az API-token megkereséséhez.'
+        step_3: Másold ki az API-tokenedet, és illeszd be alább.
+        rate_limit_warning: "Az EODHD ingyenes csomag napi 20 API-hívásra korlátozott. Leginkább kiegészítő szolgáltatóként ajánlott az EU ETF-ekhez, amelyek más szolgáltatóknál nem elérhetők."
+      alpha_vantage_settings:
+        title: Alpha Vantage
+        description: Add meg az Alpha Vantage API-kulcsát. Támogatja az EU ETF-eket a London Stock Exchange-en, XETRA-n és más tőzsdéken.
+        env_configured_message: Sikeresen konfigurálva az ALPHA_VANTAGE_API_KEY környezeti változón keresztül.
+        label: API-kulcs
+        placeholder: Add meg ide az Alpha Vantage API-kulcsodat
+        show_details: "(részletek megjelenítése)"
+        step_1_html: 'Látogass el az <a href="https://www.alphavantage.co/support/#api-key" target="_blank" rel="noopener noreferrer" class="underline">alphavantage.co</a> oldalra, és igényeld az ingyenes API-kulcsodat.'
+        step_2: Másold ki az API-kulcsot, és illeszd be alább.
+        rate_limit_warning: "Az Alpha Vantage ingyenes csomag napi 25 API-hívásra korlátozott. Leginkább kiegészítő szolgáltatóként ajánlott az EU ETF-ekhez, amelyek más szolgáltatóknál nem elérhetők."
+        no_health_check_note: "A kapcsolat egészségügyi ellenőrzése nem érhető el ehhez a szolgáltatóhoz a szigorú sebességkorlát miatt."
+      twelve_data_settings:
+        api_calls_used: "%{used} / %{limit} napi API-hívás felhasználva (%{percentage})"
+        description: Add meg a Twelve Data által biztosított API-kulcsot
+        env_configured_message: Sikeresen konfigurálva a TWELVE_DATA_API_KEY környezeti változón keresztül.
+        label: API-kulcs
+        placeholder: Add meg ide az API-kulcsodat
+        show_details: "(részletek megjelenítése)"
+        step_1_html: 'Látogass el a <a href="https://twelvedata.com/register" target="_blank" rel="noopener noreferrer" class="underline">twelvedata.com</a> oldalra, és hozz létre egy ingyenes Twelve Data fejlesztői fiókot.'
+        step_2_html: 'Lépj az <a href="https://twelvedata.com/account/api-keys" target="_blank" rel="noopener noreferrer" class="underline">API-kulcsok</a> oldalra.'
+        step_3: Fedezd fel a titkos kulcsodat, és illeszd be alább.
+        plan: "%{plan} csomag"
+        plan_upgrade_warning_title: Egyes tickerek fizetős csomagot igényelnek
+        plan_upgrade_warning_description: A portfóliódban lévő következő tickerekhez nem szinkronizálhatók az árak a jelenlegi Twelve Data csomagoddal.
+        requires_plan: "%{plan} csomag szükséges"
+        view_pricing: Twelve Data árak megtekintése
+        title: Twelve Data
+      update:
+        failure: Érvénytelen beállítási érték
+        success: Beállítások mentve
+        invalid_onboarding_state: Érvénytelen regisztrációs állapot
+        invalid_sync_time: "Érvénytelen szinkronizálási időformátum. Kérjük, használd a ÓÓ:PP formátumot (pl.: 02:30)."
+        invalid_llm_budget: "%{field} értékének legalább %{minimum} egész számnak kell lennie."
+        scheduler_sync_failed: A beállítások mentve, de a szinkronizálási ütemezés frissítése nem sikerült. Kérjük, próbáld újra, vagy ellenőrizd a szerver naplóit.
+      disconnect_external_assistant:
+        external_assistant_disconnected: A külső asszisztens kapcsolata bontva
+      clear_cache:
+        cache_cleared: Az adatcache törölve. Ez néhány percet vehet igénybe.
+      not_authorized: Nincs jogosultságod ehhez a művelethez
+      ensure_super_admin_for_onboarding:
+        not_authorized: Nincs jogosultságod ehhez a művelethez
+      sync_auto_sync_scheduler!:
+        scheduler_sync_failed: A beállítások mentve, de a szinkronizálási ütemezés frissítése nem sikerült. Kérjük, próbáld újra, vagy ellenőrizd a szerver naplóit.
+      sync_settings:
+        auto_sync_label: Automatikus szinkronizálás engedélyezése
+        auto_sync_description: Ha engedélyezve van, az összes fiók naponta automatikusan szinkronizálódik a megadott időpontban.
+        auto_sync_time_label: Szinkronizálási idő (ÓÓ:PP)
+        auto_sync_time_description: Add meg a nap azon időpontját, amikor az automatikus szinkronizálásnak meg kell történnie.
+        include_pending_label: Függőben lévő tranzakciók belefoglalása
+        include_pending_description: Ha engedélyezve van, a függőben lévő (nem teljesített) tranzakciók importálódnak, és automatikusan egyeztetődnek, amikor könyvelődnek. Tiltsd le, ha a bankod megbízhatatlan függőben lévő adatokat szolgáltat.
+        env_configured_message: Ez a beállítás le van tiltva, mert be van állítva egy szolgáltatói környezeti változó (SIMPLEFIN_INCLUDE_PENDING vagy PLAID_INCLUDE_PENDING). Távolítsd el ezt a beállítás engedélyezéséhez.
diff --git a/config/locales/views/settings/hu.yml b/config/locales/views/settings/hu.yml
new file mode 100644
index 000000000..b43b6cc97
--- /dev/null
+++ b/config/locales/views/settings/hu.yml
@@ -0,0 +1,468 @@
+---
+hu:
+  views:
+    settings:
+      payments:
+        renewal: "A hozzájárulásod %{date}-én megújul."
+        cancellation: "A hozzájárulásod %{date}-én lejár."
+  settings:
+    llm_usages:
+      show:
+        page_title: "LLM-használat és -költségek"
+        subtitle: "Kövesd nyomon az AI-használatot és a becsült költségeket"
+        start_date: "Kezdő dátum"
+        end_date: "Záró dátum"
+        filter: "Szűrő"
+        total_requests: "Összes kérés"
+        total_tokens: "Összes token"
+        prompt: "prompt"
+        completion: "befejezés"
+        total_cost: "Összes költség"
+        avg_cost_per_request: "Átl. költség/kérés"
+        based_on_requests: "%{total} kérésből %{with_cost} rendelkezik költségadattal"
+        cost_by_operation: "Költség műveletek szerint"
+        cost_by_model: "Költség modellek szerint"
+        recent_usage: "Legutóbbi használat"
+        col_date: "Dátum"
+        col_operation: "Művelet"
+        col_model: "Modell"
+        col_tokens: "Tokenek"
+        col_cost: "Költség"
+        failed: "Sikertelen"
+        no_usage_data: "Nem található használati adat a kiválasztott időszakra"
+        cost_estimates_title: "A költségbecslésekről"
+        cost_estimates_description: "A költségek az OpenAI 2025-ös árazása alapján vannak becsülve. A tényleges költségek eltérhetnek. Az árazás millió tokenenként van megadva, és modellenként változik. Az egyéni vagy önállóan üzemeltetett modellek \"N/A\"-t mutatnak, és nem szerepelnek a költségösszesítőkben."
+    ai_prompts:
+      show:
+        page_title: MI promptok
+        openai_label: OpenAI
+        disable_ai: MI asszisztens letiltása
+        prompt_instructions: Prompt utasítások
+        main_system_prompt:
+          title: Fő rendszerprompt
+          subtitle: Alapvető utasítások, amelyek meghatározzák, hogyan viselkedik az MI asszisztens minden csevegési beszélgetésben
+        transaction_categorizer:
+          title: Tranzakció-kategorizáló
+          subtitle: Az MI automatikusan kategorizálja a tranzakcióidat a meghatározott kategóriák alapján
+        merchant_detector:
+          title: Kereskedő-felismerő
+          subtitle: Az MI azonosítja és kereskedőinformációkkal gazdagítja a tranzakcióadatokat
+    payments:
+      show:
+        page_title: Fizetések
+        subscription_subtitle: Frissítsd bankkártyaadataidat
+        subscription_title: Hozzájárulások kezelése
+        currently_on_plan: "Jelenleg a"
+        trialing: "Jelenleg a %{product_name} nyílt demóját használod"
+        trial_days_left:
+          one: "Az adatok %{count} nap múlva törlődnek"
+          other: "Az adatok %{count} nap múlva törlődnek"
+        not_contributing_prefix: "Jelenleg"
+        not_contributing_emphasis: "nem járulsz hozzá"
+        contributions_note: "A(z) %{product_name} felé tett hozzájárulásaid itt jelennek meg."
+        manage: "Kezelés"
+        choose_level: "Szint kiválasztása"
+        payment_via_stripe: "Fizetés Stripe-on keresztül"
+    appearances:
+      show:
+        page_title: Megjelenés
+        theme_title: Téma
+        theme_subtitle: Válassz egy előnyben részesített témát az alkalmazáshoz
+        theme_dark: Sötét
+        theme_light: Világos
+        theme_system: Rendszer
+        transactions_title: Tranzakciók
+        transactions_subtitle: Szabd testre a tranzakciók megjelenítését
+        dashboard_title: Irányítópult
+        dashboard_subtitle: Szabd testre az irányítópult megjelenítését
+        dashboard_two_column_title: Kétoszlopos elrendezés
+        dashboard_two_column_description: Az irányítópult-widgetek megjelenítése két oszlopban nagy képernyőkön. Ha ki van kapcsolva, a widgetek egyetlen oszlopban egymás alatt jelennek meg.
+        split_grouped_title: Felosztott tranzakciók csoportosítása
+        split_grouped_description: A felosztott tranzakciók megjelenítése szülőjük alatt csoportosítva a tranzakciólistában. Ha ki van kapcsolva, a felosztott tételek egyedi sorként jelennek meg.
+    preferences:
+      show:
+        country: Ország
+        currency: Pénznem
+        date_format: Dátumformátum
+        general_subtitle: Preferenciáid beállítása
+        general_title: Általános
+        default_period: Alapértelmezett időszak
+        default_account_order: Számlák alapértelmezett sorrendje
+        language: Nyelv
+        language_auto: Böngésző nyelve
+        page_title: Preferenciák
+        timezone: Időzóna
+        month_start_day: A költségvetési hónap kezdete
+        month_start_day_hint: Állítsd be, mikor kezdődjön a költségvetési hónapod (pl. fizetési nap)
+        month_start_day_warning: A költségvetéseid és a hónapközi számítások ezt az egyéni kezdőnapot használják az 1-je helyett.
+        currencies_title: "%{moniker} pénznemek"
+        currencies_subtitle: Válaszd ki, mely pénznemek jelenjenek meg a pénzmezőkben a %{moniker} számára
+        base_currency_label: Alappénznem
+        base_currency_badge: Alappénznem
+        additional_currencies_label: További pénznemek
+        no_additional_currencies: Nincs kiválasztva
+        currencies_more: "+%{count} további"
+        manage_currencies: Pénznemek kezelése
+        manage_currencies_subtitle: Szüntess meg olyan pénznemeket, amelyeket sosem használsz, vagy szűkítsd le a listát néhányra.
+        select_all_currencies: Összes kijelölése
+        select_base_only: Csak alappénznem
+        currency_search_placeholder: Pénznem keresése
+        no_matching_currencies: Nem található pénznem
+        selected_currencies_count:
+          one: "%{count} kijelölve"
+          other: "%{count} kijelölve"
+        save_currencies: Pénznemek mentése
+        sharing_title: "%{moniker} megosztás"
+        sharing_subtitle: "Szabályozd, hogyan kerüljenek megosztásra a számlák a %{moniker} tagjaival"
+        sharing_default_label: Új számlák alapértelmezett megosztása
+        sharing_shared: Megosztás az összes taggal
+        sharing_private: Alapértelmezetten privát
+    profiles:
+      destroy:
+        cannot_remove_self: Nem távolíthatod el magadat a fiókból.
+        member_removal_failed: Probléma merült fel a tag eltávolítása során.
+        member_removed: A tag sikeresen eltávolítva.
+        not_authorized: Nincs jogosultságod tagok eltávolítására.
+      show:
+        confirm_delete:
+          body: Biztosan véglegesen törölni szeretnéd a fiókodat? Ez a művelet visszavonhatatlan.
+          title: Fiók törlése?
+        confirm_reset:
+          body: Biztosan vissza szeretnéd állítani a fiókodat? Ez törli az összes számládat, kategóriádat, kereskedődet, címkédet és egyéb adatodat. Ez a művelet nem vonható vissza.
+          title: Fiók visszaállítása?
+        confirm_reset_with_sample_data:
+          body: Biztosan vissza szeretnéd állítani a fiókodat és betölteni a mintaadatokat? Ez törli a meglévő adataidat, és demo adatokkal helyettesíti azokat, hogy biztonságosan felfedezhessed a Sure-t.
+          title: Fiók visszaállítása és mintaadatok betöltése?
+        confirm_remove_invitation:
+          body: Biztosan el szeretnéd távolítani a %{email} részére szóló meghívót?
+          title: Meghívó eltávolítása
+        confirm_remove_member:
+          body: Biztosan el szeretnéd távolítani %{name} személyt a fiókodból?
+          title: Tag eltávolítása
+        danger_zone_title: Veszélyes zóna
+        delete_account: Fiók törlése
+        delete_account_warning: A fiók törlése véglegesen eltávolítja az összes adatodat, és nem vonható vissza.
+        reset_account: Fiók visszaállítása
+        reset_account_warning: A fiók visszaállítása törli az összes számládat, kategóriádat, kereskedődet, címkédet és egyéb adatodat, de a felhasználói fiókod megmarad.
+        reset_account_with_sample_data: Visszaállítás és előtöltés
+        reset_account_with_sample_data_warning: Töröld az összes meglévő adatodat, majd tölts be friss mintaadatokat, hogy egy előre kitöltött környezetben fedezhesd fel az alkalmazást.
+        email: E-mail cím
+        first_name: Keresztnév
+        group_form_input_placeholder: Adj meg egy csoportnevet
+        group_form_label: Csoport neve
+        group_title: Csoporttagok
+        household_form_input_placeholder: Adj meg egy háztartásnevet
+        household_form_label: Háztartás neve
+        household_subtitle: A meghívottak bejelentkezhetnek a %{moniker} fiókodba és hozzáférhetnek a megosztott erőforrásokhoz.
+        household_title: Háztartás
+        invitation_link: Meghívó link
+        invite_member: Tag hozzáadása
+        last_name: Vezetéknév
+        page_title: Profiladatok
+        pending: Függőben
+        profile_subtitle: Szabd testre, hogyan jelensz meg a %{product_name} alkalmazásban
+        profile_title: Személyes
+        remove_invitation: Meghívó eltávolítása
+        remove_member: Tag eltávolítása
+        save: Mentés
+    securities:
+      show:
+        page_title: Biztonság
+        mfa_title: Kétlépéses azonosítás
+        mfa_description: Adj hozzá egy extra biztonsági réteget a fiókodhoz azáltal, hogy bejelentkezéskor egy kódot kérsz a hitelesítő alkalmazásodtól
+        enable_mfa: Kétlépéses azonosítás bekapcsolása
+        disable_mfa: Kétlépéses azonosítás kikapcsolása
+        disable_mfa_confirm: Biztosan ki szeretnéd kapcsolni a kétlépéses azonosítást?
+        sso_title: Kapcsolt fiókok
+        sso_subtitle: Egyszeri bejelentkezési fiókkapcsolatok kezelése
+        sso_disconnect: Leválasztás
+        sso_last_used: Utoljára használva
+        sso_never: Soha
+        sso_no_email: Nincs e-mail cím
+        sso_no_identities: Nincs kapcsolt egyszeri bejelentkezési fiók
+        sso_connect_hint: Jelentkezz ki, majd jelentkezz be egy SSO-szolgáltatóval a fiók összekapcsolásához.
+        sso_confirm_title: Fiók leválasztása?
+        sso_confirm_body: Biztosan le szeretnéd választani a %{provider} fiókodat? Később újra összekapcsolhatod, ha azzal a szolgáltatóval jelentkezel be.
+        sso_confirm_button: Leválasztás
+        sso_warning_message: Ez az egyetlen bejelentkezési módod. Mielőtt leválasztanád, állíts be jelszót a biztonsági beállításokban, különben kizárhatod magad a fiókodból.
+    settings_nav:
+      accounts_label: Számlák
+      advanced_section_title: Speciális
+      ai_prompts_label: MI promptok
+      api_key_label: API-kulcs
+      payment_label: Fizetés
+      categories_label: Kategóriák
+      feedback_label: Visszajelzés
+      general_section_title: Általános
+      imports_label: Importálások
+      exports_label: Exportálások
+      llm_usage_label: LLM-használat
+      logout: Kijelentkezés
+      merchants_label: Kereskedők
+      providers_label: Szolgáltatók
+      guides_label: Útmutatók
+      other_section_title: Egyéb
+      preferences_label: Preferenciák
+      profile_label: Profiladatok
+      recurring_transactions_label: Ismétlődő
+      rules_label: Szabályok
+      security_label: Biztonság
+      self_hosting_label: Saját üzemeltetés
+      sso_providers_label: SSO-szolgáltatók
+      statement_vault_label: Kimutatástár
+      tags_label: Címkék
+      transactions_section_title: Tranzakciók
+      users_label: Felhasználók
+      whats_new_label: Újdonságok
+      api_keys_label: API-kulcs
+      appearance_label: Megjelenés
+      bank_sync_label: Banki szinkronizálás
+    settings_nav_link_large:
+      next: Következő
+      previous: Vissza
+    user_avatar_field:
+      accepted_formats: JPG vagy PNG. Maximum 5 MB.
+      choose: Fotó feltöltése
+      choose_label: (nem kötelező)
+      change: Fotó módosítása
+    providers:
+      update:
+        updated_successfully: Szolgáltatói beállítások sikeresen frissítve
+        no_changes: Nem történt változtatás
+      not_authorized: Nincs jogosultság
+      bank_sync:
+        page_title: Banki szinkronizálás
+        lede: Csatlakoztasd a külső számlákat, hogy a tranzakciók, egyenlegek és portfólióadatok automatikusan áramlanak a Sure-ba.
+      status:
+        ok: Csatlakoztatva
+        warn: Beavatkozás szükséges
+        err: Hiba
+        off: Nincs konfigurálva
+      maturity:
+        beta: Béta
+        alpha: Alfa
+      drawer_trust_statement: "Csak olvasási hozzáférés. A Sure soha nem tud pénzt mozgatni, és a hitelesítő adatok titkosítva vannak tárolva."
+      setup_steps:
+        eyebrow: Beállítás
+        need_help: "Segítségre van szükséged?"
+      connect: Csatlakozás
+      groups:
+        your_connections: A te kapcsolataid
+        available: Elérhető
+        empty_available: Minden elérhető szolgáltató csatlakoztatva van.
+      health_strip:
+        connected: csatlakoztatva
+        needs_attention: figyelmet igényel
+        accounts_syncing: számla szinkronizálódik
+        last_synced: Utoljára szinkronizálva %{time} ezelőtt
+      meta:
+        sync_error: Szinkronizálási hiba
+        no_recent_sync: Szinkronizálás lejárt
+        registration_needed: Regisztráció szükséges
+        reconsent_required: Újrahozzájárulás szükséges
+        reconsent_needed:
+          one: Újrahozzájárulás szükséges 1 napon belül
+          other: Újrahozzájárulás szükséges %{count} napon belül
+        last_synced: Szinkronizálva %{time} ezelőtt
+      sync_all: Összes szinkronizálása
+      sync_all_in_progress: Az összes csatlakoztatott szolgáltató szinkronizálása folyamatban...
+      sync_all_recently: Szinkronizálás már folyamatban van. Próbáld újra egy pillanat múlva.
+      sync_provider: Szinkronizálás most
+      sync_provider_in_progress: Szinkronizálás elindítva.
+      recently_synced: Nemrég szinkronizálva. Próbáld újra egy pillanat múlva.
+      taglines:
+        simplefin: US bankszámlák csatlakoztatása az open SimpleFIN protokollon keresztül.
+        lunchflow: 40+ ország 20 000+ bankjának csatlakoztatása (Egyesült Királyság, EU, USA stb.!)
+        enable_banking: Európai bankszámlák szinkronizálása PSD2 open banking révén.
+        coinstats: Teljes kriptoportfólió nyomon követése tárcákon és tőzsdéken keresztül.
+        mercury: Mercury üzleti bankszámlák automatikus szinkronizálása.
+        brex: Brex készpénz és vállalati kártya tevékenység szinkronizálása csak olvasási hozzáféréssel.
+        coinbase: Coinbase kriptoeszközök importálása és teljesítmény nyomon követése.
+        binance: Binance spot egyenlegek szinkronizálása csak olvasási API-kulccsal.
+        kraken: Kraken egyenlegek és spot ügyletek szinkronizálása csak olvasási API-kulccsal.
+        snaptrade: Brókeri számlák csatlakoztatása a SnapTrade aggregációs hálózaton keresztül.
+        ibkr: Interactive Brokers befektetési számlák szinkronizálása Flex Query importálással.
+        indexa_capital: Indexa Capital automatizált befektetési portfólió nyomon követése.
+        sophtron: US és kanadai bankok és közüzemi szolgáltatók csatlakoztatása.
+        plaid: Ezernyi US pénzintézet csatlakoztatása Plaid-en keresztül.
+        plaid_eu: Európai pénzintézetek csatlakoztatása Plaid-en keresztül (PSD2 / Open Banking).
+      search_filters:
+        aria_label: Szolgáltatók keresése
+        placeholder: Szolgáltatók keresése
+        chips:
+          all: Összes
+          bank: Bankok
+          crypto: Kripto
+          investment: Befektetések
+      empty_filter: Nincs a szűrőnek megfelelő szolgáltató.
+      clear_filter: Szűrők törlése
+      show:
+        coinbase_title: Coinbase
+      encryption_error:
+        title: Titkosítási konfiguráció szükséges
+        message: Az Active Record titkosítási kulcsok nincsenek konfigurálva. Kérjük, gondoskodj arról, hogy a titkosítási hitelesítő adatok (active_record_encryption.primary_key, active_record_encryption.deterministic_key és active_record_encryption.key_derivation_salt) megfelelően be legyenek állítva a Rails hitelesítő adataiban vagy a környezeti változókban, mielőtt szinkronizálási szolgáltatókat használnál.
+      coinbase_panel:
+        setup_instructions: "A Coinbase csatlakoztatásához:"
+        step1_html: Nyisd meg a <a href="https://portal.cdp.coinbase.com/projects/api-keys" target="_blank" rel="noopener noreferrer" class="text-primary underline">Coinbase API beállításait</a>
+        step2: Hozz létre egy új, csak olvasási jogosultsággal rendelkező API-kulcsot (számlák és tranzakciók megtekintése)
+        step3: Másold ki az API-kulcsot és az API-titkot, majd illeszd be az alábbiakba
+        api_key_label: API-kulcs
+        api_key_placeholder: Add meg a Coinbase API-kulcsodat
+        api_secret_label: API-titok
+        api_secret_placeholder: Add meg a Coinbase API-titkodat
+        connect_button: Coinbase csatlakoztatása
+        syncing: Szinkronizálás...
+        sync: Szinkronizálás
+        disconnect_confirm: Biztosan le szeretnéd választani ezt a Coinbase-kapcsolatot? A szinkronizált számlák manuális számlákká válnak.
+      binance_panel:
+        setup_instructions: "A Binance csatlakoztatásához hozz létre egy csak olvasási jogosultsággal rendelkező API-kulcsot:"
+        step1_html: 'Nyisd meg a <a href="https://www.binance.com/en/my/settings/api-management" target="_blank" rel="noopener noreferrer" class="underline">Binance API-kezelőjét</a>'
+        step2: "Hozz létre egy új API-kulcsot, csak olvasási engedéllyel"
+        step3: "Illeszd be az API-kulcsodat és az API-titkodat az alábbiakba"
+        no_withdraw_warning: "Figyelmeztetés: NE engedélyezd a kifizetési jogosultságot"
+        no_withdraw_title: "Csak olvasható kulcs"
+        no_withdraw_body: "Ne engedélyezd a kifizetési jogosultságot a Binance API-kulcs létrehozásakor. A Sure csak olvasási hozzáférést igényel."
+        ip_hint_title: "IP-cím-engedélyezési lista szükséges"
+        ip_hint_body: "Add hozzá az alkalmazásszerver kimenő IP-címét a Binance API-kulcs engedélyezési listájához:"
+        ip_hint_contact_admin: "Az alkalmazásszerver kimenő IP-címéért fordulj a rendszergazdádhoz."
+        api_key_label: API-kulcs
+        api_key_placeholder: Illeszd be a Binance API-kulcsodat
+        api_secret_label: API-titok
+        api_secret_placeholder: Illeszd be a Binance API-titkodat
+        connect_button: Binance csatlakoztatása
+        syncing: Szinkronizálás...
+        sync: Szinkronizálás
+        disconnect_confirm: "Biztosan le szeretnéd választani a Binance-t?"
+      kraken_panel:
+        step1_html: 'Nyisd meg a <a href="https://pro.kraken.com/app/settings/api" target="_blank" rel="noopener noreferrer" class="underline">Kraken API-beállításait</a>'
+        step2: "Hozz létre egy API-kulcsot csak Lekérdezési alapok és Lekérdezési zárt megbízások & ügyletek jogosultsággal."
+        step3: "Illeszd be az API-kulcsot és a privát kulcsot az alábbiakba."
+        read_only_title: "Csak olvasási tőzsdei szinkronizálás"
+        read_only_body: "Ne adj kereskedési, visszavonási, kifizetési, exportálási, főkönyvi, Earn, staking vagy átutalási jogosultságot. A Sure csak egyenlegeket, pozíciókat és spot ügyletek adatait importálja."
+        default_connection_name: Kraken
+        add_connection: Kraken-kapcsolat hozzáadása
+        update_connection: Kapcsolat frissítése
+        connection_name_label: Kapcsolat neve
+        connection_name_placeholder: Fő Kraken
+        api_key_label: API-kulcs
+        api_key_placeholder: Illeszd be a Kraken API-kulcsodat
+        keep_api_key_placeholder: Hagyd üresen a meglévő API-kulcs megtartásához
+        api_secret_label: Privát kulcs
+        api_secret_placeholder: Illeszd be a Kraken privát kulcsodat
+        keep_api_secret_placeholder: Hagyd üresen a meglévő privát kulcs megtartásához
+        setup_accounts: Számla beállítása
+        syncing: Szinkronizálás...
+        sync: Szinkronizálás
+        disconnect: Lecsatlakozás
+        disconnect_confirm: "Biztosan le szeretnéd választani a(z) %{name}-t?"
+      enable_banking_panel:
+        callback_url_instruction: "A visszahívási URL-hez használd a következőt: %{callback_url}."
+        connection_error: Kapcsolódási hiba
+        step_1_html: "Menj a(z) %{link} oldalra, és szerezd meg a fejlesztői hitelesítő adataidat."
+        step_2: "Válaszd ki az országodat, és illeszd be az alkalmazásazonosítót és az ügyfél-tanúsítványt alább."
+        step_3: "Mentsd el, majd a Kapcsolat hozzáadása gombbal csatlakoztasd a bankod."
+        config_locked_title: "Konfiguráció zárolva"
+        config_locked_message: "Válassz le minden csatlakoztatott bankot a hitelesítő adatok módosítása előtt."
+        application_id_label: "Alkalmazásazonosító"
+        application_id_placeholder_new: "Add meg az alkalmazásazonosítót"
+        application_id_placeholder_update: "Add meg az új azonosítót a frissítéshez"
+        client_certificate_label: "Ügyfél-tanúsítvány (privát kulccsal)"
+        save_and_connect: "Mentés és csatlakozás"
+        update_connection: "Kapcsolat frissítése"
+        connected_bank: "Csatlakoztatott bank"
+        session_expires: "Munkamenet lejárata: %{date}"
+        unknown: "Ismeretlen"
+        connection: "Kapcsolat"
+        session_expired_reconnect: "Munkamenet lejárt – csatlakozz újra"
+        configured: "Konfigurálva"
+        ready_to_link: "Kész számlák összekapcsolására"
+        sync: "Szinkronizálás"
+        reconnect: "Újracsatlakozás"
+        connect_bank: "Bank csatlakoztatása"
+        remove: "Eltávolítás"
+        remove_confirm: "Biztosan el szeretnéd távolítani ezt a kapcsolatot?"
+        add_connection: "Kapcsolat hozzáadása"
+        syncing: "Szinkronizálás"
+        select_country: "Ország kiválasztása..."
+        country_label: "Ország"
+      lunchflow_panel:
+        step_1_html: "Menj a(z) %{link} oldalra és hozz létre egy API-kulcsot."
+        step_2: "Illeszd be a kulcsodat alább és csatlakozz."
+        step_3: "Ezután menj a Számlák menübe a szinkronizált számlák összekapcsolásához."
+        api_key_label: "API-kulcs"
+        api_key_placeholder_new: "Illeszd be ide az API-kulcsot"
+        api_key_placeholder_update: "Add meg az új API-kulcsot a frissítéshez"
+        base_url_label: "Alap URL (nem kötelező)"
+        base_url_placeholder: "https://lunchflow.app/api/v1 (alapértelmezett)"
+        save_and_connect: "Mentés és csatlakozás"
+        update_connection: "Kapcsolat frissítése"
+      simplefin_panel:
+        step_1_html: "Menj a(z) %{link} oldalra egy egyszeri beállítási tokenért."
+        step_2: "Illeszd be a tokent alább és csatlakozz."
+        step_3: "Ezután menj a Számlák menübe a szinkronizált számlák összekapcsolásához."
+        setup_token_label: "Beállítási token"
+        setup_token_placeholder: "SimpleFIN beállítási token beillesztése"
+        save_and_connect: "Mentés és csatlakozás"
+      plaid_panel:
+        step_1_html: "Nyisd meg a(z) %{link} oldalt, és másold ki az ügyfél-azonosítódat és titkos kulcsodat."
+        step_2: "Válassz környezetet. Teszteléshez sandbox, éles számlákhoz production."
+        step_3: "Illeszd be a hitelesítő adataidat alább és csatlakozz."
+      plaid_eu_panel:
+        step_1_html: "Nyisd meg a(z) %{link} oldalt, és másold ki az EU ügyfél-azonosítódat és titkos kulcsodat."
+      not_found: Szolgáltató nem található.
+      sync_provider_no_items: Nincs elérhető kapcsolat a szinkronizáláshoz.
+      ibkr_panel:
+        steps:
+          step_1: 'Az IBKR ügyfélportálon menj a „Teljesítmény és Jelentések" > „Flex lekérdezések" menübe.'
+          step_2: 'Kattints a „+" ikonra az „Activity Flex Query" részben egy új lekérdezés létrehozásához.'
+          step_3: 'Nevezd el a lekérdezést (pl. „Sure Sync"), majd tekintsd át az alábbi Flex Query részleteket, és engedélyezd a felsorolt szakaszokat, mezőket és konfigurációs lehetőségeket.'
+          step_4: 'Mentsd el a lekérdezést, jegyezd fel a „Query ID"-t, majd a „Flex Web Service Configuration" részben a fogaskerék ikonnal hozz létre egy hozzáférési tokent.'
+          step_5: "Illeszd be a Query ID-t és a tokent alább, mentsd el a konfigurációt, majd menj a Számlák menübe a felderített IBKR-számlák összekapcsolásához."
+        flex_query_details:
+          eyebrow: Flex Query
+          title: Szakaszok, mezők és konfiguráció
+          summary: Bővítsd ki a pontos szakaszok, mezők és beállítások megtekintéséhez, amelyeket az IBKR Activity Flex Query-nek tartalmaznia kell.
+          sections_heading: Engedélyezd ezeket a szakaszokat és mezőket
+          configuration_heading: Állítsd be ezeket a lekérdezési opciókat
+        sections:
+          account_information: "Számla adatai: Számlaazonosító, Pénznem"
+          cash_report: "Készpénzjelentés:"
+          cash_report_options: "Opciók: Nincs"
+          cash_report_fields: "Mezők: Pénznem, Záró készpénz"
+          cash_transactions: "Készpénztranzakciók:"
+          cash_transactions_options: "Opciók: Osztalékok, Befizetések és kifizetések, Részletek"
+          cash_transactions_fields: "Mezők: Összeg, Conid, Pénznem, FX-árfolyam alaphoz, Jelentési dátum, Tranzakció-azonosító, Típus"
+          change_in_position_value_summary: "Pozícióérték változásának összefoglalója: Pénznem, Időszak végi érték"
+          net_asset_value: "Nettó eszközérték (NAV) alapban:"
+          net_asset_value_options: "Opciók: Nincs"
+          net_asset_value_fields: "Mezők: Pénznem, Jelentési dátum, Összesen"
+          open_positions: "Nyitott pozíciók:"
+          open_positions_options: "Opciók: Összefoglalás"
+          open_positions_fields: "Mezők: Eszközosztály, Conid, Bekerülési ár, Pénznem, FX-árfolyam alaphoz, Piaci ár, Mennyiség, Jelentési dátum, Értékpapír-azonosító, Értékpapír-azonosító típus, Oldal, Szimbólum"
+          trades: "Ügyletek:"
+          trades_options: "Opciók: Végrehajtás"
+          trades_fields: "Mezők: Eszközosztály, Vétel/Eladás, Conid, Pénznem, FX-árfolyam alaphoz, IB jutalék, IB jutalék pénzneme, Mennyiség, Szimbólum, Ügylet dátuma, Ügylet-azonosító, Ügylet ára, Tranzakció-azonosító"
+        configuration:
+          models: "Modellek: Opcionális"
+          format: "Formátum: XML"
+          period: "Időszak: Utolsó 365 naptári nap"
+          date_format: "Dátumformátum: éééé-HH-nn"
+          time_format: "Időformátum: ÓÓ:pp:mm"
+          date_time_separator: "Dátum/idő elválasztó: ; (pontosvessző)"
+          profit_and_loss: "Nyereség és veszteség: Alapértelmezett"
+          all_other_options: 'Minden egyéb konfigurációs opció: „Nem"'
+        report_window_note: "Az IBKR Flex-jelentések az IBKR-ben konfigurált lekérdezési ablakra korlátozódnak. A Sure a teljes aktuális pozíciókat, valamint a jelentésből legfeljebb 365 nap tevékenységet importál."
+        sync: Szinkronizálás
+        disconnect_confirm: Leválasztja az Interactive Brokers-t?
+        query_id_label: Lekérdezés azonosítója
+        query_id_placeholder_new: Add meg az IBKR Flex lekérdezés azonosítóját
+        query_id_placeholder_existing: Hagyd üresen a meglévő azonosító megtartásához
+        token_label: Token
+        token_placeholder_new: Add meg az IBKR Flex Web Service tokenedet
+        token_placeholder_existing: Hagyd üresen a meglévő token megtartásához
+        save_configuration: Konfiguráció mentése
+        update_configuration: Konfiguráció frissítése
+        status_configured_prefix: "%{summary}. Látogasd meg a"
+        accounts_tab: Számlák
+        status_configured_suffix: fület a felderített számlák kezeléséhez.
+        not_configured: Nincs konfigurálva.
diff --git a/config/locales/views/settings/pl.yml b/config/locales/views/settings/pl.yml
index 9962be6a7..8acfe1772 100644
--- a/config/locales/views/settings/pl.yml
+++ b/config/locales/views/settings/pl.yml
@@ -185,8 +185,6 @@ pl:
         syncing: Synchronizacja...
         sync: Synchronizuj
         disconnect_confirm: Czy na pewno chcesz odłączyć to połączenie Coinbase? Twoje zsynchronizowane konta staną się kontami ręcznymi.
-        status_connected: Coinbase jest połączony i synchronizuje Twoje zasoby kryptowalutowe.
-        status_not_connected: Brak połączenia. Wprowadź powyżej dane API, aby rozpocząć.
       enable_banking_panel:
         callback_url_instruction: Dla URL callback użyj %{callback_url}.
         connection_error: Błąd połączenia
diff --git a/config/locales/views/settings/pt-BR.yml b/config/locales/views/settings/pt-BR.yml
index 26fa9fa13..65962871b 100644
--- a/config/locales/views/settings/pt-BR.yml
+++ b/config/locales/views/settings/pt-BR.yml
@@ -186,8 +186,6 @@ pt-BR:
         syncing: Sincronizando...
         sync: Sincronizar
         disconnect_confirm: Tem certeza de que deseja desconectar esta conexão com a Coinbase? Suas contas sincronizadas se tornarão contas manuais.
-        status_connected: A Coinbase está conectada e sincronizando seus ativos em criptomoedas.
-        status_not_connected: Não conectado. Insira suas credenciais de API acima para começar.
       enable_banking_panel:
         callback_url_instruction: "Para a URL de retorno de chamada, use %{callback_url}."
         connection_error: Erro de conexão
diff --git a/config/locales/views/settings/securities/ca.yml b/config/locales/views/settings/securities/ca.yml
index c75c90bac..2fd509e4b 100644
--- a/config/locales/views/settings/securities/ca.yml
+++ b/config/locales/views/settings/securities/ca.yml
@@ -3,10 +3,40 @@ ca:
   settings:
     securities:
       show:
-        disable_mfa: Desactiva 2FA
+        disable_mfa: Desactiva la 2FA
         disable_mfa_confirm: Segur que vols desactivar l'autenticació en dos passos?
           Això farà que el teu compte sigui menys segur.
-        enable_mfa: Activa 2FA
+        enable_mfa: Activa la 2FA
         mfa_description: Afegeix una capa extra de seguretat al teu compte requerint
           un codi de la teva app d'autenticació en iniciar sessió
+        mfa_disabled_description: Activa la 2FA per afegir una capa extra de seguretat
+          al teu compte.
+        mfa_disabled_status_html: L'autenticació en dos passos està <span class="font-medium
+          text-red-600">desactivada</span>
+        mfa_enabled_description: El teu compte està protegit amb una capa addicional
+          de seguretat.
+        mfa_enabled_status_html: L'autenticació en dos passos està <span class="font-medium
+          text-green-600">activada</span>
         mfa_title: Autenticació en dos passos
+        webauthn_add: Afegeix passkey o clau de seguretat
+        webauthn_added: Afegida el %{date}
+        webauthn_description: Utilitza una passkey, Touch ID, Windows Hello o una
+          clau de seguretat de maquinari com a segon factor en iniciar sessió.
+        webauthn_empty: Encara no hi ha cap passkey o clau de seguretat registrada.
+        webauthn_last_used: Última utilització fa %{time_ago}
+        webauthn_name_label: Nom de la clau
+        webauthn_name_placeholder: Touch ID MacBook, YubiKey, etc.
+        webauthn_remove: Elimina
+        webauthn_remove_confirm: Segur que vols eliminar aquesta passkey o clau de
+          seguretat?
+        webauthn_remove_confirm_body: Hauràs de tornar a registrar aquesta passkey
+          o clau de seguretat abans de poder utilitzar-la per a la verificació d'inici
+          de sessió.
+        webauthn_title: Passkeys i claus de seguretat
+        webauthn_unsupported: Aquest navegador no admet passkeys ni claus de seguretat.
+  webauthn_credentials:
+    default_name: Clau de seguretat
+    failure: No s'ha pogut desar aquesta passkey o clau de seguretat. Torna-ho a provar.
+    mfa_required: Activa l'autenticació en dos passos abans d'afegir una passkey o
+      clau de seguretat.
+    success: Passkey o clau de seguretat eliminada.
diff --git a/config/locales/views/settings/securities/en.yml b/config/locales/views/settings/securities/en.yml
index af439522c..1b8ae5641 100644
--- a/config/locales/views/settings/securities/en.yml
+++ b/config/locales/views/settings/securities/en.yml
@@ -7,6 +7,32 @@ en:
         disable_mfa_confirm: Are you sure you want to disable two-factor authentication?
           This will make your account less secure.
         enable_mfa: Enable 2FA
+        mfa_enabled_status_html: "Two-factor authentication is <span class=\"font-medium text-green-600\">enabled</span>"
+        mfa_enabled_description: Your account is protected with an additional layer of security.
+        mfa_disabled_status_html: "Two-factor authentication is <span class=\"font-medium text-red-600\">disabled</span>"
+        mfa_disabled_description: Enable 2FA to add an extra layer of security to your account.
         mfa_description: Add an extra layer of security to your account by requiring
           a code from your authenticator app when signing in
         mfa_title: Two-Factor Authentication
+        webauthn_add: Add passkey or security key
+        webauthn_added: Added %{date}
+        webauthn_description: Use a passkey, Touch ID, Windows Hello, or a hardware
+          security key as a second factor when signing in.
+        webauthn_empty: No passkeys or security keys are registered yet.
+        webauthn_last_used: Last used %{time_ago} ago
+        webauthn_name_label: Key name
+        webauthn_name_placeholder: MacBook Touch ID, YubiKey, etc.
+        webauthn_remove: Remove
+        webauthn_remove_confirm: Are you sure you want to remove this passkey or
+          security key?
+        webauthn_remove_confirm_body: You will need to register this passkey or
+          security key again before it can be used for sign-in verification.
+        webauthn_title: Passkeys and security keys
+        webauthn_unsupported: This browser does not support passkeys or security
+          keys.
+  webauthn_credentials:
+    default_name: Security key
+    failure: Could not save that passkey or security key. Please try again.
+    mfa_required: Enable two-factor authentication before adding a passkey or security
+      key.
+    success: Passkey or security key removed.
diff --git a/config/locales/views/settings/securities/es.yml b/config/locales/views/settings/securities/es.yml
index e5beff85e..384649ffe 100644
--- a/config/locales/views/settings/securities/es.yml
+++ b/config/locales/views/settings/securities/es.yml
@@ -8,3 +8,20 @@ es:
         enable_mfa: Habilitar 2FA
         mfa_description: Agrega una capa adicional de seguridad a tu cuenta al requerir un código de tu aplicación de autenticación al iniciar sesión
         mfa_title: Autenticación de 2FA
+        webauthn_add: Añadir passkey o llave de seguridad
+        webauthn_added: Añadida el %{date}
+        webauthn_description: Usa una passkey, Touch ID, Windows Hello o una llave de seguridad física como segundo factor al iniciar sesión.
+        webauthn_empty: Aún no hay passkeys ni llaves de seguridad registradas.
+        webauthn_last_used: Último uso hace %{time_ago}
+        webauthn_name_label: Nombre de la llave
+        webauthn_name_placeholder: Touch ID del MacBook, YubiKey, etc.
+        webauthn_remove: Eliminar
+        webauthn_remove_confirm: ¿Seguro que quieres eliminar esta passkey o llave de seguridad?
+        webauthn_remove_confirm_body: Tendrás que volver a registrar esta passkey o llave de seguridad antes de poder usarla para verificar el inicio de sesión.
+        webauthn_title: Passkeys y llaves de seguridad
+        webauthn_unsupported: Este navegador no admite passkeys ni llaves de seguridad.
+  webauthn_credentials:
+    default_name: Llave de seguridad
+    failure: No se pudo guardar esa passkey o llave de seguridad. Inténtalo de nuevo.
+    mfa_required: Activa la autenticación de dos factores antes de añadir una passkey o llave de seguridad.
+    success: Se eliminó la passkey o llave de seguridad.
diff --git a/config/locales/views/settings/securities/hu.yml b/config/locales/views/settings/securities/hu.yml
new file mode 100644
index 000000000..f3dddd801
--- /dev/null
+++ b/config/locales/views/settings/securities/hu.yml
@@ -0,0 +1,37 @@
+---
+hu:
+  settings:
+    securities:
+      show:
+        disable_mfa: 2FA letiltása
+        disable_mfa_confirm: Biztosan le szeretnéd tiltani a kétlépéses hitelesítést?
+          Ez kevésbé biztonságossá teszi a fiókodat.
+        enable_mfa: 2FA engedélyezése
+        mfa_enabled_status_html: "A kétlépéses hitelesítés <span class=\"font-medium text-green-600\">engedélyezve</span>"
+        mfa_enabled_description: A fiókod egy extra biztonsági réteggel védett.
+        mfa_disabled_status_html: "A kétlépéses hitelesítés <span class=\"font-medium text-red-600\">letiltva</span>"
+        mfa_disabled_description: Engedélyezd a 2FA-t, hogy extra védelmet adj a fiókodnak.
+        mfa_description: Adj egy extra biztonsági réteget a fiókodhoz azzal, hogy bejelentkezéskor
+          kódot kérsz az hitelesítő alkalmazásodtól
+        mfa_title: Kétlépéses hitelesítés
+        webauthn_add: Hozzáférési kulcs vagy biztonsági kulcs hozzáadása
+        webauthn_added: "Hozzáadva: %{date}"
+        webauthn_description: Használj hozzáférési kulcsot, Touch ID-t, Windows Hello-t vagy hardveres
+          biztonsági kulcsot második hitelesítési tényezőként bejelentkezéskor.
+        webauthn_empty: Még nincsenek regisztrált hozzáférési kulcsok vagy biztonsági kulcsok.
+        webauthn_last_used: Utoljára használva %{time_ago} ezelőtt
+        webauthn_name_label: Kulcsnév
+        webauthn_name_placeholder: MacBook Touch ID, YubiKey stb.
+        webauthn_remove: Eltávolítás
+        webauthn_remove_confirm: Biztosan el szeretnéd távolítani ezt a hozzáférési kulcsot vagy
+          biztonsági kulcsot?
+        webauthn_remove_confirm_body: A hozzáférési kulcsot vagy biztonsági kulcsot újra kell regisztrálnod,
+          mielőtt ismét bejelentkezési azonosításra használhatnád.
+        webauthn_title: Hozzáférési kulcsok és biztonsági kulcsok
+        webauthn_unsupported: Ez a böngésző nem támogatja a hozzáférési kulcsokat és biztonsági
+          kulcsokat.
+  webauthn_credentials:
+    default_name: Biztonsági kulcs
+    failure: Nem sikerült menteni a hozzáférési kulcsot vagy biztonsági kulcsot. Kérjük, próbáld újra.
+    mfa_required: Engedélyezd a kétlépéses hitelesítést, mielőtt hozzáférési kulcsot vagy biztonsági kulcsot adsz hozzá.
+    success: Hozzáférési kulcs vagy biztonsági kulcs eltávolítva.
diff --git a/config/locales/views/settings/sso_identities/ca.yml b/config/locales/views/settings/sso_identities/ca.yml
index 08fe9fd6e..0c84ad741 100644
--- a/config/locales/views/settings/sso_identities/ca.yml
+++ b/config/locales/views/settings/sso_identities/ca.yml
@@ -3,5 +3,5 @@ ca:
   settings:
     sso_identities:
       destroy:
-        cannot_unlink_last: No es pot desvincular l'últim
+        cannot_unlink_last: No es pot desvincular l'última identitat
         success: Èxit
diff --git a/config/locales/views/settings/sso_identities/hu.yml b/config/locales/views/settings/sso_identities/hu.yml
new file mode 100644
index 000000000..0ea60994d
--- /dev/null
+++ b/config/locales/views/settings/sso_identities/hu.yml
@@ -0,0 +1,7 @@
+---
+hu:
+  settings:
+    sso_identities:
+      destroy:
+        cannot_unlink_last: Az utolsó identitás nem távolítható el
+        success: Sikeres
diff --git a/config/locales/views/shared/ca.yml b/config/locales/views/shared/ca.yml
index 39c098d23..b1f9457d7 100644
--- a/config/locales/views/shared/ca.yml
+++ b/config/locales/views/shared/ca.yml
@@ -1,13 +1,34 @@
 ---
 ca:
+  concerns:
+    self_hostable:
+      redis_configured: Redis ja està configurat correctament! Ara pots configurar
+        la teva aplicació Sure.
   shared:
+    cancel: Cancel·la
     confirm_modal:
       accept: Confirma
       body_html: "<p>No podràs desfer aquesta acció</p>"
       cancel: Cancel·la
       title: Segur que vols continuar?
+    custom_confirm:
+      default_body: Aquesta acció no es pot desfer.
+      default_btn_text: Confirma
+      default_title: Segur que vols continuar?
+    exchange_rate_tabs:
+      calculate_rate_tab: Calcular la taxa FX
+      convert_tab: Convertir amb la taxa FX
+      destination_amount: Quantitat de destinació
+      exchange_rate: Taxa de canvi
+      exchange_rate_help: Tria com introduir la quantitat.
+    family_moniker:
+      group_plural: Grups
+      group_singular: Grup
+      plural: Famílies
+      singular: Família
     money_field:
       label: Import
+    require_admin: Només els administradors poden fer aquesta acció
     syncing_notice:
       syncing: S'estan sincronitzant les dades dels comptes...
     transaction_tabs:
diff --git a/config/locales/views/shared/de.yml b/config/locales/views/shared/de.yml
index 1b0cfb1bf..f0af087e2 100644
--- a/config/locales/views/shared/de.yml
+++ b/config/locales/views/shared/de.yml
@@ -8,6 +8,12 @@ de:
       title: Bist du sicher
     money_field:
       label: Betrag
+    exchange_rate_tabs:
+      calculate_rate_tab: FX-Kurs berechnen
+      convert_tab: Mit FX-Kurs konvertieren
+      destination_amount: Zielbetrag
+      exchange_rate: Wechselkurs
+      exchange_rate_help: Wählen Sie, wie Sie den Betrag eingeben möchten.
     syncing_notice:
       syncing: Kontodaten werden synchronisiert...
     trend_change:
diff --git a/config/locales/views/shared/en.yml b/config/locales/views/shared/en.yml
index f94797c77..6acc96633 100644
--- a/config/locales/views/shared/en.yml
+++ b/config/locales/views/shared/en.yml
@@ -1,5 +1,8 @@
 ---
 en:
+  concerns:
+    self_hostable:
+      redis_configured: "Redis is now configured properly! You can now setup your Sure application."
   shared:
     confirm_modal:
       accept: Confirm
@@ -8,8 +11,28 @@ en:
       title: Are you sure?
     money_field:
       label: Amount
+    exchange_rate_tabs:
+      calculate_rate_tab: Calculate FX rate
+      convert_tab: Convert with FX rate
+      destination_amount: Destination amount
+      exchange_rate: Exchange rate
+      exchange_rate_help: Choose how to enter the amount.
     syncing_notice:
       syncing: Syncing accounts data...
     require_admin: "Only admins can perform this action"
+    custom_confirm:
+      default_title: "Are you sure?"
+      default_body: "This is not reversible."
+      default_btn_text: "Confirm"
+    family_moniker:
+      group_plural: Groups
+      group_singular: Group
+      plural: Families
+      singular: Family
     trend_change:
       no_change: "no change"
+    cancel: Cancel
+    transaction_tabs:
+      expense: Expense
+      income: Income
+      transfer: Transfer
diff --git a/config/locales/views/shared/es.yml b/config/locales/views/shared/es.yml
index db6ceb073..4b3f5914f 100644
--- a/config/locales/views/shared/es.yml
+++ b/config/locales/views/shared/es.yml
@@ -8,6 +8,12 @@ es:
       title: ¿Estás seguro?
     money_field:
       label: Importe
+    exchange_rate_tabs:
+      calculate_rate_tab: Calcular tasa
+      convert_tab: Convertir con tasa
+      destination_amount: Importe de destino
+      exchange_rate: Tasa de cambio
+      exchange_rate_help: Elige cómo introducir el importe.
     syncing_notice:
       syncing: Sincronizando datos de cuentas...
     trend_change:
diff --git a/config/locales/views/shared/fr.yml b/config/locales/views/shared/fr.yml
index 0ecdb2d32..106ededa6 100644
--- a/config/locales/views/shared/fr.yml
+++ b/config/locales/views/shared/fr.yml
@@ -1,17 +1,5 @@
 ---
 fr:
-  breadcrumbs:
-    home: Accueil
-    dashboard: Tableau de bord
-    accounts: Comptes
-    merchants: Marchands
-    categories: Catégories
-    tags: Étiquettes
-    rules: Règles
-    transactions: Transactions
-    budgets: Budgets
-    imports: Importations
-    chats: Assistant
   shared:
     confirm_modal:
       accept: Confirmer
@@ -20,7 +8,14 @@ fr:
       title: Êtes-vous sûr ?
     money_field:
       label: Montant
+    exchange_rate_tabs:
+      calculate_rate_tab: Calculer le taux FX
+      convert_tab: Convertir avec le taux FX
+      destination_amount: Montant de destination
+      exchange_rate: Taux de change
+      exchange_rate_help: Choisissez comment entrer le montant.
     syncing_notice:
       syncing: Synchronisation des données de compte...
+    require_admin: "Seuls les administrateurs peuvent effectuer cette action"
     trend_change:
       no_change: "pas de changement"
diff --git a/config/locales/views/shared/hu.yml b/config/locales/views/shared/hu.yml
new file mode 100644
index 000000000..8f0809e72
--- /dev/null
+++ b/config/locales/views/shared/hu.yml
@@ -0,0 +1,36 @@
+---
+hu:
+  concerns:
+    self_hostable:
+      redis_configured: "A Redis most megfelelően van konfigurálva! Mostantól beállíthatod a Sure alkalmazásodat."
+  shared:
+    confirm_modal:
+      accept: Megerősítés
+      body_html: "<p>Ezt a döntést nem tudod visszavonni</p>"
+      cancel: Mégse
+      title: Biztos vagy benne?
+    money_field:
+      label: Összeg
+    exchange_rate_tabs:
+      calculate_rate_tab: Árfolyam kiszámítása
+      convert_tab: Átváltás árfolyammal
+      destination_amount: Célösszeg
+      exchange_rate: Árfolyam
+      exchange_rate_help: Válaszd ki, hogyan szeretnéd megadni az összeget.
+    syncing_notice:
+      syncing: Számlák adatainak szinkronizálása...
+    require_admin: "Ezt a műveletet csak adminisztrátorok hajthatják végre"
+    custom_confirm:
+      default_title: "Biztosan?"
+      default_body: "Ez a művelet nem vonható vissza."
+      default_btn_text: "Megerősítés"
+    family_moniker:
+      singular: Háztartás
+      plural: Háztartások
+    trend_change:
+      no_change: "nincs változás"
+    cancel: Mégse
+    transaction_tabs:
+      expense: Kiadás
+      income: Bevétel
+      transfer: Átutalás
diff --git a/config/locales/views/shared/nb.yml b/config/locales/views/shared/nb.yml
index a96b72952..c4e6eb8b0 100644
--- a/config/locales/views/shared/nb.yml
+++ b/config/locales/views/shared/nb.yml
@@ -1,14 +1,20 @@
----
-nb:
-  shared:
-    confirm_modal:
-      accept: Bekreft
-      body_html: "<p>Du vil ikke kunne angre denne beslutningen</p>"
-      cancel: Avbryt
-      title: Er du sikker?
-    money_field:
-      label: Beløp
-    syncing_notice:
-      syncing: Synkroniserer kontodata...
-    trend_change:
+---
+nb:
+  shared:
+    confirm_modal:
+      accept: Bekreft
+      body_html: "<p>Du vil ikke kunne angre denne beslutningen</p>"
+      cancel: Avbryt
+      title: Er du sikker?
+    money_field:
+      label: Beløp
+    exchange_rate_tabs:
+      calculate_rate_tab: Beregn FX-kurs
+      convert_tab: Konverter med FX-kurs
+      destination_amount: Beløp for destinasjon
+      exchange_rate: Vekslingskurs
+      exchange_rate_help: Velg hvordan du vil fylle inn beløpet.
+    syncing_notice:
+      syncing: Synkroniserer kontodata...
+    trend_change:
       no_change: "ingen endring"
\ No newline at end of file
diff --git a/config/locales/views/shared/nl.yml b/config/locales/views/shared/nl.yml
index 569c00e0d..a63b576d0 100644
--- a/config/locales/views/shared/nl.yml
+++ b/config/locales/views/shared/nl.yml
@@ -8,6 +8,12 @@ nl:
       title: Weet u het zeker?
     money_field:
       label: Bedrag
+    exchange_rate_tabs:
+      calculate_rate_tab: FX-tarief berekenen
+      convert_tab: Converteren met FX-tarief
+      destination_amount: Doelbedrag
+      exchange_rate: Wisselkoers
+      exchange_rate_help: Kies hoe u het bedrag wilt invoeren.
     syncing_notice:
       syncing: Accountsgegevens synchroniseren...
     trend_change:
diff --git a/config/locales/views/shared/pt-BR.yml b/config/locales/views/shared/pt-BR.yml
index cd14facf5..73fc47727 100644
--- a/config/locales/views/shared/pt-BR.yml
+++ b/config/locales/views/shared/pt-BR.yml
@@ -8,6 +8,12 @@ pt-BR:
       title: Tem certeza?
     money_field:
       label: Valor
+    exchange_rate_tabs:
+      calculate_rate_tab: Calcular taxa de câmbio
+      convert_tab: Converter com taxa de câmbio
+      destination_amount: Valor de destino
+      exchange_rate: Taxa de câmbio
+      exchange_rate_help: Escolha como inserir o valor.
     syncing_notice:
       syncing: Sincronizando dados das contas...
     trend_change:
diff --git a/config/locales/views/shared/ro.yml b/config/locales/views/shared/ro.yml
index b97866bd3..9cb591e89 100644
--- a/config/locales/views/shared/ro.yml
+++ b/config/locales/views/shared/ro.yml
@@ -8,6 +8,12 @@ ro:
       title: Ești sigur?
     money_field:
       label: Sumă
+    exchange_rate_tabs:
+      calculate_rate_tab: Calculați rata FX
+      convert_tab: Convertire cu rata FX
+      destination_amount: Suma de destinație
+      exchange_rate: Rata de schimb
+      exchange_rate_help: Alege cum dorești să introduci suma.
     syncing_notice:
       syncing: Se sincronizează datele conturilor...
     trend_change:
diff --git a/config/locales/views/shared/tr.yml b/config/locales/views/shared/tr.yml
index 8970dc097..045e211c2 100644
--- a/config/locales/views/shared/tr.yml
+++ b/config/locales/views/shared/tr.yml
@@ -8,6 +8,12 @@ tr:
       title: Emin misiniz?
     money_field:
       label: Tutar
+    exchange_rate_tabs:
+      calculate_rate_tab: Döviz Kuru Hesapla
+      convert_tab: Döviz Kuru ile Dönüştür
+      destination_amount: Hedef Tutar
+      exchange_rate: Döviz Kuru
+      exchange_rate_help: Tutar girişiniz için yöntemi seçin.
     syncing_notice:
       syncing: Hesap verileri senkronize ediliyor...
     trend_change:
diff --git a/config/locales/views/shared/zh-CN.yml b/config/locales/views/shared/zh-CN.yml
index d37cc3c3f..a84a48379 100644
--- a/config/locales/views/shared/zh-CN.yml
+++ b/config/locales/views/shared/zh-CN.yml
@@ -8,6 +8,12 @@ zh-CN:
       title: 确定要执行此操作？
     money_field:
       label: 金额
+    exchange_rate_tabs:
+      calculate_rate_tab: 计算汇率
+      convert_tab: 用汇率转换
+      destination_amount: 目标金额
+      exchange_rate: 汇率
+      exchange_rate_help: 选择如何输入金额。
     syncing_notice:
       syncing: 账户数据同步中...
     transaction_tabs:
diff --git a/config/locales/views/shared/zh-TW.yml b/config/locales/views/shared/zh-TW.yml
index a29edfe67..b1e193f22 100644
--- a/config/locales/views/shared/zh-TW.yml
+++ b/config/locales/views/shared/zh-TW.yml
@@ -8,6 +8,12 @@ zh-TW:
       title: 您確定嗎？
     money_field:
       label: 金額
+    exchange_rate_tabs:
+      calculate_rate_tab: 計算匯率
+      convert_tab: 用匯率轉換
+      destination_amount: 目標金額
+      exchange_rate: 匯率
+      exchange_rate_help: 選擇如何輸入金額。
     syncing_notice:
       syncing: 正在同步帳戶資料...
     trend_change:
diff --git a/config/locales/views/simplefin_items/ca.yml b/config/locales/views/simplefin_items/ca.yml
index addb9cb72..7e882f3e5 100644
--- a/config/locales/views/simplefin_items/ca.yml
+++ b/config/locales/views/simplefin_items/ca.yml
@@ -2,39 +2,59 @@
 ca:
   simplefin_items:
     complete_account_setup:
-      all_skipped: S'han ignorat tots els comptes. No s'ha creat cap compte.
+      all_skipped: S'han omès tots els comptes. No s'ha creat cap compte.
       no_accounts: No hi ha comptes per configurar.
       stale_accounts_errors:
-        one: "L'acció del compte obsolet ha fallat: %{count}. Consulta els registres per a més detalls."
-        other: "Les accions dels comptes obsolets han fallat: %{count}. Consulta els registres per a més detalls."
-      stale_accounts_processed: 'Comptes obsolets: %{deleted} eliminats, %{moved} moguts.'
-      success: Els comptes SimpleFIN s'han configurat correctament! Les teves transaccions
-        i posicions s'estan important en segon pla.
+        one: "%{count} acció de compte obsolet ha fallat. Consulta els registres per
+          a més detalls."
+        other: "%{count} accions de comptes obsolets han fallat. Consulta els registres
+          per a més detalls."
+      stale_accounts_processed: 'Comptes obsolets: %{deleted} eliminats, %{moved}
+        moguts.'
+      success:
+        one: S'ha creat correctament %{count} compte SimpleFIN! Les teves transaccions
+          i posicions s'estan important en segon pla.
+        other: S'han creat correctament %{count} comptes SimpleFIN! Les teves transaccions
+          i posicions s'estan important en segon pla.
     create:
       errors:
         blank_token: Introdueix un token de configuració SimpleFIN.
         create_failed: 'No s''ha pogut connectar: %{message}'
-        invalid_token: Token de configuració invàlid. Comprova que has copiat el token
-          complet des de SimpleFIN Bridge.
+        invalid_token: Token de configuració no vàlid. Comprova que has copiat el
+          token complet des de SimpleFIN Bridge.
         token_compromised: El token de configuració pot estar compromès, caducat o
           ja utilitzat. Crea'n un de nou.
-        unexpected: S'ha produït un error inesperat. Torna-ho a provar o contacta
-          amb el suport.
+        unexpected: S'ha produït un error inesperat. Torna-ho a provar.
       success: Connexió SimpleFIN afegida correctament! Els teus comptes apareixeran
         en breu mentre es sincronitzen en segon pla.
     destroy:
       success: La connexió SimpleFIN s'eliminarà
+    dismiss_replacement_suggestion:
+      dismissed: Suggeriment de substitució descartat
     edit:
+      cancel: Cancel·la
+      connection_needs_update: 'La teva connexió SimpleFIN necessita actualització:'
+      header_subtitle: Obtén un nou token de configuració per reconnectar el teu compte
+        SimpleFIN
       setup_token:
         help_text: El token ha de ser una cadena llarga que comenci amb lletres i
           números
         label: 'Token de configuració SimpleFIN:'
         placeholder: Enganxa aquí el teu token de configuració SimpleFIN...
+      step_1_html: Visita <a href="https://bridge.simplefin.org/simplefin/create"
+        target="_blank" rel="noopener noreferrer" class="text-link hover:text-link
+        underline">SimpleFIN Bridge</a> per crear un nou token de configuració
+      step_2: Copia el token i enganxa'l a continuació
+      step_3: Fes clic a "Actualitza" per restaurar l'accés
+      title: Actualitza la connexió SimpleFIN
+      update: Actualitza
     link_existing_account:
       errors:
-        invalid_simplefin_account: S'ha seleccionat un compte SimpleFIN invàlid
-        only_manual: Només es poden enllaçar comptes manuals
-      success: S'ha enllaçat el compte correctament amb SimpleFIN
+        different_provider: Aquest compte està enllaçat a un altre proveïdor. Desenllaça'l
+          primer d'aquell proveïdor i després enllaça'l a SimpleFIN.
+        invalid_simplefin_account: S'ha seleccionat un compte SimpleFIN no vàlid
+        only_manual: Només els comptes manuals es poden enllaçar
+      success: El compte s'ha enllaçat correctament a SimpleFIN
     new:
       cancel: Cancel·la
       connect: Connecta
@@ -45,55 +65,117 @@ ca:
       message:
         one: "%{count} transacció pendent duplicada conciliada"
         other: "%{count} transaccions pendents duplicades conciliades"
+    replacement_prompt:
+      confirm_body: "“%{account_name}” s'enllaçarà a “%{new_name}”. El teu historial
+        de transaccions es manté; les transaccions futures vindran de la nova targeta."
+      confirm_title: Vols tornar a enllaçar a la nova targeta?
+      description: "“%{account_name}” està enllaçat a “%{old_name}”, que no ha tingut
+        activitat recent i té saldo zero. Una nova targeta, “%{new_name}”, està activa
+        a la mateixa entitat. Torna a enllaçar-la per mantenir l'historial intacte."
+      dismiss_aria: Descarta el suggeriment de substitució
+      relink: Torna a enllaçar a la nova targeta
+      title: La teva targeta de %{institution} pot haver estat substituïda
     select_existing_account:
-      all_accounts_already_linked: Sembla que ja s'han enllaçat tots els comptes de SimpleFIN.
+      all_accounts_already_linked: Sembla que tots els comptes SimpleFIN ja estan
+        enllaçats.
       cancel: Cancel·la
-      check_provider_health: Comprova l'estat del proveïdor
+      check_provider_health: Comprova que la teva connexió SimpleFIN està activa a
+        Configuració → Proveïdors.
       currently_linked_to: 'Actualment enllaçat a: %{account_name}'
       description: Selecciona un compte SimpleFIN per enllaçar-lo al teu compte existent
       link_account: Enllaça el compte
-      no_accounts_found: No s'han trobat comptes SimpleFIN per a aquesta família.
+      no_accounts_found: No s'han trobat comptes SimpleFIN per a %{moniker}.
       title: Enllaça %{account_name} amb SimpleFIN
-      unlink_to_move: Per moure un enllaç, primer des-enllaça'l del menú d'accions del compte.
-      wait_for_sync: Si acabes de connectar o sincronitzar, torna-ho a provar després que la sincronització completi.
+      unlink_to_move: Per moure un enllaç, primer desenllaça'l del menú d'accions
+        del compte.
+      wait_for_sync: Si acabes de connectar o sincronitzar, torna-ho a provar després
+        que la sincronització acabi.
     setup_accounts:
+      account_card:
+        balance: Saldo
+      account_type_checking_savings: Corrent o estalvis
+      account_type_checking_savings_desc: Comptes bancaris habituals
+      account_type_credit_card: Targeta de crèdit
+      account_type_credit_card_desc: Comptes de targeta de crèdit
+      account_type_investment: Inversió
+      account_type_investment_desc: Corredoria, comptes 401(k), IRA
+      account_type_label: 'Tipus de compte:'
+      account_type_loan: Préstec o hipoteca
+      account_type_loan_desc: Comptes de deute
+      account_type_other_asset: Altre actiu
+      account_type_other_asset_desc: Tota la resta
+      activity:
+        days_ago:
+          one: fa 1 dia
+          other: fa %{count} dies
+        dormant: Sense activitat en %{days} dies
+        empty: Encara no s'han importat transaccions
+        likely_closed: Sense activitat recent i saldo zero — pot ser una targeta tancada
+          o substituïda
+        recent:
+          one: 1 transacció • darrera %{when}
+          other: "%{count} transaccions • darrera %{when}"
+        today: avui
+        yesterday: ahir
+      cancel: Cancel·la
+      choose_account_type: 'Tria el tipus de compte correcte per a cada compte SimpleFIN:'
+      create_accounts: Crea comptes
+      creating_accounts: Creant comptes...
+      header_subtitle: Tria els tipus de compte correctes per als teus comptes importats
       stale_accounts:
         action_delete: Elimina el compte i totes les transaccions
         action_move: 'Mou les transaccions a:'
         action_prompt: Què vols fer?
         action_skip: Omet ara
-        description: Aquests comptes existeixen a la teva base de dades però ja no s'ofereixen
-          per SimpleFIN. Això pot passar quan les configuracions del compte canvien a nivell superior.
+        description: Aquests comptes existeixen a la teva base de dades, però ja no
+          els ofereix SimpleFIN. Això pot passar quan la configuració del compte canvia
+          al proveïdor.
         title: Comptes ja no disponibles a SimpleFIN
         transaction_count:
           one: "%{count} transacció"
           other: "%{count} transaccions"
+      title: Configura els teus comptes SimpleFIN
+      transaction_history_description_html: SimpleFIN normalment proporciona <strong>60-90
+        dies</strong> d'historial de transaccions, segons el teu banc. Després de
+        la configuració inicial, les noves transaccions es sincronitzaran automàticament.
+        La disponibilitat de les dades històriques varia segons l'entitat i el tipus
+        de compte.
+      transaction_history_title: 'Historial de transaccions:'
     simplefin_item:
-      add_new: Afegeix nova connexió
+      accounts_skipped_label: 'Omesos: %{count}'
+      accounts_skipped_tooltip: S'han omès alguns comptes per errors durant la sincronització
+      add_new: Afegeix una connexió nova
       confirm_accept: Elimina la connexió
       confirm_body: Això eliminarà permanentment tots els comptes d'aquest grup i
         totes les dades associades.
       confirm_title: Vols eliminar la connexió SimpleFIN?
       delete: Elimina
       deletion_in_progress: "(eliminació en curs...)"
-      duplicate_accounts_skipped: S'han omès alguns comptes perquè eren duplicats — utilitza 'Enllaça
-        comptes existents' per fusionar-los.
+      duplicate_accounts_skipped: S'han omès alguns comptes perquè eren duplicats
+        — utilitza 'Enllaça comptes existents' per fusionar-los.
       error: S'ha produït un error en sincronitzar les dades
+      more_accounts_available:
+        one: "%{count} compte més disponible per configurar"
+        other: "%{count} comptes més disponibles per configurar"
       no_accounts_description: Aquesta connexió encara no té cap compte sincronitzat.
       no_accounts_title: No s'han trobat comptes
-      reconciled_details_note: "(consulta el resum de la sincronització per a més detalls)"
-      requires_update: Cal tornar a autenticar
-      setup_action: Configura nous comptes
+      rate_limited_ago: Límit de velocitat aplicat (fa %{time})
+      rate_limited_recently: Límit de velocitat aplicat recentment
+      reconciled_details_note: "(consulta el resum de la sincronització per a més
+        detalls)"
+      requires_update: Reconnecta
+      setup_accounts_menu: Configura comptes
+      setup_action: Configura els nous comptes
       setup_description: Tria els tipus de compte per als teus nous comptes SimpleFIN
         importats.
-      setup_needed: Nous comptes llestos per configurar
+      setup_needed: Nous comptes a punt per configurar
       stale_pending_accounts: 'a: %{accounts}'
       stale_pending_note: "(exclòs dels pressupostos)"
       status: Darrera sincronització fa %{timestamp}
       status_never: Mai sincronitzat
       status_with_summary: Darrera sincronització fa %{timestamp} • %{summary}
       syncing: Sincronitzant...
-      update: Actualitza la connexió
+      update: Actualitza
     stale_pending_status:
       message:
         one: "%{count} transacció pendent anterior a %{days} dies"
@@ -101,12 +183,11 @@ ca:
     update:
       errors:
         blank_token: Introdueix un token de configuració SimpleFIN.
-        invalid_token: Token de configuració invàlid. Comprova que has copiat el token
-          complet des de SimpleFIN Bridge.
+        invalid_token: Token de configuració no vàlid. Comprova que has copiat el
+          token complet des de SimpleFIN Bridge.
         token_compromised: El token de configuració pot estar compromès, caducat o
           ja utilitzat. Crea'n un de nou.
-        unexpected: S'ha produït un error inesperat. Torna-ho a provar o contacta
-          amb el suport.
+        unexpected: S'ha produït un error inesperat. Torna-ho a provar.
         update_failed: 'No s''ha pogut actualitzar la connexió: %{message}'
       success: Connexió SimpleFIN actualitzada correctament! Els teus comptes s'estan
         tornant a connectar.
diff --git a/config/locales/views/simplefin_items/en.yml b/config/locales/views/simplefin_items/en.yml
index 9929eb64c..7c8407d9c 100644
--- a/config/locales/views/simplefin_items/en.yml
+++ b/config/locales/views/simplefin_items/en.yml
@@ -30,7 +30,48 @@ en:
         label: "SimpleFIN Setup Token:"
         placeholder: "Paste your SimpleFIN setup token here..."
         help_text: "The token should be a long string starting with letters and numbers"
+      title: Update SimpleFin Connection
+      header_subtitle: Get a new setup token to reconnect your SimpleFIN account
+      connection_needs_update: "Your SimpleFIN connection needs to be updated:"
+      step_1_html: "Visit <a href=\"https://bridge.simplefin.org/simplefin/create\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"text-link hover:text-link underline\">SimpleFIN Bridge</a> to create a new setup token"
+      step_2: Copy the token and paste it below
+      step_3: "Click \"Update\" to restore access"
+      update: Update
+      cancel: Cancel
     setup_accounts:
+      title: Set Up Your SimpleFin Accounts
+      header_subtitle: Choose the correct account types for your imported accounts
+      choose_account_type: "Choose the correct account type for each SimpleFin account:"
+      account_type_checking_savings: Checking or Savings
+      account_type_checking_savings_desc: Regular bank accounts
+      account_type_credit_card: Credit Card
+      account_type_credit_card_desc: Credit card accounts
+      account_type_investment: Investment
+      account_type_investment_desc: "Brokerage, 401(k), IRA accounts"
+      account_type_loan: Loan or Mortgage
+      account_type_loan_desc: Debt accounts
+      account_type_other_asset: Other Asset
+      account_type_other_asset_desc: Everything else
+      transaction_history_title: "Transaction History:"
+      transaction_history_description_html: "SimpleFin typically provides <strong>60-90 days</strong> of transaction history, depending on your bank. After initial setup, new transactions will sync automatically going forward. Historical data availability varies by institution and account type."
+      account_type_label: "Account Type:"
+      create_accounts: Create Accounts
+      creating_accounts: Creating Accounts...
+      cancel: Cancel
+      account_card:
+        balance: "Balance"
+      activity:
+        recent:
+          one: "1 transaction • latest %{when}"
+          other: "%{count} transactions • latest %{when}"
+        dormant: "No activity in %{days} days"
+        empty: "No transactions imported yet"
+        likely_closed: "No recent activity and zero balance — this may be a closed or replaced card"
+        today: "today"
+        yesterday: "yesterday"
+        days_ago:
+          one: "1 day ago"
+          other: "%{count} days ago"
       stale_accounts:
         title: "Accounts No Longer in SimpleFIN"
         description: "These accounts exist in your database but are no longer provided by SimpleFIN. This can happen when account configurations change upstream."
@@ -97,7 +138,17 @@ en:
       success: Account successfully linked to SimpleFIN
       errors:
         only_manual: Only manual accounts can be linked
+        different_provider: This account is linked to a different provider. Unlink it from that provider first, then link to SimpleFIN.
         invalid_simplefin_account: Invalid SimpleFIN account selected
+    dismiss_replacement_suggestion:
+      dismissed: Replacement suggestion dismissed
+    replacement_prompt:
+      title: "Your %{institution} card may have been replaced"
+      description: "“%{account_name}” is linked to “%{old_name}”, which has had no recent activity and a zero balance. A new card, “%{new_name}”, is now active at the same institution. Relink to keep your history intact."
+      relink: Relink to new card
+      confirm_title: Relink to the new card?
+      confirm_body: "“%{account_name}” will be linked to “%{new_name}”. Your transaction history stays; future transactions come from the new card."
+      dismiss_aria: Dismiss replacement suggestion
     reconciled_status:
       message:
         one: "%{count} duplicate pending transaction reconciled"
diff --git a/config/locales/views/simplefin_items/fr.yml b/config/locales/views/simplefin_items/fr.yml
index 796a8b45d..64a94d364 100644
--- a/config/locales/views/simplefin_items/fr.yml
+++ b/config/locales/views/simplefin_items/fr.yml
@@ -1,6 +1,12 @@
 ---
 fr:
   simplefin_items:
+    new:
+      title: Connecter SimpleFIN
+      setup_token: Jeton de configuration
+      setup_token_placeholder: collez votre jeton de configuration SimpleFIN
+      connect: Connecter
+      cancel: Annuler
     create:
       success: Connexion SimpleFIN ajoutée avec succès ! Vos comptes apparaîtront sous peu lors de la synchronisation en arrière-plan.
       errors:
@@ -24,8 +30,41 @@ fr:
         label: "Jeton de configuration SimpleFIN :"
         placeholder: "Collez votre jeton de configuration SimpleFIN ici..."
         help_text: "Le jeton doit être une longue chaîne commençant par des lettres et des chiffres"
+    setup_accounts:
+      account_card:
+        balance: "Solde"
+      activity:
+        recent:
+          one: "1 transaction • dernière %{when}"
+          other: "%{count} transactions • dernière %{when}"
+        dormant: "Aucune activité depuis %{days} jours"
+        empty: "Aucune transaction importée pour le moment"
+        likely_closed: "Aucune activité récente et solde à zéro — il peut s'agir d'une carte fermée ou remplacée"
+        today: "aujourd'hui"
+        yesterday: "hier"
+        days_ago:
+          one: "il y a 1 jour"
+          other: "il y a %{count} jours"
+      stale_accounts:
+        title: "Comptes qui ne sont plus dans SimpleFIN"
+        description: "Ces comptes existent dans votre base de données mais ne sont plus fournis par SimpleFIN. Cela peut se produire lorsque la configuration des comptes change en amont."
+        action_prompt: "Que souhaitez-vous faire ?"
+        action_delete: "Supprimer le compte et toutes les transactions"
+        action_move: "Déplacer les transactions vers :"
+        action_skip: "Ignorer pour l'instant"
+        transaction_count:
+          one: "%{count} transaction"
+          other: "%{count} transactions"
     complete_account_setup:
-      success: Les comptes SimpleFIN ont été configurés avec succès ! Vos transactions et positions sont en cours d'importation en arrière-plan.
+      all_skipped: "Tous les comptes ont été ignorés. Aucun compte n'a été créé."
+      no_accounts: "Aucun compte à configurer."
+      success:
+        one: "%{count} compte SimpleFIN créé avec succès ! Vos transactions et avoirs sont en cours d'importation en arrière-plan."
+        other: "%{count} comptes SimpleFIN créés avec succès ! Vos transactions et avoirs sont en cours d'importation en arrière-plan."
+      stale_accounts_processed: "Comptes obsolètes : %{deleted} supprimés, %{moved} déplacés."
+      stale_accounts_errors:
+        one: "%{count} action sur un compte obsolète a échoué. Consultez les journaux pour plus de détails."
+        other: "%{count} actions sur des comptes obsolètes ont échoué. Consultez les journaux pour plus de détails."
     simplefin_item:
       add_new: Ajouter une nouvelle connexion
       confirm_accept: Supprimer la connexion
@@ -36,12 +75,58 @@ fr:
       error: Une erreur s'est produite lors de la synchronisation des données
       no_accounts_description: Cette connexion n'a pas encore de comptes synchronisés.
       no_accounts_title: Aucun compte trouvé
-      requires_update: Nécessite une ré-authentification
+      requires_update: Reconnecter
       setup_needed: Nouveaux comptes prêts à être configurés
       setup_description: Choisissez les types de comptes pour vos comptes SimpleFIN nouvellement importés.
       setup_action: Configurer les nouveaux comptes
+      setup_accounts_menu: Configurer les comptes
+      more_accounts_available:
+        one: "%{count} compte supplémentaire disponible à configurer"
+        other: "%{count} comptes supplémentaires disponibles à configurer"
+      accounts_skipped_tooltip: "Certains comptes ont été ignorés en raison d'erreurs lors de la synchronisation"
+      accounts_skipped_label: "Ignorés : %{count}"
+      rate_limited_ago: "Limite de débit atteinte (il y a %{time})"
+      rate_limited_recently: "Limite de débit atteinte récemment"
       status: Dernière synchronisation il y a %{timestamp}
       status_never: Jamais synchronisé
       status_with_summary: "Dernière synchronisation il y a %{timestamp} • %{summary}"
       syncing: Synchronisation...
-      update: Mettre à jour la connexion
+      update: Mettre à jour
+      stale_pending_note: "(exclues des budgets)"
+      stale_pending_accounts: "dans : %{accounts}"
+      reconciled_details_note: "(voir le résumé de synchronisation pour plus de détails)"
+      duplicate_accounts_skipped: "Certains comptes ont été ignorés comme doublons — utilisez 'Lier des comptes existants' pour fusionner."
+    select_existing_account:
+      title: "Lier %{account_name} à SimpleFIN"
+      description: Sélectionnez un compte SimpleFIN à lier à votre compte existant
+      cancel: Annuler
+      link_account: Lier le compte
+      no_accounts_found: "Aucun compte SimpleFIN trouvé pour ce %{moniker}."
+      wait_for_sync: Si vous venez de connecter ou de synchroniser, réessayez une fois la synchronisation terminée.
+      unlink_to_move: Pour déplacer un lien, détachez-le d'abord depuis le menu d'actions du compte.
+      all_accounts_already_linked: Tous les comptes SimpleFIN semblent déjà liés.
+      currently_linked_to: "Actuellement lié à : %{account_name}"
+
+    link_existing_account:
+      success: Compte lié à SimpleFIN avec succès
+      errors:
+        only_manual: Seuls les comptes manuels peuvent être liés
+        different_provider: Ce compte est lié à un autre fournisseur. Détachez-le d'abord de ce fournisseur, puis liez-le à SimpleFIN.
+        invalid_simplefin_account: Compte SimpleFIN sélectionné invalide
+    dismiss_replacement_suggestion:
+      dismissed: Suggestion de remplacement ignorée
+    replacement_prompt:
+      title: "Votre carte %{institution} a peut-être été remplacée"
+      description: "« %{account_name} » est liée à « %{old_name} », qui n'a eu aucune activité récente et un solde à zéro. Une nouvelle carte, « %{new_name} », est désormais active dans la même institution. Reliez-la pour conserver votre historique intact."
+      relink: Relier à la nouvelle carte
+      confirm_title: Relier à la nouvelle carte ?
+      confirm_body: "« %{account_name} » sera liée à « %{new_name} ». Votre historique de transactions est conservé ; les transactions futures proviendront de la nouvelle carte."
+      dismiss_aria: Ignorer la suggestion de remplacement
+    reconciled_status:
+      message:
+        one: "%{count} transaction en attente en doublon réconciliée"
+        other: "%{count} transactions en attente en doublon réconciliées"
+    stale_pending_status:
+      message:
+        one: "%{count} transaction en attente depuis plus de %{days} jours"
+        other: "%{count} transactions en attente depuis plus de %{days} jours"
diff --git a/config/locales/views/simplefin_items/hu.yml b/config/locales/views/simplefin_items/hu.yml
new file mode 100644
index 000000000..c2d844bc9
--- /dev/null
+++ b/config/locales/views/simplefin_items/hu.yml
@@ -0,0 +1,158 @@
+---
+hu:
+  simplefin_items:
+    new:
+      title: SimpleFIN csatlakoztatása
+      setup_token: Beállítási token
+      setup_token_placeholder: illeszd be a SimpleFIN beállítási tokenedet
+      connect: Csatlakoztatás
+      cancel: Mégse
+    create:
+      success: A SimpleFIN kapcsolat sikeresen hozzáadva! A számlák hamarosan megjelennek, miközben a háttérben szinkronizálódnak.
+      errors:
+        blank_token: Kérjük, add meg a SimpleFIN beállítási tokent.
+        invalid_token: Érvénytelen beállítási token. Ellenőrizd, hogy a teljes tokent másoltad-e a SimpleFIN Bridge-ből.
+        token_compromised: A beállítási token esetleg sérült, lejárt, vagy már felhasználták. Kérjük, hozz létre egy újat.
+        create_failed: "Nem sikerült csatlakozni: %{message}"
+        unexpected: Váratlan hiba történt. Kérjük, próbáld újra.
+    destroy:
+      success: A SimpleFIN kapcsolat el lesz távolítva
+    update:
+      success: A SimpleFIN kapcsolat sikeresen frissítve! A számlák újracsatlakoztatása folyamatban van.
+      errors:
+        blank_token: Kérjük, add meg a SimpleFIN beállítási tokent.
+        invalid_token: Érvénytelen beállítási token. Ellenőrizd, hogy a teljes tokent másoltad-e a SimpleFIN Bridge-ből.
+        token_compromised: A beállítási token esetleg sérült, lejárt, vagy már felhasználták. Kérjük, hozz létre egy újat.
+        update_failed: "Nem sikerült frissíteni a kapcsolatot: %{message}"
+        unexpected: Váratlan hiba történt. Kérjük, próbáld újra.
+    edit:
+      setup_token:
+        label: "SimpleFIN beállítási token:"
+        placeholder: "Illeszd be ide a SimpleFIN beállítási tokenedet..."
+        help_text: "A token egy betűkkel és számokkal kezdődő hosszú karakterlánc"
+      title: SimpleFIN kapcsolat frissítése
+      header_subtitle: Szerezz be egy új beállítási tokent a SimpleFIN-fiókod újracsatlakoztatásához
+      connection_needs_update: "A SimpleFIN kapcsolatodat frissíteni kell:"
+      step_1_html: "Látogass el a <a href=\"https://bridge.simplefin.org/simplefin/create\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"text-link hover:text-link underline\">SimpleFIN Bridge</a> oldalra egy új beállítási token létrehozásához"
+      step_2: Másold ki a tokent és illeszd be alább
+      step_3: "Kattints a \"Frissítés\" gombra a hozzáférés visszaállításához"
+      update: Frissítés
+      cancel: Mégse
+    setup_accounts:
+      title: SimpleFIN számlák beállítása
+      header_subtitle: Válaszd ki az importált számlák helyes típusait
+      choose_account_type: "Válaszd ki a megfelelő számlatípust minden SimpleFIN számlához:"
+      account_type_checking_savings: Folyó- vagy megtakarítási
+      account_type_checking_savings_desc: Normál bankszámlák
+      account_type_credit_card: Hitelkártya
+      account_type_credit_card_desc: Hitelkártya számlák
+      account_type_investment: Befektetési
+      account_type_investment_desc: "Brókeri, 401(k), IRA számlák"
+      account_type_loan: Hitel vagy jelzálog
+      account_type_loan_desc: Adósságszámlák
+      account_type_other_asset: Egyéb vagyon
+      account_type_other_asset_desc: Minden más
+      transaction_history_title: "Tranzakciós előzmények:"
+      transaction_history_description_html: "A SimpleFIN általában <strong>60-90 nap</strong> tranzakciós előzményt biztosít, a banktól függően. A kezdeti beállítás után az új tranzakciók automatikusan szinkronizálódnak. Az előzmények elérhetősége intézményenként és számlatípusonként változó."
+      account_type_label: "Számla típusa:"
+      create_accounts: Számlák létrehozása
+      creating_accounts: Számlák létrehozása...
+      cancel: Mégse
+      account_card:
+        balance: "Egyenleg"
+      activity:
+        recent:
+          one: "1 tranzakció • legújabb: %{when}"
+          other: "%{count} tranzakció • legújabb: %{when}"
+        dormant: "%{days} napja nincs aktivitás"
+        empty: "Még nem lett tranzakció importálva"
+        likely_closed: "Nincs friss aktivitás és az egyenleg nulla — ez egy megszűnt vagy cserélt kártya lehet"
+        today: "ma"
+        yesterday: "tegnap"
+        days_ago:
+          one: "1 napja"
+          other: "%{count} napja"
+      stale_accounts:
+        title: "A SimpleFIN-ből eltűnt számlák"
+        description: "Ezek a számlák megtalálhatók az adatbázisban, de a SimpleFIN már nem biztosítja őket. Ez akkor fordulhat elő, ha a számlakonfigurációk megváltoznak a szolgáltatónál."
+        action_prompt: "Mit szeretnél tenni?"
+        action_delete: "Számla és az összes tranzakció törlése"
+        action_move: "Tranzakciók áthelyezése ide:"
+        action_skip: "Kihagyás most"
+        transaction_count:
+          one: "%{count} tranzakció"
+          other: "%{count} tranzakció"
+    complete_account_setup:
+      all_skipped: "Minden számla ki lett hagyva. Egyetlen számla sem lett létrehozva."
+      no_accounts: "Nincs beállítandó számla."
+      success:
+        one: "Sikeresen létrehozva %{count} SimpleFIN-számla! A tranzakciók és befektetések importálása a háttérben zajlik."
+        other: "Sikeresen létrehozva %{count} SimpleFIN-számla! A tranzakciók és befektetések importálása a háttérben zajlik."
+      stale_accounts_processed: "Elavult számlák: %{deleted} törölve, %{moved} áthelyezve."
+      stale_accounts_errors:
+        one: "%{count} elavult számla művelete sikertelen. Részletekért lásd a naplót."
+        other: "%{count} elavult számla művelete sikertelen. Részletekért lásd a naplót."
+    simplefin_item:
+      add_new: Új kapcsolat hozzáadása
+      confirm_accept: Kapcsolat törlése
+      confirm_body: Ez véglegesen törli az összes számlát ebben a csoportban és az összes kapcsolódó adatot.
+      confirm_title: Töröljük a SimpleFIN kapcsolatot?
+      delete: Töröl
+      deletion_in_progress: "(törlés folyamatban...)"
+      error: Hiba történt az adatok szinkronizálása közben
+      no_accounts_description: Ennek a kapcsolatnak még nincsenek szinkronizált számlái.
+      no_accounts_title: Nem találhatók számlák
+      requires_update: Újracsatlakozás
+      setup_needed: Új számlák készen állnak a beállításra
+      setup_description: Válassz számlatípust az újonnan importált SimpleFIN-számlákhoz.
+      setup_action: Új számlák beállítása
+      setup_accounts_menu: Számlák beállítása
+      more_accounts_available:
+        one: "%{count} további számla áll rendelkezésre a beállításhoz"
+        other: "%{count} további számla áll rendelkezésre a beállításhoz"
+      accounts_skipped_tooltip: "Néhány számla ki lett hagyva a szinkronizálás közbeni hibák miatt"
+      accounts_skipped_label: "Kihagyva: %{count}"
+      rate_limited_ago: "Rátakorlátozott (%{time} ezelőtt)"
+      rate_limited_recently: "Nemrég rátakorlátozás lépett fel"
+      status: Utolsó szinkronizálás %{timestamp} ezelőtt
+      status_never: Még nem volt szinkronizálva
+      status_with_summary: "Utolsó szinkronizálás %{timestamp} ezelőtt • %{summary}"
+      syncing: Szinkronizálás folyamatban...
+      update: Frissítés
+      stale_pending_note: "(kizárva a költségvetésekből)"
+      stale_pending_accounts: "itt: %{accounts}"
+      reconciled_details_note: "(lásd a szinkronizálás összefoglalóját)"
+      duplicate_accounts_skipped: 'Néhány számla duplikátumként ki lett hagyva — az összevonáshoz használd a "Meglévő számlák összekapcsolása" lehetőséget.'
+    select_existing_account:
+      title: "%{account_name} csatlakoztatása SimpleFIN-hez"
+      description: Válassz egy SimpleFIN-számlát a meglévő számlád összekapcsolásához
+      cancel: Mégse
+      link_account: Számla összekapcsolása
+      no_accounts_found: "Nem található SimpleFIN-számla ehhez: %{moniker}."
+      wait_for_sync: Ha most csatlakoztál vagy szinkronizáltál, próbáld újra, miután a szinkronizálás befejeződött.
+      unlink_to_move: A kapcsolat áthelyezéséhez először szüntess meg a jelenlegi kapcsolatot a számla műveletek menüjéből.
+      all_accounts_already_linked: Úgy tűnik, az összes SimpleFIN-számla már össze van kapcsolva.
+      currently_linked_to: "Jelenleg összekapcsolva: %{account_name}"
+    link_existing_account:
+      success: A számla sikeresen össze lett kapcsolva a SimpleFIN-nel
+      errors:
+        only_manual: Csak manuális számlákat lehet összekapcsolni
+        different_provider: Ez a számla egy másik szolgáltatóhoz van kapcsolva. Először szüntesd meg azt a kapcsolatot, majd kapcsold a SimpleFIN-hez.
+        invalid_simplefin_account: Érvénytelen SimpleFIN-számla választva
+    dismiss_replacement_suggestion:
+      dismissed: A csere javaslata elutasítva
+    replacement_prompt:
+      title: "Lehet, hogy a %{institution} kártyád le lett cserélve"
+      description: 'A(z) "%{account_name}" össze van kapcsolva a(z) "%{old_name}"-vel, amelyen nem volt friss aktivitás és az egyenleg nulla. Egy új kártya, "%{new_name}", most aktív ugyanennél az intézménynél. Kapcsold újra, hogy a tranzakcióelőzmények megmaradjanak.'
+      relink: Újrakapcsolás az új kártyához
+      confirm_title: Újrakapcsolás az új kártyához?
+      confirm_body: 'A(z) "%{account_name}" össze lesz kapcsolva a(z) "%{new_name}"-vel. A tranzakcióelőzmények megmaradnak; a jövőbeli tranzakciók az új kártyáról érkeznek.'
+      dismiss_aria: Csere javaslat elutasítása
+    reconciled_status:
+      message:
+        one: "%{count} duplikált függőben lévő tranzakció egyeztetve"
+        other: "%{count} duplikált függőben lévő tranzakció egyeztetve"
+    stale_pending_status:
+      message:
+        one: "%{count} függőben lévő tranzakció %{days} napnál régebbi"
+        other: "%{count} függőben lévő tranzakció %{days} napnál régebbi"
diff --git a/config/locales/views/simplefin_items/update.hu.yml b/config/locales/views/simplefin_items/update.hu.yml
new file mode 100644
index 000000000..243e48435
--- /dev/null
+++ b/config/locales/views/simplefin_items/update.hu.yml
@@ -0,0 +1,7 @@
+hu:
+  simplefin_items:
+    update:
+      success: "A SimpleFIN kapcsolat frissítve."
+      errors:
+        blank_token: 'Hiányzó SimpleFIN hozzáférési token. Kérjük, adj meg egy tokent, vagy a folytatáshoz használd a „Meglévő számlák összekapcsolása" lehetőséget.'
+        update_failed: "Nem sikerült frissíteni a SimpleFIN kapcsolatot: %{message}"
diff --git a/config/locales/views/snaptrade_items/ca.yml b/config/locales/views/snaptrade_items/ca.yml
new file mode 100644
index 000000000..d270af3cf
--- /dev/null
+++ b/config/locales/views/snaptrade_items/ca.yml
@@ -0,0 +1,209 @@
+---
+ca:
+  providers:
+    snaptrade:
+      accounts_count:
+        one: "%{count} compte"
+        other: "%{count} comptes"
+      client_id_label: Client ID
+      client_id_placeholder: Introdueix el teu Client ID de SnapTrade
+      client_id_update_placeholder: Introdueix un nou Client ID per actualitzar
+      connect_button: Connecta un broker
+      connected_brokerages: 'Connectats:'
+      connection_description: Connecta't al teu broker a través de SnapTrade (25+
+        brokers admesos)
+      connections_error: 'No s''han pogut carregar les connexions: %{message}'
+      consumer_key_label: Consumer Key
+      consumer_key_placeholder: Introdueix la teva Consumer Key de SnapTrade
+      consumer_key_update_placeholder: Introdueix un nou Consumer Key per actualitzar
+      delete_connection: Elimina
+      delete_connection_body: Això eliminarà permanentment la connexió de %{brokerage}
+        de SnapTrade. Tots els comptes d'aquest broker quedaran sense enllaçar. Hauràs
+        de reconnectar per sincronitzar aquests comptes de nou.
+      delete_connection_confirm: Elimina la connexió
+      delete_connection_title: Vols eliminar la connexió amb el broker?
+      delete_orphaned_user: Elimina
+      delete_orphaned_user_body: Això eliminarà permanentment aquest usuari orfe de
+        SnapTrade i totes les seves connexions de broker, alliberant places de connexió.
+      delete_orphaned_user_confirm: Elimina el registre
+      delete_orphaned_user_title: Vols eliminar el registre orfe?
+      description: SnapTrade connecta amb més de 25 brokers importants (Fidelity,
+        Vanguard, Schwab, Robinhood, etc.) i proporciona l'historial complet d'operacions
+        amb etiquetes d'activitat i cost base.
+      free_tier_warning: El nivell gratuït de SnapTrade cobreix 5 connexions de broker.
+        Per a més, amplia el teu pla a SnapTrade.
+      loading_connections: Carregant connexions...
+      manage_connections: Gestiona connexions
+      name: SnapTrade
+      needs_linking: necessita enllaç
+      needs_setup:
+        one: "%{count} necessita configuració"
+        other: "%{count} necessiten configuració"
+      no_connections: No s'han trobat connexions de broker.
+      orphaned_connection: Connexió orfe (no sincronitzada localment)
+      orphaned_user: Registre orfe
+      orphaned_users_description: Aquests són registres d'usuari de SnapTrade anteriors
+        que ocupen places de connexió. Elimina'ls per alliberar places.
+      orphaned_users_title:
+        one: "%{count} registre orfe"
+        other: "%{count} registres orfes"
+      save_button: Desa la configuració
+      setup_accounts_button: Configura comptes
+      setup_title: 'Instruccions de configuració:'
+      status_connected:
+        one: "%{count} compte de SnapTrade"
+        other: "%{count} comptes de SnapTrade"
+      status_needs_registration: Credencials desades. Finalitza la configuració per
+        connectar un broker.
+      status_ready: Llest per connectar brokers
+      step_1_html: Crea un compte a <a href="https://dashboard.snaptrade.com" target="_blank"
+        rel="noopener noreferrer" class="text-primary underline">dashboard.snaptrade.com</a>
+      step_2: Copia el teu Client ID i Consumer Key des del panell
+      step_3: Introdueix les teves credencials a continuació i fes clic a Desa
+      step_4: Ves a la pàgina de comptes i utilitza 'Connecta un altre broker' per
+        enllaçar els teus comptes d'inversió
+      update_button: Actualitza la configuració
+  snaptrade_item:
+    brokerage_summary:
+      count:
+        one: "%{count} broker"
+        other: "%{count} brokers"
+      none: No hi ha brokers connectats
+    institution_summary:
+      count:
+        one: "%{count} entitat"
+        other: "%{count} entitats"
+      none: No hi ha entitats connectades
+    sync_status:
+      no_accounts: No s'han trobat comptes
+      synced:
+        one: "%{count} compte sincronitzat"
+        other: "%{count} comptes sincronitzats"
+      synced_with_setup: "%{linked} sincronitzats, %{unlinked} necessiten configuració"
+    syncer:
+      activities_fetching_async: Les activitats s'estan obtenint en segon pla. Pot
+        trigar fins a un minut per a connexions de broker noves.
+      calculating: Calculant saldos...
+      checking_config: Comprovant la configuració dels comptes...
+      discovering: Descobrint comptes...
+      importing: Important comptes des de SnapTrade...
+      needs_setup: "%{count} comptes necessiten configuració..."
+      processing: Processant posicions i activitats...
+  snaptrade_items:
+    callback:
+      no_item: No s'ha trobat la configuració de SnapTrade.
+      success: Broker connectat! Selecciona quins comptes vols enllaçar.
+    complete_account_setup:
+      link_failed: 'No s''han pogut enllaçar els comptes: %{errors}'
+      no_accounts: No s'ha seleccionat cap compte per enllaçar.
+      partial_success:
+        one: S'ha enllaçat %{count} compte. %{failed_count} no s'han pogut enllaçar.
+        other: S'han enllaçat %{count} comptes. %{failed_count} no s'han pogut enllaçar.
+      success:
+        one: S'ha enllaçat correctament %{count} compte.
+        other: S'han enllaçat correctament %{count} comptes.
+    connect:
+      connection_failed: 'No s''ha pogut connectar a SnapTrade: %{message}'
+      decryption_failed: No s'han pogut llegir les credencials de SnapTrade. Elimina
+        aquesta connexió i torna-la a crear.
+    connections:
+      unknown_brokerage: Broker desconegut
+    create:
+      success: SnapTrade s'ha configurat correctament.
+    default_name: Connexió SnapTrade
+    delete_connection:
+      api_deletion_failed: No s'ha pogut eliminar la connexió de SnapTrade — falten
+        les credencials. La connexió encara pot existir al teu compte SnapTrade.
+      failed: 'No s''ha pogut eliminar la connexió: %{message}'
+      missing_authorization_id: Falta l'ID d'autorització
+      success: La connexió s'ha eliminat correctament. S'ha alliberat una plaça.
+    delete_orphaned_user:
+      failed: No s'ha pogut eliminar el registre orfe.
+      success: El registre orfe s'ha eliminat correctament.
+    destroy:
+      success: S'ha programat la connexió SnapTrade per a la seva eliminació.
+    link_accounts:
+      use_setup_flow: Utilitza en el seu lloc el flux de configuració de comptes
+    link_existing_account:
+      failed: 'No s''ha pogut enllaçar el compte: %{message}'
+      not_found: No s'ha trobat el compte.
+      success: S'ha enllaçat correctament al compte SnapTrade.
+    preload_accounts:
+      not_configured: SnapTrade no està configurat.
+    select_accounts:
+      not_configured: SnapTrade no està configurat.
+    select_existing_account:
+      balance_label: 'Saldo:'
+      cancel_button: Cancel·la
+      connect_hint: Pot ser que hagis de connectar primer un broker.
+      header: Enllaça un compte existent
+      link_button: Enllaça
+      linking_to: 'Enllaçant al compte:'
+      no_accounts: No hi ha comptes SnapTrade sense enllaçar disponibles.
+      not_found: No s'ha trobat el compte o la configuració de SnapTrade.
+      settings_link: Ves a la configuració del proveïdor
+      subtitle: Selecciona un compte SnapTrade per enllaçar
+      title: Enllaça amb un compte SnapTrade
+    setup_accounts:
+      account_number: 'Compte:'
+      available_accounts: Comptes disponibles
+      back_to_settings: Torna a la configuració
+      balance_label: 'Saldo:'
+      cancel_button: Cancel·la
+      create_button: Crea els comptes seleccionats
+      creating: Creant comptes...
+      done_button: Fet
+      free_tier_note: El nivell gratuït de SnapTrade permet 5 connexions de broker.
+        Revisa el teu panell de SnapTrade per veure l'ús actual.
+      header: Configura els teus comptes SnapTrade
+      info_activities: Historial d'operacions amb etiquetes d'activitat (Compra, Venda,
+        Dividend, etc.)
+      info_cost_basis: Cost base per posició (quan estigui disponible)
+      info_history: Fins a 3 anys d'historial de transaccions
+      info_holdings: Posicions amb preus i quantitats actuals
+      info_title: Dades d'inversió SnapTrade
+      link_button: Enllaça
+      linked_accounts: Ja enllaçats
+      linked_to: 'Enllaçat a:'
+      loading: Obtenint comptes des de SnapTrade...
+      loading_hint: Fes clic a Actualitza per comprovar si hi ha comptes.
+      no_accounts_message: No s'ha trobat cap compte de broker. Això pot passar si
+        has cancel·lat la connexió o si el teu broker no està admès.
+      no_accounts_title: No s'han trobat comptes
+      or_link_existing: 'O enllaça a un compte existent en lloc de crear-ne un de
+        nou:'
+      refresh: Actualitza
+      select_account: Selecciona un compte...
+      subtitle: Selecciona quins comptes de broker vols enllaçar
+      sync_start_date_help: Deixa-ho en blanc per a tot l'historial disponible
+      sync_start_date_label: 'Importa transaccions des de:'
+      syncing: Obtenint els teus comptes...
+      title: Configura comptes SnapTrade
+      try_again: Connecta un broker
+    snaptrade_item:
+      accounts_need_setup:
+        one: "%{count} compte necessita configuració"
+        other: "%{count} comptes necessiten configuració"
+      add_another_brokerage: Connecta un altre broker
+      connect_brokerage: Connecta un broker
+      delete: Elimina
+      deletion_in_progress: Eliminació en curs...
+      error: Error de sincronització
+      manage_connections: Gestiona connexions
+      more_accounts_available:
+        one: "%{count} compte més disponible per configurar"
+        other: "%{count} comptes més disponibles per configurar"
+      no_accounts_description: Connecta un broker per importar els teus comptes d'inversió.
+      no_accounts_title: No s'han descobert comptes
+      reconnect: Reconnecta
+      requires_update: La connexió necessita actualització
+      setup_accounts_menu: Configura comptes
+      setup_action: Configura comptes
+      setup_description: Alguns comptes de SnapTrade necessiten ser enllaçats a comptes
+        de Sure.
+      setup_needed: Els comptes necessiten configuració
+      status: Darrera sincronització fa %{timestamp} - %{summary}
+      status_never: Mai sincronitzat
+      syncing: Sincronitzant...
+    update:
+      success: La configuració de SnapTrade s'ha actualitzat correctament.
diff --git a/config/locales/views/snaptrade_items/de.yml b/config/locales/views/snaptrade_items/de.yml
index c0f0cd22c..6ab8c28cf 100644
--- a/config/locales/views/snaptrade_items/de.yml
+++ b/config/locales/views/snaptrade_items/de.yml
@@ -134,8 +134,6 @@ de:
         one: "%{count} muss eingerichtet werden"
         other: "%{count} müssen eingerichtet werden"
       status_ready: "Bereit zum Verbinden von Brokern"
-      status_needs_registration: "Zugangsdaten gespeichert. Gehen Sie zur Konten-Seite, um Broker zu verbinden."
-      status_not_configured: "Nicht konfiguriert"
       setup_accounts_button: "Konten einrichten"
       connect_button: "Broker verbinden"
       connected_brokerages: "Verbunden:"
diff --git a/config/locales/views/snaptrade_items/en.yml b/config/locales/views/snaptrade_items/en.yml
index e9cdfd250..e601741cc 100644
--- a/config/locales/views/snaptrade_items/en.yml
+++ b/config/locales/views/snaptrade_items/en.yml
@@ -1,6 +1,8 @@
 en:
   snaptrade_items:
     default_name: "SnapTrade Connection"
+    link_accounts:
+      use_setup_flow: Use the account setup flow instead
     create:
       success: "Successfully configured SnapTrade."
     update:
@@ -73,6 +75,8 @@ en:
       available_accounts: "Available Accounts"
       balance_label: "Balance:"
       account_number: "Account:"
+      sync_start_date_label: "Import transactions from:"
+      sync_start_date_help: "Leave blank for all available history"
       create_button: "Create Selected Accounts"
       cancel_button: "Cancel"
       creating: "Creating Accounts..."
@@ -117,7 +121,7 @@ en:
       step_2: "Copy your Client ID and Consumer Key from the dashboard"
       step_3: "Enter your credentials below and click Save"
       step_4: "Go to the Accounts page and use 'Connect another brokerage' to link your investment accounts"
-      free_tier_warning: "Free tier includes 5 brokerage connections. Additional connections require a paid SnapTrade plan."
+      free_tier_warning: "SnapTrade's free tier covers 5 brokerage connections. Upgrade on SnapTrade for more."
       client_id_label: "Client ID"
       client_id_placeholder: "Enter your SnapTrade Client ID"
       client_id_update_placeholder: "Enter new Client ID to update"
@@ -129,17 +133,15 @@ en:
       status_connected:
         one: "%{count} account from SnapTrade"
         other: "%{count} accounts from SnapTrade"
+      status_needs_registration: "Credentials saved. Finish setup to connect a brokerage."
       needs_setup:
         one: "%{count} needs setup"
         other: "%{count} need setup"
       status_ready: "Ready to connect brokerages"
-      status_needs_registration: "Credentials saved. Go to Accounts page to connect brokerages."
-      status_not_configured: "Not configured"
       setup_accounts_button: "Setup Accounts"
       connect_button: "Connect Brokerage"
       connected_brokerages: "Connected:"
       manage_connections: "Manage Connections"
-      connection_limit_info: "SnapTrade free tier allows 5 brokerage connections. Delete unused connections to free up slots."
       loading_connections: "Loading connections..."
       connections_error: "Failed to load connections: %{message}"
       accounts_count:
diff --git a/config/locales/views/snaptrade_items/es.yml b/config/locales/views/snaptrade_items/es.yml
index 47a6ca609..db087fff9 100644
--- a/config/locales/views/snaptrade_items/es.yml
+++ b/config/locales/views/snaptrade_items/es.yml
@@ -134,8 +134,6 @@ es:
         one: "%{count} necesita configuración"
         other: "%{count} necesitan configuración"
       status_ready: "Listo para conectar brókers"
-      status_needs_registration: "Credenciales guardadas. Ve a la página de Cuentas para conectar brókers."
-      status_not_configured: "No configurado"
       setup_accounts_button: "Configurar cuentas"
       connect_button: "Conectar bróker"
       connected_brokerages: "Conectados:"
diff --git a/config/locales/views/snaptrade_items/fr.yml b/config/locales/views/snaptrade_items/fr.yml
new file mode 100644
index 000000000..65183408e
--- /dev/null
+++ b/config/locales/views/snaptrade_items/fr.yml
@@ -0,0 +1,188 @@
+---
+fr:
+  snaptrade_items:
+    default_name: "Connexion SnapTrade"
+    create:
+      success: "Configuration SnapTrade réussie."
+    update:
+      success: "Configuration SnapTrade mise à jour."
+    destroy:
+      success: "Connexion SnapTrade mise en file d'attente pour suppression."
+    connect:
+      decryption_failed: "Impossible de lire les identifiants SnapTrade. Veuillez supprimer et recréer cette connexion."
+      connection_failed: "Échec de la connexion à SnapTrade : %{message}"
+    callback:
+      success: "Courtier connecté. Veuillez sélectionner les comptes à lier."
+      no_item: "Configuration SnapTrade introuvable."
+    complete_account_setup:
+      success:
+        one: "%{count} compte lié avec succès."
+        other: "%{count} comptes liés avec succès."
+      partial_success:
+        one: "%{count} compte lié. Échec de la liaison de %{failed_count}."
+        other: "%{count} comptes liés. Échec de la liaison de %{failed_count}."
+      link_failed: "Échec de la liaison des comptes : %{errors}"
+      no_accounts: "Aucun compte n'a été sélectionné pour la liaison."
+    preload_accounts:
+      not_configured: "SnapTrade n'est pas configuré."
+    select_accounts:
+      not_configured: "SnapTrade n'est pas configuré."
+    select_existing_account:
+      not_found: "Compte ou configuration SnapTrade introuvable."
+      title: "Lier à un compte SnapTrade"
+      header: "Lier un compte existant"
+      subtitle: "Sélectionnez un compte SnapTrade à lier"
+      no_accounts: "Aucun compte SnapTrade non lié disponible."
+      connect_hint: "Vous devrez peut-être d'abord connecter un courtier."
+      settings_link: "Aller aux paramètres du fournisseur"
+      linking_to: "Liaison au compte :"
+      balance_label: "Solde :"
+      link_button: "Lier"
+      cancel_button: "Annuler"
+    link_existing_account:
+      success: "Compte SnapTrade lié avec succès."
+      failed: "Échec de la liaison du compte : %{message}"
+      not_found: "Compte introuvable."
+    connections:
+      unknown_brokerage: "Courtier inconnu"
+    delete_connection:
+      success: "Connexion supprimée avec succès. Un emplacement libéré."
+      failed: "Échec de la suppression de la connexion : %{message}"
+      missing_authorization_id: "Identifiant d'autorisation manquant"
+      api_deletion_failed: "Impossible de supprimer la connexion de SnapTrade - identifiants manquants. La connexion peut toujours exister dans votre compte SnapTrade."
+    delete_orphaned_user:
+      success: "Enregistrement orphelin supprimé avec succès."
+      failed: "Échec de la suppression de l'enregistrement orphelin."
+    setup_accounts:
+      title: "Configurer les comptes SnapTrade"
+      header: "Configurer vos comptes SnapTrade"
+      subtitle: "Sélectionnez les comptes de courtage à lier"
+      syncing: "Récupération de vos comptes…"
+      loading: "Récupération des comptes depuis SnapTrade…"
+      loading_hint: "Cliquez sur Actualiser pour vérifier les comptes."
+      refresh: "Actualiser"
+      info_title: "Données d'investissement SnapTrade"
+      info_holdings: "Avoirs avec prix actuels et quantités"
+      info_cost_basis: "Coût d'acquisition par position (lorsque disponible)"
+      info_activities: "Historique des transactions boursières avec libellés d'activité (Achat, Vente, Dividende, etc.)"
+      info_history: "Jusqu'à 3 ans d'historique des transactions"
+      free_tier_note: "L'offre gratuite SnapTrade autorise 5 connexions de courtier. Consultez votre tableau de bord SnapTrade pour l'utilisation actuelle."
+      no_accounts_title: "Aucun compte trouvé"
+      no_accounts_message: "Aucun compte de courtage n'a été trouvé. Cela peut se produire si vous avez annulé la connexion ou si votre courtier n'est pas pris en charge."
+      try_again: "Connecter un courtier"
+      back_to_settings: "Retour aux paramètres"
+      available_accounts: "Comptes disponibles"
+      balance_label: "Solde :"
+      account_number: "Compte :"
+      create_button: "Créer les comptes sélectionnés"
+      cancel_button: "Annuler"
+      creating: "Création des comptes…"
+      done_button: "Terminé"
+      or_link_existing: "Ou liez à un compte existant au lieu d'en créer un nouveau :"
+      select_account: "Sélectionnez un compte…"
+      link_button: "Lier"
+      linked_accounts: "Déjà liés"
+      linked_to: "Lié à :"
+    snaptrade_item:
+      accounts_need_setup:
+        one: "%{count} compte à configurer"
+        other: "%{count} comptes à configurer"
+      deletion_in_progress: "Suppression en cours…"
+      syncing: "Synchronisation…"
+      requires_update: "Connexion à mettre à jour"
+      error: "Erreur de synchronisation"
+      status: "Dernière synchronisation il y a %{timestamp} - %{summary}"
+      status_never: "Jamais synchronisé"
+      reconnect: "Reconnecter"
+      connect_brokerage: "Connecter un courtier"
+      add_another_brokerage: "Connecter un autre courtier"
+      delete: "Supprimer"
+      setup_needed: "Comptes à configurer"
+      setup_description: "Certains comptes de SnapTrade doivent être liés à des comptes Sure."
+      setup_action: "Configurer les comptes"
+      setup_accounts_menu: "Configurer les comptes"
+      manage_connections: "Gérer les connexions"
+      more_accounts_available:
+        one: "%{count} compte supplémentaire disponible à configurer"
+        other: "%{count} comptes supplémentaires disponibles à configurer"
+      no_accounts_title: "Aucun compte découvert"
+      no_accounts_description: "Connectez un courtier pour importer vos comptes d'investissement."
+
+  providers:
+    snaptrade:
+      name: "SnapTrade"
+      connection_description: "Connectez-vous à votre courtier via SnapTrade (plus de 25 courtiers pris en charge)"
+      description: "SnapTrade se connecte à plus de 25 courtiers majeurs (Fidelity, Vanguard, Schwab, Robinhood, etc.) et fournit l'historique complet des transactions avec des libellés d'activité et le coût d'acquisition."
+      setup_title: "Instructions de configuration :"
+      step_1_html: "Créez un compte sur <a href=\"https://dashboard.snaptrade.com\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"text-primary underline\">dashboard.snaptrade.com</a>"
+      step_2: "Copiez votre Client ID et votre Consumer Key depuis le tableau de bord"
+      step_3: "Saisissez vos identifiants ci-dessous et cliquez sur Enregistrer"
+      step_4: "Rendez-vous sur la page Comptes et utilisez « Connecter un autre courtier » pour lier vos comptes d'investissement"
+      free_tier_warning: "L'offre gratuite inclut 5 connexions de courtier. Les connexions supplémentaires nécessitent un forfait SnapTrade payant."
+      client_id_label: "Client ID"
+      client_id_placeholder: "Saisissez votre Client ID SnapTrade"
+      client_id_update_placeholder: "Saisissez un nouveau Client ID pour mettre à jour"
+      consumer_key_label: "Consumer Key"
+      consumer_key_placeholder: "Saisissez votre Consumer Key SnapTrade"
+      consumer_key_update_placeholder: "Saisissez une nouvelle Consumer Key pour mettre à jour"
+      save_button: "Enregistrer la configuration"
+      update_button: "Mettre à jour la configuration"
+      status_connected:
+        one: "%{count} compte depuis SnapTrade"
+        other: "%{count} comptes depuis SnapTrade"
+      needs_setup:
+        one: "%{count} à configurer"
+        other: "%{count} à configurer"
+      status_ready: "Prêt à connecter des courtiers"
+      setup_accounts_button: "Configurer les comptes"
+      connect_button: "Connecter un courtier"
+      connected_brokerages: "Connectés :"
+      manage_connections: "Gérer les connexions"
+      connection_limit_info: "L'offre gratuite SnapTrade autorise 5 connexions de courtier. Supprimez les connexions inutilisées pour libérer des emplacements."
+      loading_connections: "Chargement des connexions…"
+      connections_error: "Échec du chargement des connexions : %{message}"
+      accounts_count:
+        one: "%{count} compte"
+        other: "%{count} comptes"
+      orphaned_connection: "Connexion orpheline (non synchronisée localement)"
+      needs_linking: "à lier"
+      no_connections: "Aucune connexion de courtier trouvée."
+      delete_connection: "Supprimer"
+      delete_connection_title: "Supprimer la connexion de courtier ?"
+      delete_connection_body: "Cela supprimera définitivement la connexion %{brokerage} de SnapTrade. Tous les comptes de ce courtier seront déliés. Vous devrez vous reconnecter pour synchroniser à nouveau ces comptes."
+      delete_connection_confirm: "Supprimer la connexion"
+      orphaned_users_title:
+        one: "%{count} enregistrement orphelin"
+        other: "%{count} enregistrements orphelins"
+      orphaned_users_description: "Il s'agit d'anciens enregistrements d'utilisateurs SnapTrade qui occupent vos emplacements de connexion. Supprimez-les pour libérer des emplacements."
+      orphaned_user: "Enregistrement orphelin"
+      delete_orphaned_user: "Supprimer"
+      delete_orphaned_user_title: "Supprimer l'enregistrement orphelin ?"
+      delete_orphaned_user_body: "Cela supprimera définitivement cet utilisateur SnapTrade orphelin et toutes ses connexions de courtier, libérant ainsi des emplacements de connexion."
+      delete_orphaned_user_confirm: "Supprimer l'enregistrement"
+
+  snaptrade_item:
+    sync_status:
+      no_accounts: "Aucun compte trouvé"
+      synced:
+        one: "%{count} compte synchronisé"
+        other: "%{count} comptes synchronisés"
+      synced_with_setup: "%{linked} synchronisé(s), %{unlinked} à configurer"
+    institution_summary:
+      none: "Aucune institution connectée"
+      count:
+        one: "%{count} institution"
+        other: "%{count} institutions"
+    brokerage_summary:
+      none: "Aucun courtier connecté"
+      count:
+        one: "%{count} courtier"
+        other: "%{count} courtiers"
+    syncer:
+      discovering: "Découverte des comptes…"
+      importing: "Importation des comptes depuis SnapTrade…"
+      processing: "Traitement des avoirs et des activités…"
+      calculating: "Calcul des soldes…"
+      checking_config: "Vérification de la configuration du compte…"
+      needs_setup: "%{count} comptes à configurer…"
+      activities_fetching_async: "Les activités sont récupérées en arrière-plan. Cela peut prendre jusqu'à une minute pour les nouvelles connexions de courtier."
diff --git a/config/locales/views/snaptrade_items/hu.yml b/config/locales/views/snaptrade_items/hu.yml
new file mode 100644
index 000000000..dab3d05ce
--- /dev/null
+++ b/config/locales/views/snaptrade_items/hu.yml
@@ -0,0 +1,193 @@
+---
+hu:
+  snaptrade_items:
+    default_name: "SnapTrade kapcsolat"
+    link_accounts:
+      use_setup_flow: Használd helyette a számlabeállítási folyamatot
+    create:
+      success: "SnapTrade sikeresen beállítva."
+    update:
+      success: "SnapTrade konfiguráció sikeresen frissítve."
+    destroy:
+      success: "SnapTrade kapcsolat törlése ütemezve."
+    connect:
+      decryption_failed: "Nem sikerült beolvasni a SnapTrade hitelesítő adatokat. Kérlek töröld és hozd létre újra a kapcsolatot."
+      connection_failed: "Nem sikerült csatlakozni a SnapTrade-hez: %{message}"
+    callback:
+      success: "Brókercég csatlakoztatva! Kérlek válaszd ki, mely számlákat szeretnéd összekapcsolni."
+      no_item: "SnapTrade konfiguráció nem található."
+    complete_account_setup:
+      success:
+        one: "%{count} számla sikeresen összekapcsolva."
+        other: "%{count} számla sikeresen összekapcsolva."
+      partial_success:
+        one: "%{count} számla összekapcsolva. %{failed_count} összekapcsolás sikertelen."
+        other: "%{count} számla összekapcsolva. %{failed_count} összekapcsolás sikertelen."
+      link_failed: "Nem sikerült összekapcsolni a számlákat: %{errors}"
+      no_accounts: "Nem lett kijelölve számla az összekapcsoláshoz."
+    preload_accounts:
+      not_configured: "A SnapTrade nincs beállítva."
+    select_accounts:
+      not_configured: "A SnapTrade nincs beállítva."
+    select_existing_account:
+      not_found: "Számla vagy SnapTrade konfiguráció nem található."
+      title: "Összekapcsolás SnapTrade számlával"
+      header: "Meglévő számla összekapcsolása"
+      subtitle: "Válassz egy SnapTrade számlát az összekapcsoláshoz"
+      no_accounts: "Nincs elérhető nem összekapcsolt SnapTrade számla."
+      connect_hint: "Előbb lehet, hogy brókercéget kell csatlakoztatnod."
+      settings_link: "Szolgáltatói beállítások megnyitása"
+      linking_to: "Összekapcsolás ezzel a számlával:"
+      balance_label: "Egyenleg:"
+      link_button: "Összekapcsolás"
+      cancel_button: "Mégse"
+    link_existing_account:
+      success: "Sikeresen összekapcsolva a SnapTrade számlával."
+      failed: "Nem sikerült összekapcsolni a számlát: %{message}"
+      not_found: "Számla nem található."
+    connections:
+      unknown_brokerage: "Ismeretlen brókercég"
+    delete_connection:
+      success: "Kapcsolat sikeresen törölve. Egy hely felszabadult."
+      failed: "Nem sikerült törölni a kapcsolatot: %{message}"
+      missing_authorization_id: "Hiányzó engedélyezési azonosító"
+      api_deletion_failed: "Nem sikerült törölni a kapcsolatot a SnapTrade-ből — hiányzó hitelesítő adatok. A kapcsolat még mindig létezhet a SnapTrade fiókodon."
+    delete_orphaned_user:
+      success: "Árva regisztráció sikeresen törölve."
+      failed: "Nem sikerült törölni az árva regisztrációt."
+    setup_accounts:
+      title: "SnapTrade számlák beállítása"
+      header: "SnapTrade számlák beállítása"
+      subtitle: "Válaszd ki, mely brókeri számlákat szeretnéd összekapcsolni"
+      syncing: "Számlák lekérése..."
+      loading: "Számlák lekérése a SnapTrade-ből..."
+      loading_hint: "Kattints a Frissítésre a számlák ellenőrzéséhez."
+      refresh: "Frissítés"
+      info_title: "SnapTrade befektetési adatok"
+      info_holdings: "Portfólió aktuális árakkal és mennyiségekkel"
+      info_cost_basis: "Pozíciónkénti bekerülési érték (ha elérhető)"
+      info_activities: "Kereskedési előzmények tevékenységcímkékkel (Vétel, Eladás, Osztalék stb.)"
+      info_history: "Legfeljebb 3 év tranzakciós előzmény"
+      free_tier_note: "A SnapTrade ingyenes szintje 5 bróker kapcsolatot tesz lehetővé. Az aktuális felhasználásért ellenőrizd a SnapTrade irányítópultodat."
+      no_accounts_title: "Nem találhatók számlák"
+      no_accounts_message: "Nem találhatók brókeri számlák. Ez előfordulhat, ha megszakítottad a kapcsolatot, vagy ha a brókercéged nem támogatott."
+      try_again: "Brókercég csatlakoztatása"
+      back_to_settings: "Vissza a beállításokhoz"
+      available_accounts: "Elérhető számlák"
+      balance_label: "Egyenleg:"
+      account_number: "Számla:"
+      sync_start_date_label: "Tranzakciók importálása ettől:"
+      sync_start_date_help: "Hagyd üresen az összes elérhető előzményhez"
+      create_button: "Kiválasztott számlák létrehozása"
+      cancel_button: "Mégse"
+      creating: "Számlák létrehozása..."
+      done_button: "Kész"
+      or_link_existing: "Vagy kapcsold össze egy meglévő számlával ahelyett, hogy újat hoznál létre:"
+      select_account: "Válassz egy számlát..."
+      link_button: "Összekapcsolás"
+      linked_accounts: "Már összekapcsolt"
+      linked_to: "Összekapcsolva:"
+    snaptrade_item:
+      accounts_need_setup:
+        one: "%{count} számla beállítást igényel"
+        other: "%{count} számla beállítást igényel"
+      deletion_in_progress: "Törlés folyamatban..."
+      syncing: "Szinkronizálás..."
+      requires_update: "A kapcsolat frissítést igényel"
+      error: "Szinkronizálási hiba"
+      status: "Utolsó szinkronizálás %{timestamp} ezelőtt — %{summary}"
+      status_never: "Még nem szinkronizált"
+      reconnect: "Újracsatlakozás"
+      connect_brokerage: "Brókercég csatlakoztatása"
+      add_another_brokerage: "Másik brókercég csatlakoztatása"
+      delete: "Törlés"
+      setup_needed: "Számlák beállítást igényelnek"
+      setup_description: "Egyes SnapTrade számlák összekapcsolásra várnak a Sure számláival."
+      setup_action: "Számlák beállítása"
+      setup_accounts_menu: "Számlák beállítása"
+      manage_connections: "Kapcsolatok kezelése"
+      more_accounts_available:
+        one: "%{count} további beállítható számla"
+        other: "%{count} további beállítható számla"
+      no_accounts_title: "Nem találhatók számlák"
+      no_accounts_description: "Csatlakoztass egy brókercéget a befektetési számlák importálásához."
+
+  providers:
+    snaptrade:
+      name: "SnapTrade"
+      connection_description: "Csatlakozás a brókereidhez a SnapTrade-en keresztül (25+ bróker támogatott)"
+      description: "A SnapTrade 25+ nagyobb brókercéghez csatlakozik (Fidelity, Vanguard, Schwab, Robinhood stb.), és teljes kereskedési előzményeket biztosít tevékenységcímkékkel és bekerülési értékkel."
+      setup_title: "Beállítási utasítások:"
+      step_1_html: "Hozz létre fiókot a <a href=\"https://dashboard.snaptrade.com\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"text-primary underline\">dashboard.snaptrade.com</a> oldalon"
+      step_2: "Másold ki az Ügyfél-azonosítót és a Fogyasztói kulcsot az irányítópultból"
+      step_3: "Add meg a hitelesítő adatokat alább, majd kattints a Mentésre"
+      step_4: "Menj a Számlák oldalra, és az 'Másik brókercég csatlakoztatása' opcióval kapcsold össze a befektetési számláidat"
+      free_tier_warning: "Az ingyenes szint 5 bróker kapcsolatot tartalmaz. További kapcsolatokhoz fizetős SnapTrade előfizetés szükséges."
+      client_id_label: "Ügyfél-azonosító"
+      client_id_placeholder: "Add meg a SnapTrade ügyfél-azonosítódat"
+      client_id_update_placeholder: "Add meg az új ügyfél-azonosítót a frissítéshez"
+      consumer_key_label: "Fogyasztói kulcs"
+      consumer_key_placeholder: "Add meg a SnapTrade fogyasztói kulcsodat"
+      consumer_key_update_placeholder: "Add meg az új fogyasztói kulcsot a frissítéshez"
+      save_button: "Konfiguráció mentése"
+      update_button: "Konfiguráció frissítése"
+      status_connected:
+        one: "%{count} számla a SnapTrade-ből"
+        other: "%{count} számla a SnapTrade-ből"
+      needs_setup:
+        one: "%{count} beállítást igényel"
+        other: "%{count} beállítást igényel"
+      status_needs_registration: "Hitelesítő adatok elmentve. Fejezd be a beállítást egy brókercég csatlakoztatásához."
+      status_ready: "Készen áll brókercégek csatlakoztatásához"
+      setup_accounts_button: "Számlák beállítása"
+      connect_button: "Brókercég csatlakoztatása"
+      connected_brokerages: "Csatlakoztatva:"
+      manage_connections: "Kapcsolatok kezelése"
+      connection_limit_info: "A SnapTrade ingyenes szintje 5 bróker kapcsolatot tesz lehetővé. Töröl nem használt kapcsolatokat a helyek felszabadításához."
+      loading_connections: "Kapcsolatok betöltése..."
+      connections_error: "Nem sikerült betölteni a kapcsolatokat: %{message}"
+      accounts_count:
+        one: "%{count} számla"
+        other: "%{count} számla"
+      orphaned_connection: "Árva kapcsolat (nincs helyi szinkronizálás)"
+      needs_linking: "összekapcsolásra vár"
+      no_connections: "Nem találhatók brókeri kapcsolatok."
+      delete_connection: "Törlés"
+      delete_connection_title: "Brókeri kapcsolat törlése?"
+      delete_connection_body: "Ez véglegesen eltávolítja a(z) %{brokerage} kapcsolatot a SnapTrade-ből. Az ehhez a brókercéghez tartozó összes számla szétkapcsolásra kerül. A számlák újbóli szinkronizálásához újra kell csatlakoznod."
+      delete_connection_confirm: "Kapcsolat törlése"
+      orphaned_users_title:
+        one: "%{count} árva regisztráció"
+        other: "%{count} árva regisztráció"
+      orphaned_users_description: "Ezek korábbi SnapTrade felhasználói regisztrációk, amelyek a kapcsolati helyeidet foglalják. Töröl őket a helyek felszabadításához."
+      orphaned_user: "Árva regisztráció"
+      delete_orphaned_user: "Törlés"
+      delete_orphaned_user_title: "Árva regisztráció törlése?"
+      delete_orphaned_user_body: "Ez véglegesen törli ezt az árva SnapTrade felhasználót és az összes brókeri kapcsolatát, felszabadítva a kapcsolati helyeket."
+      delete_orphaned_user_confirm: "Regisztráció törlése"
+
+  snaptrade_item:
+    sync_status:
+      no_accounts: "Nem találhatók számlák"
+      synced:
+        one: "%{count} számla szinkronizálva"
+        other: "%{count} számla szinkronizálva"
+      synced_with_setup: "%{linked} szinkronizálva, %{unlinked} beállítást igényel"
+    institution_summary:
+      none: "Nincs csatlakoztatott intézmény"
+      count:
+        one: "%{count} intézmény"
+        other: "%{count} intézmény"
+    brokerage_summary:
+      none: "Nincs csatlakoztatott brókercég"
+      count:
+        one: "%{count} brókercég"
+        other: "%{count} brókercég"
+    syncer:
+      discovering: "Számlák felderítése..."
+      importing: "Számlák importálása a SnapTrade-ből..."
+      processing: "Portfólió és tevékenységek feldolgozása..."
+      calculating: "Egyenlegek kiszámítása..."
+      checking_config: "Számlakonfiguráció ellenőrzése..."
+      needs_setup: "%{count} számla beállítást igényel..."
+      activities_fetching_async: "A tevékenységek a háttérben kerülnek lekérésre. Ez friss brókerkapcsolatoknál akár egy percig is tarthat."
diff --git a/config/locales/views/snaptrade_items/pl.yml b/config/locales/views/snaptrade_items/pl.yml
index ba3eb7058..1f45a3aa1 100644
--- a/config/locales/views/snaptrade_items/pl.yml
+++ b/config/locales/views/snaptrade_items/pl.yml
@@ -145,8 +145,6 @@ pl:
         many: "%{count} wymaga konfiguracji"
         other: "%{count} wymaga konfiguracji"
       status_ready: Gotowe do połączenia z biurami maklerskimi
-      status_needs_registration: Dane uwierzytelniające zapisane. Przejdź do strony Konta, aby połączyć biura maklerskie.
-      status_not_configured: Nieskonfigurowane
       setup_accounts_button: Konfiguruj konta
       connect_button: Połącz biuro maklerskie
       connected_brokerages: 'Połączone:'
diff --git a/config/locales/views/sophtron_items/ca.yml b/config/locales/views/sophtron_items/ca.yml
new file mode 100644
index 000000000..3b5321b74
--- /dev/null
+++ b/config/locales/views/sophtron_items/ca.yml
@@ -0,0 +1,365 @@
+---
+ca:
+  sophtron_items:
+    api_error:
+      bad_credentials: 'Credencials bancàries: comprova que el nom d''usuari i la
+        contrasenya són correctes'
+      check_provider_settings: Revisa la configuració del proveïdor
+      common_issues_title: 'Problemes habituals:'
+      expired_credentials: 'Credencials caducades: genera un nou ID d''usuari i clau
+        d''accés des de Sophtron'
+      incorrect_user_id: 'ID d''usuari incorrecte: verifica el teu ID d''usuari a
+        la configuració del proveïdor'
+      institution_timeout: 'Temps esgotat de l''entitat: la pàgina d''inici de sessió
+        del banc no ha acabat a temps'
+      institution_unable_to_connect: No s'ha pogut connectar amb l'entitat
+      invalid_access_key: 'Clau d''accés no vàlida: revisa la teva clau d''accés a
+        la configuració del proveïdor'
+      network_issue: 'Problema de xarxa: comprova la teva connexió a internet'
+      service_down: 'Servei caigut: l''API de Sophtron pot estar temporalment no disponible'
+      title: Error de connexió amb Sophtron
+      try_again: Torna a intentar la connexió
+      unable_to_connect: No s'ha pogut connectar a Sophtron
+      unsupported_mfa: 'Compatibilitat MFA: Sophtron pot no donar suport al flux de
+        verificació actual d''aquesta entitat'
+      verification_code: 'Codi de verificació: assegura''t que has introduït l''últim
+        codi abans que caduqui'
+    complete_account_setup:
+      all_skipped: S'han omès tots els comptes. No s'ha creat cap compte.
+      api_error: Error de connexió amb l'API
+      creation_failed: No s'han pogut crear els comptes
+      no_accounts: No hi ha comptes per configurar.
+      success: S'han creat correctament %{count} compte(s).
+      unexpected_error: S'ha produït un error inesperat
+    connect:
+      cancel: Cancel·la
+      captcha: Captcha
+      connect: Connecta
+      institution_search_label: Entitat
+      institution_search_placeholder: Cerca pel nom del banc
+      no_institutions: No s'han trobat entitats coincidents.
+      password: Contrasenya
+      search: Cerca
+      search_too_short: Introdueix almenys dos caràcters per cercar.
+      title: Connecta una entitat Sophtron
+      username: Nom d'usuari
+    connect_institution:
+      api_error: 'La connexió Sophtron ha fallat: %{message}'
+      missing_parameters: Selecciona una entitat i introdueix les teves credencials
+        d'inici de sessió bancari.
+    connection_status:
+      api_error: 'Error de connexió amb l''API: %{message}'
+      attempt: Intent %{attempt} de %{max}
+      check_again: Torna a comprovar
+      failed: Sophtron no ha pogut completar la connexió amb aquesta entitat.
+      failed_timeout: Sophtron ha esgotat el temps mentre l'entitat completava l'inici
+        de sessió.
+      timeout: Sophtron no ha completat la connexió dins del temps previst. Pots tornar
+        a comprovar-ho o intentar reconnectar més tard.
+      title: Connectant Sophtron
+      waiting: Sophtron encara s'està connectant a la teva entitat.
+    create:
+      success: La connexió Sophtron s'ha creat correctament
+    defaults:
+      name: Connexió Sophtron
+    destroy:
+      success: La connexió Sophtron s'ha eliminat
+    edit:
+      access_key:
+        help_text: La clau d'accés ha de ser una cadena llarga que comenci amb lletres
+          i números
+        label: 'Clau d''accés de Sophtron:'
+        placeholder: Enganxa aquí la teva clau d'accés de Sophtron...
+      user_id:
+        help_text: L'ID d'usuari ha de ser una cadena llarga que comenci amb lletres
+          i números
+        label: 'ID d''usuari de Sophtron:'
+        placeholder: Enganxa aquí el teu ID d'usuari de Sophtron...
+    index:
+      title: Connexions Sophtron
+    link_accounts:
+      all_already_linked:
+        one: El compte seleccionat (%{names}) ja està enllaçat
+        other: 'Tots els %{count} comptes seleccionats ja estan enllaçats: %{names}'
+      api_error: Error de connexió amb l'API
+      invalid_account_names:
+        one: No es pot enllaçar un compte sense nom
+        other: No es poden enllaçar %{count} comptes sense nom
+      link_failed: No s'han pogut enllaçar els comptes
+      no_access_key: La clau d'accés de Sophtron no està configurada. Configura-la
+        a la configuració.
+      no_accounts_found: No s'han trobat comptes. Comprova la configuració de la teva
+        clau API.
+      no_accounts_selected: Selecciona almenys un compte
+      no_credentials_configured: Primer, configura el teu ID d'usuari i clau d'accés
+        de Sophtron a la configuració del proveïdor.
+      no_institution_connected: Primer connecta una entitat bancària amb Sophtron.
+      no_user_id: L'ID d'usuari de Sophtron no està configurat. Configura'l a la configuració.
+      partial_invalid: S'han enllaçat correctament %{created_count} compte(s), %{already_linked_count}
+        ja estaven enllaçats, %{invalid_count} compte(s) tenien noms no vàlids
+      partial_success: 'S''han enllaçat correctament %{created_count} compte(s). %{already_linked_count}
+        compte(s) ja estaven enllaçats: %{already_linked_names}'
+      success:
+        one: S'ha enllaçat correctament %{count} compte
+        other: S'han enllaçat correctament %{count} comptes
+    link_existing_account:
+      account_already_linked: Aquest compte ja està enllaçat a un proveïdor
+      api_error: Error de connexió amb l'API
+      invalid_account_name: No es pot enllaçar un compte sense nom
+      missing_parameters: Falten paràmetres obligatoris
+      no_institution_connected: Primer connecta una entitat bancària amb Sophtron.
+      sophtron_account_already_linked: Aquest compte Sophtron ja està enllaçat a un
+        altre compte
+      sophtron_account_not_found: No s'ha trobat el compte Sophtron
+      success: S'ha enllaçat correctament %{account_name} amb Sophtron
+      unexpected_error: S'ha produït un error inesperat
+    loading:
+      loading_message: Carregant comptes de Sophtron...
+      loading_title: Carregant
+    manual_sync_complete:
+      close: Tanca
+      description: Els saldos dels comptes acabaran d'actualitzar-se en segon pla.
+      message: S'han descarregat les transaccions després de la verificació de Sophtron.
+      title: Sincronització Sophtron iniciada
+    mfa:
+      captcha: Text del captcha
+      captcha_alt: Captcha de Sophtron
+      phone_confirmed: He confirmat per telèfon
+      submit: Envia
+      title: Verificació Sophtron
+      token: Codi de verificació
+    new:
+      access_key: Clau d'accés
+      access_key_placeholder: enganxa la teva clau d'accés de Sophtron
+      cancel: Cancel·la
+      connect: Connecta
+      title: Connecta Sophtron
+      user_id: ID d'usuari
+      user_id_placeholder: enganxa el teu ID d'usuari de Sophtron
+    preload_accounts:
+      api_error: Error de connexió amb l'API
+      no_access_key: La clau d'accés de Sophtron no està configurada. Configura-la
+        a la configuració.
+      no_accounts_found: No s'han trobat comptes. Comprova la configuració de la teva
+        clau API.
+      no_credentials_configured: Primer, configura el teu ID d'usuari i clau d'accés
+        de Sophtron a la configuració del proveïdor.
+      no_user_id: L'ID d'usuari de Sophtron no està configurat. Configura'l a la configuració.
+      preload_accounts: precarrega els comptes
+      unexpected_error: S'ha produït un error inesperat
+    redirect_after_account_link:
+      all_already_linked:
+        one: El compte seleccionat ja està enllaçat
+        other: Tots els %{count} comptes seleccionats ja estan enllaçats
+      invalid_account_names:
+        one: No es pot enllaçar %{count} compte sense nom
+        other: No es poden enllaçar %{count} comptes sense nom
+      link_failed: No s'han pogut enllaçar els comptes
+      partial_invalid: S'han enllaçat %{created_count} compte(s). %{already_linked_count}
+        ja estaven enllaçats, %{invalid_count} tenien noms no vàlids.
+      partial_success: S'han enllaçat %{created_count} compte(s). %{already_linked_count}
+        compte(s) ja estaven enllaçats.
+      success:
+        one: S'ha enllaçat correctament %{count} compte.
+        other: S'han enllaçat correctament %{count} comptes.
+    render_connection_timeout:
+      timeout: S'ha esgotat el temps de connexió. Torna-ho a provar.
+    select_accounts:
+      accounts_selected: comptes seleccionats
+      api_error: Error de connexió amb l'API
+      cancel: Cancel·la
+      configure_name_in_sophtron: No es pot importar — configura el nom del compte
+        a Sophtron
+      description: Selecciona els comptes que vols enllaçar al teu compte de %{product_name}.
+      link_accounts: Enllaça els comptes seleccionats
+      no_access_key: La clau d'accés de Sophtron no està configurada. Configura-la
+        a la configuració.
+      no_accounts_found: No s'han trobat comptes. Comprova la configuració de la teva
+        clau API.
+      no_credentials_configured: Primer, configura el teu ID d'usuari i clau d'accés
+        de Sophtron a la configuració del proveïdor.
+      no_institution_connected: Primer connecta una entitat bancària amb Sophtron.
+      no_name_placeholder: "(Sense nom)"
+      no_user_id: L'ID d'usuari de Sophtron no està configurat. Configura'l a la configuració.
+      title: Selecciona comptes Sophtron
+      unexpected_error: S'ha produït un error inesperat
+    select_existing_account:
+      account_already_linked: Aquest compte ja està enllaçat a un proveïdor
+      all_accounts_already_linked: Tots els comptes Sophtron ja estan enllaçats
+      api_error: Error de connexió amb l'API
+      cancel: Cancel·la
+      configure_name_in_sophtron: No es pot importar — configura el nom del compte
+        a Sophtron
+      description: Selecciona un compte Sophtron per enllaçar-lo amb aquest compte.
+        Les transaccions es sincronitzaran i deduplicaran automàticament.
+      link_account: Enllaça compte
+      no_access_key: La clau d'accés de Sophtron no està configurada. Configura-la
+        a la configuració.
+      no_account_specified: No s'ha especificat cap compte
+      no_accounts_found: No s'han trobat comptes Sophtron. Comprova la configuració
+        de la teva clau API.
+      no_institution_connected: Primer connecta una entitat bancària amb Sophtron.
+      no_name_placeholder: "(Sense nom)"
+      no_user_id: L'ID d'usuari de Sophtron no està configurat. Configura'l a la configuració.
+      title: Enllaça %{account_name} amb Sophtron
+      unexpected_error: S'ha produït un error inesperat
+    select_option: Selecciona %{type}
+    setup_accounts:
+      account_type_label: 'Tipus de compte:'
+      account_types:
+        credit_card: Targeta de crèdit
+        depository: Compte corrent o d'estalvis
+        investment: Compte d'inversió
+        loan: Préstec o hipoteca
+        other_asset: Altre actiu
+        skip: Omet aquest compte
+      all_accounts_linked: Tots els teus comptes Sophtron ja s'han configurat.
+      api_error: Error de connexió amb l'API
+      balance: Saldo
+      cancel: Cancel·la
+      choose_account_type: 'Tria el tipus de compte correcte per a cada compte Sophtron:'
+      create_accounts: Crea comptes
+      creating_accounts: Creant comptes...
+      fetch_failed: No s'han pogut obtenir els comptes
+      historical_data_range: 'Rang de dades històriques:'
+      no_access_key: La clau d'accés de Sophtron no està configurada. Revisa la configuració
+        de la connexió.
+      no_accounts_to_setup: No hi ha comptes per configurar
+      no_institution_connected: L'entitat Sophtron encara no està connectada.
+      no_user_id: L'ID d'usuari de Sophtron no està configurat. Revisa la configuració
+        de la connexió.
+      subtitle: Tria els tipus de compte correctes per als teus comptes importats
+      subtype_labels:
+        credit_card: ''
+        depository: 'Subtipus de compte:'
+        investment: 'Tipus d''inversió:'
+        loan: 'Tipus de préstec:'
+        other_asset: ''
+      subtype_messages:
+        credit_card: Les targetes de crèdit es configuraran automàticament com a comptes
+          de targeta de crèdit.
+        other_asset: No calen opcions addicionals per a altres actius.
+      sync_start_date_help: Selecciona fins on vols sincronitzar l'historial de transaccions.
+        Hi ha un màxim de 3 anys d'historial disponible.
+      sync_start_date_label: 'Comença a sincronitzar transaccions des de:'
+      title: Configura els teus comptes Sophtron
+      unexpected_error: S'ha produït un error inesperat
+    sophtron_entry:
+      processor:
+        unknown_transaction: Transacció desconeguda
+    sophtron_item:
+      accounts_need_setup: Els comptes necessiten configuració
+      automatic_sync: Utilitza la sincronització automàtica
+      automatic_sync_for: Utilitza la sincronització automàtica per a %{institution}
+      delete: Elimina la connexió
+      deletion_in_progress: eliminació en curs...
+      error: Error
+      manual_sync: Sincronització manual
+      manual_sync_action: Requereix sincronització manual
+      manual_sync_action_for: Requereix sincronització manual per a %{institution}
+      no_accounts_description: Aquesta connexió encara no té comptes enllaçats.
+      no_accounts_title: No hi ha comptes
+      setup_action: Configura els nous comptes
+      setup_description: "%{linked} de %{total} comptes enllaçats. Tria els tipus
+        de compte per als teus nous comptes Sophtron importats."
+      setup_needed: Nous comptes a punt per configurar
+      status: Sincronitzat fa %{timestamp}
+      status_never: Mai sincronitzat
+      status_with_summary: Darrera sincronització fa %{timestamp} • %{summary}
+      sync_now: Sincronitza ara
+      syncing: Sincronitzant...
+      total: Total
+      unlinked: Sense enllaç
+    sophtron_panel:
+      field_descriptions:
+        access_key_html: "<strong>Clau d'accés:</strong> la teva credencial de clau
+          d'accés de Sophtron"
+        base_url_html: "<strong>URL base:</strong> l'URL de l'endpoint de l'API de
+          Sophtron, normalment https://api.sophtron.com/api"
+        user_id_html: "<strong>ID d'usuari:</strong> la teva credencial d'ID d'usuari
+          de Sophtron"
+      field_descriptions_title: 'Descripció dels camps:'
+      fields:
+        access_key:
+          label: Clau d'accés
+          placeholder_edit: "••••••••"
+          placeholder_new: Enganxa la teva clau d'accés de Sophtron
+        base_url:
+          label: URL base
+          placeholder: https://api.sophtron.com/api
+        user_id:
+          label: ID d'usuari
+          placeholder_edit: "••••••••"
+          placeholder_new: Enganxa el teu ID d'usuari de Sophtron
+      save: Desa la configuració
+      setup_instructions:
+        step_1_html: Visita <a href="%{url}" target="_blank" rel="noopener noreferrer"
+          class="link">Sophtron</a> per obtenir les teves credencials API
+        step_2: Copia el teu ID d'usuari i clau d'accés des de la configuració del
+          teu compte Sophtron
+        step_3: Enganxa les credencials a continuació i fes clic a Desa; Sure crearà
+          o reutilitzarà el teu ID de client de Sophtron automàticament
+      setup_instructions_title: 'Instruccions de configuració:'
+      update: Actualitza la configuració
+    sophtron_setup_required:
+      description: Abans d'enllaçar comptes Sophtron, has de configurar el teu ID
+        d'usuari i clau d'accés de Sophtron.
+      go_to_provider_settings: Ves a la configuració del proveïdor
+      heading: ID d'usuari i clau d'accés sense configurar
+      message: Per completar la configuració de la teva connexió Sophtron, ves a la
+        pàgina de configuració del proveïdor i segueix les instruccions per autoritzar
+        i configurar la teva connexió Sophtron.
+      setup_steps_title: 'Passos de configuració:'
+      step_1_html: Ves a <strong>Configuració → Proveïdors de sincronització bancària</strong>
+      step_2_html: Localitza la secció <strong>Sophtron</strong>
+      step_3_html: Introdueix el teu ID d'usuari i clau d'accés de Sophtron
+      step_4: Torna aquí per enllaçar els teus comptes
+      title: Cal configurar Sophtron
+    start_manual_sync:
+      already_running: Ja s'està executant una sincronització.
+      api_error: 'Error de l''API: %{message}'
+      no_linked_accounts: No hi ha comptes enllaçats disponibles per sincronitzar.
+    start_manual_sync_for_account:
+      failed: No s'ha pogut sincronitzar el compte
+    submit_mfa:
+      api_error: 'La verificació ha fallat: %{message}'
+      invalid_security_answers: Les respostes de seguretat falten o són massa llargues.
+      unknown_challenge: Pas de verificació Sophtron desconegut.
+    subtype: subtipus
+    sync:
+      already_running: La sincronització manual de Sophtron ja s'està executant.
+      api_error: 'La sincronització manual de Sophtron ha fallat: %{message}'
+      failed: La sincronització manual de Sophtron ha fallat
+      no_linked_accounts: Aquesta entitat Sophtron no té cap compte enllaçat per sincronitzar.
+      processing_failed: La sincronització manual de Sophtron no ha pogut processar
+        les transaccions actualitzades.
+      success: Sincronització iniciada
+    syncer:
+      accounts_need_setup: "%{count} compte(s) necessiten configuració"
+      calculating_balances: Calculant saldos per als comptes enllaçats...
+      checking_account_configuration: Comprovant la configuració dels comptes...
+      importing_accounts: Important comptes des de Sophtron...
+      manual_sync_required: Cal sincronització manual de Sophtron per a aquesta entitat;
+        els seus comptes s'ometen durant la sincronització automàtica.
+      processing_transactions: Processant transaccions per als comptes enllaçats...
+    toggle_manual_sync:
+      success_disabled: L'entitat Sophtron se sincronitzarà automàticament.
+      success_enabled: L'entitat Sophtron ara requereix sincronització manual.
+    type: tipus
+    update:
+      errors:
+        access_key_compromised: La clau d'accés pot estar compromesa, caducada o ja
+          utilitzada. Crea'n una de nova.
+        blank_access_key: Introdueix una clau d'accés de Sophtron.
+        blank_user_id: Introdueix un ID d'usuari de Sophtron.
+        invalid_access_key: Clau d'accés no vàlida. Comprova que has copiat la clau
+          d'accés completa des de Sophtron.
+        invalid_user_id: ID d'usuari no vàlid. Comprova que has copiat l'ID d'usuari
+          complet des de Sophtron.
+        unexpected: S'ha produït un error inesperat. Torna-ho a provar o contacta
+          amb el suport.
+        update_failed: 'No s''ha pogut actualitzar la connexió: %{message}'
+        user_id_compromised: L'ID d'usuari pot estar compromès, caducat o ja utilitzat.
+          Crea'n un de nou.
+      success: La connexió Sophtron s'ha actualitzat correctament! Els teus comptes
+        s'estan tornant a connectar.
diff --git a/config/locales/views/sophtron_items/en.yml b/config/locales/views/sophtron_items/en.yml
new file mode 100644
index 000000000..ab66fa0a7
--- /dev/null
+++ b/config/locales/views/sophtron_items/en.yml
@@ -0,0 +1,313 @@
+---
+en:
+  sophtron_items:
+    defaults:
+      name: Sophtron Connection
+    new:
+      title: Connect Sophtron
+      user_id: User ID
+      user_id_placeholder: paste your Sophtron User ID
+      access_key: Access Key
+      access_key_placeholder: paste your Sophtron Access Key
+      connect: Connect
+      cancel: Cancel
+    create:
+      success: Sophtron connection created successfully
+    destroy:
+      success: Sophtron connection removed
+    update:
+      success: Sophtron connection updated successfully! Your accounts are being reconnected.
+      errors:
+        blank_user_id: Please enter a Sophtron User ID.
+        invalid_user_id: Invalid User ID. Please check that you copied the complete User ID from Sophtron.
+        user_id_compromised: The User ID may be compromised, expired, or already used. Please create a new one.
+        blank_access_key: Please enter a Sophtron Access Key.
+        invalid_access_key: Invalid Access Key. Please check that you copied the complete Access Key from Sophtron.
+        access_key_compromised: The Access Key may be compromised, expired, or already used. Please create a new one.
+        update_failed: "Failed to update connection: %{message}"
+        unexpected: An unexpected error occurred. Please try again or contact support.
+    edit:
+      user_id:
+        label: "Sophtron User ID:"
+        placeholder: "Paste your Sophtron User ID here..."
+        help_text: "The User ID should be a long string starting with letters and numbers"
+      access_key:
+        label: "Sophtron Access Key:"
+        placeholder: "Paste your Sophtron Access Key here..."
+        help_text: "The Access Key should be a long string starting with letters and numbers"
+    index:
+      title: Sophtron Connections
+    loading:
+      loading_message: Loading Sophtron accounts...
+      loading_title: Loading
+    link_accounts:
+      all_already_linked:
+        one: "The selected account (%{names}) is already linked"
+        other: "All %{count} selected accounts are already linked: %{names}"
+      api_error: "API connection error"
+      invalid_account_names:
+        one: "Cannot link account with blank name"
+        other: "Cannot link %{count} accounts with blank names"
+      link_failed: Failed to link accounts
+      no_accounts_selected: Please select at least one account
+      partial_invalid: "Successfully linked %{created_count} account(s), %{already_linked_count} were already linked, %{invalid_count} account(s) had invalid names"
+      partial_success: "Successfully linked %{created_count} account(s). %{already_linked_count} account(s) were already linked: %{already_linked_names}"
+      success:
+        one: "Successfully linked %{count} account"
+        other: "Successfully linked %{count} accounts"
+      no_credentials_configured: "Please configure your Sophtron API User ID and Access Key first in Provider Settings."
+      no_accounts_found: No accounts found. Please check your API key configuration.
+      no_access_key: Sophtron Access key is not configured. Please configure it in Settings.
+      no_user_id: Sophtron User ID is not configured. Please configure it in Settings.
+      no_institution_connected: Please connect a bank institution with Sophtron first.
+    connect:
+      cancel: Cancel
+      captcha: Captcha
+      connect: Connect
+      institution_search_label: Institution
+      institution_search_placeholder: Search by bank name
+      no_institutions: No matching institutions found.
+      password: Password
+      search: Search
+      search_too_short: Enter at least two characters to search.
+      title: Connect Sophtron Institution
+      username: Username
+    connect_institution:
+      api_error: "Sophtron connection failed: %{message}"
+      missing_parameters: Select an institution and enter your bank login credentials.
+    connection_status:
+      api_error: "API connection error: %{message}"
+      attempt: "Attempt %{attempt} of %{max}"
+      check_again: Check again
+      failed: Sophtron could not complete this institution connection.
+      failed_timeout: Sophtron timed out while the institution was completing login.
+      timeout: Sophtron did not finish connecting within the expected time. You can check again, or try reconnecting later.
+      title: Connecting Sophtron
+      waiting: Sophtron is still connecting to your institution.
+    mfa:
+      captcha: Captcha text
+      captcha_alt: Sophtron captcha
+      phone_confirmed: I confirmed by phone
+      submit: Submit
+      title: Sophtron Verification
+      token: Verification code
+    submit_mfa:
+      api_error: "Verification failed: %{message}"
+      invalid_security_answers: Security answers are missing or too long.
+      unknown_challenge: Unknown Sophtron verification step.
+    sophtron_item:
+      accounts_need_setup: Accounts need setup
+      automatic_sync: Use automatic sync
+      delete: Delete connection
+      deletion_in_progress: deletion in progress...
+      error: Error
+      no_accounts_description: This connection has no linked accounts yet.
+      no_accounts_title: No accounts
+      manual_sync: Manual sync
+      manual_sync_action: Require manual sync
+      manual_sync_action_for: "Require manual sync for %{institution}"
+      automatic_sync_for: "Use automatic sync for %{institution}"
+      setup_action: Set Up New Accounts
+      setup_description: "%{linked} of %{total} accounts linked. Choose account types for your newly imported Sophtron accounts."
+      setup_needed: New accounts ready to set up
+      status: "Synced %{timestamp} ago"
+      status_never: Never synced
+      status_with_summary: "Last synced %{timestamp} ago • %{summary}"
+      sync_now: Sync now
+      syncing: Syncing...
+      total: Total
+      unlinked: Unlinked
+    preload_accounts:
+      preload_accounts: preload accounts
+      api_error: "API connection error"
+      unexpected_error: "An unexpected error occurred"
+      no_credentials_configured: "Please configure your Sophtron API User ID and Access Key first in Provider Settings."
+      no_accounts_found: No accounts found. Please check your API key configuration.
+      no_access_key: Sophtron Access key is not configured. Please configure it in Settings.
+      no_user_id: Sophtron User ID is not configured. Please configure it in Settings.
+    select_accounts:
+      accounts_selected: accounts selected
+      api_error: "API connection error"
+      unexpected_error: "An unexpected error occurred"
+      cancel: Cancel
+      configure_name_in_sophtron: Cannot import - please configure account name in Sophtron
+      description: Select the accounts you want to link to your %{product_name} account.
+      link_accounts: Link selected accounts
+      no_accounts_found: No accounts found. Please check your API key configuration.
+      no_access_key: Sophtron Access key is not configured. Please configure it in Settings.
+      no_user_id: Sophtron User ID is not configured. Please configure it in Settings.
+      no_credentials_configured: "Please configure your Sophtron API User ID and Access Key first in Provider Settings."
+      no_institution_connected: Please connect a bank institution with Sophtron first.
+      no_name_placeholder: "(No name)"
+      title: Select Sophtron Accounts
+    select_existing_account:
+      account_already_linked: This account is already linked to a provider
+      all_accounts_already_linked: All Sophtron accounts are already linked
+      api_error: "API connection error"
+      cancel: Cancel
+      configure_name_in_sophtron: Cannot import - please configure account name in Sophtron
+      description: Select a Sophtron account to link with this account. Transactions will be synced and deduplicated automatically.
+      link_account: Link account
+      no_account_specified: No account specified
+      no_accounts_found: No Sophtron accounts found. Please check your API key configuration.
+      no_access_key: Sophtron Access key is not configured. Please configure it in Settings.
+      no_user_id: Sophtron User ID is not configured. Please configure it in Settings.
+      no_institution_connected: Please connect a bank institution with Sophtron first.
+      no_name_placeholder: "(No name)"
+      title: "Link %{account_name} with Sophtron"
+      unexpected_error: "An unexpected error occurred"
+    link_existing_account:
+      account_already_linked: This account is already linked to a provider
+      api_error: "API connection error"
+      unexpected_error: "An unexpected error occurred"
+      invalid_account_name: Cannot link account with blank name
+      sophtron_account_already_linked: This Sophtron account is already linked to another account
+      sophtron_account_not_found: Sophtron account not found
+      missing_parameters: Missing required parameters
+      no_institution_connected: Please connect a bank institution with Sophtron first.
+      success: "Successfully linked %{account_name} with Sophtron"
+    setup_accounts:
+      account_type_label: "Account Type:"
+      all_accounts_linked: "All your Sophtron accounts have already been set up."
+      api_error: "API connection error"
+      unexpected_error: "An unexpected error occurred"
+      fetch_failed: "Failed to Fetch Accounts"
+      no_accounts_to_setup: "No Accounts to Set Up"
+      no_access_key: "Sophtron Access key is not configured. Please check your connection settings."
+      no_user_id: "Sophtron User ID is not configured. Please check your connection settings."
+      no_institution_connected: "Sophtron institution is not connected yet."
+      account_types:
+        skip: Skip this account
+        depository: Checking or Savings Account
+        credit_card: Credit Card
+        investment: Investment Account
+        loan: Loan or Mortgage
+        other_asset: Other Asset
+      subtype_labels:
+        depository: "Account Subtype:"
+        credit_card: ""
+        investment: "Investment Type:"
+        loan: "Loan Type:"
+        other_asset: ""
+      subtype_messages:
+        credit_card: "Credit cards will be automatically set up as credit card accounts."
+        other_asset: "No additional options needed for Other Assets."
+      balance: Balance
+      cancel: Cancel
+      choose_account_type: "Choose the correct account type for each Sophtron account:"
+      create_accounts: Create Accounts
+      creating_accounts: Creating Accounts...
+      historical_data_range: "Historical Data Range:"
+      subtitle: Choose the correct account types for your imported accounts
+      sync_start_date_help: Select how far back you want to sync transaction history. Maximum 3 years of history available.
+      sync_start_date_label: "Start syncing transactions from:"
+      title: Set Up Your Sophtron Accounts
+    complete_account_setup:
+      all_skipped: "All accounts were skipped. No accounts were created."
+      creation_failed: "Failed to create accounts"
+      api_error: "API connection error"
+      unexpected_error: "An unexpected error occurred"
+      no_accounts: "No accounts to set up."
+      success: "Successfully created %{count} account(s)."
+    sync:
+      already_running: Sophtron manual sync is already in progress.
+      api_error: "Sophtron manual sync failed: %{message}"
+      failed: Sophtron manual sync failed
+      no_linked_accounts: This Sophtron institution does not have any linked accounts to sync.
+      processing_failed: Sophtron manual sync could not process the refreshed transactions.
+      success: Sync started
+    toggle_manual_sync:
+      success_disabled: Sophtron institution will sync automatically.
+      success_enabled: Sophtron institution now requires manual sync.
+    manual_sync_complete:
+      close: Close
+      description: Account balances will finish updating in the background.
+      message: Transactions were downloaded after Sophtron verification.
+      title: Sophtron Sync Started
+    sophtron_setup_required:
+      title: Sophtron Setup Required
+      message: >
+        To complete the setup of your Sophtron connection, please go to the Provider Settings page and follow the instructions to authorize and configure your Sophtron connection.
+      go_to_provider_settings: Go to Provider Settings
+      heading: "User ID and Access Key Not Configured"  
+      description: "Before you can link Sophtron accounts, you need to configure your Sophtron User ID and Access key."  
+      setup_steps_title: "Setup Steps:"  
+      step_1_html: "Go to <strong>Settings → Bank Sync Providers</strong>"  
+      step_2_html: "Find the <strong>Sophtron</strong> section"  
+      step_3_html: "Enter your Sophtron User ID and Access key"  
+      step_4: "Return here to link your accounts"  
+    api_error:  
+      title: "Sophtron Connection Error"  
+      unable_to_connect: "Unable to connect to Sophtron"  
+      institution_unable_to_connect: "Unable to connect to the institution"
+      common_issues_title: "Common Issues:"  
+      incorrect_user_id: "Incorrect User ID: Verify your User ID in Provider Settings"  
+      invalid_access_key: "Invalid Access Key: Check your Access Key in Provider Settings"  
+      expired_credentials: "Expired Credentials: Generate a new User ID and Access Key from Sophtron"  
+      network_issue: "Network Issue: Check your internet connection"  
+      service_down: "Service Down: Sophtron API may be temporarily unavailable"  
+      bad_credentials: "Bank credentials: Check the username and password are correct"
+      verification_code: "Verification code: Make sure the latest code was entered before it expired"
+      institution_timeout: "Institution timeout: The bank login page did not finish in time"
+      unsupported_mfa: "MFA support: Sophtron may not support this institution's current verification flow"
+      check_provider_settings: "Check Provider Settings"  
+      try_again: "Try connecting again"
+    select_option: "Select %{type}"  
+    subtype: "subtype"  
+    type: "type"
+    sophtron_panel:
+      setup_instructions_title: "Setup instructions:"
+      setup_instructions:
+        step_1_html: 'Visit <a href="%{url}" target="_blank" rel="noopener noreferrer" class="link">Sophtron</a> to obtain your API credentials'
+        step_2: "Copy your User ID and Access Key from your Sophtron account settings"
+        step_3: "Paste the credentials below and click Save; Sure will create or reuse your Sophtron Customer ID automatically"
+      field_descriptions_title: "Field descriptions:"
+      field_descriptions:
+        user_id_html: "<strong>User ID:</strong> Your Sophtron User ID credential"
+        access_key_html: "<strong>Access Key:</strong> Your Sophtron Access Key credential"
+        base_url_html: "<strong>Base URL:</strong> The Sophtron API endpoint URL, usually https://api.sophtron.com/api"
+      fields:
+        user_id:
+          label: "User ID"
+          placeholder_new: "Paste your Sophtron User ID"
+          placeholder_edit: "••••••••"
+        access_key:
+          label: "Access Key"
+          placeholder_new: "Paste your Sophtron Access Key"
+          placeholder_edit: "••••••••"
+        base_url:
+          label: "Base URL"
+          placeholder: "https://api.sophtron.com/api"
+      save: "Save Configuration"
+      update: "Update Configuration"
+    syncer:
+      manual_sync_required: "Manual Sophtron sync is required for this institution; skipping those accounts during automated sync."
+      importing_accounts: "Importing accounts from Sophtron..."
+      checking_account_configuration: "Checking account configuration..."
+      accounts_need_setup: "%{count} account(s) need setup"
+      processing_transactions: "Processing transactions for linked accounts..."
+      calculating_balances: "Calculating balances for linked accounts..."
+    sophtron_entry:
+      processor:
+        unknown_transaction: "Unknown transaction"
+    render_connection_timeout:
+      timeout: "Connection timed out. Please try again."
+    redirect_after_account_link:
+      invalid_account_names:
+        one: "Cannot link %{count} account with blank name"
+        other: "Cannot link %{count} accounts with blank names"
+      partial_invalid: "Linked %{created_count} account(s). %{already_linked_count} already linked, %{invalid_count} had invalid names."
+      partial_success: "Linked %{created_count} account(s). %{already_linked_count} account(s) were already linked."
+      success:
+        one: "Successfully linked %{count} account."
+        other: "Successfully linked %{count} accounts."
+      all_already_linked:
+        one: "The selected account is already linked"
+        other: "All %{count} selected accounts are already linked"
+      link_failed: "Failed to link accounts"
+    start_manual_sync:
+      already_running: "A sync is already in progress."
+      no_linked_accounts: "No linked accounts available to sync."
+      api_error: "API error: %{message}"
+    start_manual_sync_for_account:
+      failed: "Failed to sync account"
diff --git a/config/locales/views/sophtron_items/hu.yml b/config/locales/views/sophtron_items/hu.yml
new file mode 100644
index 000000000..c64f06715
--- /dev/null
+++ b/config/locales/views/sophtron_items/hu.yml
@@ -0,0 +1,313 @@
+---
+hu:
+  sophtron_items:
+    defaults:
+      name: Sophtron kapcsolat
+    new:
+      title: Sophtron csatlakoztatása
+      user_id: Felhasználói azonosító
+      user_id_placeholder: illeszd be a Sophtron felhasználói azonosítódat
+      access_key: Hozzáférési kulcs
+      access_key_placeholder: illeszd be a Sophtron hozzáférési kulcsodat
+      connect: Csatlakozás
+      cancel: Mégse
+    create:
+      success: Sophtron kapcsolat sikeresen létrehozva
+    destroy:
+      success: Sophtron kapcsolat eltávolítva
+    update:
+      success: "Sophtron kapcsolat sikeresen frissítve! A számláid újracsatlakoztatása folyamatban."
+      errors:
+        blank_user_id: Kérlek add meg a Sophtron felhasználói azonosítót.
+        invalid_user_id: Érvénytelen felhasználói azonosító. Kérlek ellenőrizd, hogy a teljes felhasználói azonosítót másoltad-e a Sophtron-ból.
+        user_id_compromised: A felhasználói azonosító lehet, hogy sérült, lejárt, vagy már fel lett használva. Kérlek hozz létre egy újat.
+        blank_access_key: Kérlek add meg a Sophtron hozzáférési kulcsot.
+        invalid_access_key: Érvénytelen hozzáférési kulcs. Kérlek ellenőrizd, hogy a teljes hozzáférési kulcsot másoltad-e a Sophtron-ból.
+        access_key_compromised: A hozzáférési kulcs lehet, hogy sérült, lejárt, vagy már fel lett használva. Kérlek hozz létre egy újat.
+        update_failed: "Nem sikerült frissíteni a kapcsolatot: %{message}"
+        unexpected: Váratlan hiba történt. Kérlek próbáld újra, vagy lépj kapcsolatba a támogatással.
+    edit:
+      user_id:
+        label: "Sophtron felhasználói azonosító:"
+        placeholder: "Illeszd be ide a Sophtron felhasználói azonosítódat..."
+        help_text: "A felhasználói azonosítónak betűkkel és számokkal kezdődő hosszú karaktersorozatnak kell lennie"
+      access_key:
+        label: "Sophtron hozzáférési kulcs:"
+        placeholder: "Illeszd be ide a Sophtron hozzáférési kulcsodat..."
+        help_text: "A hozzáférési kulcsnak betűkkel és számokkal kezdődő hosszú karaktersorozatnak kell lennie"
+    index:
+      title: Sophtron kapcsolatok
+    loading:
+      loading_message: Sophtron számlák betöltése...
+      loading_title: Betöltés
+    link_accounts:
+      all_already_linked:
+        one: "A kiválasztott számla (%{names}) már össze van kapcsolva"
+        other: "Mind a(z) %{count} kiválasztott számla már össze van kapcsolva: %{names}"
+      api_error: "API kapcsolódási hiba"
+      invalid_account_names:
+        one: "Nem lehet összekapcsolni üres nevű számlát"
+        other: "Nem lehet összekapcsolni %{count} üres nevű számlát"
+      link_failed: Nem sikerült összekapcsolni a számlákat
+      no_accounts_selected: Kérlek válassz legalább egy számlát
+      partial_invalid: "%{created_count} számla sikeresen összekapcsolva, %{already_linked_count} már össze volt kapcsolva, %{invalid_count} számla nevei érvénytelenek"
+      partial_success: "%{created_count} számla sikeresen összekapcsolva. %{already_linked_count} számla már össze volt kapcsolva: %{already_linked_names}"
+      success:
+        one: "%{count} számla sikeresen összekapcsolva"
+        other: "%{count} számla sikeresen összekapcsolva"
+      no_credentials_configured: "Kérlek előbb állítsd be a Sophtron API felhasználói azonosítódat és hozzáférési kulcsodat a Szolgáltatói beállításokban."
+      no_accounts_found: Nem találhatók számlák. Kérlek ellenőrizd az API-kulcs konfigurációdat.
+      no_access_key: A Sophtron hozzáférési kulcs nincs beállítva. Kérlek állítsd be a Beállításokban.
+      no_user_id: A Sophtron felhasználói azonosító nincs beállítva. Kérlek állítsd be a Beállításokban.
+      no_institution_connected: Kérlek először csatlakoztass egy banki intézményt a Sophtron-nal.
+    connect:
+      cancel: Mégse
+      captcha: Captcha
+      connect: Csatlakozás
+      institution_search_label: Intézmény
+      institution_search_placeholder: Keresés banknév szerint
+      no_institutions: Nem találhatók egyező intézmények.
+      password: Jelszó
+      search: Keresés
+      search_too_short: Legalább két karaktert adj meg a kereséshez.
+      title: Sophtron intézmény csatlakoztatása
+      username: Felhasználónév
+    connect_institution:
+      api_error: "Sophtron kapcsolódás sikertelen: %{message}"
+      missing_parameters: Válassz intézményt és add meg a banki bejelentkezési adataidat.
+    connection_status:
+      api_error: "API kapcsolódási hiba: %{message}"
+      attempt: "%{attempt}. kísérlet a(z) %{max}-ból"
+      check_again: Ellenőrzés újra
+      failed: A Sophtron nem tudta befejezni ezt az intézményi kapcsolatot.
+      failed_timeout: A Sophtron túllépte az időkorlátot, miközben az intézmény befejezi a bejelentkezést.
+      timeout: A Sophtron nem fejezte be a kapcsolódást a várt időn belül. Ellenőrizheted újra, vagy próbálkozz meg a kapcsolódással később.
+      title: Sophtron csatlakoztatása
+      waiting: A Sophtron még kapcsolódik az intézményedhez.
+    mfa:
+      captcha: Captcha szöveg
+      captcha_alt: Sophtron captcha
+      phone_confirmed: Telefonon megerősítettem
+      submit: Elküldés
+      title: Sophtron ellenőrzés
+      token: Ellenőrző kód
+    submit_mfa:
+      api_error: "Ellenőrzés sikertelen: %{message}"
+      invalid_security_answers: A biztonsági válaszok hiányoznak vagy túl hosszúak.
+      unknown_challenge: Ismeretlen Sophtron ellenőrzési lépés.
+    sophtron_item:
+      accounts_need_setup: Számlák beállítást igényelnek
+      automatic_sync: Automatikus szinkronizálás használata
+      delete: Kapcsolat törlése
+      deletion_in_progress: törlés folyamatban...
+      error: Hiba
+      no_accounts_description: Ehhez a kapcsolathoz még nincsenek összekapcsolt számlák.
+      no_accounts_title: Nincsenek számlák
+      manual_sync: Kézi szinkronizálás
+      manual_sync_action: Kézi szinkronizálás megkövetelése
+      manual_sync_action_for: "Kézi szinkronizálás megkövetelése ehhez: %{institution}"
+      automatic_sync_for: "Automatikus szinkronizálás használata ehhez: %{institution}"
+      setup_action: Új számlák beállítása
+      setup_description: "%{linked} / %{total} számla összekapcsolva. Válaszd ki az újonnan importált Sophtron számlák típusait."
+      setup_needed: Új számlák beállításra várnak
+      status: "Szinkronizálva %{timestamp} ezelőtt"
+      status_never: Még nem szinkronizált
+      status_with_summary: "Utolsó szinkronizálás %{timestamp} ezelőtt • %{summary}"
+      sync_now: Szinkronizálás most
+      syncing: Szinkronizálás...
+      total: Összesen
+      unlinked: Nincs összekapcsolva
+    preload_accounts:
+      preload_accounts: számlák előzetes betöltése
+      api_error: "API kapcsolódási hiba"
+      unexpected_error: "Váratlan hiba történt"
+      no_credentials_configured: "Kérlek előbb állítsd be a Sophtron API felhasználói azonosítódat és hozzáférési kulcsodat a Szolgáltatói beállításokban."
+      no_accounts_found: Nem találhatók számlák. Kérlek ellenőrizd az API-kulcs konfigurációdat.
+      no_access_key: A Sophtron hozzáférési kulcs nincs beállítva. Kérlek állítsd be a Beállításokban.
+      no_user_id: A Sophtron felhasználói azonosító nincs beállítva. Kérlek állítsd be a Beállításokban.
+    select_accounts:
+      accounts_selected: kiválasztott számla
+      api_error: "API kapcsolódási hiba"
+      unexpected_error: "Váratlan hiba történt"
+      cancel: Mégse
+      configure_name_in_sophtron: Nem importálható — kérlek állítsd be a számla nevét a Sophtron-ban
+      description: "Válaszd ki azokat a számlákat, amelyeket össze szeretnél kapcsolni a(z) %{product_name} fiókkal."
+      link_accounts: Kiválasztott számlák összekapcsolása
+      no_accounts_found: Nem találhatók számlák. Kérlek ellenőrizd az API-kulcs konfigurációdat.
+      no_access_key: A Sophtron hozzáférési kulcs nincs beállítva. Kérlek állítsd be a Beállításokban.
+      no_user_id: A Sophtron felhasználói azonosító nincs beállítva. Kérlek állítsd be a Beállításokban.
+      no_credentials_configured: "Kérlek előbb állítsd be a Sophtron API felhasználói azonosítódat és hozzáférési kulcsodat a Szolgáltatói beállításokban."
+      no_name_placeholder: "(Nincs név)"
+      no_institution_connected: Kérlek először csatlakoztass egy banki intézményt a Sophtron-nal.
+      title: Sophtron számlák kiválasztása
+    select_existing_account:
+      account_already_linked: Ez a számla már össze van kapcsolva egy szolgáltatóval
+      all_accounts_already_linked: Minden Sophtron számla már össze van kapcsolva
+      api_error: "API kapcsolódási hiba"
+      cancel: Mégse
+      configure_name_in_sophtron: Nem importálható — kérlek állítsd be a számla nevét a Sophtron-ban
+      description: Válassz egy Sophtron számlát, amelyet ehhez a számlához szeretnél kapcsolni. A tranzakciók automatikusan szinkronizálásra és deduplikálásra kerülnek.
+      link_account: Számla összekapcsolása
+      no_account_specified: Nem lett megadva számla
+      no_accounts_found: Nem találhatók Sophtron számlák. Kérlek ellenőrizd az API-kulcs konfigurációdat.
+      no_access_key: A Sophtron hozzáférési kulcs nincs beállítva. Kérlek állítsd be a Beállításokban.
+      no_user_id: A Sophtron felhasználói azonosító nincs beállítva. Kérlek állítsd be a Beállításokban.
+      no_name_placeholder: "(Nincs név)"
+      no_institution_connected: Kérlek először csatlakoztass egy banki intézményt a Sophtron-nal.
+      title: "%{account_name} összekapcsolása a Sophtron-nal"
+      unexpected_error: "Váratlan hiba történt"
+    link_existing_account:
+      account_already_linked: Ez a számla már össze van kapcsolva egy szolgáltatóval
+      api_error: "API kapcsolódási hiba"
+      unexpected_error: "Váratlan hiba történt"
+      invalid_account_name: Nem lehet összekapcsolni üres nevű számlát
+      sophtron_account_already_linked: Ez a Sophtron számla már össze van kapcsolva egy másik számlával
+      sophtron_account_not_found: Sophtron számla nem található
+      missing_parameters: Hiányzó kötelező paraméterek
+      no_institution_connected: Kérlek először csatlakoztass egy banki intézményt a Sophtron-nal.
+      success: "%{account_name} sikeresen összekapcsolva a Sophtron-nal"
+    setup_accounts:
+      account_type_label: "Számla típusa:"
+      all_accounts_linked: "Minden Sophtron számlád már be van állítva."
+      api_error: "API kapcsolódási hiba"
+      unexpected_error: "Váratlan hiba történt"
+      fetch_failed: "Nem sikerült lekérni a számlákat"
+      no_accounts_to_setup: "Nincs beállítandó számla"
+      no_access_key: "A Sophtron hozzáférési kulcs nincs beállítva. Kérlek ellenőrizd a kapcsolati beállításaidat."
+      no_user_id: "A Sophtron felhasználói azonosító nincs beállítva. Kérlek ellenőrizd a kapcsolati beállításaidat."
+      no_institution_connected: "A Sophtron intézmény még nincs csatlakoztatva."
+      account_types:
+        skip: Számla kihagyása
+        depository: Folyó- vagy megtakarítási számla
+        credit_card: Hitelkártya
+        investment: Befektetési számla
+        loan: Hitel vagy jelzálog
+        other_asset: Egyéb vagyon
+      subtype_labels:
+        depository: "Számla altípusa:"
+        credit_card: ""
+        investment: "Befektetés típusa:"
+        loan: "Hitel típusa:"
+        other_asset: ""
+      subtype_messages:
+        credit_card: "A hitelkártyák automatikusan hitelkártya számlákként lesznek beállítva."
+        other_asset: "Az egyéb vagyonelemekhez nincs szükség további beállításokra."
+      balance: Egyenleg
+      cancel: Mégse
+      choose_account_type: "Válaszd ki a megfelelő számlatípust minden Sophtron számlához:"
+      create_accounts: Számlák létrehozása
+      creating_accounts: Számlák létrehozása...
+      historical_data_range: "Előzmények időtartama:"
+      subtitle: Válaszd ki az importált számlák helyes típusait
+      sync_start_date_help: "Válaszd ki, milyen messzire szeretnél visszamenni a tranzakciós előzmények szinkronizálásában. Maximum 3 év előzmény érhető el."
+      sync_start_date_label: "Tranzakciók szinkronizálásának kezdete:"
+      title: Sophtron számlák beállítása
+    complete_account_setup:
+      all_skipped: "Minden számla ki lett hagyva. Nem jött létre számla."
+      creation_failed: "Nem sikerült létrehozni a számlákat"
+      api_error: "API kapcsolódási hiba"
+      unexpected_error: "Váratlan hiba történt"
+      no_accounts: "Nincs beállítandó számla."
+      success: "%{count} számla sikeresen létrehozva."
+    sync:
+      already_running: A Sophtron kézi szinkronizálása már folyamatban van.
+      api_error: "A Sophtron kézi szinkronizálása sikertelen: %{message}"
+      failed: A Sophtron kézi szinkronizálása sikertelen
+      no_linked_accounts: Ehhez a Sophtron intézményhez nincs szinkronizálható összekapcsolt számla.
+      processing_failed: A Sophtron kézi szinkronizálása nem tudta feldolgozni a frissített tranzakciókat.
+      success: Szinkronizálás elindítva
+    toggle_manual_sync:
+      success_disabled: A Sophtron intézmény automatikusan fog szinkronizálni.
+      success_enabled: A Sophtron intézmény mostantól kézi szinkronizálást igényel.
+    manual_sync_complete:
+      close: Bezárás
+      description: A számlaegyenlegek frissítése a háttérben fejeződik be.
+      message: A tranzakciók letöltése elindult a Sophtron ellenőrzés után.
+      title: Sophtron szinkronizálás elindítva
+    sophtron_setup_required:
+      title: Sophtron beállítás szükséges
+      message: >
+        A Sophtron kapcsolat beállításának befejezéséhez kérlek menj a Szolgáltatói beállítások oldalra, és kövesd az utasításokat a Sophtron kapcsolat engedélyezéséhez és konfigurálásához.
+      go_to_provider_settings: Szolgáltatói beállítások megnyitása
+      heading: "Felhasználói azonosító és hozzáférési kulcs nincs beállítva"
+      description: "A Sophtron számlák összekapcsolása előtt be kell állítanod a Sophtron felhasználói azonosítódat és hozzáférési kulcsodat."
+      setup_steps_title: "Beállítási lépések:"
+      step_1_html: "Menj a <strong>Beállítások → Banki szinkronizálási szolgáltatók</strong> menübe"
+      step_2_html: "Keresd meg a <strong>Sophtron</strong> részt"
+      step_3_html: "Add meg a Sophtron felhasználói azonosítódat és hozzáférési kulcsodat"
+      step_4: "Térj vissza ide a számlák összekapcsolásához"
+    api_error:
+      title: "Sophtron kapcsolódási hiba"
+      unable_to_connect: "Nem sikerült csatlakozni a Sophtron-hoz"
+      institution_unable_to_connect: "Nem sikerült csatlakozni az intézményhez"
+      common_issues_title: "Gyakori problémák:"
+      incorrect_user_id: "Helytelen felhasználói azonosító: Ellenőrizd a felhasználói azonosítódat a Szolgáltatói beállításokban"
+      invalid_access_key: "Érvénytelen hozzáférési kulcs: Ellenőrizd a hozzáférési kulcsodat a Szolgáltatói beállításokban"
+      expired_credentials: "Lejárt hitelesítő adatok: Hozz létre új felhasználói azonosítót és hozzáférési kulcsot a Sophtron-ban"
+      network_issue: "Hálózati probléma: Ellenőrizd az internetkapcsolatodat"
+      service_down: "Szolgáltatás leállása: A Sophtron API ideiglenesen nem érhető el"
+      bad_credentials: "Banki bejelentkezési adatok: Ellenőrizd, hogy a felhasználónév és jelszó helyes-e"
+      verification_code: "Ellenőrző kód: Győződj meg róla, hogy a legújabb kódot adtad meg, mielőtt lejárt"
+      institution_timeout: "Intézményi időtúllépés: A bank bejelentkezési oldala nem fejezte be a folyamatot időben"
+      unsupported_mfa: "MFA-támogatás: A Sophtron esetleg nem támogatja az intézmény jelenlegi ellenőrzési folyamatát"
+      check_provider_settings: "Szolgáltatói beállítások ellenőrzése"
+      try_again: "Próbálkozz újra a csatlakozással"
+    select_option: "%{type} kiválasztása"
+    subtype: "altípus"
+    type: "típus"
+    sophtron_panel:
+      setup_instructions_title: "Beállítási utasítások:"
+      setup_instructions:
+        step_1_html: "Látogass el a(z) <a href=\"%{url}\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"link\">Sophtron</a> oldalra az API hitelesítő adatok megszerzéséhez"
+        step_2: "Másold ki a felhasználói azonosítódat és hozzáférési kulcsodat a Sophtron fiókbeállításokból"
+        step_3: "Illeszd be a hitelesítő adatokat alább, majd kattints a Mentésre a Sophtron banki adatszinkronizálás engedélyezéséhez"
+      field_descriptions_title: "Mezőleírások:"
+      field_descriptions:
+        user_id_html: "<strong>Felhasználói azonosító:</strong> A Sophtron felhasználói azonosító hitelesítő adatod"
+        access_key_html: "<strong>Hozzáférési kulcs:</strong> A Sophtron hozzáférési kulcs hitelesítő adatod"
+        base_url_html: "<strong>Alap URL:</strong> A Sophtron API végpont URL-je (általában a Sophtron adja meg)"
+      fields:
+        user_id:
+          label: "Felhasználói azonosító"
+          placeholder_new: "Illeszd be a Sophtron felhasználói azonosítódat"
+          placeholder_edit: "••••••••"
+        access_key:
+          label: "Hozzáférési kulcs"
+          placeholder_new: "Illeszd be a Sophtron hozzáférési kulcsodat"
+          placeholder_edit: "••••••••"
+        base_url:
+          label: "Alap URL"
+          placeholder: "https://api.sophtron.com/v2"
+      save: "Konfiguráció mentése"
+      update: "Konfiguráció frissítése"
+    syncer:
+      manual_sync_required: "A kézi Sophtron szinkronizálás engedélyezve van; automatikus szinkronizálás kihagyva."
+      importing_accounts: "Számlák importálása a Sophtron-ból..."
+      checking_account_configuration: "Számlakonfiguráció ellenőrzése..."
+      accounts_need_setup: "%{count} számla beállítást igényel"
+      processing_transactions: "Tranzakciók feldolgozása az összekapcsolt számlákhoz..."
+      calculating_balances: "Egyenlegek kiszámítása az összekapcsolt számlákhoz..."
+    sophtron_entry:
+      processor:
+        unknown_transaction: "Ismeretlen tranzakció"
+    render_connection_timeout:
+      timeout: "A kapcsolat túllépte az időkorlátot. Kérlek próbáld újra."
+    redirect_after_account_link:
+      invalid_account_names:
+        one: "%{count} számlát nem lehet összekapcsolni üres névvel"
+        other: "%{count} számlát nem lehet összekapcsolni üres névvel"
+      partial_invalid: "%{created_count} számla összekapcsolva. %{already_linked_count} már össze volt kapcsolva, %{invalid_count} érvénytelen névvel rendelkezik."
+      partial_success: "%{created_count} számla összekapcsolva. %{already_linked_count} számla már össze volt kapcsolva."
+      success:
+        one: "%{count} számla sikeresen összekapcsolva."
+        other: "%{count} számla sikeresen összekapcsolva."
+      all_already_linked:
+        one: "A kiválasztott számla már össze van kapcsolva"
+        other: "Mind a(z) %{count} kiválasztott számla már össze van kapcsolva"
+      link_failed: "Nem sikerült összekapcsolni a számlákat"
+    start_manual_sync:
+      already_running: "Már folyamatban van egy szinkronizálás."
+      no_linked_accounts: "Nincs elérhető összekapcsolt számla a szinkronizáláshoz."
+      api_error: "API hiba: %{message}"
+    start_manual_sync_for_account:
+      failed: "Nem sikerült szinkronizálni a számlát"
diff --git a/config/locales/views/splits/ca.yml b/config/locales/views/splits/ca.yml
new file mode 100644
index 000000000..437a7280d
--- /dev/null
+++ b/config/locales/views/splits/ca.yml
@@ -0,0 +1,51 @@
+---
+ca:
+  splits:
+    child:
+      description: Aquesta entrada forma part d'una transacció dividida.
+      edit_split: Edita la divisió
+      title: Part d'una divisió
+      unsplit: Desfés la divisió
+    create:
+      not_splittable: Aquesta transacció no es pot dividir.
+      success: Transacció dividida correctament
+    destroy:
+      success: Divisió desfeta correctament
+    edit:
+      description: Modifica les entrades de la divisió d'aquesta transacció.
+      not_split: Aquesta transacció no està dividida.
+      submit: Actualitza la divisió
+      title: Edita la divisió
+    new:
+      add_row: Afegeix divisió
+      amount_label: Import
+      amounts_must_match: La suma dels imports de la divisió ha de ser igual a l'import
+        original de la transacció.
+      cancel: Cancel·la
+      category_label: Categoria
+      description: Divideix aquesta transacció en diverses entrades amb categories
+        i imports diferents.
+      name_label: Nom
+      name_placeholder: Nom de la divisió
+      original_amount: Import
+      original_date: 'Data:'
+      original_name: 'Nom:'
+      remaining: Restant
+      remove_row: Elimina
+      split_number: 'Divisió #%{number}'
+      submit: Divideix la transacció
+      title: Divideix la transacció
+      uncategorized: "(sense categoria)"
+    show:
+      button: Divideix
+      button_description: Divideix aquesta transacció en diverses entrades amb categories
+        i imports diferents.
+      button_title: Divideix la transacció
+      description: Aquesta transacció s'ha dividit en les entrades següents.
+      title: Entrades de la divisió
+      unsplit_button: Desfés la divisió
+      unsplit_confirm: Això eliminarà totes les entrades de la divisió i restaurarà
+        la transacció original.
+      unsplit_title: Desfés la divisió
+    update:
+      success: Divisió actualitzada correctament
diff --git a/config/locales/views/splits/fr.yml b/config/locales/views/splits/fr.yml
new file mode 100644
index 000000000..5e899f513
--- /dev/null
+++ b/config/locales/views/splits/fr.yml
@@ -0,0 +1,47 @@
+---
+fr:
+  splits:
+    new:
+      title: Diviser la transaction
+      description: Divisez cette transaction en plusieurs entrées avec différentes catégories et montants.
+      submit: Diviser la transaction
+      cancel: Annuler
+      add_row: Ajouter une division
+      remove_row: Retirer
+      remaining: Restant
+      amounts_must_match: Les montants des divisions doivent être égaux au montant initial de la transaction.
+      name_label: Nom
+      name_placeholder: Nom de la division
+      amount_label: Montant
+      category_label: Catégorie
+      uncategorized: "(sans catégorie)"
+      original_name: "Nom :"
+      original_date: "Date :"
+      original_amount: "Montant"
+      split_number: "Division n°%{number}"
+    create:
+      success: Transaction divisée avec succès
+      not_splittable: Cette transaction ne peut pas être divisée.
+    destroy:
+      success: Division de la transaction annulée avec succès
+    show:
+      title: Entrées de la division
+      description: Cette transaction a été divisée en plusieurs entrées.
+      button_title: Diviser la transaction
+      button_description: Divisez cette transaction en plusieurs entrées avec différentes catégories et montants.
+      button: Diviser
+      unsplit_title: Annuler la division
+      unsplit_button: Annuler la division
+      unsplit_confirm: Cela supprimera toutes les entrées de division et restaurera la transaction initiale.
+    edit:
+      title: Modifier la division
+      description: Modifiez les entrées de division de cette transaction.
+      submit: Mettre à jour la division
+      not_split: Cette transaction n'est pas divisée.
+    update:
+      success: Division mise à jour avec succès
+    child:
+      title: Partie d'une division
+      description: Cette entrée fait partie d'une transaction divisée.
+      edit_split: Modifier la division
+      unsplit: Annuler la division
diff --git a/config/locales/views/splits/hu.yml b/config/locales/views/splits/hu.yml
new file mode 100644
index 000000000..74ed7f5b3
--- /dev/null
+++ b/config/locales/views/splits/hu.yml
@@ -0,0 +1,47 @@
+---
+hu:
+  splits:
+    new:
+      title: Tranzakció felosztása
+      description: Oszd fel ezt a tranzakciót több tételre különböző kategóriákkal és összegekkel.
+      submit: Tranzakció felosztása
+      cancel: Mégse
+      add_row: Felosztás hozzáadása
+      remove_row: Eltávolítás
+      remaining: Fennmaradó
+      amounts_must_match: A felosztott összegeknek egyenlőnek kell lenniük az eredeti tranzakció összegével.
+      name_label: Név
+      name_placeholder: Felosztás neve
+      amount_label: Összeg
+      category_label: Kategória
+      uncategorized: "(kategorizálatlan)"
+      original_name: "Név:"
+      original_date: "Dátum:"
+      original_amount: "Összeg"
+      split_number: "%{number}. felosztás"
+    create:
+      success: Tranzakció sikeresen felosztva
+      not_splittable: Ez a tranzakció nem osztható fel.
+    destroy:
+      success: Tranzakció felosztása sikeresen visszavonva
+    show:
+      title: Felosztott tételek
+      description: Ez a tranzakció a következő tételekre lett felosztva.
+      button_title: Tranzakció felosztása
+      button_description: Oszd fel ezt a tranzakciót több tételre különböző kategóriákkal és összegekkel.
+      button: Felosztás
+      unsplit_title: Felosztás visszavonása
+      unsplit_button: Felosztás visszavonása
+      unsplit_confirm: Ez eltávolítja az összes felosztott tételt, és visszaállítja az eredeti tranzakciót.
+    edit:
+      title: Felosztás szerkesztése
+      description: Módosítsd ennek a tranzakciónak a felosztott tételeit.
+      submit: Felosztás frissítése
+      not_split: Ez a tranzakció nincs felosztva.
+    update:
+      success: Felosztás sikeresen frissítve
+    child:
+      title: Felosztás része
+      description: Ez a tétel egy felosztott tranzakció része.
+      edit_split: Felosztás szerkesztése
+      unsplit: Felosztás visszavonása
diff --git a/config/locales/views/subscriptions/ca.yml b/config/locales/views/subscriptions/ca.yml
index eb162c4ca..521b8124b 100644
--- a/config/locales/views/subscriptions/ca.yml
+++ b/config/locales/views/subscriptions/ca.yml
@@ -1,14 +1,26 @@
 ---
 ca:
   subscriptions:
+    create:
+      trial_already_used: Ja has començat o completat una prova. Actualitza per continuar.
+      welcome: Benvingut/da a Sure!
     self_hosted_alert: "%{product_name} no està disponible en mode autoallotjat."
+    success:
+      contribution_failed: Alguna cosa ha anat malament en processar la teva contribució.
+        Torna-ho a provar.
+      welcome_with_contribution: Benvingut/da a Sure! Agraïm la teva contribució.
     upgrade:
-      contribute_and_support_sure: "Contribuir i donar suport a Sure"
-      cta: "Continua donant suport al desenvolupament d'aquest codi!"
+      account_settings: Configuració del compte
+      already_contributing: Ja hi estàs contribuint. Gràcies!
+      contribute_and_support_sure: Contribueix i dona suport a Sure
+      cta: Continua donant suport al desenvolupament d'aquest codi!
       header:
-        support: "Suport"
-        sure: "Sure"
-        today: "avui"
-      redirect_to_stripe: "En el proper pas, se us redirigirà a Stripe, que gestiona les targetes de crèdit per nosaltres."
-      trialing: "Les teves dades s'eliminaran en %{days} dies"
-      trial_over: "El teu període de prova ha acabat"
\ No newline at end of file
+        support: Dona suport a
+        sure: Sure
+        today: avui
+      page_title: Actualitza
+      redirect_to_stripe: Al pas següent, se't redirigirà a Stripe, que gestiona les
+        targetes de crèdit per a nosaltres.
+      sign_out: Tanca la sessió
+      trial_over: El teu període de prova ha acabat
+      trialing: Les teves dades s'eliminaran d'aquí %{days} dies
diff --git a/config/locales/views/subscriptions/en.yml b/config/locales/views/subscriptions/en.yml
index 1cd332897..d058df0e4 100644
--- a/config/locales/views/subscriptions/en.yml
+++ b/config/locales/views/subscriptions/en.yml
@@ -2,6 +2,10 @@ en:
   subscriptions:
     self_hosted_alert: "%{product_name} is not available in self-hosted mode."
     upgrade:
+      already_contributing: You are already contributing. Thank you!
+      page_title: "Upgrade"
+      account_settings: "Account Settings"
+      sign_out: "Sign out"
       contribute_and_support_sure: "Contribute and support Sure"
       cta: "Continue supporting the development of this codebase!"
       header:
@@ -10,4 +14,10 @@ en:
         today: "today"
       redirect_to_stripe: "In the next step, you'll be redirected to Stripe which handles credit cards for us."
       trialing: "Your data will be deleted in %{days} days"
-      trial_over: "Your trial is over"
\ No newline at end of file
+      trial_over: "Your trial is over"
+    create:
+      welcome: "Welcome to Sure!"
+      trial_already_used: "You have already started or completed a trial. Please upgrade to continue."
+    success:
+      welcome_with_contribution: "Welcome to Sure!  Your contribution is appreciated."
+      contribution_failed: "Something went wrong processing your contribution. Please try again."
diff --git a/config/locales/views/subscriptions/hu.yml b/config/locales/views/subscriptions/hu.yml
new file mode 100644
index 000000000..b2b70f03f
--- /dev/null
+++ b/config/locales/views/subscriptions/hu.yml
@@ -0,0 +1,24 @@
+---
+hu:
+  subscriptions:
+    self_hosted_alert: "%{product_name} önállóan üzemeltetett módban nem érhető el."
+    upgrade:
+      already_contributing: Már hozzájárulsz. Köszönjük!
+      page_title: "Frissítés"
+      account_settings: "Fiókbeállítások"
+      sign_out: "Kijelentkezés"
+      contribute_and_support_sure: "Járulj hozzá és támogasd a Sure-t"
+      cta: "Folytasd ennek a kódbázisnak a fejlesztésének támogatását!"
+      header:
+        support: "Támogasd"
+        sure: "Sure"
+        today: "ma"
+      redirect_to_stripe: "A következő lépésben átirányítunk a Stripe-ra, amely kezeli a bankkártyás fizetéseket."
+      trialing: "Az adataid %{days} nap múlva törlésre kerülnek"
+      trial_over: "A próbaidőszakod lejárt"
+    create:
+      welcome: "Üdvözlünk a Sure-ban!"
+      trial_already_used: "Már elindítottál vagy befejezted egy próbaidőszakot. A folytatáshoz kérlek frissítsd az előfizetésedet."
+    success:
+      welcome_with_contribution: "Üdvözlünk a Sure-ban! Köszönjük a hozzájárulásodat."
+      contribution_failed: "Hiba történt a hozzájárulás feldolgozása során. Kérlek próbáld újra."
diff --git a/config/locales/views/tag/deletions/ca.yml b/config/locales/views/tag/deletions/ca.yml
index 21559e806..e9e59777d 100644
--- a/config/locales/views/tag/deletions/ca.yml
+++ b/config/locales/views/tag/deletions/ca.yml
@@ -6,6 +6,7 @@ ca:
         deleted: Etiqueta eliminada
       new:
         delete_and_leave_uncategorized: Elimina "%{tag_name}"
+        delete_and_reassign: Elimina i reassigna
         delete_and_recategorize: Elimina "%{tag_name}" i assigna una nova etiqueta
         delete_tag: Vols eliminar l'etiqueta?
         explanation: "%{tag_name} s'eliminarà de les transaccions i altres entitats
diff --git a/config/locales/views/tag/deletions/en.yml b/config/locales/views/tag/deletions/en.yml
index c69ec8d5d..77f5f2473 100644
--- a/config/locales/views/tag/deletions/en.yml
+++ b/config/locales/views/tag/deletions/en.yml
@@ -7,6 +7,7 @@ en:
       new:
         delete_and_leave_uncategorized: Delete "%{tag_name}"
         delete_and_recategorize: Delete "%{tag_name}" and assign new tag
+        delete_and_reassign: Delete and reassign
         delete_tag: Delete tag?
         explanation: "%{tag_name} will be removed from transactions and other taggable
           entities.  Instead of leaving them untagged, you can also assign a new tag
diff --git a/config/locales/views/tag/deletions/hu.yml b/config/locales/views/tag/deletions/hu.yml
new file mode 100644
index 000000000..f0a10847e
--- /dev/null
+++ b/config/locales/views/tag/deletions/hu.yml
@@ -0,0 +1,14 @@
+---
+hu:
+  tag:
+    deletions:
+      create:
+        deleted: Címke törölve
+      new:
+        delete_and_leave_uncategorized: '"%{tag_name}" törlése'
+        delete_and_recategorize: '"%{tag_name}" törlése és új címke hozzárendelése'
+        delete_and_reassign: Törlés és újraosztás
+        delete_tag: Törlöd a címkét?
+        explanation: "%{tag_name} el lesz távolítva a tranzakciókból és egyéb, címkézett elemekből. Ahelyett, hogy címke nélkül maradnának, alább új címkét is hozzárendelhetsz."
+        replacement_tag_prompt: Válassz címkét
+        tag: Címke
diff --git a/config/locales/views/tags/ca.yml b/config/locales/views/tags/ca.yml
index c34489679..95a611a80 100644
--- a/config/locales/views/tags/ca.yml
+++ b/config/locales/views/tags/ca.yml
@@ -6,11 +6,14 @@ ca:
       error: 'Error en crear l''etiqueta: %{error}'
     destroy:
       deleted: Etiqueta eliminada
+    destroy_all:
+      all_deleted: Totes les etiquetes eliminades
     edit:
       edit: Edita l'etiqueta
     form:
       placeholder: Nom de l'etiqueta
     index:
+      delete_all: Elimina-les totes
       empty: Encara no hi ha etiquetes
       new: Nova etiqueta
       tags: Etiquetes
diff --git a/config/locales/views/tags/en.yml b/config/locales/views/tags/en.yml
index a1f2ba329..076477859 100644
--- a/config/locales/views/tags/en.yml
+++ b/config/locales/views/tags/en.yml
@@ -6,6 +6,8 @@ en:
       error: 'Error creating tag: %{error}'
     destroy:
       deleted: Tag deleted
+    destroy_all:
+      all_deleted: All tags deleted
     edit:
       edit: Edit tag
     form:
@@ -14,6 +16,7 @@ en:
       empty: No tags yet
       new: New tag
       tags: Tags
+      delete_all: Delete all
     new:
       new: New tag
     tag:
diff --git a/config/locales/views/tags/hu.yml b/config/locales/views/tags/hu.yml
new file mode 100644
index 000000000..ee487af83
--- /dev/null
+++ b/config/locales/views/tags/hu.yml
@@ -0,0 +1,26 @@
+---
+hu:
+  tags:
+    create:
+      created: Címke létrehozva
+      error: 'Hiba a címke létrehozásakor: %{error}'
+    destroy:
+      deleted: Címke törölve
+    destroy_all:
+      all_deleted: Minden címke törölve
+    edit:
+      edit: Címke szerkesztése
+    form:
+      placeholder: Címke neve
+    index:
+      empty: Még nincsenek címkék
+      new: Új címke
+      tags: Címkék
+      delete_all: Összes törlése
+    new:
+      new: Új címke
+    tag:
+      delete: Törlés
+      edit: Szerkesztés
+    update:
+      updated: Címke frissítve
diff --git a/config/locales/views/trades/ca.yml b/config/locales/views/trades/ca.yml
index ef908c4df..be167ae6d 100644
--- a/config/locales/views/trades/ca.yml
+++ b/config/locales/views/trades/ca.yml
@@ -5,15 +5,26 @@ ca:
       account: Compte de transferència (opcional)
       account_prompt: Cerca compte
       amount: Import
+      dividend_requires_security: El valor és obligatori per als dividends
+      fee: Comissió de la transacció
       holding: Símbol del valor
+      holding_optional: Símbol del valor (opcional)
       price: Preu per acció
       qty: Quantitat
-      submit: Afegeix transacció
+      submit: Afegeix la transacció
       ticker_placeholder: AAPL
       type: Tipus
+      type_buy: Compra
+      type_deposit: Dipòsit
+      type_dividend: Dividend
+      type_interest: Interès
+      type_sell: Venda
+      type_withdrawal: Retirada
     header:
       buy: Compra
       current_market_price_label: Preu de mercat actual
+      dividend: Dividend
+      interest: Interès
       overview: Resum
       purchase_price_label: Preu de compra
       purchase_qty_label: Quantitat comprada
@@ -24,17 +35,25 @@ ca:
       title: Nova transacció
     show:
       additional: Addicional
+      amount_label: Import
+      buy: Compra
       category_label: Categoria
       cost_per_share_label: Cost per acció
       date_label: Data
       delete: Elimina
       delete_subtitle: Aquesta acció no es pot desfer
-      delete_title: Elimina operació
+      delete_title: Elimina l'operació
       details: Detalls
-      exclude_subtitle: Aquesta operació no s'inclourà en informes ni càlculs
+      exclude_subtitle: Aquesta operació no s'inclourà als informes ni als càlculs
       exclude_title: Exclou de l'analítica
+      fee_label: Comissió de la transacció
       no_category: Sense categoria
       note_label: Nota
       note_placeholder: Afegeix aquí qualsevol nota addicional...
+      provider_disabled_warning: Actualitzacions de preu en pausa — el proveïdor %{provider}
+        està desactivat. Torna a activar-lo a la configuració o reassigna la posició
+        a un altre proveïdor.
       quantity_label: Quantitat
+      sell: Venda
       settings: Configuració
+      type_label: Tipus
diff --git a/config/locales/views/trades/en.yml b/config/locales/views/trades/en.yml
index b2257c26f..f8e1fb418 100644
--- a/config/locales/views/trades/en.yml
+++ b/config/locales/views/trades/en.yml
@@ -45,6 +45,7 @@ en:
       delete_subtitle: This action cannot be undone
       delete_title: Delete Trade
       details: Details
+      provider_disabled_warning: "Price updates paused — %{provider} provider is disabled. Re-enable it in Settings or remap the holding to another provider."
       exclude_subtitle: This trade will not be included in reports and calculations
       exclude_title: Exclude from analytics
       no_category: No category
diff --git a/config/locales/views/trades/fr.yml b/config/locales/views/trades/fr.yml
index e94a04678..a39330e14 100644
--- a/config/locales/views/trades/fr.yml
+++ b/config/locales/views/trades/fr.yml
@@ -5,6 +5,7 @@ fr:
       account: Compte de transfert (facultatif)
       account_prompt: Rechercher un compte
       amount: Montant
+      fee: Frais de transaction
       holding: Symbole boursier
       holding_optional: Symbole boursier (facultatif)
       price: Prix par action
@@ -35,15 +36,22 @@ fr:
     show:
       additional: Détails supplémentaires
       amount_label: Montant
+      buy: Acheter
+      category_label: Catégorie
       cost_per_share_label: Coût par action
       date_label: Date
       delete: Supprimer
+      fee_label: Frais de transaction
       delete_subtitle: Cette action ne peut pas être annulée
-      delete_title: Supprimer la transaction
+      delete_title: Supprimer la transaction boursière
       details: Détails
+      provider_disabled_warning: "Mises à jour des prix en pause — le fournisseur %{provider} est désactivé. Réactivez-le dans les paramètres ou réassociez l'avoir à un autre fournisseur."
       exclude_subtitle: Cette transaction ne sera pas incluse dans les rapports et les calculs
       exclude_title: Exclure des analyses
+      no_category: Aucune catégorie
       note_label: Note
       note_placeholder: Ajoutez tout commentaire supplémentaire ici...
       quantity_label: Quantité
+      sell: Vendre
       settings: Paramètres
+      type_label: Type
diff --git a/config/locales/views/trades/hu.yml b/config/locales/views/trades/hu.yml
new file mode 100644
index 000000000..1ee4ff91a
--- /dev/null
+++ b/config/locales/views/trades/hu.yml
@@ -0,0 +1,57 @@
+---
+hu:
+  trades:
+    form:
+      account: Átviteli számla (opcionális)
+      account_prompt: Számla keresése
+      amount: Összeg
+      fee: Tranzakciós díj
+      holding: Tőzsdei szimbólum
+      holding_optional: Tőzsdei szimbólum (opcionális)
+      price: Ár részvényenként
+      qty: Mennyiség
+      submit: Tranzakció hozzáadása
+      ticker_placeholder: AAPL
+      type: Típus
+      type_buy: Vétel
+      type_sell: Eladás
+      type_deposit: Befizetés
+      type_withdrawal: Kifizetés
+      type_dividend: Osztalék
+      type_interest: Kamat
+      dividend_requires_security: Osztalékhoz értékpapír szükséges
+    header:
+      buy: Vétel
+      sell: Eladás
+      dividend: Osztalék
+      interest: Kamat
+      current_market_price_label: Aktuális piaci ár
+      overview: Áttekintés
+      purchase_price_label: Vételár
+      purchase_qty_label: Vásárolt mennyiség
+      symbol_label: Szimbólum
+      total_return_label: Nem realizált nyereség/veszteség
+    new:
+      title: Új tranzakció
+    show:
+      additional: További adatok
+      amount_label: Összeg
+      buy: Vétel
+      category_label: Kategória
+      cost_per_share_label: Bekerülési érték részvényenként
+      date_label: Dátum
+      delete: Törlés
+      fee_label: Tranzakciós díj
+      delete_subtitle: Ez a művelet nem vonható vissza
+      delete_title: Ügylet törlése
+      details: Részletek
+      provider_disabled_warning: "Az árfrissítés szünetel – a(z) %{provider} szolgáltató le van tiltva. Engedélyezd újra a Beállításokban, vagy rendeld hozzá a pozíciót egy másik szolgáltatóhoz."
+      exclude_subtitle: Ez az ügylet nem kerül bele a riportokba és a számításokba
+      exclude_title: Kizárás az elemzésből
+      no_category: Nincs kategória
+      note_label: Megjegyzés
+      note_placeholder: Adj meg bármilyen további megjegyzést itt...
+      quantity_label: Mennyiség
+      sell: Eladás
+      settings: Beállítások
+      type_label: Típus
diff --git a/config/locales/views/transactions/ca.yml b/config/locales/views/transactions/ca.yml
index dc3b94981..e147de78d 100644
--- a/config/locales/views/transactions/ca.yml
+++ b/config/locales/views/transactions/ca.yml
@@ -1,6 +1,148 @@
 ---
 ca:
   transactions:
+    activity_labels:
+      buy: Compra
+      contribution: Aportació
+      dividend: Dividend
+      exchange: Bescanvi
+      fee: Comissió
+      interest: Interès
+      other: Altres
+      reinvestment: Reinversió
+      sell: Venda
+      sweep_in: Sweep entrant
+      sweep_out: Sweep sortint
+      transfer: Transferència
+      withdrawal: Retirada
+    attachments:
+      attachment_deleted: Adjunt eliminat correctament
+      browse_to_add: Cerca per afegir fitxers
+      cannot_exceed: No es poden superar %{count} adjunts per transacció
+      delete_failed: No s'ha pogut eliminar l'adjunt. Torna-ho a provar o contacta
+        amb suport.
+      failed_delete: 'No s''ha pogut eliminar l''adjunt: %{error}'
+      failed_upload: 'No s''ha pogut pujar l''adjunt: %{error}'
+      files:
+        one: Fitxer (1)
+        other: Fitxers (%{count})
+      max_reached: S'ha arribat al límit de fitxers (%{count}/%{max}). Elimina un
+        fitxer existent per pujar-ne un altre.
+      no_attachments: Encara no hi ha adjunts
+      no_files_selected: No s'ha seleccionat cap fitxer per pujar
+      select_up_to: Selecciona fins a %{count} fitxers (imatges o PDF, màx %{size}MB
+        cadascun) • %{used} d'%{count} utilitzats
+      upload: Puja
+      upload_failed: No s'ha pogut pujar l'adjunt. Torna-ho a provar o contacta amb
+        suport.
+      uploaded_many: "%{count} adjunts pujats correctament"
+      uploaded_one: Adjunt pujat correctament
+    bulk_updates:
+      new:
+        cancel: Cancel·la
+        category_label: Categoria
+        category_prompt: Selecciona una categoria
+        date_label: Data
+        header_title: Edita transaccions
+        merchant_label: Comerç
+        merchant_prompt: Selecciona un comerç
+        name_label: Nom
+        name_placeholder: Introdueix un nom que s'aplicarà a les transaccions seleccionades
+        none: "(cap)"
+        notes_label: Notes
+        notes_placeholder: Introdueix una nota que s'aplicarà a les transaccions seleccionades
+        overview: Resum
+        save: Desa
+        tags_label: Etiquetes
+        transactions_section: Transaccions
+    categorizes:
+      create:
+        categorized:
+          one: 1 transacció categoritzada
+          other: "%{count} transaccions categoritzades"
+        rule_creation_failed: Transaccions categoritzades, però no s'ha pogut crear
+          la regla (potser ja existeix).
+      entry_row:
+        assign_category_select: Assigna categoria per a %{name}
+        include_checkbox: Inclou %{name}
+      show:
+        all_done: Totes les transaccions estan categoritzades
+        assign_category: Assigna una categoria
+        assign_category_prompt: "→ assigna"
+        col_amount: Import
+        col_category: Categoria
+        col_date: Data
+        col_transaction: Transacció
+        create_rule_label: Crea regla de categorització
+        exit: Surt
+        filter_placeholder: Cerca categories...
+        no_categories: No hi ha categories coincidents
+        remaining:
+          one: Queda 1 transacció sense categoritzar
+          other: Queden %{count} transaccions sense categoritzar
+        rule_description_prefix: Les futures transaccions de tipus %{type} amb nom
+          que contingui
+        rule_description_suffix: també haurien de rebre aquesta categoria.
+        skip: Omet
+        transaction_count:
+          one: 1 transacció
+          other: "%{count} transaccions"
+        transactions_hint: Desmarca per excloure una transacció, o assigna-li una
+          categoria diferent directament a la seva fila.
+        type_expense: Despesa
+        type_income: Ingrés
+    convert_to_trade:
+      account_label: 'Compte:'
+      amount_label: 'Import:'
+      cancel: Cancel·la
+      conversion_note: 'Convertit de la transacció: %{original_name} (%{original_date})'
+      date_label: 'Data:'
+      description: Converteix aquesta transacció en una operació amb detalls de valor
+      errors:
+        already_converted: Aquesta transacció ja s'ha convertit o exclòs
+        conversion_failed: 'No s''ha pogut convertir la transacció: %{error}'
+        enter_qty_or_price: Introdueix la quantitat o el preu per acció. L'altre es
+          calcularà a partir de l'import de la transacció.
+        enter_ticker: Introdueix un símbol de cotització
+        invalid_qty_or_price: Quantitat o preu invàlids. Introdueix valors positius
+          vàlids.
+        not_investment_account: Només es poden convertir en operacions les transaccions
+          de comptes d'inversió
+        security_not_found: El valor seleccionat ja no existeix. Selecciona'n un altre.
+        select_security: Selecciona o introdueix un valor
+        unexpected_error: 'Error inesperat durant la conversió: %{error}'
+      exchange_hint: Deixa-ho en blanc per detectar-ho automàticament
+      exchange_label: Mercat (opcional)
+      exchange_placeholder: XNAS
+      price_hint: Preu per acció (%{currency})
+      price_label: Preu per acció
+      price_mismatch_message: El teu preu (%{entered_price}/acció) difereix significativament
+        del preu de mercat actual de %{ticker} (%{market_price}). Si sembla incorrecte,
+        potser has seleccionat el valor equivocat — prova "Introdueix una cotització
+        personalitzada" per especificar el correcte.
+      price_mismatch_title: El preu pot no coincidir
+      price_placeholder: p. ex. 52,15
+      qty_or_price_hint: Introdueix com a mínim la quantitat O el preu. L'altre es
+        calcularà a partir de l'import de la transacció (%{amount}).
+      quantity_hint: Nombre d'accions operades
+      quantity_label: Quantitat (accions)
+      quantity_placeholder: p. ex. 20
+      security_custom: "+ Introdueix un ticker personalitzat"
+      security_label: Valor
+      security_not_listed_hint: No veus el teu valor? Selecciona "Introdueix un ticker
+        personalitzat" al final de la llista.
+      security_prompt: Selecciona un valor...
+      submit: Converteix en operació
+      success: Transacció convertida en operació
+      ticker_hint: Introdueix el símbol del valor (p. ex. AAPL, MSFT)
+      ticker_placeholder: AAPL
+      ticker_search_hint: Cerca per símbol o nom d'empresa, o escriu un símbol personalitzat
+      ticker_search_placeholder: Cerca un símbol...
+      title: Converteix en operació de valors
+      trade_type_hint: Compra o ven accions d'un valor
+      trade_type_label: Tipus d'operació
+    create:
+      created: Transacció creada
     dismiss_duplicate:
       failure: No s'ha pogut rebutjar la suggerència de duplicat
       success: Mantingudes com a transaccions separades
@@ -9,6 +151,7 @@ ca:
       account_prompt: Selecciona un compte
       amount: Import
       category: Categoria
+      category_label: Categoria
       category_prompt: Selecciona una categoria
       date: Data
       description: Descripció
@@ -16,6 +159,7 @@ ca:
       details: Detalls
       expense: Despesa
       income: Ingrés
+      merchant_label: Comerç
       none: "(cap)"
       note_label: Notes
       note_placeholder: Introdueix una nota
@@ -25,25 +169,57 @@ ca:
     header:
       edit_categories: Edita categories
       edit_imports: Edita importacions
-      edit_merchants: Edita comerciants
+      edit_merchants: Edita comerços
       edit_tags: Edita etiquetes
       import: Importa
     index:
+      categorize_button:
+        one: Categoritza (1)
+        other: Categoritza (%{count})
+      edit_categories: Edita categories
+      edit_imports: Edita importacions
+      edit_merchants: Edita comerços
+      edit_rules: Edita regles
+      edit_tags: Edita etiquetes
       import: Importa
+      new_rule: Nova regla
+      new_transaction: Nova transacció
+      title: Transaccions
       transaction: transacció
       transactions: transaccions
+    keep_both: 'No, mantén-les totes dues'
+    list:
+      drag_drop_subtitle: Puja transaccions directament
+      drag_drop_title: Deixa anar el CSV per importar
+      transaction: transacció
+      transactions: transaccions
+    mark_recurring: Marca com a recurrent
+    mark_recurring_subtitle: Segueix-ho com a transacció recurrent. La variància d'import
+      es calcula automàticament a partir dels últims 6 mesos de transaccions similars.
+    mark_recurring_title: Transacció recurrent
     merge_duplicate:
       failure: No s'han pogut fusionar les transaccions
       success: Les transaccions s'han fusionat correctament
     new:
       new_transaction: Nova transacció
+    pending_duplicate_merge:
+      confirm_title: Fusiona amb la transacció publicada (%{posted_amount})
+      possible_duplicate: Duplicat?
+      possible_duplicate_short: Dup?
+      reject_title: Mantén com a transaccions separades
+      review_recommended: Revisa
+      review_recommended_short: Rev
+    potential_duplicate_description: Aquesta transacció pendent pot ser la mateixa
+      que la transacció publicada a sota. Si és així, fusiona-les per evitar comptabilitzar
+      dues vegades.
+    potential_duplicate_title: S'ha detectat un duplicat possible
     search:
       filters:
         account: Compte
         amount: Import
         category: Categoria
         date: Data
-        merchant: Comerciant
+        merchant: Comerç
         status: Estat
         tag: Etiqueta
         type: Tipus
@@ -62,6 +238,9 @@ ca:
           on_or_before: el %{date} o abans
           pending: Pendent
           transfer: Transferència
+        date_filter:
+          end_date: Data de fi
+          start_date: Data d'inici
         status_filter:
           confirmed: Confirmada
           pending: Pendent
@@ -70,6 +249,8 @@ ca:
           income: Ingrés
           transfer: Transferència
       form:
+        filter: Filtra
+        search_placeholder: Cerca transaccions...
         toggle_selection_checkboxes: Commuta totes les caselles
       menu:
         account_filter: Compte
@@ -79,7 +260,7 @@ ca:
         category_filter: Categoria
         clear_filters: Neteja filtres
         date_filter: Data
-        merchant_filter: Comerciant
+        merchant_filter: Comerç
         status_filter: Estat
         tag_filter: Etiqueta
         type_filter: Tipus
@@ -87,45 +268,102 @@ ca:
         equal_to: igual a
         greater_than: major que
         less_than: menor que
+    selection_bar:
+      duplicate: Duplica
+      edit: Edita
+      selected: seleccionades
     show:
       account_label: Compte
+      activity_type: Tipus d'activitat
+      activity_type_description: Tipus d'activitat d'inversió (compra, venda, dividend,
+        etc.). Detectat automàticament o establert manualment.
+      additional_details: Detalls addicionals
       amount: Import
+      attachments: Adjunts
       category_label: Categoria
+      convert: Converteix
+      convert_to_trade_button: Converteix en operació
+      convert_to_trade_description: Converteix aquesta transacció en una operació
+        de compra o venda amb detalls de valor per al seguiment de la cartera.
+      convert_to_trade_title: Converteix en operació de valors
       date_label: Data
       delete: Elimina
       delete_subtitle: Això eliminarà permanentment la transacció, afectarà els teus
         saldos històrics i no es podrà desfer.
-      delete_title: Eliminar transacció
+      delete_title: Elimina la transacció
+      description: Descripció
       details: Detalls
-      keep_both: No, mantenir ambdós
-      mark_recurring: Marcar com a recurrent
-      mark_recurring_subtitle: Segueix-ho com a transacció recurrent. La variància d'import
-        es calcula automàticament a partir dels últims 6 mesos de transaccions similars.
+      exclude: Exclou
+      exclude_description: Les transaccions excloses es retiraran dels càlculs i informes
+        de pressupost.
+      keep_both: 'No, mantén-les totes dues'
+      loan_payment: Pagament de préstec
+      mark_recurring: Marca com a recurrent
+      mark_recurring_subtitle: Segueix-ho com a transacció recurrent. La variància
+        d'import es calcula automàticament a partir dels últims 6 mesos de transaccions
+        similars.
       mark_recurring_title: Transacció recurrent
-      merchant_label: Comerciant
+      memo: Memo
+      merchant_label: Comerç
       merge_duplicate: Sí, fusiona-les
       name_label: Nom
       nature: Tipus
       none: "(cap)"
       note_label: Notes
       note_placeholder: Introdueix una nota
+      one_time_description: Les transaccions puntuals s'exclouran de determinats càlculs
+        i informes de pressupost per ajudar-te a veure el que realment és important.
+      one_time_title: "%{type} puntual"
+      open_matcher: Obre l'aparellador
       overview: Resum
-      potential_duplicate_description: Aquesta transacció pendent pot ser la mateixa que
-        la transacció publicada a sota. Si és així, fusiona-les per evitar comptabilitzar dues vegades.
-      potential_duplicate_title: S'ha detectat duplicat possible
+      payee: Beneficiari
+      pending_duplicate_merger_button: Obre el fusionador
+      pending_duplicate_merger_description: Fusiona manualment aquesta transacció
+        pendent amb la seva versió publicada.
+      pending_duplicate_merger_title: Duplicat d'una transacció publicada?
+      potential_duplicate_description: Aquesta transacció pendent pot ser la mateixa
+        que la transacció publicada a sota. Si és així, fusiona-les per evitar comptabilitzar
+        dues vegades.
+      potential_duplicate_title: S'ha detectat un duplicat possible
+      provider_extras: Extres del proveïdor
       settings: Configuració
+      tab_transactions: Transaccions
+      tab_upcoming: Properes
       tags_label: Etiquetes
-      uncategorized: "(sense categoritzar)"
-      loan_payment: Pagament de préstec
       transfer: Transferència
+      transfer_matcher_description: Connecta aquesta transacció amb la seva contrapart
+        en un altre compte.
+      transfer_or_debt_payment: Transferència o pagament de deute?
+      uncategorized: "(sense categoritzar)"
+    split_parent_row:
+      split_label: Divisió
+    transfer_match:
+      auto_matched: Aparellada
+      auto_matched_short: A/A
+      confirm_match: Confirma la coincidència
+      payment_confirmed: Pagament confirmat
+      reject_match: Rebutja la coincidència
+      transfer_confirmed: Transferència confirmada
+    summary:
+      expenses: Despeses
+      income: Ingressos
+      inflow: Entrada
+      outflow: Sortida
+      total_transactions: Total de transaccions
     toggle_recurring_section: Mostra/Amaga les transaccions recurrents properes
     transaction:
+      activity_type_tooltip: Tipus d'activitat d'inversió
+      linked_with_provider: Vinculat amb %{provider}
       pending: Pendent
       pending_tooltip: Transacció pendent — pot canviar quan es publiqui
-      linked_with_provider: Vinculat amb %{provider}
       possible_duplicate: Duplicat?
       potential_duplicate_tooltip: Això pot ser un duplicat d'una altra transacció
       review_recommended: Revisa
       review_recommended_tooltip: Diferència d'import important — es recomana revisar
         per comprovar si és un duplicat
+      split: Divisió
+      split_child_tooltip: Part d'una transacció dividida
+      split_tooltip: Aquesta transacció s'ha dividit en múltiples entrades
     unknown_name: Transacció desconeguda
+    update:
+      updated: Transacció actualitzada
diff --git a/config/locales/views/transactions/en.yml b/config/locales/views/transactions/en.yml
index c5b5c3f0c..d051ef130 100644
--- a/config/locales/views/transactions/en.yml
+++ b/config/locales/views/transactions/en.yml
@@ -1,15 +1,36 @@
 ---
 en:
   transactions:
+    bulk_updates:
+      new:
+        cancel: Cancel
+        category_label: Category
+        category_prompt: Select a category
+        date_label: Date
+        header_title: Edit transactions
+        merchant_label: Merchant
+        merchant_prompt: Select a merchant
+        name_label: Name
+        name_placeholder: Enter a name that will be applied to selected transactions
+        none: "(none)"
+        notes_label: Notes
+        notes_placeholder: Enter a note that will be applied to selected transactions
+        overview: Overview
+        save: Save
+        tags_label: Tags
+        transactions_section: Transactions
     unknown_name: Unknown transaction
     selection_bar:
       duplicate: Duplicate
       edit: Edit
+      selected: selected
     form:
+      details: Details
       account: Account
       account_prompt: Select an Account
       amount: Amount
       category: Category
+      category_label: Category
       category_prompt: Select a Category
       date: Date
       description: Description
@@ -23,9 +44,22 @@ en:
       submit: Add transaction
       tags_label: Tags
       transfer: Transfer
+    create:
+      created: Transaction created
+    update:
+      updated: Transaction updated
     new:
       new_transaction: New transaction
     show:
+      keep_both: No, keep both
+      loan_payment: Loan Payment
+      mark_recurring: Mark as Recurring
+      mark_recurring_subtitle: Track this as a recurring transaction. Amount variance is automatically calculated from past 6 months of similar transactions.
+      mark_recurring_title: Recurring Transaction
+      merge_duplicate: Yes, merge them
+      potential_duplicate_description: This pending transaction may be the same as the posted transaction below. If so, merge them to avoid double-counting.
+      potential_duplicate_title: Possible duplicate detected
+      transfer: Transfer
       account_label: Account
       amount: Amount
       category_label: Category
@@ -45,6 +79,7 @@ en:
       convert_to_trade_title: Convert to Security Trade
       convert_to_trade_description: Convert this transaction into a Buy or Sell trade with security details for portfolio tracking.
       convert_to_trade_button: Convert to Trade
+      transfer_matcher_description: Connect this transaction to its counterpart in another account.
       pending_duplicate_merger_title: Duplicate of Posted Transaction?
       pending_duplicate_merger_description: Manually merge this pending transaction with its posted version.
       pending_duplicate_merger_button: Open merger
@@ -60,6 +95,14 @@ en:
       tab_transactions: Transactions
       tab_upcoming: Upcoming
       uncategorized: "(uncategorized)"
+      additional_details: "Additional details"
+      payee: "Payee"
+      description: "Description"
+      memo: "Memo"
+      provider_extras: "Provider extras"
+      transfer_or_debt_payment: "Transfer or Debt Payment?"
+      open_matcher: "Open matcher"
+      convert: "Convert"
     activity_labels:
       buy: Buy
       sell: Sell
@@ -83,6 +126,13 @@ en:
     keep_both: No, keep both
     split_parent_row:
       split_label: "Split"
+    transfer_match:
+      auto_matched: Auto-matched
+      auto_matched_short: A/M
+      confirm_match: Confirm match
+      payment_confirmed: Payment is confirmed
+      reject_match: Reject match
+      transfer_confirmed: Transfer is confirmed
     transaction:
       pending: Pending
       pending_tooltip: Pending transaction — may change when posted
@@ -121,9 +171,17 @@ en:
       edit_tags: Edit tags
       import: Import
     index:
+      title: "Transactions"
       transaction: transaction
       transactions: transactions
       import: Import
+      new_rule: "New rule"
+      edit_rules: "Edit rules"
+      edit_categories: "Edit categories"
+      edit_tags: "Edit tags"
+      edit_merchants: "Edit merchants"
+      edit_imports: "Edit imports"
+      new_transaction: "New transaction"
       categorize_button:
         one: "Categorize (1)"
         other: "Categorize (%{count})"
@@ -220,6 +278,9 @@ en:
         unexpected_error: "Unexpected error during conversion: %{error}"
     searches:
       filters:
+        date_filter:
+          start_date: "Start date"
+          end_date: "End date"
         amount_filter:
           equal_to: Equal to
           greater_than: Greater than
@@ -258,6 +319,8 @@ en:
         less_than: less than
       form:
         toggle_selection_checkboxes: Toggle all checkboxes
+        search_placeholder: "Search transactions ..."
+        filter: "Filter"
     attachments:
       cannot_exceed: "Cannot exceed %{count} attachments per transaction"
       uploaded_one: "Attachment uploaded successfully"
diff --git a/config/locales/views/transactions/fr.yml b/config/locales/views/transactions/fr.yml
index d6aeb52a3..8e0c69eee 100644
--- a/config/locales/views/transactions/fr.yml
+++ b/config/locales/views/transactions/fr.yml
@@ -1,6 +1,10 @@
 ---
 fr:
   transactions:
+    unknown_name: Transaction inconnue
+    selection_bar:
+      duplicate: Dupliquer
+      edit: Modifier
     form:
       account: Compte
       account_prompt: Sélectionnez un compte
@@ -12,12 +16,13 @@ fr:
       description_placeholder: Libellé de la transaction
       expense: Dépense
       income: Revenu
+      merchant_label: Marchand
       none: (aucun)
       note_label: Notes
       note_placeholder: Entrez une note
       submit: Ajouter la transaction
       tags_label: Étiquettes
-      transfer: Transfert
+      transfer: Virement
     new:
       new_transaction: Nouvelle transaction
     show:
@@ -29,6 +34,19 @@ fr:
       delete_subtitle: Cette action supprime définitivement la transaction, affecte vos soldes historiques et ne peut pas être annulée.
       delete_title: Supprimer la transaction
       details: Détails
+      attachments: Pièces jointes
+      exclude: Exclure
+      exclude_description: Les transactions exclues seront retirées des calculs budgétaires et des rapports.
+      activity_type: Type d'activité
+      activity_type_description: Type d'activité d'investissement (Achat, Vente, Dividende, etc.). Détecté automatiquement ou défini manuellement.
+      one_time_title: "Transaction ponctuelle (%{type})"
+      one_time_description: Les transactions ponctuelles seront exclues de certains calculs budgétaires et rapports afin de vous aider à voir ce qui compte vraiment.
+      convert_to_trade_title: Convertir en transaction boursière
+      convert_to_trade_description: Convertissez cette transaction en une transaction boursière d'achat ou de vente avec les détails du titre pour le suivi du portefeuille.
+      convert_to_trade_button: Convertir en transaction boursière
+      pending_duplicate_merger_title: Doublon d'une transaction validée ?
+      pending_duplicate_merger_description: Fusionnez manuellement cette transaction en attente avec sa version validée.
+      pending_duplicate_merger_button: Ouvrir la fusion
       merchant_label: Marchand
       name_label: Nom
       nature: Type
@@ -38,18 +56,167 @@ fr:
       overview: Aperçu
       settings: Paramètres
       tags_label: Étiquettes
+      tab_transactions: Transactions
+      tab_upcoming: À venir
       uncategorized: "(non catégorisée)"
+    activity_labels:
+      buy: Achat
+      sell: Vente
+      sweep_in: Balayage entrant
+      sweep_out: Balayage sortant
+      dividend: Dividende
+      reinvestment: Réinvestissement
+      interest: Intérêts
+      fee: Frais
+      transfer: Transfert
+      contribution: Contribution
+      withdrawal: Retrait
+      exchange: Échange
+      other: Autre
+    mark_recurring: Marquer comme récurrente
+    mark_recurring_subtitle: Suivez cette transaction comme récurrente. La variance du montant est calculée automatiquement à partir des 6 derniers mois de transactions similaires.
+    mark_recurring_title: Transaction récurrente
+    potential_duplicate_title: Doublon possible détecté
+    potential_duplicate_description: Cette transaction en attente peut être identique à la transaction validée ci-dessous. Si c'est le cas, fusionnez-les pour éviter le double comptage.
+    merge_duplicate: Oui, les fusionner
+    keep_both: Non, garder les deux
+    split_parent_row:
+      split_label: "Fractionner"
+    transaction:
+      pending: En attente
+      pending_tooltip: Transaction en attente — peut changer une fois validée
+      linked_with_provider: Lié avec %{provider}
+      activity_type_tooltip: Type d'activité d'investissement
+      possible_duplicate: Doublon ?
+      potential_duplicate_tooltip: Cette transaction peut être un doublon d'une autre transaction
+      review_recommended: Vérifier
+      review_recommended_tooltip: Écart de montant important — vérification recommandée pour vérifier s'il s'agit d'un doublon
+      split: Fractionner
+      split_tooltip: Cette transaction a été fractionnée en plusieurs entrées
+      split_child_tooltip: Partie d'une transaction fractionnée
+    merge_duplicate:
+      success: Transactions fusionnées avec succès
+      failure: Impossible de fusionner les transactions
+    dismiss_duplicate:
+      success: Conservées comme transactions distinctes
+      failure: Impossible d'écarter la suggestion de doublon
+    pending_duplicate_merge:
+      possible_duplicate: Doublon ?
+      possible_duplicate_short: Dbl ?
+      review_recommended: Vérifier
+      review_recommended_short: Vérif
+      confirm_title: "Fusionner avec la transaction validée (%{posted_amount})"
+      reject_title: Conserver comme transactions distinctes
+    summary:
+      total_transactions: Total des transactions
+      income: Revenus
+      expenses: Dépenses
+      inflow: Entrées
+      outflow: Sorties
     header:
       edit_categories: Modifier les catégories
       edit_imports: Modifier les importations
       edit_merchants: Modifier les marchands
       edit_tags: Modifier les étiquettes
       import: Importer
-    transaction:
-      linked_with_provider: Lié avec %{provider}
     index:
       transaction: transaction
       transactions: transactions
+      import: Importer
+      categorize_button:
+        one: "Catégoriser (1)"
+        other: "Catégoriser (%{count})"
+    categorizes:
+      show:
+        exit: "Quitter"
+        skip: "Ignorer"
+        remaining:
+          one: "1 transaction non catégorisée restante"
+          other: "%{count} transactions non catégorisées restantes"
+        transaction_count:
+          one: "1 transaction"
+          other: "%{count} transactions"
+        transactions_hint: "Décochez pour exclure une transaction, ou assignez-lui une catégorie différente directement dans sa ligne."
+        assign_category: "Assigner une catégorie"
+        assign_category_prompt: "→ assigner"
+        filter_placeholder: "Rechercher des catégories…"
+        col_transaction: "Transaction"
+        col_date: "Date"
+        col_amount: "Montant"
+        col_category: "Catégorie"
+        type_income: "Revenu"
+        type_expense: "Dépense"
+        create_rule_label: "Créer une règle de catégorisation"
+        rule_description_prefix: "Les futures transactions de type %{type} dont le nom contient"
+        rule_description_suffix: "devraient également recevoir cette catégorie."
+        no_categories: "Aucune catégorie correspondante"
+        all_done: "Toutes les transactions sont catégorisées"
+      create:
+        categorized:
+          one: "1 transaction catégorisée"
+          other: "%{count} transactions catégorisées"
+        rule_creation_failed: "Transactions catégorisées, mais la règle n'a pas pu être créée (elle existe peut-être déjà)."
+      entry_row:
+        include_checkbox: "Inclure %{name}"
+        assign_category_select: "Assigner une catégorie pour %{name}"
+    list:
+      drag_drop_title: Déposez un CSV à importer
+      drag_drop_subtitle: Téléversez directement les transactions
+      transaction: transaction
+      transactions: transactions
+    toggle_recurring_section: Afficher/masquer les transactions récurrentes à venir
+    search:
+      filters:
+        account: Compte
+        date: Date
+        type: Type
+        status: Statut
+        amount: Montant
+        category: Catégorie
+        tag: Étiquette
+        merchant: Marchand
+    convert_to_trade:
+      title: Convertir en transaction boursière
+      description: Convertir cette transaction en une transaction boursière avec les détails du titre
+      date_label: "Date :"
+      account_label: "Compte :"
+      amount_label: "Montant :"
+      security_label: Titre
+      security_prompt: Sélectionnez un titre…
+      security_custom: "+ Saisir un ticker personnalisé"
+      security_not_listed_hint: Vous ne voyez pas votre titre ? Sélectionnez « Saisir un ticker personnalisé » au bas de la liste.
+      ticker_placeholder: AAPL
+      ticker_hint: Saisissez le symbole ticker de l'action ou de l'ETF (ex. AAPL, MSFT)
+      ticker_search_placeholder: Rechercher un ticker…
+      ticker_search_hint: Recherchez par symbole ticker ou nom d'entreprise, ou saisissez un ticker personnalisé
+      price_mismatch_title: Le prix ne correspond peut-être pas
+      price_mismatch_message: "Votre prix (%{entered_price}/action) diffère significativement du prix de marché actuel de %{ticker} (%{market_price}). Si cela semble erroné, il se peut que vous ayez sélectionné le mauvais titre — essayez « Saisir un ticker personnalisé » pour indiquer le bon."
+      quantity_label: Quantité (Actions)
+      quantity_placeholder: ex. 20
+      quantity_hint: Nombre d'actions négociées
+      price_label: Prix par action
+      price_placeholder: ex. 52.15
+      price_hint: Prix par action (%{currency})
+      qty_or_price_hint: Saisissez au moins la quantité OU le prix. L'autre sera calculé à partir du montant de la transaction (%{amount}).
+      trade_type_label: Type de transaction boursière
+      trade_type_hint: Acheter ou vendre des actions d'un titre
+      exchange_label: Place de cotation (Facultatif)
+      exchange_placeholder: XNAS
+      exchange_hint: Laissez vide pour une détection automatique
+      cancel: Annuler
+      submit: Convertir en transaction boursière
+      success: Transaction convertie en transaction boursière
+      conversion_note: "Convertie depuis la transaction : %{original_name} (%{original_date})"
+      errors:
+        not_investment_account: Seules les transactions des comptes d'investissement peuvent être converties en transactions boursières
+        already_converted: Cette transaction a déjà été convertie ou exclue
+        enter_ticker: Veuillez saisir un symbole ticker
+        security_not_found: Le titre sélectionné n'existe plus. Veuillez en sélectionner un autre.
+        select_security: Veuillez sélectionner ou saisir un titre
+        enter_qty_or_price: Veuillez saisir la quantité ou le prix par action. L'autre sera calculé à partir du montant de la transaction.
+        invalid_qty_or_price: Quantité ou prix invalide. Veuillez saisir des valeurs positives valides.
+        conversion_failed: "Échec de la conversion de la transaction : %{error}"
+        unexpected_error: "Erreur inattendue lors de la conversion : %{error}"
     searches:
       filters:
         amount_filter:
@@ -62,11 +229,16 @@ fr:
           income: Revenu
           on_or_after: le %{date} et après
           on_or_before: le %{date} et avant
-          transfer: Transfert
+          transfer: Virement
+          confirmed: Confirmée
+          pending: En attente
         type_filter:
           expense: Dépense
           income: Revenu
-          transfer: Transfert
+          transfer: Virement
+        status_filter:
+          confirmed: Confirmée
+          pending: En attente
       menu:
         account_filter: Compte
         amount_filter: Montant
@@ -76,9 +248,30 @@ fr:
         clear_filters: Effacer les filtres
         date_filter: Date
         merchant_filter: Marchand
+        status_filter: Statut
         tag_filter: Étiquette
         type_filter: Type
       search:
         equal_to: égal à
         greater_than: supérieur à
         less_than: inférieur à
+      form:
+        toggle_selection_checkboxes: Basculer toutes les cases à cocher
+    attachments:
+      cannot_exceed: "Ne peut dépasser %{count} pièces jointes par transaction"
+      uploaded_one: "Pièce jointe téléversée avec succès"
+      uploaded_many: "%{count} pièces jointes téléversées avec succès"
+      failed_upload: "Échec du téléversement de la pièce jointe : %{error}"
+      no_files_selected: "Aucun fichier sélectionné pour le téléversement"
+      attachment_deleted: "Pièce jointe supprimée avec succès"
+      failed_delete: "Échec de la suppression de la pièce jointe : %{error}"
+      upload_failed: "Échec du téléversement de la pièce jointe. Veuillez réessayer ou contacter le support."
+      delete_failed: "Échec de la suppression de la pièce jointe. Veuillez réessayer ou contacter le support."
+      upload: "Téléverser"
+      no_attachments: "Aucune pièce jointe pour l'instant"
+      select_up_to: "Sélectionnez jusqu'à %{count} fichiers (images ou PDF, %{size} Mo max chacun) • %{used} sur %{count} utilisés"
+      files:
+        one: "Fichier (1)"
+        other: "Fichiers (%{count})"
+      browse_to_add: "Parcourir pour ajouter des fichiers"
+      max_reached: "Limite maximale de fichiers atteinte (%{count}/%{max}). Supprimez un fichier existant pour en téléverser un autre."
diff --git a/config/locales/views/transactions/hu.yml b/config/locales/views/transactions/hu.yml
new file mode 100644
index 000000000..bd12ab3c2
--- /dev/null
+++ b/config/locales/views/transactions/hu.yml
@@ -0,0 +1,333 @@
+---
+hu:
+  transactions:
+    bulk_updates:
+      new:
+        cancel: Mégse
+        category_label: Kategória
+        category_prompt: Válassz kategóriát
+        date_label: Dátum
+        header_title: Tranzakciók szerkesztése
+        merchant_label: Kereskedő
+        merchant_prompt: Válassz kereskedőt
+        name_label: Név
+        name_placeholder: Add meg a kiválasztott tranzakciókra alkalmazandó nevet
+        none: "(egyik sem)"
+        notes_label: Megjegyzések
+        notes_placeholder: Add meg a kiválasztott tranzakciókra alkalmazandó megjegyzést
+        overview: Áttekintés
+        save: Mentés
+        tags_label: Címkék
+        transactions_section: Tranzakciók
+    unknown_name: Ismeretlen tranzakció
+    selection_bar:
+      duplicate: Duplikálás
+      edit: Szerkesztés
+      selected: kijelölve
+    form:
+      details: Részletek
+      account: Számla
+      account_prompt: Válassz számlát
+      amount: Összeg
+      category: Kategória
+      category_label: Kategória
+      category_prompt: Válassz kategóriát
+      date: Dátum
+      description: Leírás
+      description_placeholder: Tranzakció leírása
+      expense: Kiadás
+      income: Bevétel
+      merchant_label: Kereskedő
+      none: (egyik sem)
+      note_label: Megjegyzések
+      note_placeholder: Megjegyzés írása
+      submit: Tranzakció hozzáadása
+      tags_label: Címkék
+      transfer: Átutalás
+    create:
+      created: Tranzakció létrehozva
+    update:
+      updated: Tranzakció frissítve
+    new:
+      new_transaction: Új tranzakció
+    show:
+      keep_both: Nem, mindkettőt tartsd meg
+      loan_payment: Hiteltörlesztés
+      mark_recurring: Ismétlődőként jelölés
+      mark_recurring_subtitle: Kövesd ezt ismétlődő tranzakcióként. Az összegeltérés automatikusan kiszámításra kerül az elmúlt 6 hónap hasonló tranzakcióiból.
+      mark_recurring_title: Ismétlődő tranzakció
+      merge_duplicate: Igen, egyesítsd őket
+      potential_duplicate_description: Ez a függőben lévő tranzakció megegyezhet az alábbi közzétett tranzakcióval. Ha igen, egyesítsd őket a kettős könyvelés elkerülése érdekében.
+      potential_duplicate_title: Lehetséges duplikátum észlelve
+      transfer: Átutalás
+      account_label: Számla
+      amount: Összeg
+      category_label: Kategória
+      date_label: Dátum
+      delete: Törlés
+      delete_subtitle: Ez véglegesen törli a tranzakciót, befolyásolja a korábbi egyenlegeidet, és nem vonható vissza.
+      delete_title: Tranzakció törlése
+      details: Részletek
+      attachments: Mellékletek
+      exclude: Kizárás
+      exclude_description: A kizárt tranzakciók eltávolításra kerülnek a költségvetési számításokból és a jelentésekből.
+      activity_type: Tevékenység típusa
+      activity_type_description: Befektetési tevékenység típusa (Vétel, Eladás, Osztalék stb.). Automatikusan felismert vagy manuálisan beállított.
+      one_time_title: Egyszeri %{type}
+      one_time_description: Az egyszeri tranzakciók bizonyos költségvetési számításokból és jelentésekből kizárásra kerülnek, hogy lássad, mi igazán fontos.
+      convert_to_trade_title: Konvertálás értékpapír-ügyletre
+      convert_to_trade_description: Konvertáld ezt a tranzakciót Vétel vagy Eladás ügyletté értékpapír-részletekkel a portfólió követéséhez.
+      convert_to_trade_button: Konvertálás ügyletre
+      transfer_matcher_description: Kösd össze ezt a tranzakciót a megfelelőjével egy másik számlán.
+      pending_duplicate_merger_title: Közzétett tranzakció duplikátuma?
+      pending_duplicate_merger_description: Egyesítsd manuálisan ezt a függőben lévő tranzakciót a közzétett verziójával.
+      pending_duplicate_merger_button: Összevonó megnyitása
+      merchant_label: Kereskedő
+      name_label: Név
+      nature: Típus
+      none: "(egyik sem)"
+      note_label: Megjegyzések
+      note_placeholder: Megjegyzés írása
+      overview: Áttekintés
+      settings: Beállítások
+      tags_label: Címkék
+      tab_transactions: Tranzakciók
+      tab_upcoming: Közelgő
+      uncategorized: "(kategorizálatlan)"
+      additional_details: "További részletek"
+      payee: "Kedvezményezett"
+      description: "Leírás"
+      memo: "Megjegyzés"
+      provider_extras: "Szolgáltatói kiegészítők"
+      transfer_or_debt_payment: "Átutalás vagy adósságtörlesztés?"
+      open_matcher: "Összevonó megnyitása"
+      convert: "Konvertálás"
+    activity_labels:
+      buy: Vétel
+      sell: Eladás
+      sweep_in: Beáramlás
+      sweep_out: Kiáramlás
+      dividend: Osztalék
+      reinvestment: Újrabefektetés
+      interest: Kamat
+      fee: Díj
+      transfer: Átutalás
+      contribution: Befizetés
+      withdrawal: Kifizetés
+      exchange: Csere
+      other: Egyéb
+    mark_recurring: Ismétlődőként jelölés
+    mark_recurring_subtitle: Kövesd ezt ismétlődő tranzakcióként. Az összegeltérés automatikusan kiszámításra kerül az elmúlt 6 hónap hasonló tranzakcióiból.
+    mark_recurring_title: Ismétlődő tranzakció
+    potential_duplicate_title: Lehetséges duplikátum észlelve
+    potential_duplicate_description: Ez a függőben lévő tranzakció megegyezhet az alábbi közzétett tranzakcióval. Ha igen, egyesítsd őket a kettős könyvelés elkerülése érdekében.
+    merge_duplicate: Igen, egyesítsd őket
+    keep_both: Nem, mindkettőt tartsd meg
+    split_parent_row:
+      split_label: "Felosztva"
+    transaction:
+      pending: Függőben
+      pending_tooltip: Függőben lévő tranzakció — közzétételkor változhat
+      linked_with_provider: "Összekapcsolva: %{provider}"
+      activity_type_tooltip: Befektetési tevékenység típusa
+      possible_duplicate: Duplikátum?
+      potential_duplicate_tooltip: Ez egy másik tranzakció duplikátuma lehet
+      review_recommended: Ellenőrzés
+      review_recommended_tooltip: Nagy összegkülönbség — ajánlott ellenőrizni, hogy ez duplikátum-e
+      split: Felosztva
+      split_tooltip: Ez a tranzakció több tételre lett felosztva
+      split_child_tooltip: Egy felosztott tranzakció része
+    merge_duplicate:
+      success: Tranzakciók sikeresen egyesítve
+      failure: Nem sikerült egyesíteni a tranzakciókat
+    dismiss_duplicate:
+      success: Különálló tranzakcióként megtartva
+      failure: Nem sikerült elvetni a duplikátum-javaslatot
+    pending_duplicate_merge:
+      possible_duplicate: Duplikátum?
+      possible_duplicate_short: Dup?
+      review_recommended: Ellenőrzés
+      review_recommended_short: Ell.
+      confirm_title: "Egyesítés a közzétett tranzakcióval (%{posted_amount})"
+      reject_title: Különálló tranzakcióként megtartás
+    summary:
+      total_transactions: Tranzakciók összesen
+      income: Bevétel
+      expenses: Kiadások
+      inflow: Beáramlás
+      outflow: Kiáramlás
+    header:
+      edit_categories: Kategóriák szerkesztése
+      edit_imports: Importok szerkesztése
+      edit_merchants: Kereskedők szerkesztése
+      edit_tags: Címkék szerkesztése
+      import: Import
+    index:
+      title: "Tranzakciók"
+      transaction: tranzakció
+      transactions: tranzakció
+      import: Import
+      new_rule: "Új szabály"
+      edit_rules: "Szabályok szerkesztése"
+      edit_categories: "Kategóriák szerkesztése"
+      edit_tags: "Címkék szerkesztése"
+      edit_merchants: "Kereskedők szerkesztése"
+      edit_imports: "Importok szerkesztése"
+      new_transaction: "Új tranzakció"
+      categorize_button:
+        one: "Kategorizálás (1)"
+        other: "Kategorizálás (%{count})"
+    categorizes:
+      show:
+        exit: "Kilépés"
+        skip: "Kihagyás"
+        remaining:
+          one: "1 kategorizálatlan tranzakció maradt"
+          other: "%{count} kategorizálatlan tranzakció maradt"
+        transaction_count:
+          one: "1 tranzakció"
+          other: "%{count} tranzakció"
+        transactions_hint: "Jelöld ki a kizáráshoz, vagy rendelj hozzá közvetlenül a sorban eltérő kategóriát."
+        assign_category: "Kategória hozzárendelése"
+        assign_category_prompt: "→ hozzárendelés"
+        filter_placeholder: "Kategóriák keresése..."
+        col_transaction: "Tranzakció"
+        col_date: "Dátum"
+        col_amount: "Összeg"
+        col_category: "Kategória"
+        type_income: "Bevétel"
+        type_expense: "Kiadás"
+        create_rule_label: "Kategorizálási szabály létrehozása"
+        rule_description_prefix: "A jövőbeli %{type} tranzakciók, amelyek neve tartalmazza:"
+        rule_description_suffix: "szintén ezt a kategóriát kapják."
+        no_categories: "Nincs egyező kategória"
+        all_done: "Minden tranzakció kategorizálva van"
+      create:
+        categorized:
+          one: "1 tranzakció kategorizálva"
+          other: "%{count} tranzakció kategorizálva"
+        rule_creation_failed: "Tranzakciók kategorizálva, de a szabály nem hozható létre (lehet, hogy már létezik)."
+      entry_row:
+        include_checkbox: "%{name} bevonása"
+        assign_category_select: "Kategória hozzárendelése: %{name}"
+    list:
+      drag_drop_title: CSV fájl húzása az importáláshoz
+      drag_drop_subtitle: Tranzakciók közvetlen feltöltése
+      transaction: tranzakció
+      transactions: tranzakció
+    toggle_recurring_section: Közelgő ismétlődő tranzakciók megjelenítése/elrejtése
+    search:
+      filters:
+        account: Számla
+        date: Dátum
+        type: Típus
+        status: Állapot
+        amount: Összeg
+        category: Kategória
+        tag: Címke
+        merchant: Kereskedő
+    convert_to_trade:
+      title: Konvertálás értékpapír-ügyletre
+      description: Tranzakció konvertálása ügyletté értékpapír-részletekkel
+      date_label: "Dátum:"
+      account_label: "Számla:"
+      amount_label: "Összeg:"
+      security_label: Értékpapír
+      security_prompt: Értékpapír kiválasztása...
+      security_custom: "+ Egyedi ticker megadása"
+      security_not_listed_hint: Nem látod az értékpapírodat? Válaszd az "Egyedi ticker megadása" lehetőséget a lista alján.
+      ticker_placeholder: AAPL
+      ticker_hint: Add meg a részvény/ETF ticker szimbólumát (pl. AAPL, MSFT)
+      ticker_search_placeholder: Ticker keresése...
+      ticker_search_hint: Keress ticker szimbólum vagy cégnév alapján, vagy írj be egyedi tickert
+      price_mismatch_title: Az ár eltérhet
+      price_mismatch_message: "Az árad (%{entered_price}/részvény) jelentősen eltér a(z) %{ticker} aktuális piaci árától (%{market_price}). Ha ez tévesnek tűnik, lehet, hogy rossz értékpapírt választottál — próbáld meg az \"Egyedi ticker megadása\" opciót a helyes értékpapír megadásához."
+      quantity_label: Mennyiség (részvény)
+      quantity_placeholder: pl. 20
+      quantity_hint: Kereskedett részvények száma
+      price_label: Részvényenkénti ár
+      price_placeholder: pl. 52.15
+      price_hint: "Részvényenkénti ár (%{currency})"
+      qty_or_price_hint: "Add meg legalább a mennyiséget VAGY az árat. A másik kiszámításra kerül a tranzakció összegéből (%{amount})."
+      trade_type_label: Ügylet típusa
+      trade_type_hint: Értékpapír vétele vagy eladása
+      exchange_label: Tőzsde (opcionális)
+      exchange_placeholder: XNAS
+      exchange_hint: Hagyd üresen az automatikus felismeréshez
+      cancel: Mégse
+      submit: Konvertálás ügyletre
+      success: Tranzakció sikeresen konvertálva ügyletre
+      conversion_note: "Konvertálva tranzakcióból: %{original_name} (%{original_date})"
+      errors:
+        not_investment_account: Csak befektetési számlák tranzakciói konvertálhatók ügyletekre
+        already_converted: Ez a tranzakció már konvertálva vagy kizárva lett
+        enter_ticker: Kérlek adj meg egy ticker szimbólumot
+        security_not_found: A kiválasztott értékpapír már nem létezik. Kérlek válassz másikat.
+        select_security: Kérlek válassz vagy adj meg egy értékpapírt
+        enter_qty_or_price: Kérlek adj meg mennyiséget vagy részvényenkénti árat. A másik kiszámításra kerül a tranzakció összegéből.
+        invalid_qty_or_price: Érvénytelen mennyiség vagy ár. Kérlek adj meg érvényes pozitív értékeket.
+        conversion_failed: "Nem sikerült konvertálni a tranzakciót: %{error}"
+        unexpected_error: "Váratlan hiba a konverzió során: %{error}"
+    searches:
+      filters:
+        date_filter:
+          start_date: "Kezdő dátum"
+          end_date: "Záró dátum"
+        amount_filter:
+          equal_to: Egyenlő
+          greater_than: Nagyobb, mint
+          less_than: Kisebb, mint
+          placeholder: '0'
+        badge:
+          expense: Kiadás
+          income: Bevétel
+          on_or_after: "%{date} után"
+          on_or_before: "%{date} előtt"
+          transfer: Átutalás
+          confirmed: Megerősítve
+          pending: Függőben
+        type_filter:
+          expense: Kiadás
+          income: Bevétel
+          transfer: Átutalás
+        status_filter:
+          confirmed: Megerősítve
+          pending: Függőben
+      menu:
+        account_filter: Számla
+        amount_filter: Összeg
+        apply: Alkalmaz
+        cancel: Mégse
+        category_filter: Kategória
+        clear_filters: Szűrők törlése
+        date_filter: Dátum
+        merchant_filter: Kereskedő
+        status_filter: Állapot
+        tag_filter: Címke
+        type_filter: Típus
+      search:
+        equal_to: egyenlő
+        greater_than: nagyobb, mint
+        less_than: kisebb, mint
+      form:
+        toggle_selection_checkboxes: Összes jelölőnégyzet be/ki
+        search_placeholder: "Tranzakciók keresése..."
+        filter: "Szűrő"
+    attachments:
+      cannot_exceed: "Tranzakciónként legfeljebb %{count} melléklet engedélyezett"
+      uploaded_one: "Melléklet sikeresen feltöltve"
+      uploaded_many: "%{count} melléklet sikeresen feltöltve"
+      failed_upload: "Nem sikerült feltölteni a mellékletet: %{error}"
+      no_files_selected: "Nincsenek kijelölt fájlok a feltöltéshez"
+      attachment_deleted: "Melléklet sikeresen törölve"
+      failed_delete: "Nem sikerült törölni a mellékletet: %{error}"
+      upload_failed: "Nem sikerült feltölteni a mellékletet. Kérlek próbáld újra, vagy lépj kapcsolatba a támogatással."
+      delete_failed: "Nem sikerült törölni a mellékletet. Kérlek próbáld újra, vagy lépj kapcsolatba a támogatással."
+      upload: "Feltöltés"
+      no_attachments: "Még nincsenek mellékletek"
+      select_up_to: "Legfeljebb %{count} fájl kijelölése (képek vagy PDF-ek, max. %{size} MB darabonként) • %{used} / %{count} felhasználva"
+      files:
+        one: "Fájl (1)"
+        other: "Fájlok (%{count})"
+      browse_to_add: "Fájlok hozzáadásához böngéssz"
+      max_reached: "Elérted a maximális fájlkorlátot (%{count}/%{max}). Töröl egy meglévő fájlt, hogy másikat tölthess fel."
diff --git a/config/locales/views/transfer_matches/ca.yml b/config/locales/views/transfer_matches/ca.yml
new file mode 100644
index 000000000..b4890ec6e
--- /dev/null
+++ b/config/locales/views/transfer_matches/ca.yml
@@ -0,0 +1,27 @@
+---
+ca:
+  transfer_matches:
+    create:
+      success: Transferència creada
+    matching_fields:
+      create_new_transaction: Crea una nova transacció
+      match_existing_recommended: Aparella amb una transacció existent (recomanat)
+      matching_method: Mètode d'aparellament
+      matching_transaction: Transacció coincident
+      no_matching_transactions: No s'ha trobat cap transacció que coincideixi amb
+        la dels teus altres comptes. Selecciona un compte i et crearem una nova transacció
+        d'entrada.
+      select_method: Selecciona un mètode per aparellar les teves transaccions.
+      target_account: Compte de destinació
+    new:
+      create_transfer_match: Crea l'aparellament de transferència
+      from_account: Compte d'origen
+      from_account_named: 'Compte d''origen: %{name}'
+      header:
+        subtitle: Aparella la transacció corresponent a un altre compte o crea'n una
+          de nova si no existeix.
+        title: Aparella la transferència o el pagament
+      inflow_transaction: Transacció d'entrada
+      outflow_transaction: Transacció de sortida
+      to_account: Compte de destinació
+      to_account_named: 'Compte de destinació: %{name}'
diff --git a/config/locales/views/transfer_matches/en.yml b/config/locales/views/transfer_matches/en.yml
new file mode 100644
index 000000000..9bc2abb95
--- /dev/null
+++ b/config/locales/views/transfer_matches/en.yml
@@ -0,0 +1,24 @@
+---
+en:
+  transfer_matches:
+    create:
+      success: Transfer created
+    new:
+      header:
+        title: Match transfer or payment
+        subtitle: Match the corresponding transaction in another account or create one if it doesn't exist.
+      from_account: From account
+      from_account_named: "From account: %{name}"
+      to_account: To account
+      to_account_named: "To account: %{name}"
+      outflow_transaction: Outflow transaction
+      inflow_transaction: Inflow transaction
+      create_transfer_match: Create transfer match
+    matching_fields:
+      select_method: Select a method for matching your transactions.
+      match_existing_recommended: Match existing transaction (recommended)
+      create_new_transaction: Create new transaction
+      matching_method: Matching method
+      matching_transaction: Matching transaction
+      target_account: Target account
+      no_matching_transactions: We couldn't find any transactions to match from your other accounts. Please select an account and we will create a new inflow transaction for you.
diff --git a/config/locales/views/transfer_matches/es.yml b/config/locales/views/transfer_matches/es.yml
new file mode 100644
index 000000000..2b1fc5986
--- /dev/null
+++ b/config/locales/views/transfer_matches/es.yml
@@ -0,0 +1,7 @@
+---
+es:
+  transfer_matches:
+    new:
+      header:
+        title: Vincular transferencia o pago
+        subtitle: Vincula la transacción correspondiente en otra cuenta o crea una si no existe.
diff --git a/config/locales/views/transfer_matches/hu.yml b/config/locales/views/transfer_matches/hu.yml
new file mode 100644
index 000000000..f4ac47f51
--- /dev/null
+++ b/config/locales/views/transfer_matches/hu.yml
@@ -0,0 +1,24 @@
+---
+hu:
+  transfer_matches:
+    create:
+      success: Átutalás létrehozva
+    new:
+      header:
+        title: Átutalás vagy fizetés párosítása
+        subtitle: Párosítsd a megfelelő tranzakciót egy másik számlán, vagy hozz létre újat, ha még nem létezik.
+      from_account: Forrásszámla
+      from_account_named: "Forrásszámla: %{name}"
+      to_account: Célszámla
+      to_account_named: "Célszámla: %{name}"
+      outflow_transaction: Kiáramlási tranzakció
+      inflow_transaction: Beáramlási tranzakció
+      create_transfer_match: Átutalás-egyezés létrehozása
+    matching_fields:
+      select_method: Válassz módszert a tranzakciók párosításához.
+      match_existing_recommended: Meglévő tranzakció párosítása (ajánlott)
+      create_new_transaction: Új tranzakció létrehozása
+      matching_method: Párosítási módszer
+      matching_transaction: Párosított tranzakció
+      target_account: Célszámla
+      no_matching_transactions: Nem találtunk párosítható tranzakciókat a többi számlán. Kérlek válassz számlát, és létrehozunk egy új beáramlási tranzakciót.
diff --git a/config/locales/views/transfers/ca.yml b/config/locales/views/transfers/ca.yml
index d94033ceb..dcce62762 100644
--- a/config/locales/views/transfers/ca.yml
+++ b/config/locales/views/transfers/ca.yml
@@ -7,25 +7,43 @@ ca:
       success: Transferència eliminada
     form:
       amount: Import
+      calculate_rate_tab: Calcula la taxa de canvi
+      convert_tab: Converteix amb la taxa de canvi
       date: Data
+      destination_amount: Import rebut
+      destination_amount_display: 'Import rebut: %{amount}'
+      exchange_rate: Taxa de canvi
+      exchange_rate_display: 'Taxa de canvi: %{rate}'
+      exchange_rate_help: Tria com introduir l'import de la transferència.
       expense: Despesa
       from: Des de
       income: Ingrés
       select_account: Selecciona un compte
+      source_amount: Import enviat
       submit: Crea transferència
-      to: Fins a
+      to: A
       transfer: Transferència
     new:
       title: Nova transferència
     show:
+      amount: Import
+      category: Categoria
+      date: Data
       delete: Elimina transferència
-      delete_subtitle: Això eliminarà la transferència. No s'eliminaran les transaccions
+      delete_subtitle: Això elimina la transferència. No s'eliminaran les transaccions
         associades.
       delete_title: Vols eliminar la transferència?
       details: Detalls
+      from: Des de
+      mark_recurring: Marca com a recurrent
+      mark_recurring_subtitle: Fes el seguiment d'aquesta transferència com a patró
+        recurrent al feed de properes i a la pàgina de recurrents.
+      mark_recurring_title: Marca la transferència com a recurrent
       note_label: Notes
       note_placeholder: Afegeix una nota a aquesta transferència
       overview: Resum
       settings: Configuració
+      to: A
+      uncategorized: Sense categoria
     update:
       success: Transferència actualitzada
diff --git a/config/locales/views/transfers/en.yml b/config/locales/views/transfers/en.yml
index 669bae2d3..aa9c40104 100644
--- a/config/locales/views/transfers/en.yml
+++ b/config/locales/views/transfers/en.yml
@@ -7,11 +7,19 @@ en:
       success: Transfer removed
     form:
       amount: Amount
+      calculate_rate_tab: Calculate FX rate
+      convert_tab: Convert with FX rate
       date: Date
+      destination_amount: Destination amount
+      destination_amount_display: "Destination amount: %{amount}"
+      exchange_rate: Exchange rate
+      exchange_rate_display: "Exchange rate: %{rate}"
+      exchange_rate_help: Choose how to enter the transfer amount.
       expense: Expense
       from: From
       income: Income
       select_account: Select account
+      source_amount: Source amount
       submit: Create transfer
       to: To
       transfer: Transfer
@@ -23,9 +31,19 @@ en:
         transactions.
       delete_title: Remove transfer?
       details: Details
+      mark_recurring: Mark as recurring
+      mark_recurring_subtitle: Track this transfer as a recurring pattern in the upcoming
+        feed and recurring page.
+      mark_recurring_title: Mark transfer as recurring
       note_label: Notes
       note_placeholder: Add a note to this transfer
       overview: Overview
       settings: Settings
+      from: From
+      to: To
+      date: Date
+      amount: Amount
+      category: Category
+      uncategorized: Uncategorized
     update:
       success: Transfer updated
diff --git a/config/locales/views/transfers/es.yml b/config/locales/views/transfers/es.yml
index f16061fa3..419c9b719 100644
--- a/config/locales/views/transfers/es.yml
+++ b/config/locales/views/transfers/es.yml
@@ -7,11 +7,19 @@ es:
       success: Transferencia eliminada
     form:
       amount: Importe
+      calculate_rate_tab: Calcular tasa
+      convert_tab: Convertir con tasa
       date: Fecha
+      destination_amount: Importe de destino
+      destination_amount_display: "Importe de destino: %{amount}"
+      exchange_rate: Tasa de cambio
+      exchange_rate_display: "Tasa de cambio: %{rate}"
+      exchange_rate_help: Elige cómo introducir el importe de la transferencia.
       expense: Gasto
       from: Desde
       income: Ingreso
       select_account: Seleccionar cuenta
+      source_amount: Importe de origen
       submit: Crear transferencia
       to: Hacia
       transfer: Transferencia
diff --git a/config/locales/views/transfers/fr.yml b/config/locales/views/transfers/fr.yml
index 3b881d6d9..e13023bc0 100644
--- a/config/locales/views/transfers/fr.yml
+++ b/config/locales/views/transfers/fr.yml
@@ -7,11 +7,19 @@ fr:
       success: Transfert supprimé
     form:
       amount: Montant
+      calculate_rate_tab: Calculer le taux de change
+      convert_tab: Convertir avec taux de change
       date: Date
+      destination_amount: Montant de destination
+      destination_amount_display: "Montant de destination : %{amount}"
+      exchange_rate: Taux de change
+      exchange_rate_display: "Taux de change : %{rate}"
+      exchange_rate_help: Choisissez comment saisir le montant du transfert.
       expense: Dépense
       from: De
       income: Revenu
       select_account: Sélectionner un compte
+      source_amount: Montant source
       submit: Créer le transfert
       to: Vers
       transfer: Transfert
diff --git a/config/locales/views/transfers/hu.yml b/config/locales/views/transfers/hu.yml
new file mode 100644
index 000000000..18df870c0
--- /dev/null
+++ b/config/locales/views/transfers/hu.yml
@@ -0,0 +1,47 @@
+---
+hu:
+  transfers:
+    create:
+      success: Átutalás létrehozva
+    destroy:
+      success: Átutalás eltávolítva
+    form:
+      amount: Összeg
+      calculate_rate_tab: Árfolyam kiszámítása
+      convert_tab: Átváltás árfolyammal
+      date: Dátum
+      destination_amount: Célösszeg
+      destination_amount_display: "Célösszeg: %{amount}"
+      exchange_rate: Árfolyam
+      exchange_rate_display: "Árfolyam: %{rate}"
+      exchange_rate_help: Válaszd meg, hogyan adod meg az átutalás összegét.
+      expense: Kiadás
+      from: Honnan
+      income: Bevétel
+      select_account: Válassz számlát
+      source_amount: Forrásösszeg
+      submit: Átutalás létrehozása
+      to: Hova
+      transfer: Átutalás
+    new:
+      title: Új átutalás
+    show:
+      delete: Átutalás eltávolítása
+      delete_subtitle: Ez eltávolítja az átutalást. Az alapul szolgáló tranzakciókat nem törli.
+      delete_title: Eltávolítja az átutalást?
+      details: Részletek
+      mark_recurring: Ismétlődőként jelölés
+      mark_recurring_subtitle: Kövesd ezt az átutalást ismétlődő mintaként a közelgő eseménylistában és az ismétlődők oldalon.
+      mark_recurring_title: Átutalás ismétlődőként jelölése
+      note_label: Megjegyzések
+      note_placeholder: Adj meg egy megjegyzést ehhez az átutaláshoz
+      overview: Áttekintés
+      settings: Beállítások
+      from: Honnan
+      to: Hova
+      date: Dátum
+      amount: Összeg
+      category: Kategória
+      uncategorized: Kategorizálatlan
+    update:
+      success: Átutalás frissítve
diff --git a/config/locales/views/users/ca.yml b/config/locales/views/users/ca.yml
index fa1cef12c..972c53999 100644
--- a/config/locales/views/users/ca.yml
+++ b/config/locales/views/users/ca.yml
@@ -1,21 +1,31 @@
 ---
 ca:
-  no_pending_change: No hi ha canvis pendents
   users:
     destroy:
       success: El teu compte s'ha eliminat.
     resend_confirmation_email:
-      no_pending_change: No hi ha canvi de correu electrònic actualment pendent!
-      success: S'ha posat a cua un nou correu electrònic de confirmació per ser enviat.
+      no_pending_change: Actualment no hi ha cap canvi de correu electrònic pendent!
+      success: S'ha posat a la cua un nou correu electrònic de confirmació per enviar-se.
     reset:
       success: El teu compte s'ha restablert. Les dades s'eliminaran en segon pla
-        en uns instants.
-      unauthorized: No estàs autoritzat/da per realitzar aquesta acció.
+        d'aquí a una estona.
+      unauthorized: No estàs autoritzat/da per fer aquesta acció
     reset_with_sample_data:
       success: El teu compte s'ha restablert i s'estan preparant dades de mostra.
-        Veureu dades de demostració en breu.
+        Veuràs les dades de demostració d'aquí a poc.
     update:
       email_change_failed: No s'ha pogut canviar l'adreça de correu electrònic.
-      email_change_initiated: Revisa el teu nou correu electrònic per instruccions
+      email_change_initiated: Revisa el teu nou correu electrònic per veure les instruccions
         de confirmació.
       success: El teu perfil s'ha actualitzat.
+    roles:
+      admin: Administrador/a
+      member: Membre
+      super_admin: Superadministrador/a
+    user_menu:
+      changelog: Registre de canvis
+      contact: Contacte
+      feedback: Comentaris
+      log_out: Tanca la sessió
+      settings: Configuració
+      version: Versió
diff --git a/config/locales/views/users/en.yml b/config/locales/views/users/en.yml
index 48528761c..9537d57ba 100644
--- a/config/locales/views/users/en.yml
+++ b/config/locales/views/users/en.yml
@@ -16,3 +16,15 @@ en:
       unauthorized: You are not authorized to perform this action
     reset_with_sample_data:
       success: Your account has been reset and sample data is being prepared. You’ll see demo data shortly.
+    roles:
+      admin: Admin
+      member: Member
+      super_admin: Super admin
+    user_menu:
+      aria_label: Open account menu
+      version: Version
+      settings: Settings
+      changelog: Changelog
+      feedback: Feedback
+      contact: Contact
+      log_out: Log out
diff --git a/config/locales/views/users/fr.yml b/config/locales/views/users/fr.yml
index 26f68285b..f411a4869 100644
--- a/config/locales/views/users/fr.yml
+++ b/config/locales/views/users/fr.yml
@@ -7,6 +7,9 @@ fr:
       email_change_failed: Échec du changement d'adresse e-mail.
       email_change_initiated: Veuillez vérifier votre nouvelle adresse e-mail pour les instructions de confirmation.
       success: Votre profil a été mis à jour.
+    resend_confirmation_email:
+      success: Un nouvel e-mail de confirmation est en file d'attente pour être envoyé.
+      no_pending_change: Aucun changement d'adresse e-mail n'est actuellement en attente !
     reset:
       success: Votre compte a été réinitialisé. Les données seront supprimées en arrière-plan dans un certain temps.
       unauthorized: Vous n'êtes pas autorisé à effectuer cette action.
diff --git a/config/locales/views/users/hu.yml b/config/locales/views/users/hu.yml
new file mode 100644
index 000000000..6cc4bdb4b
--- /dev/null
+++ b/config/locales/views/users/hu.yml
@@ -0,0 +1,24 @@
+---
+hu:
+  users:
+    destroy:
+      success: A fiókod törölve lett.
+    update:
+      email_change_failed: Nem sikerült megváltoztatni az e-mail címet.
+      email_change_initiated: Kérjük, ellenőrizd az új e-mail címedet a megerősítési utasításokért.
+      success: A profilod frissítve lett.
+    resend_confirmation_email:
+      success: Egy új megerősítő e-mail küldése folyamatban van.
+      no_pending_change: Jelenleg nincs függőben lévő e-mail változtatás!
+    reset:
+      success: A fiókod visszaállítva. Az adatok hamarosan törlődnek a háttérben.
+      unauthorized: Nincs jogosultságod ezt a műveletet végrehajtani.
+    reset_with_sample_data:
+      success: A fiókod visszaállítva, és a mintaadatok előkészítése folyamatban van. Hamarosan megjelennek a demóadatok.
+    user_menu:
+      version: Verzió
+      settings: Beállítások
+      changelog: Változásnapló
+      feedback: Visszajelzés
+      contact: Kapcsolat
+      log_out: Kijelentkezés
diff --git a/config/locales/views/valuations/ca.yml b/config/locales/views/valuations/ca.yml
index c16d76481..a7e6b567d 100644
--- a/config/locales/views/valuations/ca.yml
+++ b/config/locales/views/valuations/ca.yml
@@ -1,6 +1,31 @@
 ---
 ca:
   valuations:
+    confirmation_contents:
+      account_balance: saldo del compte
+      asset_value: valor de l'actiu
+      balance: saldo
+      brokerage_cash: Efectiu del compte de valors
+      change: canvi
+      credit_card_balance: saldo de la targeta de crèdit
+      crypto_balance: saldo de cripto
+      holdings_value: Valor de les posicions
+      liability_balance: saldo del passiu
+      loan_balance: saldo del préstec
+      'on': el
+      property_value: valor de l'immoble
+      recalculate_notice: Totes les transaccions i saldos futurs es recalcularan segons
+        aquest %{change_or_update}.
+      this_will: Això %{action_verb} el valor del compte el
+      to: a
+      to_colon: 'a:'
+      total_account_value: Valor total del compte
+      update: actualització
+      vehicle_value: valor del vehicle
+    create:
+      account_updated: Compte actualitzat
+    errors:
+      amount_required: L'import és obligatori
     form:
       amount: Import
       submit: Afegeix actualització de saldo
@@ -10,7 +35,7 @@ ca:
       change: canvi
       date: data
       new_entry: Nova entrada
-      no_valuations: Encara no hi ha valoracions per aquest compte
+      no_valuations: Encara no hi ha valoracions per a aquest compte
       valuations: Valor
       value: valor
     new:
@@ -19,14 +44,20 @@ ca:
       title: Nou saldo
     show:
       amount: Import
+      amount_label: Valor del compte en la data
       date_label: Data
       delete: Elimina
       delete_subtitle: Aquesta acció no es pot desfer
       delete_title: Elimina entrada
       details: Detalls
       name_label: Nom
-      name_placeholder: Introdueix un nom per aquesta entrada
+      name_placeholder: Introdueix un nom per a aquesta entrada
       note_label: Notes
       note_placeholder: Afegeix qualsevol detall addicional sobre aquesta entrada
+      opening_balance: Saldo inicial
       overview: Resum
       settings: Configuració
+      update_value: Actualitza el valor
+    update:
+      account_updated: Compte actualitzat
+      entry_updated: Entrada actualitzada
diff --git a/config/locales/views/valuations/de.yml b/config/locales/views/valuations/de.yml
index cf7a48000..fc799ab44 100644
--- a/config/locales/views/valuations/de.yml
+++ b/config/locales/views/valuations/de.yml
@@ -28,3 +28,4 @@ de:
       note_placeholder: Füge zusätzliche Details zu diesem Eintrag hinzu
       overview: Übersicht
       settings: Einstellungen
+      opening_balance: Eröffnungssaldo
diff --git a/config/locales/views/valuations/en.yml b/config/locales/views/valuations/en.yml
index 7b4ede9d4..afca72aaa 100644
--- a/config/locales/views/valuations/en.yml
+++ b/config/locales/views/valuations/en.yml
@@ -1,6 +1,33 @@
 ---
 en:
   valuations:
+    confirmation_contents:
+      this_will: "This will %{action_verb} the account value on"
+      to_colon: "to:"
+      total_account_value: Total account value
+      holdings_value: Holdings value
+      brokerage_cash: Brokerage cash
+      account_balance: account balance
+      credit_card_balance: credit card balance
+      loan_balance: loan balance
+      property_value: property value
+      vehicle_value: vehicle value
+      crypto_balance: crypto balance
+      asset_value: asset value
+      liability_balance: liability balance
+      balance: balance
+      "on": "on"
+      to: "to"
+      recalculate_notice: "All future transactions and balances will be recalculated based on this %{change_or_update}."
+      change: change
+      update: update
+    create:
+      account_updated: Account updated
+    update:
+      account_updated: Account updated
+      entry_updated: Entry updated
+    errors:
+      amount_required: Amount is required
     form:
       amount: Amount
       submit: Add balance update
@@ -17,6 +44,7 @@ en:
       title: New balance
     show:
       amount: Amount
+      amount_label: Account value on date
       date_label: Date
       delete: Delete
       delete_subtitle: This action cannot be undone
@@ -28,3 +56,5 @@ en:
       note_placeholder: Add any additional details about this entry
       overview: Overview
       settings: Settings
+      opening_balance: "Opening balance"
+      update_value: Update value
diff --git a/config/locales/views/valuations/es.yml b/config/locales/views/valuations/es.yml
index ef47eb33c..cf0816266 100644
--- a/config/locales/views/valuations/es.yml
+++ b/config/locales/views/valuations/es.yml
@@ -1,6 +1,8 @@
 ---
 es:
   valuations:
+    errors:
+      amount_required: El importe es obligatorio
     form:
       amount: Importe
       submit: Añadir actualización de saldo
@@ -28,3 +30,4 @@ es:
       note_placeholder: Añade cualquier detalle adicional sobre esta entrada
       overview: Resumen
       settings: Configuración
+      opening_balance: Saldo inicial
diff --git a/config/locales/views/valuations/fr.yml b/config/locales/views/valuations/fr.yml
index d8d59a104..ccd22d4af 100644
--- a/config/locales/views/valuations/fr.yml
+++ b/config/locales/views/valuations/fr.yml
@@ -28,3 +28,4 @@ fr:
       note_placeholder: Ajoutez tout détail supplémentaire à ce bilan
       overview: Aperçu
       settings: Paramètres
+      opening_balance: Solde d'ouverture
diff --git a/config/locales/views/valuations/hu.yml b/config/locales/views/valuations/hu.yml
new file mode 100644
index 000000000..f00a1cfa8
--- /dev/null
+++ b/config/locales/views/valuations/hu.yml
@@ -0,0 +1,60 @@
+---
+hu:
+  valuations:
+    confirmation_contents:
+      this_will: "Ez %{action_verb} a számlaértéket"
+      to_colon: "erre:"
+      total_account_value: Számla teljes értéke
+      holdings_value: Portfólió értéke
+      brokerage_cash: Brókeri készpénz
+      account_balance: számlaegyenleg
+      credit_card_balance: hitelkártya-egyenleg
+      loan_balance: hitelegyenleg
+      property_value: ingatlan értéke
+      vehicle_value: jármű értéke
+      crypto_balance: kriptoegyenleg
+      asset_value: vagyonérték
+      liability_balance: kötelezettségegyenleg
+      balance: egyenleg
+      "on": "ezen:"
+      to: "erre:"
+      recalculate_notice: "Minden jövőbeli tranzakció és egyenleg újraszámításra kerül ezen %{change_or_update} alapján."
+      change: változás
+      update: frissítés
+    create:
+      account_updated: Számla frissítve
+    update:
+      account_updated: Számla frissítve
+      entry_updated: Bejegyzés frissítve
+    errors:
+      amount_required: Az összeg megadása kötelező
+    form:
+      amount: Összeg
+      submit: Egyenlegfrissítés hozzáadása
+    header:
+      balance: Egyenleg
+    index:
+      change: változás
+      date: dátum
+      new_entry: Új bejegyzés
+      no_valuations: Ehhez a számlához még nincs értékelés
+      valuations: Érték
+      value: érték
+    new:
+      title: Új egyenleg
+    show:
+      amount: Összeg
+      amount_label: Számlaérték a megadott napon
+      date_label: Dátum
+      delete: Törlés
+      delete_subtitle: Ez a művelet nem vonható vissza
+      delete_title: Bejegyzés törlése
+      details: Részletek
+      name_label: Név
+      name_placeholder: Add meg a bejegyzés nevét
+      note_label: Megjegyzések
+      note_placeholder: Adj meg további részleteket erről a bejegyzésről
+      overview: Áttekintés
+      settings: Beállítások
+      opening_balance: "Nyitóegyenleg"
+      update_value: Érték frissítése
diff --git a/config/locales/views/valuations/nb.yml b/config/locales/views/valuations/nb.yml
index 5125b0071..9564af840 100644
--- a/config/locales/views/valuations/nb.yml
+++ b/config/locales/views/valuations/nb.yml
@@ -27,4 +27,5 @@ nb:
       note_label: Notater
       note_placeholder: Legg til eventuelle tilleggsdetaljer om denne oppføringen
       overview: Oversikt
-      settings: Innstillinger
\ No newline at end of file
+      settings: Innstillinger
+      opening_balance: Startsaldo
diff --git a/config/locales/views/valuations/nl.yml b/config/locales/views/valuations/nl.yml
index 7bc507bc7..e84eb6865 100644
--- a/config/locales/views/valuations/nl.yml
+++ b/config/locales/views/valuations/nl.yml
@@ -28,3 +28,4 @@ nl:
       note_placeholder: Voeg eventuele aanvullende details toe over deze invoer
       overview: Overzicht
       settings: Instellingen
+      opening_balance: Beginsaldo
diff --git a/config/locales/views/valuations/pt-BR.yml b/config/locales/views/valuations/pt-BR.yml
index 41d90cad1..32b6504ab 100644
--- a/config/locales/views/valuations/pt-BR.yml
+++ b/config/locales/views/valuations/pt-BR.yml
@@ -28,3 +28,4 @@ pt-BR:
       note_placeholder: Adicione detalhes adicionais sobre esta entrada
       overview: Visão geral
       settings: Configurações
+      opening_balance: Saldo inicial
diff --git a/config/locales/views/valuations/ro.yml b/config/locales/views/valuations/ro.yml
index b607ba206..29c406faa 100644
--- a/config/locales/views/valuations/ro.yml
+++ b/config/locales/views/valuations/ro.yml
@@ -24,3 +24,4 @@ ro:
       note_placeholder: Adaugă orice detalii suplimentare despre această înregistrare
       overview: Prezentare generală
       settings: Setări
+      opening_balance: Sold inițial
diff --git a/config/locales/views/valuations/tr.yml b/config/locales/views/valuations/tr.yml
index 1eb75757b..461876e95 100644
--- a/config/locales/views/valuations/tr.yml
+++ b/config/locales/views/valuations/tr.yml
@@ -27,4 +27,5 @@ tr:
       note_label: Notlar
       note_placeholder: Bu girişle ilgili ek detaylar ekleyin
       overview: Genel Bakış
-      settings: Ayarlar
\ No newline at end of file
+      settings: Ayarlar
+      opening_balance: Açılış bakiyesi
diff --git a/config/locales/views/valuations/zh-CN.yml b/config/locales/views/valuations/zh-CN.yml
index e6a3a37ec..2cc6bfc63 100644
--- a/config/locales/views/valuations/zh-CN.yml
+++ b/config/locales/views/valuations/zh-CN.yml
@@ -30,3 +30,4 @@ zh-CN:
       note_placeholder: 添加此记录的其他详细信息
       overview: 概览
       settings: 设置
+      opening_balance: 初始余额
diff --git a/config/locales/views/valuations/zh-TW.yml b/config/locales/views/valuations/zh-TW.yml
index b1a374afe..af39427d9 100644
--- a/config/locales/views/valuations/zh-TW.yml
+++ b/config/locales/views/valuations/zh-TW.yml
@@ -28,3 +28,4 @@ zh-TW:
       note_placeholder: 加入關於此紀錄的額外資訊
       overview: 概覽
       settings: 設定
+      opening_balance: 初始餘額
diff --git a/config/locales/views/vehicles/ca.yml b/config/locales/views/vehicles/ca.yml
index cda63ed3f..1f5d7d43e 100644
--- a/config/locales/views/vehicles/ca.yml
+++ b/config/locales/views/vehicles/ca.yml
@@ -23,4 +23,13 @@ ca:
       trend: Tendència
       unknown: Desconegut
       year: Any
-
+    tabs:
+      overview:
+        current_price: Preu actual
+        edit_account_details: Edita els detalls del compte
+        make_model: Marca i model
+        mileage: Quilometratge
+        purchase_price: Preu de compra
+        trend: Tendència
+        unknown: Desconegut
+        year: Any
diff --git a/config/locales/views/vehicles/en.yml b/config/locales/views/vehicles/en.yml
index 03ed52252..c136fe57b 100644
--- a/config/locales/views/vehicles/en.yml
+++ b/config/locales/views/vehicles/en.yml
@@ -23,3 +23,13 @@ en:
       trend: Trend
       unknown: Unknown
       year: Year
+    tabs:
+      overview:
+        current_price: Current Price
+        make_model: Make & Model
+        mileage: Mileage
+        purchase_price: Purchase Price
+        trend: Trend
+        unknown: Unknown
+        year: Year
+        edit_account_details: "Edit account details"
diff --git a/config/locales/views/vehicles/hu.yml b/config/locales/views/vehicles/hu.yml
new file mode 100644
index 000000000..6ad9810c2
--- /dev/null
+++ b/config/locales/views/vehicles/hu.yml
@@ -0,0 +1,35 @@
+---
+hu:
+  vehicles:
+    edit:
+      edit: '%{account} szerkesztése'
+    form:
+      make: Márka
+      make_placeholder: BMW
+      mileage: Kilométeróra-állás
+      mileage_placeholder: '15000'
+      mileage_unit: Mértékegység
+      model: Modell
+      model_placeholder: M3
+      year: Évjárat
+      year_placeholder: '2023'
+    new:
+      title: Add meg a jármű adatait
+    overview:
+      current_price: Jelenlegi ár
+      make_model: Márka és modell
+      mileage: Kilométeróra-állás
+      purchase_price: Vételár
+      trend: Tendencia
+      unknown: Ismeretlen
+      year: Évjárat
+    tabs:
+      overview:
+        current_price: Jelenlegi ár
+        make_model: Márka és modell
+        mileage: Kilométeróra-állás
+        purchase_price: Vételár
+        trend: Tendencia
+        unknown: Ismeretlen
+        year: Évjárat
+        edit_account_details: "Számlaadatok szerkesztése"
diff --git a/config/puma.rb b/config/puma.rb
index 47a2362e2..04022936a 100644
--- a/config/puma.rb
+++ b/config/puma.rb
@@ -39,6 +39,8 @@ if rails_env == "production"
 end
 
 # Specifies the `port` that Puma will listen on to receive requests; default is 3000.
+# The bind host is controlled via the Rails-native `BINDING` env var (set to
+# `0.0.0.0` in containers, or `::` for IPv6 dual-stack). See docs/hosting/docker.md.
 port ENV.fetch("PORT") { 3000 }
 
 # Specifies the `environment` that Puma will run in.
diff --git a/config/routes.rb b/config/routes.rb
index 35ca76559..ec60716fb 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -1,5 +1,7 @@
-require "sidekiq/web"
-require "sidekiq/cron/web"
+unless Rails.env.production?
+  require "sidekiq/web"
+  require "sidekiq/cron/web"
+end
 
 Rails.application.routes.draw do
   resources :indexa_capital_items, only: [ :index, :new, :create, :show, :edit, :update, :destroy ] do
@@ -33,6 +35,22 @@ Rails.application.routes.draw do
     end
   end
 
+  resources :brex_items, only: %i[index new create show edit update destroy] do
+    collection do
+      get :preload_accounts, to: "brex_items/account_flows#preload_accounts"
+      get :select_accounts, to: "brex_items/account_flows#select_accounts"
+      post :link_accounts, to: "brex_items/account_flows#link_accounts"
+      get :select_existing_account, to: "brex_items/account_flows#select_existing_account"
+      post :link_existing_account, to: "brex_items/account_flows#link_existing_account"
+    end
+
+    member do
+      post :sync
+      get :setup_accounts, to: "brex_items/account_setups#setup_accounts"
+      post :complete_account_setup, to: "brex_items/account_setups#complete_account_setup"
+    end
+  end
+
   resources :coinbase_items, only: [ :index, :new, :create, :show, :edit, :update, :destroy ] do
     collection do
       get :preload_accounts
@@ -64,6 +82,21 @@ Rails.application.routes.draw do
     end
   end
 
+  resources :kraken_items, only: [ :create, :update, :destroy ] do
+    collection do
+      get :select_accounts
+      post :link_accounts
+      get :select_existing_account
+      post :link_existing_account
+    end
+
+    member do
+      post :sync
+      get :setup_accounts
+      post :complete_account_setup
+    end
+  end
+
   resources :snaptrade_items, only: [ :index, :new, :create, :show, :edit, :update, :destroy ] do
     collection do
       get :preload_accounts
@@ -85,6 +118,20 @@ Rails.application.routes.draw do
     end
   end
 
+  resources :ibkr_items, only: [ :create, :update, :destroy ] do
+    collection do
+      get :select_accounts
+      get :select_existing_account
+      post :link_existing_account
+    end
+
+    member do
+      post :sync
+      get :setup_accounts
+      post :complete_account_setup
+    end
+  end
+
   # CoinStats routes
   resources :coinstats_items, only: [ :index, :new, :create, :update, :destroy ] do
     collection do
@@ -118,10 +165,12 @@ Rails.application.routes.draw do
   resource :mfa, controller: "mfa", only: [ :new, :create ] do
     get :verify
     post :verify, to: "mfa#verify_code"
+    post :webauthn_options
+    post :verify_webauthn
     delete :disable
   end
 
-  mount Lookbook::Engine, at: "/design-system"
+  mount Lookbook::Engine, at: "/design-system" unless Rails.env.production?
 
   if Rails.env.development?
     mount Rswag::Api::Engine => "/api-docs"
@@ -129,7 +178,7 @@ Rails.application.routes.draw do
   end
 
   # Uses basic auth - see config/initializers/sidekiq.rb
-  mount Sidekiq::Web => "/sidekiq"
+  mount Sidekiq::Web => "/sidekiq" unless Rails.env.production?
 
   # AI chats
   resources :chats do
@@ -187,21 +236,31 @@ Rails.application.routes.draw do
 
   namespace :settings do
     resource :profile, only: [ :show, :destroy ]
-    resource :preferences, only: :show
+    resource :preferences, only: %i[show update]
     resource :appearance, only: %i[show update]
+    resource :debug, only: :show
     resource :hosting, only: %i[show update] do
       delete :clear_cache, on: :collection
       delete :disconnect_external_assistant, on: :collection
     end
     resource :payment, only: :show
     resource :security, only: :show
+    resources :webauthn_credentials, only: %i[create destroy] do
+      post :options, on: :collection
+    end
     resources :sso_identities, only: :destroy
     resource :api_key, only: [ :show, :new, :create, :destroy ]
     resource :ai_prompts, only: :show
     resource :llm_usage, only: :show
     resource :guides, only: :show
-    resource :bank_sync, only: :show, controller: "bank_sync"
-    resource :providers, only: %i[show update]
+    get "bank_sync", to: redirect("/settings/providers", status: 301)
+    resource :providers, only: %i[show update] do
+      collection do
+        post :sync_all
+        post ":provider_key/sync", action: :sync, as: :sync_provider
+        get ":provider_key/connect_form", action: :connect_form, as: :connect_form
+      end
+    end
   end
 
   resource :subscription, only: %i[new show create] do
@@ -232,6 +291,7 @@ Rails.application.routes.draw do
     get :export_transactions, on: :collection
     get :google_sheets_instructions, on: :collection
     get :print, on: :collection
+    get :picker, on: :collection
   end
 
   resources :budgets, only: %i[index show edit update], param: :month_year do
@@ -256,7 +316,13 @@ Rails.application.routes.draw do
     end
   end
 
-  resources :transfers, only: %i[new create destroy show update]
+  get :exchange_rate, to: "exchange_rates#show"
+
+  resources :transfers, only: %i[new create destroy show update] do
+    member do
+      post :mark_as_recurring
+    end
+  end
 
   resources :imports, only: %i[index new show create update destroy] do
     member do
@@ -379,6 +445,14 @@ Rails.application.routes.draw do
     resource :sharing, only: [ :show, :update ], controller: "account_sharings"
   end
 
+  resources :account_statements, only: %i[index show create update destroy] do
+    member do
+      patch :link
+      patch :unlink
+      patch :reject
+    end
+  end
+
   # Convenience routes for polymorphic paths
   # Example: account_path(Account.new(accountable: Depository.new)) => /depositories/123
   direct :edit_account do |model, options|
@@ -425,18 +499,39 @@ Rails.application.routes.draw do
 
       # Production API endpoints
       resources :accounts, only: [ :index, :show ]
-      resources :categories, only: [ :index, :show ]
-      resources :merchants, only: %i[index show]
-      resources :tags, only: %i[index show create update destroy]
+      resources :balances, only: [ :index, :show ]
+      resources :budgets, only: [ :index, :show ]
+      resources :budget_categories, only: [ :index, :show ]
+      resources :categories, only: [ :index, :show, :create ]
+      resources :merchants, only: [ :index, :show ]
+      resources :rules, only: [ :index, :show ]
+      resources :rule_runs, only: [ :index, :show ]
+      resources :securities, only: [ :index, :show ]
+      resources :security_prices, only: [ :index, :show ]
+      resources :tags, only: [ :index, :show, :create, :update, :destroy ]
 
       resources :transactions, only: [ :index, :show, :create, :update, :destroy ]
       resources :trades, only: [ :index, :show, :create, :update, :destroy ]
       resources :holdings, only: [ :index, :show ]
-      resources :valuations, only: [ :create, :update, :show ]
-      resources :imports, only: [ :index, :show, :create ]
+      resources :transfers, only: [ :index, :show ]
+      resources :rejected_transfers, only: [ :index, :show ]
+      resources :valuations, only: [ :index, :create, :update, :show ]
+      resources :recurring_transactions, only: [ :index, :show, :create, :update, :destroy ]
+      resources :family_exports, only: [ :index, :show, :create ] do
+        get :download, on: :member
+      end
+      resources :imports, only: [ :index, :show, :create ] do
+        post :preflight, on: :collection
+        get :rows, on: :member
+      end
       resource :usage, only: [ :show ], controller: :usage
       resource :balance_sheet, only: [ :show ], controller: :balance_sheet
-      post :sync, to: "sync#create"
+      resource :family_settings, only: [ :show ], controller: :family_settings
+      post :sync, to: "sync#create", as: :sync_job
+      resources :syncs, only: [ :index, :show ] do
+        get :latest, on: :collection
+      end
+      resources :provider_connections, only: [ :index ]
 
       resources :chats, only: [ :index, :show, :create, :update, :destroy ] do
         resources :messages, only: [ :create ] do
@@ -444,6 +539,7 @@ Rails.application.routes.draw do
         end
       end
 
+      get "users/reset/status", to: "users#reset_status"
       delete "users/reset", to: "users#reset"
       delete "users/me", to: "users#destroy"
 
@@ -495,6 +591,7 @@ Rails.application.routes.draw do
       post :balances
       get :setup_accounts
       post :complete_account_setup
+      post :dismiss_replacement_suggestion
     end
   end
 
@@ -514,6 +611,27 @@ Rails.application.routes.draw do
     end
   end
 
+  resources :sophtron_items, only: %i[index new create show edit update destroy] do
+    collection do
+      get :preload_accounts
+      get :select_accounts
+      post :link_accounts
+      get :select_existing_account
+      post :link_existing_account
+    end
+
+    member do
+      post :connect_institution
+      post :sync
+      post :toggle_manual_sync
+      post :balances
+      get :connection_status
+      post :submit_mfa
+      get :setup_accounts
+      post :complete_account_setup
+    end
+  end
+
   namespace :webhooks do
     post "plaid"
     post "plaid_eu"
@@ -530,8 +648,8 @@ Rails.application.routes.draw do
   get "up" => "rails/health#show", as: :rails_health_check
 
   # Render dynamic PWA files from app/views/pwa/*
-  get "service-worker" => "rails/pwa#service_worker", as: :pwa_service_worker
-  get "manifest" => "rails/pwa#manifest", as: :pwa_manifest
+  get "service-worker" => "pwa#service_worker", as: :pwa_service_worker, defaults: { format: :js }
+  get "manifest" => "pwa#manifest", as: :pwa_manifest, defaults: { format: :json }
 
   get "imports/:import_id/upload/sample_csv", to: "import/uploads#sample_csv", as: :import_upload_sample_csv
 
diff --git a/config/schedule.yml b/config/schedule.yml
index c3903a229..5475d7b0a 100644
--- a/config/schedule.yml
+++ b/config/schedule.yml
@@ -31,6 +31,12 @@ clean_data:
   queue: "scheduled"
   description: "Cleans up old data (e.g., expired merchant associations, expired archived exports)"
 
+clean_debug_log_entries:
+  cron: "30 3 * * *" # daily at 3:30 AM
+  class: "DebugLogCleanupJob"
+  queue: "scheduled"
+  description: "Deletes debug log entries older than 90 days"
+
 clean_inactive_families:
   cron: "0 4 * * *" # daily at 4:00 AM
   class: "InactiveFamilyCleanerJob"
diff --git a/config/storage.yml b/config/storage.yml
index aa9050108..acae1dfed 100644
--- a/config/storage.yml
+++ b/config/storage.yml
@@ -8,7 +8,7 @@ test:
 
 amazon:
   service: S3
-  access_key_id: <%= ENV["S3_ACCESS_KEY_ID"] %> 
+  access_key_id: <%= ENV["S3_ACCESS_KEY_ID"] %>
   secret_access_key: <%= ENV["S3_SECRET_ACCESS_KEY"] %>
   region: <%= ENV["S3_REGION"] || "us-east-1" %>
   bucket: <%= ENV["S3_BUCKET"] %>
@@ -25,9 +25,15 @@ cloudflare:
 
 generic_s3:
   service: S3
-  access_key_id: <%= ENV["GENERIC_S3_ACCESS_KEY_ID"] %> 
+  access_key_id: <%= ENV["GENERIC_S3_ACCESS_KEY_ID"] %>
   secret_access_key: <%= ENV["GENERIC_S3_SECRET_ACCESS_KEY"] %>
   region: <%= ENV["GENERIC_S3_REGION"] %>
   bucket: <%= ENV["GENERIC_S3_BUCKET"] %>
   endpoint: <%= ENV["GENERIC_S3_ENDPOINT"] %>
   force_path_style: <%= ActiveModel::Type::Boolean.new.cast(ENV.fetch("GENERIC_S3_FORCE_PATH_STYLE", "false")) %>
+
+google:
+  service: GCS
+  project: <%= ENV["GCS_PROJECT"] %>
+  credentials: <%= ENV["GCS_KEYFILE_JSON"].presence || ENV["GCS_KEYFILE"] %>
+  bucket: <%= ENV["GCS_BUCKET"] %>
diff --git a/db/migrate/20260109220800_create_sophtron_items_and_accounts.rb b/db/migrate/20260109220800_create_sophtron_items_and_accounts.rb
new file mode 100644
index 000000000..8cda529d9
--- /dev/null
+++ b/db/migrate/20260109220800_create_sophtron_items_and_accounts.rb
@@ -0,0 +1,64 @@
+class CreateSophtronItemsAndAccounts < ActiveRecord::Migration[7.2]
+  def change
+    # Create provider items table (stores per-family connection credentials)
+    create_table :sophtron_items, id: :uuid do |t|
+      t.references :family, null: false, foreign_key: true, type: :uuid
+      t.string :name
+
+      # Institution metadata
+      t.string :institution_id
+      t.string :institution_name
+      t.string :institution_domain
+      t.string :institution_url
+      t.string :institution_color
+
+      # Status and lifecycle
+      t.string :status, default: "good"
+      t.boolean :scheduled_for_deletion, default: false
+      t.boolean :pending_account_setup, default: false
+
+      # Sync settings
+      t.datetime :sync_start_date
+
+      # Raw data storage
+      t.jsonb :raw_payload
+      t.jsonb :raw_institution_payload
+
+      # Provider-specific credential fields
+      t.string :user_id
+      t.string :access_key
+      t.string :base_url
+
+      t.timestamps
+    end
+    add_index :sophtron_items, :status
+
+    # Create provider accounts table (stores individual account data from provider)
+    create_table :sophtron_accounts, id: :uuid do |t|
+      t.references :sophtron_item, null: false, foreign_key: true, type: :uuid
+      # Account identification
+      t.string :name, null: false
+      t.string :account_id, null: false
+
+      # Account details
+      t.string :currency
+      t.decimal :balance, precision: 19, scale: 4
+      t.decimal :available_balance, precision: 19, scale: 4
+      t.string :account_status
+      t.string :account_type
+      t.string :account_sub_type
+      t.datetime :last_updated
+
+      # Metadata and raw data
+      t.jsonb :institution_metadata
+      t.jsonb :raw_payload
+      t.jsonb :raw_transactions_payload
+
+      t.string :customer_id, null: false
+      t.string :member_id, null: false
+
+      t.timestamps
+    end
+    add_index :sophtron_accounts, :account_id
+  end
+end
diff --git a/db/migrate/20260326112218_add_account_id_to_recurring_transactions.rb b/db/migrate/20260326112218_add_account_id_to_recurring_transactions.rb
index d8289f59d..c504abcc2 100644
--- a/db/migrate/20260326112218_add_account_id_to_recurring_transactions.rb
+++ b/db/migrate/20260326112218_add_account_id_to_recurring_transactions.rb
@@ -1,5 +1,19 @@
 class AddAccountIdToRecurringTransactions < ActiveRecord::Migration[7.2]
   def up
+    # Some long-lived self-hosted instances can already contain duplicate recurring
+    # rows because older name-based uniqueness was reflected in schema.rb but was not
+    # enforced by a migration on upgraded databases. Deduplicate on the pre-migration
+    # shape first so the migration can recover cleanly after a rollback.
+    dedupe_recurring_transactions!(
+      partition_columns: %w[family_id merchant_id amount currency],
+      where_clause: "merchant_id IS NOT NULL"
+    )
+
+    dedupe_recurring_transactions!(
+      partition_columns: %w[family_id name amount currency],
+      where_clause: "merchant_id IS NULL AND name IS NOT NULL"
+    )
+
     add_reference :recurring_transactions, :account, type: :uuid, null: true, foreign_key: true
 
     # Backfill account_id from the most recent matching entry
@@ -25,6 +39,18 @@ class AddAccountIdToRecurringTransactions < ActiveRecord::Migration[7.2]
       WHERE rt.id = subquery.recurring_transaction_id
     SQL
 
+    # Deduplicate again after backfill because rows that were distinct at the
+    # family level can collapse onto the same account-scoped uniqueness key.
+    dedupe_recurring_transactions!(
+      partition_columns: %w[family_id account_id merchant_id amount currency],
+      where_clause: "merchant_id IS NOT NULL"
+    )
+
+    dedupe_recurring_transactions!(
+      partition_columns: %w[family_id account_id name amount currency],
+      where_clause: "merchant_id IS NULL AND name IS NOT NULL"
+    )
+
     # Remove old unique indexes
     remove_index :recurring_transactions, name: "idx_recurring_txns_merchant", if_exists: true
     remove_index :recurring_transactions, name: "idx_recurring_txns_name", if_exists: true
@@ -61,4 +87,28 @@ class AddAccountIdToRecurringTransactions < ActiveRecord::Migration[7.2]
 
     remove_reference :recurring_transactions, :account
   end
+
+  private
+
+    def dedupe_recurring_transactions!(partition_columns:, where_clause:)
+      execute <<~SQL
+        WITH ranked AS (
+          SELECT id,
+                 ROW_NUMBER() OVER (
+                   PARTITION BY #{partition_columns.join(', ')}
+                   ORDER BY manual DESC,
+                            (status = 'active') DESC,
+                            last_occurrence_date DESC NULLS LAST,
+                            updated_at DESC,
+                            id DESC
+                 ) AS row_num
+          FROM recurring_transactions
+          WHERE #{where_clause}
+        )
+        DELETE FROM recurring_transactions
+        WHERE id IN (
+          SELECT id FROM ranked WHERE row_num > 1
+        )
+      SQL
+    end
 end
diff --git a/db/migrate/20260405120000_add_aspsp_metadata_to_enable_banking.rb b/db/migrate/20260405120000_add_aspsp_metadata_to_enable_banking.rb
new file mode 100644
index 000000000..b1553e87e
--- /dev/null
+++ b/db/migrate/20260405120000_add_aspsp_metadata_to_enable_banking.rb
@@ -0,0 +1,35 @@
+class AddAspspMetadataToEnableBanking < ActiveRecord::Migration[7.2]
+  def change
+    # ASPSP-level metadata on the item (stored when user selects a bank)
+    add_column :enable_banking_items, :aspsp_required_psu_headers, :jsonb, default: []
+    add_column :enable_banking_items, :aspsp_maximum_consent_validity, :integer  # in seconds
+    add_column :enable_banking_items, :aspsp_auth_approach, :string              # REDIRECT | EMBEDDED | DECOUPLED
+    add_column :enable_banking_items, :aspsp_psu_types, :jsonb, default: []
+    # PII/GDPR Notice: last_psu_ip stores the user's IP address.
+    # - Required for the Psu-Ip-Address header in Enable Banking API requests
+    # - Must be declared in the privacy policy
+    # - Data retention: consider nullifying after session expiry or 90 days
+    add_column :enable_banking_items, :last_psu_ip, :string                      # user IP captured at request time
+
+    # Fix sync_start_date type: was datetime, should be date
+    reversible do |dir|
+      dir.up do
+        # Truncate any non-midnight time components before converting datetime→date.
+        # sync_start_date is a user-configured date — time components are meaningless.
+        execute(<<~SQL)
+          UPDATE enable_banking_items
+          SET sync_start_date = DATE_TRUNC('day', sync_start_date)
+          WHERE sync_start_date IS NOT NULL
+            AND sync_start_date != DATE_TRUNC('day', sync_start_date)
+        SQL
+        change_column :enable_banking_items, :sync_start_date, :date
+      end
+      dir.down { change_column :enable_banking_items, :sync_start_date, :datetime }
+    end
+
+    # Account-level fields from AccountResource
+    add_column :enable_banking_accounts, :product, :string                       # bank's proprietary product name
+    add_column :enable_banking_accounts, :credit_limit, :decimal, precision: 19, scale: 4
+    add_column :enable_banking_accounts, :identification_hashes, :jsonb, default: []
+  end
+end
diff --git a/db/migrate/20260406120000_add_psu_type_to_enable_banking_items.rb b/db/migrate/20260406120000_add_psu_type_to_enable_banking_items.rb
new file mode 100644
index 000000000..2767601c0
--- /dev/null
+++ b/db/migrate/20260406120000_add_psu_type_to_enable_banking_items.rb
@@ -0,0 +1,5 @@
+class AddPsuTypeToEnableBankingItems < ActiveRecord::Migration[7.2]
+  def change
+    add_column :enable_banking_items, :psu_type, :string
+  end
+end
diff --git a/db/migrate/20260408120000_add_price_provider_to_securities.rb b/db/migrate/20260408120000_add_price_provider_to_securities.rb
new file mode 100644
index 000000000..7e6da11b9
--- /dev/null
+++ b/db/migrate/20260408120000_add_price_provider_to_securities.rb
@@ -0,0 +1,8 @@
+class AddPriceProviderToSecurities < ActiveRecord::Migration[7.2]
+  disable_ddl_transaction!
+
+  def change
+    add_column :securities, :price_provider, :string
+    add_index :securities, :price_provider, algorithm: :concurrently
+  end
+end
diff --git a/db/migrate/20260408151837_add_offline_reason_to_securities.rb b/db/migrate/20260408151837_add_offline_reason_to_securities.rb
new file mode 100644
index 000000000..2e5edfe02
--- /dev/null
+++ b/db/migrate/20260408151837_add_offline_reason_to_securities.rb
@@ -0,0 +1,8 @@
+class AddOfflineReasonToSecurities < ActiveRecord::Migration[7.2]
+  disable_ddl_transaction!
+
+  def change
+    add_column :securities, :offline_reason, :string
+    add_index :securities, [ :price_provider, :offline_reason ], algorithm: :concurrently
+  end
+end
diff --git a/db/migrate/20260410100000_add_enabled_currencies_to_families.rb b/db/migrate/20260410100000_add_enabled_currencies_to_families.rb
new file mode 100644
index 000000000..028d14c1b
--- /dev/null
+++ b/db/migrate/20260410100000_add_enabled_currencies_to_families.rb
@@ -0,0 +1,5 @@
+class AddEnabledCurrenciesToFamilies < ActiveRecord::Migration[7.2]
+  def change
+    add_column :families, :enabled_currencies, :string, array: true
+  end
+end
diff --git a/db/migrate/20260410114435_add_first_provider_price_on_to_securities.rb b/db/migrate/20260410114435_add_first_provider_price_on_to_securities.rb
new file mode 100644
index 000000000..4748a8e3e
--- /dev/null
+++ b/db/migrate/20260410114435_add_first_provider_price_on_to_securities.rb
@@ -0,0 +1,5 @@
+class AddFirstProviderPriceOnToSecurities < ActiveRecord::Migration[7.2]
+  def change
+    add_column :securities, :first_provider_price_on, :date
+  end
+end
diff --git a/db/migrate/20260411082125_add_gin_index_to_enable_banking_accounts_identification_hashes.rb b/db/migrate/20260411082125_add_gin_index_to_enable_banking_accounts_identification_hashes.rb
new file mode 100644
index 000000000..00c35b817
--- /dev/null
+++ b/db/migrate/20260411082125_add_gin_index_to_enable_banking_accounts_identification_hashes.rb
@@ -0,0 +1,7 @@
+class AddGinIndexToEnableBankingAccountsIdentificationHashes < ActiveRecord::Migration[7.2]
+  disable_ddl_transaction!
+
+  def change
+    add_index :enable_banking_accounts, :identification_hashes, using: :gin, algorithm: :concurrently
+  end
+end
diff --git a/db/migrate/20260412120000_create_exchange_rate_pairs.rb b/db/migrate/20260412120000_create_exchange_rate_pairs.rb
new file mode 100644
index 000000000..301020983
--- /dev/null
+++ b/db/migrate/20260412120000_create_exchange_rate_pairs.rb
@@ -0,0 +1,16 @@
+class CreateExchangeRatePairs < ActiveRecord::Migration[7.2]
+  def change
+    create_table :exchange_rate_pairs, id: :uuid, default: -> { "gen_random_uuid()" } do |t|
+      t.string :from_currency, null: false
+      t.string :to_currency, null: false
+      t.date :first_provider_rate_on
+      t.string :provider_name
+      t.timestamps
+    end
+
+    add_index :exchange_rate_pairs,
+              [ :from_currency, :to_currency ],
+              unique: true,
+              name: "index_exchange_rate_pairs_on_pair_unique"
+  end
+end
diff --git a/db/migrate/20260428120000_change_postal_code_to_string_in_addresses.rb b/db/migrate/20260428120000_change_postal_code_to_string_in_addresses.rb
new file mode 100644
index 000000000..a67374b95
--- /dev/null
+++ b/db/migrate/20260428120000_change_postal_code_to_string_in_addresses.rb
@@ -0,0 +1,9 @@
+class ChangePostalCodeToStringInAddresses < ActiveRecord::Migration[7.2]
+  def up
+    change_column :addresses, :postal_code, :string, using: "postal_code::text"
+  end
+
+  def down
+    raise ActiveRecord::IrreversibleMigration, "postal_code was changed from integer to string; alphanumeric values cannot be cast back to integer"
+  end
+end
diff --git a/db/migrate/20260429120000_add_destination_account_id_to_recurring_transactions.rb b/db/migrate/20260429120000_add_destination_account_id_to_recurring_transactions.rb
new file mode 100644
index 000000000..ab5df02e3
--- /dev/null
+++ b/db/migrate/20260429120000_add_destination_account_id_to_recurring_transactions.rb
@@ -0,0 +1,107 @@
+class AddDestinationAccountIdToRecurringTransactions < ActiveRecord::Migration[7.2]
+  def up
+    add_reference :recurring_transactions, :destination_account, type: :uuid, null: true,
+                  foreign_key: { to_table: :accounts, on_delete: :cascade }
+
+    # Backfill cascade on the existing account_id FK while we're widening this
+    # table -- consistent with the cascading direction set by
+    # 20251030172500_add_cascade_on_account_deletes.rb. Without this, deleting
+    # an Account that has any recurring_transactions referencing it raises FK
+    # violations during Family destruction.
+    remove_foreign_key :recurring_transactions, :accounts, column: :account_id
+    add_foreign_key :recurring_transactions, :accounts, column: :account_id, on_delete: :cascade
+
+    # Replace the partial unique indexes added by 20260326112218 with TWO
+    # predicate-partitioned variants:
+    #
+    #   * non-transfer rows  (destination_account_id IS NULL) keep the
+    #     existing 5-column shape so behaviour is unchanged.
+    #   * transfer rows      (destination_account_id IS NOT NULL) get a
+    #     6-column variant that includes destination_account_id.
+    #
+    # We can't simply widen the index because Postgres treats NULLs as
+    # distinct in unique indexes, so two non-transfer rows with the same
+    # (family, account, merchant/name, amount, currency) but NULL
+    # destination would no longer collide.
+    remove_index :recurring_transactions, name: "idx_recurring_txns_acct_merchant", if_exists: true
+    remove_index :recurring_transactions, name: "idx_recurring_txns_acct_name", if_exists: true
+
+    add_index :recurring_transactions,
+      [ :family_id, :account_id, :merchant_id, :amount, :currency ],
+      unique: true,
+      where: "merchant_id IS NOT NULL AND destination_account_id IS NULL",
+      name: "idx_recurring_txns_acct_merchant"
+
+    add_index :recurring_transactions,
+      [ :family_id, :account_id, :name, :amount, :currency ],
+      unique: true,
+      where: "name IS NOT NULL AND merchant_id IS NULL AND destination_account_id IS NULL",
+      name: "idx_recurring_txns_acct_name"
+
+    add_index :recurring_transactions,
+      [ :family_id, :account_id, :destination_account_id, :merchant_id, :amount, :currency ],
+      unique: true,
+      where: "destination_account_id IS NOT NULL AND merchant_id IS NOT NULL",
+      name: "idx_recurring_txns_pair_merchant"
+
+    add_index :recurring_transactions,
+      [ :family_id, :account_id, :destination_account_id, :name, :amount, :currency ],
+      unique: true,
+      where: "destination_account_id IS NOT NULL AND name IS NOT NULL AND merchant_id IS NULL",
+      name: "idx_recurring_txns_pair_name"
+
+    # Enforce transfer invariants in the database alongside the model
+    # validations. Per CLAUDE.md: "Enforce null checks, unique indexes,
+    # and simple validations in the database schema for PostgreSQL".
+    add_check_constraint :recurring_transactions,
+      "destination_account_id IS NULL OR account_id IS NOT NULL",
+      name: "chk_recurring_txns_transfer_requires_source"
+
+    add_check_constraint :recurring_transactions,
+      "destination_account_id IS NULL OR destination_account_id <> account_id",
+      name: "chk_recurring_txns_transfer_distinct_accounts"
+  end
+
+  def down
+    # Transfer rows depend on destination_account_id, which the legacy
+    # schema doesn't model. Re-adding the legacy unique indexes after
+    # transfer rows exist would violate uniqueness on otherwise-identical
+    # (family, account, merchant/name, amount, currency) tuples that
+    # differ only by destination, so we drop transfer rows before
+    # restoring the old shape. Down migrations are expected to lose
+    # feature-specific data; the column itself is removed below anyway.
+    execute <<~SQL
+      DELETE FROM recurring_transactions
+      WHERE destination_account_id IS NOT NULL
+    SQL
+
+    remove_check_constraint :recurring_transactions, name: "chk_recurring_txns_transfer_requires_source"
+    remove_check_constraint :recurring_transactions, name: "chk_recurring_txns_transfer_distinct_accounts"
+
+    remove_index :recurring_transactions, name: "idx_recurring_txns_pair_merchant", if_exists: true
+    remove_index :recurring_transactions, name: "idx_recurring_txns_pair_name", if_exists: true
+    remove_index :recurring_transactions, name: "idx_recurring_txns_acct_merchant", if_exists: true
+    remove_index :recurring_transactions, name: "idx_recurring_txns_acct_name", if_exists: true
+
+    add_index :recurring_transactions,
+      [ :family_id, :account_id, :merchant_id, :amount, :currency ],
+      unique: true,
+      where: "merchant_id IS NOT NULL",
+      name: "idx_recurring_txns_acct_merchant"
+
+    add_index :recurring_transactions,
+      [ :family_id, :account_id, :name, :amount, :currency ],
+      unique: true,
+      where: "name IS NOT NULL AND merchant_id IS NULL",
+      name: "idx_recurring_txns_acct_name"
+
+    remove_foreign_key :recurring_transactions, :accounts, column: :account_id
+    add_foreign_key :recurring_transactions, :accounts, column: :account_id
+
+    # Drop the destination_account_id FK by referencing the actual `accounts`
+    # table; Rails would otherwise infer the table as `destination_accounts`
+    # (the pluralised reference name) and fail with `no foreign key`.
+    remove_foreign_key :recurring_transactions, column: :destination_account_id
+    remove_reference :recurring_transactions, :destination_account
+  end
+end
diff --git a/db/migrate/20260501142000_create_webauthn_credentials.rb b/db/migrate/20260501142000_create_webauthn_credentials.rb
new file mode 100644
index 000000000..fdd53900e
--- /dev/null
+++ b/db/migrate/20260501142000_create_webauthn_credentials.rb
@@ -0,0 +1,21 @@
+class CreateWebauthnCredentials < ActiveRecord::Migration[7.2]
+  def change
+    add_column :users, :webauthn_id, :string
+    add_index :users, :webauthn_id, unique: true, where: "webauthn_id IS NOT NULL"
+
+    create_table :webauthn_credentials, id: :uuid do |t|
+      t.references :user, null: false, foreign_key: true, type: :uuid
+      t.string :nickname, null: false
+      t.string :credential_id, null: false
+      t.text :public_key, null: false
+      t.bigint :sign_count, null: false, default: 0
+      t.string :transports, array: true, null: false, default: []
+      t.datetime :last_used_at
+
+      t.timestamps
+    end
+
+    add_index :webauthn_credentials, :credential_id, unique: true
+    add_check_constraint :webauthn_credentials, "sign_count >= 0", name: "chk_webauthn_credentials_sign_count_non_negative"
+  end
+end
diff --git a/db/migrate/20260502000000_add_source_row_number_to_import_rows.rb b/db/migrate/20260502000000_add_source_row_number_to_import_rows.rb
new file mode 100644
index 000000000..97b116cb1
--- /dev/null
+++ b/db/migrate/20260502000000_add_source_row_number_to_import_rows.rb
@@ -0,0 +1,27 @@
+class AddSourceRowNumberToImportRows < ActiveRecord::Migration[7.2]
+  def up
+    add_column :import_rows, :source_row_number, :integer
+
+    execute <<~SQL
+      WITH numbered AS (
+        SELECT id,
+               ROW_NUMBER() OVER (PARTITION BY import_id ORDER BY created_at, id) AS row_number
+        FROM import_rows
+      )
+      UPDATE import_rows
+      SET source_row_number = numbered.row_number
+      FROM numbered
+      WHERE import_rows.id = numbered.id
+    SQL
+
+    change_column_null :import_rows, :source_row_number, false
+    add_check_constraint :import_rows, "source_row_number > 0", name: "chk_import_rows_source_row_number_positive"
+    add_index :import_rows, [ :import_id, :source_row_number ], unique: true, name: "index_import_rows_on_import_id_and_source_row_number"
+  end
+
+  def down
+    remove_index :import_rows, name: "index_import_rows_on_import_id_and_source_row_number"
+    remove_check_constraint :import_rows, name: "chk_import_rows_source_row_number_positive"
+    remove_column :import_rows, :source_row_number
+  end
+end
diff --git a/db/migrate/20260502120000_fix_sophtron_schema_drift.rb b/db/migrate/20260502120000_fix_sophtron_schema_drift.rb
new file mode 100644
index 000000000..af8da7b0c
--- /dev/null
+++ b/db/migrate/20260502120000_fix_sophtron_schema_drift.rb
@@ -0,0 +1,36 @@
+# Aligns sophtron tables with constraints that PR #596 added to db/schema.rb
+# without writing a corresponding migration. Idempotent so envs that already
+# match (e.g., those bootstrapped via db:schema:load) re-run cleanly.
+class FixSophtronSchemaDrift < ActiveRecord::Migration[7.2]
+  disable_ddl_transaction!
+
+  INDEX_NAME = "idx_unique_sophtron_accounts_per_item".freeze
+
+  def up
+    unless index_exists?(:sophtron_accounts, [ :sophtron_item_id, :account_id ], unique: true, name: INDEX_NAME)
+      add_index :sophtron_accounts,
+                [ :sophtron_item_id, :account_id ],
+                unique: true,
+                name: INDEX_NAME,
+                algorithm: :concurrently
+    end
+
+    change_column_null :sophtron_items, :user_id, false if column_nullable?(:sophtron_items, :user_id)
+    change_column_null :sophtron_items, :access_key, false if column_nullable?(:sophtron_items, :access_key)
+  end
+
+  def down
+    if index_exists?(:sophtron_accounts, name: INDEX_NAME)
+      remove_index :sophtron_accounts, name: INDEX_NAME, algorithm: :concurrently
+    end
+
+    change_column_null :sophtron_items, :user_id, true
+    change_column_null :sophtron_items, :access_key, true
+  end
+
+  private
+
+    def column_nullable?(table, column)
+      connection.columns(table).find { |c| c.name == column.to_s }&.null
+    end
+end
diff --git a/db/migrate/20260503180000_rehash_plaintext_mfa_backup_codes.rb b/db/migrate/20260503180000_rehash_plaintext_mfa_backup_codes.rb
new file mode 100644
index 000000000..2987270b2
--- /dev/null
+++ b/db/migrate/20260503180000_rehash_plaintext_mfa_backup_codes.rb
@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+class RehashPlaintextMfaBackupCodes < ActiveRecord::Migration[7.2]
+  class MigrationUser < ActiveRecord::Base
+    self.table_name = "users"
+  end
+
+  BCRYPT_PREFIXES = %w[$2a$ $2b$ $2y$].freeze
+  PLAINTEXT_BACKUP_CODE_PATTERN = /\A[0-9a-f]{8}\z/
+
+  def up
+    require "bcrypt"
+
+    say_with_time "Rehashing plaintext MFA backup codes" do
+      rehashed_users_count = 0
+
+      MigrationUser.where(otp_required: true).find_each do |user|
+        backup_codes = Array(user.otp_backup_codes)
+        next if backup_codes.blank?
+        next unless backup_codes.any? { |code| plaintext_backup_code?(code) }
+
+        rehashed_codes = backup_codes.map do |code|
+          plaintext_backup_code?(code) ? BCrypt::Password.create(normalize_backup_code(code), cost: bcrypt_cost).to_s : code
+        end
+
+        user.update_columns(otp_backup_codes: rehashed_codes, updated_at: Time.current)
+        rehashed_users_count += 1
+      end
+
+      rehashed_users_count
+    end
+  end
+
+  def down
+    raise ActiveRecord::IrreversibleMigration
+  end
+
+  private
+    def plaintext_backup_code?(code)
+      normalized_code = normalize_backup_code(code)
+      normalized_code.match?(PLAINTEXT_BACKUP_CODE_PATTERN) && BCRYPT_PREFIXES.none? { |prefix| normalized_code.start_with?(prefix) }
+    end
+
+    def normalize_backup_code(code)
+      code.to_s.strip.downcase
+    end
+
+    def bcrypt_cost
+      ActiveModel::SecurePassword.min_cost ? BCrypt::Engine::MIN_COST : BCrypt::Engine.cost
+    end
+end
diff --git a/db/migrate/20260505010000_create_brex_items_and_accounts.rb b/db/migrate/20260505010000_create_brex_items_and_accounts.rb
new file mode 100644
index 000000000..a76820b11
--- /dev/null
+++ b/db/migrate/20260505010000_create_brex_items_and_accounts.rb
@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+class CreateBrexItemsAndAccounts < ActiveRecord::Migration[7.2]
+  def change
+    create_table :brex_items, id: :uuid do |t|
+      t.references :family, null: false, foreign_key: true, type: :uuid
+      t.string :name, null: false
+
+      t.string :institution_id
+      t.string :institution_name
+      t.string :institution_domain
+      t.string :institution_url
+      t.string :institution_color
+
+      t.string :status, null: false, default: "good"
+      t.boolean :scheduled_for_deletion, null: false, default: false
+      t.boolean :pending_account_setup, null: false, default: false
+
+      t.datetime :sync_start_date
+
+      t.jsonb :raw_payload
+      t.jsonb :raw_institution_payload
+
+      t.text :token, null: false
+      t.string :base_url
+
+      t.timestamps
+    end
+
+    add_index :brex_items, :status
+
+    create_table :brex_accounts, id: :uuid do |t|
+      t.references :brex_item, null: false, foreign_key: true, type: :uuid
+
+      t.string :name
+      t.string :account_id, null: false
+      t.string :account_kind, null: false, default: "cash"
+
+      t.string :currency, null: false, default: "USD"
+      t.decimal :current_balance, precision: 19, scale: 4
+      t.decimal :available_balance, precision: 19, scale: 4
+      t.decimal :account_limit, precision: 19, scale: 4
+      t.string :account_status
+      t.string :account_type
+      t.string :provider
+
+      t.jsonb :institution_metadata
+      t.jsonb :raw_payload
+      t.jsonb :raw_transactions_payload
+
+      t.timestamps
+    end
+
+    add_index :brex_accounts,
+              [ :brex_item_id, :account_id ],
+              unique: true,
+              name: "index_brex_accounts_on_item_and_account_id"
+  end
+end
diff --git a/db/migrate/20260505120000_create_account_statements.rb b/db/migrate/20260505120000_create_account_statements.rb
new file mode 100644
index 000000000..d31f73cfc
--- /dev/null
+++ b/db/migrate/20260505120000_create_account_statements.rb
@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+class CreateAccountStatements < ActiveRecord::Migration[7.2]
+  def change
+    create_table :account_statements, id: :uuid do |t|
+      t.references :family, null: false, foreign_key: { on_delete: :cascade }, type: :uuid
+      t.references :account, null: true, type: :uuid, foreign_key: { to_table: :accounts, on_delete: :nullify }
+      t.references :suggested_account, null: true, type: :uuid, foreign_key: { to_table: :accounts, on_delete: :nullify }
+
+      t.string :filename, null: false, limit: 255
+      t.string :content_type, null: false, limit: 100
+      t.bigint :byte_size, null: false
+      t.string :checksum, null: false, limit: 64
+      t.string :content_sha256
+      t.string :source, null: false, default: "manual_upload"
+      t.string :upload_status, null: false, default: "stored"
+
+      t.string :institution_name_hint, limit: 200
+      t.string :account_name_hint, limit: 200
+      t.string :account_last4_hint, limit: 4
+      t.date :period_start_on
+      t.date :period_end_on
+      t.decimal :opening_balance, precision: 19, scale: 4
+      t.decimal :closing_balance, precision: 19, scale: 4
+      t.string :currency, limit: 3
+
+      t.decimal :parser_confidence, precision: 5, scale: 4
+      t.decimal :match_confidence, precision: 5, scale: 4
+      t.string :review_status, null: false, default: "unmatched"
+      t.jsonb :sanitized_parser_output, null: false, default: {}
+
+      t.timestamps
+
+      t.index [ :family_id, :checksum ], name: "index_account_statements_on_family_checksum"
+      t.index [ :family_id, :content_sha256 ],
+              unique: true,
+              where: "content_sha256 IS NOT NULL",
+              name: "index_account_statements_on_family_content_sha256"
+      t.index [ :family_id, :review_status ], name: "index_account_statements_on_family_review_status"
+      t.index [ :account_id, :period_start_on, :period_end_on ], name: "index_account_statements_on_account_period"
+      t.index [ :suggested_account_id, :review_status ], name: "index_account_statements_on_suggested_account_review"
+    end
+
+    add_check_constraint :account_statements, "byte_size > 0", name: "chk_account_statements_byte_size_positive"
+    add_check_constraint :account_statements,
+                         "char_length(filename) <= 255",
+                         name: "chk_account_statements_filename_length"
+    add_check_constraint :account_statements,
+                         "char_length(content_type) <= 100",
+                         name: "chk_account_statements_content_type_length"
+    add_check_constraint :account_statements,
+                         "char_length(checksum) <= 64",
+                         name: "chk_account_statements_checksum_length"
+    add_check_constraint :account_statements,
+                         "institution_name_hint IS NULL OR char_length(institution_name_hint) <= 200",
+                         name: "chk_account_statements_institution_hint_length"
+    add_check_constraint :account_statements,
+                         "account_name_hint IS NULL OR char_length(account_name_hint) <= 200",
+                         name: "chk_account_statements_account_name_hint_length"
+    add_check_constraint :account_statements,
+                         "account_last4_hint IS NULL OR char_length(account_last4_hint) <= 4",
+                         name: "chk_account_statements_account_last4_hint_length"
+    add_check_constraint :account_statements,
+                         "currency IS NULL OR char_length(currency) <= 3",
+                         name: "chk_account_statements_currency_length"
+    add_check_constraint :account_statements,
+                         "period_start_on IS NULL OR period_end_on IS NULL OR period_start_on <= period_end_on",
+                         name: "chk_account_statements_period_order"
+    add_check_constraint :account_statements,
+                         "parser_confidence IS NULL OR (parser_confidence >= 0 AND parser_confidence <= 1)",
+                         name: "chk_account_statements_parser_confidence"
+    add_check_constraint :account_statements,
+                         "match_confidence IS NULL OR (match_confidence >= 0 AND match_confidence <= 1)",
+                         name: "chk_account_statements_match_confidence"
+    add_check_constraint :account_statements,
+                         "byte_size <= 26214400",
+                         name: "chk_account_statements_byte_size_max"
+    add_check_constraint :account_statements,
+                         "source IN ('manual_upload')",
+                         name: "chk_account_statements_source"
+    add_check_constraint :account_statements,
+                         "upload_status IN ('stored', 'failed')",
+                         name: "chk_account_statements_upload_status"
+    add_check_constraint :account_statements,
+                         "review_status IN ('unmatched', 'linked', 'rejected')",
+                         name: "chk_account_statements_review_status"
+    add_check_constraint :account_statements,
+                         "content_sha256 IS NULL OR content_sha256 ~ '^[0-9a-f]{64}$'",
+                         name: "chk_account_statements_content_sha256"
+  end
+end
diff --git a/db/migrate/20260507120000_add_sophtron_connection_state.rb b/db/migrate/20260507120000_add_sophtron_connection_state.rb
new file mode 100644
index 000000000..8abe44621
--- /dev/null
+++ b/db/migrate/20260507120000_add_sophtron_connection_state.rb
@@ -0,0 +1,20 @@
+class AddSophtronConnectionState < ActiveRecord::Migration[7.2]
+  def change
+    change_column_null :sophtron_accounts, :customer_id, true
+    change_column_null :sophtron_accounts, :member_id, true
+
+    add_column :sophtron_accounts, :account_number_mask, :string
+
+    add_column :sophtron_items, :customer_id, :string
+    add_column :sophtron_items, :customer_name, :string
+    add_column :sophtron_items, :raw_customer_payload, :jsonb
+    add_column :sophtron_items, :user_institution_id, :string
+    add_column :sophtron_items, :current_job_id, :string
+    add_column :sophtron_items, :job_status, :string
+    add_column :sophtron_items, :raw_job_payload, :jsonb
+    add_column :sophtron_items, :last_connection_error, :text
+
+    add_index :sophtron_items, :customer_id
+    add_index :sophtron_items, :user_institution_id
+  end
+end
diff --git a/db/migrate/20260508120000_add_manual_sync_to_sophtron_items.rb b/db/migrate/20260508120000_add_manual_sync_to_sophtron_items.rb
new file mode 100644
index 000000000..ce94f6460
--- /dev/null
+++ b/db/migrate/20260508120000_add_manual_sync_to_sophtron_items.rb
@@ -0,0 +1,7 @@
+class AddManualSyncToSophtronItems < ActiveRecord::Migration[7.2]
+  def change
+    add_column :sophtron_items, :manual_sync, :boolean, null: false, default: false
+    add_column :sophtron_items, :current_job_sophtron_account_id, :uuid
+    add_index :sophtron_items, :current_job_sophtron_account_id
+  end
+end
diff --git a/db/migrate/20260508130000_add_manual_sync_to_sophtron_accounts.rb b/db/migrate/20260508130000_add_manual_sync_to_sophtron_accounts.rb
new file mode 100644
index 000000000..e36357cc0
--- /dev/null
+++ b/db/migrate/20260508130000_add_manual_sync_to_sophtron_accounts.rb
@@ -0,0 +1,17 @@
+class AddManualSyncToSophtronAccounts < ActiveRecord::Migration[7.2]
+  def change
+    add_column :sophtron_accounts, :manual_sync, :boolean, default: false, null: false
+
+    reversible do |dir|
+      dir.up do
+        execute <<~SQL.squish
+          UPDATE sophtron_accounts
+          SET manual_sync = TRUE
+          FROM sophtron_items
+          WHERE sophtron_accounts.sophtron_item_id = sophtron_items.id
+            AND sophtron_items.manual_sync = TRUE
+        SQL
+      end
+    end
+  end
+end
diff --git a/db/migrate/20260510120000_add_last_sync_all_attempted_at_to_families.rb b/db/migrate/20260510120000_add_last_sync_all_attempted_at_to_families.rb
new file mode 100644
index 000000000..0ab431f0a
--- /dev/null
+++ b/db/migrate/20260510120000_add_last_sync_all_attempted_at_to_families.rb
@@ -0,0 +1,5 @@
+class AddLastSyncAllAttemptedAtToFamilies < ActiveRecord::Migration[7.2]
+  def change
+    add_column :families, :last_sync_all_attempted_at, :datetime
+  end
+end
diff --git a/db/migrate/20260511090000_create_kraken_items_and_accounts.rb b/db/migrate/20260511090000_create_kraken_items_and_accounts.rb
new file mode 100644
index 000000000..48890a85c
--- /dev/null
+++ b/db/migrate/20260511090000_create_kraken_items_and_accounts.rb
@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+class CreateKrakenItemsAndAccounts < ActiveRecord::Migration[7.2]
+  def change
+    create_table :kraken_items, id: :uuid do |t|
+      t.references :family, null: false, foreign_key: true, type: :uuid
+      t.string :name
+
+      t.string :institution_name
+      t.string :institution_domain
+      t.string :institution_url
+      t.string :institution_color
+
+      t.string :status, default: "good", null: false
+      t.boolean :scheduled_for_deletion, default: false, null: false
+      t.boolean :pending_account_setup, default: false, null: false
+
+      t.datetime :sync_start_date
+      t.jsonb :raw_payload
+
+      t.text :api_key
+      t.text :api_secret
+      t.bigint :last_nonce, default: 0, null: false
+
+      t.timestamps
+    end
+
+    add_index :kraken_items, :status
+
+    create_table :kraken_accounts, id: :uuid do |t|
+      t.references :kraken_item, null: false, foreign_key: true, type: :uuid
+
+      t.string :name
+      t.string :account_id, null: false
+      t.string :account_type
+      t.string :currency
+      t.decimal :current_balance, precision: 19, scale: 4
+
+      t.jsonb :institution_metadata
+      t.jsonb :raw_payload
+      t.jsonb :raw_transactions_payload
+      t.jsonb :extra, default: {}, null: false
+
+      t.timestamps
+    end
+
+    add_index :kraken_accounts, :account_type
+    add_index :kraken_accounts,
+              [ :kraken_item_id, :account_id ],
+              unique: true,
+              name: "index_kraken_accounts_on_item_and_account_id"
+  end
+end
diff --git a/db/migrate/20260512210600_create_ibkr_items_and_accounts.rb b/db/migrate/20260512210600_create_ibkr_items_and_accounts.rb
new file mode 100644
index 000000000..b1daaeb2b
--- /dev/null
+++ b/db/migrate/20260512210600_create_ibkr_items_and_accounts.rb
@@ -0,0 +1,41 @@
+class CreateIbkrItemsAndAccounts < ActiveRecord::Migration[7.2]
+  def change
+    create_table :ibkr_items, id: :uuid do |t|
+      t.references :family, null: false, foreign_key: true, type: :uuid
+      t.string :name
+      t.string :status, default: "good", null: false
+      t.boolean :scheduled_for_deletion, default: false, null: false
+      t.boolean :pending_account_setup, default: false, null: false
+      t.jsonb :raw_payload
+      t.string :query_id
+      t.string :token
+
+      t.timestamps
+    end
+
+    add_index :ibkr_items, :status
+
+    create_table :ibkr_accounts, id: :uuid do |t|
+      t.references :ibkr_item, null: false, foreign_key: true, type: :uuid
+      t.string :name
+      t.string :ibkr_account_id
+      t.string :currency
+      t.decimal :current_balance, precision: 19, scale: 4
+      t.decimal :cash_balance, precision: 19, scale: 4
+      t.jsonb :institution_metadata
+      t.jsonb :raw_holdings_payload, default: [], null: false
+      t.jsonb :raw_activities_payload, default: {}, null: false
+      t.jsonb :raw_cash_report_payload, default: [], null: false
+      t.date :report_date
+      t.datetime :last_holdings_sync
+      t.datetime :last_activities_sync
+
+      t.timestamps
+    end
+
+    add_index :ibkr_accounts, [ :ibkr_item_id, :ibkr_account_id ],
+      unique: true,
+      where: "(ibkr_account_id IS NOT NULL)",
+      name: "index_ibkr_accounts_on_item_and_ibkr_account_id"
+  end
+end
diff --git a/db/migrate/20260512211000_add_extra_to_trades.rb b/db/migrate/20260512211000_add_extra_to_trades.rb
new file mode 100644
index 000000000..2e27be775
--- /dev/null
+++ b/db/migrate/20260512211000_add_extra_to_trades.rb
@@ -0,0 +1,6 @@
+class AddExtraToTrades < ActiveRecord::Migration[7.2]
+  def change
+    add_column :trades, :extra, :jsonb, default: {}, null: false
+    add_index :trades, :extra, using: :gin
+  end
+end
diff --git a/db/migrate/20260512211200_add_raw_equity_summary_payload_to_ibkr_accounts.rb b/db/migrate/20260512211200_add_raw_equity_summary_payload_to_ibkr_accounts.rb
new file mode 100644
index 000000000..d3f9e7969
--- /dev/null
+++ b/db/migrate/20260512211200_add_raw_equity_summary_payload_to_ibkr_accounts.rb
@@ -0,0 +1,5 @@
+class AddRawEquitySummaryPayloadToIbkrAccounts < ActiveRecord::Migration[7.2]
+  def change
+    add_column :ibkr_accounts, :raw_equity_summary_payload, :jsonb, default: [], null: false
+  end
+end
diff --git a/db/migrate/20260517122500_create_debug_log_entries.rb b/db/migrate/20260517122500_create_debug_log_entries.rb
new file mode 100644
index 000000000..34755fb5a
--- /dev/null
+++ b/db/migrate/20260517122500_create_debug_log_entries.rb
@@ -0,0 +1,35 @@
+class CreateDebugLogEntries < ActiveRecord::Migration[7.2]
+  def up
+    create_table :debug_log_entries, id: :uuid do |t|
+      t.string :category, null: false
+      t.string :level, null: false
+      t.text :message, null: false
+      t.string :source, null: false
+      t.jsonb :metadata, null: false, default: {}
+      t.references :family, type: :uuid, foreign_key: { on_delete: :nullify }, null: true
+      t.references :account, type: :uuid, foreign_key: { on_delete: :nullify }, null: true
+      t.references :user, type: :uuid, foreign_key: { on_delete: :nullify }, null: true
+      t.references :account_provider, type: :uuid, foreign_key: { on_delete: :nullify }, null: true
+      t.string :provider_key
+
+      t.timestamps
+    end
+
+    add_check_constraint :debug_log_entries,
+      "level IN ('debug', 'info', 'warn', 'error')",
+      name: "chk_debug_log_entries_level"
+
+    add_index :debug_log_entries, :created_at
+    add_index :debug_log_entries, :category
+    add_index :debug_log_entries, :level
+    add_index :debug_log_entries, :source
+    add_index :debug_log_entries, :provider_key
+    add_index :debug_log_entries, [ :category, :created_at ]
+    add_index :debug_log_entries, [ :provider_key, :created_at ]
+  end
+
+  def down
+    remove_check_constraint :debug_log_entries, name: "chk_debug_log_entries_level", if_exists: true
+    drop_table :debug_log_entries
+  end
+end
diff --git a/db/migrate/20260519092118_rename_beta_features_enabled_preference.rb b/db/migrate/20260519092118_rename_beta_features_enabled_preference.rb
new file mode 100644
index 000000000..6e9f36ea3
--- /dev/null
+++ b/db/migrate/20260519092118_rename_beta_features_enabled_preference.rb
@@ -0,0 +1,30 @@
+class RenameBetaFeaturesEnabledPreference < ActiveRecord::Migration[7.2]
+  # Renames the JSONB preference key `beta_features_enabled` to
+  # `preview_features_enabled` for every user that has the old key set.
+  # The gate was introduced in PR #1829 and never moved past the Goals
+  # rollout, so opt-in counts are small — but copying the value across keeps
+  # any early adopters opted in after the rename.
+  def up
+    execute(<<~SQL)
+      UPDATE users
+      SET preferences = (preferences - 'beta_features_enabled')
+        || jsonb_build_object(
+          'preview_features_enabled',
+          COALESCE(preferences->'preview_features_enabled', preferences->'beta_features_enabled')
+        )
+      WHERE preferences ? 'beta_features_enabled'
+    SQL
+  end
+
+  def down
+    execute(<<~SQL)
+      UPDATE users
+      SET preferences = (preferences - 'preview_features_enabled')
+        || jsonb_build_object(
+          'beta_features_enabled',
+          COALESCE(preferences->'beta_features_enabled', preferences->'preview_features_enabled')
+        )
+      WHERE preferences ? 'preview_features_enabled'
+    SQL
+  end
+end
diff --git a/db/migrate/20260519100000_add_sure_import_verification_to_imports.rb b/db/migrate/20260519100000_add_sure_import_verification_to_imports.rb
new file mode 100644
index 000000000..d73a24fd5
--- /dev/null
+++ b/db/migrate/20260519100000_add_sure_import_verification_to_imports.rb
@@ -0,0 +1,6 @@
+class AddSureImportVerificationToImports < ActiveRecord::Migration[7.2]
+  def change
+    add_column :imports, :expected_record_counts, :jsonb, null: false, default: {}
+    add_column :imports, :readback_verification, :jsonb, null: false, default: {}
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 4550680c6..99248fca5 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
+ActiveRecord::Schema[7.2].define(version: 2026_05_19_100000) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "pgcrypto"
   enable_extension "plpgsql"
@@ -43,6 +43,57 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.check_constraint "permission::text = ANY (ARRAY['full_control'::character varying::text, 'read_write'::character varying::text, 'read_only'::character varying::text])", name: "chk_account_shares_permission"
   end
 
+  create_table "account_statements", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "family_id", null: false
+    t.uuid "account_id"
+    t.uuid "suggested_account_id"
+    t.string "filename", limit: 255, null: false
+    t.string "content_type", limit: 100, null: false
+    t.bigint "byte_size", null: false
+    t.string "checksum", limit: 64, null: false
+    t.string "source", default: "manual_upload", null: false
+    t.string "upload_status", default: "stored", null: false
+    t.string "institution_name_hint", limit: 200
+    t.string "account_name_hint", limit: 200
+    t.string "account_last4_hint", limit: 4
+    t.date "period_start_on"
+    t.date "period_end_on"
+    t.decimal "opening_balance", precision: 19, scale: 4
+    t.decimal "closing_balance", precision: 19, scale: 4
+    t.string "currency", limit: 3
+    t.decimal "parser_confidence", precision: 5, scale: 4
+    t.decimal "match_confidence", precision: 5, scale: 4
+    t.string "review_status", default: "unmatched", null: false
+    t.jsonb "sanitized_parser_output", default: {}, null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.string "content_sha256"
+    t.index ["account_id", "period_start_on", "period_end_on"], name: "index_account_statements_on_account_period"
+    t.index ["account_id"], name: "index_account_statements_on_account_id"
+    t.index ["family_id", "checksum"], name: "index_account_statements_on_family_checksum"
+    t.index ["family_id", "content_sha256"], name: "index_account_statements_on_family_content_sha256", unique: true, where: "(content_sha256 IS NOT NULL)"
+    t.index ["family_id", "review_status"], name: "index_account_statements_on_family_review_status"
+    t.index ["family_id"], name: "index_account_statements_on_family_id"
+    t.index ["suggested_account_id", "review_status"], name: "index_account_statements_on_suggested_account_review"
+    t.index ["suggested_account_id"], name: "index_account_statements_on_suggested_account_id"
+    t.check_constraint "account_last4_hint IS NULL OR char_length(account_last4_hint::text) <= 4", name: "chk_account_statements_account_last4_hint_length"
+    t.check_constraint "account_name_hint IS NULL OR char_length(account_name_hint::text) <= 200", name: "chk_account_statements_account_name_hint_length"
+    t.check_constraint "byte_size <= 26214400", name: "chk_account_statements_byte_size_max"
+    t.check_constraint "byte_size > 0", name: "chk_account_statements_byte_size_positive"
+    t.check_constraint "char_length(checksum::text) <= 64", name: "chk_account_statements_checksum_length"
+    t.check_constraint "char_length(content_type::text) <= 100", name: "chk_account_statements_content_type_length"
+    t.check_constraint "char_length(filename::text) <= 255", name: "chk_account_statements_filename_length"
+    t.check_constraint "content_sha256 IS NULL OR content_sha256::text ~ '^[0-9a-f]{64}$'::text", name: "chk_account_statements_content_sha256"
+    t.check_constraint "currency IS NULL OR char_length(currency::text) <= 3", name: "chk_account_statements_currency_length"
+    t.check_constraint "institution_name_hint IS NULL OR char_length(institution_name_hint::text) <= 200", name: "chk_account_statements_institution_hint_length"
+    t.check_constraint "match_confidence IS NULL OR match_confidence >= 0::numeric AND match_confidence <= 1::numeric", name: "chk_account_statements_match_confidence"
+    t.check_constraint "parser_confidence IS NULL OR parser_confidence >= 0::numeric AND parser_confidence <= 1::numeric", name: "chk_account_statements_parser_confidence"
+    t.check_constraint "period_start_on IS NULL OR period_end_on IS NULL OR period_start_on <= period_end_on", name: "chk_account_statements_period_order"
+    t.check_constraint "review_status::text = ANY (ARRAY['unmatched'::character varying::text, 'linked'::character varying::text, 'rejected'::character varying::text])", name: "chk_account_statements_review_status"
+    t.check_constraint "source::text = 'manual_upload'::text", name: "chk_account_statements_source"
+    t.check_constraint "upload_status::text = ANY (ARRAY['stored'::character varying::text, 'failed'::character varying::text])", name: "chk_account_statements_upload_status"
+  end
+
   create_table "accounts", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
     t.string "subtype"
     t.uuid "family_id", null: false
@@ -116,7 +167,7 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.string "locality"
     t.string "region"
     t.string "country"
-    t.integer "postal_code"
+    t.string "postal_code"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
     t.index ["addressable_type", "addressable_id"], name: "index_addresses_on_addressable"
@@ -201,9 +252,9 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.string "institution_domain"
     t.string "institution_url"
     t.string "institution_color"
-    t.string "status", default: "good"
-    t.boolean "scheduled_for_deletion", default: false
-    t.boolean "pending_account_setup", default: false
+    t.string "status", default: "good", null: false
+    t.boolean "scheduled_for_deletion", default: false, null: false
+    t.boolean "pending_account_setup", default: false, null: false
     t.datetime "sync_start_date"
     t.jsonb "raw_payload"
     t.text "api_key"
@@ -214,6 +265,49 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.index ["status"], name: "index_binance_items_on_status"
   end
 
+  create_table "brex_accounts", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "brex_item_id", null: false
+    t.string "name"
+    t.string "account_id", null: false
+    t.string "account_kind", default: "cash", null: false
+    t.string "currency", default: "USD", null: false
+    t.decimal "current_balance", precision: 19, scale: 4
+    t.decimal "available_balance", precision: 19, scale: 4
+    t.decimal "account_limit", precision: 19, scale: 4
+    t.string "account_status"
+    t.string "account_type"
+    t.string "provider"
+    t.jsonb "institution_metadata"
+    t.jsonb "raw_payload"
+    t.jsonb "raw_transactions_payload"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["brex_item_id", "account_id"], name: "index_brex_accounts_on_item_and_account_id", unique: true
+    t.index ["brex_item_id"], name: "index_brex_accounts_on_brex_item_id"
+  end
+
+  create_table "brex_items", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "family_id", null: false
+    t.string "name", null: false
+    t.string "institution_id"
+    t.string "institution_name"
+    t.string "institution_domain"
+    t.string "institution_url"
+    t.string "institution_color"
+    t.string "status", default: "good", null: false
+    t.boolean "scheduled_for_deletion", default: false, null: false
+    t.boolean "pending_account_setup", default: false, null: false
+    t.datetime "sync_start_date"
+    t.jsonb "raw_payload"
+    t.jsonb "raw_institution_payload"
+    t.text "token", null: false
+    t.string "base_url"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["family_id"], name: "index_brex_items_on_family_id"
+    t.index ["status"], name: "index_brex_items_on_status"
+  end
+
   create_table "budget_categories", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
     t.uuid "budget_id", null: false
     t.uuid "category_id", null: false
@@ -380,6 +474,33 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.index ["enrichable_type", "enrichable_id"], name: "index_data_enrichments_on_enrichable"
   end
 
+  create_table "debug_log_entries", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.string "category", null: false
+    t.string "level", null: false
+    t.text "message", null: false
+    t.string "source", null: false
+    t.jsonb "metadata", default: {}, null: false
+    t.uuid "family_id"
+    t.uuid "account_id"
+    t.uuid "user_id"
+    t.uuid "account_provider_id"
+    t.string "provider_key"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["account_id"], name: "index_debug_log_entries_on_account_id"
+    t.index ["account_provider_id"], name: "index_debug_log_entries_on_account_provider_id"
+    t.index ["category", "created_at"], name: "index_debug_log_entries_on_category_and_created_at"
+    t.index ["category"], name: "index_debug_log_entries_on_category"
+    t.index ["created_at"], name: "index_debug_log_entries_on_created_at"
+    t.index ["family_id"], name: "index_debug_log_entries_on_family_id"
+    t.index ["level"], name: "index_debug_log_entries_on_level"
+    t.index ["provider_key", "created_at"], name: "index_debug_log_entries_on_provider_key_and_created_at"
+    t.index ["provider_key"], name: "index_debug_log_entries_on_provider_key"
+    t.index ["source"], name: "index_debug_log_entries_on_source"
+    t.index ["user_id"], name: "index_debug_log_entries_on_user_id"
+    t.check_constraint "level::text = ANY (ARRAY['debug'::character varying, 'info'::character varying, 'warn'::character varying, 'error'::character varying]::text[])", name: "chk_debug_log_entries_level"
+  end
+
   create_table "depositories", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
@@ -403,8 +524,12 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.jsonb "raw_transactions_payload"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
+    t.string "product"
+    t.decimal "credit_limit", precision: 19, scale: 4
+    t.jsonb "identification_hashes", default: []
     t.index ["account_id"], name: "index_enable_banking_accounts_on_account_id"
     t.index ["enable_banking_item_id"], name: "index_enable_banking_accounts_on_enable_banking_item_id"
+    t.index ["identification_hashes"], name: "index_enable_banking_accounts_on_identification_hashes", using: :gin
   end
 
   create_table "enable_banking_items", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
@@ -418,7 +543,7 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.string "status", default: "good"
     t.boolean "scheduled_for_deletion", default: false
     t.boolean "pending_account_setup", default: false
-    t.datetime "sync_start_date"
+    t.date "sync_start_date"
     t.jsonb "raw_payload"
     t.jsonb "raw_institution_payload"
     t.string "country_code"
@@ -431,6 +556,12 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.string "authorization_id"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
+    t.jsonb "aspsp_required_psu_headers", default: []
+    t.integer "aspsp_maximum_consent_validity"
+    t.string "aspsp_auth_approach"
+    t.jsonb "aspsp_psu_types", default: []
+    t.string "last_psu_ip"
+    t.string "psu_type"
     t.index ["family_id"], name: "index_enable_banking_items_on_family_id"
     t.index ["status"], name: "index_enable_banking_items_on_status"
   end
@@ -541,6 +672,16 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.index ["tags"], name: "index_eval_samples_on_tags", using: :gin
   end
 
+  create_table "exchange_rate_pairs", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.string "from_currency", null: false
+    t.string "to_currency", null: false
+    t.date "first_provider_rate_on"
+    t.string "provider_name"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["from_currency", "to_currency"], name: "index_exchange_rate_pairs_on_pair_unique", unique: true
+  end
+
   create_table "exchange_rates", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
     t.string "from_currency", null: false
     t.string "to_currency", null: false
@@ -574,6 +715,8 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.string "moniker", default: "Family", null: false
     t.string "assistant_type", default: "builtin", null: false
     t.string "default_account_sharing", default: "shared", null: false
+    t.string "enabled_currencies", array: true
+    t.datetime "last_sync_all_attempted_at"
     t.check_constraint "default_account_sharing::text = ANY (ARRAY['shared'::character varying::text, 'private'::character varying::text])", name: "chk_families_default_account_sharing"
     t.check_constraint "month_start_day >= 1 AND month_start_day <= 28", name: "month_start_day_range"
   end
@@ -637,6 +780,42 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.index ["security_id"], name: "index_holdings_on_security_id"
   end
 
+  create_table "ibkr_accounts", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "ibkr_item_id", null: false
+    t.string "name"
+    t.string "ibkr_account_id"
+    t.string "currency"
+    t.decimal "current_balance", precision: 19, scale: 4
+    t.decimal "cash_balance", precision: 19, scale: 4
+    t.jsonb "institution_metadata"
+    t.jsonb "raw_holdings_payload", default: []
+    t.jsonb "raw_activities_payload", default: {}
+    t.jsonb "raw_cash_report_payload", default: []
+    t.date "report_date"
+    t.datetime "last_holdings_sync"
+    t.datetime "last_activities_sync"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.jsonb "raw_equity_summary_payload", default: [], null: false
+    t.index ["ibkr_item_id", "ibkr_account_id"], name: "index_ibkr_accounts_on_item_and_ibkr_account_id", unique: true, where: "(ibkr_account_id IS NOT NULL)"
+    t.index ["ibkr_item_id"], name: "index_ibkr_accounts_on_ibkr_item_id"
+  end
+
+  create_table "ibkr_items", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "family_id", null: false
+    t.string "name"
+    t.string "status", default: "good"
+    t.boolean "scheduled_for_deletion", default: false
+    t.boolean "pending_account_setup", default: false, null: false
+    t.jsonb "raw_payload"
+    t.string "query_id"
+    t.string "token"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["family_id"], name: "index_ibkr_items_on_family_id"
+    t.index ["status"], name: "index_ibkr_items_on_status"
+  end
+
   create_table "impersonation_session_logs", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
     t.uuid "impersonation_session_id", null: false
     t.string "controller"
@@ -700,7 +879,10 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.string "effective_date"
     t.text "conditions"
     t.text "actions"
+    t.integer "source_row_number", null: false
+    t.index ["import_id", "source_row_number"], name: "index_import_rows_on_import_id_and_source_row_number", unique: true
     t.index ["import_id"], name: "index_import_rows_on_import_id"
+    t.check_constraint "source_row_number > 0", name: "chk_import_rows_source_row_number_positive"
   end
 
   create_table "imports", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
@@ -739,6 +921,8 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.text "ai_summary"
     t.string "document_type"
     t.jsonb "extracted_data"
+    t.jsonb "expected_record_counts", default: {}, null: false
+    t.jsonb "readback_verification", default: {}, null: false
     t.index ["family_id"], name: "index_imports_on_family_id"
   end
 
@@ -828,6 +1012,45 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.index ["token_digest"], name: "index_invite_codes_on_token_digest", unique: true, where: "(token_digest IS NOT NULL)"
   end
 
+  create_table "kraken_accounts", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "kraken_item_id", null: false
+    t.string "name"
+    t.string "account_id", null: false
+    t.string "account_type"
+    t.string "currency"
+    t.decimal "current_balance", precision: 19, scale: 4
+    t.jsonb "institution_metadata"
+    t.jsonb "raw_payload"
+    t.jsonb "raw_transactions_payload"
+    t.jsonb "extra", default: {}, null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["account_type"], name: "index_kraken_accounts_on_account_type"
+    t.index ["kraken_item_id", "account_id"], name: "index_kraken_accounts_on_item_and_account_id", unique: true
+    t.index ["kraken_item_id"], name: "index_kraken_accounts_on_kraken_item_id"
+  end
+
+  create_table "kraken_items", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "family_id", null: false
+    t.string "name"
+    t.string "institution_name"
+    t.string "institution_domain"
+    t.string "institution_url"
+    t.string "institution_color"
+    t.string "status", default: "good", null: false
+    t.boolean "scheduled_for_deletion", default: false, null: false
+    t.boolean "pending_account_setup", default: false, null: false
+    t.datetime "sync_start_date"
+    t.jsonb "raw_payload"
+    t.text "api_key"
+    t.text "api_secret"
+    t.bigint "last_nonce", default: 0, null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["family_id"], name: "index_kraken_items_on_family_id"
+    t.index ["status"], name: "index_kraken_items_on_status"
+  end
+
   create_table "llm_usages", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
     t.uuid "family_id", null: false
     t.string "provider", null: false
@@ -1143,13 +1366,19 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.decimal "expected_amount_max", precision: 19, scale: 4
     t.decimal "expected_amount_avg", precision: 19, scale: 4
     t.uuid "account_id"
+    t.uuid "destination_account_id"
     t.index ["account_id"], name: "index_recurring_transactions_on_account_id"
-    t.index ["family_id", "account_id", "merchant_id", "amount", "currency"], name: "idx_recurring_txns_acct_merchant", unique: true, where: "(merchant_id IS NOT NULL)"
-    t.index ["family_id", "account_id", "name", "amount", "currency"], name: "idx_recurring_txns_acct_name", unique: true, where: "((name IS NOT NULL) AND (merchant_id IS NULL))"
+    t.index ["destination_account_id"], name: "index_recurring_transactions_on_destination_account_id"
+    t.index ["family_id", "account_id", "destination_account_id", "merchant_id", "amount", "currency"], name: "idx_recurring_txns_pair_merchant", unique: true, where: "((destination_account_id IS NOT NULL) AND (merchant_id IS NOT NULL))"
+    t.index ["family_id", "account_id", "destination_account_id", "name", "amount", "currency"], name: "idx_recurring_txns_pair_name", unique: true, where: "((destination_account_id IS NOT NULL) AND (name IS NOT NULL) AND (merchant_id IS NULL))"
+    t.index ["family_id", "account_id", "merchant_id", "amount", "currency"], name: "idx_recurring_txns_acct_merchant", unique: true, where: "((merchant_id IS NOT NULL) AND (destination_account_id IS NULL))"
+    t.index ["family_id", "account_id", "name", "amount", "currency"], name: "idx_recurring_txns_acct_name", unique: true, where: "((name IS NOT NULL) AND (merchant_id IS NULL) AND (destination_account_id IS NULL))"
     t.index ["family_id", "status"], name: "index_recurring_transactions_on_family_id_and_status"
     t.index ["family_id"], name: "index_recurring_transactions_on_family_id"
     t.index ["merchant_id"], name: "index_recurring_transactions_on_merchant_id"
     t.index ["next_expected_date"], name: "index_recurring_transactions_on_next_expected_date"
+    t.check_constraint "destination_account_id IS NULL OR account_id IS NOT NULL", name: "chk_recurring_txns_transfer_requires_source"
+    t.check_constraint "destination_account_id IS NULL OR destination_account_id <> account_id", name: "chk_recurring_txns_transfer_distinct_accounts"
   end
 
   create_table "rejected_transfers", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
@@ -1246,11 +1475,16 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.datetime "last_health_check_at"
     t.string "website_url"
     t.string "kind", default: "standard", null: false
+    t.string "price_provider"
+    t.string "offline_reason"
+    t.date "first_provider_price_on"
     t.index "upper((ticker)::text), COALESCE(upper((exchange_operating_mic)::text), ''::text)", name: "index_securities_on_ticker_and_exchange_operating_mic_unique", unique: true
     t.index ["country_code"], name: "index_securities_on_country_code"
     t.index ["exchange_operating_mic"], name: "index_securities_on_exchange_operating_mic"
     t.index ["kind"], name: "index_securities_on_kind"
-    t.check_constraint "kind::text = ANY (ARRAY['standard'::character varying, 'cash'::character varying]::text[])", name: "chk_securities_kind"
+    t.index ["price_provider", "offline_reason"], name: "index_securities_on_price_provider_and_offline_reason"
+    t.index ["price_provider"], name: "index_securities_on_price_provider"
+    t.check_constraint "kind::text = ANY (ARRAY['standard'::character varying::text, 'cash'::character varying::text])", name: "chk_securities_kind"
   end
 
   create_table "security_prices", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
@@ -1388,6 +1622,67 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.index ["status"], name: "index_snaptrade_items_on_status"
   end
 
+  create_table "sophtron_accounts", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "sophtron_item_id", null: false
+    t.string "name", null: false
+    t.string "account_id", null: false
+    t.string "currency"
+    t.decimal "balance", precision: 19, scale: 4
+    t.decimal "available_balance", precision: 19, scale: 4
+    t.string "account_status"
+    t.string "account_type"
+    t.string "account_sub_type"
+    t.datetime "last_updated"
+    t.jsonb "institution_metadata"
+    t.jsonb "raw_payload"
+    t.jsonb "raw_transactions_payload"
+    t.string "customer_id"
+    t.string "member_id"
+    t.string "account_number_mask"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.boolean "manual_sync", default: false, null: false
+    t.index ["account_id"], name: "index_sophtron_accounts_on_account_id"
+    t.index ["sophtron_item_id", "account_id"], name: "idx_unique_sophtron_accounts_per_item", unique: true
+    t.index ["sophtron_item_id"], name: "index_sophtron_accounts_on_sophtron_item_id"
+  end
+
+  create_table "sophtron_items", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "family_id", null: false
+    t.string "name"
+    t.string "institution_id"
+    t.string "institution_name"
+    t.string "institution_domain"
+    t.string "institution_url"
+    t.string "institution_color"
+    t.string "status", default: "good"
+    t.boolean "scheduled_for_deletion", default: false
+    t.boolean "pending_account_setup", default: false
+    t.datetime "sync_start_date"
+    t.jsonb "raw_payload"
+    t.jsonb "raw_institution_payload"
+    t.string "user_id", null: false
+    t.string "access_key", null: false
+    t.string "base_url"
+    t.string "customer_id"
+    t.string "customer_name"
+    t.jsonb "raw_customer_payload"
+    t.string "user_institution_id"
+    t.string "current_job_id"
+    t.string "job_status"
+    t.jsonb "raw_job_payload"
+    t.text "last_connection_error"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.boolean "manual_sync", default: false, null: false
+    t.uuid "current_job_sophtron_account_id"
+    t.index ["current_job_sophtron_account_id"], name: "index_sophtron_items_on_current_job_sophtron_account_id"
+    t.index ["customer_id"], name: "index_sophtron_items_on_customer_id"
+    t.index ["family_id"], name: "index_sophtron_items_on_family_id"
+    t.index ["status"], name: "index_sophtron_items_on_status"
+    t.index ["user_institution_id"], name: "index_sophtron_items_on_user_institution_id"
+  end
+
   create_table "sso_audit_logs", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
     t.uuid "user_id"
     t.string "event_type", null: false
@@ -1498,6 +1793,8 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.jsonb "locked_attributes", default: {}
     t.string "investment_activity_label"
     t.decimal "fee", precision: 19, scale: 4, default: "0.0", null: false
+    t.jsonb "extra", default: {}, null: false
+    t.index ["extra"], name: "index_trades_on_extra", using: :gin
     t.index ["investment_activity_label"], name: "index_trades_on_investment_activity_label"
     t.index ["security_id"], name: "index_trades_on_security_id"
   end
@@ -1564,6 +1861,7 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.string "locale"
     t.string "ui_layout"
     t.uuid "default_account_id"
+    t.string "webauthn_id"
     t.index ["default_account_id"], name: "index_users_on_default_account_id"
     t.index ["email"], name: "index_users_on_email", unique: true
     t.index ["family_id"], name: "index_users_on_family_id"
@@ -1571,6 +1869,7 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.index ["locale"], name: "index_users_on_locale"
     t.index ["otp_secret"], name: "index_users_on_otp_secret", unique: true, where: "(otp_secret IS NOT NULL)"
     t.index ["preferences"], name: "index_users_on_preferences", using: :gin
+    t.index ["webauthn_id"], name: "index_users_on_webauthn_id", unique: true, where: "(webauthn_id IS NOT NULL)"
   end
 
   create_table "valuations", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
@@ -1592,9 +1891,27 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
     t.string "subtype"
   end
 
+  create_table "webauthn_credentials", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "user_id", null: false
+    t.string "nickname", null: false
+    t.string "credential_id", null: false
+    t.text "public_key", null: false
+    t.bigint "sign_count", default: 0, null: false
+    t.string "transports", default: [], null: false, array: true
+    t.datetime "last_used_at"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["credential_id"], name: "index_webauthn_credentials_on_credential_id", unique: true
+    t.index ["user_id"], name: "index_webauthn_credentials_on_user_id"
+    t.check_constraint "sign_count >= 0", name: "chk_webauthn_credentials_sign_count_non_negative"
+  end
+
   add_foreign_key "account_providers", "accounts", on_delete: :cascade
   add_foreign_key "account_shares", "accounts"
   add_foreign_key "account_shares", "users"
+  add_foreign_key "account_statements", "accounts", column: "suggested_account_id", on_delete: :nullify
+  add_foreign_key "account_statements", "accounts", on_delete: :nullify
+  add_foreign_key "account_statements", "families", on_delete: :cascade
   add_foreign_key "accounts", "families"
   add_foreign_key "accounts", "imports"
   add_foreign_key "accounts", "plaid_accounts"
@@ -1606,6 +1923,8 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
   add_foreign_key "balances", "accounts", on_delete: :cascade
   add_foreign_key "binance_accounts", "binance_items"
   add_foreign_key "binance_items", "families"
+  add_foreign_key "brex_accounts", "brex_items"
+  add_foreign_key "brex_items", "families"
   add_foreign_key "budget_categories", "budgets"
   add_foreign_key "budget_categories", "categories"
   add_foreign_key "budgets", "families"
@@ -1615,6 +1934,10 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
   add_foreign_key "coinbase_items", "families"
   add_foreign_key "coinstats_accounts", "coinstats_items"
   add_foreign_key "coinstats_items", "families"
+  add_foreign_key "debug_log_entries", "account_providers", on_delete: :nullify
+  add_foreign_key "debug_log_entries", "accounts", on_delete: :nullify
+  add_foreign_key "debug_log_entries", "families", on_delete: :nullify
+  add_foreign_key "debug_log_entries", "users", on_delete: :nullify
   add_foreign_key "enable_banking_accounts", "enable_banking_items"
   add_foreign_key "enable_banking_items", "families"
   add_foreign_key "entries", "accounts", on_delete: :cascade
@@ -1632,6 +1955,8 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
   add_foreign_key "holdings", "accounts", on_delete: :cascade
   add_foreign_key "holdings", "securities"
   add_foreign_key "holdings", "securities", column: "provider_security_id"
+  add_foreign_key "ibkr_accounts", "ibkr_items"
+  add_foreign_key "ibkr_items", "families"
   add_foreign_key "impersonation_session_logs", "impersonation_sessions"
   add_foreign_key "impersonation_sessions", "users", column: "impersonated_id"
   add_foreign_key "impersonation_sessions", "users", column: "impersonator_id"
@@ -1641,6 +1966,8 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
   add_foreign_key "indexa_capital_items", "families"
   add_foreign_key "invitations", "families"
   add_foreign_key "invitations", "users", column: "inviter_id"
+  add_foreign_key "kraken_accounts", "kraken_items"
+  add_foreign_key "kraken_items", "families"
   add_foreign_key "llm_usages", "families"
   add_foreign_key "lunchflow_accounts", "lunchflow_items"
   add_foreign_key "lunchflow_items", "families"
@@ -1655,7 +1982,8 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
   add_foreign_key "pension_entries", "retirement_configs"
   add_foreign_key "plaid_accounts", "plaid_items"
   add_foreign_key "plaid_items", "families"
-  add_foreign_key "recurring_transactions", "accounts"
+  add_foreign_key "recurring_transactions", "accounts", column: "destination_account_id", on_delete: :cascade
+  add_foreign_key "recurring_transactions", "accounts", on_delete: :cascade
   add_foreign_key "recurring_transactions", "families"
   add_foreign_key "recurring_transactions", "merchants"
   add_foreign_key "rejected_transfers", "transactions", column: "inflow_transaction_id"
@@ -1673,6 +2001,8 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
   add_foreign_key "simplefin_items", "families"
   add_foreign_key "snaptrade_accounts", "snaptrade_items"
   add_foreign_key "snaptrade_items", "families"
+  add_foreign_key "sophtron_accounts", "sophtron_items"
+  add_foreign_key "sophtron_items", "families"
   add_foreign_key "sso_audit_logs", "users"
   add_foreign_key "subscriptions", "families"
   add_foreign_key "syncs", "syncs", column: "parent_id"
@@ -1687,4 +2017,5 @@ ActiveRecord::Schema[7.2].define(version: 2026_04_09_100000) do
   add_foreign_key "users", "accounts", column: "default_account_id", on_delete: :nullify
   add_foreign_key "users", "chats", column: "last_viewed_chat_id"
   add_foreign_key "users", "families"
+  add_foreign_key "webauthn_credentials", "users"
 end
diff --git a/design/tokens/README.md b/design/tokens/README.md
new file mode 100644
index 000000000..8ae38ffa8
--- /dev/null
+++ b/design/tokens/README.md
@@ -0,0 +1,124 @@
+# Sure design tokens
+
+This is where the design system actually lives. Tailwind reads from here, and any external tooling (Figma Tokens Studio, AI design tools, anything that shows up later) is meant to read the same JSON.
+
+## Files
+
+- `design/tokens/sure.tokens.json`: every token, hand-edited.
+- `bin/tokens.mjs`: plain Node script. Compiles the JSON into Tailwind v4 CSS.
+- `app/assets/tailwind/sure-design-system/_generated.css`: the build output. Generated, do not edit by hand.
+
+## Workflow
+
+```bash
+# Edit a token:
+$EDITOR design/tokens/sure.tokens.json
+
+# Regenerate the CSS:
+npm run tokens:build
+
+# Commit both files together:
+git add design/tokens/sure.tokens.json app/assets/tailwind/sure-design-system/_generated.css
+```
+
+`bin/setup` runs the build automatically on a fresh checkout.
+
+## Versioning
+
+The root `$version` field follows semver, scoped to the token contract:
+
+- **Major** (`X.0.0`): breaking changes — token removed or renamed, value type changed, dark variant removed, semantic meaning changed.
+- **Minor** (`1.X.0`): additive changes — new tokens, new `$extensions.sure.*` keys, new top-level groups.
+- **Patch** (`1.0.X`): cosmetic / value tweaks that consumers don't need to know about — a hex shifts a few points without changing intent.
+
+Bump it when you commit. External consumers (Tokens Studio, future Figma sync, etc.) read this to decide whether their cached snapshot is stale.
+
+## Schema
+
+The file uses the [W3C DTCG token format](https://design-tokens.github.io/community-group/format/): `$value`, `$type`, `$description`, `$extensions`. Tokens cross-reference via `{path.to.token}` placeholders.
+
+```jsonc
+{
+  "color": {
+    "white": { "$value": "#ffffff", "$type": "color" },
+    "gray": {
+      "500": { "$value": "#737373", "$type": "color" }
+    },
+    "success": {
+      "$value": "{color.green.600}",
+      "$type": "color",
+      "$extensions": { "sure.dark": "{color.green.500}" }
+    }
+  }
+}
+```
+
+### Top-level groups
+
+| Key | Purpose |
+|-----|---------|
+| `font` | font-family stacks |
+| `color` | base colors, semantic aliases (success, warning, destructive, shadow), full-scale ladders, alpha ladders |
+| `budget` | budget-chart fills (need their own dark variants because Stimulus controllers reference them) |
+| `border.radius` | corner radii |
+| `shadow` | drop shadows, both light and dark variants |
+| `animate` | named animations |
+| `utility` | Tailwind `@utility` blocks: semantic surfaces, foregrounds, borders, button backgrounds, etc. |
+
+### Custom `$extensions.sure.*`
+
+| Extension | Where | What it does |
+|-----------|-------|--------------|
+| `sure.dark` | any token | Dark-mode override value. Same template syntax as `$value`. |
+| `sure.alpha` | reserved | Currently unused; alpha is expressed inline via `{ref\|N%}`. Reserved for structured alpha if it's ever needed. |
+| `sure.utility.prefix` | `utility.*` only | The Tailwind utility family (`bg`, `text`, `border`). Tells the build which `@apply` class to emit. |
+| `sure.utility.raw` | `utility.*` only | A CSS property name (`background-color`, `box-shadow`, etc.) when the utility emits raw CSS instead of `@apply`. |
+| `sure.compose` | `utility.*` only | Array of class names to `@apply`. For example, `bg-loader` is `["bg-surface-inset", "animate-pulse"]`. |
+
+### Template strings
+
+Anywhere a `$value` is a string:
+
+- `{path.to.token}` resolves to `var(--path-to-token)` in the generated CSS.
+- `{path.to.token|N%}` resolves to `--alpha(var(--path-to-token) / N%)` (Tailwind v4 alpha syntax).
+
+The same syntax appears inside composite values like `shadow.xs.$value`: `"0px 1px 2px 0px {color.black|6%}"`.
+
+### Alpha modifiers in views (`/N` syntax)
+
+Tailwind v4's `class/N` modifier (`bg-warning/10`, `text-link/70`, etc.) only resolves on **theme colors** (anything declared under the top-level `color.*` group, which becomes `--color-*` in the generated CSS). It does **not** resolve on classes from this file's `utility.*` group, because those compile to static `@apply` blocks with no modifier-aware definition.
+
+The mismatch is silent — Tailwind drops the unrecognized class and the element renders with no CSS for that property. Recently caught examples on `text-inverse/70`, `border-secondary/30`, and `bg-surface-inset/40` (all of which produced no class output).
+
+Until the build script teaches custom utilities to be modifier-aware, the convention is:
+
+- For alpha on a custom utility: pair the base class with `opacity-N`, e.g. `text-inverse opacity-70` instead of `text-inverse/70`.
+- For alpha on a theme color: the `/N` modifier works as expected, e.g. `bg-warning/10`, `border-destructive/30`.
+
+The pre-resolved alpha tints (`color.gray.tint-5`, `color.gray.tint-10`, `color.red.tint-5`, etc.) are theme colors, so `bg-gray-tint-5` and similar work as straight utilities and accept further `/N` modifiers.
+
+### Adding a new token
+
+1. Pick the right top-level group.
+2. Add the `$value` (raw or `{ref}`) and `$type`.
+3. If it should change in dark mode, add `$extensions.sure.dark`.
+4. If it's a utility, add `$extensions.sure.utility.prefix` (or `raw`, or `compose`).
+5. Run `npm run tokens:build`.
+6. Look at the diff in `_generated.css` and confirm it's what you expected.
+7. Commit both files.
+
+### Edge cases the build script handles
+
+- `color.gray.DEFAULT`: the `DEFAULT` segment is dropped in the CSS variable name (`--color-gray`, not `--color-gray-DEFAULT`). DTCG convention; matches Tailwind.
+- `utility.border-divider`: the value is a plain class string (`border-tertiary`) instead of a `{ref}`. The build treats values without `{}` as raw `@apply` arguments.
+- `utility.bg-overlay`: uses `sure.utility.raw: "background-color"` because it needs alpha rendering instead of `@apply`.
+- `utility.bg-loader`: uses `sure.compose` to apply two utilities together (`bg-surface-inset animate-pulse`).
+- `utility.button-bg-ghost-hover`: its dark value is a multi-class string (`bg-gray-800 text-inverse`), not a single ref. The build accepts both forms.
+
+## Consumers
+
+- Rails / Tailwind: via the generated CSS, automatically.
+- Lookbook reference page: `/design-system/inspect/design_tokens/*` reads `sure.tokens.json` at request time.
+- External tools (Figma Tokens Studio, AI design tools, etc.): point them at this file.
+
+If a consumer wants a different shape, transform the JSON in their tooling rather than editing the source here.
diff --git a/design/tokens/sure.tokens.json b/design/tokens/sure.tokens.json
new file mode 100644
index 000000000..bf36e8743
--- /dev/null
+++ b/design/tokens/sure.tokens.json
@@ -0,0 +1,355 @@
+{
+  "$schema": "https://design-tokens.github.io/community-group/format/",
+  "$version": "2.1.0",
+  "$description": "Sure design tokens. Single source of truth. Hand-edit; run `npm run tokens:build` to regenerate CSS. Template syntax in $value strings: `{path.to.token}` resolves to `var(--path-to-token)`; `{path|N%}` becomes `--alpha(var(--path) / N%)`. Utility tokens whose value lacks `{}` are treated as raw Tailwind class lists for @apply.",
+
+  "font": {
+    "sans": {
+      "$value": "'Geist', system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif",
+      "$type": "fontFamily"
+    },
+    "mono": {
+      "$value": "'Geist Mono', ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace",
+      "$type": "fontFamily"
+    }
+  },
+
+  "color": {
+    "white": { "$value": "#ffffff", "$type": "color" },
+    "black": { "$value": "#0B0B0B", "$type": "color" },
+
+    "success":     { "$value": "{color.green.700}",  "$type": "color", "$extensions": { "sure.dark": "{color.green.400}" } },
+    "warning":     { "$value": "{color.yellow.600}", "$type": "color", "$extensions": { "sure.dark": "{color.yellow.400}" } },
+    "destructive": { "$value": "{color.red.600}",    "$type": "color", "$extensions": { "sure.dark": "{color.red.400}" } },
+    "info":        { "$value": "{color.blue.600}",   "$type": "color", "$extensions": { "sure.dark": "{color.blue.500}" } },
+    "shadow":      { "$value": "{color.black|6%}",   "$type": "color", "$extensions": { "sure.dark": "{color.white|8%}" } },
+
+    "link":                  { "$value": "{color.blue.600}",         "$type": "color", "$extensions": { "sure.dark": "{color.blue.500}" } },
+    "tertiary":              { "$value": "{color.alpha-black.100}",  "$type": "color", "$extensions": { "sure.dark": "{color.alpha-white.200}" } },
+    "surface":               { "$value": "{color.gray.50}",          "$type": "color", "$extensions": { "sure.dark": "{color.black}" } },
+    "surface-hover":         { "$value": "{color.gray.100}",         "$type": "color", "$extensions": { "sure.dark": "{color.gray.800}" } },
+    "surface-inset":         { "$value": "{color.gray.100}",         "$type": "color", "$extensions": { "sure.dark": "{color.gray.800}" } },
+    "surface-inset-hover":   { "$value": "{color.gray.200}",         "$type": "color", "$extensions": { "sure.dark": "{color.gray.800}" } },
+    "container":             { "$value": "{color.white}",            "$type": "color", "$extensions": { "sure.dark": "{color.gray.900}" } },
+    "container-hover":       { "$value": "{color.gray.50}",          "$type": "color", "$extensions": { "sure.dark": "{color.gray.800}" } },
+    "container-inset":       { "$value": "{color.gray.50}",          "$type": "color", "$extensions": { "sure.dark": "{color.gray.800}" } },
+    "container-inset-hover": { "$value": "{color.gray.100}",         "$type": "color", "$extensions": { "sure.dark": "{color.gray.700}" } },
+    "nav-indicator":         { "$value": "{color.black}",            "$type": "color", "$extensions": { "sure.dark": "{color.white}" } },
+    "toggle-track":          { "$value": "{color.gray.100}",         "$type": "color", "$extensions": { "sure.dark": "{color.gray.700}" } },
+    "destructive-subtle":    { "$value": "{color.red.200}",          "$type": "color", "$extensions": { "sure.dark": "{color.red.800}" } },
+
+    "gray": {
+      "25":  { "$value": "#FAFAFA", "$type": "color" },
+      "50":  { "$value": "#F7F7F7", "$type": "color" },
+      "100": { "$value": "#F0F0F0", "$type": "color" },
+      "200": { "$value": "#E7E7E7", "$type": "color" },
+      "300": { "$value": "#CFCFCF", "$type": "color" },
+      "400": { "$value": "#9E9E9E", "$type": "color" },
+      "500": { "$value": "#737373", "$type": "color" },
+      "600": { "$value": "#5C5C5C", "$type": "color" },
+      "700": { "$value": "#363636", "$type": "color" },
+      "800": { "$value": "#242424", "$type": "color" },
+      "900": { "$value": "#171717", "$type": "color" },
+      "DEFAULT": { "$value": "{color.gray.500}",       "$type": "color" },
+      "tint-5":  { "$value": "{color.gray.500|5%}",    "$type": "color" },
+      "tint-10": { "$value": "{color.gray.500|10%}",   "$type": "color" }
+    },
+
+    "alpha-white": {
+      "25":  { "$value": "{color.white|3%}",  "$type": "color" },
+      "50":  { "$value": "{color.white|5%}",  "$type": "color" },
+      "100": { "$value": "{color.white|8%}",  "$type": "color" },
+      "200": { "$value": "{color.white|10%}", "$type": "color" },
+      "300": { "$value": "{color.white|15%}", "$type": "color" },
+      "400": { "$value": "{color.white|20%}", "$type": "color" },
+      "500": { "$value": "{color.white|30%}", "$type": "color" },
+      "600": { "$value": "{color.white|40%}", "$type": "color" },
+      "700": { "$value": "{color.white|50%}", "$type": "color" },
+      "800": { "$value": "{color.white|70%}", "$type": "color" },
+      "900": { "$value": "{color.white|85%}", "$type": "color" }
+    },
+
+    "alpha-black": {
+      "25":  { "$value": "{color.black|3%}",  "$type": "color" },
+      "50":  { "$value": "{color.black|5%}",  "$type": "color" },
+      "100": { "$value": "{color.black|8%}",  "$type": "color" },
+      "200": { "$value": "{color.black|10%}", "$type": "color" },
+      "300": { "$value": "{color.black|15%}", "$type": "color" },
+      "400": { "$value": "{color.black|20%}", "$type": "color" },
+      "500": { "$value": "{color.black|30%}", "$type": "color" },
+      "600": { "$value": "{color.black|40%}", "$type": "color" },
+      "700": { "$value": "{color.black|50%}", "$type": "color" },
+      "800": { "$value": "{color.black|70%}", "$type": "color" },
+      "900": { "$value": "{color.black|85%}", "$type": "color" }
+    },
+
+    "red": {
+      "25":  { "$value": "#FFFBFB", "$type": "color" },
+      "50":  { "$value": "#FFF1F0", "$type": "color" },
+      "100": { "$value": "#FFDEDB", "$type": "color" },
+      "200": { "$value": "#FEB9B3", "$type": "color" },
+      "300": { "$value": "#F88C86", "$type": "color" },
+      "400": { "$value": "#ED4E4E", "$type": "color" },
+      "500": { "$value": "#F13636", "$type": "color" },
+      "600": { "$value": "#EC2222", "$type": "color" },
+      "700": { "$value": "#C91313", "$type": "color" },
+      "800": { "$value": "#A40E0E", "$type": "color" },
+      "900": { "$value": "#7E0707", "$type": "color" },
+      "tint-5":  { "$value": "{color.red.500|5%}",  "$type": "color" },
+      "tint-10": { "$value": "{color.red.500|10%}", "$type": "color" }
+    },
+
+    "green": {
+      "25":  { "$value": "#F6FEF9", "$type": "color" },
+      "50":  { "$value": "#ECFDF3", "$type": "color" },
+      "100": { "$value": "#D1FADF", "$type": "color" },
+      "200": { "$value": "#A6F4C5", "$type": "color" },
+      "300": { "$value": "#6CE9A6", "$type": "color" },
+      "400": { "$value": "#32D583", "$type": "color" },
+      "500": { "$value": "#12B76A", "$type": "color" },
+      "600": { "$value": "#10A861", "$type": "color" },
+      "700": { "$value": "#078C52", "$type": "color" },
+      "800": { "$value": "#05603A", "$type": "color" },
+      "900": { "$value": "#054F31", "$type": "color" },
+      "tint-5":  { "$value": "{color.green.500|5%}",  "$type": "color" },
+      "tint-10": { "$value": "{color.green.500|10%}", "$type": "color" }
+    },
+
+    "yellow": {
+      "25":  { "$value": "#FFFCF5", "$type": "color" },
+      "50":  { "$value": "#FFFAEB", "$type": "color" },
+      "100": { "$value": "#FEF0C7", "$type": "color" },
+      "200": { "$value": "#FEDF89", "$type": "color" },
+      "300": { "$value": "#FEC84B", "$type": "color" },
+      "400": { "$value": "#FDB022", "$type": "color" },
+      "500": { "$value": "#F79009", "$type": "color" },
+      "600": { "$value": "#DC6803", "$type": "color" },
+      "700": { "$value": "#B54708", "$type": "color" },
+      "800": { "$value": "#93370D", "$type": "color" },
+      "900": { "$value": "#7A2E0E", "$type": "color" },
+      "tint-5":  { "$value": "{color.yellow.500|5%}",  "$type": "color" },
+      "tint-10": { "$value": "{color.yellow.500|10%}", "$type": "color" }
+    },
+
+    "cyan": {
+      "25":  { "$value": "#F5FEFF", "$type": "color" },
+      "50":  { "$value": "#ECFDFF", "$type": "color" },
+      "100": { "$value": "#CFF9FE", "$type": "color" },
+      "200": { "$value": "#A5F0FC", "$type": "color" },
+      "300": { "$value": "#67E3F9", "$type": "color" },
+      "400": { "$value": "#22CCEE", "$type": "color" },
+      "500": { "$value": "#06AED4", "$type": "color" },
+      "600": { "$value": "#088AB2", "$type": "color" },
+      "700": { "$value": "#0E7090", "$type": "color" },
+      "800": { "$value": "#155B75", "$type": "color" },
+      "900": { "$value": "#164E63", "$type": "color" },
+      "tint-5":  { "$value": "{color.cyan.500|5%}",  "$type": "color" },
+      "tint-10": { "$value": "{color.cyan.500|10%}", "$type": "color" }
+    },
+
+    "blue": {
+      "25":  { "$value": "#F5FAFF", "$type": "color" },
+      "50":  { "$value": "#EFF8FF", "$type": "color" },
+      "100": { "$value": "#D1E9FF", "$type": "color" },
+      "200": { "$value": "#B2DDFF", "$type": "color" },
+      "300": { "$value": "#84CAFF", "$type": "color" },
+      "400": { "$value": "#53B1FD", "$type": "color" },
+      "500": { "$value": "#2E90FA", "$type": "color" },
+      "600": { "$value": "#1570EF", "$type": "color" },
+      "700": { "$value": "#175CD3", "$type": "color" },
+      "800": { "$value": "#1849A9", "$type": "color" },
+      "900": { "$value": "#194185", "$type": "color" },
+      "tint-5":  { "$value": "{color.blue.500|5%}",  "$type": "color" },
+      "tint-10": { "$value": "{color.blue.500|10%}", "$type": "color" }
+    },
+
+    "indigo": {
+      "25":  { "$value": "#F5F8FF", "$type": "color" },
+      "50":  { "$value": "#EFF4FF", "$type": "color" },
+      "100": { "$value": "#E0EAFF", "$type": "color" },
+      "200": { "$value": "#C7D7FE", "$type": "color" },
+      "300": { "$value": "#A4BCFD", "$type": "color" },
+      "400": { "$value": "#8098F9", "$type": "color" },
+      "500": { "$value": "#6172F3", "$type": "color" },
+      "600": { "$value": "#444CE7", "$type": "color" },
+      "700": { "$value": "#3538CD", "$type": "color" },
+      "800": { "$value": "#2D31A6", "$type": "color" },
+      "900": { "$value": "#2D3282", "$type": "color" },
+      "tint-5":  { "$value": "{color.indigo.500|5%}",  "$type": "color" },
+      "tint-10": { "$value": "{color.indigo.500|10%}", "$type": "color" }
+    },
+
+    "violet": {
+      "25":  { "$value": "#FBFAFF", "$type": "color" },
+      "50":  { "$value": "#F5F3FF", "$type": "color" },
+      "100": { "$value": "#ECE9FE", "$type": "color" },
+      "200": { "$value": "#DDD6FE", "$type": "color" },
+      "300": { "$value": "#C3B5FD", "$type": "color" },
+      "400": { "$value": "#A48AFB", "$type": "color" },
+      "500": { "$value": "#875BF7", "$type": "color" },
+      "600": { "$value": "#7839EE", "$type": "color" },
+      "700": { "$value": "#6927DA", "$type": "color" },
+      "tint-5":  { "$value": "{color.violet.500|5%}",  "$type": "color" },
+      "tint-10": { "$value": "{color.violet.500|10%}", "$type": "color" }
+    },
+
+    "fuchsia": {
+      "25":  { "$value": "#FEFAFF", "$type": "color" },
+      "50":  { "$value": "#FDF4FF", "$type": "color" },
+      "100": { "$value": "#FBE8FF", "$type": "color" },
+      "200": { "$value": "#F6D0FE", "$type": "color" },
+      "300": { "$value": "#EEAAFD", "$type": "color" },
+      "400": { "$value": "#E478FA", "$type": "color" },
+      "500": { "$value": "#D444F1", "$type": "color" },
+      "600": { "$value": "#BA24D5", "$type": "color" },
+      "700": { "$value": "#9F1AB1", "$type": "color" },
+      "800": { "$value": "#821890", "$type": "color" },
+      "900": { "$value": "#6F1877", "$type": "color" },
+      "tint-5":  { "$value": "{color.fuchsia.500|5%}",  "$type": "color" },
+      "tint-10": { "$value": "{color.fuchsia.500|10%}", "$type": "color" }
+    },
+
+    "pink": {
+      "25":  { "$value": "#FFFAFC", "$type": "color" },
+      "50":  { "$value": "#FEF0F7", "$type": "color" },
+      "100": { "$value": "#FFD1E2", "$type": "color" },
+      "200": { "$value": "#FFB1CE", "$type": "color" },
+      "300": { "$value": "#FD8FBA", "$type": "color" },
+      "400": { "$value": "#F86BA7", "$type": "color" },
+      "500": { "$value": "#F23E94", "$type": "color" },
+      "600": { "$value": "#D5327F", "$type": "color" },
+      "700": { "$value": "#BA256B", "$type": "color" },
+      "800": { "$value": "#9E1958", "$type": "color" },
+      "900": { "$value": "#840B45", "$type": "color" },
+      "tint-5":  { "$value": "{color.pink.500|5%}",  "$type": "color" },
+      "tint-10": { "$value": "{color.pink.500|10%}", "$type": "color" }
+    },
+
+    "orange": {
+      "25":  { "$value": "#FFF9F5", "$type": "color" },
+      "50":  { "$value": "#FFF4ED", "$type": "color" },
+      "100": { "$value": "#FFE6D5", "$type": "color" },
+      "200": { "$value": "#FFD6AE", "$type": "color" },
+      "300": { "$value": "#FF9C66", "$type": "color" },
+      "400": { "$value": "#FF692E", "$type": "color" },
+      "500": { "$value": "#FF4405", "$type": "color" },
+      "600": { "$value": "#E62E05", "$type": "color" },
+      "700": { "$value": "#BC1B06", "$type": "color" },
+      "800": { "$value": "#97180C", "$type": "color" },
+      "900": { "$value": "#771A0D", "$type": "color" },
+      "tint-5":  { "$value": "{color.orange.500|5%}",  "$type": "color" },
+      "tint-10": { "$value": "{color.orange.500|10%}", "$type": "color" }
+    }
+  },
+
+  "budget": {
+    "unused-fill":      { "$value": "{color.gray.200}", "$type": "color", "$extensions": { "sure.dark": "{color.gray.500}" } },
+    "unallocated-fill": { "$value": "{color.gray.50}",  "$type": "color", "$extensions": { "sure.dark": "{color.gray.700}" } }
+  },
+
+  "border": {
+    "radius": {
+      "md": { "$value": "8px",  "$type": "dimension" },
+      "lg": { "$value": "10px", "$type": "dimension" }
+    }
+  },
+
+  "shadow": {
+    "xs": { "$value": "0px 1px 2px 0px {color.black|6%}",   "$type": "shadow", "$extensions": { "sure.dark": "0px 1px 2px 0px {color.white|8%}" } },
+    "sm": { "$value": "0px 1px 6px 0px {color.black|6%}",   "$type": "shadow", "$extensions": { "sure.dark": "0px 1px 6px 0px {color.white|8%}" } },
+    "md": { "$value": "0px 4px 8px -2px {color.black|6%}",  "$type": "shadow", "$extensions": { "sure.dark": "0px 4px 8px -2px {color.white|8%}" } },
+    "lg": { "$value": "0px 12px 16px -4px {color.black|6%}","$type": "shadow", "$extensions": { "sure.dark": "0px 12px 16px -4px {color.white|8%}" } },
+    "xl": { "$value": "0px 20px 24px -4px {color.black|6%}","$type": "shadow", "$extensions": { "sure.dark": "0px 20px 24px -4px {color.white|8%}" } }
+  },
+
+  "animate": {
+    "stroke-fill": { "$value": "stroke-fill 3s 300ms forwards", "$type": "transition" }
+  },
+
+  "utility": {
+    "bg-inverse":             { "$type": "utility", "$value": "{color.gray.800}", "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.white}" } },
+    "bg-inverse-hover":       { "$type": "utility", "$value": "{color.gray.700}", "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.gray.100}" } },
+    "bg-overlay": {
+      "$type": "utility",
+      "$value": "{color.gray.100|50%}",
+      "$extensions": {
+        "sure.utility": { "raw": "background-color" },
+        "sure.dark": "{color.alpha-black.900}"
+      }
+    },
+    "bg-loader": {
+      "$type": "utility",
+      "$extensions": { "sure.compose": ["bg-surface-inset", "animate-pulse"] }
+    },
+
+    "text-primary":   { "$type": "utility", "$value": "{color.gray.900}", "$extensions": { "sure.utility": { "prefix": "text" }, "sure.dark": "{color.white}" } },
+    "text-inverse":   { "$type": "utility", "$value": "{color.white}",    "$extensions": { "sure.utility": { "prefix": "text" }, "sure.dark": "{color.gray.900}" } },
+    "text-secondary": { "$type": "utility", "$value": "{color.gray.500}", "$extensions": { "sure.utility": { "prefix": "text" }, "sure.dark": "{color.gray.300}" } },
+    "text-subdued":   { "$type": "utility", "$value": "{color.gray.400}", "$extensions": { "sure.utility": { "prefix": "text" }, "sure.dark": "{color.gray.500}" } },
+
+    "shadow-border-xs": {
+      "$type": "utility",
+      "$value": "{shadow.xs}, 0px 0px 0px 1px {color.alpha-black.50}",
+      "$extensions": {
+        "sure.utility": { "raw": "box-shadow" },
+        "sure.dark": "{shadow.xs}, 0px 0px 0px 1px {color.alpha-white.50}"
+      }
+    },
+    "shadow-border-sm": {
+      "$type": "utility",
+      "$value": "{shadow.sm}, 0px 0px 0px 1px {color.alpha-black.50}",
+      "$extensions": {
+        "sure.utility": { "raw": "box-shadow" },
+        "sure.dark": "{shadow.sm}, 0px 0px 0px 1px {color.alpha-white.50}"
+      }
+    },
+    "shadow-border-md": {
+      "$type": "utility",
+      "$value": "{shadow.md}, 0px 0px 0px 1px {color.alpha-black.50}",
+      "$extensions": {
+        "sure.utility": { "raw": "box-shadow" },
+        "sure.dark": "{shadow.md}, 0px 0px 0px 1px {color.alpha-white.50}"
+      }
+    },
+    "shadow-border-lg": {
+      "$type": "utility",
+      "$value": "{shadow.lg}, 0px 0px 0px 1px {color.alpha-black.50}",
+      "$extensions": {
+        "sure.utility": { "raw": "box-shadow" },
+        "sure.dark": "{shadow.lg}, 0px 0px 0px 1px {color.alpha-white.50}"
+      }
+    },
+    "shadow-border-xl": {
+      "$type": "utility",
+      "$value": "{shadow.xl}, 0px 0px 0px 1px {color.alpha-black.50}",
+      "$extensions": {
+        "sure.utility": { "raw": "box-shadow" },
+        "sure.dark": "{shadow.xl}, 0px 0px 0px 1px {color.alpha-white.50}"
+      }
+    },
+
+    "border-primary":     { "$type": "utility", "$value": "{color.alpha-black.300}", "$extensions": { "sure.utility": { "prefix": "border" }, "sure.dark": "{color.alpha-white.400}" } },
+    "border-secondary":   { "$type": "utility", "$value": "{color.alpha-black.200}", "$extensions": { "sure.utility": { "prefix": "border" }, "sure.dark": "{color.alpha-white.300}" } },
+    "border-divider":     { "$type": "utility", "$value": "border-tertiary" },
+    "border-subdued":     { "$type": "utility", "$value": "{color.alpha-black.50}",  "$extensions": { "sure.utility": { "prefix": "border" }, "sure.dark": "{color.alpha-white.100}" } },
+    "border-solid":       { "$type": "utility", "$value": "{color.black}",           "$extensions": { "sure.utility": { "prefix": "border" }, "sure.dark": "{color.white}" } },
+    "border-destructive": { "$type": "utility", "$value": "{color.red.500}",         "$extensions": { "sure.utility": { "prefix": "border" }, "sure.dark": "{color.red.400}" } },
+    "border-inverse":     { "$type": "utility", "$value": "{color.alpha-white.200}", "$extensions": { "sure.utility": { "prefix": "border" }, "sure.dark": "{color.alpha-black.300}" } },
+
+    "button-bg-primary":           { "$type": "utility", "$value": "{color.gray.900}", "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.white}" } },
+    "button-bg-primary-hover":     { "$type": "utility", "$value": "{color.gray.800}", "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.gray.50}" } },
+    "button-bg-secondary":         { "$type": "utility", "$value": "{color.gray.50}",  "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.gray.700}" } },
+    "button-bg-secondary-hover":   { "$type": "utility", "$value": "{color.gray.100}", "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.gray.600}" } },
+    "button-bg-secondary-strong":       { "$type": "utility", "$value": "{color.gray.200}", "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.gray.700}" } },
+    "button-bg-secondary-strong-hover": { "$type": "utility", "$value": "{color.gray.300}", "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.gray.600}" } },
+    "button-bg-disabled":          { "$type": "utility", "$value": "{color.gray.50}",  "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.gray.700}" } },
+    "button-bg-destructive":       { "$type": "utility", "$value": "{color.red.500}",  "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.red.400}" } },
+    "button-bg-destructive-hover": { "$type": "utility", "$value": "{color.red.600}",  "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.red.500}" } },
+    "button-bg-ghost-hover":       { "$type": "utility", "$value": "{color.gray.50}",  "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "bg-gray-800 text-inverse" } },
+    "button-bg-outline-hover":     { "$type": "utility", "$value": "{color.gray.100}", "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.gray.700}" } },
+
+    "tab-item-active":  { "$type": "utility", "$value": "{color.white}",     "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.gray.700}" } },
+    "tab-item-hover":   { "$type": "utility", "$value": "{color.gray.200}",  "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.gray.800}" } },
+    "tab-bg-group":     { "$type": "utility", "$value": "{color.gray.50}",   "$extensions": { "sure.utility": { "prefix": "bg" }, "sure.dark": "{color.alpha-black.700}" } }
+  }
+}
diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml
index e71c1568c..456e7ffbf 100644
--- a/docs/api/openapi.yaml
+++ b/docs/api/openapi.yaml
@@ -37,6 +37,76 @@ components:
         total_pages:
           type: integer
           minimum: 0
+    FamilyExportFile:
+      type: object
+      required:
+      - attached
+      properties:
+        attached:
+          type: boolean
+        byte_size:
+          type: integer
+          nullable: true
+          minimum: 0
+        content_type:
+          type: string
+          nullable: true
+    FamilyExport:
+      type: object
+      required:
+      - id
+      - status
+      - filename
+      - downloadable
+      - file
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        status:
+          type: string
+          enum:
+          - pending
+          - processing
+          - completed
+          - failed
+        filename:
+          type: string
+        downloadable:
+          type: boolean
+        download_path:
+          type: string
+          nullable: true
+        file:
+          "$ref": "#/components/schemas/FamilyExportFile"
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    FamilyExportResponse:
+      type: object
+      required:
+      - data
+      properties:
+        data:
+          "$ref": "#/components/schemas/FamilyExport"
+    FamilyExportCollection:
+      type: object
+      required:
+      - data
+      - meta
+      properties:
+        data:
+          type: array
+          maxItems: 100
+          items:
+            "$ref": "#/components/schemas/FamilyExport"
+        meta:
+          "$ref": "#/components/schemas/Pagination"
     ErrorResponse:
       type: object
       required:
@@ -61,6 +131,32 @@ components:
           nullable: true
           description: Validation error messages (alternative to details used by trades,
             valuations, etc.)
+    ErrorResponseWithImportId:
+      type: object
+      required:
+      - error
+      - import_id
+      properties:
+        error:
+          type: string
+        message:
+          type: string
+          nullable: true
+        import_id:
+          type: string
+          format: uuid
+          description: Import ID preserved for retry or inspection after upload succeeds
+            but publish fails
+    MfaRequiredResponse:
+      type: object
+      required:
+      - error
+      - mfa_required
+      properties:
+        error:
+          type: string
+        mfa_required:
+          type: boolean
     ToolCall:
       type: object
       required:
@@ -230,15 +326,24 @@ components:
           type: string
         account_type:
           type: string
+          nullable: true
+        status:
+          type: string
     AccountDetail:
       type: object
       required:
       - id
       - name
       - balance
+      - balance_cents
+      - cash_balance
+      - cash_balance_cents
       - currency
       - classification
       - account_type
+      - status
+      - created_at
+      - updated_at
       properties:
         id:
           type: string
@@ -247,12 +352,43 @@ components:
           type: string
         balance:
           type: string
+        balance_cents:
+          type: integer
+          description: Signed balance in minor currency units
+        cash_balance:
+          type: string
+        cash_balance_cents:
+          type: integer
+          description: Signed cash balance in minor currency units
         currency:
           type: string
         classification:
           type: string
         account_type:
           type: string
+          nullable: true
+        subtype:
+          type: string
+          nullable: true
+        status:
+          type: string
+          enum:
+          - active
+          - draft
+          - disabled
+          - pending_deletion
+        institution_name:
+          type: string
+          nullable: true
+        institution_domain:
+          type: string
+          nullable: true
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
     AccountCollection:
       type: object
       required:
@@ -265,12 +401,480 @@ components:
             "$ref": "#/components/schemas/AccountDetail"
         pagination:
           "$ref": "#/components/schemas/Pagination"
+    FamilySettings:
+      type: object
+      required:
+      - id
+      - currency
+      - locale
+      - date_format
+      - month_start_day
+      - moniker
+      - default_account_sharing
+      - custom_enabled_currencies
+      - enabled_currencies
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        name:
+          type: string
+          nullable: true
+        currency:
+          type: string
+        locale:
+          type: string
+        date_format:
+          type: string
+        country:
+          type: string
+          nullable: true
+        timezone:
+          type: string
+          nullable: true
+        month_start_day:
+          type: integer
+          minimum: 1
+          maximum: 28
+        moniker:
+          type: string
+          enum:
+          - Family
+          - Group
+        default_account_sharing:
+          type: string
+          enum:
+          - shared
+          - private
+        custom_enabled_currencies:
+          type: boolean
+        enabled_currencies:
+          type: array
+          items:
+            type: string
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    BudgetSummary:
+      type: object
+      required:
+      - id
+      - start_date
+      - end_date
+      - name
+      - currency
+      - initialized
+      - current
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        start_date:
+          type: string
+          format: date
+        end_date:
+          type: string
+          format: date
+        name:
+          type: string
+        currency:
+          type: string
+        initialized:
+          type: boolean
+        current:
+          type: boolean
+        budgeted_spending:
+          type: string
+          nullable: true
+        budgeted_spending_cents:
+          type: integer
+          nullable: true
+        expected_income:
+          type: string
+          nullable: true
+        expected_income_cents:
+          type: integer
+          nullable: true
+        allocated_spending:
+          type: string
+        allocated_spending_cents:
+          type: integer
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    Budget:
+      type: object
+      required:
+      - id
+      - start_date
+      - end_date
+      - name
+      - currency
+      - initialized
+      - current
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        start_date:
+          type: string
+          format: date
+        end_date:
+          type: string
+          format: date
+        name:
+          type: string
+        currency:
+          type: string
+        initialized:
+          type: boolean
+        current:
+          type: boolean
+        budgeted_spending:
+          type: string
+          nullable: true
+        budgeted_spending_cents:
+          type: integer
+          nullable: true
+        expected_income:
+          type: string
+          nullable: true
+        expected_income_cents:
+          type: integer
+          nullable: true
+        allocated_spending:
+          type: string
+        allocated_spending_cents:
+          type: integer
+        actual_spending:
+          type: string
+        actual_spending_cents:
+          type: integer
+        actual_income:
+          type: string
+        actual_income_cents:
+          type: integer
+        available_to_spend:
+          type: string
+        available_to_spend_cents:
+          type: integer
+        available_to_allocate:
+          type: string
+        available_to_allocate_cents:
+          type: integer
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    BudgetCollection:
+      type: object
+      required:
+      - budgets
+      - pagination
+      properties:
+        budgets:
+          type: array
+          items:
+            "$ref": "#/components/schemas/BudgetSummary"
+        pagination:
+          "$ref": "#/components/schemas/Pagination"
+    BudgetCategorySummary:
+      type: object
+      required:
+      - id
+      - budget_id
+      - currency
+      - subcategory
+      - inherits_parent_budget
+      - category
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        budget_id:
+          type: string
+          format: uuid
+        currency:
+          type: string
+        subcategory:
+          type: boolean
+        inherits_parent_budget:
+          type: boolean
+        budgeted_spending:
+          type: string
+        budgeted_spending_cents:
+          type: integer
+        display_budgeted_spending:
+          type: string
+        display_budgeted_spending_cents:
+          type: integer
+        category:
+          type: object
+          required:
+          - id
+          - name
+          - color
+          - lucide_icon
+          properties:
+            id:
+              type: string
+              format: uuid
+            name:
+              type: string
+            color:
+              type: string
+            lucide_icon:
+              type: string
+            parent_id:
+              type: string
+              format: uuid
+              nullable: true
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    BudgetCategory:
+      type: object
+      required:
+      - id
+      - budget_id
+      - currency
+      - subcategory
+      - inherits_parent_budget
+      - category
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        budget_id:
+          type: string
+          format: uuid
+        currency:
+          type: string
+        subcategory:
+          type: boolean
+        inherits_parent_budget:
+          type: boolean
+        budgeted_spending:
+          type: string
+        budgeted_spending_cents:
+          type: integer
+        display_budgeted_spending:
+          type: string
+        display_budgeted_spending_cents:
+          type: integer
+        actual_spending:
+          type: string
+        actual_spending_cents:
+          type: integer
+        available_to_spend:
+          type: string
+        available_to_spend_cents:
+          type: integer
+        category:
+          type: object
+          required:
+          - id
+          - name
+          - color
+          - lucide_icon
+          properties:
+            id:
+              type: string
+              format: uuid
+            name:
+              type: string
+            color:
+              type: string
+            lucide_icon:
+              type: string
+            parent_id:
+              type: string
+              format: uuid
+              nullable: true
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    BudgetCategoryCollection:
+      type: object
+      required:
+      - budget_categories
+      - pagination
+      properties:
+        budget_categories:
+          type: array
+          items:
+            "$ref": "#/components/schemas/BudgetCategorySummary"
+        pagination:
+          "$ref": "#/components/schemas/Pagination"
+    Balance:
+      type: object
+      required:
+      - id
+      - date
+      - currency
+      - flows_factor
+      - balance
+      - balance_cents
+      - start_balance
+      - start_balance_cents
+      - end_balance
+      - end_balance_cents
+      - account
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        date:
+          type: string
+          format: date
+        currency:
+          type: string
+        flows_factor:
+          type: number
+          format: float
+        balance:
+          type: string
+        balance_cents:
+          type: integer
+          description: Balance in currency minor units
+        cash_balance:
+          type: string
+          nullable: true
+        cash_balance_cents:
+          type: integer
+          nullable: true
+          description: Cash balance in currency minor units
+        start_cash_balance:
+          type: string
+        start_cash_balance_cents:
+          type: integer
+          description: Starting cash balance in currency minor units
+        start_non_cash_balance:
+          type: string
+        start_non_cash_balance_cents:
+          type: integer
+          description: Starting non-cash balance in currency minor units
+        start_balance:
+          type: string
+        start_balance_cents:
+          type: integer
+          description: Starting total balance in currency minor units
+        cash_inflows:
+          type: string
+        cash_inflows_cents:
+          type: integer
+          description: Cash inflows in currency minor units
+        cash_outflows:
+          type: string
+        cash_outflows_cents:
+          type: integer
+          description: Cash outflows in currency minor units
+        non_cash_inflows:
+          type: string
+        non_cash_inflows_cents:
+          type: integer
+          description: Non-cash inflows in currency minor units
+        non_cash_outflows:
+          type: string
+        non_cash_outflows_cents:
+          type: integer
+          description: Non-cash outflows in currency minor units
+        net_market_flows:
+          type: string
+        net_market_flows_cents:
+          type: integer
+          description: Net market flows in currency minor units
+        cash_adjustments:
+          type: string
+        cash_adjustments_cents:
+          type: integer
+          description: Cash adjustments in currency minor units
+        non_cash_adjustments:
+          type: string
+        non_cash_adjustments_cents:
+          type: integer
+          description: Non-cash adjustments in currency minor units
+        end_cash_balance:
+          type: string
+        end_cash_balance_cents:
+          type: integer
+          description: Ending cash balance in currency minor units
+        end_non_cash_balance:
+          type: string
+        end_non_cash_balance_cents:
+          type: integer
+          description: Ending non-cash balance in currency minor units
+        end_balance:
+          type: string
+        end_balance_cents:
+          type: integer
+          description: Ending total balance in currency minor units
+        account:
+          "$ref": "#/components/schemas/BalanceAccount"
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    BalanceAccount:
+      type: object
+      required:
+      - id
+      - name
+      - account_type
+      properties:
+        id:
+          type: string
+          format: uuid
+        name:
+          type: string
+        account_type:
+          type: string
+          nullable: true
+    BalanceCollection:
+      type: object
+      required:
+      - balances
+      - pagination
+      properties:
+        balances:
+          type: array
+          items:
+            "$ref": "#/components/schemas/Balance"
+        pagination:
+          "$ref": "#/components/schemas/Pagination"
     Category:
       type: object
       required:
       - id
       - name
-      - classification
       - color
       - icon
       properties:
@@ -279,8 +883,6 @@ components:
           format: uuid
         name:
           type: string
-        classification:
-          type: string
         color:
           type: string
         icon:
@@ -301,7 +903,6 @@ components:
       required:
       - id
       - name
-      - classification
       - color
       - icon
       - subcategories_count
@@ -313,11 +914,6 @@ components:
           format: uuid
         name:
           type: string
-        classification:
-          type: string
-          enum:
-          - income
-          - expense
         color:
           type: string
         icon:
@@ -346,6 +942,33 @@ components:
             "$ref": "#/components/schemas/CategoryDetail"
         pagination:
           "$ref": "#/components/schemas/Pagination"
+    CategoryCreateRequest:
+      type: object
+      required:
+      - category
+      properties:
+        category:
+          type: object
+          required:
+          - name
+          properties:
+            name:
+              type: string
+              description: Category name (required, unique within family)
+            color:
+              type: string
+              description: 'Hex color code (e.g. #22c55e). Defaults to #6172F3 if
+                omitted; subcategories inherit parent color.'
+            icon:
+              type: string
+              description: Lucide icon name (e.g. "coffee"). Auto-suggested from the
+                name when omitted.
+            parent_id:
+              type: string
+              format: uuid
+              nullable: true
+              description: Parent category ID. Must belong to the same family. Categories
+                support up to 2 levels of nesting.
     Merchant:
       type: object
       required:
@@ -422,6 +1045,256 @@ components:
       type: array
       items:
         "$ref": "#/components/schemas/TagDetail"
+    RuleAction:
+      type: object
+      required:
+      - id
+      - action_type
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        action_type:
+          type: string
+        value:
+          type: string
+          nullable: true
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    RuleCondition:
+      type: object
+      required:
+      - id
+      - condition_type
+      - operator
+      - sub_conditions
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        condition_type:
+          type: string
+        operator:
+          type: string
+        value:
+          type: string
+          nullable: true
+        sub_conditions:
+          type: array
+          items:
+            "$ref": "#/components/schemas/RuleCondition"
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    Rule:
+      type: object
+      required:
+      - id
+      - resource_type
+      - active
+      - conditions
+      - actions
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        name:
+          type: string
+          nullable: true
+        resource_type:
+          type: string
+          enum:
+          - transaction
+        active:
+          type: boolean
+        effective_date:
+          type: string
+          format: date
+          nullable: true
+        conditions:
+          type: array
+          items:
+            "$ref": "#/components/schemas/RuleCondition"
+        actions:
+          type: array
+          items:
+            "$ref": "#/components/schemas/RuleAction"
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    RuleResponse:
+      type: object
+      required:
+      - data
+      properties:
+        data:
+          "$ref": "#/components/schemas/Rule"
+    RuleCollection:
+      type: object
+      required:
+      - data
+      - meta
+      properties:
+        data:
+          type: array
+          items:
+            "$ref": "#/components/schemas/Rule"
+        meta:
+          type: object
+          required:
+          - current_page
+          - total_pages
+          - total_count
+          - per_page
+          properties:
+            current_page:
+              type: integer
+            next_page:
+              type: integer
+              nullable: true
+            prev_page:
+              type: integer
+              nullable: true
+            total_pages:
+              type: integer
+            total_count:
+              type: integer
+            per_page:
+              type: integer
+    RuleRun:
+      type: object
+      required:
+      - id
+      - rule_id
+      - rule_name
+      - execution_type
+      - status
+      - transactions_queued
+      - transactions_processed
+      - transactions_modified
+      - pending_jobs_count
+      - executed_at
+      - rule
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        rule_id:
+          type: string
+          format: uuid
+        rule_name:
+          type: string
+          nullable: true
+        execution_type:
+          type: string
+          enum:
+          - manual
+          - scheduled
+        status:
+          type: string
+          enum:
+          - pending
+          - success
+          - failed
+        transactions_queued:
+          type: integer
+          minimum: 0
+        transactions_processed:
+          type: integer
+          minimum: 0
+        transactions_modified:
+          type: integer
+          minimum: 0
+        pending_jobs_count:
+          type: integer
+          minimum: 0
+        executed_at:
+          type: string
+          format: date-time
+        error_message:
+          type: string
+          nullable: true
+        rule:
+          type: object
+          nullable: true
+          required:
+          - id
+          - resource_type
+          - active
+          properties:
+            id:
+              type: string
+              format: uuid
+            name:
+              type: string
+              nullable: true
+            resource_type:
+              type: string
+            active:
+              type: boolean
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    RuleRunResponse:
+      type: object
+      required:
+      - data
+      properties:
+        data:
+          "$ref": "#/components/schemas/RuleRun"
+    RuleRunCollection:
+      type: object
+      required:
+      - data
+      - meta
+      properties:
+        data:
+          type: array
+          items:
+            "$ref": "#/components/schemas/RuleRun"
+        meta:
+          type: object
+          required:
+          - current_page
+          - total_pages
+          - total_count
+          - per_page
+          properties:
+            current_page:
+              type: integer
+            next_page:
+              type: integer
+              nullable: true
+            prev_page:
+              type: integer
+              nullable: true
+            total_pages:
+              type: integer
+            total_count:
+              type: integer
+            per_page:
+              type: integer
     Transfer:
       type: object
       required:
@@ -439,6 +1312,100 @@ components:
         other_account:
           "$ref": "#/components/schemas/Account"
           nullable: true
+    RecurringTransaction:
+      type: object
+      required:
+      - id
+      - amount
+      - amount_cents
+      - currency
+      - expected_day_of_month
+      - last_occurrence_date
+      - next_expected_date
+      - status
+      - occurrence_count
+      - manual
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        amount:
+          type: string
+        amount_cents:
+          type: integer
+          description: Amount in currency minor units
+        currency:
+          type: string
+        expected_day_of_month:
+          type: integer
+          minimum: 1
+          maximum: 31
+        last_occurrence_date:
+          type: string
+          format: date
+        next_expected_date:
+          type: string
+          format: date
+        status:
+          type: string
+          enum:
+          - active
+          - inactive
+        occurrence_count:
+          type: integer
+          minimum: 0
+        name:
+          type: string
+          nullable: true
+        manual:
+          type: boolean
+        expected_amount_min:
+          type: string
+          nullable: true
+        expected_amount_min_cents:
+          type: integer
+          nullable: true
+          description: Minimum expected amount in currency minor units
+        expected_amount_max:
+          type: string
+          nullable: true
+        expected_amount_max_cents:
+          type: integer
+          nullable: true
+          description: Maximum expected amount in currency minor units
+        expected_amount_avg:
+          type: string
+          nullable: true
+        expected_amount_avg_cents:
+          type: integer
+          nullable: true
+          description: Average expected amount in currency minor units
+        account:
+          "$ref": "#/components/schemas/Account"
+          nullable: true
+        merchant:
+          "$ref": "#/components/schemas/Merchant"
+          nullable: true
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    RecurringTransactionCollection:
+      type: object
+      required:
+      - recurring_transactions
+      - pagination
+      properties:
+        recurring_transactions:
+          type: array
+          items:
+            "$ref": "#/components/schemas/RecurringTransaction"
+        pagination:
+          "$ref": "#/components/schemas/Pagination"
     Transaction:
       type: object
       required:
@@ -468,6 +1435,12 @@ components:
         notes:
           type: string
           nullable: true
+        external_id:
+          type: string
+          nullable: true
+        source:
+          type: string
+          nullable: true
         classification:
           type: string
         account:
@@ -503,6 +1476,152 @@ components:
             "$ref": "#/components/schemas/Transaction"
         pagination:
           "$ref": "#/components/schemas/Pagination"
+    TransferTransactionSide:
+      type: object
+      required:
+      - id
+      - entry_id
+      - date
+      - amount
+      - amount_cents
+      - currency
+      - name
+      - kind
+      - account
+      properties:
+        id:
+          type: string
+          format: uuid
+        entry_id:
+          type: string
+          format: uuid
+        date:
+          type: string
+          format: date
+        amount:
+          type: string
+        amount_cents:
+          type: integer
+          description: Signed amount in currency minor units
+        currency:
+          type: string
+        name:
+          type: string
+        kind:
+          type: string
+        account:
+          type: object
+          required:
+          - id
+          - name
+          - account_type
+          properties:
+            id:
+              type: string
+              format: uuid
+            name:
+              type: string
+            account_type:
+              type: string
+              nullable: true
+    TransferDecision:
+      type: object
+      required:
+      - id
+      - status
+      - date
+      - amount
+      - amount_cents
+      - currency
+      - transfer_type
+      - inflow_transaction
+      - outflow_transaction
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        status:
+          type: string
+          enum:
+          - pending
+          - confirmed
+        date:
+          type: string
+          format: date
+        amount:
+          type: string
+        amount_cents:
+          type: integer
+          description: Absolute transfer amount in currency minor units
+        currency:
+          type: string
+        transfer_type:
+          type: string
+          enum:
+          - transfer
+          - liability_payment
+          - loan_payment
+        notes:
+          type: string
+          nullable: true
+        inflow_transaction:
+          "$ref": "#/components/schemas/TransferTransactionSide"
+        outflow_transaction:
+          "$ref": "#/components/schemas/TransferTransactionSide"
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    TransferDecisionCollection:
+      type: object
+      required:
+      - transfers
+      - pagination
+      properties:
+        transfers:
+          type: array
+          items:
+            "$ref": "#/components/schemas/TransferDecision"
+        pagination:
+          "$ref": "#/components/schemas/Pagination"
+    RejectedTransfer:
+      type: object
+      required:
+      - id
+      - inflow_transaction
+      - outflow_transaction
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        inflow_transaction:
+          "$ref": "#/components/schemas/TransferTransactionSide"
+        outflow_transaction:
+          "$ref": "#/components/schemas/TransferTransactionSide"
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    RejectedTransferCollection:
+      type: object
+      required:
+      - rejected_transfers
+      - pagination
+      properties:
+        rejected_transfers:
+          type: array
+          items:
+            "$ref": "#/components/schemas/RejectedTransfer"
+        pagination:
+          "$ref": "#/components/schemas/Pagination"
     Valuation:
       type: object
       required:
@@ -538,14 +1657,19 @@ components:
         updated_at:
           type: string
           format: date-time
-    DeleteResponse:
+    ValuationCollection:
       type: object
       required:
-      - message
+      - valuations
+      - pagination
       properties:
-        message:
-          type: string
-    SuccessMessage:
+        valuations:
+          type: array
+          items:
+            "$ref": "#/components/schemas/Valuation"
+        pagination:
+          "$ref": "#/components/schemas/Pagination"
+    DeleteResponse:
       type: object
       required:
       - message
@@ -587,6 +1711,12 @@ components:
           nullable: true
     ImportStats:
       type: object
+      required:
+      - rows_count
+      - valid_rows_count
+      - invalid_rows_count
+      - mappings_count
+      - unassigned_mappings_count
       properties:
         rows_count:
           type: integer
@@ -594,7 +1724,218 @@ components:
         valid_rows_count:
           type: integer
           minimum: 0
+        invalid_rows_count:
+          type: integer
+          minimum: 0
+        mappings_count:
+          type: integer
+          minimum: 0
+        unassigned_mappings_count:
+          type: integer
+          minimum: 0
+    ImportVerificationReadback:
+      type: object
+      description: SureImport only. Expected NDJSON counts compared to family-scoped
+        database readback after publish.
+      properties:
+        status:
+          type: string
+          enum:
+          - not_verified
+          - matched
+          - mismatch
+          - failed
+          - reverted
+        checked_at:
+          type: string
+          format: date-time
           nullable: true
+        expected_record_counts:
+          type: object
+          additionalProperties:
+            type: integer
+        before_counts:
+          type: object
+          additionalProperties:
+            type: integer
+        after_counts:
+          type: object
+          additionalProperties:
+            type: integer
+        actual_delta_counts:
+          type: object
+          additionalProperties:
+            type: integer
+        checked_counts:
+          type: object
+          additionalProperties:
+            type: integer
+        mismatches:
+          type: object
+          additionalProperties:
+            type: object
+            required:
+            - expected
+            - actual
+            properties:
+              expected:
+                type: integer
+              actual:
+                type: integer
+        error:
+          type: string
+          nullable: true
+    ImportVerification:
+      type: object
+      description: SureImport only. Captured at upload and completed after import
+        publish.
+      required:
+      - expected_record_counts
+      - readback
+      properties:
+        expected_record_counts:
+          type: object
+          additionalProperties:
+            type: integer
+        readback:
+          "$ref": "#/components/schemas/ImportVerificationReadback"
+    ImportPreflightContent:
+      type: object
+      required:
+      - filename
+      - content_type
+      - byte_size
+      properties:
+        filename:
+          type: string
+        content_type:
+          type: string
+        byte_size:
+          type: integer
+          minimum: 0
+    ImportPreflightError:
+      type: object
+      required:
+      - code
+      - message
+      properties:
+        code:
+          type: string
+        message:
+          type: string
+    ImportPreflightStats:
+      type: object
+      required:
+      - rows_count
+      properties:
+        rows_count:
+          type: integer
+          minimum: 0
+          description: CSV parsed non-header rows, or nonblank Sure NDJSON lines.
+        valid_rows_count:
+          type: integer
+          minimum: 0
+          description: SureImport only. Valid NDJSON records.
+        invalid_rows_count:
+          type: integer
+          minimum: 0
+          description: SureImport only. Invalid NDJSON records. CSV malformed content
+            returns a 422 instead.
+        entity_counts:
+          type: object
+          additionalProperties:
+            type: integer
+          nullable: true
+        record_type_counts:
+          type: object
+          additionalProperties:
+            type: integer
+          nullable: true
+    ImportPreflight:
+      type: object
+      required:
+      - type
+      - valid
+      - content
+      - stats
+      - errors
+      - warnings
+      properties:
+        type:
+          type: string
+          enum:
+          - TransactionImport
+          - TradeImport
+          - AccountImport
+          - MintImport
+          - ActualImport
+          - CategoryImport
+          - RuleImport
+          - SureImport
+        valid:
+          type: boolean
+        content:
+          "$ref": "#/components/schemas/ImportPreflightContent"
+        stats:
+          "$ref": "#/components/schemas/ImportPreflightStats"
+        headers:
+          type: array
+          items:
+            type: string
+          nullable: true
+        required_headers:
+          type: array
+          items:
+            type: string
+          nullable: true
+        missing_required_headers:
+          type: array
+          items:
+            type: string
+          nullable: true
+        errors:
+          type: array
+          items:
+            "$ref": "#/components/schemas/ImportPreflightError"
+        warnings:
+          type: array
+          items:
+            type: string
+    ImportPreflightResponse:
+      type: object
+      required:
+      - data
+      properties:
+        data:
+          "$ref": "#/components/schemas/ImportPreflight"
+    ImportStatusSummary:
+      type: object
+      required:
+      - uploaded
+      - configured
+      - terminal
+      properties:
+        uploaded:
+          type: boolean
+        configured:
+          type: boolean
+        terminal:
+          type: boolean
+    ImportStatusDetail:
+      allOf:
+      - "$ref": "#/components/schemas/ImportStatusSummary"
+      - type: object
+        required:
+        - cleaned
+        - publishable
+        - revertable
+        properties:
+          cleaned:
+            type: boolean
+          publishable:
+            type: boolean
+          revertable:
+            type: boolean
     ImportSummary:
       type: object
       required:
@@ -603,6 +1944,7 @@ components:
       - status
       - created_at
       - updated_at
+      - status_detail
       properties:
         id:
           type: string
@@ -614,8 +1956,10 @@ components:
           - TradeImport
           - AccountImport
           - MintImport
+          - ActualImport
           - CategoryImport
           - RuleImport
+          - SureImport
         status:
           type: string
           enum:
@@ -641,6 +1985,8 @@ components:
         error:
           type: string
           nullable: true
+        status_detail:
+          "$ref": "#/components/schemas/ImportStatusSummary"
     ImportDetail:
       type: object
       required:
@@ -649,6 +1995,9 @@ components:
       - status
       - created_at
       - updated_at
+      - status_detail
+      - configuration
+      - stats
       properties:
         id:
           type: string
@@ -660,8 +2009,10 @@ components:
           - TradeImport
           - AccountImport
           - MintImport
+          - ActualImport
           - CategoryImport
           - RuleImport
+          - SureImport
         status:
           type: string
           enum:
@@ -684,10 +2035,14 @@ components:
         error:
           type: string
           nullable: true
+        status_detail:
+          "$ref": "#/components/schemas/ImportStatusDetail"
         configuration:
           "$ref": "#/components/schemas/ImportConfiguration"
         stats:
           "$ref": "#/components/schemas/ImportStats"
+        verification:
+          "$ref": "#/components/schemas/ImportVerification"
     ImportCollection:
       type: object
       required:
@@ -731,6 +2086,436 @@ components:
       properties:
         data:
           "$ref": "#/components/schemas/ImportDetail"
+    ProviderConnectionInstitution:
+      type: object
+      required:
+      - name
+      properties:
+        name:
+          type: string
+          nullable: true
+        domain:
+          type: string
+          nullable: true
+        url:
+          type: string
+          nullable: true
+    ProviderConnectionAccounts:
+      type: object
+      required:
+      - total_count
+      - linked_count
+      - unlinked_count
+      properties:
+        total_count:
+          type: integer
+          minimum: 0
+        linked_count:
+          type: integer
+          minimum: 0
+        unlinked_count:
+          type: integer
+          minimum: 0
+    ProviderConnectionSyncLatest:
+      type: object
+      required:
+      - id
+      - status
+      - created_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        status:
+          type: string
+        created_at:
+          type: string
+          format: date-time
+        syncing_at:
+          type: string
+          format: date-time
+          nullable: true
+        completed_at:
+          type: string
+          format: date-time
+          nullable: true
+        failed_at:
+          type: string
+          format: date-time
+          nullable: true
+        error:
+          type: object
+          nullable: true
+          description: Sanitized latest sync error summary. Null when the latest sync
+            is not failed or stale.
+          required:
+          - present
+          properties:
+            present:
+              type: boolean
+              description: Always true when this object is present.
+            message:
+              type: string
+              nullable: true
+              description: Stable sanitized error category message; raw provider error
+                text is never exposed.
+    ProviderConnectionSync:
+      type: object
+      required:
+      - syncing
+      properties:
+        syncing:
+          type: boolean
+        status_summary:
+          type: string
+          nullable: true
+        last_synced_at:
+          type: string
+          format: date-time
+          nullable: true
+        latest:
+          allOf:
+          - "$ref": "#/components/schemas/ProviderConnectionSyncLatest"
+          nullable: true
+    ProviderConnection:
+      type: object
+      required:
+      - id
+      - provider
+      - provider_type
+      - name
+      - status
+      - requires_update
+      - credentials_configured
+      - scheduled_for_deletion
+      - pending_account_setup
+      - institution
+      - accounts
+      - sync
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        provider:
+          type: string
+        provider_type:
+          type: string
+        name:
+          type: string
+        status:
+          type: string
+          nullable: true
+        requires_update:
+          type: boolean
+          nullable: true
+          description: False when the provider item does not expose this status.
+        credentials_configured:
+          type: boolean
+          nullable: true
+          description: False when credential readiness is unknown.
+        scheduled_for_deletion:
+          type: boolean
+          nullable: true
+          description: False when the provider item does not expose this status.
+        pending_account_setup:
+          type: boolean
+          nullable: true
+          description: False when account setup state is unknown.
+        institution:
+          "$ref": "#/components/schemas/ProviderConnectionInstitution"
+        accounts:
+          "$ref": "#/components/schemas/ProviderConnectionAccounts"
+        sync:
+          "$ref": "#/components/schemas/ProviderConnectionSync"
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    ProviderConnectionCollection:
+      type: object
+      required:
+      - data
+      properties:
+        data:
+          type: array
+          items:
+            "$ref": "#/components/schemas/ProviderConnection"
+    ImportRowMapping:
+      type: object
+      required:
+      - key
+      - type
+      - value
+      - create_when_empty
+      - creatable
+      - mappable
+      properties:
+        key:
+          type: string
+          nullable: true
+        type:
+          type: string
+        value:
+          type: string
+          nullable: true
+        create_when_empty:
+          type: boolean
+        creatable:
+          type: boolean
+        mappable:
+          type: object
+          nullable: true
+          properties:
+            id:
+              type: string
+              format: uuid
+            type:
+              type: string
+            name:
+              type: string
+              nullable: true
+    ImportRowDiagnostic:
+      type: object
+      required:
+      - id
+      - row_number
+      - valid
+      - errors
+      - fields
+      - mappings
+      properties:
+        id:
+          type: string
+          format: uuid
+        row_number:
+          type: integer
+          minimum: 1
+        valid:
+          type: boolean
+        errors:
+          type: array
+          items:
+            type: string
+        fields:
+          type: object
+          properties:
+            account:
+              type: string
+              nullable: true
+            date:
+              type: string
+              nullable: true
+            qty:
+              type: string
+              nullable: true
+            ticker:
+              type: string
+              nullable: true
+            exchange_operating_mic:
+              type: string
+              nullable: true
+            price:
+              type: string
+              nullable: true
+            amount:
+              type: string
+              nullable: true
+            currency:
+              type: string
+              nullable: true
+            name:
+              type: string
+              nullable: true
+            category:
+              type: string
+              nullable: true
+            tags:
+              type: string
+              nullable: true
+            entity_type:
+              type: string
+              nullable: true
+            notes:
+              type: string
+              nullable: true
+            active:
+              type: boolean
+              nullable: true
+            effective_date:
+              type: string
+              nullable: true
+            conditions:
+              type: string
+              nullable: true
+            actions:
+              type: string
+              nullable: true
+        mappings:
+          type: object
+          properties:
+            account:
+              "$ref": "#/components/schemas/ImportRowMapping"
+            category:
+              "$ref": "#/components/schemas/ImportRowMapping"
+            account_type:
+              "$ref": "#/components/schemas/ImportRowMapping"
+            tags:
+              type: array
+              items:
+                "$ref": "#/components/schemas/ImportRowMapping"
+    ImportRowDiagnosticCollection:
+      type: object
+      required:
+      - data
+      - meta
+      properties:
+        data:
+          type: array
+          items:
+            "$ref": "#/components/schemas/ImportRowDiagnostic"
+        meta:
+          type: object
+          required:
+          - current_page
+          - total_pages
+          - total_count
+          - per_page
+          properties:
+            current_page:
+              type: integer
+              minimum: 1
+            next_page:
+              type: integer
+              nullable: true
+            prev_page:
+              type: integer
+              nullable: true
+            total_pages:
+              type: integer
+              minimum: 0
+            total_count:
+              type: integer
+              minimum: 0
+            per_page:
+              type: integer
+              minimum: 1
+    SyncableSummary:
+      type: object
+      required:
+      - type
+      - id
+      properties:
+        type:
+          type: string
+        id:
+          type: string
+          format: uuid
+        name:
+          type: string
+          nullable: true
+    SyncErrorSummary:
+      type: object
+      required:
+      - message
+      properties:
+        message:
+          type: string
+    SyncResource:
+      type: object
+      required:
+      - id
+      - status
+      - in_progress
+      - terminal
+      - syncable
+      - children_count
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        status:
+          type: string
+          enum:
+          - pending
+          - syncing
+          - completed
+          - failed
+          - stale
+        in_progress:
+          type: boolean
+        terminal:
+          type: boolean
+        syncable:
+          "$ref": "#/components/schemas/SyncableSummary"
+        parent_id:
+          type: string
+          format: uuid
+          nullable: true
+        children_count:
+          type: integer
+          minimum: 0
+        window_start_date:
+          type: string
+          format: date
+          nullable: true
+        window_end_date:
+          type: string
+          format: date
+          nullable: true
+        pending_at:
+          type: string
+          format: date-time
+          nullable: true
+        syncing_at:
+          type: string
+          format: date-time
+          nullable: true
+        completed_at:
+          type: string
+          format: date-time
+          nullable: true
+        failed_at:
+          type: string
+          format: date-time
+          nullable: true
+        error:
+          nullable: true
+          allOf:
+          - "$ref": "#/components/schemas/SyncErrorSummary"
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    SyncResponse:
+      type: object
+      required:
+      - data
+      properties:
+        data:
+          nullable: true
+          allOf:
+          - "$ref": "#/components/schemas/SyncResource"
+    SyncCollection:
+      type: object
+      required:
+      - data
+      - meta
+      properties:
+        data:
+          type: array
+          maxItems: 100
+          items:
+            "$ref": "#/components/schemas/SyncResource"
+        meta:
+          "$ref": "#/components/schemas/Pagination"
     Trade:
       type: object
       required:
@@ -879,50 +2664,261 @@ components:
             "$ref": "#/components/schemas/Holding"
         pagination:
           "$ref": "#/components/schemas/Pagination"
+    Security:
+      type: object
+      required:
+      - id
+      - ticker
+      - kind
+      - offline
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        ticker:
+          type: string
+        name:
+          type: string
+          nullable: true
+        kind:
+          type: string
+          enum:
+          - standard
+          - cash
+        country_code:
+          type: string
+          nullable: true
+        exchange_mic:
+          type: string
+          nullable: true
+        exchange_acronym:
+          type: string
+          nullable: true
+        exchange_operating_mic:
+          type: string
+          nullable: true
+        exchange_name:
+          type: string
+          nullable: true
+        offline:
+          type: boolean
+        offline_reason:
+          type: string
+          nullable: true
+        website_url:
+          type: string
+          nullable: true
+        logo_url:
+          type: string
+          nullable: true
+        first_provider_price_on:
+          type: string
+          format: date
+          nullable: true
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    SecurityCollection:
+      type: object
+      required:
+      - securities
+      - pagination
+      properties:
+        securities:
+          type: array
+          items:
+            "$ref": "#/components/schemas/Security"
+        pagination:
+          "$ref": "#/components/schemas/Pagination"
+    SecurityPrice:
+      type: object
+      required:
+      - id
+      - date
+      - price
+      - price_amount
+      - currency
+      - provisional
+      - security
+      - created_at
+      - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        date:
+          type: string
+          format: date
+        price:
+          type: string
+          description: Formatted security price
+        price_amount:
+          type: string
+          description: Exact decimal security price
+        currency:
+          type: string
+        provisional:
+          type: boolean
+        security:
+          type: object
+          required:
+          - id
+          - ticker
+          properties:
+            id:
+              type: string
+              format: uuid
+            ticker:
+              type: string
+            name:
+              type: string
+              nullable: true
+            exchange_operating_mic:
+              type: string
+              nullable: true
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+    SecurityPriceCollection:
+      type: object
+      required:
+      - security_prices
+      - pagination
+      properties:
+        security_prices:
+          type: array
+          items:
+            "$ref": "#/components/schemas/SecurityPrice"
+        pagination:
+          "$ref": "#/components/schemas/Pagination"
+    Money:
+      type: object
+      required:
+      - amount
+      - currency
+      - formatted
+      properties:
+        amount:
+          type: string
+          description: Numeric amount as string
+        currency:
+          type: string
+          description: ISO 4217 currency code
+        formatted:
+          type: string
+          description: Locale-formatted money string
+    BalanceSheet:
+      type: object
+      required:
+      - currency
+      - net_worth
+      - assets
+      - liabilities
+      properties:
+        currency:
+          type: string
+          description: Family primary currency
+        net_worth:
+          "$ref": "#/components/schemas/Money"
+        assets:
+          "$ref": "#/components/schemas/Money"
+        liabilities:
+          "$ref": "#/components/schemas/Money"
+    SuccessMessage:
+      type: object
+      required:
+      - message
+      properties:
+        message:
+          type: string
+    ResetInitiatedResponse:
+      type: object
+      required:
+      - message
+      - status
+      - job_id
+      - family_id
+      - status_url
+      properties:
+        message:
+          type: string
+        status:
+          type: string
+          enum:
+          - queued
+        job_id:
+          type: string
+          description: Informational Active Job identifier returned by the queue adapter;
+            reset status is family-scoped, not job-scoped.
+        family_id:
+          type: string
+          format: uuid
+          description: UUID of the family being reset.
+        status_url:
+          type: string
+    ResetStatusResponse:
+      type: object
+      required:
+      - status
+      - family_id
+      - reset_complete
+      - counts
+      properties:
+        status:
+          type: string
+          enum:
+          - complete
+          - data_remaining
+          description: Counts-based family reset status at response time.
+        family_id:
+          type: string
+          format: uuid
+          description: UUID of the family whose reset target counts were checked.
+        reset_complete:
+          type: boolean
+          description: True when all reset target counts are zero at response time.
+            This is a family data snapshot, not a durable per-job completion record.
+        counts:
+          type: object
+          required:
+          - accounts
+          - categories
+          - tags
+          - merchants
+          - plaid_items
+          - imports
+          - budgets
+          properties:
+            accounts:
+              type: integer
+              minimum: 0
+            categories:
+              type: integer
+              minimum: 0
+            tags:
+              type: integer
+              minimum: 0
+            merchants:
+              type: integer
+              minimum: 0
+            plaid_items:
+              type: integer
+              minimum: 0
+            imports:
+              type: integer
+              minimum: 0
+            budgets:
+              type: integer
+              minimum: 0
 paths:
-  "/api/v1/merchants":
-    get:
-      summary: List merchants
-      tags:
-      - Merchants
-      security:
-      - apiKeyAuth: []
-      responses:
-        '200':
-          description: merchants listed
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  "$ref": "#/components/schemas/MerchantDetail"
-  "/api/v1/merchants/{id}":
-    parameters:
-    - name: id
-      in: path
-      required: true
-      description: Merchant ID
-      schema:
-        type: string
-    get:
-      summary: Retrieve a merchant
-      tags:
-      - Merchants
-      security:
-      - apiKeyAuth: []
-      responses:
-        '200':
-          description: merchant retrieved
-          content:
-            application/json:
-              schema:
-                "$ref": "#/components/schemas/MerchantDetail"
-        '404':
-          description: merchant not found
-          content:
-            application/json:
-              schema:
-                "$ref": "#/components/schemas/ErrorResponse"
   "/api/v1/accounts":
     get:
       summary: List accounts
@@ -943,6 +2939,12 @@ paths:
         description: 'Items per page (default: 25, max: 100)'
         schema:
           type: integer
+      - name: include_disabled
+        in: query
+        required: false
+        description: Include disabled accounts in the response. Defaults to false.
+        schema:
+          type: boolean
       responses:
         '200':
           description: accounts paginated
@@ -950,6 +2952,53 @@ paths:
             application/json:
               schema:
                 "$ref": "#/components/schemas/AccountCollection"
+  "/api/v1/accounts/{id}":
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Account ID
+      schema:
+        type: string
+        format: uuid
+    get:
+      summary: Retrieve an account
+      tags:
+      - Accounts
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: include_disabled
+        in: query
+        required: false
+        description: Allow retrieving a disabled account. Defaults to false.
+        schema:
+          type: boolean
+      responses:
+        '200':
+          description: account retrieved
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/AccountDetail"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: account not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
   "/api/v1/auth/signup":
     post:
       summary: Sign up a new user
@@ -1267,6 +3316,181 @@ paths:
               - refresh_token
               - device
         required: true
+  "/api/v1/auth/sso_link":
+    post:
+      summary: Link an existing account via SSO
+      tags:
+      - Auth
+      description: Authenticates with email/password and links the SSO identity from
+        a previously issued linking code. Creates an OidcIdentity, logs the link via
+        SsoAuditLog, and issues mobile OAuth tokens.
+      parameters: []
+      responses:
+        '200':
+          description: account linked and tokens issued
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  access_token:
+                    type: string
+                  refresh_token:
+                    type: string
+                  token_type:
+                    type: string
+                  expires_in:
+                    type: integer
+                  created_at:
+                    type: integer
+                  user:
+                    type: object
+                    properties:
+                      id:
+                        type: string
+                        format: uuid
+                      email:
+                        type: string
+                      first_name:
+                        type: string
+                      last_name:
+                        type: string
+                      ui_layout:
+                        type: string
+                        enum:
+                        - dashboard
+                        - intro
+                      ai_enabled:
+                        type: boolean
+        '400':
+          description: missing linking code
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '401':
+          description: invalid credentials or expired linking code
+          content:
+            application/json:
+              schema:
+                oneOf:
+                - "$ref": "#/components/schemas/ErrorResponse"
+                - "$ref": "#/components/schemas/MfaRequiredResponse"
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                linking_code:
+                  type: string
+                  description: One-time linking code from mobile SSO onboarding redirect
+                email:
+                  type: string
+                  format: email
+                  description: Email of the existing account to link
+                password:
+                  type: string
+                  description: Password for the existing account
+              required:
+              - linking_code
+              - email
+              - password
+        required: true
+  "/api/v1/auth/sso_create_account":
+    post:
+      summary: Create a new account via SSO
+      tags:
+      - Auth
+      description: Creates a new user and family from a previously issued linking
+        code. Links the SSO identity via OidcIdentity, logs the JIT account creation
+        via SsoAuditLog, and issues mobile OAuth tokens. The linking code must have
+        allow_account_creation enabled.
+      parameters: []
+      responses:
+        '200':
+          description: account created and tokens issued
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  access_token:
+                    type: string
+                  refresh_token:
+                    type: string
+                  token_type:
+                    type: string
+                  expires_in:
+                    type: integer
+                  created_at:
+                    type: integer
+                  user:
+                    type: object
+                    properties:
+                      id:
+                        type: string
+                        format: uuid
+                      email:
+                        type: string
+                      first_name:
+                        type: string
+                      last_name:
+                        type: string
+                      ui_layout:
+                        type: string
+                        enum:
+                        - dashboard
+                        - intro
+                      ai_enabled:
+                        type: boolean
+        '400':
+          description: missing linking code
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '401':
+          description: invalid or expired linking code
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: account creation disabled
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: user validation error
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  errors:
+                    type: array
+                    items:
+                      type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                linking_code:
+                  type: string
+                  description: One-time linking code from mobile SSO onboarding redirect
+                first_name:
+                  type: string
+                  description: First name (overrides value from SSO provider if provided)
+                last_name:
+                  type: string
+                  description: Last name (overrides value from SSO provider if provided)
+              required:
+              - linking_code
+        required: true
   "/api/v1/auth/enable_ai":
     patch:
       summary: Enable AI features for the authenticated user
@@ -1309,6 +3533,360 @@ paths:
             application/json:
               schema:
                 "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/balance_sheet":
+    get:
+      summary: Show balance sheet
+      tags:
+      - Balance Sheet
+      description: Returns the family balance sheet including net worth, total assets,
+        and total liabilities with amounts converted to the family's primary currency.
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: balance sheet returned
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/BalanceSheet"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/balances":
+    get:
+      summary: List balance history records
+      tags:
+      - Balances
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      - name: account_id
+        in: query
+        required: false
+        description: Filter by account ID
+        schema:
+          type: string
+          format: uuid
+      - name: currency
+        in: query
+        required: false
+        description: Filter by currency code
+        schema:
+          type: string
+      - name: start_date
+        in: query
+        required: false
+        description: Filter balances from this date
+        schema:
+          type: string
+          format: date
+      - name: end_date
+        in: query
+        required: false
+        description: Filter balances until this date
+        schema:
+          type: string
+          format: date
+      responses:
+        '200':
+          description: balances listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/BalanceCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: invalid filter
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/balances/{id}":
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Balance ID
+      schema:
+        type: string
+        format: uuid
+    get:
+      summary: Retrieve a balance history record
+      tags:
+      - Balances
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: balance retrieved
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/Balance"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: balance not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/budget_categories":
+    get:
+      summary: List budget categories
+      tags:
+      - Budget Categories
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      - name: budget_id
+        in: query
+        required: false
+        schema:
+          type: string
+          format: uuid
+        description: Filter by budget ID
+      - name: category_id
+        in: query
+        required: false
+        schema:
+          type: string
+          format: uuid
+        description: Filter by category ID
+      - name: start_date
+        in: query
+        required: false
+        schema:
+          type: string
+          format: date
+        description: Filter budget categories whose budget starts on or after this
+          date
+      - name: end_date
+        in: query
+        required: false
+        schema:
+          type: string
+          format: date
+        description: Filter budget categories whose budget ends on or before this
+          date
+      responses:
+        '200':
+          description: budget categories listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/BudgetCategoryCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: invalid filter
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/budget_categories/{id}":
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Budget category ID
+      schema:
+        type: string
+        format: uuid
+    get:
+      summary: Retrieve a budget category
+      tags:
+      - Budget Categories
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: budget category retrieved
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/BudgetCategory"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: budget category not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/budgets":
+    get:
+      summary: List budgets
+      tags:
+      - Budgets
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      - name: start_date
+        in: query
+        required: false
+        schema:
+          type: string
+          format: date
+        description: Filter budgets starting on or after this date
+      - name: end_date
+        in: query
+        required: false
+        schema:
+          type: string
+          format: date
+        description: Filter budgets ending on or before this date
+      responses:
+        '200':
+          description: budgets listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/BudgetCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: invalid date filter
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/budgets/{id}":
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Budget ID
+      schema:
+        type: string
+        format: uuid
+    get:
+      summary: Retrieve a budget
+      tags:
+      - Budgets
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: budget retrieved
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/Budget"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: budget not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
   "/api/v1/categories":
     get:
       summary: List categories
@@ -1329,15 +3907,6 @@ paths:
         description: 'Items per page (default: 25, max: 100)'
         schema:
           type: integer
-      - name: classification
-        in: query
-        required: false
-        description: Filter by classification (income or expense)
-        schema:
-          type: string
-          enum:
-          - income
-          - expense
       - name: roots_only
         in: query
         required: false
@@ -1358,6 +3927,50 @@ paths:
             application/json:
               schema:
                 "$ref": "#/components/schemas/CategoryCollection"
+    post:
+      summary: Create category
+      tags:
+      - Categories
+      security:
+      - apiKeyAuth: []
+      parameters: []
+      responses:
+        '201':
+          description: subcategory created with parent
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/CategoryDetail"
+        '422':
+          description: validation error - duplicate name
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden - api key missing read_write scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '400':
+          description: bad request - missing category payload
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '401':
+          description: unauthorized - missing api key
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+      requestBody:
+        content:
+          application/json:
+            schema:
+              "$ref": "#/components/schemas/CategoryCreateRequest"
+        required: true
   "/api/v1/categories/{id}":
     parameters:
     - name: id
@@ -1597,6 +4210,191 @@ paths:
             application/json:
               schema:
                 "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/family_exports":
+    get:
+      summary: Lists family exports
+      tags:
+      - Family Exports
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      responses:
+        '200':
+          description: family exports listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/FamilyExportCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+    post:
+      summary: Queues a family export
+      tags:
+      - Family Exports
+      security:
+      - apiKeyAuth: []
+      parameters: []
+      responses:
+        '202':
+          description: family export queued
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/FamilyExportResponse"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: invalid params
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              description: Family export creation does not accept request parameters.
+  "/api/v1/family_exports/{id}":
+    parameters:
+    - name: id
+      in: path
+      format: uuid
+      required: true
+      schema:
+        type: string
+    get:
+      summary: Shows a family export
+      tags:
+      - Family Exports
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: family export shown
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/FamilyExportResponse"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/family_exports/{id}/download":
+    parameters:
+    - name: id
+      in: path
+      format: uuid
+      required: true
+      schema:
+        type: string
+    get:
+      summary: Downloads a completed family export
+      tags:
+      - Family Exports
+      security:
+      - apiKeyAuth: []
+      responses:
+        '302':
+          description: family export download redirected
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '409':
+          description: export not ready
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/family_settings":
+    get:
+      summary: Retrieve family settings
+      description: Retrieve a read-only snapshot of non-secret family configuration.
+      tags:
+      - Family Settings
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: family settings retrieved
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/FamilySettings"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
   "/api/v1/holdings":
     get:
       summary: List holdings
@@ -1755,8 +4553,10 @@ paths:
           - TradeImport
           - AccountImport
           - MintImport
+          - ActualImport
           - CategoryImport
           - RuleImport
+          - SureImport
       responses:
         '200':
           description: imports filtered by type
@@ -1766,7 +4566,8 @@ paths:
                 "$ref": "#/components/schemas/ImportCollection"
     post:
       summary: Create import
-      description: Create a new import from raw CSV content.
+      description: Create a new import from raw CSV content, inline Sure NDJSON content,
+        or an uploaded Sure NDJSON file. CSV content is limited to 10MB.
       tags:
       - Imports
       security:
@@ -1784,7 +4585,15 @@ paths:
           content:
             application/json:
               schema:
-                "$ref": "#/components/schemas/ErrorResponse"
+                oneOf:
+                - "$ref": "#/components/schemas/ErrorResponse"
+                - "$ref": "#/components/schemas/ErrorResponseWithImportId"
+        '500':
+          description: import uploaded but publish enqueue failed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponseWithImportId"
       requestBody:
         content:
           application/json:
@@ -1793,7 +4602,9 @@ paths:
               properties:
                 raw_file_content:
                   type: string
-                  description: The raw CSV content as a string
+                  description: Raw CSV or Sure NDJSON content as a string. CSV content
+                    is limited to 10MB. Required for SureImport unless a multipart
+                    file is uploaded.
                 type:
                   type: string
                   enum:
@@ -1801,8 +4612,10 @@ paths:
                   - TradeImport
                   - AccountImport
                   - MintImport
+                  - ActualImport
                   - CategoryImport
                   - RuleImport
+                  - SureImport
                   description: Import type (defaults to TransactionImport)
                 account_id:
                   type: string
@@ -1814,25 +4627,51 @@ paths:
                     if configuration is valid
                 date_col_label:
                   type: string
-                  description: Header name for the date column
+                  description: CSV imports only. Header name for the date column
                 amount_col_label:
                   type: string
-                  description: Header name for the amount column
+                  description: CSV imports only. Header name for the amount column
                 name_col_label:
                   type: string
-                  description: Header name for the transaction name column
+                  description: CSV imports only. Header name for the transaction name
+                    column
                 category_col_label:
                   type: string
-                  description: Header name for the category column
+                  description: CSV imports only. Header name for the category column
                 tags_col_label:
                   type: string
-                  description: Header name for the tags column
+                  description: CSV imports only. Header name for the tags column
                 notes_col_label:
                   type: string
-                  description: Header name for the notes column
+                  description: CSV imports only. Header name for the notes column
+                account_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the account column
+                    when importing rows across multiple accounts
+                qty_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the quantity
+                    column
+                ticker_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the ticker
+                    column
+                price_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the price column
+                entity_type_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the entity type column
+                currency_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the currency column
+                exchange_operating_mic_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the exchange
+                    operating MIC column
                 date_format:
                   type: string
-                  description: Date format pattern (e.g., "%m/%d/%Y")
+                  description: CSV imports only. Date format pattern (e.g., "%m/%d/%Y")
                 number_format:
                   type: string
                   enum:
@@ -1840,20 +4679,137 @@ paths:
                   - 1.234,56
                   - 1 234,56
                   - '1,234'
-                  description: Number format for parsing amounts
+                  description: CSV imports only. Number format for parsing amounts
                 signage_convention:
                   type: string
                   enum:
                   - inflows_positive
                   - inflows_negative
-                  description: How to interpret positive/negative amounts
+                  description: CSV imports only. How to interpret positive/negative
+                    amounts
                 col_sep:
                   type: string
                   enum:
                   - ","
                   - ";"
-                  description: Column separator
-        required: true
+                  description: CSV imports only. Column separator
+                amount_type_strategy:
+                  type: string
+                  enum:
+                  - signed_amount
+                  - custom_column
+                  description: CSV imports only. Amount parsing strategy
+                amount_type_inflow_value:
+                  type: string
+                  description: CSV imports only. Column value that marks an amount
+                    as an inflow when using custom_column strategy
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                raw_file_content:
+                  type: string
+                  description: Raw CSV or Sure NDJSON content as a string. CSV content
+                    is limited to 10MB. Required for SureImport unless a multipart
+                    file is uploaded.
+                type:
+                  type: string
+                  enum:
+                  - TransactionImport
+                  - TradeImport
+                  - AccountImport
+                  - MintImport
+                  - ActualImport
+                  - CategoryImport
+                  - RuleImport
+                  - SureImport
+                  description: Import type (defaults to TransactionImport)
+                account_id:
+                  type: string
+                  format: uuid
+                  description: Account ID to import into
+                publish:
+                  type: string
+                  description: Set to "true" to automatically queue for processing
+                    if configuration is valid
+                date_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the date column
+                amount_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the amount column
+                name_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the transaction name
+                    column
+                category_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the category column
+                tags_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the tags column
+                notes_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the notes column
+                account_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the account column
+                    when importing rows across multiple accounts
+                qty_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the quantity
+                    column
+                ticker_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the ticker
+                    column
+                price_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the price column
+                entity_type_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the entity type column
+                currency_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the currency column
+                exchange_operating_mic_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the exchange
+                    operating MIC column
+                date_format:
+                  type: string
+                  description: CSV imports only. Date format pattern (e.g., "%m/%d/%Y")
+                number_format:
+                  type: string
+                  enum:
+                  - '1,234.56'
+                  - 1.234,56
+                  - 1 234,56
+                  - '1,234'
+                  description: CSV imports only. Number format for parsing amounts
+                signage_convention:
+                  type: string
+                  enum:
+                  - inflows_positive
+                  - inflows_negative
+                  description: CSV imports only. How to interpret positive/negative
+                    amounts
+                col_sep:
+                  type: string
+                  enum:
+                  - ","
+                  - ";"
+                  description: CSV imports only. Column separator
+                amount_type_strategy:
+                  type: string
+                  enum:
+                  - signed_amount
+                  - custom_column
+                  description: CSV imports only. Amount parsing strategy
+                amount_type_inflow_value:
+                  type: string
+                  description: CSV imports only. Column value that marks an amount
+                    as an inflow when using custom_column strategy
   "/api/v1/imports/{id}":
     parameters:
     - name: id
@@ -1865,7 +4821,7 @@ paths:
     get:
       summary: Retrieve an import
       description: Retrieve detailed information about a specific import, including
-        configuration and row statistics.
+        configuration, row statistics, and SureImport readback verification when available.
       tags:
       - Imports
       security:
@@ -1883,6 +4839,1352 @@ paths:
             application/json:
               schema:
                 "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/imports/{id}/rows":
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Import ID
+      schema:
+        type: string
+    get:
+      summary: List import row diagnostics
+      description: List sanitized import rows with validation errors and mapping resolution
+        state.
+      tags:
+      - Imports
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      responses:
+        '200':
+          description: import rows listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ImportRowDiagnosticCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: import not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '500':
+          description: internal server error
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/imports/preflight":
+    post:
+      summary: Validate import content without creating an import
+      description: Validate CSV or Sure NDJSON import content and return counts, headers,
+        warnings, and validation errors without persisting an import or enqueueing
+        jobs. CSV content is limited to 10MB.
+      tags:
+      - Imports
+      security:
+      - apiKeyAuth: []
+      parameters: []
+      responses:
+        '200':
+          description: import content preflighted
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ImportPreflightResponse"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: missing or invalid content
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: account not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                raw_file_content:
+                  type: string
+                  description: Raw CSV or Sure NDJSON content as a string. CSV content
+                    is limited to 10MB.
+                file:
+                  type: string
+                  format: binary
+                  description: CSV or Sure NDJSON upload when using multipart/form-data.
+                    CSV files are limited to 10MB.
+                type:
+                  type: string
+                  enum:
+                  - TransactionImport
+                  - TradeImport
+                  - AccountImport
+                  - MintImport
+                  - ActualImport
+                  - CategoryImport
+                  - RuleImport
+                  - SureImport
+                  description: Import type to validate (defaults to TransactionImport)
+                account_id:
+                  type: string
+                  format: uuid
+                  description: Account ID used for account-scoped CSV import validation
+                date_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the date column
+                amount_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the amount column
+                name_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the transaction name
+                    column
+                category_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the category column
+                tags_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the tags column
+                notes_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the notes column
+                account_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the account column
+                qty_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the quantity
+                    column
+                ticker_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the ticker
+                    column
+                price_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the price column
+                entity_type_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the entity type column
+                currency_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the currency column
+                exchange_operating_mic_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the exchange
+                    operating MIC column
+                date_format:
+                  type: string
+                  description: CSV imports only. Date format pattern
+                number_format:
+                  type: string
+                  enum:
+                  - '1,234.56'
+                  - 1.234,56
+                  - 1 234,56
+                  - '1,234'
+                  description: CSV imports only. Number format for parsing amounts
+                signage_convention:
+                  type: string
+                  enum:
+                  - inflows_positive
+                  - inflows_negative
+                  description: CSV imports only. How to interpret positive/negative
+                    amounts
+                col_sep:
+                  type: string
+                  enum:
+                  - ","
+                  - ";"
+                  description: CSV imports only. Column separator
+                rows_to_skip:
+                  type: integer
+                  minimum: 0
+                  description: CSV imports only. Number of leading rows to skip before
+                    reading headers
+                amount_type_strategy:
+                  type: string
+                  enum:
+                  - signed_amount
+                  - custom_column
+                  description: CSV imports only. Amount parsing strategy
+                amount_type_inflow_value:
+                  type: string
+                  description: CSV imports only. Column value that marks an amount
+                    as an inflow when using custom_column strategy
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                raw_file_content:
+                  type: string
+                  description: Raw CSV or Sure NDJSON content as a string. CSV content
+                    is limited to 10MB.
+                file:
+                  type: string
+                  format: binary
+                  description: CSV or Sure NDJSON upload when using multipart/form-data.
+                    CSV files are limited to 10MB.
+                type:
+                  type: string
+                  enum:
+                  - TransactionImport
+                  - TradeImport
+                  - AccountImport
+                  - MintImport
+                  - ActualImport
+                  - CategoryImport
+                  - RuleImport
+                  - SureImport
+                  description: Import type to validate (defaults to TransactionImport)
+                account_id:
+                  type: string
+                  format: uuid
+                  description: Account ID used for account-scoped CSV import validation
+                date_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the date column
+                amount_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the amount column
+                name_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the transaction name
+                    column
+                category_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the category column
+                tags_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the tags column
+                notes_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the notes column
+                account_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the account column
+                qty_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the quantity
+                    column
+                ticker_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the ticker
+                    column
+                price_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the price column
+                entity_type_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the entity type column
+                currency_col_label:
+                  type: string
+                  description: CSV imports only. Header name for the currency column
+                exchange_operating_mic_col_label:
+                  type: string
+                  description: CSV trade imports only. Header name for the exchange
+                    operating MIC column
+                date_format:
+                  type: string
+                  description: CSV imports only. Date format pattern
+                number_format:
+                  type: string
+                  enum:
+                  - '1,234.56'
+                  - 1.234,56
+                  - 1 234,56
+                  - '1,234'
+                  description: CSV imports only. Number format for parsing amounts
+                signage_convention:
+                  type: string
+                  enum:
+                  - inflows_positive
+                  - inflows_negative
+                  description: CSV imports only. How to interpret positive/negative
+                    amounts
+                col_sep:
+                  type: string
+                  enum:
+                  - ","
+                  - ";"
+                  description: CSV imports only. Column separator
+                rows_to_skip:
+                  type: integer
+                  minimum: 0
+                  description: CSV imports only. Number of leading rows to skip before
+                    reading headers
+                amount_type_strategy:
+                  type: string
+                  enum:
+                  - signed_amount
+                  - custom_column
+                  description: CSV imports only. Amount parsing strategy
+                amount_type_inflow_value:
+                  type: string
+                  description: CSV imports only. Column value that marks an amount
+                    as an inflow when using custom_column strategy
+  "/api/v1/merchants":
+    get:
+      summary: List merchants
+      tags:
+      - Merchants
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: merchants listed
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  "$ref": "#/components/schemas/MerchantDetail"
+  "/api/v1/merchants/{id}":
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Merchant ID
+      schema:
+        type: string
+    get:
+      summary: Retrieve a merchant
+      tags:
+      - Merchants
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: merchant retrieved
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/MerchantDetail"
+        '404':
+          description: merchant not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/provider_connections":
+    get:
+      summary: Lists provider connection status summaries
+      description: List safe provider connection status metadata for the authenticated
+        user's family without exposing credentials, raw provider payloads, or raw
+        sync errors.
+      tags:
+      - Provider Connections
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: provider connection status summaries listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ProviderConnectionCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/recurring_transactions":
+    get:
+      summary: List recurring transactions
+      tags:
+      - Recurring Transactions
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      - name: status
+        in: query
+        required: false
+        description: Filter by recurring status
+        schema:
+          type: string
+          enum:
+          - active
+          - inactive
+      - name: account_id
+        in: query
+        required: false
+        description: Filter by account ID
+        schema:
+          type: string
+          format: uuid
+      responses:
+        '200':
+          description: recurring transactions listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/RecurringTransactionCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: validation error - malformed account filter
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+    post:
+      summary: Create recurring transaction
+      tags:
+      - Recurring Transactions
+      security:
+      - apiKeyAuth: []
+      parameters: []
+      responses:
+        '201':
+          description: recurring transaction created
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/RecurringTransaction"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden - requires read_write scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: account not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: validation error - negative occurrence count
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                recurring_transaction:
+                  type: object
+                  properties:
+                    account_id:
+                      type: string
+                      format: uuid
+                      nullable: true
+                    merchant_id:
+                      type: string
+                      format: uuid
+                      nullable: true
+                    name:
+                      type: string
+                      nullable: true
+                    amount:
+                      type: number
+                    currency:
+                      type: string
+                    expected_day_of_month:
+                      type: integer
+                      minimum: 1
+                      maximum: 31
+                    last_occurrence_date:
+                      type: string
+                      format: date
+                    next_expected_date:
+                      type: string
+                      format: date
+                    status:
+                      type: string
+                      enum:
+                      - active
+                      - inactive
+                    occurrence_count:
+                      type: integer
+                      minimum: 0
+                    manual:
+                      type: boolean
+                    expected_amount_min:
+                      type: number
+                      nullable: true
+                    expected_amount_max:
+                      type: number
+                      nullable: true
+                    expected_amount_avg:
+                      type: number
+                      nullable: true
+                  required:
+                  - amount
+                  - currency
+                  - expected_day_of_month
+                  - last_occurrence_date
+                  - next_expected_date
+                  anyOf:
+                  - required:
+                    - name
+                  - required:
+                    - merchant_id
+              required:
+              - recurring_transaction
+        required: true
+  "/api/v1/recurring_transactions/{id}":
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Recurring transaction ID
+      schema:
+        type: string
+    get:
+      summary: Retrieve recurring transaction
+      tags:
+      - Recurring Transactions
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: recurring transaction retrieved
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/RecurringTransaction"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: recurring transaction not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+    patch:
+      summary: Update recurring transaction
+      tags:
+      - Recurring Transactions
+      security:
+      - apiKeyAuth: []
+      parameters: []
+      responses:
+        '200':
+          description: recurring transaction updated
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/RecurringTransaction"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden - requires read_write scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: recurring transaction not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: validation error
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                recurring_transaction:
+                  type: object
+                  properties:
+                    status:
+                      type: string
+                      enum:
+                      - active
+                      - inactive
+                    expected_day_of_month:
+                      type: integer
+                      minimum: 1
+                      maximum: 31
+                    next_expected_date:
+                      type: string
+                      format: date
+        required: true
+    delete:
+      summary: Delete recurring transaction
+      tags:
+      - Recurring Transactions
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: recurring transaction deleted
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/SuccessMessage"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden - requires read_write scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: recurring transaction not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/rejected_transfers":
+    get:
+      summary: List rejected transfers
+      tags:
+      - Rejected Transfers
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      - name: account_id
+        in: query
+        required: false
+        schema:
+          type: string
+          format: uuid
+        description: Filter rejected transfers involving this account
+      - name: start_date
+        in: query
+        required: false
+        schema:
+          type: string
+          format: date
+        description: Filter rejected transfers from this date
+      - name: end_date
+        in: query
+        required: false
+        schema:
+          type: string
+          format: date
+        description: Filter rejected transfers until this date
+      responses:
+        '200':
+          description: rejected transfers listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/RejectedTransferCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: invalid filter
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/rejected_transfers/{id}":
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Rejected transfer ID
+      schema:
+        type: string
+    get:
+      summary: Retrieve a rejected transfer
+      tags:
+      - Rejected Transfers
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: rejected transfer retrieved
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/RejectedTransfer"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: rejected transfer not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/rule_runs":
+    get:
+      summary: List rule runs
+      description: List rule run history for the authenticated user family.
+      tags:
+      - Rule Runs
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      - name: rule_id
+        in: query
+        required: false
+        description: Filter by rule ID
+        schema:
+          type: string
+          format: uuid
+      - name: status
+        in: query
+        required: false
+        description: Filter by run status
+        schema:
+          type: string
+          enum:
+          - pending
+          - success
+          - failed
+      - name: execution_type
+        in: query
+        required: false
+        description: Filter by execution type
+        schema:
+          type: string
+          enum:
+          - manual
+          - scheduled
+      - name: start_executed_at
+        in: query
+        required: false
+        description: Filter runs executed at or after this timestamp
+        schema:
+          type: string
+          format: date-time
+      - name: end_executed_at
+        in: query
+        required: false
+        description: Filter runs executed at or before this timestamp
+        schema:
+          type: string
+          format: date-time
+      responses:
+        '200':
+          description: rule runs listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/RuleRunCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: invalid filter
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/rule_runs/{id}":
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Rule run ID
+      schema:
+        type: string
+        format: uuid
+    get:
+      summary: Retrieve a rule run
+      description: Retrieve one rule run from the authenticated user family.
+      tags:
+      - Rule Runs
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: rule run retrieved
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/RuleRunResponse"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: rule run not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/rules":
+    get:
+      summary: List rules
+      tags:
+      - Rules
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      - name: resource_type
+        in: query
+        required: false
+        description: Filter by rule resource type
+        schema:
+          type: string
+          enum:
+          - transaction
+      - name: active
+        in: query
+        required: false
+        description: Filter by active status
+        schema:
+          type: boolean
+      responses:
+        '200':
+          description: rules listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/RuleCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden - requires read scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: unsupported resource type
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/rules/{id}":
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Rule ID
+      schema:
+        type: string
+    get:
+      summary: Retrieve a rule
+      tags:
+      - Rules
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: rule retrieved
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/RuleResponse"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden - requires read scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: rule not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/securities":
+    get:
+      summary: List securities referenced by family investment data
+      tags:
+      - Securities
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      - name: ticker
+        in: query
+        required: false
+        description: Filter by ticker symbol
+        schema:
+          type: string
+      - name: exchange_operating_mic
+        in: query
+        required: false
+        description: Filter by exchange operating MIC
+        schema:
+          type: string
+      - name: kind
+        in: query
+        required: false
+        description: Filter by security kind
+        schema:
+          type: string
+          enum:
+          - standard
+          - cash
+      - name: offline
+        in: query
+        required: false
+        description: Filter by offline status. When supplied, must be true or false.
+        schema:
+          type: boolean
+      responses:
+        '200':
+          description: securities listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/SecurityCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: invalid filter
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/securities/{id}":
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Security ID
+      schema:
+        type: string
+        format: uuid
+    get:
+      summary: Retrieve a security referenced by family investment data
+      tags:
+      - Securities
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: security retrieved
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/Security"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: security not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/security_prices":
+    get:
+      summary: List security price history referenced by family investment data
+      tags:
+      - Security Prices
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      - name: security_id
+        in: query
+        required: false
+        description: Filter by security ID
+        schema:
+          type: string
+          format: uuid
+      - name: currency
+        in: query
+        required: false
+        description: Filter by currency code
+        schema:
+          type: string
+      - name: start_date
+        in: query
+        required: false
+        description: Filter prices from this date
+        schema:
+          type: string
+          format: date
+      - name: end_date
+        in: query
+        required: false
+        description: Filter prices until this date
+        schema:
+          type: string
+          format: date
+      - name: provisional
+        in: query
+        required: false
+        description: Filter by provisional price status. When supplied, must be true
+          or false.
+        schema:
+          type: boolean
+      responses:
+        '200':
+          description: security prices listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/SecurityPriceCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: invalid filter
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/security_prices/{id}":
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Security price ID
+      schema:
+        type: string
+        format: uuid
+    get:
+      summary: Retrieve a security price referenced by family investment data
+      tags:
+      - Security Prices
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: security price retrieved
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/SecurityPrice"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: security price not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/syncs":
+    get:
+      summary: Lists sync history
+      description: List sanitized sync status history for the authenticated user's
+        family, accounts, and provider connections.
+      tags:
+      - Syncs
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      responses:
+        '200':
+          description: syncs listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/SyncCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/syncs/latest":
+    get:
+      summary: Shows the latest sync
+      description: 'Return the most recently created sanitized sync status for the
+        authenticated user''s family, or data: null when no sync exists.'
+      tags:
+      - Syncs
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: latest sync shown
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/SyncResponse"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/syncs/{id}":
+    parameters:
+    - name: id
+      in: path
+      format: uuid
+      required: true
+      schema:
+        type: string
+    get:
+      summary: Shows a sync
+      description: Return sanitized status metadata for a single family-scoped sync.
+      tags:
+      - Syncs
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: sync shown
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/SyncResponse"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
   "/api/v1/tags":
     get:
       summary: List tags
@@ -2279,6 +6581,8 @@ paths:
       - Transactions
       security:
       - apiKeyAuth: []
+      description: Returns global ledger history for accessible accounts, including
+        disabled accounts but excluding accounts pending deletion.
       parameters:
       - name: page
         in: query
@@ -2404,6 +6708,12 @@ paths:
             application/json:
               schema:
                 "$ref": "#/components/schemas/Transaction"
+        '200':
+          description: transaction already exists for external idempotency key
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/Transaction"
         '422':
           description: validation error - missing required fields
           content:
@@ -2458,6 +6768,14 @@ paths:
                       - inflow
                       - outflow
                       description: Transaction nature (determines sign)
+                    external_id:
+                      type: string
+                      description: Optional external idempotency key scoped to account
+                        and source
+                    source:
+                      type: string
+                      description: Optional source namespace for external_id. Requires
+                        external_id and defaults to api when external_id is provided
                     tag_ids:
                       type: array
                       items:
@@ -2476,10 +6794,11 @@ paths:
     parameters:
     - name: id
       in: path
-      required: true
-      description: Transaction ID
       schema:
         type: string
+        format: uuid
+      required: true
+      description: Transaction ID
     get:
       summary: Retrieve a transaction
       tags:
@@ -2583,20 +6902,279 @@ paths:
             application/json:
               schema:
                 "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/transfers":
+    get:
+      summary: List transfers
+      tags:
+      - Transfers
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      - name: status
+        in: query
+        required: false
+        schema:
+          type: string
+          enum:
+          - pending
+          - confirmed
+        description: Filter by transfer status
+      - name: account_id
+        in: query
+        required: false
+        schema:
+          type: string
+          format: uuid
+        description: Filter transfers involving this account
+      - name: start_date
+        in: query
+        required: false
+        schema:
+          type: string
+          format: date
+        description: Filter transfers from this date
+      - name: end_date
+        in: query
+        required: false
+        schema:
+          type: string
+          format: date
+        description: Filter transfers until this date
+      responses:
+        '200':
+          description: transfers listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/TransferDecisionCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: invalid filter
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/transfers/{id}":
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Transfer ID
+      schema:
+        type: string
+    get:
+      summary: Retrieve a transfer
+      tags:
+      - Transfers
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: transfer retrieved
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/TransferDecision"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: insufficient scope
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '404':
+          description: transfer not found
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/users/reset":
+    delete:
+      summary: Reset account
+      tags:
+      - Users
+      description: Resets all financial data (accounts, categories, merchants, tags,
+        etc.) for the current user's family while keeping the user account intact.
+        The reset runs asynchronously in the background. The returned job_id is informational
+        only; reset status is family-scoped, not job-scoped. Requires admin role.
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: account reset initiated
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ResetInitiatedResponse"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden - requires read_write scope and admin role
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '500':
+          description: reset enqueue failed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/users/reset/status":
+    get:
+      summary: Retrieve reset status
+      tags:
+      - Users
+      description: Returns counts of family-owned data targeted by account reset.
+        Use this after DELETE /api/v1/users/reset to decide whether reset materialization
+        has completed. Completion is a counts-based family snapshot and may change
+        if new data is created after reset.
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: reset status returned
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ResetStatusResponse"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '403':
+          description: forbidden - requires admin role
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+  "/api/v1/users/me":
+    delete:
+      summary: Delete account
+      tags:
+      - Users
+      description: Permanently deactivates the current user account and all associated
+        data. This action cannot be undone.
+      security:
+      - apiKeyAuth: []
+      responses:
+        '200':
+          description: account deleted
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/SuccessMessage"
+        '401':
+          description: unauthorized
+        '403':
+          description: insufficient scope
+        '422':
+          description: deactivation failed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
   "/api/v1/valuations":
+    get:
+      summary: List valuations
+      tags:
+      - Valuations
+      security:
+      - apiKeyAuth: []
+      parameters:
+      - name: page
+        in: query
+        required: false
+        description: 'Page number (default: 1)'
+        schema:
+          type: integer
+      - name: per_page
+        in: query
+        required: false
+        description: 'Items per page (default: 25, max: 100)'
+        schema:
+          type: integer
+      - name: account_id
+        in: query
+        required: false
+        description: Filter by account ID
+        schema:
+          type: string
+          format: uuid
+      - name: start_date
+        in: query
+        required: false
+        description: Filter valuations from this date
+        schema:
+          type: string
+          format: date
+      - name: end_date
+        in: query
+        required: false
+        description: Filter valuations until this date
+        schema:
+          type: string
+          format: date
+      responses:
+        '200':
+          description: valuations listed
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ValuationCollection"
+        '401':
+          description: unauthorized
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
+        '422':
+          description: invalid account filter
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/ErrorResponse"
     post:
       summary: Create valuation
       tags:
       - Valuations
       security:
       - apiKeyAuth: []
-      parameters:
-      - name: Authorization
-        in: header
-        required: true
-        schema:
-          type: string
-        description: Bearer token with write scope
+      parameters: []
       responses:
         '201':
           description: valuation created
@@ -2604,6 +7182,12 @@ paths:
             application/json:
               schema:
                 "$ref": "#/components/schemas/Valuation"
+        '200':
+          description: existing valuation upserted
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/Valuation"
         '422':
           description: validation error - missing date
           content:
@@ -2639,21 +7223,27 @@ paths:
                     notes:
                       type: string
                       description: Additional notes
+                    upsert:
+                      type: boolean
+                      description: Nested alternative to the top-level response-status
+                        flag. Top-level upsert takes precedence when both are provided.
                   required:
                   - account_id
                   - amount
                   - date
+                upsert:
+                  type: boolean
+                  description: Response-status signal only. When true and a same-account
+                    same-date valuation exists before the request, the endpoint returns
+                    200 OK instead of 201 Created. The underlying reconciliation write
+                    path is unchanged; this flag does not add duplicate-prevention
+                    or safe-retry guarantees beyond existing same-date reconciliation
+                    behavior.
               required:
               - valuation
         required: true
   "/api/v1/valuations/{id}":
     parameters:
-    - name: Authorization
-      in: header
-      required: true
-      schema:
-        type: string
-      description: Bearer token
     - name: id
       in: path
       required: true
@@ -2725,66 +7315,3 @@ paths:
                       type: string
                       description: Additional notes
         required: true
-  "/api/v1/users/reset":
-    delete:
-      summary: Reset account
-      tags:
-      - Users
-      description: Resets all financial data (accounts, categories, merchants, tags,
-        etc.) for the current user's family while keeping the user account intact.
-        The reset runs asynchronously in the background. Requires admin role.
-      security:
-      - apiKeyAuth: []
-      responses:
-        '200':
-          description: account reset initiated
-          content:
-            application/json:
-              schema:
-                "$ref": "#/components/schemas/SuccessMessage"
-        '401':
-          description: unauthorized
-          content:
-            application/json:
-              schema:
-                "$ref": "#/components/schemas/ErrorResponse"
-        '403':
-          description: "forbidden \u2014 requires read_write scope and admin role"
-          content:
-            application/json:
-              schema:
-                "$ref": "#/components/schemas/ErrorResponse"
-  "/api/v1/users/me":
-    delete:
-      summary: Delete account
-      tags:
-      - Users
-      description: Permanently deactivates the current user account and all associated
-        data. This action cannot be undone.
-      security:
-      - apiKeyAuth: []
-      responses:
-        '200':
-          description: account deleted
-          content:
-            application/json:
-              schema:
-                "$ref": "#/components/schemas/SuccessMessage"
-        '401':
-          description: unauthorized
-          content:
-            application/json:
-              schema:
-                "$ref": "#/components/schemas/ErrorResponse"
-        '403':
-          description: insufficient scope
-          content:
-            application/json:
-              schema:
-                "$ref": "#/components/schemas/ErrorResponse"
-        '422':
-          description: deactivation failed
-          content:
-            application/json:
-              schema:
-                "$ref": "#/components/schemas/ErrorResponse"
diff --git a/docs/hosting/docker.md b/docs/hosting/docker.md
index 09114ed09..afd462752 100644
--- a/docs/hosting/docker.md
+++ b/docs/hosting/docker.md
@@ -111,6 +111,54 @@ and change it to `true`
 RAILS_ASSUME_SSL: "true"
 ```
 
+#### WebAuthn MFA (passkeys and security keys)
+
+If you enable passkeys, Touch ID, Windows Hello, or hardware security keys as MFA credentials, pin the WebAuthn relying party settings in your `.env` file:
+
+```txt
+WEBAUTHN_RP_ID="example.com"
+WEBAUTHN_ALLOWED_ORIGINS="https://sure.example.com"
+```
+
+`WEBAUTHN_RP_ID` should usually be your registrable domain, not a full URL. See [WebAuthn MFA Configuration](webauthn.md) before changing hostnames or reverse proxy settings for an instance with registered passkeys.
+
+#### Binding to IPv6 (optional)
+
+By default Sure listens on `0.0.0.0:3000` (IPv4 wildcard) inside the container and Docker publishes the port on the host's IPv4 interface only. If you want the app reachable over IPv6 as well, two things need to change:
+
+1. **Tell the app to bind to `[::]`** by setting `BINDING=::` in the container environment. `BINDING` is Rails' native env var for the server bind address. On any kernel with `net.ipv6.bindv6only=0` (the default on Linux and macOS) a single `[::]` bind is **dual-stack**: it accepts both IPv6 and IPv4 clients from the same socket. You do not need two binds and you do not need two ports.
+2. **Tell Docker to publish the host port on IPv6** by adding a bracketed-host `ports:` entry alongside the existing IPv4 one.
+
+In `compose.yml`:
+
+```yaml
+services:
+  web:
+    ports:
+      - ${PORT:-3000}:3000
+      - "[::]:${PORT:-3000}:3000"
+    environment:
+      <<: *rails_env
+      BINDING: "::"
+```
+
+With both changes in place, `http://127.0.0.1:3000/` and `http://[::1]:3000/` both work against the same container.
+
+**Note:** Docker's default userland proxy already bridges host-side IPv6 publishes to the container's internal IPv4 address, so in many setups just adding the `[::]:` port entry is enough. Setting `BINDING=::` inside the container only becomes load-bearing when the Docker daemon has `"ipv6": true` + `"ip6tables": true` configured (uncommon for self-hosters) and forwards raw IPv6 packets into the container via netfilter instead of the proxy. Setting both is harmless and future-proof.
+
+If you are running behind a reverse proxy that terminates TLS, nothing else changes — `proxy_pass http://[::1]:3000` and `proxy_pass http://127.0.0.1:3000` both work because the `[::]` bind is dual-stack.
+
+#### Local development bind
+
+For `bin/dev` on your own machine, the server now defaults to Rails' native `localhost` bind (`127.0.0.1` + `[::1]`) — only reachable from the same machine. If you need external access (phone on the same WiFi, devcontainer port forwarding, LAN testing), set the Rails-native env var:
+
+```bash
+BINDING=0.0.0.0 bin/dev   # reachable from LAN
+BINDING=::       bin/dev  # IPv6 dual-stack
+```
+
+The bundled devcontainer at `.devcontainer/docker-compose.yml` already pins `BINDING: "0.0.0.0"` so Docker port forwarding reaches the app — no manual override needed when using the devcontainer.
+
 ### Step 4: Run the app
 
 You are now ready to run the app. Start with the following command to make sure everything is working:
diff --git a/docs/hosting/pipelock.md b/docs/hosting/pipelock.md
index b1f039eeb..08c14fb13 100644
--- a/docs/hosting/pipelock.md
+++ b/docs/hosting/pipelock.md
@@ -77,13 +77,13 @@ Enable Pipelock in your Helm values:
 pipelock:
   enabled: true
   image:
-    tag: "2.0.0"
+    tag: "2.2.0"
   mode: balanced
 ```
 
 This creates a separate Deployment, Service, and ConfigMap. The chart auto-injects `HTTPS_PROXY`/`HTTP_PROXY`/`NO_PROXY` into web and worker pods.
 
-v2.0 adds trusted domain allowlisting, MCP tool redirect profiles, enhanced tool poisoning detection (full JSON schema scanning), and per-read kill switch preemption on long-lived connections. Process sandboxing and attack simulation are also available via `extraConfig` and CLI.
+Recent pipelock releases add trusted domain allowlisting, MCP tool redirect profiles, enhanced tool poisoning detection (full JSON schema scanning), per-read kill switch preemption, signed action receipts, per-pattern DLP warn mode, and the `pipelock posture verify` / `pipelock session` CLI commands. See the [pipelock changelog](https://github.com/luckyPipewrench/pipelock/releases) for details.
 
 ### Exposing MCP to external agents (Kubernetes)
 
diff --git a/docs/hosting/webauthn.md b/docs/hosting/webauthn.md
new file mode 100644
index 000000000..2e78ceb59
--- /dev/null
+++ b/docs/hosting/webauthn.md
@@ -0,0 +1,27 @@
+# WebAuthn MFA Configuration
+
+Sure supports passkeys, Touch ID, Windows Hello, and hardware security keys as MFA credentials. WebAuthn credentials are bound to the relying party ID used when they are registered, so production deployments should pin these values explicitly instead of deriving them from incoming request headers.
+
+Set these environment variables for self-hosted deployments:
+
+```bash
+WEBAUTHN_RP_ID=example.com
+WEBAUTHN_ALLOWED_ORIGINS=https://sure.example.com
+```
+
+`WEBAUTHN_RP_ID` is usually the registrable domain, such as `example.com`, not a full URL and not a hostname with a port. This lets credentials work across subdomains when the browser permits it.
+
+`WEBAUTHN_ALLOWED_ORIGINS` is a comma-separated list of full origins where users access Sure, including scheme and host. Examples:
+
+```bash
+WEBAUTHN_ALLOWED_ORIGINS=https://sure.example.com,https://app.example.com
+```
+
+For local development, use:
+
+```bash
+WEBAUTHN_RP_ID=localhost
+WEBAUTHN_ALLOWED_ORIGINS=http://localhost:3000
+```
+
+Changing `WEBAUTHN_RP_ID` after users register credentials can make existing passkeys and security keys unavailable. Keep the value stable across reverse proxy, domain, and hostname changes.
diff --git a/docs/llm-guides/adding-a-securities-provider.md b/docs/llm-guides/adding-a-securities-provider.md
new file mode 100644
index 000000000..df0eb063d
--- /dev/null
+++ b/docs/llm-guides/adding-a-securities-provider.md
@@ -0,0 +1,493 @@
+# Adding a New Securities Price Provider
+
+This guide covers every step needed to add a new securities price provider (like Tiingo, EODHD, etc.) to the application.
+
+## Architecture Overview
+
+```text
+User searches ticker in combobox
+  → SecuritiesController#index
+    → Security.search_provider (queries all enabled providers concurrently)
+      → Provider::YourProvider#search_securities
+        → Returns results with provider key attached
+          → User selects one → price_provider stored on Security record
+
+Account sync / price fetch
+  → Security#price_data_provider (looks up provider by security.price_provider)
+    → Provider::YourProvider#fetch_security_prices
+      → Security::Price::Importer gap-fills and upserts into DB
+```
+
+Key files:
+- Provider class: `app/models/provider/your_provider.rb`
+- Registry: `app/models/provider/registry.rb`
+- Settings: `app/models/setting.rb`
+- Provider resolution: `app/models/security/provided.rb`
+- Price import: `app/models/security/price/importer.rb`
+- Market data sync: `app/models/account/market_data_importer.rb`
+
+## Step 1: Create the Provider Class
+
+Create `app/models/provider/your_provider.rb`:
+
+```ruby
+class Provider::YourProvider < Provider
+  include SecurityConcept
+
+  # Include if your provider has rate limits
+  include RateLimitable
+
+  # Custom error classes
+  Error = Class.new(Provider::Error)
+  RateLimitError = Class.new(Error)
+
+  # Rate limiting (only if you included RateLimitable)
+  MIN_REQUEST_INTERVAL = 1.0 # seconds between requests
+
+  def initialize(api_key)
+    @api_key = api_key # pipelock:ignore
+  end
+
+  # --- Required Methods ---
+
+  def search_securities(symbol, country_code: nil, exchange_operating_mic: nil)
+    with_provider_response do
+      response = client.get("#{base_url}/search", params: { q: symbol })
+      parsed = JSON.parse(response.body)
+
+      parsed.map do |result|
+        SecurityConcept::Security.new(
+          symbol:                 result["ticker"],
+          name:                   result["name"],
+          logo_url:               result["logo"],
+          exchange_operating_mic: map_exchange_to_mic(result["exchange"]),
+          country_code:           result["country"],
+          currency:               result["currency"]
+        )
+      end
+    end
+  end
+
+  def fetch_security_info(symbol:, exchange_operating_mic:)
+    with_provider_response do
+      response = client.get("#{base_url}/info/#{symbol}")
+      parsed = JSON.parse(response.body)
+
+      SecurityConcept::SecurityInfo.new(
+        symbol:                 parsed["ticker"],
+        name:                   parsed["name"],
+        links:                  parsed["website"],
+        logo_url:               parsed["logo"],
+        description:            parsed["description"],
+        kind:                   parsed["type"],       # e.g. "common stock", "etf"
+        exchange_operating_mic: exchange_operating_mic
+      )
+    end
+  end
+
+  def fetch_security_price(symbol:, exchange_operating_mic:, date:)
+    with_provider_response do
+      response = client.get("#{base_url}/price/#{symbol}", params: { date: date.to_s })
+      parsed = JSON.parse(response.body)
+
+      SecurityConcept::Price.new(
+        symbol:                 symbol,
+        date:                   Date.parse(parsed["date"]),
+        price:                  parsed["close"].to_f,
+        currency:               parsed["currency"],
+        exchange_operating_mic: exchange_operating_mic
+      )
+    end
+  end
+
+  def fetch_security_prices(symbol:, exchange_operating_mic:, start_date:, end_date:)
+    with_provider_response do
+      response = client.get("#{base_url}/prices/#{symbol}", params: {
+        start: start_date.to_s,
+        end: end_date.to_s
+      })
+      parsed = JSON.parse(response.body)
+
+      parsed.map do |row|
+        SecurityConcept::Price.new(
+          symbol:                 symbol,
+          date:                   Date.parse(row["date"]),
+          price:                  row["close"].to_f,
+          currency:               row["currency"],
+          exchange_operating_mic: exchange_operating_mic
+        )
+      end
+    end
+  end
+
+  # Optional: limit how far back the importer fetches history.
+  # nil = unlimited. Free tiers often have limits.
+  def max_history_days
+    365
+  end
+
+  # Optional: health check for admin UI
+  def healthy?
+    with_provider_response do
+      response = client.get("#{base_url}/status")
+      JSON.parse(response.body)["status"] == "ok"
+    end
+  end
+
+  # Optional: usage stats for admin UI
+  def usage
+    with_provider_response do
+      Provider::UsageData.new(
+        used: daily_request_count,
+        limit: MAX_REQUESTS_PER_DAY,
+        utilization: (daily_request_count.to_f / MAX_REQUESTS_PER_DAY * 100).round(1),
+        plan: "Free"
+      )
+    end
+  end
+
+  private
+
+    def base_url
+      "https://api.yourprovider.com/v1"
+    end
+
+    def client
+      @client ||= Faraday.new do |conn|
+        conn.headers["Authorization"] = "Bearer #{@api_key}"
+        conn.response :raise_error
+      end
+    end
+
+    # Map provider's exchange names to ISO 10383 MIC codes.
+    # This is critical — the app uses MIC codes everywhere.
+    def map_exchange_to_mic(exchange_name)
+      {
+        "NASDAQ" => "XNAS",
+        "NYSE"   => "XNYS",
+        "LSE"    => "XLON",
+        "XETRA"  => "XETR",
+        "AMS"    => "XAMS"
+        # Add all exchanges your provider returns
+      }[exchange_name]
+    end
+end
+```
+
+### Data Structures (defined in `SecurityConcept`)
+
+All methods must return these exact types (wrapped in `with_provider_response`):
+
+```ruby
+SecurityConcept::Security    = Data.define(:symbol, :name, :logo_url, :exchange_operating_mic, :country_code, :currency)
+SecurityConcept::SecurityInfo = Data.define(:symbol, :name, :links, :logo_url, :description, :kind, :exchange_operating_mic)
+SecurityConcept::Price       = Data.define(:symbol, :date, :price, :currency, :exchange_operating_mic)
+```
+
+### Error Handling
+
+All public methods must be wrapped in `with_provider_response`:
+
+```ruby
+def some_method
+  with_provider_response do
+    # Your logic. Raise on errors.
+    # The block return value becomes response.data
+  end
+end
+```
+
+Callers always receive a `Provider::Response`:
+```ruby
+response = provider.fetch_security_price(...)
+response.success?  # true/false
+response.data      # the return value from the block
+response.error     # Provider::Error instance (on failure)
+```
+
+### Rate Limiting
+
+If your provider has rate limits, include `RateLimitable` and use cache-based atomic counters:
+
+```ruby
+include RateLimitable
+
+MIN_REQUEST_INTERVAL = 1.5 # seconds between requests
+
+MAX_REQUESTS_PER_DAY = 20
+
+private
+
+  def throttle_request
+    super # enforces MIN_REQUEST_INTERVAL
+    enforce_daily_limit!
+  end
+
+  def enforce_daily_limit!
+    cache_key = "your_provider:daily:#{Date.current}"
+    count = Rails.cache.increment(cache_key, 1, expires_in: 1.day, initial: 0)
+    raise RateLimitError, "Daily limit reached" if count > MAX_REQUESTS_PER_DAY
+  end
+```
+
+### Exchange Mapping
+
+Every provider has its own naming for exchanges. You must map them to ISO 10383 MIC codes. Define bidirectional maps:
+
+```ruby
+# Provider exchange name → MIC code (for parsing search results)
+PROVIDER_TO_MIC = { "NASDAQ" => "XNAS", ... }.freeze
+
+# MIC code → Provider exchange name (for building API requests)
+MIC_TO_PROVIDER = PROVIDER_TO_MIC.invert.freeze
+```
+
+See `config/exchanges.yml` for the full list of MIC codes and their display names.
+
+### Currency Handling
+
+Some providers don't return currency in every response. Common pattern: cache currency from search results and reuse later:
+
+```ruby
+def search_securities(symbol, **opts)
+  with_provider_response do
+    results = api_call(...)
+    results.each do |r|
+      Rails.cache.write("your_provider:currency:#{r[:ticker].upcase}", r[:currency], expires_in: 24.hours)
+    end
+    # ...
+  end
+end
+
+def fetch_security_prices(symbol:, **)
+  with_provider_response do
+    # ...
+    currency = Rails.cache.read("your_provider:currency:#{symbol.upcase}") || fallback_currency(exchange)
+    # ...
+  end
+end
+```
+
+## Step 2: Register in the Provider Registry
+
+Edit `app/models/provider/registry.rb`:
+
+**Add to `available_providers`** (around line 144):
+
+```ruby
+def available_providers
+  case concept
+  when :exchange_rates
+    %i[twelve_data yahoo_finance]
+  when :securities
+    %i[twelve_data yahoo_finance tiingo eodhd alpha_vantage mfapi your_provider]
+  # ...
+  end
+end
+```
+
+**Add the factory method** (private section, around line 85):
+
+```ruby
+def your_provider
+  api_key = ENV["YOUR_PROVIDER_API_KEY"].presence || Setting.your_provider_api_key # pipelock:ignore
+  return nil unless api_key.present?
+  Provider::YourProvider.new(api_key)
+end
+```
+
+If your provider needs no API key (like Yahoo Finance or MFAPI):
+
+```ruby
+def your_provider
+  Provider::YourProvider.new
+end
+```
+
+## Step 3: Add Settings
+
+Edit `app/models/setting.rb`:
+
+**Add the API key field** (around line 40):
+
+```ruby
+field :your_provider_api_key, type: :string, default: ENV["YOUR_PROVIDER_API_KEY"]
+```
+
+**Add to encrypted fields** (in `EncryptedSettingFields`, around line 55):
+
+```ruby
+ENCRYPTED_FIELDS = %i[
+  twelve_data_api_key
+  tiingo_api_key
+  eodhd_api_key
+  alpha_vantage_api_key
+  your_provider_api_key    # ← add here
+  openai_access_token
+  external_assistant_token
+]
+```
+
+## Step 4: Add to the Settings UI
+
+### Hostings Controller
+
+Edit `app/controllers/settings/hostings_controller.rb`:
+
+**In `show`** — add a flag to control visibility:
+
+```ruby
+@show_your_provider_settings = enabled_securities.include?("your_provider")
+```
+
+**In `update`** — handle the API key:
+
+```ruby
+update_encrypted_setting(:your_provider_api_key)
+```
+
+### Hostings View
+
+Edit the settings view to add your provider's checkbox and API key field. Follow the existing pattern for Tiingo/EODHD (checkbox in the provider selection list, API key input shown when enabled).
+
+## Step 5: Add Translations
+
+Edit `config/locales/views/settings/hostings/en.yml`:
+
+**Add provider name** (under `provider_selection.providers`):
+
+```yaml
+providers:
+  twelve_data: "Twelve Data"
+  yahoo_finance: "Yahoo Finance"
+  tiingo: "Tiingo"
+  eodhd: "EODHD"
+  alpha_vantage: "Alpha Vantage"
+  mfapi: "MFAPI.in"
+  your_provider: "Your Provider"    # ← add here
+```
+
+**Add hint text** (under `provider_selection`):
+
+```yaml
+your_provider_hint: "requires API key, N calls/day limit"
+```
+
+**Add settings section** (for the API key input):
+
+```yaml
+your_provider_settings:
+  title: "Your Provider"
+  description: "Get your API key from https://yourprovider.com/dashboard"
+  label: "API Key"
+  env_configured_message: "The YOUR_PROVIDER_API_KEY environment variable is set."
+```
+
+Also add a display name in `config/locales/en.yml` under `securities.providers`:
+
+```yaml
+securities:
+  providers:
+    your_provider: "Your Provider"
+```
+
+This is used in the combobox dropdown to show which provider each search result comes from.
+
+## Step 6: Test
+
+### Manual Testing
+
+```ruby
+# In rails console:
+provider = Provider::YourProvider.new("your_api_key")
+
+# Search
+response = provider.search_securities("AAPL")
+response.success? # => true
+response.data     # => [SecurityConcept::Security(...), ...]
+
+# Price
+response = provider.fetch_security_price(symbol: "AAPL", exchange_operating_mic: "XNAS", date: Date.current)
+response.data.price    # => 150.25
+response.data.currency # => "USD"
+
+# Historical prices
+response = provider.fetch_security_prices(symbol: "AAPL", exchange_operating_mic: "XNAS", start_date: 30.days.ago.to_date, end_date: Date.current)
+response.data.size # => ~30
+```
+
+### Enable and Search
+
+```ruby
+# Enable the provider
+Setting.securities_providers = "your_provider"
+
+# Search via the app's multi-provider system
+results = Security.search_provider("AAPL")
+results.map { |s| [s.ticker, s.price_provider] }
+# => [["AAPL", "your_provider"]]
+
+# Create a security with your provider
+security = Security::Resolver.new("AAPL", exchange_operating_mic: "XNAS", price_provider: "your_provider").resolve
+security.price_provider # => "your_provider"
+
+# Import prices
+security.import_provider_prices(start_date: 30.days.ago.to_date, end_date: Date.current)
+security.prices.count
+```
+
+## How It All Connects
+
+### Search Flow
+
+When a user types in the securities combobox:
+
+1. `SecuritiesController#index` calls `Security.search_provider(query)` (`app/models/security/provided.rb`)
+2. `search_provider` queries **all enabled providers concurrently** using `Concurrent::Promises` with an 8-second timeout per provider
+3. Results are deduplicated (key: `ticker|exchange|provider`) and ranked by relevance
+4. Each result's `ComboboxOption#id` is `"TICKER|EXCHANGE|PROVIDER"` (e.g., `"AAPL|XNAS|your_provider"`)
+5. When the user selects one, `price_provider` is stored on the Security record
+
+### Price Fetch Flow
+
+When prices are needed:
+
+1. `Security#price_data_provider` looks up the provider by `security.price_provider`
+2. If the assigned provider is unavailable (disabled in settings), returns `nil` — the security is skipped, not silently switched
+3. If no provider assigned, falls back to the first enabled provider
+4. `Security::Price::Importer` calls `fetch_security_prices` and gap-fills missing dates using LOCF (last observation carried forward)
+5. Prices are upserted in batches of 200
+
+### Provider Resolution Priority
+
+```text
+security.price_provider present?
+  ├── YES → Security.provider_for(price_provider)
+  │         ├── Provider enabled & configured → use it
+  │         └── Provider unavailable → return nil (skip security)
+  └── NO  → Security.providers.first (first enabled provider)
+```
+
+## Checklist
+
+- [ ] Provider class at `app/models/provider/your_provider.rb`
+  - [ ] Inherits from `Provider`
+  - [ ] Includes `SecurityConcept`
+  - [ ] Implements `search_securities`, `fetch_security_info`, `fetch_security_price`, `fetch_security_prices`
+  - [ ] Returns correct `Data.define` types
+  - [ ] All methods wrapped in `with_provider_response`
+  - [ ] Exchange names mapped to MIC codes
+  - [ ] Currency handling (cached or mapped)
+  - [ ] Rate limiting if applicable
+- [ ] Registry entry in `app/models/provider/registry.rb`
+  - [ ] Added to `available_providers` for `:securities`
+  - [ ] Private factory method with ENV + Setting fallback
+- [ ] Setting field in `app/models/setting.rb` (if API key needed)
+  - [ ] `field :your_provider_api_key`
+  - [ ] Added to `ENCRYPTED_FIELDS`
+- [ ] Settings UI in hostings controller/view
+- [ ] Translations in `config/locales/`
+  - [ ] Provider name in `provider_selection.providers`
+  - [ ] Provider name in `securities.providers` (for combobox display)
+  - [ ] Hint text and settings section
+- [ ] Tested: search, single price, historical prices, info
diff --git a/docs/llm-guides/gating-a-preview-feature.md b/docs/llm-guides/gating-a-preview-feature.md
new file mode 100644
index 000000000..008513ed3
--- /dev/null
+++ b/docs/llm-guides/gating-a-preview-feature.md
@@ -0,0 +1,128 @@
+# Gating a preview feature
+
+Sure ships preview features behind a single per-user toggle. Users opt in via Settings → Preferences. Opted-in users see your feature; everyone else doesn't. This guide is for hooking a new feature into the gate.
+
+The intent is to ship in-progress work without blocking smaller PRs on a "feels finished" bar. You gate the entry points (routes, nav, anything that links into your feature) and iterate behind them. Once stable, you remove the gate in a small follow-up PR.
+
+## How the gate works
+
+The state lives on `users.preferences["preview_features_enabled"]`, a key inside the existing JSONB column. It defaults to `false`. Reading it goes through `User#preview_features_enabled?`.
+
+`ApplicationController` includes the `PreviewGateable` concern, which exposes two methods to every controller:
+
+- `preview_features_enabled?`. Returns a boolean. `false` for logged-out callers.
+- `require_preview_features!`. A `before_action` helper. Redirects users without preview access to `/` with a flash that points them at Settings → Preferences.
+
+The concern also registers `preview_features_enabled?` as a helper method, so views can call it directly.
+
+Key files:
+
+- `app/controllers/concerns/preview_gateable.rb`. The concern.
+- `app/models/user.rb`. The `preview_features_enabled?` predicate.
+- `app/views/settings/preferences/show.html.erb`. The toggle UI users see.
+- `app/components/DS/pill.rb`. The `Preview` / `Canary` marker pill.
+- `config/locales/views/preview/en.yml`. The redirect flash copy.
+
+## Gating a controller
+
+Add `require_preview_features!` as a `before_action`. That's it.
+
+```ruby
+class GoalsController < ApplicationController
+  before_action :require_preview_features!
+end
+```
+
+Routes stay defined; the gate runs per-request. Users without preview access hitting `/goals` get redirected with a flash. Preview users pass through.
+
+If only some actions are gated, scope the `before_action`:
+
+```ruby
+class TransactionsController < ApplicationController
+  before_action :require_preview_features!, only: %i[forecast scenarios]
+end
+```
+
+## Gating a view
+
+Wrap the relevant fragment in the helper:
+
+```erb
+<% if preview_features_enabled? %>
+  <li>
+    <%= link_to t(".nav.goals"), goals_path %>
+  </li>
+<% end %>
+```
+
+Same pattern works for dashboard widgets, scoreboard cards, anything that surfaces preview data alongside non-preview data. The helper resolves on every request and reflects the current user's preference.
+
+## Marking the feature in the UI
+
+When a preview surface renders for an opted-in user, mark it. The pill component lives in the design system:
+
+```erb
+<%# Next to a page header. The md size pairs with h1 / h2. %>
+<%= render DS::Pill.new(label: "Preview", size: :md) %>
+
+<%# Next to a sidebar nav label or section title. sm is the default. %>
+<%= render DS::Pill.new(label: "Preview") %>
+
+<%# Same shape, fuchsia tone, for canary / experimental surfaces. %>
+<%= render DS::Pill.new(label: "Canary", tone: :fuchsia) %>
+
+<%# Sidebar icon rail has no room for a label. The dot-only mode keeps the tone semantics without the text. %>
+<%= render DS::Pill.new(tone: :violet, dot_only: true, title: "Preview") %>
+```
+
+Default tone is violet. Tones available: `violet`, `indigo`, `fuchsia`, `amber`, `gray`. Styles: `soft` (default), `filled`, `outline`. Sizes: `sm` (default), `md`. The Lookbook preview at `/design-system` (look for `PillComponentPreview#default`) flips every option, so you can see what your call site renders without a round trip to Rails.
+
+## Tests
+
+Gated controllers should test both states. The pattern:
+
+```ruby
+class GoalsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in @user = users(:family_admin)
+  end
+
+  test "redirects users without preview access" do
+    @user.update!(preferences: (@user.preferences || {}).merge("preview_features_enabled" => false))
+
+    get goals_url
+
+    assert_redirected_to root_path
+    assert_match(/preview/i, flash[:alert])
+  end
+
+  test "renders for users with preview access" do
+    @user.update!(preferences: (@user.preferences || {}).merge("preview_features_enabled" => true))
+
+    get goals_url
+
+    assert_response :success
+  end
+end
+```
+
+If you write a system test, flip the preference in setup the same way before the visit.
+
+## Removing the gate when the feature ships GA
+
+When a feature moves from preview to general availability, removing the gate is a small mechanical PR:
+
+1. Drop the `before_action :require_preview_features!` line from the controller.
+2. Unwrap the `if preview_features_enabled?` blocks in views.
+3. Drop the `DS::Pill` markers from headers, nav, and section titles.
+4. Delete the controller / view tests that exercise the redirect.
+
+Grep for `require_preview_features!` and `preview_features_enabled?` near your feature to confirm nothing's left behind.
+
+## Notes
+
+The flag is per-user, not per-family. Two users in the same family can see different versions of the product if one opts in and the other doesn't. That's intentional. Data is family-scoped, but visibility is a personal preference. If you write a feature that creates family-shared data (goals, budgets, etc.), the data persists when a user toggles preview off. The UI just disappears from their view while still showing up for opted-in family members.
+
+The gate does nothing for background jobs. If your feature has a Sidekiq cron job, it runs regardless of who has preview enabled. That's usually correct (data should keep flowing), but if the job sends notifications or emails, gate those at the send site too.
+
+The redirect target is `/`. If you want gated controllers to land somewhere else (a docs page, an opt-in nudge), override `require_preview_features!` in the controller, or write a thin custom `before_action` that calls `preview_features_enabled?` directly.
diff --git a/lib/active_record_encryption_config.rb b/lib/active_record_encryption_config.rb
new file mode 100644
index 000000000..463976adc
--- /dev/null
+++ b/lib/active_record_encryption_config.rb
@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module ActiveRecordEncryptionConfig
+  ENV_KEYS = %w[
+    ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY
+    ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY
+    ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT
+  ].freeze
+
+  CONFIG_KEYS = %i[
+    primary_key
+    deterministic_key
+    key_derivation_salt
+  ].freeze
+
+  module_function
+
+  def complete_env?(env = ENV)
+    ENV_KEYS.all? { |key| env_value_present?(env, key) }
+  end
+
+  def partial_env?(env = ENV)
+    present_count = ENV_KEYS.count { |key| env_value_present?(env, key) }
+    present_count.positive? && present_count < ENV_KEYS.count
+  end
+
+  def missing_env_keys(env = ENV)
+    ENV_KEYS.reject { |key| env_value_present?(env, key) }
+  end
+
+  def partial_env_message(env = ENV)
+    "Active Record encryption environment variables are partially configured. Missing: #{missing_env_keys(env).join(', ')}"
+  end
+
+  def credentials_configured?(credentials = Rails.application.credentials)
+    credentials.active_record_encryption.present?
+  rescue NoMethodError
+    false
+  end
+
+  def runtime_configured?(config = Rails.application.config.active_record.encryption)
+    CONFIG_KEYS.all? { |key| config.public_send(key).present? }
+  rescue NoMethodError
+    false
+  end
+
+  def explicitly_configured?
+    complete_env? || credentials_configured?
+  end
+
+  def ready?
+    explicitly_configured? || runtime_configured?
+  end
+
+  def env_value_present?(env, key)
+    env[key].present?
+  end
+end
diff --git a/lib/money.rb b/lib/money.rb
index ed1e00d48..0d1e73a88 100644
--- a/lib/money.rb
+++ b/lib/money.rb
@@ -39,16 +39,30 @@ class Money
     validate!
   end
 
-  def exchange_to(other_currency, date: Date.current, fallback_rate: nil)
+  # Exchange money to another currency
+  # Params:
+  #   other_currency: target currency code (e.g. "USD")
+  #   date: date for historical rates (default: Date.current)
+  #   custom_rate: explicit exchange rate to use (skips lookup if provided, including nil check)
+  # Priority:
+  #   1. Use custom_rate if explicitly provided (not nil)
+  #   2. Look up rate via store.find_or_fetch_rate
+  #   3. Raise ConversionError if no valid rate available
+  def exchange_to(other_currency, date: Date.current, custom_rate: nil)
     iso_code = currency.iso_code
     other_iso_code = Money::Currency.new(other_currency).iso_code
 
     if iso_code == other_iso_code
       self
     else
-      exchange_rate = store.find_or_fetch_rate(from: iso_code, to: other_iso_code, date: date)&.rate || fallback_rate
+      # Use custom rate if provided, otherwise look it up
+      if custom_rate.present?
+        exchange_rate = custom_rate.to_d
+      else
+        exchange_rate = store.find_or_fetch_rate(from: iso_code, to: other_iso_code, date: date)&.rate
+      end
 
-      raise ConversionError.new(from_currency: iso_code, to_currency: other_iso_code, date: date) unless exchange_rate
+      raise ConversionError.new(from_currency: iso_code, to_currency: other_iso_code, date: date) unless exchange_rate && exchange_rate > 0
 
       Money.new(amount * exchange_rate, other_iso_code)
     end
diff --git a/lib/money/formatting.rb b/lib/money/formatting.rb
index 9d6152fe6..2dbbe92f6 100644
--- a/lib/money/formatting.rb
+++ b/lib/money/formatting.rb
@@ -5,7 +5,7 @@ module Money::Formatting
   # European style: dot as thousands delimiter, comma as decimal separator, symbol after number
   EUROPEAN_SYMBOL_AFTER = %i[de es it tr ca ro].freeze
   # Scandinavian/Eastern European: space as thousands delimiter, comma as decimal separator, symbol after number
-  SPACE_DELIMITER_SYMBOL_AFTER = %i[pl nb].freeze
+  SPACE_DELIMITER_SYMBOL_AFTER = %i[pl nb hu].freeze
   # European style: dot as thousands delimiter, comma as decimal separator, symbol before number
   EUROPEAN_SYMBOL_BEFORE = %i[nl pt-BR].freeze
 
@@ -13,7 +13,7 @@ module Money::Formatting
     locale = options[:locale] || I18n.locale
     default_opts = format_options(locale)
 
-    number_to_currency(amount, default_opts.merge(options))
+    number_to_currency(amount, default_opts.merge(options.except(:locale)))
   end
   alias_method :to_s, :format
 
diff --git a/lib/tasks/dev_sync_stats.rake b/lib/tasks/dev_sync_stats.rake
index f7c353a7b..38f217c2d 100644
--- a/lib/tasks/dev_sync_stats.rake
+++ b/lib/tasks/dev_sync_stats.rake
@@ -124,6 +124,7 @@ namespace :dev do
       DevSyncStatsHelpers.generate_fake_stats_for_items(LunchflowItem, "lunchflow")
       DevSyncStatsHelpers.generate_fake_stats_for_items(EnableBankingItem, "enable_banking")
       DevSyncStatsHelpers.generate_fake_stats_for_items(CoinstatsItem, "coinstats")
+      DevSyncStatsHelpers.generate_fake_stats_for_items(SophtronItem, "sophtron")
 
       puts "Done! Refresh your browser to see the sync summaries."
     end
@@ -154,7 +155,7 @@ namespace :dev do
       DevSyncStatsHelpers.generate_fake_stats_for_items(LunchflowItem, "lunchflow", include_issues: true)
       DevSyncStatsHelpers.generate_fake_stats_for_items(EnableBankingItem, "enable_banking", include_issues: true)
       DevSyncStatsHelpers.generate_fake_stats_for_items(CoinstatsItem, "coinstats", include_issues: true)
-
+      DevSyncStatsHelpers.generate_fake_stats_for_items(SophtronItem, "sophtron", include_issues: true)
       puts "Done! Refresh your browser to see the sync summaries with issues."
     end
 
@@ -231,6 +232,27 @@ namespace :dev do
       end
       puts "    Created 2 LunchflowAccounts"
 
+      # Create a fake Sophtron item
+      sophtron_item = family.sophtron_items.create!(
+        name: "Test Sophtron Connection",
+        user_id: "test-user-id-#{SecureRandom.hex(16)}",
+        access_key: "test-access-key-#{SecureRandom.hex(32)}"
+      )
+      puts "  Created SophtronItem: #{sophtron_item.name}"
+
+      # Create fake Sophtron accounts
+      2.times do |i|
+        sophtron_item.sophtron_accounts.create!(
+          name: "Test Sophtron Account #{i + 1}",
+          account_id: "test-sophtron-#{SecureRandom.hex(8)}",
+          customer_id: "test-sophtron-#{SecureRandom.hex(8)}",
+          member_id: "test-sophtron-#{SecureRandom.hex(8)}",
+          currency: "USD",
+          current_balance: rand(1000..50000)
+        )
+      end
+      puts "    Created 2 SophtronAccounts"
+
       # Create a fake CoinStats item
       coinstats_item = family.coinstats_items.create!(
         name: "Test CoinStats Connection",
@@ -288,6 +310,7 @@ namespace :dev do
       DevSyncStatsHelpers.generate_fake_stats_for_items(LunchflowItem, "lunchflow", include_issues: false)
       DevSyncStatsHelpers.generate_fake_stats_for_items(CoinstatsItem, "coinstats", include_issues: true)
       DevSyncStatsHelpers.generate_fake_stats_for_items(EnableBankingItem, "enable_banking", include_issues: false)
+      DevSyncStatsHelpers.generate_fake_stats_for_items(SophtronItem, "sophtron", include_issues: false)
 
       puts "\nDone! Visit /accounts to see the sync summaries."
     end
@@ -308,6 +331,7 @@ namespace :dev do
       count += LunchflowItem.where("name LIKE ?", "Test %").destroy_all.count
       count += CoinstatsItem.where("name LIKE ?", "Test %").destroy_all.count
       count += EnableBankingItem.where("name LIKE ? OR institution_name LIKE ?", "Test %", "Test %").destroy_all.count
+      count += SophtronItem.where("name LIKE ?", "Test %").destroy_all.count
 
       puts "Removed #{count} test provider items. Done!"
     end
diff --git a/lib/tasks/simplefin_dev.rake b/lib/tasks/simplefin_dev.rake
new file mode 100644
index 000000000..10a6a9d7c
--- /dev/null
+++ b/lib/tasks/simplefin_dev.rake
@@ -0,0 +1,129 @@
+# Developer utilities for exercising the SimpleFIN setup/relink flows.
+# Safe only against development/test databases — never run against production.
+
+namespace :simplefin do
+  desc "Seed a card-replacement (fraud) scenario for the user with the given email"
+  task :seed_fraud_scenario, [ :user_email ] => :environment do |_t, args|
+    if Rails.env.production?
+      abort("Refusing to run simplefin:seed_fraud_scenario in production")
+    end
+
+    email = args[:user_email].presence ||
+      ENV["USER_EMAIL"].presence ||
+      abort("Usage: bin/rails 'simplefin:seed_fraud_scenario[user@example.com]'")
+
+    user = User.find_by!(email: email)
+    family = user.family
+    puts "Seeding fraud scenario for #{user.email} (family: #{family.id})"
+
+    # Piggyback on an existing SimpleFIN item when the family already has one,
+    # so the seeded pair renders inside that card (matching how real fraud
+    # replacements appear: both cards come from the same institution's item).
+    # Fall back to a dedicated seed item otherwise.
+    item = family.simplefin_items.where.not(name: "Dev Fraud Scenario").first
+    if item
+      puts "  Attaching to existing item: #{item.name} (#{item.id})"
+    else
+      item = family.simplefin_items.create!(
+        name: "Dev Fraud Scenario",
+        access_url: "https://example.com/seed/#{SecureRandom.hex(4)}"
+      )
+      puts "  Created standalone item: #{item.name} (#{item.id})"
+    end
+
+    old_sfa = item.simplefin_accounts.create!(
+      name: "Citi Double Cash Card-OLD (9999)",
+      account_id: "seed_citi_old_#{SecureRandom.hex(3)}",
+      currency: "USD",
+      account_type: "credit",
+      current_balance: 0,
+      org_data: { "name" => "Citibank" },
+      raw_transactions_payload: [
+        {
+          "id" => "seed_old_tx_1",
+          "transacted_at" => 60.days.ago.to_i,
+          "posted" => 60.days.ago.to_i,
+          "amount" => "-42.50",
+          "payee" => "Coffee Shop"
+        }
+      ]
+    )
+
+    sure_account = family.accounts.create!(
+      name: "Citi Double Cash (dev seed)",
+      balance: 0,
+      currency: "USD",
+      accountable: CreditCard.create!(subtype: "credit_card")
+    )
+    AccountProvider.create!(account: sure_account, provider: old_sfa)
+
+    new_sfa = item.simplefin_accounts.create!(
+      name: "Citi Double Cash Card-NEW (1111)",
+      account_id: "seed_citi_new_#{SecureRandom.hex(3)}",
+      currency: "USD",
+      account_type: "credit",
+      current_balance: -987.65,
+      org_data: { "name" => "Citibank" },
+      raw_transactions_payload: [
+        { "id" => "seed_new_tx_1", "transacted_at" => 1.day.ago.to_i, "posted" => 1.day.ago.to_i, "amount" => "-24.50", "payee" => "Lunch" },
+        { "id" => "seed_new_tx_2", "transacted_at" => 3.days.ago.to_i, "posted" => 3.days.ago.to_i, "amount" => "-120.00", "payee" => "Gas Station" }
+      ]
+    )
+
+    # Simulate a recent sync so the prompt path fires (sync_stats holds the suggestion).
+    suggestions = SimplefinItem::ReplacementDetector.new(item).call
+    sync = item.syncs.create!(
+      status: :completed,
+      sync_stats: { "replacement_suggestions" => suggestions }
+    )
+    sync.update_column(:created_at, Time.current)
+
+    puts "Created:"
+    puts "  SimplefinItem:      #{item.id}"
+    puts "  Dormant sfa (OLD):  #{old_sfa.id}"
+    puts "  Active sfa (NEW):   #{new_sfa.id}"
+    puts "  Sure account:       #{sure_account.id}"
+    puts "  Suggestions:        #{suggestions.size}"
+    puts
+    puts "Next: load the accounts page in the dev server. You should see a"
+    puts "replacement prompt on the 'Dev Fraud Scenario' SimpleFIN card."
+    puts
+    puts "To tear down: bin/rails 'simplefin:cleanup_fraud_scenario[#{email}]'"
+  end
+
+  desc "Remove all seeded fraud scenarios for the given user"
+  task :cleanup_fraud_scenario, [ :user_email ] => :environment do |_t, args|
+    if Rails.env.production?
+      abort("Refusing to run simplefin:cleanup_fraud_scenario in production")
+    end
+    email = args[:user_email].presence ||
+      ENV["USER_EMAIL"].presence ||
+      abort("Usage: bin/rails 'simplefin:cleanup_fraud_scenario[user@example.com]'")
+
+    user = User.find_by!(email: email)
+    family = user.family
+    # Drop seeded sfas by account_id prefix (see seed_* values in the seed task)
+    # plus the Sure account created by the seed. This handles both the
+    # standalone-item path and the piggyback-on-existing-item path.
+    seed_sfas = SimplefinAccount
+      .joins(:simplefin_item)
+      .where(simplefin_items: { family_id: family.id })
+      .where("account_id LIKE ?", "seed_citi_%")
+    count_sfas = seed_sfas.count
+    seed_sfas.find_each do |sfa|
+      acct = sfa.current_account
+      AccountProvider.where(provider: sfa).destroy_all
+      acct&.destroy_later if acct&.may_mark_for_deletion?
+      sfa.destroy
+    end
+    # Drop the seeded Sure account even when unlinked (name-based, safe).
+    family.accounts.where(name: "Citi Double Cash (dev seed)").find_each do |acct|
+      acct.destroy_later if acct.may_mark_for_deletion?
+    end
+    # Drop the standalone fallback item if it has no other sfas.
+    family.simplefin_items.where(name: "Dev Fraud Scenario").find_each do |item|
+      item.destroy if item.simplefin_accounts.reload.empty?
+    end
+    puts "Removed #{count_sfas} seeded sfa(s) for #{user.email}"
+  end
+end
diff --git a/lib/uuid_format.rb b/lib/uuid_format.rb
new file mode 100644
index 000000000..6e4890f9c
--- /dev/null
+++ b/lib/uuid_format.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module UuidFormat
+  PATTERN = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/i.freeze
+
+  module_function
+
+  def valid?(value)
+    PATTERN.match?(value.to_s)
+  end
+end
diff --git a/mobile/android/app/build.gradle b/mobile/android/app/build.gradle
index 98e06fdd5..786c43ba0 100644
--- a/mobile/android/app/build.gradle
+++ b/mobile/android/app/build.gradle
@@ -1,6 +1,6 @@
 plugins {
     id "com.android.application"
-    id "kotlin-android"
+    id "org.jetbrains.kotlin.android"
     id "dev.flutter.flutter-gradle-plugin"
 }
 
@@ -99,6 +99,3 @@ flutter {
     source '../..'
 }
 
-dependencies {
-    implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk7:$kotlin_version"
-}
diff --git a/mobile/android/app/src/main/AndroidManifest.xml b/mobile/android/app/src/main/AndroidManifest.xml
index 353c34933..bd068e898 100644
--- a/mobile/android/app/src/main/AndroidManifest.xml
+++ b/mobile/android/app/src/main/AndroidManifest.xml
@@ -2,7 +2,8 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
     
     <uses-permission android:name="android.permission.INTERNET"/>
-    
+    <uses-permission android:name="android.permission.USE_BIOMETRIC"/>
+
     <application
         android:label="Sure Finances"
         android:name="${applicationName}"
diff --git a/mobile/android/app/src/main/java/io/flutter/plugins/GeneratedPluginRegistrant.java b/mobile/android/app/src/main/java/io/flutter/plugins/GeneratedPluginRegistrant.java
index a345a0caa..976c65844 100644
--- a/mobile/android/app/src/main/java/io/flutter/plugins/GeneratedPluginRegistrant.java
+++ b/mobile/android/app/src/main/java/io/flutter/plugins/GeneratedPluginRegistrant.java
@@ -25,11 +25,21 @@ public final class GeneratedPluginRegistrant {
     } catch (Exception e) {
       Log.e(TAG, "Error registering plugin connectivity_plus, dev.fluttercommunity.plus.connectivity.ConnectivityPlugin", e);
     }
+    try {
+      flutterEngine.getPlugins().add(new io.flutter.plugins.flutter_plugin_android_lifecycle.FlutterAndroidLifecyclePlugin());
+    } catch (Exception e) {
+      Log.e(TAG, "Error registering plugin flutter_plugin_android_lifecycle, io.flutter.plugins.flutter_plugin_android_lifecycle.FlutterAndroidLifecyclePlugin", e);
+    }
     try {
       flutterEngine.getPlugins().add(new com.it_nomads.fluttersecurestorage.FlutterSecureStoragePlugin());
     } catch (Exception e) {
       Log.e(TAG, "Error registering plugin flutter_secure_storage, com.it_nomads.fluttersecurestorage.FlutterSecureStoragePlugin", e);
     }
+    try {
+      flutterEngine.getPlugins().add(new io.flutter.plugins.localauth.LocalAuthPlugin());
+    } catch (Exception e) {
+      Log.e(TAG, "Error registering plugin local_auth_android, io.flutter.plugins.localauth.LocalAuthPlugin", e);
+    }
     try {
       flutterEngine.getPlugins().add(new dev.fluttercommunity.plus.packageinfo.PackageInfoPlugin());
     } catch (Exception e) {
@@ -55,5 +65,10 @@ public final class GeneratedPluginRegistrant {
     } catch (Exception e) {
       Log.e(TAG, "Error registering plugin url_launcher_android, io.flutter.plugins.urllauncher.UrlLauncherPlugin", e);
     }
+    try {
+      flutterEngine.getPlugins().add(new io.flutter.plugins.webviewflutter.WebViewFlutterPlugin());
+    } catch (Exception e) {
+      Log.e(TAG, "Error registering plugin webview_flutter_android, io.flutter.plugins.webviewflutter.WebViewFlutterPlugin", e);
+    }
   }
 }
diff --git a/mobile/android/app/src/main/kotlin/am/sure/mobile/MainActivity.kt b/mobile/android/app/src/main/kotlin/am/sure/mobile/MainActivity.kt
index 65cd6f9ee..0ba2363d4 100644
--- a/mobile/android/app/src/main/kotlin/am/sure/mobile/MainActivity.kt
+++ b/mobile/android/app/src/main/kotlin/am/sure/mobile/MainActivity.kt
@@ -1,5 +1,5 @@
 package am.sure.mobile
 
-import io.flutter.embedding.android.FlutterActivity
+import io.flutter.embedding.android.FlutterFragmentActivity
 
-class MainActivity: FlutterActivity()
+class MainActivity: FlutterFragmentActivity()
diff --git a/mobile/android/build.gradle b/mobile/android/build.gradle
index 68b15a841..bc157bd1a 100644
--- a/mobile/android/build.gradle
+++ b/mobile/android/build.gradle
@@ -1,16 +1,3 @@
-buildscript {
-    ext.kotlin_version = '1.9.0'
-    repositories {
-        google()
-        mavenCentral()
-    }
-
-    dependencies {
-        classpath 'com.android.tools.build:gradle:8.1.0'
-        classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
-    }
-}
-
 allprojects {
     repositories {
         google()
diff --git a/mobile/android/gradle/wrapper/gradle-wrapper.properties b/mobile/android/gradle/wrapper/gradle-wrapper.properties
index d951fac2b..8357d8485 100644
--- a/mobile/android/gradle/wrapper/gradle-wrapper.properties
+++ b/mobile/android/gradle/wrapper/gradle-wrapper.properties
@@ -1,5 +1,5 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.12-all.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
diff --git a/mobile/android/settings.gradle b/mobile/android/settings.gradle
index 2919a5408..4644c3ead 100644
--- a/mobile/android/settings.gradle
+++ b/mobile/android/settings.gradle
@@ -19,7 +19,7 @@ pluginManagement {
 
 plugins {
     id "dev.flutter.flutter-plugin-loader" version "1.0.0"
-    id "com.android.application" version "8.5.0" apply false
+    id "com.android.application" version "8.9.1" apply false
     id "org.jetbrains.kotlin.android" version "1.9.24" apply false
 }
 
diff --git a/mobile/ios/Runner/GeneratedPluginRegistrant.m b/mobile/ios/Runner/GeneratedPluginRegistrant.m
index 5c010e574..67307bbf3 100644
--- a/mobile/ios/Runner/GeneratedPluginRegistrant.m
+++ b/mobile/ios/Runner/GeneratedPluginRegistrant.m
@@ -24,6 +24,12 @@
 @import flutter_secure_storage_darwin;
 #endif
 
+#if __has_include(<local_auth_darwin/LocalAuthPlugin.h>)
+#import <local_auth_darwin/LocalAuthPlugin.h>
+#else
+@import local_auth_darwin;
+#endif
+
 #if __has_include(<package_info_plus/FPPPackageInfoPlusPlugin.h>)
 #import <package_info_plus/FPPPackageInfoPlusPlugin.h>
 #else
@@ -54,17 +60,25 @@
 @import url_launcher_ios;
 #endif
 
+#if __has_include(<webview_flutter_wkwebview/WebViewFlutterPlugin.h>)
+#import <webview_flutter_wkwebview/WebViewFlutterPlugin.h>
+#else
+@import webview_flutter_wkwebview;
+#endif
+
 @implementation GeneratedPluginRegistrant
 
 + (void)registerWithRegistry:(NSObject<FlutterPluginRegistry>*)registry {
   [AppLinksIosPlugin registerWithRegistrar:[registry registrarForPlugin:@"AppLinksIosPlugin"]];
   [ConnectivityPlusPlugin registerWithRegistrar:[registry registrarForPlugin:@"ConnectivityPlusPlugin"]];
   [FlutterSecureStorageDarwinPlugin registerWithRegistrar:[registry registrarForPlugin:@"FlutterSecureStorageDarwinPlugin"]];
+  [LocalAuthPlugin registerWithRegistrar:[registry registrarForPlugin:@"LocalAuthPlugin"]];
   [FPPPackageInfoPlusPlugin registerWithRegistrar:[registry registrarForPlugin:@"FPPPackageInfoPlusPlugin"]];
   [PathProviderPlugin registerWithRegistrar:[registry registrarForPlugin:@"PathProviderPlugin"]];
   [SharedPreferencesPlugin registerWithRegistrar:[registry registrarForPlugin:@"SharedPreferencesPlugin"]];
   [SqflitePlugin registerWithRegistrar:[registry registrarForPlugin:@"SqflitePlugin"]];
   [URLLauncherPlugin registerWithRegistrar:[registry registrarForPlugin:@"URLLauncherPlugin"]];
+  [WebViewFlutterPlugin registerWithRegistrar:[registry registrarForPlugin:@"WebViewFlutterPlugin"]];
 }
 
 @end
diff --git a/mobile/ios/Runner/Info.plist b/mobile/ios/Runner/Info.plist
index 6db62fda2..02f8e5ec0 100644
--- a/mobile/ios/Runner/Info.plist
+++ b/mobile/ios/Runner/Info.plist
@@ -47,6 +47,8 @@
 	<true/>
 	<key>UIApplicationSupportsIndirectInputEvents</key>
 	<true/>
+	<key>NSFaceIDUsageDescription</key>
+	<string>Authenticate with Face ID to unlock the app</string>
 	<key>CFBundleURLTypes</key>
 	<array>
 		<dict>
diff --git a/mobile/lib/constants/suggested_questions.dart b/mobile/lib/constants/suggested_questions.dart
new file mode 100644
index 000000000..818be7652
--- /dev/null
+++ b/mobile/lib/constants/suggested_questions.dart
@@ -0,0 +1,14 @@
+import 'package:flutter/material.dart';
+
+/// Suggested questions shown on the empty chat screen.
+///
+/// l10n upgrade path: when Flutter localisation is added to the mobile app,
+/// replace this const list with a function that accepts [BuildContext] and
+/// returns localised strings via AppLocalizations. The call site in
+/// _EmptyState requires only a one-line change.
+const List<({IconData icon, String text})> suggestedQuestions = [
+  (icon: Icons.account_balance_wallet_outlined, text: 'What is my current net worth?'),
+  (icon: Icons.show_chart,                      text: 'How has my spending changed this month?'),
+  (icon: Icons.savings_outlined,                text: 'How can I improve my savings rate?'),
+  (icon: Icons.receipt_long_outlined,           text: 'What are my biggest expenses lately?'),
+];
diff --git a/mobile/lib/main.dart b/mobile/lib/main.dart
index 5b1a582f5..bc1b4afc6 100644
--- a/mobile/lib/main.dart
+++ b/mobile/lib/main.dart
@@ -4,16 +4,19 @@ import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
 import 'providers/auth_provider.dart';
 import 'providers/accounts_provider.dart';
+import 'providers/categories_provider.dart';
 import 'providers/transactions_provider.dart';
 import 'providers/chat_provider.dart';
 import 'providers/theme_provider.dart';
 import 'screens/backend_config_screen.dart';
 import 'screens/login_screen.dart';
+import 'screens/biometric_lock_screen.dart';
 import 'screens/main_navigation_screen.dart';
 import 'screens/sso_onboarding_screen.dart';
 import 'services/api_config.dart';
 import 'services/connectivity_service.dart';
 import 'services/log_service.dart';
+import 'services/preferences_service.dart';
 
 void main() async {
   WidgetsFlutterBinding.ensureInitialized();
@@ -36,6 +39,7 @@ class SureApp extends StatelessWidget {
         ChangeNotifierProvider(create: (_) => ConnectivityService()),
         ChangeNotifierProvider(create: (_) => AuthProvider()),
         ChangeNotifierProvider(create: (_) => ChatProvider()),
+        ChangeNotifierProvider(create: (_) => CategoriesProvider()),
         ChangeNotifierProvider(create: (_) => ThemeProvider()),
         ChangeNotifierProxyProvider<ConnectivityService, AccountsProvider>(
           create: (_) => AccountsProvider(),
@@ -161,25 +165,56 @@ class AppWrapper extends StatefulWidget {
   State<AppWrapper> createState() => _AppWrapperState();
 }
 
-class _AppWrapperState extends State<AppWrapper> {
+class _AppWrapperState extends State<AppWrapper> with WidgetsBindingObserver {
   bool _isCheckingConfig = true;
   bool _hasBackendUrl = false;
+  bool _isLocked = false;
   late final AppLinks _appLinks;
   StreamSubscription<Uri>? _linkSubscription;
 
   @override
   void initState() {
     super.initState();
+    WidgetsBinding.instance.addObserver(this);
     _checkBackendConfig();
     _initDeepLinks();
   }
 
   @override
   void dispose() {
+    WidgetsBinding.instance.removeObserver(this);
     _linkSubscription?.cancel();
     super.dispose();
   }
 
+  @override
+  void didChangeAppLifecycleState(AppLifecycleState state) {
+    if (state == AppLifecycleState.paused) {
+      _markLockedIfEnabled();
+    } else if (state == AppLifecycleState.resumed && _isLocked) {
+      // Lock screen is already showing via build(); biometric auto-triggers there.
+    }
+  }
+
+  Future<void> _markLockedIfEnabled() async {
+    final authProvider = Provider.of<AuthProvider>(context, listen: false);
+    if (!authProvider.isAuthenticated) return;
+    final enabled = await PreferencesService.instance.getBiometricEnabled();
+    if (enabled && mounted) {
+      setState(() => _isLocked = true);
+    }
+  }
+
+  void _onUnlocked() {
+    if (mounted) setState(() => _isLocked = false);
+  }
+
+  Future<void> _onLockLogout() async {
+    final authProvider = Provider.of<AuthProvider>(context, listen: false);
+    await authProvider.logout();
+    if (mounted) setState(() => _isLocked = false);
+  }
+
   void _initDeepLinks() {
     _appLinks = AppLinks();
 
@@ -222,12 +257,6 @@ class _AppWrapperState extends State<AppWrapper> {
     });
   }
 
-  void _goToBackendConfig() {
-    setState(() {
-      _hasBackendUrl = false;
-    });
-  }
-
   @override
   Widget build(BuildContext context) {
     if (_isCheckingConfig) {
@@ -256,16 +285,30 @@ class _AppWrapperState extends State<AppWrapper> {
         }
 
         if (authProvider.isAuthenticated) {
-          return const MainNavigationScreen();
+          return Stack(
+            children: [
+              const MainNavigationScreen(),
+              if (_isLocked)
+                BiometricLockScreen(
+                  onUnlocked: _onUnlocked,
+                  onLogout: _onLockLogout,
+                ),
+            ],
+          );
+        }
+
+        // Clear stale lock state so it doesn't flash on the next login.
+        if (_isLocked) {
+          WidgetsBinding.instance.addPostFrameCallback((_) {
+            if (mounted) setState(() => _isLocked = false);
+          });
         }
 
         if (authProvider.ssoOnboardingPending) {
           return const SsoOnboardingScreen();
         }
 
-        return LoginScreen(
-          onGoToSettings: _goToBackendConfig,
-        );
+        return const LoginScreen();
       },
     );
   }
diff --git a/mobile/lib/models/category.dart b/mobile/lib/models/category.dart
new file mode 100644
index 000000000..a492a0e08
--- /dev/null
+++ b/mobile/lib/models/category.dart
@@ -0,0 +1,44 @@
+class Category {
+  final String id;
+  final String name;
+  final String? color;
+  final String? icon;
+  final Category? parent;
+  final int subcategoriesCount;
+
+  Category({
+    required this.id,
+    required this.name,
+    this.color,
+    this.icon,
+    this.parent,
+    this.subcategoriesCount = 0,
+  });
+
+  factory Category.fromJson(Map<String, dynamic> json) {
+    Category? parent;
+    if (json['parent'] != null && json['parent'] is Map) {
+      parent = Category.fromJson(Map<String, dynamic>.from(json['parent']));
+    }
+
+    return Category(
+      id: json['id']?.toString() ?? '',
+      name: json['name']?.toString() ?? '',
+      color: json['color']?.toString(),
+      icon: json['icon']?.toString(),
+      parent: parent,
+      subcategoriesCount: json['subcategories_count'] as int? ?? 0,
+    );
+  }
+
+  /// Display name including full ancestor path for subcategories
+  String get displayName {
+    final parts = <String>[];
+    Category? current = this;
+    while (current != null) {
+      parts.add(current.name);
+      current = current.parent;
+    }
+    return parts.reversed.join(' > ');
+  }
+}
diff --git a/mobile/lib/models/custom_proxy_header.dart b/mobile/lib/models/custom_proxy_header.dart
new file mode 100644
index 000000000..900bd2486
--- /dev/null
+++ b/mobile/lib/models/custom_proxy_header.dart
@@ -0,0 +1,90 @@
+class CustomProxyHeader {
+  static final RegExp _headerNamePattern = RegExp(r"^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$");
+  // Reject ASCII control bytes in values to block CR/LF header injection.
+  static final RegExp _headerValueControlChars = RegExp(r'[\x00-\x1F\x7F]');
+  static const Set<String> _reservedNames = {
+    'accept',
+    'authorization',
+    'content-type',
+    'x-api-key',
+  };
+
+  final String name;
+  final String value;
+
+  CustomProxyHeader({
+    required String name,
+    required String value,
+  })  : name = name.trim(),
+        value = value.trim();
+
+  factory CustomProxyHeader.fromJson(Map<String, dynamic> json) {
+    return CustomProxyHeader(
+      name: json['name'] as String? ?? '',
+      value: json['value'] as String? ?? '',
+    );
+  }
+
+  Map<String, dynamic> toJson() => {
+        'name': name,
+        'value': value,
+      };
+
+  String get normalizedName => name.toLowerCase();
+
+  // Length is intentionally obscured: short values get a fixed 4-bullet mask
+  // and longer values get a fixed 6-bullet prefix + last 4 chars. Keeping the
+  // last 4 lets users sanity-check what they entered without leaking length.
+  String get redactedValue {
+    if (value.isEmpty) return '';
+    if (value.length <= 4) return '••••';
+    return '••••••${value.substring(value.length - 4)}';
+  }
+
+  /// Drops headers with empty/invalid name or value, then dedupes by
+  /// case-insensitive name (last write wins). Single source of truth used by
+  /// both `ApiConfig.setCustomProxyHeaders` and the persistence service.
+  static List<CustomProxyHeader> sanitize(List<CustomProxyHeader> headers) {
+    final byName = <String, CustomProxyHeader>{};
+    for (final header in headers) {
+      if (!header.isComplete) continue;
+      if (validateName(header.name) != null) continue;
+      if (validateValue(header.value) != null) continue;
+      byName[header.normalizedName] = header;
+    }
+    return byName.values.toList(growable: false);
+  }
+
+  bool get isComplete => name.isNotEmpty && value.isNotEmpty;
+
+  static String? validateName(String value) {
+    final trimmed = value.trim();
+    if (trimmed.isEmpty) return 'Header name is required';
+    if (!_headerNamePattern.hasMatch(trimmed)) {
+      return 'Use a valid HTTP header name';
+    }
+    if (_reservedNames.contains(trimmed.toLowerCase())) {
+      return 'This header is managed by the app';
+    }
+    return null;
+  }
+
+  static String? validateValue(String value) {
+    if (value.trim().isEmpty) return 'Header value is required';
+    if (_headerValueControlChars.hasMatch(value)) {
+      return 'Header value contains control characters';
+    }
+    return null;
+  }
+
+  @override
+  bool operator ==(Object other) {
+    return identical(this, other) ||
+        other is CustomProxyHeader &&
+            name == other.name &&
+            value == other.value;
+  }
+
+  @override
+  int get hashCode => Object.hash(name, value);
+}
diff --git a/mobile/lib/models/offline_transaction.dart b/mobile/lib/models/offline_transaction.dart
index 4259f40a3..0f8a877f4 100644
--- a/mobile/lib/models/offline_transaction.dart
+++ b/mobile/lib/models/offline_transaction.dart
@@ -23,6 +23,8 @@ class OfflineTransaction extends Transaction {
     required super.currency,
     required super.nature,
     super.notes,
+    super.categoryId,
+    super.categoryName,
     this.syncStatus = SyncStatus.pending,
     DateTime? createdAt,
     DateTime? updatedAt,
@@ -44,6 +46,8 @@ class OfflineTransaction extends Transaction {
       currency: transaction.currency,
       nature: transaction.nature,
       notes: transaction.notes,
+      categoryId: transaction.categoryId,
+      categoryName: transaction.categoryName,
       syncStatus: syncStatus,
     );
   }
@@ -59,6 +63,8 @@ class OfflineTransaction extends Transaction {
       currency: map['currency'] as String,
       nature: map['nature'] as String,
       notes: map['notes'] as String?,
+      categoryId: map['category_id'] as String?,
+      categoryName: map['category_name'] as String?,
       syncStatus: _parseSyncStatus(map['sync_status'] as String),
       createdAt: DateTime.parse(map['created_at'] as String),
       updatedAt: DateTime.parse(map['updated_at'] as String),
@@ -76,6 +82,8 @@ class OfflineTransaction extends Transaction {
       'currency': currency,
       'nature': nature,
       'notes': notes,
+      'category_id': categoryId,
+      'category_name': categoryName,
       'sync_status': _syncStatusToString(syncStatus),
       'created_at': createdAt.toIso8601String(),
       'updated_at': updatedAt.toIso8601String(),
@@ -92,6 +100,8 @@ class OfflineTransaction extends Transaction {
       currency: currency,
       nature: nature,
       notes: notes,
+      categoryId: categoryId,
+      categoryName: categoryName,
     );
   }
 
@@ -105,6 +115,8 @@ class OfflineTransaction extends Transaction {
     String? currency,
     String? nature,
     String? notes,
+    String? categoryId,
+    String? categoryName,
     SyncStatus? syncStatus,
     DateTime? createdAt,
     DateTime? updatedAt,
@@ -119,6 +131,8 @@ class OfflineTransaction extends Transaction {
       currency: currency ?? this.currency,
       nature: nature ?? this.nature,
       notes: notes ?? this.notes,
+      categoryId: categoryId ?? this.categoryId,
+      categoryName: categoryName ?? this.categoryName,
       syncStatus: syncStatus ?? this.syncStatus,
       createdAt: createdAt ?? this.createdAt,
       updatedAt: updatedAt ?? this.updatedAt,
diff --git a/mobile/lib/models/transaction.dart b/mobile/lib/models/transaction.dart
index 291f571c0..e20e536b3 100644
--- a/mobile/lib/models/transaction.dart
+++ b/mobile/lib/models/transaction.dart
@@ -7,6 +7,8 @@ class Transaction {
   final String currency;
   final String nature; // "expense" or "income"
   final String? notes;
+  final String? categoryId;
+  final String? categoryName;
 
   Transaction({
     this.id,
@@ -17,6 +19,8 @@ class Transaction {
     required this.currency,
     required this.nature,
     this.notes,
+    this.categoryId,
+    this.categoryName,
   });
 
   factory Transaction.fromJson(Map<String, dynamic> json) {
@@ -39,6 +43,17 @@ class Transaction {
       nature = json['nature']?.toString() ?? 'expense';
     }
 
+    // Parse category from API response
+    String? categoryId;
+    String? categoryName;
+    if (json['category'] != null && json['category'] is Map) {
+      categoryId = json['category']['id']?.toString();
+      categoryName = json['category']['name']?.toString();
+    } else if (json['category_id'] != null) {
+      categoryId = json['category_id']?.toString();
+      categoryName = json['category_name']?.toString();
+    }
+
     return Transaction(
       id: json['id']?.toString(),
       accountId: accountId,
@@ -48,6 +63,8 @@ class Transaction {
       currency: json['currency']?.toString() ?? '',
       nature: nature,
       notes: json['notes']?.toString(),
+      categoryId: categoryId,
+      categoryName: categoryName,
     );
   }
 
@@ -61,6 +78,8 @@ class Transaction {
       'currency': currency,
       'nature': nature,
       if (notes != null) 'notes': notes,
+      if (categoryId != null) 'category_id': categoryId,
+      if (categoryName != null) 'category_name': categoryName,
     };
   }
 
diff --git a/mobile/lib/providers/categories_provider.dart b/mobile/lib/providers/categories_provider.dart
new file mode 100644
index 000000000..a0d916522
--- /dev/null
+++ b/mobile/lib/providers/categories_provider.dart
@@ -0,0 +1,56 @@
+import 'package:flutter/foundation.dart';
+import '../models/category.dart' as models;
+import '../services/categories_service.dart';
+import '../services/log_service.dart';
+
+class CategoriesProvider with ChangeNotifier {
+  final CategoriesService _categoriesService = CategoriesService();
+  final LogService _log = LogService.instance;
+
+  List<models.Category> _categories = [];
+  bool _isLoading = false;
+  String? _error;
+  bool _hasFetched = false;
+
+  List<models.Category> get categories => List.unmodifiable(_categories);
+  bool get isLoading => _isLoading;
+  String? get error => _error;
+  bool get hasFetched => _hasFetched;
+
+  Future<void> fetchCategories({required String accessToken}) async {
+    if (_isLoading || _hasFetched) return;
+
+    _isLoading = true;
+    _error = null;
+    notifyListeners();
+
+    try {
+      final result = await _categoriesService.getCategories(
+        accessToken: accessToken,
+        perPage: 100,
+      );
+
+      if (result['success'] == true) {
+        _categories = result['categories'] as List<models.Category>;
+        _hasFetched = true;
+        _log.info('CategoriesProvider', 'Fetched ${_categories.length} categories');
+      } else {
+        _error = result['error'] as String?;
+        _log.error('CategoriesProvider', 'Failed to fetch categories: $_error');
+      }
+    } catch (e) {
+      _error = 'Failed to load categories';
+      _log.error('CategoriesProvider', 'Exception fetching categories: $e');
+    } finally {
+      _isLoading = false;
+      notifyListeners();
+    }
+  }
+
+  void clear() {
+    _categories = [];
+    _hasFetched = false;
+    _error = null;
+    notifyListeners();
+  }
+}
diff --git a/mobile/lib/providers/chat_provider.dart b/mobile/lib/providers/chat_provider.dart
index 158e2a147..2eb6ed212 100644
--- a/mobile/lib/providers/chat_provider.dart
+++ b/mobile/lib/providers/chat_provider.dart
@@ -14,16 +14,26 @@ class ChatProvider with ChangeNotifier {
   bool _isWaitingForResponse = false;
   String? _errorMessage;
   Timer? _pollingTimer;
+  DateTime? _pollingStartTime;
+  bool _isPollingRequestInFlight = false;
+
+  static const _pollingTimeout = Duration(seconds: 20);
 
   /// Content length of the last assistant message from the previous poll.
   /// Used to detect when the LLM has finished writing (no growth between polls).
   int? _lastAssistantContentLength;
 
+  /// Number of consecutive polls with no content growth.
+  /// Requires 2 consecutive stable polls before declaring the response complete,
+  /// to avoid prematurely stopping on a brief server-side generation pause.
+  int _stablePollingCount = 0;
+
   List<Chat> get chats => _chats;
   Chat? get currentChat => _currentChat;
   bool get isLoading => _isLoading;
   bool get isSendingMessage => _isSendingMessage;
   bool get isWaitingForResponse => _isWaitingForResponse;
+  bool get isPolling => _pollingTimer != null;
   String? get errorMessage => _errorMessage;
 
   /// Fetch list of chats
@@ -50,7 +60,8 @@ class ChatProvider with ChangeNotifier {
         _errorMessage = result['error'] ?? 'Failed to fetch chats';
       }
     } catch (e) {
-      _errorMessage = 'Error: ${e.toString()}';
+      debugPrint('fetchChats error: $e');
+      _errorMessage = 'Something went wrong. Please try again.';
     } finally {
       _isLoading = false;
       notifyListeners();
@@ -62,6 +73,10 @@ class ChatProvider with ChangeNotifier {
     required String accessToken,
     required String chatId,
   }) async {
+    // Stop any in-progress polling — the server response is the source of truth
+    // when explicitly fetching a chat. This prevents a stale poll from
+    // overwriting the freshly fetched data and ensures the message filter lifts.
+    _stopPolling();
     _isLoading = true;
     _errorMessage = null;
     notifyListeners();
@@ -79,7 +94,8 @@ class ChatProvider with ChangeNotifier {
         _errorMessage = result['error'] ?? 'Failed to fetch chat';
       }
     } catch (e) {
-      _errorMessage = 'Error: ${e.toString()}';
+      debugPrint('fetchChat error: $e');
+      _errorMessage = 'Something went wrong. Please try again.';
     } finally {
       _isLoading = false;
       notifyListeners();
@@ -137,13 +153,25 @@ class ChatProvider with ChangeNotifier {
         return null;
       }
     } catch (e) {
-      _errorMessage = 'Error: ${e.toString()}';
+      debugPrint('createChat error: $e');
+      _errorMessage = 'Something went wrong. Please try again.';
       _isLoading = false;
       notifyListeners();
       return null;
     }
   }
 
+  void _rollbackOptimisticMessage(String optimisticId, String chatId) {
+    if (_currentChat != null && _currentChat!.id == chatId) {
+      _currentChat = _currentChat!.copyWith(
+        messages: _currentChat!.messages
+            .where((m) => m.id != optimisticId)
+            .toList(),
+      );
+    }
+    _isWaitingForResponse = false;
+  }
+
   /// Send a message to the current chat.
   /// Returns true if delivery succeeded, false otherwise.
   Future<bool> sendMessage({
@@ -153,6 +181,26 @@ class ChatProvider with ChangeNotifier {
   }) async {
     _isSendingMessage = true;
     _errorMessage = null;
+
+    // Optimistically add the user message so it appears immediately — before
+    // the network round-trip completes. This makes the empty-state disappear
+    // and the typing indicator show at the same instant.
+    final now = DateTime.now();
+    final optimisticId = 'pending-${now.millisecondsSinceEpoch}';
+    final optimisticMessage = Message(
+      id: optimisticId,
+      type: 'text',
+      role: 'user',
+      content: content,
+      createdAt: now,
+      updatedAt: now,
+    );
+    if (_currentChat != null && _currentChat!.id == chatId) {
+      _currentChat = _currentChat!.copyWith(
+        messages: [..._currentChat!.messages, optimisticMessage],
+      );
+    }
+    _isWaitingForResponse = true;
     notifyListeners();
 
     try {
@@ -165,11 +213,13 @@ class ChatProvider with ChangeNotifier {
       if (result['success'] == true) {
         final message = result['message'] as Message;
 
-        // Add the message to current chat if it's loaded
+        // Replace the optimistic message with the confirmed one from the server.
         if (_currentChat != null && _currentChat!.id == chatId) {
-          _currentChat = _currentChat!.copyWith(
-            messages: [..._currentChat!.messages, message],
-          );
+          final updated = _currentChat!.messages
+              .where((m) => m.id != optimisticMessage.id)
+              .toList()
+            ..add(message);
+          _currentChat = _currentChat!.copyWith(messages: updated);
         }
 
         _errorMessage = null;
@@ -178,11 +228,16 @@ class ChatProvider with ChangeNotifier {
         _startPolling(accessToken, chatId);
         return true;
       } else {
+        // Roll back the optimistic message on failure.
+        _rollbackOptimisticMessage(optimisticId, chatId);
         _errorMessage = result['error'] ?? 'Failed to send message';
         return false;
       }
     } catch (e) {
-      _errorMessage = 'Error: ${e.toString()}';
+      // Roll back the optimistic message on error.
+      _rollbackOptimisticMessage(optimisticId, chatId);
+      debugPrint('sendMessage error: $e');
+      _errorMessage = 'Something went wrong. Please try again.';
       return false;
     } finally {
       _isSendingMessage = false;
@@ -212,15 +267,23 @@ class ChatProvider with ChangeNotifier {
           _chats[index] = updatedChat;
         }
 
-        // Update current chat if it's the same
+        // Update current chat if it's the same.
+        // Preserve existing messages — the title-update response may omit them.
         if (_currentChat != null && _currentChat!.id == chatId) {
-          _currentChat = updatedChat;
+          final Chat newChat;
+          if (updatedChat.messages.isEmpty) {
+            newChat = updatedChat.copyWith(messages: _currentChat!.messages);
+          } else {
+            newChat = updatedChat;
+          }
+          _currentChat = newChat;
         }
 
         notifyListeners();
       }
     } catch (e) {
-      _errorMessage = 'Error: ${e.toString()}';
+      debugPrint('updateChatTitle error: $e');
+      _errorMessage = 'Something went wrong. Please try again.';
       notifyListeners();
     }
   }
@@ -251,7 +314,44 @@ class ChatProvider with ChangeNotifier {
         return false;
       }
     } catch (e) {
-      _errorMessage = 'Error: ${e.toString()}';
+      debugPrint('deleteChat error: $e');
+      _errorMessage = 'Something went wrong. Please try again.';
+      notifyListeners();
+      return false;
+    }
+  }
+
+  /// Delete multiple chats
+  Future<bool> deleteMultipleChats({
+    required String accessToken,
+    required List<String> chatIds,
+  }) async {
+    try {
+      final result = await _chatService.deleteMultipleChats(
+        accessToken: accessToken,
+        chatIds: chatIds,
+      );
+
+      final deletedCount = (result['deletedCount'] as int?) ?? 0;
+      if (result['success'] == true || deletedCount > 0) {
+        final failedIds = ((result['failedIds'] as List?) ?? []).cast<String>().toSet();
+        final deleted = chatIds.toSet().difference(failedIds);
+        _chats.removeWhere((c) => deleted.contains(c.id));
+
+        if (_currentChat != null && deleted.contains(_currentChat!.id)) {
+          _currentChat = null;
+        }
+
+        notifyListeners();
+        return true;
+      }
+
+      _errorMessage = 'Failed to delete chats';
+      notifyListeners();
+      return false;
+    } catch (e) {
+      debugPrint('deleteMultipleChats error: $e');
+      _errorMessage = 'Something went wrong. Please try again.';
       notifyListeners();
       return false;
     }
@@ -261,11 +361,19 @@ class ChatProvider with ChangeNotifier {
   void _startPolling(String accessToken, String chatId) {
     _pollingTimer?.cancel();
     _lastAssistantContentLength = null;
+    _stablePollingCount = 0;
     _isWaitingForResponse = true;
+    _pollingStartTime = DateTime.now();
     notifyListeners();
 
     _pollingTimer = Timer.periodic(const Duration(seconds: 2), (timer) async {
-      await _pollForUpdates(accessToken, chatId);
+      if (_isPollingRequestInFlight) return;
+      _isPollingRequestInFlight = true;
+      try {
+        await _pollForUpdates(accessToken, chatId);
+      } finally {
+        _isPollingRequestInFlight = false;
+      }
     });
   }
 
@@ -273,7 +381,11 @@ class ChatProvider with ChangeNotifier {
   void _stopPolling() {
     _pollingTimer?.cancel();
     _pollingTimer = null;
+    _pollingStartTime = null;
+    _isPollingRequestInFlight = false;
     _isWaitingForResponse = false;
+    _lastAssistantContentLength = null;
+    _stablePollingCount = 0;
   }
 
   /// Poll for updates
@@ -320,32 +432,61 @@ class ChatProvider with ChangeNotifier {
 
         if (shouldUpdate) {
           _currentChat = updatedChat;
-          // Hide thinking indicator as soon as the first assistant content arrives.
-          if (_isWaitingForResponse) {
-            final lastMsg = updatedChat.messages.lastOrNull;
-            if (lastMsg != null && lastMsg.isAssistant && lastMsg.content.isNotEmpty) {
-              _isWaitingForResponse = false;
-            }
-          }
           notifyListeners();
         }
 
+        if (updatedChat.error != null && updatedChat.error!.isNotEmpty) {
+          if (!shouldUpdate) {
+            _currentChat = updatedChat;
+          }
+          _stopPolling();
+          _errorMessage = updatedChat.error;
+          notifyListeners();
+          return;
+        }
+
         final lastMessage = updatedChat.messages.lastOrNull;
         if (lastMessage != null && lastMessage.isAssistant) {
           final newLen = lastMessage.content.length;
-          if (newLen > (_lastAssistantContentLength ?? 0)) {
+          final previousLen = _lastAssistantContentLength;
+
+          if (newLen > (previousLen ?? -1)) {
             _lastAssistantContentLength = newLen;
-          } else {
-            // Content stable: no growth since last poll — done.
-            _stopPolling();
-            _lastAssistantContentLength = null;
-            notifyListeners();
+            _stablePollingCount = 0;
+            if (newLen > 0) {
+              // Content is growing — reset the inactivity clock.
+              _pollingStartTime = DateTime.now();
+              return; // progress made, don't evaluate timeout this tick
+            }
+            // newLen == 0: empty placeholder, keep polling
+          } else if (newLen > 0) {
+            // Content stable and non-empty.
+            // Require 2 consecutive stable polls before declaring done, to avoid
+            // stopping prematurely on a brief server-side generation pause.
+            _stablePollingCount++;
+            if (_stablePollingCount >= 2) {
+              _stopPolling();
+              _lastAssistantContentLength = null;
+              notifyListeners();
+              return;
+            }
           }
+          // newLen == 0 with previousLen already 0: still empty, keep polling
         }
       }
     } catch (e) {
+      // Network error — allow polling to continue; timeout check below will
+      // stop it if the deadline has passed.
       debugPrint('Polling error: ${e.toString()}');
     }
+
+    // Evaluate timeout only after the attempt, and only when no progress was made.
+    if (_pollingStartTime != null &&
+        DateTime.now().difference(_pollingStartTime!) >= _pollingTimeout) {
+      _stopPolling();
+      _errorMessage = 'The assistant took too long to respond. Please try again.';
+      notifyListeners();
+    }
   }
 
   /// Clear current chat
diff --git a/mobile/lib/providers/transactions_provider.dart b/mobile/lib/providers/transactions_provider.dart
index 54e682178..634f1f520 100644
--- a/mobile/lib/providers/transactions_provider.dart
+++ b/mobile/lib/providers/transactions_provider.dart
@@ -149,6 +149,8 @@ class TransactionsProvider with ChangeNotifier {
     required String currency,
     required String nature,
     String? notes,
+    String? categoryId,
+    String? categoryName,
   }) async {
     _lastAccessToken = accessToken; // Store for auto-sync
 
@@ -166,6 +168,8 @@ class TransactionsProvider with ChangeNotifier {
         currency: currency,
         nature: nature,
         notes: notes,
+        categoryId: categoryId,
+        categoryName: categoryName,
         syncStatus: SyncStatus.pending, // Start as pending
       );
 
@@ -188,6 +192,7 @@ class TransactionsProvider with ChangeNotifier {
           currency: currency,
           nature: nature,
           notes: notes,
+          categoryId: categoryId,
         ).then((result) async {
           if (_isDisposed) return;
           
diff --git a/mobile/lib/screens/backend_config_screen.dart b/mobile/lib/screens/backend_config_screen.dart
index edc50d774..b5cbf5519 100644
--- a/mobile/lib/screens/backend_config_screen.dart
+++ b/mobile/lib/screens/backend_config_screen.dart
@@ -1,7 +1,10 @@
 import 'package:flutter/material.dart';
 import 'package:shared_preferences/shared_preferences.dart';
 import 'package:http/http.dart' as http;
+import '../models/custom_proxy_header.dart';
 import '../services/api_config.dart';
+import '../services/custom_proxy_headers_service.dart';
+import '../widgets/custom_proxy_headers_editor.dart';
 
 class BackendConfigScreen extends StatefulWidget {
   final VoidCallback? onConfigSaved;
@@ -17,8 +20,10 @@ class _BackendConfigScreenState extends State<BackendConfigScreen> {
   final _urlController = TextEditingController();
   bool _isLoading = false;
   bool _isTesting = false;
+  bool _hasLoadedConfig = false;
   String? _errorMessage;
   String? _successMessage;
+  List<CustomProxyHeader> _customHeaders = [];
 
   @override
   void initState() {
@@ -33,16 +38,27 @@ class _BackendConfigScreenState extends State<BackendConfigScreen> {
   }
 
   Future<void> _loadSavedUrl() async {
-    final prefs = await SharedPreferences.getInstance();
-    final savedUrl = prefs.getString('backend_url');
-    final urlToShow = (savedUrl != null && savedUrl.isNotEmpty)
-        ? savedUrl
-        : ApiConfig.baseUrl;
-
-    if (mounted) {
-      setState(() {
-        _urlController.text = urlToShow;
-      });
+    String urlToShow = ApiConfig.baseUrl;
+    List<CustomProxyHeader> headers = const [];
+    try {
+      final prefs = await SharedPreferences.getInstance();
+      final savedUrl = prefs.getString('backend_url');
+      headers = await CustomProxyHeadersService.instance.loadHeaders();
+      if (savedUrl != null && savedUrl.isNotEmpty) {
+        urlToShow = savedUrl;
+      }
+    } catch (e, stack) {
+      // Swallow storage failures so the screen still becomes interactive with
+      // sensible defaults; the user can re-enter and re-save.
+      debugPrint('BackendConfigScreen: failed to load saved config: $e\n$stack');
+    } finally {
+      if (mounted) {
+        setState(() {
+          _urlController.text = urlToShow;
+          _customHeaders = headers;
+          _hasLoadedConfig = true;
+        });
+      }
     }
   }
 
@@ -55,6 +71,7 @@ class _BackendConfigScreenState extends State<BackendConfigScreen> {
       _successMessage = null;
     });
 
+    final previousHeaders = ApiConfig.customProxyHeaders;
     try {
       // Normalize base URL by removing trailing slashes
       final normalizedUrl = _urlController.text.trim().replaceAll(
@@ -62,10 +79,14 @@ class _BackendConfigScreenState extends State<BackendConfigScreen> {
         '',
       );
 
+      // Apply the unsaved edits only for the duration of this probe so the
+      // test reflects what the user is about to save. Restored in `finally`.
+      ApiConfig.setCustomProxyHeaders(_customHeaders);
+
       // Check /sessions/new page to verify it's a Sure backend
       final sessionsUrl = Uri.parse('$normalizedUrl/sessions/new');
       final sessionsResponse = await http
-          .get(sessionsUrl, headers: {'Accept': 'text/html'})
+          .get(sessionsUrl, headers: ApiConfig.htmlHeaders())
           .timeout(
             const Duration(seconds: 10),
             onTimeout: () {
@@ -98,6 +119,7 @@ class _BackendConfigScreenState extends State<BackendConfigScreen> {
         });
       }
     } finally {
+      ApiConfig.setCustomProxyHeaders(previousHeaders);
       if (mounted) {
         setState(() {
           _isTesting = false;
@@ -125,6 +147,10 @@ class _BackendConfigScreenState extends State<BackendConfigScreen> {
       final prefs = await SharedPreferences.getInstance();
       await prefs.setString('backend_url', normalizedUrl);
 
+      // Save custom proxy headers
+      await CustomProxyHeadersService.instance.saveHeaders(_customHeaders);
+      ApiConfig.setCustomProxyHeaders(_customHeaders);
+
       // Update ApiConfig
       ApiConfig.setBaseUrl(normalizedUrl);
 
@@ -334,6 +360,41 @@ class _BackendConfigScreenState extends State<BackendConfigScreen> {
                   validator: _validateUrl,
                   onFieldSubmitted: (_) => _saveAndContinue(),
                 ),
+                const SizedBox(height: 24),
+                ExpansionTile(
+                  tilePadding: EdgeInsets.zero,
+                  leading: const Icon(Icons.http_outlined),
+                  title: const Text('Custom proxy headers'),
+                  subtitle: Text(
+                    _customHeaders.isEmpty
+                        ? 'Optional headers for a reverse proxy or auth gateway'
+                        : '${_customHeaders.length} configured',
+                  ),
+                  children: [
+                    const SizedBox(height: 8),
+                    if (_hasLoadedConfig)
+                      CustomProxyHeadersEditor(
+                        initialHeaders: _customHeaders,
+                        onChanged: (headers) {
+                          setState(() => _customHeaders = headers);
+                        },
+                      )
+                    else
+                      const Center(
+                        child: Padding(
+                          padding: EdgeInsets.all(16),
+                          child: CircularProgressIndicator(),
+                        ),
+                      ),
+                    const SizedBox(height: 8),
+                    Text(
+                      'Headers are sent by the app with API requests. External browser SSO pages may not receive them.',
+                      style: Theme.of(context).textTheme.bodySmall?.copyWith(
+                            color: colorScheme.onSurfaceVariant,
+                          ),
+                    ),
+                  ],
+                ),
                 const SizedBox(height: 16),
 
                 // Test Connection Button
diff --git a/mobile/lib/screens/biometric_lock_screen.dart b/mobile/lib/screens/biometric_lock_screen.dart
new file mode 100644
index 000000000..536e0a9c0
--- /dev/null
+++ b/mobile/lib/screens/biometric_lock_screen.dart
@@ -0,0 +1,99 @@
+import 'package:flutter/material.dart';
+import '../services/biometric_service.dart';
+
+class BiometricLockScreen extends StatefulWidget {
+  const BiometricLockScreen({
+    super.key,
+    required this.onUnlocked,
+    this.onLogout,
+  });
+
+  final VoidCallback onUnlocked;
+  final VoidCallback? onLogout;
+
+  @override
+  State<BiometricLockScreen> createState() => _BiometricLockScreenState();
+}
+
+class _BiometricLockScreenState extends State<BiometricLockScreen> {
+  bool _isAuthenticating = false;
+
+  @override
+  void initState() {
+    super.initState();
+    // Auto-trigger biometric prompt on first show.
+    WidgetsBinding.instance.addPostFrameCallback((_) => _authenticate());
+  }
+
+  Future<void> _authenticate() async {
+    if (!mounted || _isAuthenticating) return;
+    setState(() => _isAuthenticating = true);
+
+    final success = await BiometricService.instance.authenticate();
+
+    if (!mounted) return;
+    setState(() => _isAuthenticating = false);
+
+    if (success) {
+      widget.onUnlocked();
+    } else {
+      ScaffoldMessenger.of(context).showSnackBar(
+        const SnackBar(content: Text('Authentication failed. Tap Unlock to try again.')),
+      );
+    }
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final colorScheme = Theme.of(context).colorScheme;
+
+    return Scaffold(
+      body: Center(
+        child: Padding(
+          padding: const EdgeInsets.symmetric(horizontal: 32),
+          child: Column(
+            mainAxisAlignment: MainAxisAlignment.center,
+            children: [
+              Icon(
+                Icons.lock_outline,
+                size: 72,
+                color: colorScheme.primary,
+              ),
+              const SizedBox(height: 24),
+              Text(
+                'App Locked',
+                style: Theme.of(context).textTheme.headlineSmall?.copyWith(
+                      fontWeight: FontWeight.w600,
+                    ),
+              ),
+              const SizedBox(height: 8),
+              Text(
+                'Authenticate to continue',
+                style: TextStyle(color: colorScheme.onSurfaceVariant),
+              ),
+              const SizedBox(height: 40),
+              FilledButton.icon(
+                onPressed: _isAuthenticating ? null : _authenticate,
+                icon: const Icon(Icons.fingerprint),
+                label: Text(_isAuthenticating ? 'Authenticating…' : 'Unlock'),
+                style: FilledButton.styleFrom(
+                  minimumSize: const Size(200, 50),
+                  shape: RoundedRectangleBorder(
+                    borderRadius: BorderRadius.circular(12),
+                  ),
+                ),
+              ),
+              if (widget.onLogout != null) ...[
+                const SizedBox(height: 16),
+                TextButton(
+                  onPressed: widget.onLogout,
+                  child: const Text('Log out'),
+                ),
+              ],
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/screens/chat_conversation_screen.dart b/mobile/lib/screens/chat_conversation_screen.dart
index e5e85d264..e521eb4c6 100644
--- a/mobile/lib/screens/chat_conversation_screen.dart
+++ b/mobile/lib/screens/chat_conversation_screen.dart
@@ -1,10 +1,12 @@
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
+import 'package:flutter_markdown/flutter_markdown.dart';
 import 'package:provider/provider.dart';
 import '../models/chat.dart';
 import '../providers/auth_provider.dart';
 import '../providers/chat_provider.dart';
 import '../models/message.dart';
+import '../constants/suggested_questions.dart';
 import '../widgets/typing_indicator.dart';
 
 class _SendMessageIntent extends Intent {
@@ -33,6 +35,7 @@ class _ChatConversationScreenState extends State<ChatConversationScreen> {
 
   ChatProvider? _chatProvider;
   bool _listenerAdded = false;
+  bool _isSendInFlight = false;
 
   @override
   void initState() {
@@ -67,7 +70,7 @@ class _ChatConversationScreenState extends State<ChatConversationScreen> {
   void _onChatChanged() {
     if (!mounted) return;
     final chatProvider = Provider.of<ChatProvider>(context, listen: false);
-    if (chatProvider.isWaitingForResponse || chatProvider.isSendingMessage) {
+    if (chatProvider.isWaitingForResponse || chatProvider.isSendingMessage || chatProvider.isPolling) {
       WidgetsBinding.instance.addPostFrameCallback((_) {
         if (mounted) _scrollToBottom();
       });
@@ -84,6 +87,14 @@ class _ChatConversationScreenState extends State<ChatConversationScreen> {
     }
   }
 
+  Future<void> _sendSuggestedQuestion(String question) async {
+    if (!mounted) return;
+    final chatProvider = Provider.of<ChatProvider>(context, listen: false);
+    if (chatProvider.isSendingMessage || chatProvider.isWaitingForResponse) return;
+    _messageController.text = question;
+    await _sendMessage();
+  }
+
   Future<void> _loadChat({bool forceRefresh = false}) async {
     if (_chatId == null) return;
 
@@ -119,9 +130,12 @@ class _ChatConversationScreenState extends State<ChatConversationScreen> {
   }
 
   Future<void> _sendMessage() async {
+    if (_isSendInFlight) return;
     final content = _messageController.text.trim();
     if (content.isEmpty) return;
+    setState(() => _isSendInFlight = true);
 
+    try {
     final authProvider = Provider.of<AuthProvider>(context, listen: false);
     final chatProvider = Provider.of<ChatProvider>(context, listen: false);
 
@@ -181,6 +195,9 @@ class _ChatConversationScreenState extends State<ChatConversationScreen> {
         );
       }
     });
+    } finally {
+      if (mounted) setState(() => _isSendInFlight = false);
+    }
   }
 
   Future<void> _editTitle() async {
@@ -314,31 +331,55 @@ class _ChatConversationScreenState extends State<ChatConversationScreen> {
             );
           }
 
-          final messages = chatProvider.currentChat?.messages ?? [];
+          final allMessages = chatProvider.currentChat?.messages ?? [];
+          // While waiting for the AI response, hide the last (partial/streaming)
+          // assistant message so the typing indicator shows instead of partial content.
+          // The full response is revealed once polling detects stable content.
+          final messages = chatProvider.isWaitingForResponse
+              ? allMessages.where((m) {
+                  return !(m.isAssistant && m == allMessages.lastOrNull);
+                }).toList()
+              : allMessages;
+          final firstName =
+              Provider.of<AuthProvider>(context, listen: true).user?.firstName;
 
           return Column(
             children: [
               Expanded(
-                child: ListView.builder(
-                  controller: _scrollController,
-                  padding: const EdgeInsets.all(16),
-                  itemCount: messages.length +
-                      (chatProvider.isWaitingForResponse ? 1 : 0),
-                  itemBuilder: (context, index) {
-                    if (index == messages.length) {
-                      return const _TypingIndicatorBubble();
-                    }
-                    return _MessageBubble(
-                      message: messages[index],
-                      formatTime: _formatTime,
-                    );
-                  },
-                ),
+                child: messages.isEmpty &&
+                        !chatProvider.isLoading &&
+                        !chatProvider.isSendingMessage &&
+                        !chatProvider.isWaitingForResponse
+                    ? _EmptyState(
+                        firstName: firstName,
+                        isSending: false,
+                        onQuestionTap: _sendSuggestedQuestion,
+                      )
+                    : ListView.builder(
+                        controller: _scrollController,
+                        padding: const EdgeInsets.all(16),
+                        itemCount: messages.length +
+                            (chatProvider.isWaitingForResponse ? 1 : 0),
+                        itemBuilder: (context, index) {
+                          if (index == messages.length) {
+                            return const _TypingIndicatorBubble();
+                          }
+                          return _MessageBubble(
+                            message: messages[index],
+                            formatTime: _formatTime,
+                          );
+                        },
+                      ),
               ),
 
               // Message input
               Container(
-                padding: const EdgeInsets.all(16),
+                padding: EdgeInsets.fromLTRB(
+                  16,
+                  16,
+                  16,
+                  16 + MediaQuery.paddingOf(context).bottom,
+                ),
                 decoration: BoxDecoration(
                   color: colorScheme.surface,
                   boxShadow: [
@@ -358,7 +399,7 @@ class _ChatConversationScreenState extends State<ChatConversationScreen> {
                     actions: <Type, Action<Intent>>{
                       _SendMessageIntent: CallbackAction<_SendMessageIntent>(
                         onInvoke: (_) {
-                          if (!chatProvider.isSendingMessage) _sendMessage();
+                          if (!_isSendInFlight && !chatProvider.isSendingMessage && !chatProvider.isWaitingForResponse && !chatProvider.isPolling) _sendMessage();
                           return null;
                         },
                       ),
@@ -386,7 +427,7 @@ class _ChatConversationScreenState extends State<ChatConversationScreen> {
                         const SizedBox(width: 8),
                         IconButton(
                           icon: const Icon(Icons.send),
-                          onPressed: chatProvider.isSendingMessage
+                          onPressed: (_isSendInFlight || chatProvider.isSendingMessage || chatProvider.isWaitingForResponse || chatProvider.isPolling)
                               ? null
                               : _sendMessage,
                           color: colorScheme.primary,
@@ -414,6 +455,22 @@ class _MessageBubble extends StatelessWidget {
     required this.formatTime,
   });
 
+  /// Builds the markdown stylesheet once per render context instead of inline,
+  /// avoiding redundant TextStyle allocations per message bubble.
+  MarkdownStyleSheet _markdownStyle(BuildContext context) {
+    final color = Theme.of(context).colorScheme.onSurfaceVariant;
+    return MarkdownStyleSheet.fromTheme(Theme.of(context)).copyWith(
+      p: TextStyle(color: color),
+      strong: TextStyle(color: color, fontWeight: FontWeight.bold),
+      em: TextStyle(color: color, fontStyle: FontStyle.italic),
+      listBullet: TextStyle(color: color),
+      h1: TextStyle(color: color, fontSize: 20, fontWeight: FontWeight.bold),
+      h2: TextStyle(color: color, fontSize: 18, fontWeight: FontWeight.bold),
+      h3: TextStyle(color: color, fontSize: 16, fontWeight: FontWeight.bold),
+      code: TextStyle(color: color, fontFamily: 'monospace'),
+    );
+  }
+
   @override
   Widget build(BuildContext context) {
     final colorScheme = Theme.of(context).colorScheme;
@@ -455,14 +512,27 @@ class _MessageBubble extends StatelessWidget {
                   child: Column(
                     crossAxisAlignment: CrossAxisAlignment.start,
                     children: [
-                      Text(
-                        message.content,
-                        style: TextStyle(
-                          color: isUser
-                              ? colorScheme.onPrimary
-                              : colorScheme.onSurfaceVariant,
+                      if (isUser)
+                        Text(
+                          message.content,
+                          style: TextStyle(
+                            color: colorScheme.onPrimary,
+                          ),
+                        )
+                      else
+                        MarkdownBody(
+                          data: message.content,
+                          selectable: false,
+                          softLineBreak: true,
+                          styleSheet: _markdownStyle(context),
+                          sizedImageBuilder: (config) {
+                            // Block remote images to prevent unsolicited network requests.
+                            if (config.uri.scheme == 'http' || config.uri.scheme == 'https') {
+                              return const SizedBox.shrink();
+                            }
+                            return Image.asset(config.uri.toString());
+                          },
                         ),
-                      ),
                       if (message.toolCalls != null &&
                           message.toolCalls!.isNotEmpty)
                         Padding(
@@ -514,6 +584,58 @@ class _MessageBubble extends StatelessWidget {
   }
 }
 
+class _EmptyState extends StatelessWidget {
+  final String? firstName;
+  final bool isSending;
+  final void Function(String) onQuestionTap;
+
+  const _EmptyState({
+    required this.firstName,
+    required this.isSending,
+    required this.onQuestionTap,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    final colorScheme = Theme.of(context).colorScheme;
+    final name = (firstName ?? '').trim();
+    final greeting = name.isNotEmpty ? 'Hi $name, how can I help?' : 'How can I help?';
+
+    return ListView(
+      padding: const EdgeInsets.all(24),
+      children: [
+        const SizedBox(height: 32),
+        Text(
+          greeting,
+          style: Theme.of(context).textTheme.headlineSmall?.copyWith(
+                fontWeight: FontWeight.bold,
+              ),
+          textAlign: TextAlign.center,
+        ),
+        const SizedBox(height: 32),
+        ...suggestedQuestions.map(
+          (q) => Padding(
+            padding: const EdgeInsets.only(bottom: 12),
+            child: OutlinedButton.icon(
+              onPressed: isSending ? null : () => onQuestionTap(q.text),
+              icon: Icon(q.icon, size: 20),
+              label: Text(q.text, textAlign: TextAlign.left),
+              style: OutlinedButton.styleFrom(
+                alignment: Alignment.centerLeft,
+                padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 14),
+                shape: RoundedRectangleBorder(
+                  borderRadius: BorderRadius.circular(12),
+                ),
+                foregroundColor: colorScheme.onSurface,
+              ),
+            ),
+          ),
+        ),
+      ],
+    );
+  }
+}
+
 class _TypingIndicatorBubble extends StatelessWidget {
   const _TypingIndicatorBubble();
 
diff --git a/mobile/lib/screens/chat_list_screen.dart b/mobile/lib/screens/chat_list_screen.dart
index 3c1606ecd..7868a30f5 100644
--- a/mobile/lib/screens/chat_list_screen.dart
+++ b/mobile/lib/screens/chat_list_screen.dart
@@ -12,6 +12,9 @@ class ChatListScreen extends StatefulWidget {
 }
 
 class _ChatListScreenState extends State<ChatListScreen> {
+  bool _isSelectionMode = false;
+  final Set<String> _selectedChatIds = {};
+
   @override
   void initState() {
     super.initState();
@@ -35,6 +38,89 @@ class _ChatListScreenState extends State<ChatListScreen> {
     await _loadChats();
   }
 
+  void _toggleSelectionMode() {
+    setState(() {
+      _isSelectionMode = !_isSelectionMode;
+      _selectedChatIds.clear();
+    });
+  }
+
+  void _toggleSelectAll(List<String> allIds) {
+    setState(() {
+      if (_selectedChatIds.length == allIds.length) {
+        _selectedChatIds.clear();
+      } else {
+        _selectedChatIds
+          ..clear()
+          ..addAll(allIds);
+      }
+    });
+  }
+
+  void _toggleChatSelection(String id) {
+    setState(() {
+      if (_selectedChatIds.contains(id)) {
+        _selectedChatIds.remove(id);
+      } else {
+        _selectedChatIds.add(id);
+      }
+    });
+  }
+
+  Future<void> _deleteSelectedChats() async {
+    final authProvider = Provider.of<AuthProvider>(context, listen: false);
+    final chatProvider = Provider.of<ChatProvider>(context, listen: false);
+
+    final confirmed = await showDialog<bool>(
+      context: context,
+      builder: (context) => AlertDialog(
+        title: const Text('Delete Chats'),
+        content: Text(
+          'Delete ${_selectedChatIds.length} chat(s)? This cannot be undone.',
+        ),
+        actions: [
+          TextButton(
+            onPressed: () => Navigator.pop(context, false),
+            child: const Text('Cancel'),
+          ),
+          TextButton(
+            onPressed: () => Navigator.pop(context, true),
+            child: const Text('Delete', style: TextStyle(color: Colors.red)),
+          ),
+        ],
+      ),
+    );
+
+    if (confirmed != true || !mounted) return;
+
+    final accessToken = await authProvider.getValidAccessToken();
+    if (accessToken == null) {
+      await authProvider.logout();
+      return;
+    }
+
+    final success = await chatProvider.deleteMultipleChats(
+      accessToken: accessToken,
+      chatIds: _selectedChatIds.toList(),
+    );
+
+    if (!mounted) return;
+
+    setState(() {
+      _isSelectionMode = false;
+      _selectedChatIds.clear();
+    });
+
+    ScaffoldMessenger.of(context).showSnackBar(
+      SnackBar(
+        content: Text(
+          success ? 'Chats deleted' : 'Failed to delete chats',
+        ),
+        backgroundColor: success ? Colors.green : Colors.red,
+      ),
+    );
+  }
+
   Future<void> _openNewChat() async {
     if (!mounted) return;
 
@@ -74,17 +160,38 @@ class _ChatListScreenState extends State<ChatListScreen> {
         title: const Text('Chats'),
         centerTitle: false,
         actions: [
-          Padding(
-            padding: const EdgeInsets.only(top: 12, right: 12),
-            child: InkWell(
-              onTap: _handleRefresh,
-              child: const SizedBox(
-                width: 36,
-                height: 36,
-                child: Icon(Icons.refresh),
+          if (_isSelectionMode) ...[
+            IconButton(
+              icon: const Icon(Icons.delete),
+              onPressed: _selectedChatIds.isNotEmpty ? _deleteSelectedChats : null,
+            ),
+            IconButton(
+              icon: const Icon(Icons.select_all),
+              onPressed: () {
+                final allIds = Provider.of<ChatProvider>(context, listen: false)
+                    .chats
+                    .map((c) => c.id)
+                    .toList();
+                _toggleSelectAll(allIds);
+              },
+            ),
+            IconButton(
+              icon: const Icon(Icons.close),
+              onPressed: _toggleSelectionMode,
+            ),
+          ] else ...[
+            Padding(
+              padding: const EdgeInsets.only(top: 12, right: 12),
+              child: InkWell(
+                onTap: _handleRefresh,
+                child: const SizedBox(
+                  width: 36,
+                  height: 36,
+                  child: Icon(Icons.refresh),
+                ),
               ),
             ),
-          ),
+          ],
         ],
       ),
       body: Consumer<ChatProvider>(
@@ -166,9 +273,12 @@ class _ChatListScreenState extends State<ChatListScreen> {
               itemCount: chatProvider.chats.length,
               itemBuilder: (context, index) {
                 final chat = chatProvider.chats[index];
+                final isSelected = _selectedChatIds.contains(chat.id);
                 return Dismissible(
                   key: Key(chat.id),
-                  direction: DismissDirection.endToStart,
+                  direction: _isSelectionMode
+                      ? DismissDirection.none
+                      : DismissDirection.endToStart,
                   background: Container(
                     color: Colors.red,
                     alignment: Alignment.centerRight,
@@ -208,13 +318,18 @@ class _ChatListScreenState extends State<ChatListScreen> {
                     }
                   },
                   child: ListTile(
-                    leading: CircleAvatar(
-                      backgroundColor: colorScheme.primaryContainer,
-                      child: Icon(
-                        Icons.chat,
-                        color: colorScheme.onPrimaryContainer,
-                      ),
-                    ),
+                    leading: _isSelectionMode
+                        ? Checkbox(
+                            value: isSelected,
+                            onChanged: (_) => _toggleChatSelection(chat.id),
+                          )
+                        : CircleAvatar(
+                            backgroundColor: colorScheme.primaryContainer,
+                            child: Icon(
+                              Icons.chat,
+                              color: colorScheme.onPrimaryContainer,
+                            ),
+                          ),
                     title: Text(
                       chat.title,
                       maxLines: 1,
@@ -223,7 +338,7 @@ class _ChatListScreenState extends State<ChatListScreen> {
                     subtitle: chat.lastMessageAt != null
                         ? Text(_formatDateTime(chat.lastMessageAt!))
                         : null,
-                    trailing: chat.messageCount != null
+                    trailing: chat.messageCount != null && !_isSelectionMode
                         ? Container(
                             padding: const EdgeInsets.symmetric(horizontal: 8, vertical: 4),
                             decoration: BoxDecoration(
@@ -241,6 +356,10 @@ class _ChatListScreenState extends State<ChatListScreen> {
                           )
                         : null,
                     onTap: () async {
+                      if (_isSelectionMode) {
+                        _toggleChatSelection(chat.id);
+                        return;
+                      }
                       await Navigator.push(
                         context,
                         MaterialPageRoute(
@@ -249,6 +368,14 @@ class _ChatListScreenState extends State<ChatListScreen> {
                       );
                       _loadChats();
                     },
+                    onLongPress: _isSelectionMode
+                        ? null
+                        : () {
+                            setState(() {
+                              _isSelectionMode = true;
+                              _selectedChatIds.add(chat.id);
+                            });
+                          },
                   ),
                 );
               },
diff --git a/mobile/lib/screens/login_screen.dart b/mobile/lib/screens/login_screen.dart
index 3c97f457e..efff02d6f 100644
--- a/mobile/lib/screens/login_screen.dart
+++ b/mobile/lib/screens/login_screen.dart
@@ -5,21 +5,40 @@ import 'package:url_launcher/url_launcher.dart';
 import 'package:flutter_svg/flutter_svg.dart';
 import '../providers/auth_provider.dart';
 import '../services/api_config.dart';
+import 'backend_config_screen.dart';
 
 class LoginScreen extends StatefulWidget {
   final VoidCallback? onGoToSettings;
 
   const LoginScreen({super.key, this.onGoToSettings});
 
+  void _openSettings(BuildContext context) {
+    if (onGoToSettings != null) {
+      onGoToSettings!();
+      return;
+    }
+    Navigator.of(context).push(
+      MaterialPageRoute<void>(
+        builder: (routeContext) => BackendConfigScreen(
+          onConfigSaved: () => Navigator.of(routeContext).pop(),
+        ),
+      ),
+    );
+  }
+
   @override
   State<LoginScreen> createState() => _LoginScreenState();
 }
 
 class _LoginScreenState extends State<LoginScreen> {
   final _formKey = GlobalKey<FormState>();
-  final _emailController = TextEditingController(text: 'user@example.com');
-  final _passwordController = TextEditingController(text: 'Password1!');
+  static const _emailPlaceholder = 'user@example.com';
+  static const _passwordPlaceholder = 'Password1!';
+  final _emailController = TextEditingController(text: _emailPlaceholder);
+  final _passwordController = TextEditingController(text: _passwordPlaceholder);
   final _otpController = TextEditingController();
+  final _emailFocus = FocusNode();
+  final _passwordFocus = FocusNode();
   bool _obscurePassword = true;
   late final TapGestureRecognizer _signUpTapRecognizer;
 
@@ -27,6 +46,17 @@ class _LoginScreenState extends State<LoginScreen> {
   void initState() {
     super.initState();
     _signUpTapRecognizer = TapGestureRecognizer()..onTap = _openSignUpPage;
+    _emailFocus.addListener(() => _clearPlaceholderOnFocus(
+          _emailFocus, _emailController, _emailPlaceholder));
+    _passwordFocus.addListener(() => _clearPlaceholderOnFocus(
+          _passwordFocus, _passwordController, _passwordPlaceholder));
+  }
+
+  void _clearPlaceholderOnFocus(
+      FocusNode node, TextEditingController controller, String placeholder) {
+    if (node.hasFocus && controller.text == placeholder) {
+      controller.clear();
+    }
   }
 
   @override
@@ -35,6 +65,8 @@ class _LoginScreenState extends State<LoginScreen> {
     _emailController.dispose();
     _passwordController.dispose();
     _otpController.dispose();
+    _emailFocus.dispose();
+    _passwordFocus.dispose();
     super.dispose();
   }
 
@@ -261,6 +293,7 @@ class _LoginScreenState extends State<LoginScreen> {
                     // Email Field
                     TextFormField(
                       controller: _emailController,
+                      focusNode: _emailFocus,
                       keyboardType: TextInputType.emailAddress,
                       autocorrect: false,
                       textInputAction: TextInputAction.next,
@@ -291,6 +324,7 @@ class _LoginScreenState extends State<LoginScreen> {
                             // Password Field
                             TextFormField(
                               controller: _passwordController,
+                              focusNode: _passwordFocus,
                               obscureText: _obscurePassword,
                               textInputAction: showOtp
                                   ? TextInputAction.next
@@ -442,7 +476,7 @@ class _LoginScreenState extends State<LoginScreen> {
 
                     // Backend URL info
                     InkWell(
-                      onTap: widget.onGoToSettings,
+                      onTap: () => widget._openSettings(context),
                       borderRadius: BorderRadius.circular(8),
                       child: Container(
                         padding: const EdgeInsets.all(12),
@@ -494,7 +528,7 @@ class _LoginScreenState extends State<LoginScreen> {
               child: IconButton(
                 icon: const Icon(Icons.settings_outlined),
                 tooltip: 'Backend Settings',
-                onPressed: widget.onGoToSettings,
+                onPressed: () => widget._openSettings(context),
               ),
             ),
           ],
diff --git a/mobile/lib/screens/settings_screen.dart b/mobile/lib/screens/settings_screen.dart
index 867e22c7b..676926153 100644
--- a/mobile/lib/screens/settings_screen.dart
+++ b/mobile/lib/screens/settings_screen.dart
@@ -3,12 +3,18 @@ import 'package:package_info_plus/package_info_plus.dart';
 import 'package:provider/provider.dart';
 import 'package:url_launcher/url_launcher.dart';
 import '../providers/auth_provider.dart';
+import '../providers/categories_provider.dart';
 import '../providers/theme_provider.dart';
 import '../services/offline_storage_service.dart';
 import '../services/log_service.dart';
+import '../services/biometric_service.dart';
 import '../services/preferences_service.dart';
 import '../services/user_service.dart';
 import 'log_viewer_screen.dart';
+import '../models/custom_proxy_header.dart';
+import '../services/api_config.dart';
+import '../services/custom_proxy_headers_service.dart';
+import '../widgets/custom_proxy_headers_editor.dart';
 
 class SettingsScreen extends StatefulWidget {
   const SettingsScreen({super.key});
@@ -22,12 +28,55 @@ class _SettingsScreenState extends State<SettingsScreen> {
   String? _appVersion;
   bool _isResettingAccount = false;
   bool _isDeletingAccount = false;
+  bool _biometricSupported = false;
+  bool _biometricEnabled = false;
+  bool _isTogglingBiometric = false;
+  List<CustomProxyHeader> _customHeaders = [];
 
   @override
   void initState() {
     super.initState();
     _loadPreferences();
     _loadAppVersion();
+    _loadBiometricState();
+    _loadCustomHeaders();
+  }
+
+  Future<void> _loadBiometricState() async {
+    final supported = await BiometricService.instance.isDeviceSupported();
+    final enabled = await PreferencesService.instance.getBiometricEnabled();
+    if (!supported && enabled) {
+      await PreferencesService.instance.setBiometricEnabled(false);
+    }
+    if (mounted) {
+      setState(() {
+        _biometricSupported = supported;
+        _biometricEnabled = supported && enabled;
+      });
+    }
+  }
+
+  Future<void> _toggleBiometric(bool value) async {
+    if (_isTogglingBiometric) return;
+    setState(() => _isTogglingBiometric = true);
+    try {
+      if (value) {
+        final success = await BiometricService.instance.authenticate(
+          reason: 'Verify biometric to enable app lock',
+        );
+        if (!mounted) return;
+        if (!success) {
+          ScaffoldMessenger.of(context).showSnackBar(
+            const SnackBar(content: Text('Biometric authentication failed.')),
+          );
+          return;
+        }
+      }
+      await PreferencesService.instance.setBiometricEnabled(value);
+      if (mounted) setState(() => _biometricEnabled = value);
+    } finally {
+      if (mounted) setState(() => _isTogglingBiometric = false);
+    }
   }
 
   Future<void> _loadAppVersion() async {
@@ -42,14 +91,26 @@ class _SettingsScreenState extends State<SettingsScreen> {
   }
 
   Future<void> _loadPreferences() async {
-    final value = await PreferencesService.instance.getGroupByType();
+    final groupByType = await PreferencesService.instance.getGroupByType();
     if (mounted) {
       setState(() {
-        _groupByType = value;
+        _groupByType = groupByType;
       });
     }
   }
 
+  Future<void> _loadCustomHeaders() async {
+    try {
+      final headers = await CustomProxyHeadersService.instance.loadHeaders();
+      if (mounted) {
+        setState(() => _customHeaders = headers);
+      }
+    } catch (e, stack) {
+      debugPrint('SettingsScreen: failed to load custom headers: $e\n$stack');
+      // Keep the existing _customHeaders state so the screen remains usable.
+    }
+  }
+
   Future<void> _handleClearLocalData(BuildContext context) async {
     final confirmed = await showDialog<bool>(
       context: context,
@@ -83,6 +144,9 @@ class _SettingsScreenState extends State<SettingsScreen> {
 
         log.info('Settings', 'Clearing all local data...');
         await offlineStorage.clearAllData();
+        if (context.mounted) {
+          Provider.of<CategoriesProvider>(context, listen: false).clear();
+        }
         log.info('Settings', 'Local data cleared successfully');
 
         if (context.mounted) {
@@ -164,6 +228,9 @@ class _SettingsScreenState extends State<SettingsScreen> {
 
       if (result['success'] == true) {
         await OfflineStorageService().clearAllData();
+        if (context.mounted) {
+          Provider.of<CategoriesProvider>(context, listen: false).clear();
+        }
 
         if (!context.mounted) return;
 
@@ -269,6 +336,79 @@ class _SettingsScreenState extends State<SettingsScreen> {
     }
   }
 
+  Future<void> _showCustomHeadersDialog() async {
+    final formKey = GlobalKey<FormState>();
+    final latestHeaders = await CustomProxyHeadersService.instance.loadHeaders();
+    if (!mounted) return;
+
+    setState(() => _customHeaders = latestHeaders);
+    var draftHeaders = List<CustomProxyHeader>.from(latestHeaders);
+
+    final saved = await showDialog<bool>(
+      context: context,
+      builder: (context) {
+        return AlertDialog(
+          title: const Text('Custom proxy headers'),
+          content: SingleChildScrollView(
+            child: Form(
+              key: formKey,
+              child: Column(
+                mainAxisSize: MainAxisSize.min,
+                crossAxisAlignment: CrossAxisAlignment.stretch,
+                children: [
+                  CustomProxyHeadersEditor(
+                    initialHeaders: draftHeaders,
+                    onChanged: (headers) => draftHeaders = headers,
+                  ),
+                  const SizedBox(height: 12),
+                  Text(
+                    'Headers are sent by the app with API requests. External browser SSO pages may not receive them.',
+                    style: Theme.of(context).textTheme.bodySmall?.copyWith(
+                          color: Theme.of(context).colorScheme.onSurfaceVariant,
+                        ),
+                  ),
+                ],
+              ),
+            ),
+          ),
+          actions: [
+            TextButton(
+              onPressed: () => Navigator.pop(context, false),
+              child: const Text('Cancel'),
+            ),
+            ElevatedButton(
+              onPressed: () {
+                if (formKey.currentState?.validate() != true) return;
+                Navigator.pop(context, true);
+              },
+              child: const Text('Save'),
+            ),
+          ],
+        );
+      },
+    );
+
+    if (saved != true) return;
+
+    try {
+      await CustomProxyHeadersService.instance.saveHeaders(draftHeaders);
+      ApiConfig.setCustomProxyHeaders(draftHeaders);
+      if (!mounted) return;
+      setState(() => _customHeaders = draftHeaders);
+      ScaffoldMessenger.of(context).showSnackBar(
+        const SnackBar(content: Text('Custom proxy headers saved')),
+      );
+    } catch (e) {
+      if (!mounted) return;
+      ScaffoldMessenger.of(context).showSnackBar(
+        SnackBar(
+          content: Text('Failed to save custom proxy headers: $e'),
+          backgroundColor: Theme.of(context).colorScheme.error,
+        ),
+      );
+    }
+  }
+
   @override
   Widget build(BuildContext context) {
     final colorScheme = Theme.of(context).colorScheme;
@@ -433,6 +573,31 @@ class _SettingsScreenState extends State<SettingsScreen> {
 
           const Divider(),
 
+          const Padding(
+            padding: EdgeInsets.fromLTRB(16, 16, 16, 8),
+            child: Text(
+              'Connection',
+              style: TextStyle(
+                fontSize: 14,
+                fontWeight: FontWeight.bold,
+                color: Colors.grey,
+              ),
+            ),
+          ),
+
+          ListTile(
+            leading: const Icon(Icons.http_outlined),
+            title: const Text('Custom proxy headers'),
+            subtitle: Text(
+              _customHeaders.isEmpty
+                  ? 'Optional headers for a reverse proxy or auth gateway'
+                  : '${_customHeaders.length} configured',
+            ),
+            onTap: _showCustomHeadersDialog,
+          ),
+
+          const Divider(),
+
           // Data Management Section
           const Padding(
             padding: EdgeInsets.fromLTRB(16, 16, 16, 8),
@@ -454,6 +619,30 @@ class _SettingsScreenState extends State<SettingsScreen> {
             onTap: () => _handleClearLocalData(context),
           ),
 
+          if (_biometricSupported) ...[
+            const Divider(),
+
+            const Padding(
+              padding: EdgeInsets.fromLTRB(16, 16, 16, 8),
+              child: Text(
+                'Security',
+                style: TextStyle(
+                  fontSize: 14,
+                  fontWeight: FontWeight.bold,
+                  color: Colors.grey,
+                ),
+              ),
+            ),
+
+            SwitchListTile(
+              secondary: const Icon(Icons.fingerprint),
+              title: const Text('Biometric Lock'),
+              subtitle: const Text('Require biometric authentication when resuming the app'),
+              value: _biometricEnabled,
+              onChanged: _isTogglingBiometric ? null : _toggleBiometric,
+            ),
+          ],
+
           const Divider(),
 
           // Danger Zone Section
diff --git a/mobile/lib/screens/transaction_form_screen.dart b/mobile/lib/screens/transaction_form_screen.dart
index cc4743080..d5513615b 100644
--- a/mobile/lib/screens/transaction_form_screen.dart
+++ b/mobile/lib/screens/transaction_form_screen.dart
@@ -2,7 +2,9 @@ import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
 import 'package:intl/intl.dart';
 import '../models/account.dart';
+import '../models/category.dart' as models;
 import '../providers/auth_provider.dart';
+import '../providers/categories_provider.dart';
 import '../providers/transactions_provider.dart';
 import '../services/log_service.dart';
 import '../services/connectivity_service.dart';
@@ -29,6 +31,7 @@ class _TransactionFormScreenState extends State<TransactionFormScreen> {
   String _nature = 'expense';
   bool _showMoreFields = false;
   bool _isSubmitting = false;
+  models.Category? _selectedCategory;
 
   @override
   void initState() {
@@ -38,6 +41,16 @@ class _TransactionFormScreenState extends State<TransactionFormScreen> {
     final formattedDate = DateFormat('yyyy/MM/dd').format(now);
     _dateController.text = formattedDate;
     _nameController.text = 'SureApp';
+    _fetchCategories();
+  }
+
+  Future<void> _fetchCategories() async {
+    final authProvider = Provider.of<AuthProvider>(context, listen: false);
+    final categoriesProvider = Provider.of<CategoriesProvider>(context, listen: false);
+    final accessToken = await authProvider.getValidAccessToken();
+    if (accessToken != null) {
+      categoriesProvider.fetchCategories(accessToken: accessToken);
+    }
   }
 
   @override
@@ -126,6 +139,8 @@ class _TransactionFormScreenState extends State<TransactionFormScreen> {
         currency: widget.account.currency,
         nature: _nature,
         notes: 'This transaction via mobile app.',
+        categoryId: _selectedCategory?.id,
+        categoryName: _selectedCategory?.name,
       );
 
       if (mounted) {
@@ -359,6 +374,56 @@ class _TransactionFormScreenState extends State<TransactionFormScreen> {
                               helperText: 'Optional (default: SureApp)',
                             ),
                           ),
+                          const SizedBox(height: 16),
+
+                          // Category picker
+                          Consumer<CategoriesProvider>(
+                            builder: (context, categoriesProvider, _) {
+                              if (categoriesProvider.isLoading) {
+                                return const InputDecorator(
+                                  decoration: InputDecoration(
+                                    labelText: 'Category',
+                                    prefixIcon: Icon(Icons.category),
+                                  ),
+                                  child: Text('Loading categories...'),
+                                );
+                              }
+
+                              final categories = categoriesProvider.categories;
+
+                              return DropdownButtonFormField<String?>(
+                                value: _selectedCategory?.id,
+                                decoration: const InputDecoration(
+                                  labelText: 'Category',
+                                  prefixIcon: Icon(Icons.category),
+                                  helperText: 'Optional',
+                                ),
+                                isExpanded: true,
+                                items: [
+                                  const DropdownMenuItem<String?>(
+                                    value: null,
+                                    child: Text('No category'),
+                                  ),
+                                  ...categories.map((category) {
+                                    return DropdownMenuItem<String?>(
+                                      value: category.id,
+                                      child: Text(category.displayName),
+                                    );
+                                  }),
+                                ],
+                                onChanged: (value) {
+                                  setState(() {
+                                    if (value == null) {
+                                      _selectedCategory = null;
+                                    } else {
+                                      _selectedCategory = categories
+                                          .firstWhere((c) => c.id == value);
+                                    }
+                                  });
+                                },
+                              );
+                            },
+                          ),
                         ],
 
                         const SizedBox(height: 32),
diff --git a/mobile/lib/screens/transactions_list_screen.dart b/mobile/lib/screens/transactions_list_screen.dart
index df5bced82..0aa6ab131 100644
--- a/mobile/lib/screens/transactions_list_screen.dart
+++ b/mobile/lib/screens/transactions_list_screen.dart
@@ -4,8 +4,10 @@ import '../models/account.dart';
 import '../models/transaction.dart';
 import '../models/offline_transaction.dart';
 import '../providers/auth_provider.dart';
+import '../providers/categories_provider.dart';
 import '../providers/transactions_provider.dart';
 import '../screens/transaction_form_screen.dart';
+import '../widgets/category_filter.dart';
 import '../widgets/sync_status_badge.dart';
 import '../services/log_service.dart';
 
@@ -24,11 +26,13 @@ class TransactionsListScreen extends StatefulWidget {
 class _TransactionsListScreenState extends State<TransactionsListScreen> {
   bool _isSelectionMode = false;
   final Set<String> _selectedTransactions = {};
+  Set<String> _selectedCategoryIds = {};
 
   @override
   void initState() {
     super.initState();
     _loadTransactions();
+    _loadCategories();
   }
 
   // Parse and display amount information
@@ -91,6 +95,31 @@ class _TransactionsListScreenState extends State<TransactionsListScreen> {
     }
   }
 
+  Future<void> _loadCategories() async {
+    final authProvider = Provider.of<AuthProvider>(context, listen: false);
+    final categoriesProvider = Provider.of<CategoriesProvider>(context, listen: false);
+    final accessToken = await authProvider.getValidAccessToken();
+    if (accessToken != null) {
+      await categoriesProvider.fetchCategories(accessToken: accessToken);
+    }
+  }
+
+  String? _getCategoryDisplayName(String? categoryId, String? fallbackName) {
+    if (categoryId == null) return fallbackName;
+    final categoriesProvider = Provider.of<CategoriesProvider>(context);
+    for (final cat in categoriesProvider.categories) {
+      if (cat.id == categoryId) return cat.displayName;
+    }
+    return fallbackName;
+  }
+
+  List<OfflineTransaction> _getFilteredTransactions(List<OfflineTransaction> transactions) {
+    if (_selectedCategoryIds.isEmpty) return transactions;
+    return transactions.where((t) =>
+      t.categoryId != null && _selectedCategoryIds.contains(t.categoryId)
+    ).toList();
+  }
+
   Future<void> _loadTransactions() async {
     final authProvider = Provider.of<AuthProvider>(context, listen: false);
     final transactionsProvider = Provider.of<TransactionsProvider>(context, listen: false);
@@ -368,9 +397,9 @@ class _TransactionsListScreenState extends State<TransactionsListScreen> {
             );
           }
 
-          final transactions = transactionsProvider.offlineTransactions;
+          final allTransactions = transactionsProvider.offlineTransactions;
 
-          if (transactions.isEmpty) {
+          if (allTransactions.isEmpty) {
             return RefreshIndicator(
               onRefresh: _loadTransactions,
               child: CustomScrollView(
@@ -410,9 +439,48 @@ class _TransactionsListScreenState extends State<TransactionsListScreen> {
             );
           }
 
+          final transactions = _getFilteredTransactions(allTransactions);
+
           return RefreshIndicator(
             onRefresh: _loadTransactions,
-            child: ListView.builder(
+            child: Column(
+              children: [
+                Consumer<CategoriesProvider>(
+                  builder: (context, categoriesProvider, _) {
+                    if (categoriesProvider.isLoading || categoriesProvider.categories.isEmpty) {
+                      return const SizedBox.shrink();
+                    }
+                    return Padding(
+                      padding: const EdgeInsets.only(top: 8, bottom: 4),
+                      child: CategoryFilter(
+                        availableCategories: categoriesProvider.categories,
+                        selectedCategoryIds: _selectedCategoryIds,
+                        onSelectionChanged: (categoryIds) {
+                          setState(() {
+                            _selectedCategoryIds = categoryIds;
+                          });
+                        },
+                      ),
+                    );
+                  },
+                ),
+                Expanded(
+                  child: transactions.isEmpty
+                    ? ListView(
+                        physics: const AlwaysScrollableScrollPhysics(),
+                        children: [
+                          SizedBox(
+                            height: MediaQuery.of(context).size.height * 0.4,
+                            child: Center(
+                              child: Text(
+                                'No transactions match this category',
+                                style: TextStyle(color: colorScheme.onSurfaceVariant),
+                              ),
+                            ),
+                          ),
+                        ],
+                      )
+                    : ListView.builder(
               padding: const EdgeInsets.all(16),
               itemCount: transactions.length,
               itemBuilder: (context, index) {
@@ -485,11 +553,42 @@ class _TransactionsListScreenState extends State<TransactionsListScreen> {
                               child: Column(
                                 crossAxisAlignment: CrossAxisAlignment.start,
                                 children: [
-                                  Text(
-                                    transaction.name,
-                                    style: Theme.of(context).textTheme.titleMedium?.copyWith(
-                                          fontWeight: FontWeight.w600,
+                                  Row(
+                                    children: [
+                                      Flexible(
+                                        child: Text(
+                                          transaction.name,
+                                          style: Theme.of(context).textTheme.titleMedium?.copyWith(
+                                                fontWeight: FontWeight.w600,
+                                              ),
+                                          overflow: TextOverflow.ellipsis,
                                         ),
+                                      ),
+                                      if (transaction.categoryName != null) ...[
+                                        const SizedBox(width: 8),
+                                        Flexible(
+                                          flex: 0,
+                                          child: Container(
+                                            padding: const EdgeInsets.symmetric(horizontal: 8, vertical: 2),
+                                            decoration: BoxDecoration(
+                                              color: colorScheme.primaryContainer.withValues(alpha: 0.5),
+                                              borderRadius: BorderRadius.circular(12),
+                                              border: Border.all(
+                                                color: colorScheme.primary.withValues(alpha: 0.3),
+                                              ),
+                                            ),
+                                            child: Text(
+                                              _getCategoryDisplayName(transaction.categoryId, transaction.categoryName) ?? '',
+                                              style: Theme.of(context).textTheme.labelSmall?.copyWith(
+                                                    color: colorScheme.onPrimaryContainer,
+                                                    fontWeight: FontWeight.w500,
+                                                  ),
+                                              overflow: TextOverflow.ellipsis,
+                                            ),
+                                          ),
+                                        ),
+                                      ],
+                                    ],
                                   ),
                                   const SizedBox(height: 4),
                                   Text(
@@ -566,6 +665,9 @@ class _TransactionsListScreenState extends State<TransactionsListScreen> {
                   ),
                 );
               },
+            ),
+                ),
+              ],
             ),
           );
         },
diff --git a/mobile/lib/services/api_config.dart b/mobile/lib/services/api_config.dart
index 441618a7c..a012786d0 100644
--- a/mobile/lib/services/api_config.dart
+++ b/mobile/lib/services/api_config.dart
@@ -1,5 +1,8 @@
 import 'package:shared_preferences/shared_preferences.dart';
 
+import '../models/custom_proxy_header.dart';
+import 'custom_proxy_headers_service.dart';
+
 class ApiConfig {
   // Base URL for the API - can be changed to point to different environments
   // For local development, use: http://10.0.2.2:3000 (Android emulator)
@@ -32,14 +35,53 @@ class ApiConfig {
     _apiKeyValue = null;
   }
 
+  // Custom proxy headers
+  static List<CustomProxyHeader> _customProxyHeaders = [];
+
+  static List<CustomProxyHeader> get customProxyHeaders =>
+      List.unmodifiable(_customProxyHeaders);
+
+  static void setCustomProxyHeaders(List<CustomProxyHeader> headers) {
+    _customProxyHeaders = CustomProxyHeader.sanitize(headers);
+  }
+
+  static Map<String, String> get customProxyHeaderMap {
+    return {
+      for (final header in _customProxyHeaders) header.name: header.value,
+    };
+  }
+
+  static Map<String, String> jsonHeaders() {
+    return {
+      ...customProxyHeaderMap,
+      'Content-Type': 'application/json',
+      'Accept': 'application/json',
+    };
+  }
+
+  static Map<String, String> htmlHeaders() {
+    return {
+      ...customProxyHeaderMap,
+      'Accept': 'text/html',
+    };
+  }
+
   /// Returns the correct auth headers based on the current auth mode.
   /// In API key mode, uses X-Api-Key header.
   /// In token mode, uses Authorization: Bearer header.
   static Map<String, String> getAuthHeaders(String token) {
     if (_isApiKeyAuth && _apiKeyValue != null) {
-      return {'X-Api-Key': _apiKeyValue!, 'Accept': 'application/json'};
+      return {
+        ...customProxyHeaderMap,
+        'X-Api-Key': _apiKeyValue!,
+        'Accept': 'application/json',
+      };
     }
-    return {'Authorization': 'Bearer $token', 'Accept': 'application/json'};
+    return {
+      ...customProxyHeaderMap,
+      'Authorization': 'Bearer $token',
+      'Accept': 'application/json',
+    };
   }
 
   /// Initialize the API configuration by loading the backend URL from storage
@@ -51,6 +93,7 @@ class ApiConfig {
 
       if (savedUrl != null && savedUrl.isNotEmpty) {
         _baseUrl = savedUrl;
+        _customProxyHeaders = await CustomProxyHeadersService.instance.loadHeaders();
         return true;
       }
 
@@ -58,6 +101,7 @@ class ApiConfig {
       // go straight to login while still letting users override it later.
       _baseUrl = _defaultBaseUrl;
       await prefs.setString(_backendUrlKey, _defaultBaseUrl);
+      _customProxyHeaders = await CustomProxyHeadersService.instance.loadHeaders();
       return true;
     } catch (e) {
       // If initialization fails, keep the default URL
diff --git a/mobile/lib/services/auth_service.dart b/mobile/lib/services/auth_service.dart
index e31c34554..e39ae6254 100644
--- a/mobile/lib/services/auth_service.dart
+++ b/mobile/lib/services/auth_service.dart
@@ -36,10 +36,7 @@ class AuthService {
 
       final response = await http.post(
         url,
-        headers: {
-          'Content-Type': 'application/json',
-          'Accept': 'application/json',
-        },
+        headers: ApiConfig.jsonHeaders(),
         body: jsonEncode(body),
       ).timeout(const Duration(seconds: 30));
 
@@ -145,10 +142,7 @@ class AuthService {
 
       final response = await http.post(
         url,
-        headers: {
-          'Content-Type': 'application/json',
-          'Accept': 'application/json',
-        },
+        headers: ApiConfig.jsonHeaders(),
         body: jsonEncode(body),
       ).timeout(const Duration(seconds: 30));
 
@@ -227,10 +221,7 @@ class AuthService {
 
       final response = await http.post(
         url,
-        headers: {
-          'Content-Type': 'application/json',
-          'Accept': 'application/json',
-        },
+        headers: ApiConfig.jsonHeaders(),
         body: jsonEncode({
           'refresh_token': refreshToken,
           'device': deviceInfo,
@@ -301,6 +292,7 @@ class AuthService {
       final response = await http.get(
         url,
         headers: {
+          ...ApiConfig.customProxyHeaderMap,
           'X-Api-Key': apiKey,
           'Accept': 'application/json',
         },
@@ -398,10 +390,7 @@ class AuthService {
       final url = Uri.parse('${ApiConfig.baseUrl}/api/v1/auth/sso_exchange');
       final response = await http.post(
         url,
-        headers: {
-          'Content-Type': 'application/json',
-          'Accept': 'application/json',
-        },
+        headers: ApiConfig.jsonHeaders(),
         body: jsonEncode({'code': code}),
       ).timeout(const Duration(seconds: 30));
 
@@ -463,10 +452,7 @@ class AuthService {
       final url = Uri.parse('${ApiConfig.baseUrl}/api/v1/auth/sso_link');
       final response = await http.post(
         url,
-        headers: {
-          'Content-Type': 'application/json',
-          'Accept': 'application/json',
-        },
+        headers: ApiConfig.jsonHeaders(),
         body: jsonEncode({
           'linking_code': linkingCode,
           'email': email,
@@ -523,10 +509,7 @@ class AuthService {
 
       final response = await http.post(
         url,
-        headers: {
-          'Content-Type': 'application/json',
-          'Accept': 'application/json',
-        },
+        headers: ApiConfig.jsonHeaders(),
         body: jsonEncode(body),
       ).timeout(const Duration(seconds: 30));
 
diff --git a/mobile/lib/services/biometric_service.dart b/mobile/lib/services/biometric_service.dart
new file mode 100644
index 000000000..b6daa17a4
--- /dev/null
+++ b/mobile/lib/services/biometric_service.dart
@@ -0,0 +1,47 @@
+import 'package:local_auth/local_auth.dart';
+import 'log_service.dart';
+
+class BiometricService {
+  static final BiometricService instance = BiometricService._();
+  BiometricService._();
+
+  final LocalAuthentication _auth = LocalAuthentication();
+
+  /// Returns true when the platform supports biometrics AND at least one
+  /// biometric is enrolled on the device.
+  Future<bool> isDeviceSupported() async {
+    try {
+      final isSupported = await _auth.isDeviceSupported();
+      if (!isSupported) return false;
+      final enrolled = await _auth.getAvailableBiometrics();
+      return enrolled.isNotEmpty;
+    } catch (_) {
+      return false;
+    }
+  }
+
+  /// Returns the list of enrolled biometric types (fingerprint, face, etc.).
+  Future<List<BiometricType>> getAvailableBiometrics() async {
+    try {
+      return await _auth.getAvailableBiometrics();
+    } catch (_) {
+      return [];
+    }
+  }
+
+  /// Triggers the OS biometric prompt. Returns true if authentication succeeds.
+  Future<bool> authenticate({String reason = 'Unlock Sure to continue'}) async {
+    try {
+      return await _auth.authenticate(
+        localizedReason: reason,
+        options: const AuthenticationOptions(
+          stickyAuth: true,
+          biometricOnly: false,
+        ),
+      );
+    } catch (e, stack) {
+      LogService.instance.error('BiometricService', 'authenticate() failed: $e\n$stack');
+      return false;
+    }
+  }
+}
diff --git a/mobile/lib/services/categories_service.dart b/mobile/lib/services/categories_service.dart
new file mode 100644
index 000000000..c15d7f437
--- /dev/null
+++ b/mobile/lib/services/categories_service.dart
@@ -0,0 +1,81 @@
+import 'dart:convert';
+import 'package:http/http.dart' as http;
+import '../models/category.dart';
+import 'api_config.dart';
+
+class CategoriesService {
+  Future<Map<String, dynamic>> getCategories({
+    required String accessToken,
+    int? page,
+    int? perPage,
+    bool? rootsOnly,
+    String? parentId,
+  }) async {
+    final Map<String, String> queryParams = {};
+
+    if (page != null) {
+      queryParams['page'] = page.toString();
+    }
+    if (perPage != null) {
+      queryParams['per_page'] = perPage.toString();
+    }
+    if (rootsOnly == true) {
+      queryParams['roots_only'] = 'true';
+    }
+    if (parentId != null) {
+      queryParams['parent_id'] = parentId;
+    }
+
+    final baseUri = Uri.parse('${ApiConfig.baseUrl}/api/v1/categories');
+    final url = queryParams.isNotEmpty
+        ? baseUri.replace(queryParameters: queryParams)
+        : baseUri;
+
+    try {
+      final response = await http.get(
+        url,
+        headers: {
+          ...ApiConfig.getAuthHeaders(accessToken),
+          'Content-Type': 'application/json',
+        },
+      ).timeout(const Duration(seconds: 30));
+
+      if (response.statusCode == 200) {
+        final responseData = jsonDecode(response.body);
+
+        List<dynamic> categoriesJson;
+        if (responseData is List) {
+          categoriesJson = responseData;
+        } else if (responseData is Map && responseData.containsKey('categories')) {
+          categoriesJson = responseData['categories'];
+        } else {
+          categoriesJson = [];
+        }
+
+        final categories = categoriesJson
+            .map((json) => Category.fromJson(json))
+            .toList();
+
+        return {
+          'success': true,
+          'categories': categories,
+        };
+      } else if (response.statusCode == 401) {
+        return {
+          'success': false,
+          'error': 'unauthorized',
+        };
+      } else {
+        return {
+          'success': false,
+          'error': 'Failed to fetch categories',
+        };
+      }
+    } catch (e) {
+      return {
+        'success': false,
+        'error': 'Network error: ${e.toString()}',
+      };
+    }
+  }
+}
diff --git a/mobile/lib/services/chat_service.dart b/mobile/lib/services/chat_service.dart
index 1e55e57da..37b927f4c 100644
--- a/mobile/lib/services/chat_service.dart
+++ b/mobile/lib/services/chat_service.dart
@@ -331,6 +331,34 @@ class ChatService {
     }
   }
 
+  /// Delete multiple chats in parallel
+  Future<Map<String, dynamic>> deleteMultipleChats({
+    required String accessToken,
+    required List<String> chatIds,
+  }) async {
+    final results = await Future.wait(
+      chatIds.map((id) async {
+        try {
+          return await deleteChat(accessToken: accessToken, chatId: id);
+        } catch (_) {
+          return {'success': false};
+        }
+      }),
+      eagerError: false,
+    );
+    final failedIds = chatIds
+        .asMap()
+        .entries
+        .where((e) => results[e.key]['success'] != true)
+        .map((e) => e.value)
+        .toList();
+    return {
+      'success': failedIds.isEmpty,
+      'deletedCount': chatIds.length - failedIds.length,
+      'failedIds': failedIds,
+    };
+  }
+
   /// Retry the last assistant response in a chat
   Future<Map<String, dynamic>> retryMessage({
     required String accessToken,
diff --git a/mobile/lib/services/custom_proxy_headers_service.dart b/mobile/lib/services/custom_proxy_headers_service.dart
new file mode 100644
index 000000000..26fd7f37b
--- /dev/null
+++ b/mobile/lib/services/custom_proxy_headers_service.dart
@@ -0,0 +1,47 @@
+import 'dart:convert';
+
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+
+import '../models/custom_proxy_header.dart';
+
+class CustomProxyHeadersService {
+  static const String storageKey = 'custom_proxy_headers';
+
+  static CustomProxyHeadersService? _instance;
+
+  CustomProxyHeadersService._();
+
+  static CustomProxyHeadersService get instance {
+    _instance ??= CustomProxyHeadersService._();
+    return _instance!;
+  }
+
+  Future<List<CustomProxyHeader>> loadHeaders() async {
+    const storage = FlutterSecureStorage();
+    try {
+      final raw = await storage.read(key: storageKey);
+      if (raw == null || raw.isEmpty) return [];
+
+      final decoded = jsonDecode(raw);
+      if (decoded is! List) return [];
+
+      return CustomProxyHeader.sanitize(
+        decoded
+            .whereType<Map>()
+            .map((item) => CustomProxyHeader.fromJson(Map<String, dynamic>.from(item)))
+            .toList(),
+      );
+    } catch (_) {
+      return [];
+    }
+  }
+
+  Future<void> saveHeaders(List<CustomProxyHeader> headers) async {
+    const storage = FlutterSecureStorage();
+    final sanitized = CustomProxyHeader.sanitize(headers);
+    await storage.write(
+      key: storageKey,
+      value: jsonEncode(sanitized.map((header) => header.toJson()).toList()),
+    );
+  }
+}
diff --git a/mobile/lib/services/database_helper.dart b/mobile/lib/services/database_helper.dart
index 0ec4efc0f..fe893b85f 100644
--- a/mobile/lib/services/database_helper.dart
+++ b/mobile/lib/services/database_helper.dart
@@ -63,8 +63,9 @@ class DatabaseHelper {
 
       return await openDatabase(
         path,
-        version: 1,
+        version: 2,
         onCreate: _createDB,
+        onUpgrade: _upgradeDB,
       );
     } catch (e, stackTrace) {
       _log.error('DatabaseHelper', 'Error opening database file "$filePath": $e');
@@ -94,6 +95,8 @@ class DatabaseHelper {
           currency TEXT NOT NULL,
           nature TEXT NOT NULL,
           notes TEXT,
+          category_id TEXT,
+          category_name TEXT,
           sync_status TEXT NOT NULL,
           created_at TEXT NOT NULL,
           updated_at TEXT NOT NULL
@@ -148,6 +151,19 @@ class DatabaseHelper {
     }
   }
 
+  Future<void> _upgradeDB(Database db, int oldVersion, int newVersion) async {
+    if (oldVersion < 2) {
+      final columns = await db.rawQuery('PRAGMA table_info(transactions)');
+      final columnNames = columns.map((c) => c['name'] as String).toSet();
+      if (!columnNames.contains('category_id')) {
+        await db.execute('ALTER TABLE transactions ADD COLUMN category_id TEXT');
+      }
+      if (!columnNames.contains('category_name')) {
+        await db.execute('ALTER TABLE transactions ADD COLUMN category_name TEXT');
+      }
+    }
+  }
+
   // Transaction CRUD operations
   Future<String> insertTransaction(Map<String, dynamic> transaction) async {
     if (_useInMemoryStore) {
diff --git a/mobile/lib/services/offline_storage_service.dart b/mobile/lib/services/offline_storage_service.dart
index 9f5567dc6..06b0a687b 100644
--- a/mobile/lib/services/offline_storage_service.dart
+++ b/mobile/lib/services/offline_storage_service.dart
@@ -19,6 +19,8 @@ class OfflineStorageService {
     required String currency,
     required String nature,
     String? notes,
+    String? categoryId,
+    String? categoryName,
     String? serverId,
     SyncStatus syncStatus = SyncStatus.pending,
   }) async {
@@ -35,6 +37,8 @@ class OfflineStorageService {
       currency: currency,
       nature: nature,
       notes: notes,
+      categoryId: categoryId,
+      categoryName: categoryName,
       syncStatus: syncStatus,
     );
 
@@ -238,6 +242,8 @@ class OfflineStorageService {
         currency: transaction.currency,
         nature: transaction.nature,
         notes: transaction.notes,
+        categoryId: transaction.categoryId ?? existing.categoryId,
+        categoryName: transaction.categoryName ?? existing.categoryName,
         syncStatus: SyncStatus.synced,
       );
       await _dbHelper.updateTransaction(existing.localId, updated.toDatabaseMap());
@@ -257,6 +263,8 @@ class OfflineStorageService {
         currency: transaction.currency,
         nature: transaction.nature,
         notes: transaction.notes,
+        categoryId: transaction.categoryId,
+        categoryName: transaction.categoryName,
         syncStatus: SyncStatus.synced,
       );
       await _dbHelper.insertTransaction(offlineTransaction.toDatabaseMap());
diff --git a/mobile/lib/services/preferences_service.dart b/mobile/lib/services/preferences_service.dart
index 35b671e71..05b2b46c7 100644
--- a/mobile/lib/services/preferences_service.dart
+++ b/mobile/lib/services/preferences_service.dart
@@ -2,6 +2,8 @@ import 'package:shared_preferences/shared_preferences.dart';
 
 class PreferencesService {
   static const _groupByTypeKey = 'dashboard_group_by_type';
+  static const _biometricEnabledKey = 'biometric_enabled';
+  static const _showCategoryFilterKey = 'dashboard_show_category_filter';
   static const _themeModeKey = 'theme_mode';
 
   static PreferencesService? _instance;
@@ -29,6 +31,26 @@ class PreferencesService {
     await prefs.setBool(_groupByTypeKey, value);
   }
 
+  Future<bool> getBiometricEnabled() async {
+    final prefs = await _preferences;
+    return prefs.getBool(_biometricEnabledKey) ?? false;
+  }
+
+  Future<void> setBiometricEnabled(bool value) async {
+    final prefs = await _preferences;
+    await prefs.setBool(_biometricEnabledKey, value);
+  }
+
+  Future<bool> getShowCategoryFilter() async {
+    final prefs = await _preferences;
+    return prefs.getBool(_showCategoryFilterKey) ?? false;
+  }
+
+  Future<void> setShowCategoryFilter(bool value) async {
+    final prefs = await _preferences;
+    await prefs.setBool(_showCategoryFilterKey, value);
+  }
+
   /// Returns 'light', 'dark', or 'system' (default).
   Future<String> getThemeMode() async {
     final prefs = await _preferences;
diff --git a/mobile/lib/services/sync_service.dart b/mobile/lib/services/sync_service.dart
index 82abbf575..a5dab6543 100644
--- a/mobile/lib/services/sync_service.dart
+++ b/mobile/lib/services/sync_service.dart
@@ -125,6 +125,7 @@ class SyncService with ChangeNotifier {
             currency: transaction.currency,
             nature: transaction.nature,
             notes: transaction.notes,
+            categoryId: transaction.categoryId,
           );
 
           if (result['success'] == true) {
diff --git a/mobile/lib/services/transactions_service.dart b/mobile/lib/services/transactions_service.dart
index c36d86ac2..83af27de8 100644
--- a/mobile/lib/services/transactions_service.dart
+++ b/mobile/lib/services/transactions_service.dart
@@ -13,6 +13,7 @@ class TransactionsService {
     required String currency,
     required String nature,
     String? notes,
+    String? categoryId,
   }) async {
     final url = Uri.parse('${ApiConfig.baseUrl}/api/v1/transactions');
 
@@ -25,6 +26,7 @@ class TransactionsService {
         'currency': currency,
         'nature': nature,
         if (notes != null) 'notes': notes,
+        if (categoryId != null) 'category_id': categoryId,
       }
     };
 
diff --git a/mobile/lib/widgets/category_filter.dart b/mobile/lib/widgets/category_filter.dart
new file mode 100644
index 000000000..448c1fc2b
--- /dev/null
+++ b/mobile/lib/widgets/category_filter.dart
@@ -0,0 +1,106 @@
+import 'package:flutter/material.dart';
+import '../models/category.dart' as models;
+
+class CategoryFilter extends StatelessWidget {
+  final List<models.Category> availableCategories;
+  final Set<String> selectedCategoryIds;
+  final ValueChanged<Set<String>> onSelectionChanged;
+
+  const CategoryFilter({
+    super.key,
+    required this.availableCategories,
+    required this.selectedCategoryIds,
+    required this.onSelectionChanged,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    if (availableCategories.isEmpty) {
+      return const SizedBox.shrink();
+    }
+
+    final colorScheme = Theme.of(context).colorScheme;
+    final isAllSelected = selectedCategoryIds.isEmpty;
+
+    return Container(
+      height: 44,
+      margin: const EdgeInsets.symmetric(horizontal: 16),
+      child: ListView(
+        scrollDirection: Axis.horizontal,
+        children: [
+          // "All" chip
+          Padding(
+            padding: const EdgeInsets.only(right: 8),
+            child: FilterChip(
+              label: const Text('All'),
+              selected: isAllSelected,
+              onSelected: (_) {
+                onSelectionChanged({});
+              },
+              backgroundColor: colorScheme.surfaceContainerHighest,
+              selectedColor: colorScheme.primaryContainer,
+              checkmarkColor: colorScheme.onPrimaryContainer,
+              labelStyle: TextStyle(
+                color: isAllSelected
+                    ? colorScheme.onPrimaryContainer
+                    : colorScheme.onSurfaceVariant,
+                fontWeight: isAllSelected ? FontWeight.bold : FontWeight.normal,
+              ),
+              side: BorderSide(
+                color: isAllSelected
+                    ? colorScheme.primary
+                    : colorScheme.outline.withValues(alpha: 0.3),
+              ),
+              padding: const EdgeInsets.symmetric(horizontal: 8),
+            ),
+          ),
+
+          // Category chips
+          ...availableCategories.map((category) {
+            final isSelected =
+                selectedCategoryIds.contains(category.id) && !isAllSelected;
+
+            return Padding(
+              padding: const EdgeInsets.only(right: 8),
+              child: FilterChip(
+                label: Text(category.displayName),
+                selected: isSelected,
+                onSelected: (_) {
+                  final newSelection = Set<String>.from(selectedCategoryIds);
+                  if (isSelected) {
+                    newSelection.remove(category.id);
+                  } else {
+                    if (isAllSelected) {
+                      newSelection.clear();
+                    }
+                    newSelection.add(category.id);
+                  }
+                  if (newSelection.length == availableCategories.length) {
+                    onSelectionChanged({});
+                  } else {
+                    onSelectionChanged(newSelection);
+                  }
+                },
+                backgroundColor: colorScheme.surfaceContainerHighest,
+                selectedColor: colorScheme.primaryContainer,
+                checkmarkColor: colorScheme.onPrimaryContainer,
+                labelStyle: TextStyle(
+                  color: isSelected
+                      ? colorScheme.onPrimaryContainer
+                      : colorScheme.onSurfaceVariant,
+                  fontWeight: isSelected ? FontWeight.bold : FontWeight.normal,
+                ),
+                side: BorderSide(
+                  color: isSelected
+                      ? colorScheme.primary
+                      : colorScheme.outline.withValues(alpha: 0.3),
+                ),
+                padding: const EdgeInsets.symmetric(horizontal: 8),
+              ),
+            );
+          }),
+        ],
+      ),
+    );
+  }
+}
diff --git a/mobile/lib/widgets/custom_proxy_headers_editor.dart b/mobile/lib/widgets/custom_proxy_headers_editor.dart
new file mode 100644
index 000000000..29dcc95ed
--- /dev/null
+++ b/mobile/lib/widgets/custom_proxy_headers_editor.dart
@@ -0,0 +1,145 @@
+import 'package:flutter/material.dart';
+
+import '../models/custom_proxy_header.dart';
+
+class CustomProxyHeadersEditor extends StatefulWidget {
+  final List<CustomProxyHeader> initialHeaders;
+  final ValueChanged<List<CustomProxyHeader>> onChanged;
+
+  const CustomProxyHeadersEditor({
+    super.key,
+    required this.initialHeaders,
+    required this.onChanged,
+  });
+
+  @override
+  State<CustomProxyHeadersEditor> createState() => _CustomProxyHeadersEditorState();
+}
+
+class _CustomProxyHeadersEditorState extends State<CustomProxyHeadersEditor> {
+  late List<_HeaderDraft> _drafts;
+
+  @override
+  void initState() {
+    super.initState();
+    _drafts = widget.initialHeaders
+        .map((header) => _HeaderDraft(name: header.name, value: header.value))
+        .toList();
+  }
+
+  void _notifyChanged() {
+    widget.onChanged(
+      _drafts
+          .map((draft) => CustomProxyHeader(name: draft.name.text, value: draft.value.text))
+          .where((header) => header.isComplete)
+          .toList(),
+    );
+  }
+
+  void _addHeader() {
+    setState(() => _drafts.add(_HeaderDraft()));
+  }
+
+  void _removeHeader(int index) {
+    setState(() {
+      final draft = _drafts.removeAt(index);
+      draft.dispose();
+    });
+    _notifyChanged();
+  }
+
+  @override
+  void dispose() {
+    for (final draft in _drafts) {
+      draft.dispose();
+    }
+    super.dispose();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.stretch,
+      children: [
+        for (var index = 0; index < _drafts.length; index++) ...[
+          _HeaderRow(
+            draft: _drafts[index],
+            onChanged: _notifyChanged,
+            onRemove: () => _removeHeader(index),
+          ),
+          const SizedBox(height: 12),
+        ],
+        OutlinedButton.icon(
+          onPressed: _addHeader,
+          icon: const Icon(Icons.add),
+          label: const Text('Add header'),
+        ),
+      ],
+    );
+  }
+}
+
+class _HeaderRow extends StatelessWidget {
+  final _HeaderDraft draft;
+  final VoidCallback onChanged;
+  final VoidCallback onRemove;
+
+  const _HeaderRow({
+    required this.draft,
+    required this.onChanged,
+    required this.onRemove,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    return Row(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        Expanded(
+          child: Column(
+            children: [
+              TextFormField(
+                controller: draft.name,
+                decoration: const InputDecoration(
+                  labelText: 'Header name',
+                  hintText: 'X-Auth-Token',
+                ),
+                validator: (value) => CustomProxyHeader.validateName(value ?? ''),
+                onChanged: (_) => onChanged(),
+              ),
+              const SizedBox(height: 8),
+              TextFormField(
+                controller: draft.value,
+                decoration: const InputDecoration(
+                  labelText: 'Header value',
+                ),
+                obscureText: true,
+                validator: (value) => CustomProxyHeader.validateValue(value ?? ''),
+                onChanged: (_) => onChanged(),
+              ),
+            ],
+          ),
+        ),
+        IconButton(
+          tooltip: 'Remove header',
+          icon: const Icon(Icons.delete_outline),
+          onPressed: onRemove,
+        ),
+      ],
+    );
+  }
+}
+
+class _HeaderDraft {
+  final TextEditingController name;
+  final TextEditingController value;
+
+  _HeaderDraft({String name = '', String value = ''})
+      : name = TextEditingController(text: name),
+        value = TextEditingController(text: value);
+
+  void dispose() {
+    name.dispose();
+    value.dispose();
+  }
+}
diff --git a/mobile/pubspec.lock b/mobile/pubspec.lock
index b00dc2ebb..a9d66b802 100644
--- a/mobile/pubspec.lock
+++ b/mobile/pubspec.lock
@@ -69,10 +69,10 @@ packages:
     dependency: transitive
     description:
       name: characters
-      sha256: f71061c654a3380576a52b451dd5532377954cf9dbd272a78fc8479606670803
+      sha256: faf38497bda5ead2a8c7615f4f7939df04333478bf32e4173fcb06d428b5716b
       url: "https://pub.dev"
     source: hosted
-    version: "1.4.0"
+    version: "1.4.1"
   checked_yaml:
     dependency: transitive
     description:
@@ -198,6 +198,22 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "6.0.0"
+  flutter_plugin_android_lifecycle:
+    dependency: transitive
+    description:
+      name: flutter_plugin_android_lifecycle
+      sha256: ee8068e0e1cd16c4a82714119918efdeed33b3ba7772c54b5d094ab53f9b7fd1
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.33"
+  flutter_markdown:
+    dependency: "direct main"
+    description:
+      name: flutter_markdown
+      sha256: "08fb8315236099ff8e90cb87bb2b935e0a724a3af1623000a9cec930468e0f27"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.7.7+1"
   flutter_secure_storage:
     dependency: "direct main"
     description:
@@ -344,22 +360,70 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "6.1.0"
+  local_auth:
+    dependency: "direct main"
+    description:
+      name: local_auth
+      sha256: "434d854cf478f17f12ab29a76a02b3067f86a63a6d6c4eb8fbfdcfe4879c1b7b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.3.0"
+  local_auth_android:
+    dependency: transitive
+    description:
+      name: local_auth_android
+      sha256: a0bdfcc0607050a26ef5b31d6b4b254581c3d3ce3c1816ab4d4f4a9173e84467
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.56"
+  local_auth_darwin:
+    dependency: transitive
+    description:
+      name: local_auth_darwin
+      sha256: "699873970067a40ef2f2c09b4c72eb1cfef64224ef041b3df9fdc5c4c1f91f49"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.6.1"
+  local_auth_platform_interface:
+    dependency: transitive
+    description:
+      name: local_auth_platform_interface
+      sha256: f98b8e388588583d3f781f6806e4f4c9f9e189d898d27f0c249b93a1973dd122
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.0"
+  local_auth_windows:
+    dependency: transitive
+    description:
+      name: local_auth_windows
+      sha256: bc4e66a29b0fdf751aafbec923b5bed7ad6ed3614875d8151afe2578520b2ab5
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.11"
+  markdown:
+    dependency: transitive
+    description:
+      name: markdown
+      sha256: ee85086ad7698b42522c6ad42fe195f1b9898e4d974a1af4576c1a3a176cada9
+      url: "https://pub.dev"
+    source: hosted
+    version: "7.3.1"
   matcher:
     dependency: transitive
     description:
       name: matcher
-      sha256: dc58c723c3c24bf8d3e2d3ad3f2f9d7bd9cf43ec6feaa64181775e60190153f2
+      sha256: "12956d0ad8390bbcc63ca2e1469c0619946ccb52809807067a7020d57e647aa6"
       url: "https://pub.dev"
     source: hosted
-    version: "0.12.17"
+    version: "0.12.18"
   material_color_utilities:
     dependency: transitive
     description:
       name: material_color_utilities
-      sha256: f7142bb1154231d7ea5f96bc7bde4bda2a0945d2806bb11670e30b850d56bdec
+      sha256: "9c337007e82b1889149c82ed242ed1cb24a66044e30979c44912381e9be4c48b"
       url: "https://pub.dev"
     source: hosted
-    version: "0.11.1"
+    version: "0.13.0"
   meta:
     dependency: transitive
     description:
@@ -657,10 +721,10 @@ packages:
     dependency: transitive
     description:
       name: test_api
-      sha256: ab2726c1a94d3176a45960b6234466ec367179b87dd74f1611adb1f3b5fb9d55
+      sha256: "93167629bfc610f71560ab9312acdda4959de4df6fac7492c89ff0d3886f6636"
       url: "https://pub.dev"
     source: hosted
-    version: "0.7.7"
+    version: "0.7.9"
   typed_data:
     dependency: transitive
     description:
diff --git a/mobile/pubspec.yaml b/mobile/pubspec.yaml
index b81f489e0..efcb72b9c 100644
--- a/mobile/pubspec.yaml
+++ b/mobile/pubspec.yaml
@@ -4,7 +4,7 @@ publish_to: 'none'
 version: 0.6.9+20260402
 
 environment:
-  sdk: '>=3.0.0 <4.0.0'
+  sdk: '>=3.3.0 <4.0.0'
   flutter: '>=3.27.0'
 
 dependencies:
@@ -24,6 +24,8 @@ dependencies:
   url_launcher: ^6.2.5
   flutter_svg: ^2.2.0
   package_info_plus: ^8.0.0
+  local_auth: ^2.3.0
+  flutter_markdown: ^0.7.2
 
 dev_dependencies:
   flutter_test:
@@ -41,6 +43,7 @@ flutter_launcher_icons:
   android: true
   ios: true
   image_path: "assets/icon/app_icon.png"
+  image_path_ios_dark_transparent: "assets/icon/app_icon.png"
   adaptive_icon_background: "#FFFFFF"
   adaptive_icon_foreground: "assets/icon/app_icon.png"
   remove_alpha_ios: true
diff --git a/mobile/test/models/custom_proxy_header_test.dart b/mobile/test/models/custom_proxy_header_test.dart
new file mode 100644
index 000000000..6943f4fca
--- /dev/null
+++ b/mobile/test/models/custom_proxy_header_test.dart
@@ -0,0 +1,47 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:sure_mobile/models/custom_proxy_header.dart';
+
+void main() {
+  group('CustomProxyHeader', () {
+    test('serializes trimmed header name and value', () {
+      final header = CustomProxyHeader(name: ' X-Auth-Id ', value: ' abc ');
+
+      expect(header.name, 'X-Auth-Id');
+      expect(header.value, 'abc');
+      expect(header.toJson(), {
+        'name': 'X-Auth-Id',
+        'value': 'abc',
+      });
+      expect(CustomProxyHeader.fromJson(header.toJson()), header);
+    });
+
+    test('rejects empty, malformed, and reserved names', () {
+      expect(CustomProxyHeader.validateName(''), isNotNull);
+      expect(CustomProxyHeader.validateName('Bad Header'), isNotNull);
+      expect(CustomProxyHeader.validateName('Bad:Header'), isNotNull);
+      expect(CustomProxyHeader.validateName('Authorization'), isNotNull);
+      expect(CustomProxyHeader.validateName('X-Api-Key'), isNotNull);
+      expect(CustomProxyHeader.validateName('Accept'), isNotNull);
+      expect(CustomProxyHeader.validateName('Content-Type'), isNotNull);
+    });
+
+    test('allows custom header names with hyphens', () {
+      expect(CustomProxyHeader.validateName('X-Auth-Id'), isNull);
+      expect(CustomProxyHeader.validateName('X-Auth-Secret'), isNull);
+    });
+
+    test('rejects values containing control characters (header injection)', () {
+      expect(CustomProxyHeader.validateValue('abc\r\nInjected: 1'), isNotNull);
+      expect(CustomProxyHeader.validateValue('abc\tdef'), isNotNull);
+      expect(CustomProxyHeader.validateValue('abc\x7Fdef'), isNotNull);
+      expect(CustomProxyHeader.validateValue('plain value with spaces'), isNull);
+    });
+
+    test('redacts values for display', () {
+      expect(
+        CustomProxyHeader(name: 'X-Auth-Secret', value: '1234567890').redactedValue,
+        '••••••7890',
+      );
+    });
+  });
+}
diff --git a/mobile/test/services/api_config_headers_test.dart b/mobile/test/services/api_config_headers_test.dart
new file mode 100644
index 000000000..cde001b22
--- /dev/null
+++ b/mobile/test/services/api_config_headers_test.dart
@@ -0,0 +1,78 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+import 'package:sure_mobile/models/custom_proxy_header.dart';
+import 'package:sure_mobile/services/api_config.dart';
+
+void main() {
+  setUp(() async {
+    SharedPreferences.setMockInitialValues({});
+    ApiConfig.clearApiKeyAuth();
+    ApiConfig.setBaseUrl(ApiConfig.defaultBaseUrl);
+    ApiConfig.setCustomProxyHeaders([]);
+  });
+
+  test('adds custom proxy headers to token auth headers', () {
+    ApiConfig.setCustomProxyHeaders([
+      CustomProxyHeader(name: 'X-Auth-Id', value: 'id'),
+      CustomProxyHeader(name: 'X-Auth-Secret', value: 'secret'),
+    ]);
+
+    expect(ApiConfig.getAuthHeaders('token'), {
+      'X-Auth-Id': 'id',
+      'X-Auth-Secret': 'secret',
+      'Authorization': 'Bearer token',
+      'Accept': 'application/json',
+    });
+  });
+
+  test('adds custom proxy headers to unauthenticated json headers', () {
+    ApiConfig.setCustomProxyHeaders([
+      CustomProxyHeader(name: 'X-Mobile-Bypass', value: 'pass'),
+    ]);
+
+    expect(ApiConfig.jsonHeaders(), {
+      'X-Mobile-Bypass': 'pass',
+      'Content-Type': 'application/json',
+      'Accept': 'application/json',
+    });
+  });
+
+  test('drops headers with reserved names', () {
+    ApiConfig.setCustomProxyHeaders([
+      CustomProxyHeader(name: 'Accept', value: 'text/plain'),
+      CustomProxyHeader(name: 'Authorization', value: 'should-be-dropped'),
+      CustomProxyHeader(name: 'X-Api-Key', value: 'should-be-dropped-too'),
+      CustomProxyHeader(name: 'Content-Type', value: 'application/xml'),
+      CustomProxyHeader(name: 'X-Auth-Id', value: 'id'),
+    ]);
+
+    final result = ApiConfig.customProxyHeaders;
+    expect(result.length, 1);
+    expect(result.first.name, 'X-Auth-Id');
+  });
+
+  test('deduplicates headers by normalized name keeping the last value', () {
+    ApiConfig.setCustomProxyHeaders([
+      CustomProxyHeader(name: 'X-Auth-Id', value: 'first'),
+      CustomProxyHeader(name: 'x-auth-id', value: 'second'),
+      CustomProxyHeader(name: 'X-Auth-Id', value: 'third'),
+    ]);
+
+    final result = ApiConfig.customProxyHeaders;
+    expect(result.length, 1);
+    expect(result.first.name, 'X-Auth-Id');
+    expect(result.first.value, 'third');
+  });
+
+  test('app managed headers win over custom headers', () {
+    ApiConfig.setCustomProxyHeaders([
+      CustomProxyHeader(name: 'Accept', value: 'text/plain'),
+      CustomProxyHeader(name: 'X-Auth-Id', value: 'id'),
+    ]);
+
+    expect(ApiConfig.htmlHeaders(), {
+      'X-Auth-Id': 'id',
+      'Accept': 'text/html',
+    });
+  });
+}
diff --git a/mobile/test/services/custom_proxy_headers_service_test.dart b/mobile/test/services/custom_proxy_headers_service_test.dart
new file mode 100644
index 000000000..f64f26823
--- /dev/null
+++ b/mobile/test/services/custom_proxy_headers_service_test.dart
@@ -0,0 +1,47 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:sure_mobile/models/custom_proxy_header.dart';
+import 'package:sure_mobile/services/custom_proxy_headers_service.dart';
+
+void main() {
+  setUp(() {
+    FlutterSecureStorage.setMockInitialValues({});
+  });
+
+  test('saves and loads custom proxy headers', () async {
+    final service = CustomProxyHeadersService.instance;
+    final headers = [
+      CustomProxyHeader(name: 'X-Auth-Id', value: 'id'),
+      CustomProxyHeader(name: 'X-Auth-Secret', value: 'secret'),
+    ];
+
+    await service.saveHeaders(headers);
+
+    expect(await service.loadHeaders(), headers);
+  });
+
+  test('drops incomplete and duplicate headers, keeping the last value', () async {
+    final service = CustomProxyHeadersService.instance;
+
+    await service.saveHeaders([
+      CustomProxyHeader(name: 'X-Auth-Id', value: 'old'),
+      CustomProxyHeader(name: '', value: 'ignored'),
+      CustomProxyHeader(name: 'X-Auth-Id', value: 'new'),
+      CustomProxyHeader(name: 'X-Empty', value: ''),
+    ]);
+
+    expect(await service.loadHeaders(), [
+      CustomProxyHeader(name: 'X-Auth-Id', value: 'new'),
+    ]);
+  });
+
+  test('returns an empty list for invalid stored json', () async {
+    const storage = FlutterSecureStorage();
+    await storage.write(
+      key: CustomProxyHeadersService.storageKey,
+      value: 'not json',
+    );
+
+    expect(await CustomProxyHeadersService.instance.loadHeaders(), isEmpty);
+  });
+}
diff --git a/package.json b/package.json
index c3ec2a6d4..8dbeeb8bf 100644
--- a/package.json
+++ b/package.json
@@ -11,7 +11,9 @@
 		"lint": "biome lint",
 		"lint:fix": "biome lint --write",
 		"format:check": "biome format",
-		"format": "biome format --write"
+		"format": "biome format --write",
+		"tokens:build": "node bin/tokens.mjs",
+		"tokens:check": "node bin/tokens.mjs && git diff --quiet -- app/assets/tailwind/sure-design-system/_generated.css"
 	},
 	"author": "",
 	"license": "ISC"
diff --git a/pipelock.example.yaml b/pipelock.example.yaml
index 2458f834f..ee77d162f 100644
--- a/pipelock.example.yaml
+++ b/pipelock.example.yaml
@@ -1,8 +1,10 @@
 # Pipelock configuration for Docker Compose
 # See https://github.com/luckyPipewrench/pipelock for full options.
 #
-# New in v2.0: trusted_domains, redirect profiles, attack simulation,
-# security scoring, process sandbox, and enhanced tool poisoning detection.
+# Recent additions: trusted_domains, redirect profiles, attack simulation,
+# security scoring, process sandbox, enhanced tool poisoning detection, signed
+# action receipts, per-pattern DLP warn mode, and the `pipelock posture verify`
+# / `pipelock session` CLIs.
 # Run `pipelock simulate --config <file>` to test your config against 24 attack scenarios.
 # Run `pipelock audit score --config <file>` for a security posture score (0-100).
 
@@ -54,7 +56,7 @@ mcp_tool_scanning:
 mcp_tool_policy:
   enabled: false
   action: warn
-  # Redirect profiles (v2.0): route matched tool calls to audited handler programs
+  # Redirect profiles: route matched tool calls to audited handler programs
   # instead of blocking. The handler returns a synthetic MCP response.
   # redirect_profiles:
   #   safe-fetch:
diff --git a/spec/requests/api/v1/accounts_spec.rb b/spec/requests/api/v1/accounts_spec.rb
index 80927388d..91686840b 100644
--- a/spec/requests/api/v1/accounts_spec.rb
+++ b/spec/requests/api/v1/accounts_spec.rb
@@ -31,6 +31,19 @@ RSpec.describe 'API V1 Accounts', type: :request do
     )
   end
 
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    # Valid persisted API keys can only be read/read_write; this intentionally
+    # bypasses validations to document the runtime insufficient-scope response.
+    ApiKey.new(
+      user: user,
+      name: 'No Read Docs Key',
+      key: key,
+      scopes: %w[write],
+      source: 'web'
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+
   let(:'X-Api-Key') { api_key.plain_key }
 
   let!(:checking_account) do
@@ -72,6 +85,8 @@ RSpec.describe 'API V1 Accounts', type: :request do
                 description: 'Page number (default: 1)'
       parameter name: :per_page, in: :query, type: :integer, required: false,
                 description: 'Items per page (default: 25, max: 100)'
+      parameter name: :include_disabled, in: :query, type: :boolean, required: false,
+                description: 'Include disabled accounts in the response. Defaults to false.'
 
       response '200', 'accounts listed' do
         schema '$ref' => '#/components/schemas/AccountCollection'
@@ -89,4 +104,51 @@ RSpec.describe 'API V1 Accounts', type: :request do
       end
     end
   end
+
+  path '/api/v1/accounts/{id}' do
+    parameter name: :id, in: :path, required: true, description: 'Account ID',
+              schema: { type: :string, format: :uuid }
+
+    get 'Retrieve an account' do
+      tags 'Accounts'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+      parameter name: :include_disabled, in: :query, type: :boolean, required: false,
+                description: 'Allow retrieving a disabled account. Defaults to false.'
+
+      let(:id) { checking_account.id }
+
+      response '200', 'account retrieved' do
+        schema '$ref' => '#/components/schemas/AccountDetail'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { checking_account.id }
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { checking_account.id }
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'account not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+    end
+  end
 end
diff --git a/spec/requests/api/v1/auth_spec.rb b/spec/requests/api/v1/auth_spec.rb
index 278ec7348..11366acf8 100644
--- a/spec/requests/api/v1/auth_spec.rb
+++ b/spec/requests/api/v1/auth_spec.rb
@@ -261,7 +261,10 @@ RSpec.describe 'API V1 Auth', type: :request do
       end
 
       response '401', 'invalid credentials or expired linking code' do
-        schema '$ref' => '#/components/schemas/ErrorResponse'
+        schema oneOf: [
+          { '$ref' => '#/components/schemas/ErrorResponse' },
+          { '$ref' => '#/components/schemas/MfaRequiredResponse' }
+        ]
         run_test!
       end
     end
diff --git a/spec/requests/api/v1/balance_sheet_spec.rb b/spec/requests/api/v1/balance_sheet_spec.rb
index 72132871a..f42e079f9 100644
--- a/spec/requests/api/v1/balance_sheet_spec.rb
+++ b/spec/requests/api/v1/balance_sheet_spec.rb
@@ -48,6 +48,8 @@ RSpec.describe 'API V1 Balance Sheet', type: :request do
       end
 
       response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
         let(:'X-Api-Key') { 'invalid-key' }
 
         run_test!
diff --git a/spec/requests/api/v1/balances_spec.rb b/spec/requests/api/v1/balances_spec.rb
new file mode 100644
index 000000000..641b76a5b
--- /dev/null
+++ b/spec/requests/api/v1/balances_spec.rb
@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+require 'swagger_helper'
+
+RSpec.describe 'API V1 Balances', type: :request do
+  let(:family) do
+    Family.create!(
+      name: 'API Family',
+      currency: 'USD',
+      locale: 'en',
+      date_format: '%m-%d-%Y'
+    )
+  end
+
+  let(:user) do
+    family.users.create!(
+      email: 'api-user@example.com',
+      password: 'password123',
+      password_confirmation: 'password123'
+    )
+  end
+
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: 'API Docs Key',
+      key: key,
+      scopes: %w[read_write],
+      source: 'web'
+    )
+  end
+
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    ApiKey.new(
+      user: user,
+      name: 'No Read Docs Key',
+      key: key,
+      scopes: %w[write],
+      source: 'web'
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+
+  let(:'X-Api-Key') { api_key.plain_key }
+
+  let!(:account) do
+    Account.create!(
+      family: family,
+      name: 'Checking Account',
+      balance: 1500.50,
+      currency: 'USD',
+      accountable: Depository.create!
+    )
+  end
+
+  let!(:balance) do
+    account.balances.create!(
+      date: Date.parse('2024-01-15'),
+      balance: 1500.50,
+      cash_balance: 1500.50,
+      start_cash_balance: 1200,
+      start_non_cash_balance: 0,
+      cash_inflows: 300.50,
+      cash_outflows: 0,
+      currency: 'USD'
+    )
+  end
+
+  path '/api/v1/balances' do
+    get 'List balance history records' do
+      tags 'Balances'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+      parameter name: :page, in: :query, type: :integer, required: false,
+                description: 'Page number (default: 1)'
+      parameter name: :per_page, in: :query, type: :integer, required: false,
+                description: 'Items per page (default: 25, max: 100)'
+      parameter name: :account_id, in: :query, required: false,
+                description: 'Filter by account ID',
+                schema: { type: :string, format: :uuid }
+      parameter name: :currency, in: :query, required: false,
+                description: 'Filter by currency code',
+                schema: { type: :string }
+      parameter name: :start_date, in: :query, required: false,
+                description: 'Filter balances from this date',
+                schema: { type: :string, format: :date }
+      parameter name: :end_date, in: :query, required: false,
+                description: 'Filter balances until this date',
+                schema: { type: :string, format: :date }
+
+      response '200', 'balances listed' do
+        schema '$ref' => '#/components/schemas/BalanceCollection'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '422', 'invalid filter' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:account_id) { 'not-a-uuid' }
+
+        run_test!
+      end
+    end
+  end
+
+  path '/api/v1/balances/{id}' do
+    parameter name: :id, in: :path, required: true, description: 'Balance ID',
+              schema: { type: :string, format: :uuid }
+
+    get 'Retrieve a balance history record' do
+      tags 'Balances'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+
+      let(:id) { balance.id }
+
+      response '200', 'balance retrieved' do
+        schema '$ref' => '#/components/schemas/Balance'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'balance not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/budget_categories_spec.rb b/spec/requests/api/v1/budget_categories_spec.rb
new file mode 100644
index 000000000..a2c88159b
--- /dev/null
+++ b/spec/requests/api/v1/budget_categories_spec.rb
@@ -0,0 +1,162 @@
+# frozen_string_literal: true
+
+require 'swagger_helper'
+
+RSpec.describe 'API V1 Budget Categories', type: :request do
+  let(:family) do
+    Family.create!(
+      name: 'API Family',
+      currency: 'USD',
+      locale: 'en',
+      date_format: '%m-%d-%Y'
+    )
+  end
+
+  let(:user) do
+    family.users.create!(
+      email: 'api-user@example.com',
+      password: 'password123',
+      password_confirmation: 'password123'
+    )
+  end
+
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: 'API Docs Key',
+      key: key,
+      display_key: key,
+      scopes: %w[read],
+      source: 'web'
+    )
+  end
+
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    ApiKey.new(
+      user: user,
+      name: 'No Read Docs Key',
+      key: key,
+      display_key: key,
+      scopes: [],
+      source: 'mobile'
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+
+  let(:'X-Api-Key') { api_key.plain_key }
+  let!(:category) { family.categories.create!(name: 'Groceries', color: '#22c55e') }
+  let!(:budget) do
+    family.budgets.create!(
+      start_date: Date.current.beginning_of_month,
+      end_date: Date.current.end_of_month,
+      budgeted_spending: 3000,
+      expected_income: 5000,
+      currency: 'USD'
+    )
+  end
+  let!(:budget_category) do
+    budget.budget_categories.create!(
+      category: category,
+      budgeted_spending: 500,
+      currency: 'USD'
+    )
+  end
+
+  path '/api/v1/budget_categories' do
+    get 'List budget categories' do
+      tags 'Budget Categories'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+      parameter name: :page, in: :query, type: :integer, required: false,
+                description: 'Page number (default: 1)'
+      parameter name: :per_page, in: :query, type: :integer, required: false,
+                description: 'Items per page (default: 25, max: 100)'
+      parameter name: :budget_id, in: :query, required: false,
+                schema: { type: :string, format: :uuid },
+                description: 'Filter by budget ID'
+      parameter name: :category_id, in: :query, required: false,
+                schema: { type: :string, format: :uuid },
+                description: 'Filter by category ID'
+      parameter name: :start_date, in: :query, required: false,
+                schema: { type: :string, format: :date },
+                description: 'Filter budget categories whose budget starts on or after this date'
+      parameter name: :end_date, in: :query, required: false,
+                schema: { type: :string, format: :date },
+                description: 'Filter budget categories whose budget ends on or before this date'
+
+      response '200', 'budget categories listed' do
+        schema '$ref' => '#/components/schemas/BudgetCategoryCollection'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '422', 'invalid filter' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:budget_id) { 'not-a-uuid' }
+
+        run_test!
+      end
+    end
+  end
+
+  path '/api/v1/budget_categories/{id}' do
+    parameter name: :id, in: :path, required: true, description: 'Budget category ID',
+              schema: { type: :string, format: :uuid }
+
+    get 'Retrieve a budget category' do
+      tags 'Budget Categories'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+
+      let(:id) { budget_category.id }
+
+      response '200', 'budget category retrieved' do
+        schema '$ref' => '#/components/schemas/BudgetCategory'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'budget category not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/budgets_spec.rb b/spec/requests/api/v1/budgets_spec.rb
new file mode 100644
index 000000000..e15bcdb85
--- /dev/null
+++ b/spec/requests/api/v1/budgets_spec.rb
@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+require 'swagger_helper'
+
+RSpec.describe 'API V1 Budgets', type: :request do
+  let(:family) do
+    Family.create!(
+      name: 'API Family',
+      currency: 'USD',
+      locale: 'en',
+      date_format: '%m-%d-%Y'
+    )
+  end
+
+  let(:user) do
+    family.users.create!(
+      email: 'api-user@example.com',
+      password: 'password123',
+      password_confirmation: 'password123'
+    )
+  end
+
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: 'API Docs Key',
+      key: key,
+      display_key: key,
+      scopes: %w[read],
+      source: 'web'
+    )
+  end
+
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    ApiKey.new(
+      user: user,
+      name: 'No Read Docs Key',
+      key: key,
+      display_key: key,
+      scopes: [],
+      source: 'mobile'
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+
+  let(:'X-Api-Key') { api_key.plain_key }
+  let!(:budget) do
+    family.budgets.create!(
+      start_date: Date.current.beginning_of_month,
+      end_date: Date.current.end_of_month,
+      budgeted_spending: 3000,
+      expected_income: 5000,
+      currency: 'USD'
+    )
+  end
+
+  path '/api/v1/budgets' do
+    get 'List budgets' do
+      tags 'Budgets'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+      parameter name: :page, in: :query, type: :integer, required: false,
+                description: 'Page number (default: 1)'
+      parameter name: :per_page, in: :query, type: :integer, required: false,
+                description: 'Items per page (default: 25, max: 100)'
+      parameter name: :start_date, in: :query, required: false,
+                schema: { type: :string, format: :date },
+                description: 'Filter budgets starting on or after this date'
+      parameter name: :end_date, in: :query, required: false,
+                schema: { type: :string, format: :date },
+                description: 'Filter budgets ending on or before this date'
+
+      response '200', 'budgets listed' do
+        schema '$ref' => '#/components/schemas/BudgetCollection'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '422', 'invalid date filter' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:start_date) { 'not-a-date' }
+
+        run_test!
+      end
+    end
+  end
+
+  path '/api/v1/budgets/{id}' do
+    parameter name: :id, in: :path, required: true, description: 'Budget ID',
+              schema: { type: :string, format: :uuid }
+
+    get 'Retrieve a budget' do
+      tags 'Budgets'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+
+      let(:id) { budget.id }
+
+      response '200', 'budget retrieved' do
+        schema '$ref' => '#/components/schemas/Budget'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'budget not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/categories_spec.rb b/spec/requests/api/v1/categories_spec.rb
index 90e06d5c2..d74e76b56 100644
--- a/spec/requests/api/v1/categories_spec.rb
+++ b/spec/requests/api/v1/categories_spec.rb
@@ -96,6 +96,93 @@ RSpec.describe 'API V1 Categories', type: :request do
         run_test!
       end
     end
+
+    post 'Create category' do
+      tags 'Categories'
+      security [ { apiKeyAuth: [] } ]
+      consumes 'application/json'
+      produces 'application/json'
+      parameter name: :body, in: :body, required: true, schema: {
+        '$ref' => '#/components/schemas/CategoryCreateRequest'
+      }
+
+      response '201', 'category created' do
+        schema '$ref' => '#/components/schemas/CategoryDetail'
+
+        let(:body) do
+          {
+            category: {
+              name: 'Imported / Coffee',
+              color: '#22c55e',
+              icon: 'coffee'
+            }
+          }
+        end
+
+        run_test!
+      end
+
+      response '201', 'subcategory created with parent' do
+        schema '$ref' => '#/components/schemas/CategoryDetail'
+
+        let(:body) do
+          {
+            category: {
+              name: 'Imported / Espresso',
+              color: '#22c55e',
+              icon: 'coffee',
+              parent_id: parent_category.id
+            }
+          }
+        end
+
+        run_test!
+      end
+
+      response '422', 'validation error - duplicate name' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:body) { { category: { name: parent_category.name } } }
+
+        run_test!
+      end
+
+      response '403', 'forbidden - api key missing read_write scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:read_only_api_key) do
+          key = ApiKey.generate_secure_key
+          ApiKey.create!(
+            user: user,
+            name: 'API Docs Read Key',
+            key: key,
+            scopes: %w[read],
+            source: 'mobile'
+          )
+        end
+        let(:'X-Api-Key') { read_only_api_key.plain_key }
+        let(:body) { { category: { name: 'Anything' } } }
+
+        run_test!
+      end
+
+      response '400', 'bad request - missing category payload' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:body) { {} }
+
+        run_test!
+      end
+
+      response '401', 'unauthorized - missing api key' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+        let(:body) { { category: { name: 'Anything' } } }
+
+        run_test!
+      end
+    end
   end
 
   path '/api/v1/categories/{id}' do
diff --git a/spec/requests/api/v1/family_exports_spec.rb b/spec/requests/api/v1/family_exports_spec.rb
new file mode 100644
index 000000000..df3b140c7
--- /dev/null
+++ b/spec/requests/api/v1/family_exports_spec.rb
@@ -0,0 +1,164 @@
+# frozen_string_literal: true
+
+require "swagger_helper"
+
+RSpec.describe "Api::V1::FamilyExports", type: :request do
+  let(:user) { users(:family_admin) }
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: "API Docs Key",
+      key: key,
+      scopes: %w[read_write],
+      source: "web"
+    )
+  end
+  let(:'X-Api-Key') { api_key.plain_key }
+  let(:family_export) { user.family.family_exports.create!(status: "completed") }
+  let(:id) { family_export.id }
+
+  path "/api/v1/family_exports" do
+    get "Lists family exports" do
+      tags "Family Exports"
+      security [ apiKeyAuth: [] ]
+      produces "application/json"
+      parameter name: :page, in: :query, type: :integer, required: false, description: "Page number (default: 1)"
+      parameter name: :per_page, in: :query, type: :integer, required: false, description: "Items per page (default: 25, max: 100)"
+
+      response "200", "family exports listed" do
+        schema "$ref" => "#/components/schemas/FamilyExportCollection"
+        run_test!
+      end
+
+      response "401", "unauthorized" do
+        let(:'X-Api-Key') { nil }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+
+      response "403", "forbidden" do
+        let(:user) { users(:family_member) }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+    end
+
+    post "Queues a family export" do
+      tags "Family Exports"
+      security [ apiKeyAuth: [] ]
+      consumes "application/json"
+      produces "application/json"
+      parameter name: :body, in: :body, required: false, schema: {
+        type: :object,
+        additionalProperties: false,
+        description: "Family export creation does not accept request parameters."
+      }
+
+      let(:body) { {} }
+
+      response "202", "family export queued" do
+        schema "$ref" => "#/components/schemas/FamilyExportResponse"
+        run_test!
+      end
+
+      response "401", "unauthorized" do
+        let(:'X-Api-Key') { nil }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+
+      response "403", "forbidden" do
+        let(:user) { users(:family_member) }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+
+      response "422", "invalid params" do
+        let(:body) { { family_export: { status: "completed" } } }
+
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+    end
+  end
+
+  path "/api/v1/family_exports/{id}" do
+    parameter name: :id, in: :path, type: :string, format: :uuid, required: true
+
+    get "Shows a family export" do
+      tags "Family Exports"
+      security [ apiKeyAuth: [] ]
+      produces "application/json"
+
+      response "200", "family export shown" do
+        schema "$ref" => "#/components/schemas/FamilyExportResponse"
+        run_test!
+      end
+
+      response "401", "unauthorized" do
+        let(:'X-Api-Key') { nil }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+
+      response "403", "forbidden" do
+        let(:user) { users(:family_member) }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+
+      response "404", "not found" do
+        let(:id) { SecureRandom.uuid }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+    end
+  end
+
+  path "/api/v1/family_exports/{id}/download" do
+    parameter name: :id, in: :path, type: :string, format: :uuid, required: true
+
+    get "Downloads a completed family export" do
+      tags "Family Exports"
+      security [ apiKeyAuth: [] ]
+      produces "application/json"
+
+      response "302", "family export download redirected" do
+        before do
+          family_export.export_file.attach(
+            io: StringIO.new("test zip content"),
+            filename: "test.zip",
+            content_type: "application/zip"
+          )
+        end
+
+        run_test!
+      end
+
+      response "401", "unauthorized" do
+        let(:'X-Api-Key') { nil }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+
+      response "403", "forbidden" do
+        let(:user) { users(:family_member) }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+
+      response "404", "not found" do
+        let(:id) { SecureRandom.uuid }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+
+      response "409", "export not ready" do
+        let(:family_export) { user.family.family_exports.create!(status: "processing") }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/family_settings_spec.rb b/spec/requests/api/v1/family_settings_spec.rb
new file mode 100644
index 000000000..771a9f19e
--- /dev/null
+++ b/spec/requests/api/v1/family_settings_spec.rb
@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'swagger_helper'
+
+RSpec.describe 'API V1 Family Settings', type: :request do
+  let(:family) do
+    Family.create!(
+      name: 'API Family',
+      currency: 'USD',
+      locale: 'en',
+      date_format: '%m-%d-%Y',
+      country: 'US',
+      timezone: 'America/New_York',
+      month_start_day: 1
+    )
+  end
+
+  let(:user) do
+    family.users.create!(
+      email: 'api-user@example.com',
+      password: 'password123',
+      password_confirmation: 'password123'
+    )
+  end
+
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: 'API Docs Key',
+      key: key,
+      display_key: key,
+      scopes: %w[read_write],
+      source: 'web'
+    )
+  end
+
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    # Empty scopes intentionally bypass validation so the 403 response can be documented.
+    ApiKey.new(
+      user: user,
+      name: 'No Read Docs Key',
+      key: key,
+      display_key: key,
+      scopes: [],
+      source: 'web'
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+
+  let(:'X-Api-Key') { api_key.plain_key }
+
+  path '/api/v1/family_settings' do
+    get 'Retrieve family settings' do
+      description 'Retrieve a read-only snapshot of non-secret family configuration.'
+      tags 'Family Settings'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+
+      response '200', 'family settings retrieved' do
+        schema '$ref' => '#/components/schemas/FamilySettings'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/imports_spec.rb b/spec/requests/api/v1/imports_spec.rb
index 44580e747..7d6691612 100644
--- a/spec/requests/api/v1/imports_spec.rb
+++ b/spec/requests/api/v1/imports_spec.rb
@@ -31,6 +31,17 @@ RSpec.describe 'API V1 Imports', type: :request do
     )
   end
 
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    ApiKey.new(
+      user: user,
+      name: 'No Read Docs Key',
+      key: key,
+      scopes: %w[write],
+      source: 'web'
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+
   let(:'X-Api-Key') { api_key.plain_key }
 
   let(:account) do
@@ -52,6 +63,16 @@ RSpec.describe 'API V1 Imports', type: :request do
     )
   end
 
+  let!(:import_row) do
+    pending_import.rows.create!(
+      source_row_number: 1,
+      date: '01/01/2024',
+      amount: '10.00',
+      currency: 'USD',
+      name: 'Test Transaction'
+    )
+  end
+
   let!(:complete_import) do
     family.imports.create!(
       type: 'TransactionImport',
@@ -76,7 +97,7 @@ RSpec.describe 'API V1 Imports', type: :request do
                 schema: { type: :string, enum: %w[pending complete importing reverting revert_failed failed] }
       parameter name: :type, in: :query, required: false,
                 description: 'Filter by import type',
-                schema: { type: :string, enum: %w[TransactionImport TradeImport AccountImport MintImport CategoryImport RuleImport] }
+                schema: { type: :string, enum: %w[TransactionImport TradeImport AccountImport MintImport ActualImport CategoryImport RuleImport SureImport] }
 
       response '200', 'imports listed' do
         schema '$ref' => '#/components/schemas/ImportCollection'
@@ -102,22 +123,22 @@ RSpec.describe 'API V1 Imports', type: :request do
     end
 
     post 'Create import' do
-      description 'Create a new import from raw CSV content.'
+      description 'Create a new import from raw CSV content, inline Sure NDJSON content, or an uploaded Sure NDJSON file. CSV content is limited to 10MB.'
       tags 'Imports'
       security [ { apiKeyAuth: [] } ]
-      consumes 'application/json'
+      consumes 'application/json', 'multipart/form-data'
       produces 'application/json'
 
-      parameter name: :body, in: :body, required: true, schema: {
+      parameter name: :body, in: :body, required: false, schema: {
         type: :object,
         properties: {
           raw_file_content: {
             type: :string,
-            description: 'The raw CSV content as a string'
+            description: 'Raw CSV or Sure NDJSON content as a string. CSV content is limited to 10MB. Required for SureImport unless a multipart file is uploaded.'
           },
           type: {
             type: :string,
-            enum: %w[TransactionImport TradeImport AccountImport MintImport CategoryImport RuleImport],
+            enum: %w[TransactionImport TradeImport AccountImport MintImport ActualImport CategoryImport RuleImport SureImport],
             description: 'Import type (defaults to TransactionImport)'
           },
           account_id: {
@@ -131,46 +152,83 @@ RSpec.describe 'API V1 Imports', type: :request do
           },
           date_col_label: {
             type: :string,
-            description: 'Header name for the date column'
+            description: 'CSV imports only. Header name for the date column'
           },
           amount_col_label: {
             type: :string,
-            description: 'Header name for the amount column'
+            description: 'CSV imports only. Header name for the amount column'
           },
           name_col_label: {
             type: :string,
-            description: 'Header name for the transaction name column'
+            description: 'CSV imports only. Header name for the transaction name column'
           },
           category_col_label: {
             type: :string,
-            description: 'Header name for the category column'
+            description: 'CSV imports only. Header name for the category column'
           },
           tags_col_label: {
             type: :string,
-            description: 'Header name for the tags column'
+            description: 'CSV imports only. Header name for the tags column'
           },
           notes_col_label: {
             type: :string,
-            description: 'Header name for the notes column'
+            description: 'CSV imports only. Header name for the notes column'
+          },
+          account_col_label: {
+            type: :string,
+            description: 'CSV imports only. Header name for the account column when importing rows across multiple accounts'
+          },
+          qty_col_label: {
+            type: :string,
+            description: 'CSV trade imports only. Header name for the quantity column'
+          },
+          ticker_col_label: {
+            type: :string,
+            description: 'CSV trade imports only. Header name for the ticker column'
+          },
+          price_col_label: {
+            type: :string,
+            description: 'CSV trade imports only. Header name for the price column'
+          },
+          entity_type_col_label: {
+            type: :string,
+            description: 'CSV imports only. Header name for the entity type column'
+          },
+          currency_col_label: {
+            type: :string,
+            description: 'CSV imports only. Header name for the currency column'
+          },
+          exchange_operating_mic_col_label: {
+            type: :string,
+            description: 'CSV trade imports only. Header name for the exchange operating MIC column'
           },
           date_format: {
             type: :string,
-            description: 'Date format pattern (e.g., "%m/%d/%Y")'
+            description: 'CSV imports only. Date format pattern (e.g., "%m/%d/%Y")'
           },
           number_format: {
             type: :string,
             enum: [ '1,234.56', '1.234,56', '1 234,56', '1,234' ],
-            description: 'Number format for parsing amounts'
+            description: 'CSV imports only. Number format for parsing amounts'
           },
           signage_convention: {
             type: :string,
             enum: %w[inflows_positive inflows_negative],
-            description: 'How to interpret positive/negative amounts'
+            description: 'CSV imports only. How to interpret positive/negative amounts'
           },
           col_sep: {
             type: :string,
             enum: [ ',', ';' ],
-            description: 'Column separator'
+            description: 'CSV imports only. Column separator'
+          },
+          amount_type_strategy: {
+            type: :string,
+            enum: %w[signed_amount custom_column],
+            description: 'CSV imports only. Amount parsing strategy'
+          },
+          amount_type_inflow_value: {
+            type: :string,
+            description: 'CSV imports only. Column value that marks an amount as an inflow when using custom_column strategy'
           }
         }
       }
@@ -193,7 +251,10 @@ RSpec.describe 'API V1 Imports', type: :request do
       end
 
       response '422', 'validation error - file too large' do
-        schema '$ref' => '#/components/schemas/ErrorResponse'
+        schema oneOf: [
+          { '$ref' => '#/components/schemas/ErrorResponse' },
+          { '$ref' => '#/components/schemas/ErrorResponseWithImportId' }
+        ]
 
         let(:body) do
           {
@@ -204,6 +265,20 @@ RSpec.describe 'API V1 Imports', type: :request do
 
         run_test!
       end
+
+      response '500', 'import uploaded but publish enqueue failed' do
+        schema '$ref' => '#/components/schemas/ErrorResponseWithImportId'
+
+        let(:body) do
+          {
+            raw_file_content: { type: 'Account', data: { id: 'account_1', name: 'Checking' } }.to_json,
+            type: 'SureImport',
+            publish: 'true'
+          }
+        end
+
+        run_test!
+      end
     end
   end
 
@@ -211,7 +286,7 @@ RSpec.describe 'API V1 Imports', type: :request do
     parameter name: :id, in: :path, type: :string, required: true, description: 'Import ID'
 
     get 'Retrieve an import' do
-      description 'Retrieve detailed information about a specific import, including configuration and row statistics.'
+      description 'Retrieve detailed information about a specific import, including configuration, row statistics, and SureImport readback verification when available.'
       tags 'Imports'
       security [ { apiKeyAuth: [] } ]
       produces 'application/json'
@@ -233,4 +308,183 @@ RSpec.describe 'API V1 Imports', type: :request do
       end
     end
   end
+
+  path '/api/v1/imports/{id}/rows' do
+    parameter name: :id, in: :path, type: :string, required: true, description: 'Import ID'
+
+    get 'List import row diagnostics' do
+      description 'List sanitized import rows with validation errors and mapping resolution state.'
+      tags 'Imports'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+      parameter name: :page, in: :query, type: :integer, required: false,
+                description: 'Page number (default: 1)'
+      parameter name: :per_page, in: :query, type: :integer, required: false,
+                description: 'Items per page (default: 25, max: 100)'
+
+      let(:id) { pending_import.id }
+
+      response '200', 'import rows listed' do
+        schema '$ref' => '#/components/schemas/ImportRowDiagnosticCollection'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'import not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+
+      response '500', 'internal server error' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        before do
+          allow_any_instance_of(Import::Row).to receive(:valid?).and_raise(StandardError, 'validation down')
+        end
+
+        run_test!
+      end
+    end
+  end
+
+  path '/api/v1/imports/preflight' do
+    post 'Validate import content without creating an import' do
+      description 'Validate CSV or Sure NDJSON import content and return counts, headers, warnings, and validation errors without persisting an import or enqueueing jobs. CSV content is limited to 10MB.'
+      tags 'Imports'
+      security [ { apiKeyAuth: [] } ]
+      consumes 'application/json', 'multipart/form-data'
+      produces 'application/json'
+
+      parameter name: :body, in: :body, required: false, schema: {
+        type: :object,
+        properties: {
+          raw_file_content: {
+            type: :string,
+            description: 'Raw CSV or Sure NDJSON content as a string. CSV content is limited to 10MB.'
+          },
+          file: {
+            type: :string,
+            format: :binary,
+            description: 'CSV or Sure NDJSON upload when using multipart/form-data. CSV files are limited to 10MB.'
+          },
+          type: {
+            type: :string,
+            enum: %w[TransactionImport TradeImport AccountImport MintImport ActualImport CategoryImport RuleImport SureImport],
+            description: 'Import type to validate (defaults to TransactionImport)'
+          },
+          account_id: {
+            type: :string,
+            format: :uuid,
+            description: 'Account ID used for account-scoped CSV import validation'
+          },
+          date_col_label: { type: :string, description: 'CSV imports only. Header name for the date column' },
+          amount_col_label: { type: :string, description: 'CSV imports only. Header name for the amount column' },
+          name_col_label: { type: :string, description: 'CSV imports only. Header name for the transaction name column' },
+          category_col_label: { type: :string, description: 'CSV imports only. Header name for the category column' },
+          tags_col_label: { type: :string, description: 'CSV imports only. Header name for the tags column' },
+          notes_col_label: { type: :string, description: 'CSV imports only. Header name for the notes column' },
+          account_col_label: { type: :string, description: 'CSV imports only. Header name for the account column' },
+          qty_col_label: { type: :string, description: 'CSV trade imports only. Header name for the quantity column' },
+          ticker_col_label: { type: :string, description: 'CSV trade imports only. Header name for the ticker column' },
+          price_col_label: { type: :string, description: 'CSV trade imports only. Header name for the price column' },
+          entity_type_col_label: { type: :string, description: 'CSV imports only. Header name for the entity type column' },
+          currency_col_label: { type: :string, description: 'CSV imports only. Header name for the currency column' },
+          exchange_operating_mic_col_label: { type: :string, description: 'CSV trade imports only. Header name for the exchange operating MIC column' },
+          date_format: { type: :string, description: 'CSV imports only. Date format pattern' },
+          number_format: {
+            type: :string,
+            enum: [ '1,234.56', '1.234,56', '1 234,56', '1,234' ],
+            description: 'CSV imports only. Number format for parsing amounts'
+          },
+          signage_convention: {
+            type: :string,
+            enum: %w[inflows_positive inflows_negative],
+            description: 'CSV imports only. How to interpret positive/negative amounts'
+          },
+          col_sep: {
+            type: :string,
+            enum: [ ',', ';' ],
+            description: 'CSV imports only. Column separator'
+          },
+          rows_to_skip: {
+            type: :integer,
+            minimum: 0,
+            description: 'CSV imports only. Number of leading rows to skip before reading headers'
+          },
+          amount_type_strategy: {
+            type: :string,
+            enum: %w[signed_amount custom_column],
+            description: 'CSV imports only. Amount parsing strategy'
+          },
+          amount_type_inflow_value: {
+            type: :string,
+            description: 'CSV imports only. Column value that marks an amount as an inflow when using custom_column strategy'
+          }
+        }
+      }
+
+      response '200', 'import content preflighted' do
+        schema '$ref' => '#/components/schemas/ImportPreflightResponse'
+
+        let(:body) do
+          {
+            raw_file_content: "date,amount,name\n01/15/2024,50.00,New Transaction",
+            type: 'TransactionImport',
+            account_id: account.id,
+            date_col_label: 'date',
+            amount_col_label: 'amount',
+            name_col_label: 'name'
+          }
+        end
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+        let(:'X-Api-Key') { nil }
+        let(:body) { { raw_file_content: "date,amount\n01/15/2024,50.00" } }
+
+        run_test!
+      end
+
+      response '422', 'missing or invalid content' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+        let(:body) { { type: 'SureImport' } }
+
+        run_test!
+      end
+
+      response '404', 'account not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+        let(:body) do
+          {
+            raw_file_content: "date,amount,name\n01/15/2024,50.00,New Transaction",
+            account_id: SecureRandom.uuid
+          }
+        end
+
+        run_test!
+      end
+    end
+  end
 end
diff --git a/spec/requests/api/v1/provider_connections_spec.rb b/spec/requests/api/v1/provider_connections_spec.rb
new file mode 100644
index 000000000..ec52f9619
--- /dev/null
+++ b/spec/requests/api/v1/provider_connections_spec.rb
@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "swagger_helper"
+
+RSpec.describe "Api::V1::ProviderConnections", type: :request do
+  let(:user) { users(:family_admin) }
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: "API Docs Key",
+      key: key,
+      scopes: %w[read_write],
+      source: "web"
+    )
+  end
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    ApiKey.new(
+      user: user,
+      name: "API Docs Write Key",
+      key: key,
+      scopes: %w[write],
+      source: "web"
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+  let(:'X-Api-Key') { api_key.plain_key }
+
+  path "/api/v1/provider_connections" do
+    get "Lists provider connection status summaries" do
+      description "List safe provider connection status metadata for the authenticated user's family without exposing credentials, raw provider payloads, or raw sync errors."
+      tags "Provider Connections"
+      security [ { apiKeyAuth: [] } ]
+      produces "application/json"
+
+      response "200", "provider connection status summaries listed" do
+        schema "$ref" => "#/components/schemas/ProviderConnectionCollection"
+        run_test!
+      end
+
+      response "401", "unauthorized" do
+        let(:'X-Api-Key') { nil }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+
+      response "403", "insufficient scope" do
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/recurring_transactions_spec.rb b/spec/requests/api/v1/recurring_transactions_spec.rb
new file mode 100644
index 000000000..aedfd0df1
--- /dev/null
+++ b/spec/requests/api/v1/recurring_transactions_spec.rb
@@ -0,0 +1,401 @@
+# frozen_string_literal: true
+
+require 'swagger_helper'
+
+RSpec.describe 'API V1 Recurring Transactions', type: :request do
+  let(:family) do
+    Family.create!(
+      name: 'API Family',
+      currency: 'USD',
+      locale: 'en',
+      date_format: '%m-%d-%Y'
+    )
+  end
+
+  let(:user) do
+    family.users.create!(
+      email: 'api-user@example.com',
+      password: 'password123',
+      password_confirmation: 'password123'
+    )
+  end
+
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: 'API Docs Key',
+      key: key,
+      scopes: %w[read_write],
+      source: 'web'
+    )
+  end
+
+  let(:read_only_api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: 'Read Only Docs Key',
+      key: key,
+      scopes: %w[read],
+      source: 'mobile'
+    )
+  end
+
+  let(:'X-Api-Key') { api_key.plain_key }
+
+  let(:account) do
+    Account.create!(
+      family: family,
+      owner: user,
+      name: 'Checking Account',
+      balance: 1000,
+      currency: 'USD',
+      accountable: Depository.create!
+    )
+  end
+
+  let(:merchant) { family.merchants.create!(name: 'Streaming Service') }
+
+  let!(:recurring_transaction) do
+    family.recurring_transactions.create!(
+      account: account,
+      merchant: merchant,
+      amount: 19.99,
+      currency: 'USD',
+      expected_day_of_month: 15,
+      last_occurrence_date: Date.new(2026, 4, 15),
+      next_expected_date: Date.new(2026, 5, 15),
+      status: 'active',
+      occurrence_count: 3,
+      manual: true
+    )
+  end
+
+  path '/api/v1/recurring_transactions' do
+    get 'List recurring transactions' do
+      tags 'Recurring Transactions'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+      parameter name: :page, in: :query, type: :integer, required: false,
+                description: 'Page number (default: 1)'
+      parameter name: :per_page, in: :query, type: :integer, required: false,
+                description: 'Items per page (default: 25, max: 100)'
+      parameter name: :status, in: :query, required: false,
+                description: 'Filter by recurring status',
+                schema: { type: :string, enum: %w[active inactive] }
+      parameter name: :account_id, in: :query, required: false, description: 'Filter by account ID',
+                schema: { type: :string, format: :uuid }
+
+      response '200', 'recurring transactions listed' do
+        schema '$ref' => '#/components/schemas/RecurringTransactionCollection'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '422', 'validation error - malformed account filter' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:account_id) { 'not-a-uuid' }
+
+        run_test!
+      end
+    end
+
+    post 'Create recurring transaction' do
+      tags 'Recurring Transactions'
+      security [ { apiKeyAuth: [] } ]
+      consumes 'application/json'
+      produces 'application/json'
+      parameter name: :body, in: :body, required: true, schema: {
+        type: :object,
+        properties: {
+          recurring_transaction: {
+            type: :object,
+            properties: {
+              account_id: { type: :string, format: :uuid, nullable: true },
+              merchant_id: { type: :string, format: :uuid, nullable: true },
+              name: { type: :string, nullable: true },
+              amount: { type: :number },
+              currency: { type: :string },
+              expected_day_of_month: { type: :integer, minimum: 1, maximum: 31 },
+              last_occurrence_date: { type: :string, format: :date },
+              next_expected_date: { type: :string, format: :date },
+              status: { type: :string, enum: %w[active inactive] },
+              occurrence_count: { type: :integer, minimum: 0 },
+              manual: { type: :boolean },
+              expected_amount_min: { type: :number, nullable: true },
+              expected_amount_max: { type: :number, nullable: true },
+              expected_amount_avg: { type: :number, nullable: true }
+            },
+            required: %w[amount currency expected_day_of_month last_occurrence_date next_expected_date],
+            anyOf: [
+              { required: %w[name] },
+              { required: %w[merchant_id] }
+            ]
+          }
+        },
+        required: %w[recurring_transaction]
+      }
+
+      let(:body) do
+        {
+          recurring_transaction: {
+            account_id: account.id,
+            name: 'Gym Membership',
+            amount: 49.99,
+            currency: 'USD',
+            expected_day_of_month: 1,
+            last_occurrence_date: '2026-04-01',
+            next_expected_date: '2026-05-01'
+          }
+        }
+      end
+
+      response '201', 'recurring transaction created' do
+        schema '$ref' => '#/components/schemas/RecurringTransaction'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'forbidden - requires read_write scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { read_only_api_key.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'account not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:body) do
+          {
+            recurring_transaction: {
+              account_id: SecureRandom.uuid,
+              name: 'Gym Membership',
+              amount: 49.99,
+              currency: 'USD',
+              expected_day_of_month: 1,
+              last_occurrence_date: '2026-04-01',
+              next_expected_date: '2026-05-01'
+            }
+          }
+        end
+
+        run_test!
+      end
+
+      response '422', 'validation error - missing merchant or name' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:body) do
+          {
+            recurring_transaction: {
+              account_id: account.id,
+              amount: 49.99,
+              currency: 'USD',
+              expected_day_of_month: 1,
+              last_occurrence_date: '2026-04-01',
+              next_expected_date: '2026-05-01'
+            }
+          }
+        end
+
+        run_test!
+      end
+
+      response '422', 'validation error - nil status' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:body) do
+          {
+            recurring_transaction: {
+              account_id: account.id,
+              name: 'Gym Membership',
+              amount: 49.99,
+              currency: 'USD',
+              expected_day_of_month: 1,
+              last_occurrence_date: '2026-04-01',
+              next_expected_date: '2026-05-01',
+              status: nil
+            }
+          }
+        end
+
+        run_test!
+      end
+
+      response '422', 'validation error - negative occurrence count' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:body) do
+          {
+            recurring_transaction: {
+              account_id: account.id,
+              name: 'Gym Membership',
+              amount: 49.99,
+              currency: 'USD',
+              expected_day_of_month: 1,
+              last_occurrence_date: '2026-04-01',
+              next_expected_date: '2026-05-01',
+              occurrence_count: -1
+            }
+          }
+        end
+
+        run_test!
+      end
+    end
+  end
+
+  path '/api/v1/recurring_transactions/{id}' do
+    parameter name: :id, in: :path, type: :string, required: true, description: 'Recurring transaction ID'
+
+    get 'Retrieve recurring transaction' do
+      tags 'Recurring Transactions'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+
+      let(:id) { recurring_transaction.id }
+
+      response '200', 'recurring transaction retrieved' do
+        schema '$ref' => '#/components/schemas/RecurringTransaction'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '404', 'recurring transaction not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+    end
+
+    patch 'Update recurring transaction' do
+      tags 'Recurring Transactions'
+      security [ { apiKeyAuth: [] } ]
+      consumes 'application/json'
+      produces 'application/json'
+
+      let(:id) { recurring_transaction.id }
+
+      parameter name: :body, in: :body, required: true, schema: {
+        type: :object,
+        properties: {
+          recurring_transaction: {
+            type: :object,
+            properties: {
+              status: { type: :string, enum: %w[active inactive] },
+              expected_day_of_month: { type: :integer, minimum: 1, maximum: 31 },
+              next_expected_date: { type: :string, format: :date }
+            }
+          }
+        }
+      }
+      let(:body) { { recurring_transaction: { status: 'inactive' } } }
+
+      response '200', 'recurring transaction updated' do
+        schema '$ref' => '#/components/schemas/RecurringTransaction'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'forbidden - requires read_write scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { read_only_api_key.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'recurring transaction not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+
+      response '422', 'validation error' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:body) { { recurring_transaction: { expected_day_of_month: 32 } } }
+
+        run_test!
+      end
+    end
+
+    delete 'Delete recurring transaction' do
+      tags 'Recurring Transactions'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+
+      let(:id) { recurring_transaction.id }
+
+      response '200', 'recurring transaction deleted' do
+        schema '$ref' => '#/components/schemas/SuccessMessage'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'forbidden - requires read_write scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { read_only_api_key.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'recurring transaction not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/rejected_transfers_spec.rb b/spec/requests/api/v1/rejected_transfers_spec.rb
new file mode 100644
index 000000000..91580a42b
--- /dev/null
+++ b/spec/requests/api/v1/rejected_transfers_spec.rb
@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+require 'swagger_helper'
+
+RSpec.describe 'API V1 Rejected Transfers', type: :request do
+  let(:family) do
+    Family.create!(
+      name: 'API Family',
+      currency: 'USD',
+      locale: 'en',
+      date_format: '%m-%d-%Y'
+    )
+  end
+
+  let(:user) do
+    family.users.create!(
+      email: 'api-user@example.com',
+      password: 'password123',
+      password_confirmation: 'password123'
+    )
+  end
+
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: 'API Docs Key',
+      key: key,
+      scopes: %w[read_write],
+      source: 'web'
+    )
+  end
+
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    ApiKey.new(
+      user: user,
+      name: 'No Read Docs Key',
+      key: key,
+      scopes: [],
+      source: 'mobile'
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+
+  let(:'X-Api-Key') { api_key.plain_key }
+  let(:checking) { family.accounts.create!(name: 'Checking', balance: 1000, currency: 'USD', accountable: Depository.create!) }
+  let(:savings) { family.accounts.create!(name: 'Savings', balance: 2500, currency: 'USD', accountable: Depository.create!) }
+  let!(:outflow_entry) do
+    checking.entries.create!(
+      date: Date.current,
+      amount: 100,
+      name: 'Rejected outflow',
+      currency: 'USD',
+      entryable: Transaction.new(kind: 'standard')
+    )
+  end
+  let!(:inflow_entry) do
+    savings.entries.create!(
+      date: Date.current,
+      amount: -100,
+      name: 'Rejected inflow',
+      currency: 'USD',
+      entryable: Transaction.new(kind: 'standard')
+    )
+  end
+  let!(:rejected_transfer) do
+    RejectedTransfer.create!(
+      outflow_transaction: outflow_entry.entryable,
+      inflow_transaction: inflow_entry.entryable
+    )
+  end
+
+  path '/api/v1/rejected_transfers' do
+    get 'List rejected transfers' do
+      tags 'Rejected Transfers'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+      parameter name: :page, in: :query, type: :integer, required: false,
+                description: 'Page number (default: 1)'
+      parameter name: :per_page, in: :query, type: :integer, required: false,
+                description: 'Items per page (default: 25, max: 100)'
+      parameter name: :account_id, in: :query, required: false,
+                schema: { type: :string, format: :uuid },
+                description: 'Filter rejected transfers involving this account'
+      parameter name: :start_date, in: :query, required: false,
+                schema: { type: :string, format: :date },
+                description: 'Filter rejected transfers from this date'
+      parameter name: :end_date, in: :query, required: false,
+                schema: { type: :string, format: :date },
+                description: 'Filter rejected transfers until this date'
+
+      response '200', 'rejected transfers listed' do
+        schema '$ref' => '#/components/schemas/RejectedTransferCollection'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '422', 'invalid filter' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:account_id) { 'not-a-uuid' }
+
+        run_test!
+      end
+    end
+  end
+
+  path '/api/v1/rejected_transfers/{id}' do
+    parameter name: :id, in: :path, type: :string, required: true, description: 'Rejected transfer ID'
+
+    get 'Retrieve a rejected transfer' do
+      tags 'Rejected Transfers'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+
+      let(:id) { rejected_transfer.id }
+
+      response '200', 'rejected transfer retrieved' do
+        schema '$ref' => '#/components/schemas/RejectedTransfer'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'rejected transfer not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/rule_runs_spec.rb b/spec/requests/api/v1/rule_runs_spec.rb
new file mode 100644
index 000000000..d3a992190
--- /dev/null
+++ b/spec/requests/api/v1/rule_runs_spec.rb
@@ -0,0 +1,177 @@
+# frozen_string_literal: true
+
+require 'swagger_helper'
+
+RSpec.describe 'API V1 Rule Runs', type: :request do
+  let(:family) do
+    Family.create!(
+      name: 'API Family',
+      currency: 'USD',
+      locale: 'en',
+      date_format: '%m-%d-%Y'
+    )
+  end
+
+  let(:user) do
+    family.users.create!(
+      email: 'api-user@example.com',
+      password: 'password123',
+      password_confirmation: 'password123'
+    )
+  end
+
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: 'API Docs Key',
+      key: key,
+      scopes: %w[read_write],
+      source: 'web'
+    )
+  end
+
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    # Valid persisted API keys can only be read/read_write; this intentionally
+    # bypasses validations to document the runtime insufficient-scope response.
+    ApiKey.new(
+      user: user,
+      name: 'No Read Docs Key',
+      key: key,
+      scopes: [],
+      display_key: key,
+      source: 'mobile'
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+
+  let(:'X-Api-Key') { api_key.plain_key }
+
+  let!(:rule) do
+    family.rules.build(
+      name: 'Coffee cleanup',
+      resource_type: 'transaction',
+      active: true,
+      effective_date: Date.new(2024, 1, 1)
+    ).tap do |record|
+      record.conditions.build(condition_type: 'transaction_name', operator: 'like', value: 'coffee')
+      record.actions.build(action_type: 'set_transaction_name', value: 'Coffee')
+      record.save!
+    end
+  end
+
+  let!(:rule_run) do
+    rule.rule_runs.create!(
+      rule_name: rule.name,
+      execution_type: 'manual',
+      status: 'success',
+      transactions_queued: 10,
+      transactions_processed: 10,
+      transactions_modified: 4,
+      pending_jobs_count: 0,
+      executed_at: Time.zone.parse('2024-01-15 12:00:00')
+    )
+  end
+
+  path '/api/v1/rule_runs' do
+    get 'List rule runs' do
+      description 'List rule run history for the authenticated user family.'
+      tags 'Rule Runs'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+      parameter name: :page, in: :query, type: :integer, required: false,
+                description: 'Page number (default: 1)'
+      parameter name: :per_page, in: :query, type: :integer, required: false,
+                description: 'Items per page (default: 25, max: 100)'
+      parameter name: :rule_id, in: :query, required: false,
+                description: 'Filter by rule ID',
+                schema: { type: :string, format: :uuid }
+      parameter name: :status, in: :query, required: false,
+                description: 'Filter by run status',
+                schema: { type: :string, enum: %w[pending success failed] }
+      parameter name: :execution_type, in: :query, required: false,
+                description: 'Filter by execution type',
+                schema: { type: :string, enum: %w[manual scheduled] }
+      parameter name: :start_executed_at, in: :query, required: false,
+                description: 'Filter runs executed at or after this timestamp',
+                schema: { type: :string, format: :'date-time' }
+      parameter name: :end_executed_at, in: :query, required: false,
+                description: 'Filter runs executed at or before this timestamp',
+                schema: { type: :string, format: :'date-time' }
+
+      response '200', 'rule runs listed' do
+        schema '$ref' => '#/components/schemas/RuleRunCollection'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '422', 'invalid filter' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:status) { 'unknown' }
+
+        run_test!
+      end
+    end
+  end
+
+  path '/api/v1/rule_runs/{id}' do
+    parameter name: :id, in: :path, required: true, description: 'Rule run ID',
+              schema: { type: :string, format: :uuid }
+
+    get 'Retrieve a rule run' do
+      description 'Retrieve one rule run from the authenticated user family.'
+      tags 'Rule Runs'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+
+      let(:id) { rule_run.id }
+
+      response '200', 'rule run retrieved' do
+        schema '$ref' => '#/components/schemas/RuleRunResponse'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'rule run not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/rules_spec.rb b/spec/requests/api/v1/rules_spec.rb
new file mode 100644
index 000000000..0bf8e5bce
--- /dev/null
+++ b/spec/requests/api/v1/rules_spec.rb
@@ -0,0 +1,160 @@
+# frozen_string_literal: true
+
+require 'swagger_helper'
+
+RSpec.describe 'API V1 Rules', type: :request do
+  let(:family) do
+    Family.create!(
+      name: 'API Family',
+      currency: 'USD',
+      locale: 'en',
+      date_format: '%m-%d-%Y'
+    )
+  end
+
+  let(:user) do
+    family.users.create!(
+      email: 'api-user@example.com',
+      password: 'password123',
+      password_confirmation: 'password123'
+    )
+  end
+
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: 'API Docs Key',
+      key: key,
+      scopes: %w[read],
+      source: 'web'
+    )
+  end
+
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    # Valid persisted API keys can only be read/read_write; this intentionally
+    # bypasses validations to document the runtime insufficient-scope response.
+    ApiKey.new(
+      user: user,
+      name: 'No Read Docs Key',
+      key: key,
+      scopes: [],
+      display_key: key,
+      source: 'mobile'
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+
+  let(:'X-Api-Key') { api_key.plain_key }
+
+  let!(:rule) do
+    family.rules.build(
+      name: 'Coffee cleanup',
+      resource_type: 'transaction',
+      active: true,
+      effective_date: Date.new(2024, 1, 1)
+    ).tap do |rule|
+      rule.conditions.build(condition_type: 'transaction_name', operator: 'like', value: 'coffee')
+      rule.actions.build(action_type: 'set_transaction_name', value: 'Coffee')
+      rule.save!
+    end
+  end
+
+  path '/api/v1/rules' do
+    get 'List rules' do
+      tags 'Rules'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+      parameter name: :page, in: :query, type: :integer, required: false,
+                description: 'Page number (default: 1)'
+      parameter name: :per_page, in: :query, type: :integer, required: false,
+                description: 'Items per page (default: 25, max: 100)'
+      parameter name: :resource_type, in: :query, required: false,
+                description: 'Filter by rule resource type',
+                schema: { type: :string, enum: %w[transaction] }
+      parameter name: :active, in: :query, required: false,
+                description: 'Filter by active status',
+                schema: { type: :boolean }
+
+      response '200', 'rules listed' do
+        schema '$ref' => '#/components/schemas/RuleCollection'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'forbidden - requires read scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '422', 'invalid active filter' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:active) { 'not_boolean' }
+
+        run_test!
+      end
+
+      response '422', 'unsupported resource type' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:resource_type) { 'account' }
+
+        run_test!
+      end
+    end
+  end
+
+  path '/api/v1/rules/{id}' do
+    parameter name: :id, in: :path, type: :string, required: true, description: 'Rule ID'
+
+    get 'Retrieve a rule' do
+      tags 'Rules'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+
+      let(:id) { rule.id }
+
+      response '200', 'rule retrieved' do
+        schema '$ref' => '#/components/schemas/RuleResponse'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'forbidden - requires read scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'rule not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/securities_spec.rb b/spec/requests/api/v1/securities_spec.rb
new file mode 100644
index 000000000..b250ece3c
--- /dev/null
+++ b/spec/requests/api/v1/securities_spec.rb
@@ -0,0 +1,177 @@
+# frozen_string_literal: true
+
+require 'swagger_helper'
+
+RSpec.describe 'API V1 Securities', type: :request do
+  let(:family) do
+    Family.create!(
+      name: 'API Family',
+      currency: 'USD',
+      locale: 'en',
+      date_format: '%m-%d-%Y'
+    )
+  end
+
+  let(:user) do
+    family.users.create!(
+      email: 'api-user@example.com',
+      password: 'password123',
+      password_confirmation: 'password123'
+    )
+  end
+
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: 'API Docs Key',
+      key: key,
+      display_key: key,
+      scopes: %w[read_write],
+      source: 'web'
+    )
+  end
+
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    # Persist an invalid key shape intentionally so rswag can document 403.
+    ApiKey.new(
+      user: user,
+      name: 'No Read Docs Key',
+      key: key,
+      display_key: key,
+      scopes: [],
+      source: 'web'
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+
+  let(:'X-Api-Key') { api_key.plain_key }
+
+  let(:account) do
+    Account.create!(
+      family: family,
+      name: 'Investment Account',
+      balance: 50_000,
+      currency: 'USD',
+      accountable: Investment.create!
+    )
+  end
+
+  let!(:security) do
+    Security.create!(
+      ticker: 'VTI',
+      name: 'Vanguard Total Stock Market ETF',
+      country_code: 'US',
+      exchange_operating_mic: 'ARCX'
+    )
+  end
+
+  let!(:holding) do
+    Holding.create!(
+      account: account,
+      security: security,
+      date: Date.current,
+      qty: 100,
+      price: 250.50,
+      amount: 25_050,
+      currency: 'USD'
+    )
+  end
+
+  path '/api/v1/securities' do
+    get 'List securities referenced by family investment data' do
+      tags 'Securities'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+      parameter name: :page, in: :query, type: :integer, required: false,
+                description: 'Page number (default: 1)'
+      parameter name: :per_page, in: :query, type: :integer, required: false,
+                description: 'Items per page (default: 25, max: 100)'
+      parameter name: :ticker, in: :query, required: false,
+                description: 'Filter by ticker symbol',
+                schema: { type: :string }
+      parameter name: :exchange_operating_mic, in: :query, required: false,
+                description: 'Filter by exchange operating MIC',
+                schema: { type: :string }
+      parameter name: :kind, in: :query, required: false,
+                description: 'Filter by security kind',
+                schema: { type: :string, enum: %w[standard cash] }
+      parameter name: :offline, in: :query, required: false,
+                description: 'Filter by offline status. When supplied, must be true or false.',
+                schema: { type: :boolean }
+
+      response '200', 'securities listed' do
+        schema '$ref' => '#/components/schemas/SecurityCollection'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '422', 'invalid filter' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:kind) { 'unsupported' }
+
+        run_test!
+      end
+    end
+  end
+
+  path '/api/v1/securities/{id}' do
+    parameter name: :id, in: :path, required: true, description: 'Security ID',
+              schema: { type: :string, format: :uuid }
+
+    get 'Retrieve a security referenced by family investment data' do
+      tags 'Securities'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+
+      let(:id) { security.id }
+
+      response '200', 'security retrieved' do
+        schema '$ref' => '#/components/schemas/Security'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'security not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/security_prices_spec.rb b/spec/requests/api/v1/security_prices_spec.rb
new file mode 100644
index 000000000..335cf1317
--- /dev/null
+++ b/spec/requests/api/v1/security_prices_spec.rb
@@ -0,0 +1,189 @@
+# frozen_string_literal: true
+
+require 'swagger_helper'
+
+RSpec.describe 'API V1 Security Prices', type: :request do
+  let(:family) do
+    Family.create!(
+      name: 'API Family',
+      currency: 'USD',
+      locale: 'en',
+      date_format: '%m-%d-%Y'
+    )
+  end
+
+  let(:user) do
+    family.users.create!(
+      email: 'api-user@example.com',
+      password: 'password123',
+      password_confirmation: 'password123'
+    )
+  end
+
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: 'API Docs Key',
+      key: key,
+      display_key: key,
+      scopes: %w[read_write],
+      source: 'web'
+    )
+  end
+
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    # Persist an invalid key shape intentionally so rswag can document 403.
+    ApiKey.new(
+      user: user,
+      name: 'No Read Docs Key',
+      key: key,
+      display_key: key,
+      scopes: [],
+      source: 'web'
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+
+  let(:'X-Api-Key') { api_key.plain_key }
+
+  let(:account) do
+    Account.create!(
+      family: family,
+      name: 'Investment Account',
+      balance: 50_000,
+      currency: 'USD',
+      accountable: Investment.create!
+    )
+  end
+
+  let!(:security) do
+    Security.create!(
+      ticker: 'VTI',
+      name: 'Vanguard Total Stock Market ETF',
+      country_code: 'US',
+      exchange_operating_mic: 'ARCX'
+    )
+  end
+
+  let!(:holding) do
+    Holding.create!(
+      account: account,
+      security: security,
+      date: Date.current,
+      qty: 100,
+      price: 250.50,
+      amount: 25_050,
+      currency: 'USD'
+    )
+  end
+
+  let!(:security_price) do
+    Security::Price.create!(
+      security: security,
+      date: Date.current,
+      price: 250.1234,
+      currency: 'USD'
+    )
+  end
+
+  path '/api/v1/security_prices' do
+    get 'List security price history referenced by family investment data' do
+      tags 'Security Prices'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+      parameter name: :page, in: :query, type: :integer, required: false,
+                description: 'Page number (default: 1)'
+      parameter name: :per_page, in: :query, type: :integer, required: false,
+                description: 'Items per page (default: 25, max: 100)'
+      parameter name: :security_id, in: :query, required: false,
+                description: 'Filter by security ID',
+                schema: { type: :string, format: :uuid }
+      parameter name: :currency, in: :query, required: false,
+                description: 'Filter by currency code',
+                schema: { type: :string }
+      parameter name: :start_date, in: :query, required: false,
+                description: 'Filter prices from this date',
+                schema: { type: :string, format: :date }
+      parameter name: :end_date, in: :query, required: false,
+                description: 'Filter prices until this date',
+                schema: { type: :string, format: :date }
+      parameter name: :provisional, in: :query, required: false,
+                description: 'Filter by provisional price status. When supplied, must be true or false.',
+                schema: { type: :boolean }
+
+      response '200', 'security prices listed' do
+        schema '$ref' => '#/components/schemas/SecurityPriceCollection'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '422', 'invalid filter' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:security_id) { 'not-a-uuid' }
+
+        run_test!
+      end
+    end
+  end
+
+  path '/api/v1/security_prices/{id}' do
+    parameter name: :id, in: :path, required: true, description: 'Security price ID',
+              schema: { type: :string, format: :uuid }
+
+    get 'Retrieve a security price referenced by family investment data' do
+      tags 'Security Prices'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+
+      let(:id) { security_price.id }
+
+      response '200', 'security price retrieved' do
+        schema '$ref' => '#/components/schemas/SecurityPrice'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'security price not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/syncs_spec.rb b/spec/requests/api/v1/syncs_spec.rb
new file mode 100644
index 000000000..90c2dccca
--- /dev/null
+++ b/spec/requests/api/v1/syncs_spec.rb
@@ -0,0 +1,141 @@
+# frozen_string_literal: true
+
+require "swagger_helper"
+
+RSpec.describe "Api::V1::Syncs", type: :request do
+  let(:family) do
+    Family.create!(
+      name: "API Family",
+      currency: "USD",
+      locale: "en",
+      date_format: "%m-%d-%Y"
+    )
+  end
+
+  let(:user) do
+    family.users.create!(
+      email: "sync-api-user@example.com",
+      password: "password123",
+      password_confirmation: "password123"
+    )
+  end
+
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: "API Docs Key",
+      key: key,
+      display_key: key,
+      scopes: %w[read_write],
+      source: "web"
+    )
+  end
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    ApiKey.new(
+      user: user,
+      name: "No Read Docs Key",
+      key: key,
+      display_key: key,
+      scopes: %w[write],
+      source: "web"
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+  let(:'X-Api-Key') { api_key.plain_key }
+  let(:sync) { Sync.create!(syncable: family, status: "completed", completed_at: 1.minute.ago) }
+  let(:id) { sync.id }
+
+  path "/api/v1/syncs" do
+    get "Lists sync history" do
+      description "List sanitized sync status history for the authenticated user's family, accounts, and provider connections."
+      tags "Syncs"
+      security [ { apiKeyAuth: [] } ]
+      produces "application/json"
+      parameter name: :page, in: :query, type: :integer, required: false, description: "Page number (default: 1)"
+      parameter name: :per_page, in: :query, type: :integer, required: false, description: "Items per page (default: 25, max: 100)"
+
+      response "200", "syncs listed" do
+        schema "$ref" => "#/components/schemas/SyncCollection"
+        before { sync }
+        run_test!
+      end
+
+      response "401", "unauthorized" do
+        let(:'X-Api-Key') { nil }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+
+      response "403", "forbidden" do
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+    end
+  end
+
+  path "/api/v1/syncs/latest" do
+    get "Shows the latest sync" do
+      description "Return the most recently created sanitized sync status for the authenticated user's family, or data: null when no sync exists."
+      tags "Syncs"
+      security [ { apiKeyAuth: [] } ]
+      produces "application/json"
+
+      response "200", "latest sync shown" do
+        schema "$ref" => "#/components/schemas/SyncResponse"
+        before { sync }
+        run_test!
+      end
+
+      response "401", "unauthorized" do
+        let(:'X-Api-Key') { nil }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+
+      response "403", "forbidden" do
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+    end
+  end
+
+  path "/api/v1/syncs/{id}" do
+    parameter name: :id, in: :path, type: :string, format: :uuid, required: true
+
+    get "Shows a sync" do
+      description "Return sanitized status metadata for a single family-scoped sync."
+      tags "Syncs"
+      security [ { apiKeyAuth: [] } ]
+      produces "application/json"
+
+      response "200", "sync shown" do
+        schema "$ref" => "#/components/schemas/SyncResponse"
+        run_test!
+      end
+
+      response "401", "unauthorized" do
+        let(:'X-Api-Key') { nil }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+
+      response "403", "forbidden" do
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+
+      response "404", "not found" do
+        let(:id) { SecureRandom.uuid }
+        schema "$ref" => "#/components/schemas/ErrorResponse"
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/transactions_spec.rb b/spec/requests/api/v1/transactions_spec.rb
index a4eab7590..2a346906c 100644
--- a/spec/requests/api/v1/transactions_spec.rb
+++ b/spec/requests/api/v1/transactions_spec.rb
@@ -89,6 +89,7 @@ RSpec.describe 'API V1 Transactions', type: :request do
     get 'List transactions' do
       tags 'Transactions'
       security [ { apiKeyAuth: [] } ]
+      description 'Returns global ledger history for accessible accounts, including disabled accounts but excluding accounts pending deletion.'
       produces 'application/json'
       parameter name: :page, in: :query, type: :integer, required: false,
                 description: 'Page number (default: 1)'
@@ -173,6 +174,8 @@ RSpec.describe 'API V1 Transactions', type: :request do
               category_id: { type: :string, format: :uuid, description: 'Category ID' },
               merchant_id: { type: :string, format: :uuid, description: 'Merchant ID' },
               nature: { type: :string, enum: %w[income expense inflow outflow], description: 'Transaction nature (determines sign)' },
+              external_id: { type: :string, description: 'Optional external idempotency key scoped to account and source' },
+              source: { type: :string, description: 'Optional source namespace for external_id. Requires external_id and defaults to api when external_id is provided' },
               tag_ids: { type: :array, items: { type: :string, format: :uuid }, description: 'Array of tag IDs' }
             },
             required: %w[account_id date amount name]
@@ -201,6 +204,38 @@ RSpec.describe 'API V1 Transactions', type: :request do
         run_test!
       end
 
+      response '200', 'transaction already exists for external idempotency key' do
+        schema '$ref' => '#/components/schemas/Transaction'
+
+        let(:body) do
+          {
+            transaction: {
+              account_id: account.id,
+              date: Date.current.to_s,
+              amount: 50.00,
+              name: 'Test purchase',
+              nature: 'expense',
+              external_id: 'docs-import-transaction-1',
+              source: 'external_import'
+            }
+          }
+        end
+
+        before do
+          account.entries.create!(
+            name: 'Test purchase',
+            date: Date.current,
+            amount: 50.00,
+            currency: 'USD',
+            external_id: 'docs-import-transaction-1',
+            source: 'external_import',
+            entryable: Transaction.new
+          )
+        end
+
+        run_test!
+      end
+
       response '422', 'validation error - missing account_id' do
         schema '$ref' => '#/components/schemas/ErrorResponse'
 
@@ -234,7 +269,7 @@ RSpec.describe 'API V1 Transactions', type: :request do
   end
 
   path '/api/v1/transactions/{id}' do
-    parameter name: :id, in: :path, type: :string, required: true, description: 'Transaction ID'
+    parameter name: :id, in: :path, schema: { type: :string, format: :uuid }, required: true, description: 'Transaction ID'
 
     get 'Retrieve a transaction' do
       tags 'Transactions'
diff --git a/spec/requests/api/v1/transfers_spec.rb b/spec/requests/api/v1/transfers_spec.rb
new file mode 100644
index 000000000..47fcdd823
--- /dev/null
+++ b/spec/requests/api/v1/transfers_spec.rb
@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+
+require 'swagger_helper'
+
+RSpec.describe 'API V1 Transfers', type: :request do
+  let(:family) do
+    Family.create!(
+      name: 'API Family',
+      currency: 'USD',
+      locale: 'en',
+      date_format: '%m-%d-%Y'
+    )
+  end
+
+  let(:user) do
+    family.users.create!(
+      email: 'api-user@example.com',
+      password: 'password123',
+      password_confirmation: 'password123'
+    )
+  end
+
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: 'API Docs Key',
+      key: key,
+      scopes: %w[read_write],
+      source: 'web'
+    )
+  end
+
+  let(:api_key_without_read_scope) do
+    key = ApiKey.generate_secure_key
+    ApiKey.new(
+      user: user,
+      name: 'No Read Docs Key',
+      key: key,
+      scopes: [],
+      source: 'mobile'
+    ).tap { |api_key| api_key.save!(validate: false) }
+  end
+
+  let(:'X-Api-Key') { api_key.plain_key }
+  let(:checking) { family.accounts.create!(name: 'Checking', balance: 1000, currency: 'USD', accountable: Depository.create!) }
+  let(:savings) { family.accounts.create!(name: 'Savings', balance: 2500, currency: 'USD', accountable: Depository.create!) }
+  let!(:outflow_entry) do
+    checking.entries.create!(
+      date: Date.current,
+      amount: 100,
+      name: 'Transfer to savings',
+      currency: 'USD',
+      entryable: Transaction.new(kind: 'funds_movement')
+    )
+  end
+  let!(:inflow_entry) do
+    savings.entries.create!(
+      date: Date.current,
+      amount: -100,
+      name: 'Transfer from checking',
+      currency: 'USD',
+      entryable: Transaction.new(kind: 'funds_movement')
+    )
+  end
+  let!(:transfer) do
+    Transfer.create!(
+      outflow_transaction: outflow_entry.entryable,
+      inflow_transaction: inflow_entry.entryable,
+      status: 'confirmed',
+      notes: 'Confirmed by user'
+    )
+  end
+
+  path '/api/v1/transfers' do
+    get 'List transfers' do
+      tags 'Transfers'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+      parameter name: :page, in: :query, type: :integer, required: false,
+                description: 'Page number (default: 1)'
+      parameter name: :per_page, in: :query, type: :integer, required: false,
+                description: 'Items per page (default: 25, max: 100)'
+      parameter name: :status, in: :query, required: false,
+                schema: { type: :string, enum: %w[pending confirmed] },
+                description: 'Filter by transfer status'
+      parameter name: :account_id, in: :query, required: false,
+                schema: { type: :string, format: :uuid },
+                description: 'Filter transfers involving this account'
+      parameter name: :start_date, in: :query, required: false,
+                schema: { type: :string, format: :date },
+                description: 'Filter transfers from this date'
+      parameter name: :end_date, in: :query, required: false,
+                schema: { type: :string, format: :date },
+                description: 'Filter transfers until this date'
+
+      response '200', 'transfers listed' do
+        schema '$ref' => '#/components/schemas/TransferDecisionCollection'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '422', 'invalid filter' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:status) { 'settled' }
+
+        run_test!
+      end
+    end
+  end
+
+  path '/api/v1/transfers/{id}' do
+    parameter name: :id, in: :path, type: :string, required: true, description: 'Transfer ID'
+
+    get 'Retrieve a transfer' do
+      tags 'Transfers'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+
+      let(:id) { transfer.id }
+
+      response '200', 'transfer retrieved' do
+        schema '$ref' => '#/components/schemas/TransferDecision'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '403', 'insufficient scope' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { api_key_without_read_scope.plain_key }
+
+        run_test!
+      end
+
+      response '404', 'transfer not found' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:id) { SecureRandom.uuid }
+
+        run_test!
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/users_spec.rb b/spec/requests/api/v1/users_spec.rb
index bb714d8ef..17c831fe9 100644
--- a/spec/requests/api/v1/users_spec.rb
+++ b/spec/requests/api/v1/users_spec.rb
@@ -42,23 +42,28 @@ RSpec.describe 'API V1 Users', type: :request do
       description 'Resets all financial data (accounts, categories, merchants, tags, etc.) ' \
                   'for the current user\'s family while keeping the user account intact. ' \
                   'The reset runs asynchronously in the background. ' \
+                  'The returned job_id is informational only; reset status is family-scoped, not job-scoped. ' \
                   'Requires admin role.'
       security [ { apiKeyAuth: [] } ]
       produces 'application/json'
 
       response '200', 'account reset initiated' do
-        schema '$ref' => '#/components/schemas/SuccessMessage'
+        schema '$ref' => '#/components/schemas/ResetInitiatedResponse'
 
         run_test!
       end
 
       response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
         let(:'X-Api-Key') { 'invalid-key' }
 
         run_test!
       end
 
       response '403', 'forbidden - requires read_write scope and admin role' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
         let(:api_key) do
           key = ApiKey.generate_secure_key
           ApiKey.create!(
@@ -72,6 +77,49 @@ RSpec.describe 'API V1 Users', type: :request do
 
         run_test!
       end
+
+      response '500', 'reset enqueue failed' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        before do
+          allow(FamilyResetJob).to receive(:perform_later).and_raise(StandardError, 'queue down')
+        end
+
+        run_test!
+      end
+    end
+  end
+
+  path '/api/v1/users/reset/status' do
+    get 'Retrieve reset status' do
+      tags 'Users'
+      description 'Returns counts of family-owned data targeted by account reset. ' \
+                  'Use this after DELETE /api/v1/users/reset to decide whether reset materialization has completed. ' \
+                  'Completion is a counts-based family snapshot and may change if new data is created after reset.'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+
+      response '200', 'reset status returned' do
+        schema '$ref' => '#/components/schemas/ResetStatusResponse'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { 'invalid-key' }
+
+        run_test!
+      end
+
+      response '403', 'forbidden - requires admin role' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:role) { :member }
+
+        run_test!
+      end
     end
   end
 
@@ -114,6 +162,7 @@ RSpec.describe 'API V1 Users', type: :request do
         schema '$ref' => '#/components/schemas/ErrorResponse'
 
         before do
+          api_key
           allow_any_instance_of(User).to receive(:deactivate).and_return(false)
           allow_any_instance_of(User).to receive(:errors).and_return(
             double(full_messages: [ 'Cannot deactivate admin with other users' ])
diff --git a/spec/requests/api/v1/valuations_spec.rb b/spec/requests/api/v1/valuations_spec.rb
index 04319c688..b164812cf 100644
--- a/spec/requests/api/v1/valuations_spec.rb
+++ b/spec/requests/api/v1/valuations_spec.rb
@@ -20,25 +20,18 @@ RSpec.describe 'API V1 Valuations', type: :request do
     )
   end
 
-  let(:oauth_application) do
-    Doorkeeper::Application.create!(
-      name: 'API Docs',
-      redirect_uri: 'https://example.com/callback',
-      scopes: 'read read_write'
+  let(:api_key) do
+    key = ApiKey.generate_secure_key
+    ApiKey.create!(
+      user: user,
+      name: 'API Docs Key',
+      key: key,
+      scopes: %w[read_write],
+      source: 'web'
     )
   end
 
-  let(:access_token) do
-    Doorkeeper::AccessToken.create!(
-      application: oauth_application,
-      resource_owner_id: user.id,
-      scopes: 'read_write',
-      expires_in: 2.hours,
-      token: SecureRandom.hex(32)
-    )
-  end
-
-  let(:Authorization) { "Bearer #{access_token.token}" }
+  let(:'X-Api-Key') { api_key.plain_key }
 
   let(:account) do
     Account.create!(
@@ -66,13 +59,59 @@ RSpec.describe 'API V1 Valuations', type: :request do
   let!(:valuation_id) { valuation_entry.id }
 
   path '/api/v1/valuations' do
+    get 'List valuations' do
+      tags 'Valuations'
+      security [ { apiKeyAuth: [] } ]
+      produces 'application/json'
+      parameter name: :page, in: :query, type: :integer, required: false,
+                description: 'Page number (default: 1)'
+      parameter name: :per_page, in: :query, type: :integer, required: false,
+                description: 'Items per page (default: 25, max: 100)'
+      parameter name: :account_id, in: :query, required: false, description: 'Filter by account ID',
+                schema: { type: :string, format: :uuid }
+      parameter name: :start_date, in: :query, required: false,
+                description: 'Filter valuations from this date',
+                schema: { type: :string, format: :date }
+      parameter name: :end_date, in: :query, required: false,
+                description: 'Filter valuations until this date',
+                schema: { type: :string, format: :date }
+
+      response '200', 'valuations listed' do
+        schema '$ref' => '#/components/schemas/ValuationCollection'
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:'X-Api-Key') { nil }
+
+        run_test!
+      end
+
+      response '422', 'invalid date filter' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:start_date) { 'not-a-date' }
+
+        run_test!
+      end
+
+      response '422', 'invalid account filter' do
+        schema '$ref' => '#/components/schemas/ErrorResponse'
+
+        let(:account_id) { 'not-a-uuid' }
+
+        run_test!
+      end
+    end
+
     post 'Create valuation' do
       tags 'Valuations'
       security [ { apiKeyAuth: [] } ]
       consumes 'application/json'
       produces 'application/json'
-      parameter name: :Authorization, in: :header, required: true, schema: { type: :string },
-                description: 'Bearer token with write scope'
       parameter name: :body, in: :body, required: true, schema: {
         type: :object,
         properties: {
@@ -82,9 +121,17 @@ RSpec.describe 'API V1 Valuations', type: :request do
               account_id: { type: :string, format: :uuid, description: 'Account ID (required)' },
               amount: { type: :number, description: 'Valuation amount (required)' },
               date: { type: :string, format: :date, description: 'Valuation date (required)' },
-              notes: { type: :string, description: 'Additional notes' }
+              notes: { type: :string, description: 'Additional notes' },
+              upsert: {
+                type: :boolean,
+                description: 'Nested alternative to the top-level response-status flag. Top-level upsert takes precedence when both are provided.'
+              }
             },
             required: %w[account_id amount date]
+          },
+          upsert: {
+            type: :boolean,
+            description: 'Response-status signal only. When true and a same-account same-date valuation exists before the request, the endpoint returns 200 OK instead of 201 Created. The underlying reconciliation write path is unchanged; this flag does not add duplicate-prevention or safe-retry guarantees beyond existing same-date reconciliation behavior.'
           }
         },
         required: %w[valuation]
@@ -106,6 +153,23 @@ RSpec.describe 'API V1 Valuations', type: :request do
         run_test!
       end
 
+      response '200', 'existing valuation upserted' do
+        schema '$ref' => '#/components/schemas/Valuation'
+
+        let(:body) do
+          {
+            upsert: true,
+            valuation: {
+              account_id: account.id,
+              amount: 15000.00,
+              date: Date.current.to_s
+            }
+          }
+        end
+
+        run_test!
+      end
+
       response '422', 'validation error - missing account_id' do
         schema '$ref' => '#/components/schemas/ErrorResponse'
 
@@ -170,8 +234,6 @@ RSpec.describe 'API V1 Valuations', type: :request do
   end
 
   path '/api/v1/valuations/{id}' do
-    parameter name: :Authorization, in: :header, required: true, schema: { type: :string },
-              description: 'Bearer token'
     parameter name: :id, in: :path, type: :string, required: true, description: 'Valuation ID (entry ID)'
 
     get 'Retrieve a valuation' do
diff --git a/spec/swagger_helper.rb b/spec/swagger_helper.rb
index ad99750c1..0372ce03a 100644
--- a/spec/swagger_helper.rb
+++ b/spec/swagger_helper.rb
@@ -43,6 +43,48 @@ RSpec.configure do |config|
               total_pages: { type: :integer, minimum: 0 }
             }
           },
+          FamilyExportFile: {
+            type: :object,
+            required: %w[attached],
+            properties: {
+              attached: { type: :boolean },
+              byte_size: { type: :integer, nullable: true, minimum: 0 },
+              content_type: { type: :string, nullable: true }
+            }
+          },
+          FamilyExport: {
+            type: :object,
+            required: %w[id status filename downloadable file created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              status: { type: :string, enum: %w[pending processing completed failed] },
+              filename: { type: :string },
+              downloadable: { type: :boolean },
+              download_path: { type: :string, nullable: true },
+              file: { '$ref' => '#/components/schemas/FamilyExportFile' },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          FamilyExportResponse: {
+            type: :object,
+            required: %w[data],
+            properties: {
+              data: { '$ref' => '#/components/schemas/FamilyExport' }
+            }
+          },
+          FamilyExportCollection: {
+            type: :object,
+            required: %w[data meta],
+            properties: {
+              data: {
+                type: :array,
+                maxItems: 100,
+                items: { '$ref' => '#/components/schemas/FamilyExport' }
+              },
+              meta: { '$ref' => '#/components/schemas/Pagination' }
+            }
+          },
           ErrorResponse: {
             type: :object,
             required: %w[error],
@@ -64,6 +106,27 @@ RSpec.configure do |config|
               }
             }
           },
+          ErrorResponseWithImportId: {
+            type: :object,
+            required: %w[error import_id],
+            properties: {
+              error: { type: :string },
+              message: { type: :string, nullable: true },
+              import_id: {
+                type: :string,
+                format: :uuid,
+                description: 'Import ID preserved for retry or inspection after upload succeeds but publish fails'
+              }
+            }
+          },
+          MfaRequiredResponse: {
+            type: :object,
+            required: %w[error mfa_required],
+            properties: {
+              error: { type: :string },
+              mfa_required: { type: :boolean }
+            }
+          },
           ToolCall: {
             type: :object,
             required: %w[id function_name function_arguments created_at],
@@ -175,19 +238,29 @@ RSpec.configure do |config|
             properties: {
               id: { type: :string, format: :uuid },
               name: { type: :string },
-              account_type: { type: :string }
+              account_type: { type: :string, nullable: true },
+              status: { type: :string }
             }
           },
           AccountDetail: {
             type: :object,
-            required: %w[id name balance currency classification account_type],
+            required: %w[id name balance balance_cents cash_balance cash_balance_cents currency classification account_type status created_at updated_at],
             properties: {
               id: { type: :string, format: :uuid },
               name: { type: :string },
               balance: { type: :string },
+              balance_cents: { type: :integer, description: 'Signed balance in minor currency units' },
+              cash_balance: { type: :string },
+              cash_balance_cents: { type: :integer, description: 'Signed cash balance in minor currency units' },
               currency: { type: :string },
               classification: { type: :string },
-              account_type: { type: :string }
+              account_type: { type: :string, nullable: true },
+              subtype: { type: :string, nullable: true },
+              status: { type: :string, enum: %w[active draft disabled pending_deletion] },
+              institution_name: { type: :string, nullable: true },
+              institution_domain: { type: :string, nullable: true },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
             }
           },
           AccountCollection: {
@@ -201,6 +274,224 @@ RSpec.configure do |config|
               pagination: { '$ref' => '#/components/schemas/Pagination' }
             }
           },
+          FamilySettings: {
+            type: :object,
+            required: %w[id currency locale date_format month_start_day moniker default_account_sharing custom_enabled_currencies enabled_currencies created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              name: { type: :string, nullable: true },
+              currency: { type: :string },
+              locale: { type: :string },
+              date_format: { type: :string },
+              country: { type: :string, nullable: true },
+              timezone: { type: :string, nullable: true },
+              month_start_day: { type: :integer, minimum: 1, maximum: 28 },
+              moniker: { type: :string, enum: Family::MONIKERS },
+              default_account_sharing: { type: :string, enum: %w[shared private] },
+              custom_enabled_currencies: { type: :boolean },
+              enabled_currencies: {
+                type: :array,
+                items: { type: :string }
+              },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          BudgetSummary: {
+            type: :object,
+            required: %w[id start_date end_date name currency initialized current created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              start_date: { type: :string, format: :date },
+              end_date: { type: :string, format: :date },
+              name: { type: :string },
+              currency: { type: :string },
+              initialized: { type: :boolean },
+              current: { type: :boolean },
+              budgeted_spending: { type: :string, nullable: true },
+              budgeted_spending_cents: { type: :integer, nullable: true },
+              expected_income: { type: :string, nullable: true },
+              expected_income_cents: { type: :integer, nullable: true },
+              allocated_spending: { type: :string },
+              allocated_spending_cents: { type: :integer },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          Budget: {
+            type: :object,
+            required: %w[id start_date end_date name currency initialized current created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              start_date: { type: :string, format: :date },
+              end_date: { type: :string, format: :date },
+              name: { type: :string },
+              currency: { type: :string },
+              initialized: { type: :boolean },
+              current: { type: :boolean },
+              budgeted_spending: { type: :string, nullable: true },
+              budgeted_spending_cents: { type: :integer, nullable: true },
+              expected_income: { type: :string, nullable: true },
+              expected_income_cents: { type: :integer, nullable: true },
+              allocated_spending: { type: :string },
+              allocated_spending_cents: { type: :integer },
+              actual_spending: { type: :string },
+              actual_spending_cents: { type: :integer },
+              actual_income: { type: :string },
+              actual_income_cents: { type: :integer },
+              available_to_spend: { type: :string },
+              available_to_spend_cents: { type: :integer },
+              available_to_allocate: { type: :string },
+              available_to_allocate_cents: { type: :integer },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          BudgetCollection: {
+            type: :object,
+            required: %w[budgets pagination],
+            properties: {
+              budgets: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/BudgetSummary' }
+              },
+              pagination: { '$ref' => '#/components/schemas/Pagination' }
+            }
+          },
+          BudgetCategorySummary: {
+            type: :object,
+            required: %w[id budget_id currency subcategory inherits_parent_budget category created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              budget_id: { type: :string, format: :uuid },
+              currency: { type: :string },
+              subcategory: { type: :boolean },
+              inherits_parent_budget: { type: :boolean },
+              budgeted_spending: { type: :string },
+              budgeted_spending_cents: { type: :integer },
+              display_budgeted_spending: { type: :string },
+              display_budgeted_spending_cents: { type: :integer },
+              category: {
+                type: :object,
+                required: %w[id name color lucide_icon],
+                properties: {
+                  id: { type: :string, format: :uuid },
+                  name: { type: :string },
+                  color: { type: :string },
+                  lucide_icon: { type: :string },
+                  parent_id: { type: :string, format: :uuid, nullable: true }
+                }
+              },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          BudgetCategory: {
+            type: :object,
+            required: %w[id budget_id currency subcategory inherits_parent_budget category created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              budget_id: { type: :string, format: :uuid },
+              currency: { type: :string },
+              subcategory: { type: :boolean },
+              inherits_parent_budget: { type: :boolean },
+              budgeted_spending: { type: :string },
+              budgeted_spending_cents: { type: :integer },
+              display_budgeted_spending: { type: :string },
+              display_budgeted_spending_cents: { type: :integer },
+              actual_spending: { type: :string },
+              actual_spending_cents: { type: :integer },
+              available_to_spend: { type: :string },
+              available_to_spend_cents: { type: :integer },
+              category: {
+                type: :object,
+                required: %w[id name color lucide_icon],
+                properties: {
+                  id: { type: :string, format: :uuid },
+                  name: { type: :string },
+                  color: { type: :string },
+                  lucide_icon: { type: :string },
+                  parent_id: { type: :string, format: :uuid, nullable: true }
+                }
+              },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          BudgetCategoryCollection: {
+            type: :object,
+            required: %w[budget_categories pagination],
+            properties: {
+              budget_categories: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/BudgetCategorySummary' }
+              },
+              pagination: { '$ref' => '#/components/schemas/Pagination' }
+            }
+          },
+          Balance: {
+            type: :object,
+            required: %w[id date currency flows_factor balance balance_cents start_balance start_balance_cents end_balance end_balance_cents account created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              date: { type: :string, format: :date },
+              currency: { type: :string },
+              flows_factor: { type: :number, format: :float },
+              balance: { type: :string },
+              balance_cents: { type: :integer, description: 'Balance in currency minor units' },
+              cash_balance: { type: :string, nullable: true },
+              cash_balance_cents: { type: :integer, nullable: true, description: 'Cash balance in currency minor units' },
+              start_cash_balance: { type: :string },
+              start_cash_balance_cents: { type: :integer, description: 'Starting cash balance in currency minor units' },
+              start_non_cash_balance: { type: :string },
+              start_non_cash_balance_cents: { type: :integer, description: 'Starting non-cash balance in currency minor units' },
+              start_balance: { type: :string },
+              start_balance_cents: { type: :integer, description: 'Starting total balance in currency minor units' },
+              cash_inflows: { type: :string },
+              cash_inflows_cents: { type: :integer, description: 'Cash inflows in currency minor units' },
+              cash_outflows: { type: :string },
+              cash_outflows_cents: { type: :integer, description: 'Cash outflows in currency minor units' },
+              non_cash_inflows: { type: :string },
+              non_cash_inflows_cents: { type: :integer, description: 'Non-cash inflows in currency minor units' },
+              non_cash_outflows: { type: :string },
+              non_cash_outflows_cents: { type: :integer, description: 'Non-cash outflows in currency minor units' },
+              net_market_flows: { type: :string },
+              net_market_flows_cents: { type: :integer, description: 'Net market flows in currency minor units' },
+              cash_adjustments: { type: :string },
+              cash_adjustments_cents: { type: :integer, description: 'Cash adjustments in currency minor units' },
+              non_cash_adjustments: { type: :string },
+              non_cash_adjustments_cents: { type: :integer, description: 'Non-cash adjustments in currency minor units' },
+              end_cash_balance: { type: :string },
+              end_cash_balance_cents: { type: :integer, description: 'Ending cash balance in currency minor units' },
+              end_non_cash_balance: { type: :string },
+              end_non_cash_balance_cents: { type: :integer, description: 'Ending non-cash balance in currency minor units' },
+              end_balance: { type: :string },
+              end_balance_cents: { type: :integer, description: 'Ending total balance in currency minor units' },
+              account: { '$ref' => '#/components/schemas/BalanceAccount' },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          BalanceAccount: {
+            type: :object,
+            required: %w[id name account_type],
+            properties: {
+              id: { type: :string, format: :uuid },
+              name: { type: :string },
+              account_type: { type: :string, nullable: true }
+            }
+          },
+          BalanceCollection: {
+            type: :object,
+            required: %w[balances pagination],
+            properties: {
+              balances: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/Balance' }
+              },
+              pagination: { '$ref' => '#/components/schemas/Pagination' }
+            }
+          },
           Category: {
             type: :object,
             required: %w[id name color icon],
@@ -244,6 +535,22 @@ RSpec.configure do |config|
               pagination: { '$ref' => '#/components/schemas/Pagination' }
             }
           },
+          CategoryCreateRequest: {
+            type: :object,
+            required: %w[category],
+            properties: {
+              category: {
+                type: :object,
+                required: %w[name],
+                properties: {
+                  name: { type: :string, description: 'Category name (required, unique within family)' },
+                  color: { type: :string, description: 'Hex color code (e.g. #22c55e). Defaults to #6172F3 if omitted; subcategories inherit parent color.' },
+                  icon: { type: :string, description: 'Lucide icon name (e.g. "coffee"). Auto-suggested from the name when omitted.' },
+                  parent_id: { type: :string, format: :uuid, nullable: true, description: 'Parent category ID. Must belong to the same family. Categories support up to 2 levels of nesting.' }
+                }
+              }
+            }
+          },
           Merchant: {
             type: :object,
             required: %w[id name],
@@ -287,6 +594,142 @@ RSpec.configure do |config|
             type: :array,
             items: { '$ref' => '#/components/schemas/TagDetail' }
           },
+          RuleAction: {
+            type: :object,
+            required: %w[id action_type created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              action_type: { type: :string },
+              value: { type: :string, nullable: true },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          RuleCondition: {
+            type: :object,
+            required: %w[id condition_type operator sub_conditions created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              condition_type: { type: :string },
+              operator: { type: :string },
+              value: { type: :string, nullable: true },
+              sub_conditions: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/RuleCondition' }
+              },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          Rule: {
+            type: :object,
+            required: %w[id resource_type active conditions actions created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              name: { type: :string, nullable: true },
+              resource_type: { type: :string, enum: %w[transaction] },
+              active: { type: :boolean },
+              effective_date: { type: :string, format: :date, nullable: true },
+              conditions: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/RuleCondition' }
+              },
+              actions: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/RuleAction' }
+              },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          RuleResponse: {
+            type: :object,
+            required: %w[data],
+            properties: {
+              data: { '$ref' => '#/components/schemas/Rule' }
+            }
+          },
+          RuleCollection: {
+            type: :object,
+            required: %w[data meta],
+            properties: {
+              data: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/Rule' }
+              },
+              meta: {
+                type: :object,
+                required: %w[current_page total_pages total_count per_page],
+                properties: {
+                  current_page: { type: :integer },
+                  next_page: { type: :integer, nullable: true },
+                  prev_page: { type: :integer, nullable: true },
+                  total_pages: { type: :integer },
+                  total_count: { type: :integer },
+                  per_page: { type: :integer }
+                }
+              }
+            }
+          },
+          RuleRun: {
+            type: :object,
+            required: %w[id rule_id rule_name execution_type status transactions_queued transactions_processed transactions_modified pending_jobs_count executed_at rule created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              rule_id: { type: :string, format: :uuid },
+              rule_name: { type: :string, nullable: true },
+              execution_type: { type: :string, enum: %w[manual scheduled] },
+              status: { type: :string, enum: %w[pending success failed] },
+              transactions_queued: { type: :integer, minimum: 0 },
+              transactions_processed: { type: :integer, minimum: 0 },
+              transactions_modified: { type: :integer, minimum: 0 },
+              pending_jobs_count: { type: :integer, minimum: 0 },
+              executed_at: { type: :string, format: :'date-time' },
+              error_message: { type: :string, nullable: true },
+              rule: {
+                type: :object,
+                nullable: true,
+                required: %w[id resource_type active],
+                properties: {
+                  id: { type: :string, format: :uuid },
+                  name: { type: :string, nullable: true },
+                  resource_type: { type: :string },
+                  active: { type: :boolean }
+                }
+              },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          RuleRunResponse: {
+            type: :object,
+            required: %w[data],
+            properties: {
+              data: { '$ref' => '#/components/schemas/RuleRun' }
+            }
+          },
+          RuleRunCollection: {
+            type: :object,
+            required: %w[data meta],
+            properties: {
+              data: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/RuleRun' }
+              },
+              meta: {
+                type: :object,
+                required: %w[current_page total_pages total_count per_page],
+                properties: {
+                  current_page: { type: :integer },
+                  next_page: { type: :integer, nullable: true },
+                  prev_page: { type: :integer, nullable: true },
+                  total_pages: { type: :integer },
+                  total_count: { type: :integer },
+                  per_page: { type: :integer }
+                }
+              }
+            }
+          },
           Transfer: {
             type: :object,
             required: %w[id amount currency],
@@ -297,6 +740,44 @@ RSpec.configure do |config|
               other_account: { '$ref' => '#/components/schemas/Account', nullable: true }
             }
           },
+          RecurringTransaction: {
+            type: :object,
+            required: %w[id amount amount_cents currency expected_day_of_month last_occurrence_date next_expected_date status occurrence_count manual created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              amount: { type: :string },
+              amount_cents: { type: :integer, description: 'Amount in currency minor units' },
+              currency: { type: :string },
+              expected_day_of_month: { type: :integer, minimum: 1, maximum: 31 },
+              last_occurrence_date: { type: :string, format: :date },
+              next_expected_date: { type: :string, format: :date },
+              status: { type: :string, enum: %w[active inactive] },
+              occurrence_count: { type: :integer, minimum: 0 },
+              name: { type: :string, nullable: true },
+              manual: { type: :boolean },
+              expected_amount_min: { type: :string, nullable: true },
+              expected_amount_min_cents: { type: :integer, nullable: true, description: 'Minimum expected amount in currency minor units' },
+              expected_amount_max: { type: :string, nullable: true },
+              expected_amount_max_cents: { type: :integer, nullable: true, description: 'Maximum expected amount in currency minor units' },
+              expected_amount_avg: { type: :string, nullable: true },
+              expected_amount_avg_cents: { type: :integer, nullable: true, description: 'Average expected amount in currency minor units' },
+              account: { '$ref' => '#/components/schemas/Account', nullable: true },
+              merchant: { '$ref' => '#/components/schemas/Merchant', nullable: true },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          RecurringTransactionCollection: {
+            type: :object,
+            required: %w[recurring_transactions pagination],
+            properties: {
+              recurring_transactions: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/RecurringTransaction' }
+              },
+              pagination: { '$ref' => '#/components/schemas/Pagination' }
+            }
+          },
           Transaction: {
             type: :object,
             required: %w[id date amount currency name classification account tags created_at updated_at],
@@ -307,6 +788,8 @@ RSpec.configure do |config|
               currency: { type: :string },
               name: { type: :string },
               notes: { type: :string, nullable: true },
+              external_id: { type: :string, nullable: true },
+              source: { type: :string, nullable: true },
               classification: { type: :string },
               account: { '$ref' => '#/components/schemas/Account' },
               category: { '$ref' => '#/components/schemas/Category', nullable: true },
@@ -331,6 +814,80 @@ RSpec.configure do |config|
               pagination: { '$ref' => '#/components/schemas/Pagination' }
             }
           },
+          TransferTransactionSide: {
+            type: :object,
+            required: %w[id entry_id date amount amount_cents currency name kind account],
+            properties: {
+              id: { type: :string, format: :uuid },
+              entry_id: { type: :string, format: :uuid },
+              date: { type: :string, format: :date },
+              amount: { type: :string },
+              amount_cents: { type: :integer, description: 'Signed amount in currency minor units' },
+              currency: { type: :string },
+              name: { type: :string },
+              kind: { type: :string },
+              account: {
+                type: :object,
+                required: %w[id name account_type],
+                properties: {
+                  id: { type: :string, format: :uuid },
+                  name: { type: :string },
+                  account_type: { type: :string, nullable: true }
+                }
+              }
+            }
+          },
+          TransferDecision: {
+            type: :object,
+            required: %w[id status date amount amount_cents currency transfer_type inflow_transaction outflow_transaction created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              status: { type: :string, enum: %w[pending confirmed] },
+              date: { type: :string, format: :date },
+              amount: { type: :string },
+              amount_cents: { type: :integer, description: 'Absolute transfer amount in currency minor units' },
+              currency: { type: :string },
+              transfer_type: { type: :string, enum: %w[transfer liability_payment loan_payment] },
+              notes: { type: :string, nullable: true },
+              inflow_transaction: { '$ref' => '#/components/schemas/TransferTransactionSide' },
+              outflow_transaction: { '$ref' => '#/components/schemas/TransferTransactionSide' },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          TransferDecisionCollection: {
+            type: :object,
+            required: %w[transfers pagination],
+            properties: {
+              transfers: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/TransferDecision' }
+              },
+              pagination: { '$ref' => '#/components/schemas/Pagination' }
+            }
+          },
+          RejectedTransfer: {
+            type: :object,
+            required: %w[id inflow_transaction outflow_transaction created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              inflow_transaction: { '$ref' => '#/components/schemas/TransferTransactionSide' },
+              outflow_transaction: { '$ref' => '#/components/schemas/TransferTransactionSide' },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          RejectedTransferCollection: {
+            type: :object,
+            required: %w[rejected_transfers pagination],
+            properties: {
+              rejected_transfers: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/RejectedTransfer' }
+              },
+              pagination: { '$ref' => '#/components/schemas/Pagination' }
+            }
+          },
           Valuation: {
             type: :object,
             required: %w[id date amount currency kind account created_at updated_at],
@@ -346,6 +903,17 @@ RSpec.configure do |config|
               updated_at: { type: :string, format: :'date-time' }
             }
           },
+          ValuationCollection: {
+            type: :object,
+            required: %w[valuations pagination],
+            properties: {
+              valuations: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/Valuation' }
+              },
+              pagination: { '$ref' => '#/components/schemas/Pagination' }
+            }
+          },
           DeleteResponse: {
             type: :object,
             required: %w[message],
@@ -370,38 +938,208 @@ RSpec.configure do |config|
           },
           ImportStats: {
             type: :object,
+            required: %w[rows_count valid_rows_count invalid_rows_count mappings_count unassigned_mappings_count],
             properties: {
               rows_count: { type: :integer, minimum: 0 },
-              valid_rows_count: { type: :integer, minimum: 0, nullable: true }
+              valid_rows_count: { type: :integer, minimum: 0 },
+              invalid_rows_count: { type: :integer, minimum: 0 },
+              mappings_count: { type: :integer, minimum: 0 },
+              unassigned_mappings_count: { type: :integer, minimum: 0 }
             }
           },
+          ImportVerificationReadback: {
+            type: :object,
+            description: 'SureImport only. Expected NDJSON counts compared to family-scoped database readback after publish.',
+            properties: {
+              status: { type: :string, enum: %w[not_verified matched mismatch failed reverted] },
+              checked_at: { type: :string, format: :'date-time', nullable: true },
+              expected_record_counts: {
+                type: :object,
+                additionalProperties: { type: :integer }
+              },
+              before_counts: {
+                type: :object,
+                additionalProperties: { type: :integer }
+              },
+              after_counts: {
+                type: :object,
+                additionalProperties: { type: :integer }
+              },
+              actual_delta_counts: {
+                type: :object,
+                additionalProperties: { type: :integer }
+              },
+              checked_counts: {
+                type: :object,
+                additionalProperties: { type: :integer }
+              },
+              mismatches: {
+                type: :object,
+                additionalProperties: {
+                  type: :object,
+                  required: %w[expected actual],
+                  properties: {
+                    expected: { type: :integer },
+                    actual: { type: :integer }
+                  }
+                }
+              },
+              error: { type: :string, nullable: true }
+            }
+          },
+          ImportVerification: {
+            type: :object,
+            description: 'SureImport only. Captured at upload and completed after import publish.',
+            required: %w[expected_record_counts readback],
+            properties: {
+              expected_record_counts: {
+                type: :object,
+                additionalProperties: { type: :integer }
+              },
+              readback: { '$ref' => '#/components/schemas/ImportVerificationReadback' }
+            }
+          },
+          ImportPreflightContent: {
+            type: :object,
+            required: %w[filename content_type byte_size],
+            properties: {
+              filename: { type: :string },
+              content_type: { type: :string },
+              byte_size: { type: :integer, minimum: 0 }
+            }
+          },
+          ImportPreflightError: {
+            type: :object,
+            required: %w[code message],
+            properties: {
+              code: { type: :string },
+              message: { type: :string }
+            }
+          },
+          ImportPreflightStats: {
+            type: :object,
+            required: %w[rows_count],
+            properties: {
+              rows_count: {
+                type: :integer,
+                minimum: 0,
+                description: 'CSV parsed non-header rows, or nonblank Sure NDJSON lines.'
+              },
+              valid_rows_count: {
+                type: :integer,
+                minimum: 0,
+                description: 'SureImport only. Valid NDJSON records.'
+              },
+              invalid_rows_count: {
+                type: :integer,
+                minimum: 0,
+                description: 'SureImport only. Invalid NDJSON records. CSV malformed content returns a 422 instead.'
+              },
+              entity_counts: {
+                type: :object,
+                additionalProperties: { type: :integer },
+                nullable: true
+              },
+              record_type_counts: {
+                type: :object,
+                additionalProperties: { type: :integer },
+                nullable: true
+              }
+            }
+          },
+          ImportPreflight: {
+            type: :object,
+            required: %w[type valid content stats errors warnings],
+            properties: {
+              type: { type: :string, enum: %w[TransactionImport TradeImport AccountImport MintImport ActualImport CategoryImport RuleImport SureImport] },
+              valid: { type: :boolean },
+              content: { '$ref' => '#/components/schemas/ImportPreflightContent' },
+              stats: { '$ref' => '#/components/schemas/ImportPreflightStats' },
+              headers: {
+                type: :array,
+                items: { type: :string },
+                nullable: true
+              },
+              required_headers: {
+                type: :array,
+                items: { type: :string },
+                nullable: true
+              },
+              missing_required_headers: {
+                type: :array,
+                items: { type: :string },
+                nullable: true
+              },
+              errors: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/ImportPreflightError' }
+              },
+              warnings: {
+                type: :array,
+                items: { type: :string }
+              }
+            }
+          },
+          ImportPreflightResponse: {
+            type: :object,
+            required: %w[data],
+            properties: {
+              data: { '$ref' => '#/components/schemas/ImportPreflight' }
+            }
+          },
+          ImportStatusSummary: {
+            type: :object,
+            required: %w[uploaded configured terminal],
+            properties: {
+              uploaded: { type: :boolean },
+              configured: { type: :boolean },
+              terminal: { type: :boolean }
+            }
+          },
+          ImportStatusDetail: {
+            allOf: [
+              { '$ref' => '#/components/schemas/ImportStatusSummary' },
+              {
+                type: :object,
+                required: %w[cleaned publishable revertable],
+                properties: {
+                  cleaned: { type: :boolean },
+                  publishable: { type: :boolean },
+                  revertable: { type: :boolean }
+                }
+              }
+            ]
+          },
           ImportSummary: {
             type: :object,
-            required: %w[id type status created_at updated_at],
+            required: %w[id type status created_at updated_at status_detail],
             properties: {
               id: { type: :string, format: :uuid },
-              type: { type: :string, enum: %w[TransactionImport TradeImport AccountImport MintImport CategoryImport RuleImport] },
+              type: { type: :string, enum: %w[TransactionImport TradeImport AccountImport MintImport ActualImport CategoryImport RuleImport SureImport] },
               status: { type: :string, enum: %w[pending complete importing reverting revert_failed failed] },
               created_at: { type: :string, format: :'date-time' },
               updated_at: { type: :string, format: :'date-time' },
               account_id: { type: :string, format: :uuid, nullable: true },
               rows_count: { type: :integer, minimum: 0 },
-              error: { type: :string, nullable: true }
+              error: { type: :string, nullable: true },
+              status_detail: { '$ref' => '#/components/schemas/ImportStatusSummary' }
             }
           },
           ImportDetail: {
             type: :object,
-            required: %w[id type status created_at updated_at],
+            required: %w[id type status created_at updated_at status_detail configuration stats],
             properties: {
               id: { type: :string, format: :uuid },
-              type: { type: :string, enum: %w[TransactionImport TradeImport AccountImport MintImport CategoryImport RuleImport] },
+              type: { type: :string, enum: %w[TransactionImport TradeImport AccountImport MintImport ActualImport CategoryImport RuleImport SureImport] },
               status: { type: :string, enum: %w[pending complete importing reverting revert_failed failed] },
               created_at: { type: :string, format: :'date-time' },
               updated_at: { type: :string, format: :'date-time' },
               account_id: { type: :string, format: :uuid, nullable: true },
               error: { type: :string, nullable: true },
+              status_detail: { '$ref' => '#/components/schemas/ImportStatusDetail' },
               configuration: { '$ref' => '#/components/schemas/ImportConfiguration' },
-              stats: { '$ref' => '#/components/schemas/ImportStats' }
+              stats: { '$ref' => '#/components/schemas/ImportStats' },
+              verification: { '$ref' => '#/components/schemas/ImportVerification' }
             }
           },
           ImportCollection: {
@@ -433,6 +1171,235 @@ RSpec.configure do |config|
               data: { '$ref' => '#/components/schemas/ImportDetail' }
             }
           },
+          ProviderConnectionInstitution: {
+            type: :object,
+            required: %w[name],
+            properties: {
+              name: { type: :string, nullable: true },
+              domain: { type: :string, nullable: true },
+              url: { type: :string, nullable: true }
+            }
+          },
+          ProviderConnectionAccounts: {
+            type: :object,
+            required: %w[total_count linked_count unlinked_count],
+            properties: {
+              total_count: { type: :integer, minimum: 0 },
+              linked_count: { type: :integer, minimum: 0 },
+              unlinked_count: { type: :integer, minimum: 0 }
+            }
+          },
+          ProviderConnectionSyncLatest: {
+            type: :object,
+            required: %w[id status created_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              status: { type: :string },
+              created_at: { type: :string, format: :'date-time' },
+              syncing_at: { type: :string, format: :'date-time', nullable: true },
+              completed_at: { type: :string, format: :'date-time', nullable: true },
+              failed_at: { type: :string, format: :'date-time', nullable: true },
+              error: {
+                type: :object,
+                nullable: true,
+                description: "Sanitized latest sync error summary. Null when the latest sync is not failed or stale.",
+                required: %w[present],
+                properties: {
+                  present: { type: :boolean, description: "Always true when this object is present." },
+                  message: { type: :string, nullable: true, description: "Stable sanitized error category message; raw provider error text is never exposed." }
+                }
+              }
+            }
+          },
+          ProviderConnectionSync: {
+            type: :object,
+            required: %w[syncing],
+            properties: {
+              syncing: { type: :boolean },
+              status_summary: { type: :string, nullable: true },
+              last_synced_at: { type: :string, format: :'date-time', nullable: true },
+              latest: {
+                allOf: [ { '$ref' => '#/components/schemas/ProviderConnectionSyncLatest' } ],
+                nullable: true
+              }
+            }
+          },
+          ProviderConnection: {
+            type: :object,
+            required: %w[id provider provider_type name status requires_update credentials_configured scheduled_for_deletion pending_account_setup institution accounts sync created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              provider: { type: :string },
+              provider_type: { type: :string },
+              name: { type: :string },
+              status: { type: :string, nullable: true },
+              requires_update: { type: :boolean, nullable: true, description: "False when the provider item does not expose this status." },
+              credentials_configured: { type: :boolean, nullable: true, description: "False when credential readiness is unknown." },
+              scheduled_for_deletion: { type: :boolean, nullable: true, description: "False when the provider item does not expose this status." },
+              pending_account_setup: { type: :boolean, nullable: true, description: "False when account setup state is unknown." },
+              institution: { '$ref' => '#/components/schemas/ProviderConnectionInstitution' },
+              accounts: { '$ref' => '#/components/schemas/ProviderConnectionAccounts' },
+              sync: { '$ref' => '#/components/schemas/ProviderConnectionSync' },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          ProviderConnectionCollection: {
+            type: :object,
+            required: %w[data],
+            properties: {
+              data: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/ProviderConnection' }
+              }
+            }
+          },
+          ImportRowMapping: {
+            type: :object,
+            required: %w[key type value create_when_empty creatable mappable],
+            properties: {
+              key: { type: :string, nullable: true },
+              type: { type: :string },
+              value: { type: :string, nullable: true },
+              create_when_empty: { type: :boolean },
+              creatable: { type: :boolean },
+              mappable: {
+                type: :object,
+                nullable: true,
+                properties: {
+                  id: { type: :string, format: :uuid },
+                  type: { type: :string },
+                  name: { type: :string, nullable: true }
+                }
+              }
+            }
+          },
+          ImportRowDiagnostic: {
+            type: :object,
+            required: %w[id row_number valid errors fields mappings],
+            properties: {
+              id: { type: :string, format: :uuid },
+              row_number: { type: :integer, minimum: 1 },
+              valid: { type: :boolean },
+              errors: {
+                type: :array,
+                items: { type: :string }
+              },
+              fields: {
+                type: :object,
+                properties: {
+                  account: { type: :string, nullable: true },
+                  date: { type: :string, nullable: true },
+                  qty: { type: :string, nullable: true },
+                  ticker: { type: :string, nullable: true },
+                  exchange_operating_mic: { type: :string, nullable: true },
+                  price: { type: :string, nullable: true },
+                  amount: { type: :string, nullable: true },
+                  currency: { type: :string, nullable: true },
+                  name: { type: :string, nullable: true },
+                  category: { type: :string, nullable: true },
+                  tags: { type: :string, nullable: true },
+                  entity_type: { type: :string, nullable: true },
+                  notes: { type: :string, nullable: true },
+                  active: { type: :boolean, nullable: true },
+                  effective_date: { type: :string, nullable: true },
+                  conditions: { type: :string, nullable: true },
+                  actions: { type: :string, nullable: true }
+                }
+              },
+              mappings: {
+                type: :object,
+                properties: {
+                  account: { '$ref' => '#/components/schemas/ImportRowMapping' },
+                  category: { '$ref' => '#/components/schemas/ImportRowMapping' },
+                  account_type: { '$ref' => '#/components/schemas/ImportRowMapping' },
+                  tags: {
+                    type: :array,
+                    items: { '$ref' => '#/components/schemas/ImportRowMapping' }
+                  }
+                }
+              }
+            }
+          },
+          ImportRowDiagnosticCollection: {
+            type: :object,
+            required: %w[data meta],
+            properties: {
+              data: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/ImportRowDiagnostic' }
+              },
+              meta: {
+                type: :object,
+                required: %w[current_page total_pages total_count per_page],
+                properties: {
+                  current_page: { type: :integer, minimum: 1 },
+                  next_page: { type: :integer, nullable: true },
+                  prev_page: { type: :integer, nullable: true },
+                  total_pages: { type: :integer, minimum: 0 },
+                  total_count: { type: :integer, minimum: 0 },
+                  per_page: { type: :integer, minimum: 1 }
+                }
+              }
+            }
+          },
+          SyncableSummary: {
+            type: :object,
+            required: %w[type id],
+            properties: {
+              type: { type: :string },
+              id: { type: :string, format: :uuid },
+              name: { type: :string, nullable: true }
+            }
+          },
+          SyncErrorSummary: {
+            type: :object,
+            required: %w[message],
+            properties: {
+              message: { type: :string }
+            }
+          },
+          SyncResource: {
+            type: :object,
+            required: %w[id status in_progress terminal syncable children_count created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              status: { type: :string, enum: %w[pending syncing completed failed stale] },
+              in_progress: { type: :boolean },
+              terminal: { type: :boolean },
+              syncable: { '$ref' => '#/components/schemas/SyncableSummary' },
+              parent_id: { type: :string, format: :uuid, nullable: true },
+              children_count: { type: :integer, minimum: 0 },
+              window_start_date: { type: :string, format: :date, nullable: true },
+              window_end_date: { type: :string, format: :date, nullable: true },
+              pending_at: { type: :string, format: :'date-time', nullable: true },
+              syncing_at: { type: :string, format: :'date-time', nullable: true },
+              completed_at: { type: :string, format: :'date-time', nullable: true },
+              failed_at: { type: :string, format: :'date-time', nullable: true },
+              error: { nullable: true, allOf: [ { '$ref' => '#/components/schemas/SyncErrorSummary' } ] },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          SyncResponse: {
+            type: :object,
+            required: %w[data],
+            properties: {
+              data: { nullable: true, allOf: [ { '$ref' => '#/components/schemas/SyncResource' } ] }
+            }
+          },
+          SyncCollection: {
+            type: :object,
+            required: %w[data meta],
+            properties: {
+              data: {
+                type: :array,
+                maxItems: 100,
+                items: { '$ref' => '#/components/schemas/SyncResource' }
+              },
+              meta: { '$ref' => '#/components/schemas/Pagination' }
+            }
+          },
           Trade: {
             type: :object,
             required: %w[id date amount currency name qty price account created_at updated_at],
@@ -516,6 +1483,74 @@ RSpec.configure do |config|
               pagination: { '$ref' => '#/components/schemas/Pagination' }
             }
           },
+          Security: {
+            type: :object,
+            required: %w[id ticker kind offline created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              ticker: { type: :string },
+              name: { type: :string, nullable: true },
+              kind: { type: :string, enum: %w[standard cash] },
+              country_code: { type: :string, nullable: true },
+              exchange_mic: { type: :string, nullable: true },
+              exchange_acronym: { type: :string, nullable: true },
+              exchange_operating_mic: { type: :string, nullable: true },
+              exchange_name: { type: :string, nullable: true },
+              offline: { type: :boolean },
+              offline_reason: { type: :string, nullable: true },
+              website_url: { type: :string, nullable: true },
+              logo_url: { type: :string, nullable: true },
+              first_provider_price_on: { type: :string, format: :date, nullable: true },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          SecurityCollection: {
+            type: :object,
+            required: %w[securities pagination],
+            properties: {
+              securities: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/Security' }
+              },
+              pagination: { '$ref' => '#/components/schemas/Pagination' }
+            }
+          },
+          SecurityPrice: {
+            type: :object,
+            required: %w[id date price price_amount currency provisional security created_at updated_at],
+            properties: {
+              id: { type: :string, format: :uuid },
+              date: { type: :string, format: :date },
+              price: { type: :string, description: 'Formatted security price' },
+              price_amount: { type: :string, description: 'Exact decimal security price' },
+              currency: { type: :string },
+              provisional: { type: :boolean },
+              security: {
+                type: :object,
+                required: %w[id ticker],
+                properties: {
+                  id: { type: :string, format: :uuid },
+                  ticker: { type: :string },
+                  name: { type: :string, nullable: true },
+                  exchange_operating_mic: { type: :string, nullable: true }
+                }
+              },
+              created_at: { type: :string, format: :'date-time' },
+              updated_at: { type: :string, format: :'date-time' }
+            }
+          },
+          SecurityPriceCollection: {
+            type: :object,
+            required: %w[security_prices pagination],
+            properties: {
+              security_prices: {
+                type: :array,
+                items: { '$ref' => '#/components/schemas/SecurityPrice' }
+              },
+              pagination: { '$ref' => '#/components/schemas/Pagination' }
+            }
+          },
           Money: {
             type: :object,
             required: %w[amount currency formatted],
@@ -541,6 +1576,49 @@ RSpec.configure do |config|
             properties: {
               message: { type: :string }
             }
+          },
+          ResetInitiatedResponse: {
+            type: :object,
+            required: %w[message status job_id family_id status_url],
+            properties: {
+              message: { type: :string },
+              status: { type: :string, enum: %w[queued] },
+              job_id: {
+                type: :string,
+                description: 'Informational Active Job identifier returned by the queue adapter; reset status is family-scoped, not job-scoped.'
+              },
+              family_id: { type: :string, format: :uuid, description: 'UUID of the family being reset.' },
+              status_url: { type: :string }
+            }
+          },
+          ResetStatusResponse: {
+            type: :object,
+            required: %w[status family_id reset_complete counts],
+            properties: {
+              status: {
+                type: :string,
+                enum: %w[complete data_remaining],
+                description: 'Counts-based family reset status at response time.'
+              },
+              family_id: { type: :string, format: :uuid, description: 'UUID of the family whose reset target counts were checked.' },
+              reset_complete: {
+                type: :boolean,
+                description: 'True when all reset target counts are zero at response time. This is a family data snapshot, not a durable per-job completion record.'
+              },
+              counts: {
+                type: :object,
+                required: %w[accounts categories tags merchants plaid_items imports budgets],
+                properties: {
+                  accounts: { type: :integer, minimum: 0 },
+                  categories: { type: :integer, minimum: 0 },
+                  tags: { type: :integer, minimum: 0 },
+                  merchants: { type: :integer, minimum: 0 },
+                  plaid_items: { type: :integer, minimum: 0 },
+                  imports: { type: :integer, minimum: 0 },
+                  budgets: { type: :integer, minimum: 0 }
+                }
+              }
+            }
           }
         }
       }
diff --git a/test/application_system_test_case.rb b/test/application_system_test_case.rb
index 69724cda0..57f01828c 100644
--- a/test/application_system_test_case.rb
+++ b/test/application_system_test_case.rb
@@ -2,6 +2,9 @@ require "test_helper"
 require "socket"
 
 class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
+  DEFAULT_VIEWPORT_WIDTH = 1400
+  DEFAULT_VIEWPORT_HEIGHT = 1400
+
   setup do
     Capybara.default_max_wait_time = 5
 
@@ -14,6 +17,8 @@ class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
       Capybara.always_include_port = true
       Capybara.app_host = "http://#{app_host}:#{server_port}"
     end
+
+    reset_viewport
   end
 
   if ENV["SELENIUM_REMOTE_URL"].present?
@@ -31,11 +36,53 @@ class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
 
     driven_by :selenium_remote_chrome, screen_size: [ 1400, 1400 ]
   else
-    driven_by :selenium, using: ENV["CI"].present? ? :headless_chrome : ENV.fetch("E2E_BROWSER", :chrome).to_sym, screen_size: [ 1400, 1400 ]
+    requested_browser = ENV["E2E_BROWSER"].presence&.to_sym
+    local_browser = case requested_browser
+    when :headless_chrome then :chrome
+    when :headless_firefox then :firefox
+    else requested_browser || :chrome
+    end
+
+    headless = ENV["CI"].present? || requested_browser.in?([ :headless_chrome, :headless_firefox ]) || ENV["DISPLAY"].blank?
+
+    Capybara.register_driver :selenium_local_chrome do |app|
+      options = case local_browser
+      when :firefox
+        Selenium::WebDriver::Firefox::Options.new.tap do |firefox_options|
+          firefox_options.add_argument("--width=1400")
+          firefox_options.add_argument("--height=1400")
+          firefox_options.add_argument("-headless") if headless
+        end
+      else
+        Selenium::WebDriver::Chrome::Options.new.tap do |chrome_options|
+          chrome_options.add_argument("--window-size=1400,1400")
+          chrome_options.add_argument("--headless=new") if headless
+          chrome_options.add_argument("--no-sandbox")
+          chrome_options.add_argument("--disable-dev-shm-usage")
+        end
+      end
+
+      Capybara::Selenium::Driver.new(
+        app,
+        browser: local_browser,
+        options: options
+      )
+    end
+
+    driven_by :selenium_local_chrome, screen_size: [ 1400, 1400 ]
+  end
+
+  def teardown
+    reset_viewport
+    super
   end
 
   private
 
+    def reset_viewport
+      page.current_window.resize_to(DEFAULT_VIEWPORT_WIDTH, DEFAULT_VIEWPORT_HEIGHT) if page&.current_window
+    end
+
     def sign_in(user)
       visit new_session_path
       within %(form[action='#{sessions_path}']) do
@@ -65,4 +112,18 @@ class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
         yield
       end
     end
+
+    # Interact with DS::Select custom dropdown components.
+    # DS::Select renders as a button + listbox — not a native <select> — so
+    # Capybara's built-in `select(value, from:)` does not work with it.
+    def select_ds(label_text, record)
+      field_label = find("label", exact_text: label_text)
+      container = field_label.ancestor("div.relative")
+      container.find("button").click
+      if container.has_selector?("input[type='search']", visible: true)
+        container.find("input[type='search']", visible: true).set(record.name)
+      end
+      listbox = container.find("[role='listbox']", visible: true)
+      listbox.find("[role='option'][data-value='#{record.id}']", visible: true).click
+    end
 end
diff --git a/test/components/DS/pill_test.rb b/test/components/DS/pill_test.rb
new file mode 100644
index 000000000..aab1cc9ad
--- /dev/null
+++ b/test/components/DS/pill_test.rb
@@ -0,0 +1,65 @@
+require "test_helper"
+
+class DS::PillTest < ViewComponent::TestCase
+  test "marker mode (default) renders uppercase sub-12px chrome with rounded-md" do
+    render_inline(DS::Pill.new(label: "Beta", tone: :violet))
+
+    pill = page.find("span", text: "Beta")
+    assert_includes pill[:class], "uppercase"
+    # Marker keeps sub-12px text via arbitrary value (intentional — see component docs).
+    assert_match(/text-\[1[01]px\]/, pill[:class])
+    # Marker uses rounded-md (chip shape).
+    assert_includes pill[:class], "rounded-md"
+    refute_includes pill[:class], "rounded-full"
+  end
+
+  test "marker: false renders normal-case DS-scale chrome with rounded-full" do
+    render_inline(DS::Pill.new(label: "Active", tone: :success, marker: false))
+
+    pill = page.find("span", text: "Active")
+    refute_includes pill[:class], "uppercase"
+    # Badge mode snaps to text-xs / text-sm — no sub-12px arbitrary values.
+    assert_match(/text-(xs|sm)/, pill[:class])
+    refute_match(/text-\[1[01]px\]/, pill[:class])
+    # Badge uses rounded-full to match the existing _status_pill / _maturity_badge convention.
+    assert_includes pill[:class], "rounded-full"
+    refute_includes pill[:class], "rounded-md"
+  end
+
+  test "semantic tone aliases resolve to visual palette tones" do
+    {
+      success:     :green,
+      warning:     :amber,
+      error:       :red,
+      destructive: :red,
+      info:        :indigo,
+      neutral:     :gray
+    }.each do |alias_name, expected_visual|
+      pill = DS::Pill.new(label: "x", tone: alias_name)
+      assert_equal expected_visual, pill.tone, "Expected #{alias_name} → #{expected_visual}, got #{pill.tone}"
+    end
+  end
+
+  test "unknown tone falls back to violet" do
+    pill = DS::Pill.new(label: "x", tone: :nonexistent)
+    assert_equal :violet, pill.tone
+  end
+
+  test "red tone palette resolves to red-* tokens" do
+    pill = DS::Pill.new(label: "Failed", tone: :error)
+    assert_includes pill.palette[:dot], "color-red-500"
+    assert_includes pill.palette[:bg], "color-red-50"
+  end
+
+  test "icon option renders glyph in place of dot" do
+    render_inline(DS::Pill.new(label: "Syncing", tone: :info, marker: false, icon: "loader"))
+
+    # Lucide icon helper renders the inline SVG; verifying we see at least one <svg>
+    # is enough — the icon helper is covered by its own tests.
+    assert_selector "svg"
+    # And the dot is suppressed when an icon takes its place. The dot is an
+    # `inline-block` span (parent pill is `inline-flex`), so target it by
+    # `inline-block.rounded-full` to avoid matching the parent pill.
+    assert_no_selector "span.inline-block.rounded-full"
+  end
+end
diff --git a/test/components/previews/alert_component_preview.rb b/test/components/previews/alert_component_preview.rb
index ddd91183c..3ae3d36e4 100644
--- a/test/components/previews/alert_component_preview.rb
+++ b/test/components/previews/alert_component_preview.rb
@@ -1,7 +1,34 @@
 class AlertComponentPreview < Lookbook::Preview
   # @param message text
+  # @param title text
   # @param variant select [info, success, warning, error]
-  def default(message: "This is an alert message.", variant: :info)
-    render DS::Alert.new(message: message, variant: variant.to_sym)
+  def default(message: "This is an alert message.", title: nil, variant: :info)
+    render DS::Alert.new(message: message, title: title.presence, variant: variant.to_sym)
+  end
+
+  # @param variant select [info, success, warning, error]
+  def with_title(variant: :warning)
+    render DS::Alert.new(
+      message: "Heads up — this account hasn't synced in 7 days.",
+      title: "Stale connection",
+      variant: variant.to_sym
+    )
+  end
+
+  # @param variant select [info, success, warning, error]
+  def with_body_slot(variant: :error)
+    render DS::Alert.new(title: "We couldn't process this request", variant: variant.to_sym) do
+      tag.div do
+        safe_join([
+          tag.p("Verify the values you submitted and try again. If the issue persists, contact support.", class: "text-secondary"),
+          tag.ul(class: "list-disc list-inside text-secondary") do
+            safe_join([
+              tag.li("Check that all required fields are populated."),
+              tag.li("Confirm the dates fall within an open period.")
+            ])
+          end
+        ])
+      end
+    end
   end
 end
diff --git a/test/components/previews/design_tokens_preview.rb b/test/components/previews/design_tokens_preview.rb
new file mode 100644
index 000000000..688cc6ffd
--- /dev/null
+++ b/test/components/previews/design_tokens_preview.rb
@@ -0,0 +1,219 @@
+class DesignTokensPreview < ViewComponent::Preview
+  # Each section is its own preview so the Lookbook nav groups them.
+  # Source of truth: design/tokens/sure.tokens.json.
+  #
+  # All values are pre-resolved in this class (refs and {ref|N%} expanded to
+  # final hex / rgba strings) so templates iterate over plain data with no
+  # Tailwind-runtime dependency.
+
+  TAILWIND_TEXT_SIZES = [
+    [ "text-xs",   "12px / 16px" ],
+    [ "text-sm",   "14px / 20px" ],
+    [ "text-base", "16px / 24px" ],
+    [ "text-lg",   "18px / 28px" ],
+    [ "text-xl",   "20px / 28px" ],
+    [ "text-2xl",  "24px / 32px" ],
+    [ "text-3xl",  "30px / 36px" ],
+    [ "text-4xl",  "36px / 40px" ],
+    [ "text-5xl",  "48px" ]
+  ].freeze
+
+  TAILWIND_FONT_WEIGHTS = [
+    [ "font-light",     300 ],
+    [ "font-normal",    400 ],
+    [ "font-medium",    500 ],
+    [ "font-semibold",  600 ],
+    [ "font-bold",      700 ]
+  ].freeze
+
+  def typography
+    render_with_template(locals: {
+      fonts: collect_fonts,
+      text_sizes: TAILWIND_TEXT_SIZES,
+      font_weights: TAILWIND_FONT_WEIGHTS
+    })
+  end
+
+  def palette
+    render_with_template(locals: {
+      base_colors: collect_named_colors(%w[white black]),
+      semantic_colors: collect_named_colors(%w[success warning destructive shadow]),
+      budget_colors: collect_budget,
+      scales: collect_scales
+    })
+  end
+
+  def surfaces
+    render_with_template(locals: { utilities: collect_utilities { |name| name.start_with?("bg-") } })
+  end
+
+  def text
+    render_with_template(locals: { utilities: collect_utilities { |name| name.start_with?("text-") } })
+  end
+
+  def borders
+    render_with_template(locals: { utilities: collect_utilities { |name| name.start_with?("border-") || name.start_with?("shadow-border-") } })
+  end
+
+  def controls
+    render_with_template(locals: { utilities: collect_utilities { |name| name.start_with?("button-bg-") || name.start_with?("tab-") || name == "bg-nav-indicator" } })
+  end
+
+  def effects
+    render_with_template(locals: {
+      shadows: collect_shadows,
+      radii: collect_radii
+    })
+  end
+
+  private
+
+    # ─── Data builders ──────────────────────────────────────────────────────
+
+    def collect_fonts
+      walked.select { |path, _| path.first == "font" }.map do |path, node|
+        { var: var_name(path), name: path.last, value: node["$value"] }
+      end
+    end
+
+    def collect_named_colors(names)
+      walked.filter_map do |path, node|
+        next unless path.first == "color" && path.length == 2 && names.include?(path[1])
+        build_color_entry(path, node)
+      end
+    end
+
+    def collect_budget
+      walked.filter_map do |path, node|
+        next unless path.first == "budget"
+        build_color_entry(path, node)
+      end
+    end
+
+    def collect_scales
+      scales = {}
+      walked.each do |path, node|
+        next unless path.first == "color" && path.length > 2
+        scales[path[1]] ||= []
+        scales[path[1]] << build_color_entry(path, node)
+      end
+      scales
+    end
+
+    def collect_utilities
+      walked.filter_map do |path, node|
+        next unless path.first == "utility"
+        name = path[1]
+        next unless yield(name)
+        ext = node["$extensions"] || {}
+        light_raw = node["$value"]
+        dark_raw = ext["sure.dark"]
+        {
+          name: path[1..].join("-"),
+          light_value: light_raw,
+          dark_value: dark_raw,
+          light_resolved: light_raw.is_a?(String) ? resolve_template(light_raw) : nil,
+          dark_resolved:  dark_raw.is_a?(String) ? resolve_template(dark_raw) : nil,
+          compose: ext["sure.compose"]
+        }
+      end
+    end
+
+    def collect_shadows
+      walked.filter_map do |path, node|
+        next unless path.first == "shadow"
+        {
+          var: var_name(path),
+          name: path.last,
+          light_resolved: resolve_value(node),
+          light_raw: node["$value"],
+          dark_raw: node.dig("$extensions", "sure.dark")
+        }
+      end
+    end
+
+    def collect_radii
+      walked.filter_map do |path, node|
+        next unless path.first == "border" && path.length == 3
+        { var: var_name(path), name: path.last, value: resolve_value(node) || node["$value"] }
+      end
+    end
+
+    def build_color_entry(path, node)
+      {
+        var: var_name(path),
+        name: path.last,
+        light_resolved: resolve_value(node) || node["$value"],
+        light_raw: node["$value"],
+        dark_resolved: resolve_dark(node),
+        dark_raw: node.dig("$extensions", "sure.dark")
+      }
+    end
+
+    # ─── Token walker ───────────────────────────────────────────────────────
+
+    def tokens
+      @tokens ||= JSON.parse(Rails.root.join("design/tokens/sure.tokens.json").read)
+    end
+
+    def walked
+      @walked ||= begin
+        result = []
+        walker = lambda do |node, path|
+          return unless node.is_a?(Hash)
+          if node.key?("$value") || node["$type"] == "utility"
+            result << [ path, node ]
+            return unless node["$value"].is_a?(Hash)
+          end
+          node.each do |k, v|
+            next if k.start_with?("$")
+            walker.call(v, path + [ k ])
+          end
+        end
+        walker.call(tokens, [])
+        result
+      end
+    end
+
+    # ─── Reference resolution ───────────────────────────────────────────────
+
+    def var_name(path)
+      cleaned = path.last == "DEFAULT" ? path[0..-2] : path
+      "--#{cleaned.join('-')}"
+    end
+
+    def resolve_value(node)
+      return nil unless node.is_a?(Hash)
+      v = node["$value"]
+      return nil unless v.is_a?(String)
+      resolve_template(v)
+    end
+
+    def resolve_dark(node)
+      raw = node.dig("$extensions", "sure.dark")
+      raw ? resolve_template(raw) : nil
+    end
+
+    def resolve_template(str)
+      str.gsub(/\{([^|}]+)(?:\|([^}]+))?\}/) do
+        ref_path = Regexp.last_match(1).split(".")
+        alpha = Regexp.last_match(2)
+        target = lookup(ref_path)
+        resolved = target ? (resolve_value(target) || target["$value"]) : Regexp.last_match(0)
+        alpha ? hex_to_rgba(resolved, alpha) : resolved
+      end
+    end
+
+    def lookup(path)
+      path.inject(tokens) { |h, k| h.is_a?(Hash) ? h[k] : nil }
+    end
+
+    def hex_to_rgba(hex, percent_str)
+      return hex unless hex.is_a?(String) && hex.start_with?("#")
+      h = hex.delete_prefix("#")
+      h = h.chars.map { |c| c * 2 }.join if h.length == 3
+      r, g, b = h[0, 2].to_i(16), h[2, 2].to_i(16), h[4, 2].to_i(16)
+      pct = percent_str.to_s.delete("%").to_f / 100.0
+      "rgba(#{r}, #{g}, #{b}, #{pct.round(3)})"
+    end
+end
diff --git a/test/components/previews/design_tokens_preview/borders.html.erb b/test/components/previews/design_tokens_preview/borders.html.erb
new file mode 100644
index 000000000..23514cc99
--- /dev/null
+++ b/test/components/previews/design_tokens_preview/borders.html.erb
@@ -0,0 +1,25 @@
+<%
+  card    = "rounded-lg border border-secondary bg-container p-3 space-y-1.5"
+  label   = "text-xs font-medium text-primary"
+  meta    = "text-xs text-secondary font-mono"
+%>
+<div class="bg-surface min-h-screen p-6 space-y-6">
+  <header>
+    <h2 class="text-2xl font-semibold text-primary">Borders</h2>
+    <p class="text-sm text-secondary"><code class="font-mono">border-*</code> and <code class="font-mono">shadow-border-*</code> utilities. Boxes show the rendered effect.</p>
+  </header>
+
+  <div class="grid gap-3 grid-cols-2 sm:grid-cols-3 lg:grid-cols-4">
+    <% utilities.each do |u| %>
+      <% is_shadow_border = u[:name].start_with?("shadow-border-") %>
+      <div class="<%= card %>">
+        <div class="h-12 w-full rounded-md bg-container <%= is_shadow_border ? u[:name] : "border-2 #{u[:name]}" %>"></div>
+        <p class="<%= label %>"><%= u[:name] %></p>
+        <p class="<%= meta %> truncate"><%= u[:light_resolved] || u[:light_value] %></p>
+        <% if u[:dark_value] %>
+          <p class="<%= meta %> truncate text-subdued">dark: <%= u[:dark_resolved] || u[:dark_value] %></p>
+        <% end %>
+      </div>
+    <% end %>
+  </div>
+</div>
diff --git a/test/components/previews/design_tokens_preview/controls.html.erb b/test/components/previews/design_tokens_preview/controls.html.erb
new file mode 100644
index 000000000..39d34b293
--- /dev/null
+++ b/test/components/previews/design_tokens_preview/controls.html.erb
@@ -0,0 +1,25 @@
+<%
+  card    = "rounded-lg border border-secondary bg-container p-3 space-y-1.5"
+  label   = "text-xs font-medium text-primary"
+  meta    = "text-xs text-secondary font-mono"
+  swatch  = "h-12 w-full rounded-md border border-secondary"
+%>
+<div class="bg-surface min-h-screen p-6 space-y-6">
+  <header>
+    <h2 class="text-2xl font-semibold text-primary">Controls</h2>
+    <p class="text-sm text-secondary"><code class="font-mono">button-bg-*</code>, <code class="font-mono">tab-*</code>, and the nav indicator.</p>
+  </header>
+
+  <div class="grid gap-3 grid-cols-2 sm:grid-cols-3 lg:grid-cols-4">
+    <% utilities.each do |u| %>
+      <div class="<%= card %>">
+        <div class="<%= swatch %> <%= u[:name] %>"></div>
+        <p class="<%= label %>"><%= u[:name] %></p>
+        <p class="<%= meta %> truncate"><%= u[:light_resolved] || u[:light_value] %></p>
+        <% if u[:dark_value] %>
+          <p class="<%= meta %> truncate text-subdued">dark: <%= u[:dark_resolved] || u[:dark_value] %></p>
+        <% end %>
+      </div>
+    <% end %>
+  </div>
+</div>
diff --git a/test/components/previews/design_tokens_preview/effects.html.erb b/test/components/previews/design_tokens_preview/effects.html.erb
new file mode 100644
index 000000000..3ea59955e
--- /dev/null
+++ b/test/components/previews/design_tokens_preview/effects.html.erb
@@ -0,0 +1,42 @@
+<%
+  card    = "rounded-lg border border-secondary bg-container p-3 space-y-1.5"
+  label   = "text-xs font-medium text-primary"
+  meta    = "text-xs text-secondary font-mono"
+%>
+<div class="bg-surface min-h-screen p-6 space-y-10">
+  <header>
+    <h2 class="text-2xl font-semibold text-primary">Effects</h2>
+    <p class="text-sm text-secondary">Shadow and border-radius tokens.</p>
+  </header>
+
+  <section class="space-y-3">
+    <h3 class="text-lg font-medium text-primary">Shadows</h3>
+    <div class="grid gap-3 grid-cols-2 sm:grid-cols-3 lg:grid-cols-5">
+      <% shadows.each do |s| %>
+        <div class="<%= card %>">
+          <div class="h-16 w-full rounded-md bg-container" style="box-shadow: var(<%= s[:var] %>)"></div>
+          <p class="<%= label %>"><%= s[:var] %></p>
+          <p class="<%= meta %> truncate"><%= s[:light_raw] %></p>
+          <% if s[:dark_raw] %>
+            <p class="<%= meta %> truncate text-subdued">dark: <%= s[:dark_raw] %></p>
+          <% end %>
+        </div>
+      <% end %>
+    </div>
+  </section>
+
+  <section class="space-y-3">
+    <h3 class="text-lg font-medium text-primary">Border radius</h3>
+    <div class="grid gap-3 grid-cols-2 sm:grid-cols-4">
+      <% radii.each do |r| %>
+        <div class="<%= card %>">
+          <div class="flex items-center justify-center bg-surface rounded p-4">
+            <div class="size-12 bg-inverse" style="border-radius: <%= r[:value] %>"></div>
+          </div>
+          <p class="<%= label %>"><%= r[:var] %></p>
+          <p class="<%= meta %>"><%= r[:value] %></p>
+        </div>
+      <% end %>
+    </div>
+  </section>
+</div>
diff --git a/test/components/previews/design_tokens_preview/palette.html.erb b/test/components/previews/design_tokens_preview/palette.html.erb
new file mode 100644
index 000000000..1f9455f97
--- /dev/null
+++ b/test/components/previews/design_tokens_preview/palette.html.erb
@@ -0,0 +1,50 @@
+<%
+  card    = "rounded-lg border border-secondary bg-container p-3 space-y-1.5"
+  label   = "text-xs font-medium text-primary"
+  meta    = "text-xs text-secondary font-mono"
+  swatch  = "h-12 w-full rounded-md border border-secondary"
+%>
+<div class="bg-surface min-h-screen p-6 space-y-10">
+  <header>
+    <h2 class="text-2xl font-semibold text-primary">Palette</h2>
+    <p class="text-sm text-secondary">Base colors, semantic aliases, and the full scale ladders. Aliases that have a dark variant show both values.</p>
+  </header>
+
+  <section class="space-y-3">
+    <h3 class="text-lg font-medium text-primary">Base &amp; semantic colors</h3>
+    <div class="grid gap-3 grid-cols-2 sm:grid-cols-3 lg:grid-cols-4">
+      <% (base_colors + semantic_colors + budget_colors).each do |entry| %>
+        <div class="<%= card %>">
+          <div class="<%= swatch %>" style="background-color: <%= entry[:light_resolved] %>"></div>
+          <div class="flex items-center justify-between gap-1">
+            <span class="<%= label %>"><%= entry[:var] %></span>
+            <% if entry[:dark_resolved] %>
+              <span class="text-[10px] uppercase tracking-wide text-secondary">light/dark</span>
+            <% end %>
+          </div>
+          <p class="<%= meta %> truncate"><%= entry[:light_resolved] %></p>
+          <% if entry[:dark_resolved] %>
+            <p class="<%= meta %> truncate text-subdued">dark: <%= entry[:dark_resolved] %></p>
+          <% end %>
+        </div>
+      <% end %>
+    </div>
+  </section>
+
+  <section class="space-y-4">
+    <h3 class="text-lg font-medium text-primary">Color scales</h3>
+    <% scales.each do |scale, entries| %>
+      <div class="space-y-2">
+        <h4 class="text-sm font-medium text-primary"><%= scale %></h4>
+        <div class="grid grid-cols-6 sm:grid-cols-9 lg:grid-cols-13 gap-1">
+          <% entries.each do |entry| %>
+            <div class="space-y-1">
+              <div class="h-10 rounded border border-subdued" style="background-color: <%= entry[:light_resolved] %>" title="<%= entry[:var] %>: <%= entry[:light_resolved] %>"></div>
+              <p class="text-[10px] text-secondary text-center"><%= entry[:name] %></p>
+            </div>
+          <% end %>
+        </div>
+      </div>
+    <% end %>
+  </section>
+</div>
diff --git a/test/components/previews/design_tokens_preview/surfaces.html.erb b/test/components/previews/design_tokens_preview/surfaces.html.erb
new file mode 100644
index 000000000..725ac18d1
--- /dev/null
+++ b/test/components/previews/design_tokens_preview/surfaces.html.erb
@@ -0,0 +1,29 @@
+<%
+  card    = "rounded-lg border border-secondary bg-container p-3 space-y-1.5"
+  label   = "text-xs font-medium text-primary"
+  meta    = "text-xs text-secondary font-mono"
+  swatch  = "h-12 w-full rounded-md border border-secondary"
+%>
+<div class="bg-surface min-h-screen p-6 space-y-6">
+  <header>
+    <h2 class="text-2xl font-semibold text-primary">Surfaces &amp; backgrounds</h2>
+    <p class="text-sm text-secondary"><code class="font-mono">bg-*</code> utilities. Light/dark values shown when defined.</p>
+  </header>
+
+  <div class="grid gap-3 grid-cols-2 sm:grid-cols-3 lg:grid-cols-4">
+    <% utilities.each do |u| %>
+      <div class="<%= card %>">
+        <div class="<%= swatch %> <%= u[:name] %>"></div>
+        <p class="<%= label %>"><%= u[:name] %></p>
+        <% if u[:compose] %>
+          <p class="<%= meta %> truncate">@apply <%= u[:compose].join(" ") %></p>
+        <% else %>
+          <p class="<%= meta %> truncate"><%= u[:light_resolved] || u[:light_value] %></p>
+          <% if u[:dark_value] %>
+            <p class="<%= meta %> truncate text-subdued">dark: <%= u[:dark_resolved] || u[:dark_value] %></p>
+          <% end %>
+        <% end %>
+      </div>
+    <% end %>
+  </div>
+</div>
diff --git a/test/components/previews/design_tokens_preview/text.html.erb b/test/components/previews/design_tokens_preview/text.html.erb
new file mode 100644
index 000000000..8425e280e
--- /dev/null
+++ b/test/components/previews/design_tokens_preview/text.html.erb
@@ -0,0 +1,36 @@
+<%
+  card        = "rounded-lg border border-secondary bg-container p-3 space-y-2"
+  meta        = "text-xs text-secondary font-mono"
+  light_ctx   = "rounded p-3 bg-surface"
+  dark_ctx    = "rounded p-3 bg-gray-900"
+%>
+<div class="bg-surface min-h-screen p-6 space-y-6">
+  <header>
+    <h2 class="text-2xl font-semibold text-primary">Text &amp; foregrounds</h2>
+    <p class="text-sm text-secondary">
+      <code class="font-mono">text-*</code> utilities. Each example renders the literal class on a light <em>and</em> a dark surface so utilities meant for inverse contexts show their intended state.
+    </p>
+  </header>
+
+  <div class="grid gap-3 grid-cols-1 lg:grid-cols-2">
+    <% utilities.each do |u| %>
+      <div class="<%= card %>">
+        <div class="grid grid-cols-2 gap-2">
+          <div class="<%= light_ctx %>">
+            <p class="text-sm font-medium <%= u[:name] %>">Quick brown fox</p>
+          </div>
+          <div class="<%= dark_ctx %>">
+            <p class="text-sm font-medium <%= u[:name] %>">Quick brown fox</p>
+          </div>
+        </div>
+        <div class="space-y-0.5">
+          <p class="text-xs font-medium text-primary"><%= u[:name] %></p>
+          <p class="<%= meta %> truncate"><%= u[:light_resolved] || u[:light_value] %></p>
+          <% if u[:dark_value] %>
+            <p class="<%= meta %> truncate text-subdued">dark: <%= u[:dark_resolved] || u[:dark_value] %></p>
+          <% end %>
+        </div>
+      </div>
+    <% end %>
+  </div>
+</div>
diff --git a/test/components/previews/design_tokens_preview/typography.html.erb b/test/components/previews/design_tokens_preview/typography.html.erb
new file mode 100644
index 000000000..5297aa668
--- /dev/null
+++ b/test/components/previews/design_tokens_preview/typography.html.erb
@@ -0,0 +1,60 @@
+<%
+  card  = "rounded-lg border border-secondary bg-container p-3 space-y-1.5"
+  label = "text-xs font-medium text-primary"
+  meta  = "text-xs text-secondary font-mono"
+%>
+<div class="bg-surface min-h-screen p-6 space-y-10">
+  <header>
+    <h2 class="text-2xl font-semibold text-primary">Typography</h2>
+    <p class="text-sm text-secondary">Font family tokens defined in <code class="font-mono">design/tokens/sure.tokens.json</code>. Sizes, weights, and line heights are not yet curated as Sure tokens — the codebase uses Tailwind defaults, listed below for reference.</p>
+  </header>
+
+  <section class="space-y-3">
+    <h3 class="text-lg font-medium text-primary">Font families <span class="text-xs text-secondary font-normal">(Sure tokens)</span></h3>
+    <div class="grid gap-3 grid-cols-1 lg:grid-cols-2">
+      <% fonts.each do |entry| %>
+        <div class="<%= card %>">
+          <div class="flex items-baseline justify-between">
+            <span class="<%= label %>"><%= entry[:var] %></span>
+            <span class="<%= meta %>"><%= entry[:name] %></span>
+          </div>
+          <p class="text-2xl text-primary" style="font-family: var(<%= entry[:var] %>)">
+            The quick brown fox jumps over the lazy dog. 0123456789
+          </p>
+          <p class="<%= meta %> truncate"><%= entry[:value] %></p>
+        </div>
+      <% end %>
+    </div>
+  </section>
+
+  <section class="space-y-3">
+    <header class="space-y-1">
+      <h3 class="text-lg font-medium text-primary">Size scale <span class="text-xs text-secondary font-normal">(Tailwind defaults — not Sure tokens)</span></h3>
+      <p class="text-sm text-secondary">Used heavily across the codebase. Listed here as reference until a Sure-specific hierarchy is curated.</p>
+    </header>
+    <div class="<%= card %>">
+      <% text_sizes.each do |class_name, value| %>
+        <div class="flex items-baseline gap-4 py-1.5 border-b border-subdued last:border-0">
+          <code class="<%= meta %> w-20 shrink-0"><%= class_name %></code>
+          <span class="<%= meta %> w-24 shrink-0 text-subdued"><%= value %></span>
+          <span class="<%= class_name %> text-primary truncate">The quick brown fox</span>
+        </div>
+      <% end %>
+    </div>
+  </section>
+
+  <section class="space-y-3">
+    <header class="space-y-1">
+      <h3 class="text-lg font-medium text-primary">Weight scale <span class="text-xs text-secondary font-normal">(Tailwind defaults — not Sure tokens)</span></h3>
+    </header>
+    <div class="<%= card %>">
+      <% font_weights.each do |class_name, value| %>
+        <div class="flex items-baseline gap-4 py-1.5 border-b border-subdued last:border-0">
+          <code class="<%= meta %> w-28 shrink-0"><%= class_name %></code>
+          <span class="<%= meta %> w-12 shrink-0 text-subdued"><%= value %></span>
+          <span class="text-lg <%= class_name %> text-primary">The quick brown fox</span>
+        </div>
+      <% end %>
+    </div>
+  </section>
+</div>
diff --git a/test/components/previews/menu_component_preview.rb b/test/components/previews/menu_component_preview.rb
index 592b276c1..6fffb7ca3 100644
--- a/test/components/previews/menu_component_preview.rb
+++ b/test/components/previews/menu_component_preview.rb
@@ -5,6 +5,12 @@ class MenuComponentPreview < ViewComponent::Preview
     end
   end
 
+  def icon_sm
+    render DS::Menu.new(variant: "icon_sm") do |menu|
+      menu_contents(menu)
+    end
+  end
+
   def button
     render DS::Menu.new(variant: "button") do |menu|
       menu.with_button(text: "Open menu", variant: "secondary")
@@ -12,33 +18,14 @@ class MenuComponentPreview < ViewComponent::Preview
     end
   end
 
-  def avatar
-    render DS::Menu.new(variant: "avatar") do |menu|
-      menu_contents(menu)
-    end
-  end
-
   private
     def menu_contents(menu)
-      menu.with_header do
-        content_tag(:div, class: "p-3") do
-          content_tag(:h3, "Menu header", class: "font-medium text-gray-900")
-        end
-      end
-
       menu.with_item(variant: "link", text: "Link", href: "#", icon: "plus")
       menu.with_item(variant: "button", text: "Action", href: "#", method: :post, icon: "circle")
       menu.with_item(variant: "button", text: "Action destructive", href: "#", method: :delete, icon: "circle")
 
       menu.with_item(variant: "divider")
 
-      menu.with_custom_content do
-        content_tag(:div, class: "p-4") do
-          safe_join([
-            content_tag(:h3, "Custom content header", class: "font-medium text-gray-900"),
-            content_tag(:p, "Some custom content", class: "text-sm text-gray-500")
-          ])
-        end
-      end
+      menu.with_item(variant: "link", text: "Another link", href: "#", icon: "external-link")
     end
 end
diff --git a/test/components/previews/pill_component_preview.rb b/test/components/previews/pill_component_preview.rb
new file mode 100644
index 000000000..ae036179c
--- /dev/null
+++ b/test/components/previews/pill_component_preview.rb
@@ -0,0 +1,68 @@
+class PillComponentPreview < ViewComponent::Preview
+  # @param tone select ["violet", "indigo", "fuchsia", "amber", "green", "gray", "red", "success", "warning", "error", "info", "neutral"]
+  # @param style select ["soft", "filled", "outline"]
+  # @param size select ["sm", "md"]
+  # @param label text
+  # @param show_dot toggle
+  # @param dot_only toggle
+  # @param marker toggle
+  # @param icon text
+  def default(tone: "violet", style: "soft", size: "sm", label: "Preview", show_dot: true, dot_only: false, marker: true, icon: nil)
+    render DS::Pill.new(
+      label: label,
+      tone: tone.to_sym,
+      style: style.to_sym,
+      size: size.to_sym,
+      show_dot: show_dot,
+      dot_only: dot_only,
+      marker: marker,
+      icon: icon.presence
+    )
+  end
+
+  # @!group Stage markers (marker: true — original #1829 shape)
+  def canary
+    render DS::Pill.new(label: "Canary", tone: :fuchsia)
+  end
+
+  def beta
+    render DS::Pill.new(label: "Beta", tone: :violet)
+  end
+
+  def new_marker
+    render DS::Pill.new(label: "New", tone: :indigo)
+  end
+
+  def dot_only_collapsed_sidebar
+    render DS::Pill.new(dot_only: true, tone: :violet)
+  end
+  # @!endgroup
+
+  # @!group Status badges (marker: false, semantic tones)
+  def status_active
+    render DS::Pill.new(label: "Active", tone: :success, marker: false)
+  end
+
+  def status_pending
+    render DS::Pill.new(label: "Pending", tone: :warning, marker: false)
+  end
+
+  def status_failed
+    render DS::Pill.new(label: "Failed", tone: :error, marker: false, icon: "circle-alert")
+  end
+
+  def status_archived
+    render DS::Pill.new(label: "Archived", tone: :neutral, marker: false)
+  end
+
+  def status_info
+    render DS::Pill.new(label: "Syncing", tone: :info, marker: false, icon: "loader")
+  end
+  # @!endgroup
+
+  # @!group Sizes (md)
+  def status_md
+    render DS::Pill.new(label: "Past due", tone: :error, marker: false, size: :md)
+  end
+  # @!endgroup
+end
diff --git a/test/components/previews/tooltip_component_preview.rb b/test/components/previews/tooltip_component_preview.rb
index 68bd6c320..a6345ef0b 100644
--- a/test/components/previews/tooltip_component_preview.rb
+++ b/test/components/previews/tooltip_component_preview.rb
@@ -6,7 +6,8 @@ class TooltipComponentPreview < ViewComponent::Preview
   # @param icon text
   # @param size select [xs, sm, md, lg, xl, 2xl]
   # @param color select [default, white, success, warning, destructive, current]
-  def default(text: "This is helpful information", placement: "top", offset: 10, cross_axis: 0, icon: "info", size: "sm", color: "default")
+  # @param as select [button, span]
+  def default(text: "This is helpful information", placement: "top", offset: 10, cross_axis: 0, icon: "info", size: "sm", color: "default", as: "button")
     render DS::Tooltip.new(
       text: text,
       placement: placement,
@@ -14,7 +15,8 @@ class TooltipComponentPreview < ViewComponent::Preview
       cross_axis: cross_axis,
       icon: icon,
       size: size,
-      color: color
+      color: color,
+      as: as.to_sym
     )
   end
 
diff --git a/test/controllers/account_statements_controller_test.rb b/test/controllers/account_statements_controller_test.rb
new file mode 100644
index 000000000..01739f0dc
--- /dev/null
+++ b/test/controllers/account_statements_controller_test.rb
@@ -0,0 +1,483 @@
+require "test_helper"
+
+class AccountStatementsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    ensure_tailwind_build
+    sign_in @user = users(:family_admin)
+    @account = accounts(:depository)
+  end
+
+  test "shows statement vault" do
+    get account_statements_url
+    assert_response :success
+    assert_select "h1", text: I18n.t("account_statements.index.title")
+  end
+
+  test "statement vault only lists linked statements for accessible accounts" do
+    accessible_statement = AccountStatement.create_from_upload!(
+      family: @account.family,
+      account: @account,
+      file: uploaded_file(filename: "accessible_statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    private_account = accounts(:other_asset)
+    private_statement = AccountStatement.create_from_upload!(
+      family: private_account.family,
+      account: private_account,
+      file: uploaded_file(filename: "private_statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-02,2\n")
+    )
+    sign_in users(:family_member)
+
+    get account_statements_url
+
+    assert_response :success
+    assert_includes response.body, accessible_statement.filename
+    refute_includes response.body, private_statement.filename
+    refute_includes response.body, private_account.name
+  end
+
+  test "non manager cannot open statement vault" do
+    sign_in family_guest
+
+    get account_statements_url
+
+    assert_redirected_to accounts_url
+    assert_equal I18n.t("accounts.not_authorized"), flash[:alert]
+  end
+
+  test "non manager cannot view unmatched statement" do
+    statement = AccountStatement.create_from_upload!(
+      family: @account.family,
+      account: nil,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv")
+    )
+    sign_in family_guest
+
+    get account_statement_url(statement)
+
+    assert_response :not_found
+  end
+
+  test "uploads statement to account without importing transactions" do
+    assert_difference "AccountStatement.count", 1 do
+      assert_no_difference [ "Import.count", "Entry.count", "Transaction.count" ] do
+        post account_statements_url, params: {
+          account_statement: {
+            account_id: @account.id,
+            files: [ uploaded_file(filename: "Checking_2024-01.csv", content_type: "text/csv") ]
+          }
+        }
+      end
+    end
+
+    statement = AccountStatement.order(:created_at).last
+    assert_equal @account, statement.account
+    assert statement.linked?
+    assert_redirected_to account_url(@account, tab: "statements")
+  end
+
+  test "member with writable account access can upload linked statement" do
+    sign_in users(:family_member)
+
+    assert_difference "AccountStatement.count", 1 do
+      post account_statements_url, params: {
+        account_statement: {
+          account_id: @account.id,
+          files: [ uploaded_file(filename: "member_statement.csv", content_type: "text/csv") ]
+        }
+      }
+    end
+
+    statement = AccountStatement.order(:created_at).last
+    assert_equal @account, statement.account
+    assert_redirected_to account_url(@account, tab: "statements")
+  end
+
+  test "uploads unmatched statement to inbox" do
+    assert_difference "AccountStatement.count", 1 do
+      post account_statements_url, params: {
+        account_statement: {
+          files: [ uploaded_file(filename: "Unknown_2024-01.csv", content_type: "text/csv") ]
+        }
+      }
+    end
+
+    statement = AccountStatement.order(:created_at).last
+    assert_nil statement.account
+    assert statement.unmatched?
+    assert_redirected_to account_statement_url(statement)
+  end
+
+  test "skips duplicate statement upload" do
+    AccountStatement.create_from_upload!(
+      family: @account.family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+
+    assert_no_difference "AccountStatement.count" do
+      post account_statements_url, params: {
+        account_statement: {
+          account_id: @account.id,
+          files: [ uploaded_file(filename: "duplicate.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n") ]
+        }
+      }
+    end
+
+    assert_redirected_to account_url(@account, tab: "statements")
+    assert_equal I18n.t("account_statements.create.duplicates", count: 1), flash[:alert]
+  end
+
+  test "continues upload loop after a validation error" do
+    invalid_record = AccountStatement.new
+    invalid_record.errors.add(:filename, "is invalid")
+
+    assert_difference "AccountStatement.count", 1 do
+      created_statement = AccountStatement.create_from_upload!(
+        family: @account.family,
+        account: @account,
+        file: uploaded_file(filename: "valid-result.csv", content_type: "text/csv", content: "date,amount\n2024-01-02,2\n")
+      )
+      upload_sequence = sequence("statement upload processing")
+      AccountStatement.expects(:create_from_prepared_upload!).in_sequence(upload_sequence).raises(ActiveRecord::RecordInvalid.new(invalid_record))
+      AccountStatement.expects(:create_from_prepared_upload!).in_sequence(upload_sequence).returns(created_statement)
+
+      post account_statements_url, params: {
+        account_statement: {
+          account_id: @account.id,
+          files: [
+            uploaded_file(filename: "invalid.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n"),
+            uploaded_file(filename: "valid.csv", content_type: "text/csv", content: "date,amount\n2024-01-02,2\n")
+          ]
+        }
+      }
+    end
+
+    assert_redirected_to account_url(@account, tab: "statements")
+    assert_equal I18n.t("account_statements.create.success", count: 1), flash[:notice]
+    assert_includes flash[:alert], invalid_record.errors.full_messages.to_sentence
+  end
+
+  test "rejects invalid statement file type" do
+    assert_no_difference "AccountStatement.count" do
+      post account_statements_url, params: {
+        account_statement: {
+          files: [ uploaded_file(filename: "statement.bin", content_type: "application/octet-stream", content: "\x00\x01\x02".b) ]
+        }
+      }
+    end
+
+    assert_redirected_to account_statements_url
+    assert_equal I18n.t("account_statements.create.invalid_file_type"), flash[:alert]
+  end
+
+  test "continues upload loop after an invalid file type" do
+    assert_difference "AccountStatement.count", 1 do
+      post account_statements_url, params: {
+        account_statement: {
+          files: [
+            uploaded_file(filename: "statement.bin", content_type: "application/octet-stream", content: "\x00\x01\x02".b),
+            uploaded_file(filename: "valid.csv", content_type: "text/csv", content: "date,amount\n2024-01-02,2\n")
+          ]
+        }
+      }
+    end
+
+    statement = AccountStatement.order(:created_at).last
+    assert_redirected_to account_statement_url(statement)
+    assert_equal I18n.t("account_statements.create.success", count: 1), flash[:notice]
+    assert_includes flash[:alert], I18n.t("account_statements.create.invalid_file_type")
+  end
+
+  test "rejects txt and xls statement uploads" do
+    [
+      uploaded_file(filename: "statement.txt", content_type: "text/plain"),
+      uploaded_file(filename: "statement.xls", content_type: "application/vnd.ms-excel")
+    ].each do |file|
+      assert_no_difference "AccountStatement.count" do
+        post account_statements_url, params: {
+          account_statement: {
+            files: [ file ]
+          }
+        }
+      end
+
+      assert_redirected_to account_statements_url
+      assert_equal I18n.t("account_statements.create.invalid_file_type"), flash[:alert]
+    end
+  end
+
+  test "rejects empty csv and xlsx statement uploads" do
+    [
+      uploaded_file(filename: "empty.csv", content_type: "text/csv", content: ""),
+      uploaded_file(
+        filename: "empty.xlsx",
+        content_type: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+        content: ""
+      )
+    ].each do |file|
+      assert_no_difference "AccountStatement.count" do
+        post account_statements_url, params: {
+          account_statement: {
+            files: [ file ]
+          }
+        }
+      end
+
+      assert_redirected_to account_statements_url
+      assert_equal I18n.t("account_statements.create.invalid_file_type"), flash[:alert]
+    end
+  end
+
+  test "rejects oversized statement upload" do
+    original_max_file_size = AccountStatement::MAX_FILE_SIZE
+    silence_warnings { AccountStatement.const_set(:MAX_FILE_SIZE, 16) }
+
+    begin
+      assert_no_difference "AccountStatement.count" do
+        post account_statements_url, params: {
+          account_statement: {
+            files: [
+              uploaded_file(
+                filename: "oversized.csv",
+                content_type: "text/csv",
+                content: "x" * (AccountStatement::MAX_FILE_SIZE + 1)
+              )
+            ]
+          }
+        }
+      end
+    ensure
+      silence_warnings { AccountStatement.const_set(:MAX_FILE_SIZE, original_max_file_size) }
+    end
+
+    assert_redirected_to account_statements_url
+    assert_equal I18n.t("account_statements.create.invalid_file_type"), flash[:alert]
+  end
+
+  test "rejects cross-family account id" do
+    other_account = Account.create!(
+      family: families(:empty),
+      owner: users(:empty),
+      name: "Other family account",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+
+    assert_no_difference "AccountStatement.count" do
+      post account_statements_url, params: {
+        account_statement: {
+          account_id: other_account.id,
+          files: [ uploaded_file(filename: "statement.csv", content_type: "text/csv") ]
+        }
+      }
+    end
+    assert_response :not_found
+  end
+
+  test "read only shared user cannot upload to account" do
+    sign_in users(:family_member)
+    account = accounts(:credit_card)
+
+    assert_no_difference "AccountStatement.count" do
+      post account_statements_url, params: {
+        account_statement: {
+          account_id: account.id,
+          files: [ uploaded_file(filename: "statement.csv", content_type: "text/csv") ]
+        }
+      }
+    end
+
+    assert_redirected_to account_url(account)
+    assert_equal I18n.t("accounts.not_authorized"), flash[:alert]
+  end
+
+  test "read only shared user sees statement detail without edit controls" do
+    account = accounts(:credit_card)
+    statement = AccountStatement.create_from_upload!(
+      family: @account.family,
+      account: account,
+      file: uploaded_file(filename: "readonly_statement.csv", content_type: "text/csv")
+    )
+    sign_in users(:family_member)
+
+    get account_statement_url(statement)
+
+    assert_response :success
+    assert_select "input[name='account_statement[period_start_on]']", 0
+    assert_select "select[name='account_statement[account_id]']", 0
+    assert_select "button", text: I18n.t("account_statements.show.delete"), count: 0
+    assert_select "button", text: I18n.t("account_statements.show.save"), count: 0
+    assert_select "button", text: I18n.t("account_statements.show.unlink"), count: 0
+  end
+
+  test "metadata form does not expose account select for managers" do
+    statement = AccountStatement.create_from_upload!(
+      family: @account.family,
+      account: @account,
+      file: uploaded_file(filename: "manager_statement.csv", content_type: "text/csv")
+    )
+
+    get account_statement_url(statement)
+
+    assert_response :success
+    assert_select "input[name='account_statement[period_start_on]']", 1
+    assert_select "input[name='account_statement[currency]']", 0
+    assert_select "select[name='account_statement[currency]'] option[value='USD']"
+    assert_select "select[name='account_statement[account_id]']", 0
+  end
+
+  test "links suggested statement" do
+    statement = AccountStatement.create_from_upload!(
+      family: @account.family,
+      account: nil,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    statement.update!(suggested_account: @account, match_confidence: 0.9)
+
+    patch link_account_statement_url(statement), params: { account_id: @account.id }
+
+    assert_redirected_to account_url(@account, tab: "statements")
+    statement.reload
+    assert_equal @account, statement.account
+    assert statement.linked?
+  end
+
+  test "read only shared user cannot relink linked statement to writable account" do
+    source_account = accounts(:credit_card)
+    target_account = accounts(:depository)
+    statement = AccountStatement.create_from_upload!(
+      family: source_account.family,
+      account: source_account,
+      file: uploaded_file(filename: "readonly_relink.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    sign_in users(:family_member)
+
+    patch link_account_statement_url(statement), params: { account_id: target_account.id }
+
+    assert_redirected_to account_url(source_account)
+    assert_equal I18n.t("accounts.not_authorized"), flash[:alert]
+    assert_equal source_account, statement.reload.account
+  end
+
+  test "link shows friendly error when no target account is available" do
+    statement = AccountStatement.create_from_upload!(
+      family: @account.family,
+      account: nil,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+
+    patch link_account_statement_url(statement)
+
+    assert_redirected_to account_statement_url(statement)
+    assert_equal I18n.t("account_statements.link.no_account"), flash[:alert]
+    statement.reload
+    assert_nil statement.account
+    assert statement.unmatched?
+  end
+
+  test "unlinks statement back to inbox" do
+    statement = AccountStatement.create_from_upload!(
+      family: @account.family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+
+    patch unlink_account_statement_url(statement)
+
+    assert_redirected_to account_statement_url(statement)
+    statement.reload
+    assert_nil statement.account
+    assert statement.unmatched?
+  end
+
+  test "rejects suggestion" do
+    statement = AccountStatement.create_from_upload!(
+      family: @account.family,
+      account: nil,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    statement.update!(suggested_account: @account, match_confidence: 0.9)
+
+    patch reject_account_statement_url(statement)
+
+    assert_redirected_to account_statements_url
+    statement.reload
+    assert statement.rejected?
+    assert_nil statement.suggested_account
+  end
+
+  test "updates metadata" do
+    statement = AccountStatement.create_from_upload!(
+      family: @account.family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+
+    patch account_statement_url(statement), params: {
+      account_statement: {
+        period_start_on: "2024-01-01",
+        period_end_on: "2024-01-31",
+        closing_balance: "123.45",
+        currency: "usd"
+      }
+    }
+
+    assert_redirected_to account_statement_url(statement)
+    statement.reload
+    assert_equal Date.new(2024, 1, 31), statement.period_end_on
+    assert_equal 123.45.to_d, statement.closing_balance
+    assert_equal "USD", statement.currency
+  end
+
+  test "metadata update links selected account" do
+    statement = AccountStatement.create_from_upload!(
+      family: @account.family,
+      account: nil,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+
+    patch account_statement_url(statement), params: {
+      account_statement: {
+        account_id: @account.id,
+        period_start_on: "2024-01-01",
+        period_end_on: "2024-01-31"
+      }
+    }
+
+    assert_redirected_to account_statement_url(statement)
+    statement.reload
+    assert_equal @account, statement.account
+    assert statement.linked?
+  end
+
+  test "deletes statement" do
+    statement = AccountStatement.create_from_upload!(
+      family: @account.family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+
+    assert_difference "AccountStatement.count", -1 do
+      delete account_statement_url(statement)
+    end
+
+    assert_redirected_to account_url(@account, tab: "statements")
+  end
+
+  test "destroy reports failure when statement cannot be deleted" do
+    statement = AccountStatement.create_from_upload!(
+      family: @account.family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    AccountStatement.any_instance.stubs(:destroy).returns(false)
+
+    assert_no_difference "AccountStatement.count" do
+      delete account_statement_url(statement)
+    end
+
+    assert_redirected_to account_url(@account, tab: "statements")
+    assert_equal I18n.t("account_statements.destroy.failure"), flash[:alert]
+  end
+end
diff --git a/test/controllers/accounts_controller_test.rb b/test/controllers/accounts_controller_test.rb
index 0034360e0..4b7604c3e 100644
--- a/test/controllers/accounts_controller_test.rb
+++ b/test/controllers/accounts_controller_test.rb
@@ -1,6 +1,8 @@
 require "test_helper"
 
 class AccountsControllerTest < ActionDispatch::IntegrationTest
+  include ActionView::RecordIdentifier
+
   setup do
     sign_in @user = users(:family_admin)
     @account = accounts(:depository)
@@ -9,6 +11,7 @@ class AccountsControllerTest < ActionDispatch::IntegrationTest
   test "should get index" do
     get accounts_url
     assert_response :success
+    assert_select "p.ml-auto.privacy-sensitive"
   end
 
   test "should get show" do
@@ -16,6 +19,93 @@ class AccountsControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
   end
 
+  test "show lazily loads statement tab data unless statements tab is active" do
+    AccountStatement::Coverage.expects(:for_year).never
+    AccountStatement.expects(:reconciliation_statuses_for).never
+
+    get account_url(@account)
+
+    assert_response :success
+    assert_select "select[name='statement_year']", count: 0
+    statements_path = account_path(@account, tab: "statements")
+    assert_select "turbo-frame[src='#{statements_path}']"
+  end
+
+  test "statements tab shows coverage and upload for statement managers with account write access" do
+    get account_url(@account, tab: "statements")
+
+    assert_response :success
+    assert_select "input[type=file][accept='.pdf,.csv,.xlsx']"
+    assert_select "select[name='statement_year']"
+    assert_select "p", text: I18n.l(Date.current.prev_month.beginning_of_month, format: "%b %Y")
+  end
+
+  test "statements tab lazy frame returns matching frame content" do
+    frame_id = dom_id(@account, :statements_tab)
+
+    get account_url(@account, tab: "statements"), headers: { "Turbo-Frame" => frame_id }
+
+    assert_response :success
+    assert_select "turbo-frame##{frame_id}", count: 1
+    assert_select "select[name='statement_year']"
+    assert_select "turbo-frame##{dom_id(@account, :container)}", count: 0
+  end
+
+  test "statements tab filters historical coverage by year" do
+    account = Account.create!(
+      family: @user.family,
+      owner: @user,
+      name: "Historical Checking",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+    statement = AccountStatement.create_from_upload!(
+      family: @user.family,
+      account: account,
+      file: uploaded_file(filename: "historical.csv", content_type: "text/csv")
+    )
+    statement.update!(period_start_on: Date.new(2024, 2, 1), period_end_on: Date.new(2024, 2, 29))
+
+    travel_to Date.new(2026, 5, 6) do
+      get account_url(account, tab: "statements")
+
+      assert_response :success
+      assert_select "select[name='statement_year'] option[selected='selected']", text: "2026"
+      assert_select "p", text: "May 2026"
+      assert_select "p", text: "Not expected"
+
+      get account_url(account, tab: "statements", statement_year: 2024)
+
+      assert_response :success
+      assert_select "select[name='statement_year'] option[selected='selected']", text: "2024"
+      assert_select "p", text: "Jan 2024"
+      assert_select "p", text: "Feb 2024"
+      assert_select "p", text: "Covered"
+      assert_select "p", text: "Missing"
+      assert_select "p", text: "Not expected"
+    end
+  end
+
+  test "statements tab hides upload for read only account access" do
+    sign_in users(:family_member)
+
+    get account_url(accounts(:credit_card), tab: "statements")
+
+    assert_response :success
+    assert_select "input[type=file]", count: 0
+  end
+
+  test "account activity marks trade amounts as privacy-sensitive" do
+    trade_entry = entries(:trade)
+    expected_amount = ApplicationController.helpers.format_money(-trade_entry.amount_money)
+
+    get account_url(accounts(:investment))
+
+    assert_response :success
+    assert_select "turbo-frame##{dom_id(trade_entry)} p.privacy-sensitive", text: expected_amount, count: 1
+  end
+
   test "activity pagination keeps activity tab when loaded from holdings tab" do
     investment = accounts(:investment)
 
@@ -37,6 +127,31 @@ class AccountsControllerTest < ActionDispatch::IntegrationTest
     assert_select "a[href*='page=2'][href*='tab=holdings']", count: 0
   end
 
+  test "account activity constrains long category labels before the amount on wide screens" do
+    category = categories(:food_and_drink)
+    category.update!(name: "Super Long Category Name That Should Stop Before The Amount On Wide Screens Too")
+
+    entry = @account.entries.create!(
+      name: "Wide category verification",
+      date: Date.current,
+      amount: 187.65,
+      currency: @account.currency,
+      entryable: Transaction.new(category: category)
+    )
+
+    get account_url(@account, tab: "activity")
+
+    assert_response :success
+    assert_select "##{dom_id(entry.entryable, "category_menu_desktop")}"
+    assert_select "##{dom_id(entry.entryable, "category_menu_desktop")}.min-w-0"
+    assert_select "##{dom_id(entry.entryable, "category_menu_desktop")}.overflow-hidden"
+    assert_select "##{dom_id(entry.entryable, "category_menu_desktop")} button.block"
+    assert_select "##{dom_id(entry.entryable, "category_menu_desktop")} button.w-full"
+    assert_select "##{dom_id(entry.entryable, "category_menu_desktop")} button.overflow-hidden"
+    assert_select "##{dom_id(entry.entryable, "category_menu_desktop")} [data-testid='category-name']"
+    assert_select "div.hidden.md\\:flex.min-w-0"
+  end
+
   test "should sync account" do
     post sync_account_url(@account)
     assert_redirected_to account_url(@account)
diff --git a/test/controllers/api/v1/accounts_controller_test.rb b/test/controllers/api/v1/accounts_controller_test.rb
index 9d95b4548..65e1715cd 100644
--- a/test/controllers/api/v1/accounts_controller_test.rb
+++ b/test/controllers/api/v1/accounts_controller_test.rb
@@ -8,10 +8,22 @@ class Api::V1::AccountsControllerTest < ActionDispatch::IntegrationTest
     @other_family_user = users(:family_member)
     @other_family_user.update!(family: families(:empty))
 
-    @oauth_app = Doorkeeper::Application.create!(
-      name: "Test API App",
-      redirect_uri: "https://example.com/callback",
-      scopes: "read read_write"
+    @user.api_keys.active.destroy_all
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      source: "web",
+      display_key: "test_read_#{SecureRandom.hex(8)}"
+    )
+
+    @other_family_user.api_keys.active.destroy_all
+    @other_family_api_key = ApiKey.create!(
+      user: @other_family_user,
+      name: "Other Family Read Key",
+      scopes: [ "read" ],
+      source: "web",
+      display_key: "other_family_read_#{SecureRandom.hex(8)}"
     )
   end
 
@@ -24,37 +36,28 @@ class Api::V1::AccountsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should require read_accounts scope" do
-  # TODO: Re-enable this test after fixing scope checking
-  skip "Scope checking temporarily disabled - needs configuration fix"
+    api_key_without_read = ApiKey.new(
+      user: @user,
+      name: "No Read Key",
+      scopes: [],
+      source: "web",
+      display_key: "no_read_#{SecureRandom.hex(8)}"
+    )
+    # Valid persisted API keys can only be read/read_write; this intentionally
+    # bypasses validations to exercise the runtime insufficient-scope guard.
+    api_key_without_read.save!(validate: false)
 
-  # Create token with wrong scope - using a non-existent scope to test rejection
-  access_token = Doorkeeper::AccessToken.create!(
-    application: @oauth_app,
-    resource_owner_id: @user.id,
-    scopes: "invalid_scope" # Wrong scope
-  )
+    get "/api/v1/accounts", params: {}, headers: api_headers(api_key_without_read)
 
-  get "/api/v1/accounts", params: {}, headers: {
-    "Authorization" => "Bearer #{access_token.token}"
-  }
-
-  assert_response :forbidden
-
-  # Doorkeeper returns a standard OAuth error response
-  response_body = JSON.parse(response.body)
-  assert_equal "insufficient_scope", response_body["error"]
-end
+    assert_response :forbidden
+    response_body = JSON.parse(response.body)
+    assert_equal "insufficient_scope", response_body["error"]
+  ensure
+    api_key_without_read&.destroy
+  end
 
   test "should return user's family accounts successfully" do
-    access_token = Doorkeeper::AccessToken.create!(
-      application: @oauth_app,
-      resource_owner_id: @user.id,
-      scopes: "read"
-    )
-
-    get "/api/v1/accounts", params: {}, headers: {
-      "Authorization" => "Bearer #{access_token.token}"
-    }
+    get "/api/v1/accounts", params: {}, headers: api_headers(@api_key)
 
     assert_response :success
     response_body = JSON.parse(response.body)
@@ -83,15 +86,7 @@ end
     inactive_account = accounts(:depository)
     inactive_account.disable!
 
-    access_token = Doorkeeper::AccessToken.create!(
-      application: @oauth_app,
-      resource_owner_id: @user.id,
-      scopes: "read"
-    )
-
-    get "/api/v1/accounts", params: {}, headers: {
-      "Authorization" => "Bearer #{access_token.token}"
-    }
+    get "/api/v1/accounts", params: {}, headers: api_headers(@api_key)
 
     assert_response :success
     response_body = JSON.parse(response.body)
@@ -101,17 +96,140 @@ end
     assert_not_includes account_names, inactive_account.name
   end
 
-  test "should not return other family's accounts" do
-    access_token = Doorkeeper::AccessToken.create!(
-      application: @oauth_app,
-      resource_owner_id: @other_family_user.id,  # User from different family
-      scopes: "read"
-    )
+  test "should include disabled accounts when requested" do
+    inactive_account = accounts(:depository)
+    inactive_account.disable!
 
-    get "/api/v1/accounts", params: {}, headers: {
-      "Authorization" => "Bearer #{access_token.token}"
+    get "/api/v1/accounts", params: { include_disabled: true }, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_body = JSON.parse(response.body)
+
+    account = response_body["accounts"].find { |account_data| account_data["id"] == inactive_account.id }
+    assert_not_nil account
+    assert_equal "disabled", account["status"]
+  end
+
+  test "should show active account" do
+    account = accounts(:depository)
+
+    get "/api/v1/accounts/#{account.id}", headers: api_headers(@api_key)
+
+    assert_response :success
+    response_body = JSON.parse(response.body)
+    assert_equal account.id, response_body["id"]
+    assert_equal account.status, response_body["status"]
+    assert_equal account.balance_money.format, response_body["balance"]
+    assert_equal money_cents(account.balance_money), response_body["balance_cents"]
+    assert_equal account.cash_balance_money.format, response_body["cash_balance"]
+    assert_equal money_cents(account.cash_balance_money), response_body["cash_balance_cents"]
+    assert_nullable_equal account.subtype, response_body["subtype"]
+    assert response_body.key?("institution_name")
+    assert response_body.key?("institution_domain")
+    assert_nullable_equal account.institution_name, response_body["institution_name"]
+    assert_nullable_equal account.institution_domain, response_body["institution_domain"]
+    assert_equal account.created_at.iso8601, response_body["created_at"]
+    assert_equal account.updated_at.iso8601, response_body["updated_at"]
+  end
+
+  test "should return 404 for unknown account on show" do
+    get "/api/v1/accounts/#{SecureRandom.uuid}", headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_body = JSON.parse(response.body)
+    assert_equal "not_found", response_body["error"]
+  end
+
+  test "should return 404 for malformed account id on show" do
+    get "/api/v1/accounts/not-a-uuid", headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_body = JSON.parse(response.body)
+    assert_equal "not_found", response_body["error"]
+    assert_equal "Account not found", response_body["message"]
+  end
+
+  test "should require authentication on show" do
+    account = accounts(:depository)
+
+    get "/api/v1/accounts/#{account.id}"
+
+    assert_response :unauthorized
+    response_body = JSON.parse(response.body)
+    assert_equal "unauthorized", response_body["error"]
+  end
+
+  test "should require read scope on show" do
+    account = accounts(:depository)
+    api_key_without_read = ApiKey.new(
+      user: @user,
+      name: "No Read Show Key",
+      scopes: [],
+      source: "web",
+      display_key: "no_read_show_#{SecureRandom.hex(8)}"
+    )
+    # Valid persisted API keys can only be read/read_write; this intentionally
+    # bypasses validations to exercise the runtime insufficient-scope guard.
+    api_key_without_read.save!(validate: false)
+
+    get "/api/v1/accounts/#{account.id}", headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+    response_body = JSON.parse(response.body)
+    assert_equal "insufficient_scope", response_body["error"]
+  ensure
+    api_key_without_read&.destroy
+  end
+
+  test "should hide disabled account by default on show" do
+    inactive_account = accounts(:depository)
+    inactive_account.disable!
+
+    get "/api/v1/accounts/#{inactive_account.id}", headers: api_headers(@api_key)
+
+    assert_response :not_found
+  end
+
+  test "should show disabled account when requested" do
+    inactive_account = accounts(:depository)
+    inactive_account.disable!
+
+    get "/api/v1/accounts/#{inactive_account.id}",
+        params: { include_disabled: true },
+        headers: api_headers(@api_key)
+
+    assert_response :success
+    response_body = JSON.parse(response.body)
+    assert_equal inactive_account.id, response_body["id"]
+    assert_equal "disabled", response_body["status"]
+  end
+
+  test "should expose subtype across account types" do
+    expected_subtypes = {
+      accounts(:depository) => "checking",
+      accounts(:credit_card) => "credit_card",
+      accounts(:investment) => "brokerage",
+      accounts(:loan) => "mortgage",
+      accounts(:property) => "single_family_home",
+      accounts(:vehicle) => "sedan",
+      accounts(:crypto) => "exchange",
+      accounts(:other_asset) => "collectible",
+      accounts(:other_liability) => "personal_debt"
     }
 
+    expected_subtypes.each { |account, subtype| account.accountable.update!(subtype: subtype) }
+
+    expected_subtypes.each do |account, subtype|
+      get "/api/v1/accounts/#{account.id}", headers: api_headers(@api_key)
+
+      assert_response :success
+      assert_equal subtype, JSON.parse(response.body)["subtype"]
+    end
+  end
+
+  test "should not return other family's accounts" do
+    get "/api/v1/accounts", params: {}, headers: api_headers(@other_family_api_key)
+
     assert_response :success
     response_body = JSON.parse(response.body)
 
@@ -121,16 +239,8 @@ end
   end
 
   test "should handle pagination parameters" do
-    access_token = Doorkeeper::AccessToken.create!(
-      application: @oauth_app,
-      resource_owner_id: @user.id,
-      scopes: "read"
-    )
-
     # Test with pagination params
-    get "/api/v1/accounts", params: { page: 1, per_page: 2 }, headers: {
-      "Authorization" => "Bearer #{access_token.token}"
-    }
+    get "/api/v1/accounts", params: { page: 1, per_page: 2 }, headers: api_headers(@api_key)
 
     assert_response :success
     response_body = JSON.parse(response.body)
@@ -142,15 +252,7 @@ end
   end
 
   test "should return proper account data structure" do
-    access_token = Doorkeeper::AccessToken.create!(
-      application: @oauth_app,
-      resource_owner_id: @user.id,
-      scopes: "read"
-    )
-
-    get "/api/v1/accounts", params: {}, headers: {
-      "Authorization" => "Bearer #{access_token.token}"
-    }
+    get "/api/v1/accounts", params: {}, headers: api_headers(@api_key)
 
     assert_response :success
     response_body = JSON.parse(response.body)
@@ -161,7 +263,7 @@ end
     account = response_body["accounts"].first
 
     # Check required fields are present
-    required_fields = %w[id name balance currency classification account_type]
+    required_fields = %w[id name balance balance_cents cash_balance cash_balance_cents currency classification account_type]
     required_fields.each do |field|
       assert account.key?(field), "Account should have #{field} field"
     end
@@ -170,21 +272,15 @@ end
     assert account["id"].is_a?(String), "ID should be string (UUID)"
     assert account["name"].is_a?(String), "Name should be string"
     assert account["balance"].is_a?(String), "Balance should be string (money)"
+    assert account["balance_cents"].is_a?(Integer), "Balance cents should be integer"
+    assert account["cash_balance_cents"].is_a?(Integer), "Cash balance cents should be integer"
     assert account["currency"].is_a?(String), "Currency should be string"
     assert %w[asset liability].include?(account["classification"]), "Classification should be asset or liability"
   end
 
   test "should handle invalid pagination parameters gracefully" do
-    access_token = Doorkeeper::AccessToken.create!(
-      application: @oauth_app,
-      resource_owner_id: @user.id,
-      scopes: "read"
-    )
-
     # Test with invalid page number
-    get "/api/v1/accounts", params: { page: -1, per_page: "invalid" }, headers: {
-      "Authorization" => "Bearer #{access_token.token}"
-    }
+    get "/api/v1/accounts", params: { page: -1, per_page: "invalid" }, headers: api_headers(@api_key)
 
     # Should still return success with default pagination
     assert_response :success
@@ -197,15 +293,7 @@ end
   end
 
   test "should sort accounts alphabetically" do
-    access_token = Doorkeeper::AccessToken.create!(
-      application: @oauth_app,
-      resource_owner_id: @user.id,
-      scopes: "read"
-    )
-
-    get "/api/v1/accounts", params: {}, headers: {
-      "Authorization" => "Bearer #{access_token.token}"
-    }
+    get "/api/v1/accounts", params: {}, headers: api_headers(@api_key)
 
     assert_response :success
     response_body = JSON.parse(response.body)
@@ -214,4 +302,18 @@ end
     account_names = response_body["accounts"].map { |a| a["name"] }
     assert_equal account_names.sort, account_names
   end
+
+  private
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.plain_key }
+    end
+
+    def money_cents(money)
+      (money.amount * money.currency.minor_unit_conversion).round(0).to_i
+    end
+
+    def assert_nullable_equal(expected, actual)
+      expected.nil? ? assert_nil(actual) : assert_equal(expected, actual)
+    end
 end
diff --git a/test/controllers/api/v1/auth_controller_test.rb b/test/controllers/api/v1/auth_controller_test.rb
index 52207df3a..9760c22dc 100644
--- a/test/controllers/api/v1/auth_controller_test.rb
+++ b/test/controllers/api/v1/auth_controller_test.rb
@@ -94,6 +94,25 @@ class Api::V1::AuthControllerTest < ActionDispatch::IntegrationTest
     assert_equal "Device information is required", response_data["error"]
   end
 
+  test "should reject signup with invalid device_type before committing any state" do
+    # Pre-validation catches bad device_type and returns 400 without creating
+    # user/family/device/token. Guards against a partial-commit state where the
+    # account exists but the mobile session handoff fails.
+    assert_no_difference([ "User.count", "MobileDevice.count", "Doorkeeper::AccessToken.count" ]) do
+      post "/api/v1/auth/signup", params: {
+        user: {
+          email: "newuser@example.com",
+          password: "SecurePass123!",
+          first_name: "New",
+          last_name: "User"
+        },
+        device: @device_info.merge(device_type: "windows") # not in allowlist
+      }
+    end
+
+    assert_response :bad_request
+  end
+
   test "should not signup with invalid password" do
     assert_no_difference("User.count") do
       post "/api/v1/auth/signup", params: {
diff --git a/test/controllers/api/v1/balances_controller_test.rb b/test/controllers/api/v1/balances_controller_test.rb
new file mode 100644
index 000000000..afb2cb201
--- /dev/null
+++ b/test/controllers/api/v1/balances_controller_test.rb
@@ -0,0 +1,197 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::BalancesControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+    @user.api_keys.active.destroy_all
+
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      source: "web",
+      display_key: "test_read_#{SecureRandom.hex(8)}"
+    )
+
+    @account = @family.accounts.create!(
+      name: "Balance Checking",
+      accountable: Depository.new,
+      balance: 1234.56,
+      currency: "USD"
+    )
+    @balance = @account.balances.create!(
+      date: Date.parse("2024-01-15"),
+      balance: 1234.56,
+      cash_balance: 1234.56,
+      start_cash_balance: 1000,
+      start_non_cash_balance: 0,
+      cash_inflows: 234.56,
+      cash_outflows: 0,
+      currency: "USD"
+    )
+
+    other_family = families(:empty)
+    other_account = other_family.accounts.create!(
+      name: "Other Balance Checking",
+      accountable: Depository.new,
+      balance: 500,
+      currency: "USD"
+    )
+    @other_balance = other_account.balances.create!(
+      date: Date.parse("2024-01-15"),
+      balance: 500,
+      cash_balance: 500,
+      currency: "USD"
+    )
+  end
+
+  test "lists balances scoped to accessible family accounts" do
+    get api_v1_balances_url, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert response_data.key?("balances")
+    assert response_data.key?("pagination")
+    assert_includes response_data["balances"].map { |balance| balance["id"] }, @balance.id
+    assert_not_includes response_data["balances"].map { |balance| balance["id"] }, @other_balance.id
+  end
+
+  test "shows a balance" do
+    get api_v1_balance_url(@balance), headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_equal @balance.id, response_data["id"]
+    assert_equal "2024-01-15", response_data["date"]
+    assert_equal @account.id, response_data.dig("account", "id")
+    assert_kind_of Integer, response_data["balance_cents"]
+    assert_kind_of Integer, response_data["end_balance_cents"]
+  end
+
+  test "renders nullable cash balance fields" do
+    balance_without_cash = @account.balances.create!(
+      date: Date.parse("2024-01-16"),
+      balance: 1234.56,
+      currency: "USD"
+    )
+    balance_without_cash.update_column(:cash_balance, nil)
+
+    get api_v1_balance_url(balance_without_cash), headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_nil response_data["cash_balance"]
+    assert_nil response_data["cash_balance_cents"]
+  end
+
+  test "renders nullable account type" do
+    @account.update_columns(accountable_type: nil, accountable_id: nil)
+
+    get api_v1_balance_url(@balance), headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_nil response_data.dig("account", "account_type")
+  end
+
+  test "returns not found for another family's balance" do
+    get api_v1_balance_url(@other_balance), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "returns not found for malformed balance id" do
+    get api_v1_balance_url("not-a-uuid"), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "filters balances by account_id" do
+    get api_v1_balances_url,
+        params: { account_id: @account.id },
+        headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_includes response_data["balances"].map { |balance| balance["id"] }, @balance.id
+  end
+
+  test "filters balances by currency" do
+    eur_balance = @account.balances.create!(
+      date: Date.parse("2024-01-16"),
+      balance: 100,
+      currency: "EUR"
+    )
+
+    get api_v1_balances_url,
+        params: { currency: "usd" },
+        headers: api_headers(@api_key)
+
+    assert_response :success
+    balance_ids = JSON.parse(response.body)["balances"].map { |balance| balance["id"] }
+    assert_includes balance_ids, @balance.id
+    assert_not_includes balance_ids, eur_balance.id
+  end
+
+  test "filters balances by date range" do
+    get api_v1_balances_url,
+        params: { start_date: "2024-01-15", end_date: "2024-01-15" },
+        headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_includes response_data["balances"].map { |balance| balance["id"] }, @balance.id
+  end
+
+  test "rejects malformed account_id filter" do
+    get api_v1_balances_url, params: { account_id: "not-a-uuid" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "rejects invalid date filters" do
+    get api_v1_balances_url, params: { start_date: "01/15/2024" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "requires authentication" do
+    get api_v1_balances_url
+
+    assert_response :unauthorized
+  end
+
+  test "requires read scope" do
+    api_key_without_read = ApiKey.new(
+      user: @user,
+      name: "No Read Key",
+      scopes: [],
+      source: "mobile",
+      display_key: "no_read_#{SecureRandom.hex(8)}"
+    )
+    api_key_without_read.save!(validate: false)
+
+    get api_v1_balances_url, headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+  ensure
+    api_key_without_read&.destroy
+  end
+
+  private
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.display_key }
+    end
+end
diff --git a/test/controllers/api/v1/base_controller_test.rb b/test/controllers/api/v1/base_controller_test.rb
index af9e7066d..a6dec7ab6 100644
--- a/test/controllers/api/v1/base_controller_test.rb
+++ b/test/controllers/api/v1/base_controller_test.rb
@@ -60,6 +60,23 @@ class Api::V1::BaseControllerTest < ActionDispatch::IntegrationTest
     assert_equal @user.email, response_body["user"]
   end
 
+  test "should reject revoked access token" do
+    access_token = Doorkeeper::AccessToken.create!(
+      application: @oauth_app,
+      resource_owner_id: @user.id,
+      scopes: "read"
+    )
+    access_token.revoke
+
+    get "/api/v1/test", params: {}, headers: {
+      "Authorization" => "Bearer #{access_token.token}"
+    }
+
+    assert_response :unauthorized
+    response_body = JSON.parse(response.body)
+    assert_equal "unauthorized", response_body["error"]
+  end
+
   test "should reject invalid access token" do
     get "/api/v1/test", params: {}, headers: {
       "Authorization" => "Bearer invalid_token"
diff --git a/test/controllers/api/v1/budget_categories_controller_test.rb b/test/controllers/api/v1/budget_categories_controller_test.rb
new file mode 100644
index 000000000..0cd854b6a
--- /dev/null
+++ b/test/controllers/api/v1/budget_categories_controller_test.rb
@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::BudgetCategoriesControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+    @user.api_keys.active.destroy_all
+
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      source: "web",
+      display_key: "test_read_#{SecureRandom.hex(8)}"
+    )
+
+    @budget = @family.budgets.create!(
+      start_date: 5.months.ago.beginning_of_month.to_date,
+      end_date: 5.months.ago.end_of_month.to_date,
+      budgeted_spending: 3000,
+      expected_income: 5000,
+      currency: "USD"
+    )
+    @category = categories(:food_and_drink)
+    @budget_category = @budget.budget_categories.create!(
+      category: @category,
+      budgeted_spending: 500,
+      currency: "USD"
+    )
+
+    other_family = families(:empty)
+    other_category = other_family.categories.create!(name: "Other Food", color: "#123456")
+    other_budget = other_family.budgets.create!(
+      start_date: 6.months.ago.beginning_of_month.to_date,
+      end_date: 6.months.ago.end_of_month.to_date,
+      budgeted_spending: 1000,
+      expected_income: 2000,
+      currency: "USD"
+    )
+    @other_budget_category = other_budget.budget_categories.create!(
+      category: other_category,
+      budgeted_spending: 100,
+      currency: "USD"
+    )
+  end
+
+  test "lists budget categories scoped to the current family" do
+    get api_v1_budget_categories_url, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert response_data.key?("budget_categories")
+    assert response_data.key?("pagination")
+    assert_includes response_data["budget_categories"].map { |budget_category| budget_category["id"] }, @budget_category.id
+    assert_not_includes response_data["budget_categories"].map { |budget_category| budget_category["id"] }, @other_budget_category.id
+
+    budget_category = response_data["budget_categories"].find { |category| category["id"] == @budget_category.id }
+    assert_kind_of Integer, budget_category["budgeted_spending_cents"]
+    assert_not budget_category.key?("actual_spending")
+    assert_not budget_category.key?("actual_spending_cents")
+    assert_not budget_category.key?("available_to_spend")
+    assert_not budget_category.key?("available_to_spend_cents")
+  end
+
+  test "shows a budget category" do
+    get api_v1_budget_category_url(@budget_category), headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_equal @budget_category.id, response_data["id"]
+    assert_equal @budget.id, response_data["budget_id"]
+    assert_equal @category.id, response_data.dig("category", "id")
+    assert_kind_of Integer, response_data["budgeted_spending_cents"]
+    assert_kind_of Integer, response_data["actual_spending_cents"]
+    assert_kind_of Integer, response_data["available_to_spend_cents"]
+  end
+
+  test "returns not found for another family's budget category" do
+    get api_v1_budget_category_url(@other_budget_category), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "returns not found for malformed budget category id" do
+    get api_v1_budget_category_url("not-a-uuid"), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "filters budget categories by budget_id" do
+    get api_v1_budget_categories_url,
+        params: { budget_id: @budget.id },
+        headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_includes response_data["budget_categories"].map { |budget_category| budget_category["id"] }, @budget_category.id
+  end
+
+  test "filters budget categories by category_id" do
+    get api_v1_budget_categories_url,
+        params: { category_id: @category.id },
+        headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_includes response_data["budget_categories"].map { |budget_category| budget_category["id"] }, @budget_category.id
+  end
+
+  test "rejects malformed budget_id filter" do
+    get api_v1_budget_categories_url, params: { budget_id: "not-a-uuid" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "rejects invalid date filters" do
+    get api_v1_budget_categories_url, params: { start_date: "03/01/2024" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "requires authentication" do
+    get api_v1_budget_categories_url
+
+    assert_response :unauthorized
+  end
+
+  test "requires read scope" do
+    api_key_without_read = ApiKey.new(
+      user: @user,
+      name: "No Read Key",
+      scopes: [],
+      source: "mobile",
+      display_key: "no_read_#{SecureRandom.hex(8)}"
+    )
+    api_key_without_read.save!(validate: false)
+
+    get api_v1_budget_categories_url, headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+  ensure
+    api_key_without_read&.destroy
+  end
+end
diff --git a/test/controllers/api/v1/budgets_controller_test.rb b/test/controllers/api/v1/budgets_controller_test.rb
new file mode 100644
index 000000000..b4c7252ee
--- /dev/null
+++ b/test/controllers/api/v1/budgets_controller_test.rb
@@ -0,0 +1,141 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::BudgetsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+    @user.api_keys.active.destroy_all
+
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      source: "web",
+      display_key: "test_read_#{SecureRandom.hex(8)}"
+    )
+
+    @budget = @family.budgets.create!(
+      start_date: 3.months.ago.beginning_of_month.to_date,
+      end_date: 3.months.ago.end_of_month.to_date,
+      budgeted_spending: 3000,
+      expected_income: 5000,
+      currency: "USD"
+    )
+
+    category = categories(:food_and_drink)
+    @budget_category = @budget.budget_categories.create!(
+      category: category,
+      budgeted_spending: 500,
+      currency: "USD"
+    )
+
+    other_family = families(:empty)
+    @other_budget = other_family.budgets.create!(
+      start_date: 4.months.ago.beginning_of_month.to_date,
+      end_date: 4.months.ago.end_of_month.to_date,
+      budgeted_spending: 1000,
+      expected_income: 2000,
+      currency: "USD"
+    )
+  end
+
+  test "lists budgets scoped to the current family" do
+    get api_v1_budgets_url, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert response_data.key?("budgets")
+    assert response_data.key?("pagination")
+    assert_includes response_data["budgets"].map { |budget| budget["id"] }, @budget.id
+    assert_not_includes response_data["budgets"].map { |budget| budget["id"] }, @other_budget.id
+
+    budget_response = response_data["budgets"].find { |budget| budget["id"] == @budget.id }
+    %w[
+      actual_spending
+      actual_spending_cents
+      actual_income
+      actual_income_cents
+      available_to_spend
+      available_to_spend_cents
+      available_to_allocate
+      available_to_allocate_cents
+    ].each do |derived_field|
+      assert_not budget_response.key?(derived_field), "Expected budget index to omit #{derived_field}"
+    end
+  end
+
+  test "shows a budget" do
+    get api_v1_budget_url(@budget.id), headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_equal @budget.id, response_data["id"]
+    assert_equal @budget.start_date.to_s, response_data["start_date"]
+    assert_equal "USD", response_data["currency"]
+    assert_equal true, response_data["initialized"]
+    assert_kind_of Integer, response_data["budgeted_spending_cents"]
+    assert_kind_of Integer, response_data["actual_spending_cents"]
+    assert_kind_of Integer, response_data["actual_income_cents"]
+    assert_kind_of Integer, response_data["available_to_spend_cents"]
+    assert_kind_of Integer, response_data["available_to_allocate_cents"]
+  end
+
+  test "returns not found for another family's budget" do
+    get api_v1_budget_url(@other_budget.id), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "returns not found for malformed budget id" do
+    get api_v1_budget_url("not-a-uuid"), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "filters budgets by date range" do
+    get api_v1_budgets_url,
+        params: { start_date: @budget.start_date.to_s, end_date: @budget.end_date.to_s },
+        headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_includes response_data["budgets"].map { |budget| budget["id"] }, @budget.id
+  end
+
+  test "rejects invalid date filters" do
+    get api_v1_budgets_url, params: { start_date: "03/01/2024" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "requires authentication" do
+    get api_v1_budgets_url
+
+    assert_response :unauthorized
+  end
+
+  test "requires read scope" do
+    api_key_without_read = ApiKey.new(
+      user: @user,
+      name: "No Read Key",
+      scopes: [],
+      source: "mobile",
+      display_key: "no_read_#{SecureRandom.hex(8)}"
+    )
+    api_key_without_read.save!(validate: false)
+
+    get api_v1_budgets_url, headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+  ensure
+    api_key_without_read&.destroy
+  end
+end
diff --git a/test/controllers/api/v1/categories_controller_test.rb b/test/controllers/api/v1/categories_controller_test.rb
index c60fcacc1..12d30fef8 100644
--- a/test/controllers/api/v1/categories_controller_test.rb
+++ b/test/controllers/api/v1/categories_controller_test.rb
@@ -8,17 +8,10 @@ class Api::V1::CategoriesControllerTest < ActionDispatch::IntegrationTest
     @other_family_user = users(:family_member)
     @other_family_user.update!(family: families(:empty))
 
-    @oauth_app = Doorkeeper::Application.create!(
-      name: "Test API App",
-      redirect_uri: "https://example.com/callback",
-      scopes: "read read_write"
-    )
-
-    @access_token = Doorkeeper::AccessToken.create!(
-      application: @oauth_app,
-      resource_owner_id: @user.id,
-      scopes: "read"
-    )
+    # Fixtures pre-create active keys for family_admin; clear them so we can
+    # create scoped keys per-test without tripping the one-active-key-per-source
+    # validation.
+    @user.api_keys.active.destroy_all
 
     @category = categories(:food_and_drink)
     @subcategory = categories(:subcategory)
@@ -35,9 +28,7 @@ class Api::V1::CategoriesControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should return user's family categories successfully" do
-    get "/api/v1/categories", params: {}, headers: {
-      "Authorization" => "Bearer #{@access_token.token}"
-    }
+    get "/api/v1/categories", params: {}, headers: api_headers(read_only_api_key)
 
     assert_response :success
     response_body = JSON.parse(response.body)
@@ -53,15 +44,15 @@ class Api::V1::CategoriesControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should not return other family's categories" do
-    access_token = Doorkeeper::AccessToken.create!(
-      application: @oauth_app,
-      resource_owner_id: @other_family_user.id,
-      scopes: "read"
+    other_family_api_key = ApiKey.create!(
+      user: @other_family_user,
+      name: "Other Family Read Key",
+      key: ApiKey.generate_secure_key,
+      scopes: %w[read],
+      source: "web"
     )
 
-    get "/api/v1/categories", params: {}, headers: {
-      "Authorization" => "Bearer #{access_token.token}"
-    }
+    get "/api/v1/categories", params: {}, headers: api_headers(other_family_api_key)
 
     assert_response :success
     response_body = JSON.parse(response.body)
@@ -72,9 +63,7 @@ class Api::V1::CategoriesControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should return proper category data structure" do
-    get "/api/v1/categories", params: {}, headers: {
-      "Authorization" => "Bearer #{@access_token.token}"
-    }
+    get "/api/v1/categories", params: {}, headers: api_headers(read_only_api_key)
 
     assert_response :success
     response_body = JSON.parse(response.body)
@@ -96,9 +85,7 @@ class Api::V1::CategoriesControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should include parent information for subcategories" do
-    get "/api/v1/categories", params: {}, headers: {
-      "Authorization" => "Bearer #{@access_token.token}"
-    }
+    get "/api/v1/categories", params: {}, headers: api_headers(read_only_api_key)
 
     assert_response :success
     response_body = JSON.parse(response.body)
@@ -112,9 +99,7 @@ class Api::V1::CategoriesControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should handle pagination parameters" do
-    get "/api/v1/categories", params: { page: 1, per_page: 2 }, headers: {
-      "Authorization" => "Bearer #{@access_token.token}"
-    }
+    get "/api/v1/categories", params: { page: 1, per_page: 2 }, headers: api_headers(read_only_api_key)
 
     assert_response :success
     response_body = JSON.parse(response.body)
@@ -125,9 +110,7 @@ class Api::V1::CategoriesControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should filter for roots only" do
-    get "/api/v1/categories", params: { roots_only: true }, headers: {
-      "Authorization" => "Bearer #{@access_token.token}"
-    }
+    get "/api/v1/categories", params: { roots_only: true }, headers: api_headers(read_only_api_key)
 
     assert_response :success
     response_body = JSON.parse(response.body)
@@ -138,9 +121,7 @@ class Api::V1::CategoriesControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should sort categories alphabetically" do
-    get "/api/v1/categories", params: {}, headers: {
-      "Authorization" => "Bearer #{@access_token.token}"
-    }
+    get "/api/v1/categories", params: {}, headers: api_headers(read_only_api_key)
 
     assert_response :success
     response_body = JSON.parse(response.body)
@@ -152,9 +133,7 @@ class Api::V1::CategoriesControllerTest < ActionDispatch::IntegrationTest
   # Show action tests
 
   test "should return a single category" do
-    get "/api/v1/categories/#{@category.id}", params: {}, headers: {
-      "Authorization" => "Bearer #{@access_token.token}"
-    }
+    get "/api/v1/categories/#{@category.id}", params: {}, headers: api_headers(read_only_api_key)
 
     assert_response :success
     response_body = JSON.parse(response.body)
@@ -166,9 +145,7 @@ class Api::V1::CategoriesControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should return 404 for non-existent category" do
-    get "/api/v1/categories/00000000-0000-0000-0000-000000000000", params: {}, headers: {
-      "Authorization" => "Bearer #{@access_token.token}"
-    }
+    get "/api/v1/categories/00000000-0000-0000-0000-000000000000", params: {}, headers: api_headers(read_only_api_key)
 
     assert_response :not_found
     response_body = JSON.parse(response.body)
@@ -182,10 +159,156 @@ class Api::V1::CategoriesControllerTest < ActionDispatch::IntegrationTest
       classification_unused: "expense"
     )
 
-    get "/api/v1/categories/#{other_family_category.id}", params: {}, headers: {
-      "Authorization" => "Bearer #{@access_token.token}"
-    }
+    get "/api/v1/categories/#{other_family_category.id}", params: {}, headers: api_headers(read_only_api_key)
 
     assert_response :not_found
   end
+
+  # Create action tests
+
+  test "create requires authentication" do
+    post "/api/v1/categories", params: { category: { name: "Anything" } }
+    assert_response :unauthorized
+  end
+
+  test "create rejects api key without read_write scope" do
+    post "/api/v1/categories",
+      params: { category: { name: "Coffee Runs", color: "#22c55e", icon: "coffee" } },
+      headers: api_headers(read_only_api_key)
+
+    assert_response :forbidden
+  end
+
+  test "create returns 201 with full attributes" do
+    post "/api/v1/categories",
+      params: { category: { name: "Coffee Runs", color: "#22c55e", icon: "coffee" } },
+      headers: api_headers(read_write_api_key)
+
+    assert_response :created
+    body = JSON.parse(response.body)
+    assert body["id"].present?
+    assert_equal "Coffee Runs", body["name"]
+    assert_equal "#22c55e", body["color"]
+    assert_equal "coffee", body["icon"]
+    assert_nil body["parent"]
+    assert_equal 0, body["subcategories_count"]
+
+    persisted = @user.family.categories.find(body["id"])
+    assert_equal "coffee", persisted.lucide_icon
+  end
+
+  test "create auto-suggests icon when omitted" do
+    post "/api/v1/categories",
+      params: { category: { name: "Groceries Imported", color: "#407706" } },
+      headers: api_headers(read_write_api_key)
+
+    assert_response :created
+    body = JSON.parse(response.body)
+    assert body["icon"].present?
+    assert_not_equal "", body["icon"]
+  end
+
+  test "create attaches parent when provided" do
+    post "/api/v1/categories",
+      params: { category: { name: "Imported Subcategory", color: "#22c55e", icon: "shapes", parent_id: @category.id } },
+      headers: api_headers(read_write_api_key)
+
+    assert_response :created
+    body = JSON.parse(response.body)
+    assert_equal @category.id, body.dig("parent", "id")
+    assert_equal @category.name, body.dig("parent", "name")
+  end
+
+  test "create returns 422 on duplicate name within family" do
+    post "/api/v1/categories",
+      params: { category: { name: @category.name, color: "#22c55e", icon: "shapes" } },
+      headers: api_headers(read_write_api_key)
+
+    assert_response :unprocessable_entity
+    body = JSON.parse(response.body)
+    assert_equal "unprocessable_entity", body["error"]
+    assert body["message"].present?
+  end
+
+  test "create returns 422 on invalid color" do
+    post "/api/v1/categories",
+      params: { category: { name: "Bad Color", color: "not-a-hex" } },
+      headers: api_headers(read_write_api_key)
+
+    assert_response :unprocessable_entity
+    body = JSON.parse(response.body)
+    assert_equal "unprocessable_entity", body["error"]
+    assert body["message"].present?
+  end
+
+  test "create returns 422 when parent_id belongs to another family" do
+    other_family_category = families(:empty).categories.create!(
+      name: "External Parent",
+      color: "#FF0000",
+      classification_unused: "expense"
+    )
+
+    post "/api/v1/categories",
+      params: { category: { name: "Should Fail", color: "#22c55e", icon: "shapes", parent_id: other_family_category.id } },
+      headers: api_headers(read_write_api_key)
+
+    assert_response :unprocessable_entity
+    body = JSON.parse(response.body)
+    assert_equal "unprocessable_entity", body["error"]
+    assert body["message"].present?
+  end
+
+  test "create returns 422 when nesting exceeds two levels" do
+    child = @user.family.categories.create!(
+      name: "Existing Child",
+      color: "#22c55e",
+      lucide_icon: "shapes",
+      parent: @category
+    )
+
+    post "/api/v1/categories",
+      params: { category: { name: "Grandchild", color: "#22c55e", icon: "shapes", parent_id: child.id } },
+      headers: api_headers(read_write_api_key)
+
+    assert_response :unprocessable_entity
+    body = JSON.parse(response.body)
+    assert_equal "unprocessable_entity", body["error"]
+    assert body["message"].present?
+  end
+
+  test "create returns 400 when category payload is missing" do
+    post "/api/v1/categories",
+      params: {},
+      headers: api_headers(read_write_api_key)
+
+    assert_response :bad_request
+    body = JSON.parse(response.body)
+    assert_equal "bad_request", body["error"]
+  end
+
+  private
+
+    def read_write_api_key
+      @read_write_api_key ||= ApiKey.create!(
+        user: @user,
+        name: "Test RW Key",
+        key: ApiKey.generate_secure_key,
+        scopes: %w[read_write],
+        source: "web"
+      )
+    end
+
+    def read_only_api_key
+      @read_only_api_key ||= ApiKey.create!(
+        user: @user,
+        name: "Test RO Key",
+        key: ApiKey.generate_secure_key,
+        scopes: %w[read],
+        source: "mobile"
+      )
+    end
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.plain_key }
+    end
 end
diff --git a/test/controllers/api/v1/family_exports_controller_test.rb b/test/controllers/api/v1/family_exports_controller_test.rb
new file mode 100644
index 000000000..ec16da07c
--- /dev/null
+++ b/test/controllers/api/v1/family_exports_controller_test.rb
@@ -0,0 +1,201 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::FamilyExportsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @admin = users(:family_admin)
+    @member = users(:family_member)
+    @family = @admin.family
+
+    @admin.api_keys.active.destroy_all
+    @member.api_keys.active.destroy_all
+
+    @api_key = ApiKey.create!(
+      user: @admin,
+      name: "Test Read-Write Key",
+      scopes: [ "read_write" ],
+      display_key: "test_rw_#{SecureRandom.hex(8)}",
+      source: "web"
+    )
+
+    @read_only_api_key = ApiKey.create!(
+      user: @admin,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      display_key: "test_ro_#{SecureRandom.hex(8)}",
+      source: "mobile"
+    )
+
+    @member_api_key = ApiKey.create!(
+      user: @member,
+      name: "Member Read-Write Key",
+      scopes: [ "read_write" ],
+      display_key: "test_member_#{SecureRandom.hex(8)}",
+      source: "web"
+    )
+
+    redis = Redis.new
+    redis.del("api_rate_limit:#{@api_key.id}")
+    redis.del("api_rate_limit:#{@read_only_api_key.id}")
+    redis.del("api_rate_limit:#{@member_api_key.id}")
+    redis.close
+  end
+
+  test "lists family exports" do
+    completed_export = @family.family_exports.create!(status: "completed")
+    processing_export = @family.family_exports.create!(status: "processing")
+
+    get api_v1_family_exports_url, headers: api_headers(@read_only_api_key)
+    assert_response :success
+
+    json_response = JSON.parse(response.body)
+    export_ids = json_response["data"].map { |export| export["id"] }
+
+    assert_includes export_ids, completed_export.id
+    assert_includes export_ids, processing_export.id
+    assert_equal @family.family_exports.count, json_response["meta"]["total_count"]
+  end
+
+  test "shows a family export" do
+    export = @family.family_exports.create!(status: "completed")
+    export.export_file.attach(
+      io: StringIO.new("test zip content"),
+      filename: "test.zip",
+      content_type: "application/zip"
+    )
+
+    get api_v1_family_export_url(export), headers: api_headers(@read_only_api_key)
+    assert_response :success
+
+    json_response = JSON.parse(response.body)
+    assert_equal export.id, json_response["data"]["id"]
+    assert_equal "completed", json_response["data"]["status"]
+    assert_equal true, json_response["data"]["downloadable"]
+    assert_equal download_api_v1_family_export_path(export), json_response["data"]["download_path"]
+    assert_equal true, json_response["data"]["file"]["attached"]
+    assert_equal "application/zip", json_response["data"]["file"]["content_type"]
+  end
+
+  test "creates a family export job" do
+    assert_enqueued_with(job: FamilyDataExportJob) do
+      assert_difference("@family.family_exports.count") do
+        post api_v1_family_exports_url, headers: api_headers(@api_key)
+      end
+    end
+
+    assert_response :accepted
+    json_response = JSON.parse(response.body)
+    export = FamilyExport.find(json_response["data"]["id"])
+
+    assert_equal "pending", export.status
+    assert_equal @family.id, export.family_id
+  end
+
+  test "read-only key cannot create a family export" do
+    assert_no_difference("@family.family_exports.count") do
+      post api_v1_family_exports_url, headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :forbidden
+    assert_equal "insufficient_scope", JSON.parse(response.body)["error"]
+  end
+
+  test "create rejects unsupported params" do
+    assert_no_difference("@family.family_exports.count") do
+      post api_v1_family_exports_url,
+           params: { family_export: { status: "completed" } },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    assert_equal "invalid_params", JSON.parse(response.body)["error"]
+  end
+
+  test "non-admin cannot access family exports" do
+    get api_v1_family_exports_url, headers: api_headers(@member_api_key)
+    assert_response :forbidden
+
+    assert_equal "forbidden", JSON.parse(response.body)["error"]
+  end
+
+  test "returns not found for another family's export" do
+    other_family = families(:empty)
+    other_export = other_family.family_exports.create!(status: "completed")
+
+    get api_v1_family_export_url(other_export), headers: api_headers(@read_only_api_key)
+    assert_response :not_found
+
+    assert_equal "record_not_found", JSON.parse(response.body)["error"]
+  end
+
+  test "returns not found for malformed export id" do
+    get api_v1_family_export_url("not-a-uuid"), headers: api_headers(@read_only_api_key)
+    assert_response :not_found
+
+    assert_equal "record_not_found", JSON.parse(response.body)["error"]
+  end
+
+  test "download returns not found for malformed export id" do
+    get download_api_v1_family_export_url("not-a-uuid"), headers: api_headers(@read_only_api_key)
+    assert_response :not_found
+
+    assert_equal "record_not_found", JSON.parse(response.body)["error"]
+  end
+
+  test "redirects completed export downloads to the attached file" do
+    export = @family.family_exports.create!(status: "completed")
+    export.export_file.attach(
+      io: StringIO.new("test zip content"),
+      filename: "test.zip",
+      content_type: "application/zip"
+    )
+
+    get download_api_v1_family_export_url(export), headers: api_headers(@read_only_api_key)
+    assert_response :redirect
+    assert_includes response.location, "/rails/active_storage/blobs/redirect/"
+    assert_includes response.location, "test.zip"
+  end
+
+  test "download returns conflict when export is not ready" do
+    export = @family.family_exports.create!(status: "processing")
+
+    get download_api_v1_family_export_url(export), headers: api_headers(@read_only_api_key)
+    assert_response :conflict
+
+    json_response = JSON.parse(response.body)
+    assert_equal "export_not_ready", json_response["error"]
+  end
+
+  test "download handles storage URL failures without leaking details" do
+    export = @family.family_exports.create!(status: "completed")
+    export.export_file.attach(
+      io: StringIO.new("test zip content"),
+      filename: "test.zip",
+      content_type: "application/zip"
+    )
+
+    Api::V1::FamilyExportsController.any_instance
+      .stubs(:rails_blob_url)
+      .raises(StandardError, "storage down")
+
+    get download_api_v1_family_export_url(export), headers: api_headers(@read_only_api_key)
+    assert_response :internal_server_error
+
+    json_response = JSON.parse(response.body)
+    assert_equal "internal_server_error", json_response["error"]
+    assert_equal "An unexpected error occurred", json_response["message"]
+    assert_not_includes response.body, "storage down"
+  end
+
+  test "requires authentication" do
+    get api_v1_family_exports_url
+    assert_response :unauthorized
+  end
+
+  private
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.plain_key }
+    end
+end
diff --git a/test/controllers/api/v1/family_settings_controller_test.rb b/test/controllers/api/v1/family_settings_controller_test.rb
new file mode 100644
index 000000000..e1fb8565c
--- /dev/null
+++ b/test/controllers/api/v1/family_settings_controller_test.rb
@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::FamilySettingsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+    @family.update!(
+      currency: "SGD",
+      enabled_currencies: [ "USD" ],
+      locale: "en",
+      date_format: "%Y-%m-%d",
+      country: "SG",
+      timezone: "Asia/Singapore",
+      month_start_day: 15,
+      moniker: "Family",
+      default_account_sharing: "private"
+    )
+
+    @user.api_keys.active.destroy_all
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      source: "web",
+      display_key: "test_read_#{SecureRandom.hex(8)}"
+    )
+    Redis.new.del("api_rate_limit:#{@api_key.id}")
+  end
+
+  test "shows current family settings snapshot" do
+    get api_v1_family_settings_url, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_body = JSON.parse(response.body)
+
+    assert_equal @family.id, response_body["id"]
+    assert_equal @family.name, response_body["name"]
+    assert_equal "SGD", response_body["currency"]
+    assert_equal "en", response_body["locale"]
+    assert_equal "%Y-%m-%d", response_body["date_format"]
+    assert_equal "SG", response_body["country"]
+    assert_equal "Asia/Singapore", response_body["timezone"]
+    assert_equal 15, response_body["month_start_day"]
+    assert_equal "Family", response_body["moniker"]
+    assert_equal "private", response_body["default_account_sharing"]
+    assert_equal true, response_body["custom_enabled_currencies"]
+    assert_equal @family.enabled_currency_codes, response_body["enabled_currencies"]
+    assert_equal @family.created_at.iso8601, response_body["created_at"]
+    assert_equal @family.updated_at.iso8601, response_body["updated_at"]
+    assert_not response_body.key?("stripe_customer_id")
+    assert_not response_body.key?("vector_store_id")
+  end
+
+  test "requires authentication" do
+    get api_v1_family_settings_url
+
+    assert_response :unauthorized
+  end
+
+  test "requires read scope" do
+    api_key_without_read = ApiKey.new(
+      user: @user,
+      name: "No Read Key",
+      scopes: [],
+      source: "web",
+      display_key: "no_read_#{SecureRandom.hex(8)}"
+    )
+    api_key_without_read.save!(validate: false)
+
+    get api_v1_family_settings_url, headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+  ensure
+    api_key_without_read&.destroy
+  end
+
+  private
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.plain_key }
+    end
+end
diff --git a/test/controllers/api/v1/imports_controller_test.rb b/test/controllers/api/v1/imports_controller_test.rb
index fb5ac9bc2..41d6c2e43 100644
--- a/test/controllers/api/v1/imports_controller_test.rb
+++ b/test/controllers/api/v1/imports_controller_test.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "test_helper"
 
 class Api::V1::ImportsControllerTest < ActionDispatch::IntegrationTest
@@ -13,7 +15,8 @@ class Api::V1::ImportsControllerTest < ActionDispatch::IntegrationTest
       user: @user,
       name: "Test Read-Write Key",
       scopes: [ "read_write" ],
-      display_key: "test_rw_#{SecureRandom.hex(8)}"
+      display_key: "test_rw_#{SecureRandom.hex(8)}",
+      source: "web"
     )
 
     @read_only_api_key = ApiKey.create!(
@@ -26,6 +29,53 @@ class Api::V1::ImportsControllerTest < ActionDispatch::IntegrationTest
 
     Redis.new.del("api_rate_limit:#{@api_key.id}")
     Redis.new.del("api_rate_limit:#{@read_only_api_key.id}")
+
+    @diagnostic_category_name = "Diagnostic Groceries #{SecureRandom.hex(4)}"
+    @diagnostic_import = @family.imports.create!(
+      type: "TransactionImport",
+      status: "pending",
+      account: @account,
+      raw_file_str: "date,amount,name,category,tags\n01/15/2024,-10.00,Grocery Run,#{@diagnostic_category_name},Food|Weekly",
+      date_col_label: "date",
+      amount_col_label: "amount",
+      name_col_label: "name",
+      category_col_label: "category",
+      tags_col_label: "tags"
+    )
+    @diagnostic_row = @diagnostic_import.rows.create!(
+      source_row_number: 7,
+      date: "01/15/2024",
+      amount: "-10.00",
+      currency: "USD",
+      name: "Grocery Run",
+      category: @diagnostic_category_name,
+      entity_type: "checking",
+      tags: "Food|Weekly"
+    )
+    @invalid_diagnostic_row = @diagnostic_import.rows.build(
+      source_row_number: 8,
+      date: "not-a-date",
+      amount: "not-a-number",
+      currency: "BAD",
+      name: "Bad Row"
+    )
+    @invalid_diagnostic_row.save!(validate: false)
+
+    @diagnostic_category = @family.categories.create!(
+      name: @diagnostic_category_name,
+      color: "#407706",
+      lucide_icon: "shopping-basket"
+    )
+    Import::CategoryMapping.create!(
+      import: @diagnostic_import,
+      key: @diagnostic_category_name,
+      mappable: @diagnostic_category
+    )
+    Import::AccountTypeMapping.create!(
+      import: @diagnostic_import,
+      key: "checking",
+      value: "Depository"
+    )
   end
 
   test "should list imports" do
@@ -35,6 +85,12 @@ class Api::V1::ImportsControllerTest < ActionDispatch::IntegrationTest
     json_response = JSON.parse(response.body)
     assert_not_empty json_response["data"]
     assert_equal @family.imports.count, json_response["meta"]["total_count"]
+
+    import_data = json_response["data"].detect { |data| data["id"] == @import.id }
+    assert_not_nil import_data
+    assert_equal @import.uploaded?, import_data["status_detail"]["uploaded"]
+    assert_equal @import.configured?, import_data["status_detail"]["configured"]
+    assert_equal @import.complete? || @import.failed? || @import.revert_failed?, import_data["status_detail"]["terminal"]
   end
 
   test "should show import" do
@@ -42,8 +98,166 @@ class Api::V1::ImportsControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
 
     json_response = JSON.parse(response.body)
+    rows = @import.rows.to_a
+    valid_rows_count = rows.count(&:valid?)
+    invalid_rows_count = rows.length - valid_rows_count
+
     assert_equal @import.id, json_response["data"]["id"]
     assert_equal @import.status, json_response["data"]["status"]
+    assert json_response["data"].key?("status_detail")
+    assert_equal @import.uploaded?, json_response["data"]["status_detail"]["uploaded"]
+    assert_equal @import.configured?, json_response["data"]["status_detail"]["configured"]
+    assert_equal @import.cleaned_from_validation_stats?(invalid_rows_count: invalid_rows_count),
+                 json_response["data"]["status_detail"]["cleaned"]
+    assert_equal @import.publishable_from_validation_stats?(invalid_rows_count: invalid_rows_count),
+                 json_response["data"]["status_detail"]["publishable"]
+    assert_equal @import.revertable?, json_response["data"]["status_detail"]["revertable"]
+    assert_equal @import.rows_count, json_response["data"]["stats"]["rows_count"]
+    assert_equal valid_rows_count, json_response["data"]["stats"]["valid_rows_count"]
+    assert_equal invalid_rows_count, json_response["data"]["stats"]["invalid_rows_count"]
+    assert_equal @import.mappings.count, json_response["data"]["stats"]["mappings_count"]
+    assert_equal @import.mappings.where(mappable_id: nil).count,
+                 json_response["data"]["stats"]["unassigned_mappings_count"]
+  end
+
+  test "should show Sure import verification" do
+    sure_import = @family.imports.create!(type: "SureImport")
+    sure_import.ndjson_file.attach(
+      io: StringIO.new(build_ndjson([
+        { type: "Account", data: {
+          id: "account-1",
+          name: "API Verified Checking",
+          balance: "100.00",
+          currency: "USD",
+          accountable_type: "Depository"
+        } },
+        { type: "Valuation", data: {
+          id: "valuation-1",
+          account_id: "account-1",
+          date: "2024-01-14",
+          amount: "100.00",
+          currency: "USD",
+          kind: "opening_anchor"
+        } }
+      ])),
+      filename: "sure.ndjson",
+      content_type: "application/x-ndjson"
+    )
+    sure_import.sync_ndjson_rows_count!
+    sure_import.publish
+
+    get api_v1_import_url(sure_import), headers: api_headers(@api_key)
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    verification = json_response.dig("data", "verification")
+
+    assert_equal 1, verification.dig("expected_record_counts", "accounts")
+    assert_equal 1, verification.dig("expected_record_counts", "valuations")
+    assert_equal "matched", verification.dig("readback", "status")
+    assert_equal 1, verification.dig("readback", "actual_delta_counts", "accounts")
+    assert_equal 1, verification.dig("readback", "actual_delta_counts", "valuations")
+    assert_equal 0, verification.dig("readback", "checked_counts", "balances")
+    assert_empty verification.dig("readback", "mismatches")
+  end
+
+  test "should list sanitized import row diagnostics" do
+    get rows_api_v1_import_url(@diagnostic_import), headers: api_headers(@read_only_api_key)
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+
+    assert_equal 2, json_response["meta"]["total_count"]
+    row_data = json_response["data"].find { |row| row["id"] == @diagnostic_row.id }
+
+    assert_not_nil row_data
+    assert_equal true, row_data["valid"]
+    assert_equal 7, row_data["row_number"]
+    assert_equal "Grocery Run", row_data.dig("fields", "name")
+    assert_equal @diagnostic_category_name, row_data.dig("fields", "category")
+    assert_equal @diagnostic_category.id, row_data.dig("mappings", "category", "mappable", "id")
+    assert_equal "Depository", row_data.dig("mappings", "account_type", "value")
+    tag_mapping = row_data.dig("mappings", "tags").find { |mapping| mapping["key"] == "Weekly" }
+    assert_not_nil tag_mapping
+    assert_nil tag_mapping["value"]
+    assert_not row_data.key?("raw_file_str")
+    refute_includes response.body, @diagnostic_import.raw_file_str
+  end
+
+  test "should include validation errors for invalid import rows" do
+    get rows_api_v1_import_url(@diagnostic_import), headers: api_headers(@api_key)
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    row_data = json_response["data"].find { |row| row["id"] == @invalid_diagnostic_row.id }
+
+    assert_not_nil row_data
+    assert_equal false, row_data["valid"]
+    assert_not_empty row_data["errors"]
+  end
+
+  test "should paginate import row diagnostics" do
+    get rows_api_v1_import_url(@diagnostic_import),
+        params: { page: 1, per_page: 1 },
+        headers: api_headers(@api_key)
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+
+    assert_equal 1, json_response["data"].length
+    assert_equal 2, json_response["meta"]["total_count"]
+    assert_equal 1, json_response["meta"]["per_page"]
+  end
+
+  test "should list import row diagnostics in source row order" do
+    @diagnostic_import.rows.create!(
+      source_row_number: 6,
+      date: "01/14/2024",
+      amount: "-5.00",
+      currency: "USD",
+      name: "Earlier Source Row"
+    )
+
+    get rows_api_v1_import_url(@diagnostic_import), headers: api_headers(@api_key)
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+
+    assert_equal [ 6, 7, 8 ], json_response["data"].map { |row| row["row_number"] }
+  end
+
+  test "should not expose another family's import rows" do
+    other_family = Family.create!(name: "Other Family", currency: "USD", locale: "en")
+    other_import = other_family.imports.create!(type: "TransactionImport", raw_file_str: "date,amount,name")
+
+    get rows_api_v1_import_url(other_import), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    json_response = JSON.parse(response.body)
+    assert_equal "not_found", json_response["error"]
+  end
+
+  test "should require authentication for import row diagnostics" do
+    get rows_api_v1_import_url(@diagnostic_import)
+
+    assert_response :unauthorized
+  end
+
+  test "should require read scope for import row diagnostics" do
+    api_key_without_read = ApiKey.new(
+      user: @user,
+      name: "No Read Key",
+      scopes: [],
+      source: "web",
+      display_key: "no_read_#{SecureRandom.hex(8)}"
+    )
+    api_key_without_read.save!(validate: false)
+
+    get rows_api_v1_import_url(@diagnostic_import), headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+  ensure
+    api_key_without_read&.destroy
   end
 
   test "should create import with raw content" do
@@ -131,6 +345,765 @@ class Api::V1::ImportsControllerTest < ActionDispatch::IntegrationTest
     assert_equal '[{"action_type":"set_transaction_category","value":"Groceries"}]', row.actions
   end
 
+  test "should create Sure import with raw NDJSON content" do
+    ndjson_content = { type: "Account", data: { id: "account_1", name: "Checking" } }.to_json
+
+    assert_difference("Import.count") do
+      post api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             raw_file_content: ndjson_content
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :created
+
+    json_response = JSON.parse(response.body)
+    import = Import.find(json_response["data"]["id"])
+
+    assert_instance_of SureImport, import
+    assert import.ndjson_file.attached?
+    assert_equal 1, import.rows_count
+    assert_equal "pending", import.status
+  end
+
+  test "should require authentication for Sure import" do
+    ndjson_content = { type: "Account", data: { id: "account_1", name: "Checking" } }.to_json
+
+    assert_no_difference("Import.count") do
+      post api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             raw_file_content: ndjson_content
+           }
+    end
+
+    assert_response :unauthorized
+  end
+
+  test "should reject Sure import with read-only API key" do
+    ndjson_content = { type: "Account", data: { id: "account_1", name: "Checking" } }.to_json
+
+    assert_no_difference("Import.count") do
+      post api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             raw_file_content: ndjson_content
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :forbidden
+    json_response = JSON.parse(response.body)
+    assert_equal "insufficient_scope", json_response["error"]
+  end
+
+  test "should create Sure import with uploaded NDJSON file" do
+    ndjson_content = { type: "Account", data: { id: "account_1", name: "Checking" } }.to_json
+    valid_file = Rack::Test::UploadedFile.new(
+      StringIO.new(ndjson_content),
+      "application/x-ndjson",
+      original_filename: "sure-backup.ndjson"
+    )
+
+    assert_difference("Import.count") do
+      post api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             file: valid_file
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :created
+
+    import = Import.find(JSON.parse(response.body)["data"]["id"])
+    assert_instance_of SureImport, import
+    assert import.ndjson_file.attached?
+    assert_equal 1, import.rows_count
+  end
+
+  test "should reject Sure import with no file or raw content" do
+    assert_no_difference("Import.count") do
+      post api_v1_imports_url,
+           params: {
+             type: "SureImport"
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    json_response = JSON.parse(response.body)
+    assert_equal "missing_content", json_response["error"]
+  end
+
+  test "should reject Sure import uploaded file exceeding max size" do
+    test_limit = 1.kilobyte
+    large_file = Rack::Test::UploadedFile.new(
+      StringIO.new("x" * (test_limit + 1)),
+      "application/x-ndjson",
+      original_filename: "large.ndjson"
+    )
+
+    SureImport.stubs(:max_ndjson_size).returns(test_limit)
+
+    assert_no_difference("Import.count") do
+      post api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             file: large_file
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    json_response = JSON.parse(response.body)
+    assert_equal "file_too_large", json_response["error"]
+  end
+
+  test "should reject Sure import uploaded file with invalid type" do
+    ndjson_content = { type: "Account", data: { id: "account_1", name: "Checking" } }.to_json
+    invalid_file = Rack::Test::UploadedFile.new(
+      StringIO.new(ndjson_content),
+      "application/pdf",
+      original_filename: "sure-backup.pdf"
+    )
+
+    assert_no_difference("Import.count") do
+      post api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             file: invalid_file
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    json_response = JSON.parse(response.body)
+    assert_equal "invalid_file_type", json_response["error"]
+  end
+
+  test "should clean up Sure import if row sync fails" do
+    ndjson_content = { type: "Account", data: { id: "account_1", name: "Checking" } }.to_json
+    SureImport.any_instance.stubs(:sync_ndjson_rows_count!).raises(StandardError, "sync failed")
+
+    assert_no_difference("Import.count") do
+      post api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             raw_file_content: ndjson_content
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :internal_server_error
+    json_response = JSON.parse(response.body)
+    assert_equal "internal_server_error", json_response["error"]
+  end
+
+  test "should clean up Sure import if row sync validation fails" do
+    ndjson_content = { type: "Account", data: { id: "account_1", name: "Checking" } }.to_json
+    invalid_import = SureImport.new
+    invalid_import.errors.add(:base, "invalid rows")
+    SureImport.any_instance.stubs(:sync_ndjson_rows_count!).raises(ActiveRecord::RecordInvalid.new(invalid_import))
+
+    assert_no_difference("Import.count") do
+      post api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             raw_file_content: ndjson_content
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    json_response = JSON.parse(response.body)
+    assert_equal "validation_failed", json_response["error"]
+    assert_includes json_response["errors"], "invalid rows"
+  end
+
+  test "should preserve Sure import if publish queueing fails" do
+    ndjson_content = { type: "Account", data: { id: "account_1", name: "Checking" } }.to_json
+    ImportJob.stubs(:perform_later).raises(StandardError, "queue offline")
+
+    assert_difference("Import.count") do
+      post api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             raw_file_content: ndjson_content,
+             publish: "true"
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :internal_server_error
+    json_response = JSON.parse(response.body)
+    assert_equal "publish_failed", json_response["error"]
+
+    import = Import.find(json_response["import_id"])
+    assert_instance_of SureImport, import
+    assert import.ndjson_file.attached?
+    assert_equal 1, import.rows_count
+    assert_equal "pending", import.status
+  end
+
+  test "should preserve Sure import if auto publish exceeds row count" do
+    ndjson_content = { type: "Account", data: { id: "account_1", name: "Checking" } }.to_json
+    SureImport.any_instance.stubs(:publish_later).raises(Import::MaxRowCountExceededError)
+
+    assert_difference("Import.count") do
+      post api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             raw_file_content: ndjson_content,
+             publish: "true"
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    json_response = JSON.parse(response.body)
+    assert_equal "max_row_count_exceeded", json_response["error"]
+
+    import = Import.find(json_response["import_id"])
+    assert_instance_of SureImport, import
+    assert import.ndjson_file.attached?
+    assert_equal 1, import.rows_count
+  end
+
+  test "should reject invalid Sure import NDJSON content" do
+    assert_no_difference("Import.count") do
+      post api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             raw_file_content: "not ndjson"
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    json_response = JSON.parse(response.body)
+    assert_equal "invalid_ndjson", json_response["error"]
+  end
+
+  test "should preflight CSV import without persisting records" do
+    csv_content = "date,amount,name\n2023-01-01,-10.00,Test Transaction"
+
+    assert_no_difference([ "Import.count", "Import::Row.count" ]) do
+      post preflight_api_v1_imports_url,
+           params: {
+             raw_file_content: csv_content,
+             date_col_label: "date",
+             amount_col_label: "amount",
+             name_col_label: "name",
+             account_id: @account.id
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    data = json_response["data"]
+
+    assert_equal "TransactionImport", data["type"]
+    assert_equal true, data["valid"]
+    assert_equal 1, data["stats"]["rows_count"]
+    assert_not data["stats"].key?("valid_rows_count")
+    assert_not data["stats"].key?("invalid_rows_count")
+    assert_equal %w[date amount name], data["headers"]
+    assert_empty data["missing_required_headers"]
+    assert_empty data["errors"]
+  end
+
+  test "should report missing required CSV headers during preflight" do
+    csv_content = "name\nMissing Amount"
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             raw_file_content: csv_content,
+             date_col_label: "date",
+             amount_col_label: "amount",
+             name_col_label: "name",
+             account_id: @account.id
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :success
+    data = JSON.parse(response.body)["data"]
+
+    assert_equal false, data["valid"]
+    assert_equal 1, data["stats"]["rows_count"]
+    assert_not data["stats"].key?("valid_rows_count")
+    assert_not data["stats"].key?("invalid_rows_count")
+    assert_equal [ "date", "amount" ], data["missing_required_headers"]
+    assert_equal "missing_required_headers", data["errors"].first["code"]
+  end
+
+  test "should apply rows_to_skip before CSV preflight header validation" do
+    csv_content = [
+      "Generated by bank export",
+      "posted,amount,description",
+      "2024-01-01,-10.00,Coffee"
+    ].join("\n")
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             raw_file_content: csv_content,
+             rows_to_skip: 1,
+             date_col_label: "posted",
+             amount_col_label: "amount",
+             name_col_label: "description",
+             account_id: @account.id
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :success
+    data = JSON.parse(response.body)["data"]
+
+    assert_equal true, data["valid"]
+    assert_equal 1, data["stats"]["rows_count"]
+    assert_equal %w[posted amount description], data["headers"]
+    assert_empty data["missing_required_headers"]
+  end
+
+  test "should preflight semicolon separated CSV content" do
+    csv_content = "date;amount;name\n2024-01-01;-10.00;Coffee"
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             raw_file_content: csv_content,
+             col_sep: ";",
+             date_col_label: "date",
+             amount_col_label: "amount",
+             name_col_label: "name",
+             account_id: @account.id
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :success
+    data = JSON.parse(response.body)["data"]
+
+    assert_equal true, data["valid"]
+    assert_equal 1, data["stats"]["rows_count"]
+    assert_equal %w[date amount name], data["headers"]
+  end
+
+  test "should report invalid preflight CSV parser config without parsing" do
+    csv_content = "date,amount,name\n2024-01-01,-10.00,Coffee"
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             raw_file_content: csv_content,
+             col_sep: "",
+             date_col_label: "date",
+             amount_col_label: "amount",
+             name_col_label: "name",
+             account_id: @account.id
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :success
+    data = JSON.parse(response.body)["data"]
+
+    assert_equal false, data["valid"]
+    assert_equal 0, data["stats"]["rows_count"]
+    assert_empty data["headers"]
+    assert_equal "validation_failed", data["errors"].first["code"]
+  end
+
+  test "should reject malformed CSV during preflight" do
+    csv_content = "date,amount,name\n2024-01-01,-10.00,\"Coffee Shop"
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             raw_file_content: csv_content,
+             date_col_label: "date",
+             amount_col_label: "amount",
+             name_col_label: "name",
+             account_id: @account.id
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :unprocessable_entity
+    json_response = JSON.parse(response.body)
+    assert_equal "invalid_csv", json_response["error"]
+  end
+
+  test "should include preflight exception message in internal server error response" do
+    Import::Preflight.any_instance.stubs(:call).raises(StandardError, "boom")
+
+    post preflight_api_v1_imports_url,
+         params: {
+           raw_file_content: "date,amount,name\n2024-01-01,-10.00,Coffee",
+           date_col_label: "date",
+           amount_col_label: "amount",
+           name_col_label: "name"
+         },
+         headers: api_headers(@read_only_api_key)
+
+    assert_response :internal_server_error
+    json_response = JSON.parse(response.body)
+    assert_equal "internal_server_error", json_response["error"]
+    assert_equal "Error: boom", json_response["message"]
+  end
+
+  test "should reject unknown preflight import type" do
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             type: "FakeImport",
+             raw_file_content: "date,amount,name\n2023-01-01,-10.00,Test Transaction"
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "invalid_import_type", response_data["error"]
+    assert_not response_data.key?("errors")
+  end
+
+  test "should reject import types excluded from preflight" do
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             type: "QifImport",
+             raw_file_content: "!Type:Bank\nD01/01/2024\nT-10.00\nPTest\n^"
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "invalid_import_type", response_data["error"]
+    assert_not response_data.key?("errors")
+    assert_not_includes response_data["message"], "QifImport"
+    assert_not_includes response_data["message"], "PdfImport"
+  end
+
+  test "should report empty CSV preflight content as invalid" do
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             raw_file_content: "date,amount,name\n",
+             date_col_label: "date",
+             amount_col_label: "amount",
+             name_col_label: "name",
+             account_id: @account.id
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :success
+    data = JSON.parse(response.body)["data"]
+
+    assert_equal false, data["valid"]
+    assert_equal 0, data["stats"]["rows_count"]
+    assert_equal "no_data_rows", data["errors"].first["code"]
+    assert_empty data["warnings"]
+  end
+
+  test "should preflight Sure import without persisting records" do
+    ndjson_content = [
+      { type: "Account", data: { id: "account_1", name: "Checking" } }.to_json,
+      { type: "Transaction", data: { id: "entry_1", account_id: "account_1" } }.to_json
+    ].join("\n")
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             raw_file_content: ndjson_content
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :success
+    data = JSON.parse(response.body)["data"]
+
+    assert_equal "SureImport", data["type"]
+    assert_equal true, data["valid"]
+    assert_equal 2, data["stats"]["rows_count"]
+    assert_equal 1, data["stats"]["entity_counts"]["accounts"]
+    assert_equal 1, data["stats"]["entity_counts"]["transactions"]
+    assert_empty data["errors"]
+  end
+
+  test "should report invalid Sure import NDJSON during preflight" do
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             raw_file_content: "not ndjson"
+           },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :success
+    data = JSON.parse(response.body)["data"]
+
+    assert_equal false, data["valid"]
+    assert_equal 1, data["stats"]["invalid_rows_count"]
+    assert_equal "invalid_json", data["errors"].first["code"]
+  end
+
+  test "should report non-object Sure import NDJSON records during preflight" do
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             raw_file_content: "[]"
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :success
+    data = JSON.parse(response.body)["data"]
+
+    assert_equal false, data["valid"]
+    assert_equal 1, data["stats"]["invalid_rows_count"]
+    assert_equal "invalid_ndjson_record", data["errors"].first["code"]
+  end
+
+  test "should report empty Sure import file as invalid during preflight" do
+    empty_file = Rack::Test::UploadedFile.new(
+      StringIO.new(""),
+      "application/x-ndjson",
+      original_filename: "empty.ndjson"
+    )
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             type: "SureImport",
+             file: empty_file
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :success
+    data = JSON.parse(response.body)["data"]
+
+    assert_equal false, data["valid"]
+    assert_equal 0, data["stats"]["rows_count"]
+    assert_equal "no_data_rows", data["errors"].first["code"]
+    assert_empty data["warnings"]
+  end
+
+  test "should reject preflight with no file or raw content" do
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: { type: "SureImport" },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    assert_equal "missing_content", JSON.parse(response.body)["error"]
+  end
+
+  test "should reject oversized file uploads during preflight" do
+    test_limit = 1.kilobyte
+    large_file = Rack::Test::UploadedFile.new(
+      StringIO.new("x" * (test_limit + 1)),
+      "text/csv",
+      original_filename: "large.csv"
+    )
+
+    Import.stubs(:max_csv_size).returns(test_limit)
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: { file: large_file },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :unprocessable_entity
+    assert_equal "file_too_large", JSON.parse(response.body)["error"]
+  end
+
+  test "should preflight with read-only API key" do
+    csv_content = "date,amount,name\n2023-01-01,-10.00,Test Transaction"
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             raw_file_content: csv_content,
+             date_col_label: "date",
+             amount_col_label: "amount",
+             name_col_label: "name",
+             account_id: @account.id
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :success
+    assert_equal true, JSON.parse(response.body)["data"]["valid"]
+  end
+
+  test "should require authentication for preflight" do
+    post preflight_api_v1_imports_url, params: {
+      raw_file_content: "date,amount,name\n2023-01-01,-10.00,Test Transaction"
+    }
+
+    assert_response :unauthorized
+  end
+
+  test "should return not found for preflight account outside family" do
+    other_family = Family.create!(name: "Other Family", currency: "USD", locale: "en")
+    other_depository = Depository.create!(subtype: "checking")
+    other_account = Account.create!(
+      family: other_family,
+      name: "Other Account",
+      currency: "USD",
+      classification: "asset",
+      accountable: other_depository,
+      balance: 0
+    )
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             raw_file_content: "date,amount,name\n2023-01-01,-10.00,Test Transaction",
+             date_col_label: "date",
+             amount_col_label: "amount",
+             name_col_label: "name",
+             account_id: other_account.id
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :not_found
+    assert_equal "record_not_found", JSON.parse(response.body)["error"]
+  end
+
+  test "should return not found for malformed preflight account id" do
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             raw_file_content: "date,amount,name\n2023-01-01,-10.00,Test Transaction",
+             date_col_label: "date",
+             amount_col_label: "amount",
+             name_col_label: "name",
+             account_id: "not-a-uuid"
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :not_found
+    assert_equal "record_not_found", JSON.parse(response.body)["error"]
+  end
+
+  test "should apply Mint defaults before preflight header validation" do
+    mint_content = [
+      "Date,Amount,Account Name,Description,Category,Labels,Currency,Notes,Transaction Type",
+      "01/01/2024,-8.55,Checking,Starbucks,Food & Drink,Coffee,USD,Morning coffee,debit"
+    ].join("\n")
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             type: "MintImport",
+             raw_file_content: mint_content
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :success
+    data = JSON.parse(response.body)["data"]
+
+    assert_equal "MintImport", data["type"]
+    assert_equal true, data["valid"]
+    assert_empty data["missing_required_headers"]
+    assert_includes data["required_headers"], "Date"
+    assert_includes data["required_headers"], "Amount"
+  end
+
+  test "should apply Actual defaults before preflight header validation" do
+    actual_content = [
+      "Account,Date,Payee,Notes,Category_Group,Category,Amount,Split_Amount,Cleared",
+      "Checking Account,2024-01-01,Coffee Shop,Morning coffee,Food,Coffee,-4.25,0,Cleared"
+    ].join("\n")
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             type: "ActualImport",
+             raw_file_content: actual_content
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :success
+    data = JSON.parse(response.body)["data"]
+
+    assert_equal "ActualImport", data["type"]
+    assert_equal true, data["valid"]
+    assert_empty data["missing_required_headers"]
+    assert_includes data["required_headers"], "Date"
+    assert_includes data["required_headers"], "Amount"
+  end
+
+  test "should not overwrite explicit Actual preflight column mappings with defaults" do
+    actual_content = [
+      "Booked On,Value,Payee",
+      "2024-01-01,-4.25,Coffee Shop"
+    ].join("\n")
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             type: "ActualImport",
+             raw_file_content: actual_content,
+             date_col_label: "Booked On",
+             amount_col_label: "Value"
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :success
+    data = JSON.parse(response.body)["data"]
+
+    assert_equal true, data["valid"]
+    assert_equal [ "Booked On", "Value" ], data["required_headers"]
+    assert_empty data["missing_required_headers"]
+  end
+
+  test "should not overwrite explicit Mint preflight column mappings with defaults" do
+    mint_content = [
+      "Posted On,Value,Description",
+      "01/01/2024,-8.55,Starbucks"
+    ].join("\n")
+
+    assert_no_difference("Import.count") do
+      post preflight_api_v1_imports_url,
+           params: {
+             type: "MintImport",
+             raw_file_content: mint_content,
+             date_col_label: "Posted On",
+             amount_col_label: "Value"
+           },
+           headers: api_headers(@read_only_api_key)
+    end
+
+    assert_response :success
+    data = JSON.parse(response.body)["data"]
+
+    assert_equal true, data["valid"]
+    assert_equal [ "Posted On", "Value" ], data["required_headers"]
+    assert_empty data["missing_required_headers"]
+  end
+
   test "should create import and auto-publish when configured and requested" do
     csv_content = "date,amount,name\n2023-01-01,-10.00,Test Transaction"
 
@@ -213,9 +1186,7 @@ class Api::V1::ImportsControllerTest < ActionDispatch::IntegrationTest
     test_limit = 1.kilobyte
     large_content = "x" * (test_limit + 1)
 
-    original_value = Import::MAX_CSV_SIZE
-    Import.send(:remove_const, :MAX_CSV_SIZE)
-    Import.const_set(:MAX_CSV_SIZE, test_limit)
+    Import.stubs(:max_csv_size).returns(test_limit)
 
     assert_no_difference("Import.count") do
       post api_v1_imports_url,
@@ -226,9 +1197,6 @@ class Api::V1::ImportsControllerTest < ActionDispatch::IntegrationTest
     assert_response :unprocessable_entity
     json_response = JSON.parse(response.body)
     assert_equal "content_too_large", json_response["error"]
-  ensure
-    Import.send(:remove_const, :MAX_CSV_SIZE)
-    Import.const_set(:MAX_CSV_SIZE, original_value)
   end
 
   test "should accept file upload with valid csv mime type" do
@@ -256,7 +1224,11 @@ class Api::V1::ImportsControllerTest < ActionDispatch::IntegrationTest
 
   private
 
+    def build_ndjson(records)
+      records.map(&:to_json).join("\n")
+    end
+
     def api_headers(api_key)
-      { "X-Api-Key" => api_key.display_key }
+      { "X-Api-Key" => api_key.plain_key }
     end
 end
diff --git a/test/controllers/api/v1/messages_controller_test.rb b/test/controllers/api/v1/messages_controller_test.rb
index da0ff01f4..c4bc627b2 100644
--- a/test/controllers/api/v1/messages_controller_test.rb
+++ b/test/controllers/api/v1/messages_controller_test.rb
@@ -37,7 +37,7 @@ class Api::V1::MessagesControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should create message with write scope" do
-    assert_difference "Message.count" do
+    assert_difference "UserMessage.count" do
       post "/api/v1/chats/#{@chat.id}/messages",
         params: { content: "Test message", model: "gpt-4" },
         headers: bearer_auth_header(@write_token)
diff --git a/test/controllers/api/v1/provider_connections_controller_test.rb b/test/controllers/api/v1/provider_connections_controller_test.rb
new file mode 100644
index 000000000..957b5aa31
--- /dev/null
+++ b/test/controllers/api/v1/provider_connections_controller_test.rb
@@ -0,0 +1,221 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::ProviderConnectionsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+    @mercury_item = mercury_items(:one)
+
+    @user.api_keys.active.destroy_all
+
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      display_key: "test_read_#{SecureRandom.hex(8)}",
+      source: "web"
+    )
+
+    @read_write_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read-Write Key",
+      scopes: [ "read_write" ],
+      display_key: "test_rw_#{SecureRandom.hex(8)}",
+      source: "mobile"
+    )
+
+    redis = Redis.new
+    redis.del("api_rate_limit:#{@api_key.id}")
+    redis.del("api_rate_limit:#{@read_write_key.id}")
+  end
+
+  test "lists provider connection status for current family" do
+    failed_sync = @mercury_item.syncs.create!(
+      status: "failed",
+      failed_at: Time.current,
+      error: "secret token failed"
+    )
+
+    get api_v1_provider_connections_url, headers: api_headers(@api_key)
+    assert_response :success
+
+    json_response = JSON.parse(response.body)
+    mercury_connection = json_response["data"].detect do |connection|
+      connection["id"] == @mercury_item.id && connection["provider"] == "mercury"
+    end
+
+    assert_not_nil mercury_connection
+    assert_equal "mercury", mercury_connection["provider"]
+    assert_equal "MercuryItem", mercury_connection["provider_type"]
+    assert_equal @mercury_item.name, mercury_connection["name"]
+    assert_equal @mercury_item.status, mercury_connection["status"]
+    assert_includes [ true, false ], mercury_connection["requires_update"]
+    assert_equal true, mercury_connection["credentials_configured"]
+    assert_includes [ true, false ], mercury_connection["scheduled_for_deletion"]
+    assert_includes [ true, false ], mercury_connection["pending_account_setup"]
+    assert_equal @mercury_item.mercury_accounts.count, mercury_connection["accounts"]["total_count"]
+    assert_equal failed_sync.id, mercury_connection["sync"]["latest"]["id"]
+    assert_equal true, mercury_connection["sync"]["latest"]["error"]["present"]
+    assert_equal "Sync failed", mercury_connection["sync"]["latest"]["error"]["message"]
+  end
+
+  test "reports failed sync errors as present without exposing raw messages" do
+    failed_sync = @mercury_item.syncs.create!(
+      status: "failed",
+      failed_at: Time.current,
+      error: nil
+    )
+
+    get api_v1_provider_connections_url, headers: api_headers(@api_key)
+    assert_response :success
+
+    mercury_connection = JSON.parse(response.body)["data"].detect do |connection|
+      connection["id"] == @mercury_item.id && connection["provider"] == "mercury"
+    end
+
+    assert_equal failed_sync.id, mercury_connection["sync"]["latest"]["id"]
+    assert_equal true, mercury_connection["sync"]["latest"]["error"]["present"]
+    assert_equal "Sync failed", mercury_connection["sync"]["latest"]["error"]["message"]
+  end
+
+  test "reports stale sync errors as present" do
+    stale_sync = @mercury_item.syncs.create!(
+      status: "stale",
+      syncing_at: 2.days.ago
+    )
+
+    get api_v1_provider_connections_url, headers: api_headers(@api_key)
+    assert_response :success
+
+    mercury_connection = JSON.parse(response.body)["data"].detect do |connection|
+      connection["id"] == @mercury_item.id && connection["provider"] == "mercury"
+    end
+
+    assert_equal stale_sync.id, mercury_connection["sync"]["latest"]["id"]
+    assert_equal true, mercury_connection["sync"]["latest"]["error"]["present"]
+    assert_equal "Sync became stale before completion", mercury_connection["sync"]["latest"]["error"]["message"]
+  end
+
+  test "does not expose provider secrets or raw sync errors" do
+    @mercury_item.syncs.create!(
+      status: "failed",
+      failed_at: Time.current,
+      error: "raw provider token secret"
+    )
+    kraken_item = kraken_items(:one)
+    kraken_item.syncs.create!(
+      status: "failed",
+      failed_at: Time.current,
+      error: "raw kraken key secret"
+    )
+
+    get api_v1_provider_connections_url, headers: api_headers(@api_key)
+    assert_response :success
+
+    json_response = JSON.parse(response.body)
+    kraken_connection = json_response["data"].detect do |connection|
+      connection["id"] == kraken_item.id && connection["provider"] == "kraken"
+    end
+
+    assert_not_nil kraken_connection
+    assert_equal "KrakenItem", kraken_connection["provider_type"]
+    refute_includes response.body, @mercury_item.token
+    refute_includes response.body, kraken_item.api_key
+    refute_includes response.body, kraken_item.api_secret
+    refute_includes response.body, "raw provider token secret"
+    refute_includes response.body, "raw kraken key secret"
+  end
+
+  test "fails closed when credential readiness is unknown" do
+    get api_v1_provider_connections_url, headers: api_headers(@api_key)
+    assert_response :success
+
+    plaid_connection = JSON.parse(response.body)["data"].detect do |connection|
+      connection["provider"] == "plaid"
+    end
+
+    assert_not_nil plaid_connection
+    assert_includes [ true, false ], plaid_connection["requires_update"]
+    assert_equal false, plaid_connection["credentials_configured"]
+    assert_includes [ true, false ], plaid_connection["scheduled_for_deletion"]
+    assert_includes [ true, false ], plaid_connection["pending_account_setup"]
+  end
+
+  test "excludes another family's provider connections" do
+    other_item = snaptrade_items(:pending_registration_item)
+
+    get api_v1_provider_connections_url, headers: api_headers(@api_key)
+    assert_response :success
+
+    ids = JSON.parse(response.body)["data"].map { |connection| connection["id"] }
+    assert_not_includes ids, other_item.id
+  end
+
+  test "read_write key can list provider connection status" do
+    get api_v1_provider_connections_url, headers: api_headers(@read_write_key)
+    assert_response :success
+  end
+
+  test "lists Brex provider connection status" do
+    brex_item = brex_items(:one)
+
+    get api_v1_provider_connections_url, headers: api_headers(@api_key)
+    assert_response :success
+
+    brex_connection = JSON.parse(response.body)["data"].detect do |connection|
+      connection["id"] == brex_item.id && connection["provider"] == "brex"
+    end
+
+    assert_not_nil brex_connection
+    assert_equal "BrexItem", brex_connection["provider_type"]
+    assert_equal brex_item.name, brex_connection["name"]
+    assert_equal brex_item.brex_accounts.count, brex_connection["accounts"]["total_count"]
+    assert_equal brex_item.linked_accounts_count, brex_connection["accounts"]["linked_count"]
+    assert_equal brex_item.unlinked_accounts_count, brex_connection["accounts"]["unlinked_count"]
+  end
+
+  test "returns an empty list when no provider connections exist" do
+    ProviderConnectionStatus.stub(:for_family, []) do
+      get api_v1_provider_connections_url, headers: api_headers(@api_key)
+    end
+
+    assert_response :success
+    assert_equal [], JSON.parse(response.body)["data"]
+  end
+
+  test "requires authentication" do
+    get api_v1_provider_connections_url
+    assert_response :unauthorized
+  end
+
+  test "rejects api keys without read scope" do
+    write_only_key = ApiKey.new(
+      user: @user,
+      name: "Test Write Key",
+      scopes: [ "write" ],
+      display_key: "test_write_#{SecureRandom.hex(8)}",
+      source: "monitoring"
+    ).tap { |api_key| api_key.save!(validate: false) }
+
+    get api_v1_provider_connections_url, headers: api_headers(write_only_key)
+    assert_response :forbidden
+  end
+
+  test "does not leak internal provider status errors" do
+    ProviderConnectionStatus.stub(:for_family, ->(_family) { raise StandardError, "secret provider failure" }) do
+      get api_v1_provider_connections_url, headers: api_headers(@api_key)
+    end
+
+    assert_response :internal_server_error
+    assert_equal "internal_server_error", JSON.parse(response.body)["error"]
+    refute_includes response.body, "secret provider failure"
+  end
+
+  private
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.plain_key }
+    end
+end
diff --git a/test/controllers/api/v1/recurring_transactions_controller_test.rb b/test/controllers/api/v1/recurring_transactions_controller_test.rb
new file mode 100644
index 000000000..f03f08639
--- /dev/null
+++ b/test/controllers/api/v1/recurring_transactions_controller_test.rb
@@ -0,0 +1,509 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::RecurringTransactionsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+    @account = accounts(:depository)
+    @merchant = @family.merchants.create!(name: "Streaming Service")
+
+    @user.api_keys.active.destroy_all
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read-Write Key",
+      scopes: [ "read_write" ],
+      source: "web",
+      display_key: "test_rw_#{SecureRandom.hex(8)}"
+    )
+    @read_only_api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      display_key: "test_read_#{SecureRandom.hex(8)}",
+      source: "mobile"
+    )
+
+    @recurring_transaction = @family.recurring_transactions.create!(
+      account: @account,
+      merchant: @merchant,
+      amount: 19.99,
+      currency: "USD",
+      expected_day_of_month: 15,
+      last_occurrence_date: Date.new(2026, 4, 15),
+      next_expected_date: Date.new(2026, 5, 15),
+      status: "active",
+      occurrence_count: 3,
+      manual: true
+    )
+  end
+
+  test "should list recurring transactions" do
+    get api_v1_recurring_transactions_url, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert response_data.key?("recurring_transactions")
+    assert response_data.key?("pagination")
+    assert_includes response_data["recurring_transactions"].map { |item| item["id"] }, @recurring_transaction.id
+  end
+
+  test "should require authentication when listing recurring transactions" do
+    get api_v1_recurring_transactions_url
+
+    assert_response :unauthorized
+  end
+
+  test "should show recurring transaction" do
+    get api_v1_recurring_transaction_url(@recurring_transaction), headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_equal @recurring_transaction.id, response_data["id"]
+    assert_equal 1999, response_data["amount_cents"]
+    assert response_data.key?("expected_amount_min_cents")
+    assert response_data.key?("expected_amount_max_cents")
+    assert response_data.key?("expected_amount_avg_cents")
+    assert_equal @account.id, response_data["account"]["id"]
+    assert_equal @merchant.id, response_data["merchant"]["id"]
+  end
+
+  test "should not mutate recurring transaction on read only shared account" do
+    member = users(:family_member)
+    member.api_keys.active.destroy_all
+    member_api_key = ApiKey.create!(
+      user: member,
+      name: "Member Read-Write Key",
+      scopes: [ "read_write" ],
+      source: "web",
+      display_key: "test_member_rw_#{SecureRandom.hex(8)}"
+    )
+    read_only_account = accounts(:credit_card)
+    recurring_transaction = @family.recurring_transactions.create!(
+      account: read_only_account,
+      name: "Read Only Shared Subscription",
+      amount: 9.99,
+      currency: "USD",
+      expected_day_of_month: 5,
+      last_occurrence_date: Date.new(2026, 4, 5),
+      next_expected_date: Date.new(2026, 5, 5),
+      status: "active",
+      occurrence_count: 2,
+      manual: true
+    )
+
+    get api_v1_recurring_transaction_url(recurring_transaction), headers: api_headers(member_api_key)
+    assert_response :success
+
+    patch api_v1_recurring_transaction_url(recurring_transaction),
+          params: { recurring_transaction: { status: "inactive" } },
+          headers: api_headers(member_api_key)
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+
+    assert_no_difference("@family.recurring_transactions.count") do
+      delete api_v1_recurring_transaction_url(recurring_transaction), headers: api_headers(member_api_key)
+    end
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "should return not found for missing recurring transaction" do
+    get api_v1_recurring_transaction_url(SecureRandom.uuid), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "should return not found for malformed recurring transaction id" do
+    get api_v1_recurring_transaction_url("not-a-uuid"), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "should reject malformed account filter" do
+    get api_v1_recurring_transactions_url,
+        params: { account_id: "not-a-uuid" },
+        headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "should require authentication when showing recurring transaction" do
+    get api_v1_recurring_transaction_url(@recurring_transaction)
+
+    assert_response :unauthorized
+  end
+
+  test "should create recurring transaction" do
+    assert_difference("@family.recurring_transactions.count", 1) do
+      post api_v1_recurring_transactions_url,
+           params: valid_recurring_transaction_params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :created
+    response_data = JSON.parse(response.body)
+    assert_equal "Gym Membership", response_data["name"]
+    assert_equal 4999, response_data["amount_cents"]
+    assert_equal true, response_data["manual"]
+  end
+
+  test "should default null manual to true when creating recurring transaction" do
+    params = valid_recurring_transaction_params.deep_dup
+    params[:recurring_transaction][:manual] = nil
+
+    assert_difference("@family.recurring_transactions.count", 1) do
+      post api_v1_recurring_transactions_url,
+           params: params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :created
+    response_data = JSON.parse(response.body)
+    assert_equal true, response_data["manual"]
+  end
+
+  test "should require authentication when creating recurring transaction" do
+    post api_v1_recurring_transactions_url, params: valid_recurring_transaction_params
+
+    assert_response :unauthorized
+  end
+
+  test "should reject create with read-only API key" do
+    post api_v1_recurring_transactions_url,
+         params: valid_recurring_transaction_params,
+         headers: api_headers(@read_only_api_key)
+
+    assert_response :forbidden
+  end
+
+  test "should reject create without recurring transaction wrapper" do
+    assert_no_difference("@family.recurring_transactions.count") do
+      post api_v1_recurring_transactions_url,
+           params: { name: "Gym Membership" },
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "should reject create with malformed account id" do
+    params = valid_recurring_transaction_params.deep_dup
+    params[:recurring_transaction][:account_id] = "not-a-uuid"
+
+    assert_no_difference("@family.recurring_transactions.count") do
+      post api_v1_recurring_transactions_url,
+           params: params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "should reject create with malformed merchant id" do
+    params = valid_recurring_transaction_params.deep_dup
+    params[:recurring_transaction].delete(:name)
+    params[:recurring_transaction][:merchant_id] = "not-a-uuid"
+
+    assert_no_difference("@family.recurring_transactions.count") do
+      post api_v1_recurring_transactions_url,
+           params: params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "should reject create without name or merchant" do
+    params = valid_recurring_transaction_params.deep_dup
+    params[:recurring_transaction].delete(:name)
+
+    post api_v1_recurring_transactions_url,
+         params: params,
+         headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "should reject create without required dates" do
+    params = valid_recurring_transaction_params.deep_dup
+    params[:recurring_transaction].delete(:last_occurrence_date)
+    params[:recurring_transaction].delete(:next_expected_date)
+
+    assert_no_difference("@family.recurring_transactions.count") do
+      post api_v1_recurring_transactions_url,
+           params: params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+    assert_includes response_data["errors"], "Last occurrence date can't be blank"
+    assert_includes response_data["errors"], "Next expected date can't be blank"
+  end
+
+  test "should reject create with nil status" do
+    params = valid_recurring_transaction_params.deep_dup
+    params[:recurring_transaction][:status] = nil
+
+    assert_no_difference("@family.recurring_transactions.count") do
+      post api_v1_recurring_transactions_url,
+           params: params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+    assert_includes response_data["errors"], "Status can't be blank"
+  end
+
+  test "should reject create with negative occurrence count" do
+    params = valid_recurring_transaction_params.deep_dup
+    params[:recurring_transaction][:occurrence_count] = -1
+
+    assert_no_difference("@family.recurring_transactions.count") do
+      post api_v1_recurring_transactions_url,
+           params: params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+    assert_includes response_data["errors"], "Occurrence count must be greater than or equal to 0"
+  end
+
+  test "should return conflict when creating duplicate recurring transaction" do
+    params = {
+      recurring_transaction: {
+        account_id: @account.id,
+        merchant_id: @merchant.id,
+        amount: @recurring_transaction.amount.to_s,
+        currency: @recurring_transaction.currency,
+        expected_day_of_month: 15,
+        last_occurrence_date: "2026-04-15",
+        next_expected_date: "2026-05-15"
+      }
+    }
+
+    # The unique index intentionally ignores recurrence dates; matching family,
+    # account, merchant, amount, and currency is enough to conflict.
+    assert_no_difference("@family.recurring_transactions.count") do
+      post api_v1_recurring_transactions_url,
+           params: params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :conflict
+    response_data = JSON.parse(response.body)
+    assert_equal "conflict", response_data["error"]
+    assert_equal "Recurring transaction already exists", response_data["message"]
+  end
+
+  test "should update recurring transaction" do
+    patch api_v1_recurring_transaction_url(@recurring_transaction),
+          params: { recurring_transaction: { status: "inactive", expected_day_of_month: 16 } },
+          headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_equal "inactive", response_data["status"]
+    assert_equal 16, response_data["expected_day_of_month"]
+  end
+
+  test "should require authentication when updating recurring transaction" do
+    patch api_v1_recurring_transaction_url(@recurring_transaction),
+          params: { recurring_transaction: { status: "inactive" } }
+
+    assert_response :unauthorized
+  end
+
+  test "should reject update with read-only API key" do
+    patch api_v1_recurring_transaction_url(@recurring_transaction),
+          params: { recurring_transaction: { status: "inactive" } },
+          headers: api_headers(@read_only_api_key)
+
+    assert_response :forbidden
+  end
+
+  test "should reject update without recurring transaction wrapper" do
+    patch api_v1_recurring_transaction_url(@recurring_transaction),
+          params: { status: "inactive" },
+          headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "should reject update with invalid status" do
+    patch api_v1_recurring_transaction_url(@recurring_transaction),
+          params: { recurring_transaction: { status: "paused" } },
+          headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "should reject update with nil status" do
+    patch api_v1_recurring_transaction_url(@recurring_transaction),
+          params: { recurring_transaction: { status: nil } },
+          headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+    assert_includes response_data["errors"], "Status can't be blank"
+  end
+
+  test "should reject update with nil next expected date" do
+    patch api_v1_recurring_transaction_url(@recurring_transaction),
+          params: { recurring_transaction: { next_expected_date: nil } },
+          headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+    assert_includes response_data["errors"], "Next expected date can't be blank"
+  end
+
+  test "should ignore internal fields on update" do
+    patch api_v1_recurring_transaction_url(@recurring_transaction),
+          params: {
+            recurring_transaction: {
+              status: "inactive",
+              occurrence_count: 99,
+              manual: false,
+              amount: 1.23
+            }
+          },
+          headers: api_headers(@api_key)
+
+    assert_response :success
+    @recurring_transaction.reload
+    assert_equal "inactive", @recurring_transaction.status
+    assert_equal 3, @recurring_transaction.occurrence_count
+    assert_equal true, @recurring_transaction.manual
+    assert_equal 19.99, @recurring_transaction.amount.to_f
+  end
+
+  test "should return not found when updating missing recurring transaction" do
+    patch api_v1_recurring_transaction_url(SecureRandom.uuid),
+          params: { recurring_transaction: { status: "inactive" } },
+          headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "should reject invalid recurring transaction update" do
+    patch api_v1_recurring_transaction_url(@recurring_transaction),
+          params: { recurring_transaction: { expected_day_of_month: 32 } },
+          headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "should destroy recurring transaction" do
+    assert_difference("@family.recurring_transactions.count", -1) do
+      delete api_v1_recurring_transaction_url(@recurring_transaction), headers: api_headers(@api_key)
+    end
+
+    assert_response :ok
+  end
+
+  test "should require authentication when destroying recurring transaction" do
+    delete api_v1_recurring_transaction_url(@recurring_transaction)
+
+    assert_response :unauthorized
+  end
+
+  test "should reject destroy with read-only API key" do
+    delete api_v1_recurring_transaction_url(@recurring_transaction), headers: api_headers(@read_only_api_key)
+
+    assert_response :forbidden
+  end
+
+  test "should return not found when destroying missing recurring transaction" do
+    delete api_v1_recurring_transaction_url(SecureRandom.uuid), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "should not create recurring transaction for another family account" do
+    other_family = Family.create!(name: "Other Family", currency: "USD", locale: "en")
+    other_account = Account.create!(
+      family: other_family,
+      name: "Other Checking",
+      currency: "USD",
+      classification: "asset",
+      accountable: Depository.create!,
+      balance: 0
+    )
+
+    post api_v1_recurring_transactions_url,
+         params: {
+           recurring_transaction: {
+             account_id: other_account.id,
+             name: "Gym Membership",
+             amount: 49.99,
+             currency: "USD",
+             expected_day_of_month: 1,
+             last_occurrence_date: "2026-04-01",
+             next_expected_date: "2026-05-01"
+           }
+         },
+         headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  private
+
+    def valid_recurring_transaction_params
+      {
+        recurring_transaction: {
+          account_id: @account.id,
+          name: "Gym Membership",
+          amount: 49.99,
+          currency: "USD",
+          expected_day_of_month: 1,
+          last_occurrence_date: "2026-04-01",
+          next_expected_date: "2026-05-01",
+          status: "active",
+          occurrence_count: 1
+        }
+      }
+    end
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.plain_key }
+    end
+end
diff --git a/test/controllers/api/v1/rejected_transfers_controller_test.rb b/test/controllers/api/v1/rejected_transfers_controller_test.rb
new file mode 100644
index 000000000..ad64de5ea
--- /dev/null
+++ b/test/controllers/api/v1/rejected_transfers_controller_test.rb
@@ -0,0 +1,182 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::RejectedTransfersControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+    @user.api_keys.active.destroy_all
+
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      source: "web",
+      display_key: "test_read_#{SecureRandom.hex(8)}"
+    )
+
+    @account = @family.accounts.create!(
+      name: "Rejected Checking",
+      accountable: Depository.new,
+      balance: 500,
+      currency: "USD"
+    )
+    @destination_account = @family.accounts.create!(
+      name: "Rejected Savings",
+      accountable: Depository.new,
+      balance: 1000,
+      currency: "USD"
+    )
+
+    outflow = create_transaction(@account, amount: 25, date: Date.parse("2024-01-15"), name: "Rejected outflow")
+    inflow = create_transaction(@destination_account, amount: -25, date: Date.parse("2024-01-15"), name: "Rejected inflow")
+    @rejected_transfer = RejectedTransfer.create!(
+      outflow_transaction: outflow,
+      inflow_transaction: inflow
+    )
+
+    other_family = families(:empty)
+    other_account = other_family.accounts.create!(name: "Other Rejected Checking", accountable: Depository.new, balance: 0, currency: "USD")
+    other_destination = other_family.accounts.create!(name: "Other Rejected Savings", accountable: Depository.new, balance: 0, currency: "USD")
+    other_outflow = create_transaction(other_account, amount: 50, date: Date.parse("2024-01-15"), name: "Other rejected outflow")
+    other_inflow = create_transaction(other_destination, amount: -50, date: Date.parse("2024-01-15"), name: "Other rejected inflow")
+    @other_rejected_transfer = RejectedTransfer.create!(outflow_transaction: other_outflow, inflow_transaction: other_inflow)
+  end
+
+  test "lists rejected transfers scoped to the current family" do
+    get api_v1_rejected_transfers_url, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert response_data.key?("rejected_transfers")
+    assert response_data.key?("pagination")
+    assert_includes response_data["rejected_transfers"].map { |transfer| transfer["id"] }, @rejected_transfer.id
+    assert_not_includes response_data["rejected_transfers"].map { |transfer| transfer["id"] }, @other_rejected_transfer.id
+  end
+
+  test "permits read write scope" do
+    read_write_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Write Key",
+      scopes: [ "read_write" ],
+      source: "mobile",
+      display_key: "test_read_write_#{SecureRandom.hex(8)}"
+    )
+
+    get api_v1_rejected_transfers_url, headers: api_headers(read_write_key)
+
+    assert_response :success
+  end
+
+  test "shows a rejected transfer" do
+    get api_v1_rejected_transfer_url(@rejected_transfer), headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_equal @rejected_transfer.id, response_data["id"]
+    assert_equal "Rejected Savings", response_data.dig("inflow_transaction", "account", "name")
+    assert_equal "Rejected Checking", response_data.dig("outflow_transaction", "account", "name")
+  end
+
+  test "returns not found for another family's rejected transfer" do
+    get api_v1_rejected_transfer_url(@other_rejected_transfer), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "returns not found for malformed rejected transfer id" do
+    get api_v1_rejected_transfer_url("not-a-uuid"), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "filters rejected transfers by account_id" do
+    get api_v1_rejected_transfers_url, params: { account_id: @account.id }, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_includes response_data["rejected_transfers"].map { |transfer| transfer["id"] }, @rejected_transfer.id
+  end
+
+  test "rejects malformed account_id filter" do
+    get api_v1_rejected_transfers_url, params: { account_id: "not-a-uuid" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "rejects invalid date filter" do
+    get api_v1_rejected_transfers_url, params: { start_date: "01/15/2024" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "filters rejected transfers when either transaction side date matches" do
+    matched_outflow = create_transaction(@account, amount: 35, date: Date.parse("2024-02-10"), name: "Rejected dated outflow")
+    matched_inflow = create_transaction(@destination_account, amount: -35, date: Date.parse("2024-02-10"), name: "Rejected dated inflow")
+    date_matched_transfer = RejectedTransfer.create!(outflow_transaction: matched_outflow, inflow_transaction: matched_inflow)
+
+    partial_outflow = create_transaction(@account, amount: 45, date: Date.parse("2024-02-10"), name: "Rejected partial outflow")
+    partial_inflow = create_transaction(@destination_account, amount: -45, date: Date.parse("2024-02-12"), name: "Rejected partial inflow")
+    partial_date_transfer = RejectedTransfer.create!(outflow_transaction: partial_outflow, inflow_transaction: partial_inflow)
+
+    get api_v1_rejected_transfers_url,
+        params: { start_date: "2024-02-10", end_date: "2024-02-10" },
+        headers: api_headers(@api_key)
+
+    assert_response :success
+    transfer_ids = JSON.parse(response.body)["rejected_transfers"].map { |transfer| transfer["id"] }
+    assert_includes transfer_ids, date_matched_transfer.id
+    assert_includes transfer_ids, partial_date_transfer.id
+    assert_not_includes transfer_ids, @rejected_transfer.id
+  end
+
+  test "requires authentication" do
+    get api_v1_rejected_transfers_url
+
+    assert_response :unauthorized
+  end
+
+  test "requires read scope" do
+    # ApiKey.create! rejects empty scopes; bypass validation to exercise runtime authorization.
+    api_key_without_read = ApiKey.new(
+      user: @user,
+      name: "No Read Key",
+      scopes: [],
+      source: "mobile",
+      display_key: "no_read_#{SecureRandom.hex(8)}"
+    )
+    api_key_without_read.save!(validate: false)
+
+    get api_v1_rejected_transfers_url, headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+  ensure
+    api_key_without_read&.destroy
+  end
+
+  private
+
+    def create_transaction(account, amount:, date:, name:)
+      entry = account.entries.create!(
+        date: date,
+        amount: amount,
+        name: name,
+        currency: account.currency,
+        entryable: Transaction.new(kind: "standard")
+      )
+      entry.entryable
+    end
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.display_key }
+    end
+end
diff --git a/test/controllers/api/v1/rule_runs_controller_test.rb b/test/controllers/api/v1/rule_runs_controller_test.rb
new file mode 100644
index 000000000..5db2c8afc
--- /dev/null
+++ b/test/controllers/api/v1/rule_runs_controller_test.rb
@@ -0,0 +1,207 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::RuleRunsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+
+    @user.api_keys.active.destroy_all
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      source: "web",
+      display_key: "test_read_#{SecureRandom.hex(8)}"
+    )
+    @redis = Redis.new
+    @redis.del("api_rate_limit:#{@api_key.id}")
+
+    @rule = @family.rules.build(
+      name: "Coffee cleanup",
+      resource_type: "transaction",
+      active: true,
+      effective_date: Date.new(2024, 1, 1)
+    )
+    @rule.conditions.build(condition_type: "transaction_name", operator: "like", value: "coffee")
+    @rule.actions.build(action_type: "set_transaction_name", value: "Coffee")
+    @rule.save!
+
+    @rule_run = @rule.rule_runs.create!(
+      rule_name: @rule.name,
+      execution_type: "manual",
+      status: "success",
+      transactions_queued: 10,
+      transactions_processed: 10,
+      transactions_modified: 4,
+      pending_jobs_count: 0,
+      executed_at: Time.zone.parse("2024-01-15 12:00:00")
+    )
+    @failed_rule_run = @rule.rule_runs.create!(
+      rule_name: @rule.name,
+      execution_type: "scheduled",
+      status: "failed",
+      transactions_queued: 5,
+      transactions_processed: 2,
+      transactions_modified: 0,
+      pending_jobs_count: 0,
+      executed_at: Time.zone.parse("2024-01-16 12:00:00"),
+      error_message: "Rule failed"
+    )
+  end
+
+  test "lists rule runs scoped to family rules" do
+    other_rule_run = create_other_family_rule_run
+
+    get api_v1_rule_runs_url, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    rule_run_ids = response_data["data"].map { |rule_run| rule_run["id"] }
+
+    assert_includes rule_run_ids, @rule_run.id
+    assert_includes rule_run_ids, @failed_rule_run.id
+    assert_not_includes rule_run_ids, other_rule_run.id
+    expected_count = RuleRun.joins(:rule).where(rules: { family_id: @family.id }).count
+    assert_equal expected_count, response_data["meta"]["total_count"]
+  end
+
+  test "shows a rule run" do
+    get api_v1_rule_run_url(@rule_run), headers: api_headers(@api_key)
+
+    assert_response :success
+    rule_run = JSON.parse(response.body)["data"]
+
+    assert_equal @rule_run.id, rule_run["id"]
+    assert_equal @rule.id, rule_run["rule_id"]
+    assert_equal "manual", rule_run["execution_type"]
+    assert_equal "success", rule_run["status"]
+    assert_equal 10, rule_run["transactions_queued"]
+    assert_equal 4, rule_run["transactions_modified"]
+    assert_equal @rule.id, rule_run.dig("rule", "id")
+  end
+
+  test "does not show another family's rule run" do
+    other_rule_run = create_other_family_rule_run
+
+    get api_v1_rule_run_url(other_rule_run), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "returns not found for malformed rule run id" do
+    get api_v1_rule_run_url("not-a-uuid"), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "filters rule runs" do
+    get api_v1_rule_runs_url,
+        params: {
+          rule_id: @rule.id,
+          status: "failed",
+          execution_type: "scheduled",
+          start_executed_at: "2024-01-16T00:00:00Z",
+          end_executed_at: "2024-01-17T00:00:00Z"
+        },
+        headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_equal [ @failed_rule_run.id ], response_data["data"].map { |rule_run| rule_run["id"] }
+  end
+
+  test "rejects invalid filters" do
+    get api_v1_rule_runs_url, params: { status: "unknown" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "clamps oversized per_page values to the documented maximum" do
+    get api_v1_rule_runs_url, params: { per_page: 500 }, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_equal 100, response_data["meta"]["per_page"]
+  end
+
+  test "rejects malformed rule_id filter" do
+    get api_v1_rule_runs_url, params: { rule_id: "not-a-uuid" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "rejects invalid timestamp filters" do
+    get api_v1_rule_runs_url, params: { start_executed_at: "not-a-date" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "requires authentication" do
+    get api_v1_rule_runs_url
+
+    assert_response :unauthorized
+  end
+
+  test "show requires authentication" do
+    get api_v1_rule_run_url(@rule_run)
+
+    assert_response :unauthorized
+  end
+
+  test "requires read scope" do
+    api_key_without_read = ApiKey.new(
+      user: @user,
+      name: "No Read Key",
+      scopes: [],
+      source: "web",
+      display_key: "no_read_#{SecureRandom.hex(8)}"
+    )
+    api_key_without_read.save!(validate: false)
+
+    get api_v1_rule_runs_url, headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+  ensure
+    api_key_without_read&.destroy
+  end
+
+  teardown do
+    @redis&.close
+  end
+
+  private
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.display_key }
+    end
+
+    def create_other_family_rule_run
+      other_family = Family.create!(name: "Other Family", currency: "USD", locale: "en")
+      other_rule = other_family.rules.build(name: "Other", resource_type: "transaction", active: true)
+      other_rule.conditions.build(condition_type: "transaction_name", operator: "like", value: "other")
+      other_rule.actions.build(action_type: "set_transaction_name", value: "Other")
+      other_rule.save!
+      other_rule.rule_runs.create!(
+        rule_name: other_rule.name,
+        execution_type: "manual",
+        status: "success",
+        transactions_queued: 1,
+        transactions_processed: 1,
+        transactions_modified: 1,
+        pending_jobs_count: 0,
+        executed_at: Time.current
+      )
+    end
+end
diff --git a/test/controllers/api/v1/rules_controller_test.rb b/test/controllers/api/v1/rules_controller_test.rb
new file mode 100644
index 000000000..5360aa73e
--- /dev/null
+++ b/test/controllers/api/v1/rules_controller_test.rb
@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::RulesControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+
+    @user.api_keys.active.destroy_all
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      source: "web",
+      display_key: "test_read_#{SecureRandom.hex(8)}"
+    )
+
+    Redis.new.del("api_rate_limit:#{@api_key.id}")
+
+    @rule = @family.rules.build(
+      name: "Coffee cleanup",
+      resource_type: "transaction",
+      active: true,
+      effective_date: Date.new(2024, 1, 1)
+    )
+    @rule.conditions.build(condition_type: "transaction_name", operator: "like", value: "coffee")
+    @rule.actions.build(action_type: "set_transaction_name", value: "Coffee")
+    @rule.save!
+  end
+
+  test "should list rules" do
+    get api_v1_rules_url, headers: api_headers(@api_key)
+    assert_response :success
+
+    json_response = JSON.parse(response.body)
+    assert json_response["data"].any? { |rule| rule["id"] == @rule.id }
+    assert_equal @family.rules.count, json_response["meta"]["total_count"]
+  end
+
+  test "should not list another family's rules" do
+    other_family = Family.create!(name: "Other Family", currency: "USD", locale: "en")
+    other_rule = other_family.rules.build(name: "Other", resource_type: "transaction", active: true)
+    other_rule.conditions.build(condition_type: "transaction_name", operator: "like", value: "other")
+    other_rule.actions.build(action_type: "set_transaction_name", value: "Other")
+    other_rule.save!
+
+    get api_v1_rules_url, headers: api_headers(@api_key)
+    assert_response :success
+
+    rule_ids = JSON.parse(response.body)["data"].map { |rule| rule["id"] }
+    assert_includes rule_ids, @rule.id
+    assert_not_includes rule_ids, other_rule.id
+  end
+
+  test "should require authentication when listing rules" do
+    get api_v1_rules_url
+
+    assert_response :unauthorized
+  end
+
+  test "should require read scope when listing rules" do
+    api_key_without_read = api_key_without_read_scope
+
+    get api_v1_rules_url, headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+    json_response = JSON.parse(response.body)
+    assert_equal "insufficient_scope", json_response["error"]
+  ensure
+    api_key_without_read&.destroy
+  end
+
+  test "should filter rules by active status" do
+    inactive_rule = @family.rules.build(name: "Inactive", resource_type: "transaction", active: false)
+    inactive_rule.conditions.build(condition_type: "transaction_name", operator: "like", value: "ignore")
+    inactive_rule.actions.build(action_type: "set_transaction_name", value: "Ignore")
+    inactive_rule.save!
+
+    get api_v1_rules_url, params: { active: true }, headers: api_headers(@api_key)
+    assert_response :success
+
+    json_response = JSON.parse(response.body)
+    rule_ids = json_response["data"].map { |rule| rule["id"] }
+    assert_includes rule_ids, @rule.id
+    assert_not_includes rule_ids, inactive_rule.id
+  end
+
+  test "should reject invalid active filter" do
+    get api_v1_rules_url, params: { active: "not_boolean" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    json_response = JSON.parse(response.body)
+    assert_equal "validation_failed", json_response["error"]
+  end
+
+  test "should reject unsupported resource type filter" do
+    get api_v1_rules_url, params: { resource_type: "account" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    json_response = JSON.parse(response.body)
+    assert_equal "validation_failed", json_response["error"]
+  end
+
+  test "should show rule with conditions and actions" do
+    get api_v1_rule_url(@rule), headers: api_headers(@api_key)
+    assert_response :success
+
+    rule = JSON.parse(response.body)["data"]
+    assert_equal @rule.id, rule["id"]
+    assert_equal "Coffee cleanup", rule["name"]
+    assert_equal "transaction", rule["resource_type"]
+    assert_equal true, rule["active"]
+    assert_equal "2024-01-01", rule["effective_date"]
+
+    assert_equal 1, rule["conditions"].length
+    assert_equal "transaction_name", rule["conditions"].first["condition_type"]
+    assert_equal "like", rule["conditions"].first["operator"]
+    assert_equal "coffee", rule["conditions"].first["value"]
+
+    assert_equal 1, rule["actions"].length
+    assert_equal "set_transaction_name", rule["actions"].first["action_type"]
+    assert_equal "Coffee", rule["actions"].first["value"]
+  end
+
+  test "should require authentication when showing a rule" do
+    get api_v1_rule_url(@rule)
+
+    assert_response :unauthorized
+  end
+
+  test "should require read scope when showing a rule" do
+    api_key_without_read = api_key_without_read_scope
+
+    get api_v1_rule_url(@rule), headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+    json_response = JSON.parse(response.body)
+    assert_equal "insufficient_scope", json_response["error"]
+  ensure
+    api_key_without_read&.destroy
+  end
+
+  test "should not show another family's rule" do
+    other_family = Family.create!(name: "Other Family", currency: "USD", locale: "en")
+    other_rule = other_family.rules.build(name: "Other", resource_type: "transaction", active: true)
+    other_rule.conditions.build(condition_type: "transaction_name", operator: "like", value: "other")
+    other_rule.actions.build(action_type: "set_transaction_name", value: "Other")
+    other_rule.save!
+
+    get api_v1_rule_url(other_rule), headers: api_headers(@api_key)
+    assert_response :not_found
+    json_response = JSON.parse(response.body)
+    assert_equal "record_not_found", json_response["error"]
+  end
+
+  private
+
+    def api_key_without_read_scope
+      # Valid persisted API keys can only be read/read_write; this intentionally
+      # bypasses validations to exercise the runtime insufficient-scope guard.
+      ApiKey.new(
+        user: @user,
+        name: "No Read Key",
+        scopes: [],
+        display_key: "test_no_read_#{SecureRandom.hex(8)}",
+        source: "mobile"
+      ).tap { |api_key| api_key.save!(validate: false) }
+    end
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.plain_key }
+    end
+end
diff --git a/test/controllers/api/v1/securities_controller_test.rb b/test/controllers/api/v1/securities_controller_test.rb
new file mode 100644
index 000000000..04b235b79
--- /dev/null
+++ b/test/controllers/api/v1/securities_controller_test.rb
@@ -0,0 +1,182 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::SecuritiesControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+    @user.api_keys.active.destroy_all
+
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      source: "web",
+      display_key: "test_read_#{SecureRandom.hex(8)}"
+    )
+
+    @account = accounts(:investment)
+    @holding_security = securities(:aapl)
+    @holding_ticker = @holding_security.ticker
+    @trade_ticker = "AAPL#{SecureRandom.hex(4).upcase}"
+
+    @trade_security = Security.create!(
+      ticker: @trade_ticker,
+      name: "Apple Inc.",
+      country_code: "US",
+      exchange_operating_mic: "XNAS"
+    )
+    @account.entries.create!(
+      name: "Buy AAPL",
+      date: Date.parse("2024-01-16"),
+      amount: 1800,
+      currency: "USD",
+      entryable: Trade.new(
+        security: @trade_security,
+        qty: 10,
+        price: 180,
+        currency: "USD"
+      )
+    )
+
+    @unreferenced_security = Security.create!(ticker: "MSFT#{SecureRandom.hex(4).upcase}", name: "Microsoft Corp.", country_code: "US")
+
+    other_account = families(:empty).accounts.create!(
+      name: "Other Investment Account",
+      accountable: Investment.new,
+      balance: 1000,
+      currency: "USD"
+    )
+    @other_security = Security.create!(ticker: "GOOG#{SecureRandom.hex(4).upcase}", name: "Alphabet Inc.", country_code: "US")
+    other_account.holdings.create!(
+      security: @other_security,
+      date: Date.parse("2024-01-15"),
+      qty: 1,
+      price: 100,
+      amount: 100,
+      currency: "USD"
+    )
+  end
+
+  test "lists securities referenced by accessible family investment data" do
+    get api_v1_securities_url, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    security_ids = response_data["securities"].map { |security| security["id"] }
+
+    assert_includes security_ids, @holding_security.id
+    assert_includes security_ids, @trade_security.id
+    assert_not_includes security_ids, @unreferenced_security.id
+    assert_not_includes security_ids, @other_security.id
+    assert response_data.key?("pagination")
+  end
+
+  test "shows a scoped security" do
+    get api_v1_security_url(@holding_security), headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+
+    assert_equal @holding_security.id, response_data["id"]
+    assert_equal @holding_ticker, response_data["ticker"]
+    assert_equal @holding_security.exchange_operating_mic, response_data["exchange_operating_mic"]
+    assert_equal "standard", response_data["kind"]
+    assert_not response_data.key?("price_provider")
+  end
+
+  test "returns not found for another family's security" do
+    get api_v1_security_url(@other_security), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "returns not found for malformed security id" do
+    get api_v1_security_url("not-a-uuid"), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "filters securities by ticker" do
+    get api_v1_securities_url, params: { ticker: @trade_ticker.downcase }, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_equal [ @trade_security.id ], response_data["securities"].map { |security| security["id"] }
+  end
+
+  test "filters securities by exchange operating mic" do
+    get api_v1_securities_url, params: { exchange_operating_mic: " xnas " }, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_equal [ @holding_security.id, @trade_security.id ], response_data["securities"].map { |security| security["id"] }
+  end
+
+  test "caps per_page at documented maximum" do
+    get api_v1_securities_url, params: { per_page: 250 }, headers: api_headers(@api_key)
+
+    assert_response :success
+    assert_equal 100, JSON.parse(response.body).dig("pagination", "per_page")
+  end
+
+  test "rejects invalid kind filter" do
+    get api_v1_securities_url, params: { kind: "unsupported" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "rejects malformed offline filter" do
+    get api_v1_securities_url, params: { offline: "maybe" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+    assert_includes response_data["errors"], "offline must be true or false"
+  end
+
+  test "rejects blank offline filter" do
+    get api_v1_securities_url, params: { offline: "" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+    assert_includes response_data["errors"], "offline must be true or false"
+  end
+
+  test "requires authentication" do
+    get api_v1_securities_url
+
+    assert_response :unauthorized
+  end
+
+  test "requires read scope" do
+    api_key_without_read = ApiKey.new(
+      user: @user,
+      name: "No Read Key",
+      scopes: [],
+      source: "web",
+      display_key: "no_read_#{SecureRandom.hex(8)}"
+    )
+    api_key_without_read.save!(validate: false)
+
+    get api_v1_securities_url, headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+  ensure
+    api_key_without_read&.destroy
+  end
+
+  private
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.plain_key }
+    end
+end
diff --git a/test/controllers/api/v1/security_prices_controller_test.rb b/test/controllers/api/v1/security_prices_controller_test.rb
new file mode 100644
index 000000000..156b97d32
--- /dev/null
+++ b/test/controllers/api/v1/security_prices_controller_test.rb
@@ -0,0 +1,196 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::SecurityPricesControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+    @user.api_keys.active.destroy_all
+
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      source: "web",
+      display_key: "test_read_#{SecureRandom.hex(8)}"
+    )
+
+    @account = accounts(:investment)
+    @security = securities(:aapl)
+    @ticker = @security.ticker
+    @security_price = security_prices(:one)
+    @eur_price = Security::Price.create!(
+      security: @security,
+      date: @security_price.date,
+      price: BigDecimal("250.5000"),
+      currency: "EUR"
+    )
+
+    other_account = families(:empty).accounts.create!(
+      name: "Other Investment Account",
+      accountable: Investment.new,
+      balance: 1000,
+      currency: "USD"
+    )
+    @other_security = Security.create!(ticker: "GOOG#{SecureRandom.hex(4).upcase}", name: "Alphabet Inc.", country_code: "US")
+    other_account.holdings.create!(
+      security: @other_security,
+      date: Date.parse("2024-01-15"),
+      qty: 1,
+      price: 100,
+      amount: 100,
+      currency: "USD"
+    )
+    @other_price = Security::Price.create!(
+      security: @other_security,
+      date: Date.parse("2024-01-15"),
+      price: 100,
+      currency: "USD"
+    )
+  end
+
+  test "lists prices for securities referenced by accessible family investment data" do
+    get api_v1_security_prices_url, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    price_ids = response_data["security_prices"].map { |price| price["id"] }
+
+    assert_includes price_ids, @security_price.id
+    assert_not_includes price_ids, @other_price.id
+    assert response_data.key?("pagination")
+  end
+
+  test "shows a scoped security price" do
+    get api_v1_security_price_url(@security_price), headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+
+    assert_equal @security_price.id, response_data["id"]
+    assert_equal @security_price.date.iso8601, response_data["date"]
+    assert_equal "215.0000", response_data["price_amount"]
+    assert_equal @security.id, response_data.dig("security", "id")
+  end
+
+  test "returns not found for another family's security price" do
+    get api_v1_security_price_url(@other_price), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "returns not found for malformed security price id" do
+    get api_v1_security_price_url("not-a-uuid"), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "filters security prices by security_id" do
+    get api_v1_security_prices_url, params: { security_id: @security.id }, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_includes response_data["security_prices"].map { |price| price["id"] }, @security_price.id
+    assert response_data["security_prices"].all? { |price| price.dig("security", "id") == @security.id }
+  end
+
+  test "filters security prices by date range and provisional status" do
+    get api_v1_security_prices_url,
+        params: { start_date: @security_price.date.iso8601, end_date: @security_price.date.iso8601, currency: "USD", provisional: false },
+        headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_equal [ @security_price.id ], response_data["security_prices"].map { |price| price["id"] }
+  end
+
+  test "rejects blank provisional filter" do
+    get api_v1_security_prices_url,
+        params: { provisional: "" },
+        headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+    assert_includes response_data["errors"], "provisional must be true or false"
+  end
+
+  test "filters security prices by currency" do
+    get api_v1_security_prices_url,
+        params: { currency: " usd " },
+        headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_includes response_data["security_prices"].map { |price| price["id"] }, @security_price.id
+    assert_not_includes response_data["security_prices"].map { |price| price["id"] }, @eur_price.id
+  end
+
+  test "rejects malformed provisional filter" do
+    get api_v1_security_prices_url,
+        params: { provisional: "maybe" },
+        headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+    assert_includes response_data["errors"], "provisional must be true or false"
+  end
+
+  test "caps per_page at documented maximum" do
+    get api_v1_security_prices_url, params: { per_page: 250 }, headers: api_headers(@api_key)
+
+    assert_response :success
+    assert_equal 100, JSON.parse(response.body).dig("pagination", "per_page")
+  end
+
+  test "rejects malformed security_id filter" do
+    get api_v1_security_prices_url, params: { security_id: "not-a-uuid" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "rejects invalid date filters" do
+    get api_v1_security_prices_url, params: { start_date: "01/15/2024" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "requires authentication" do
+    get api_v1_security_prices_url
+
+    assert_response :unauthorized
+  end
+
+  test "requires read scope" do
+    api_key_without_read = ApiKey.new(
+      user: @user,
+      name: "No Read Key",
+      scopes: [],
+      source: "web",
+      display_key: "no_read_#{SecureRandom.hex(8)}"
+    )
+    api_key_without_read.save!(validate: false)
+
+    get api_v1_security_prices_url, headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+  ensure
+    api_key_without_read&.destroy
+  end
+
+  private
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.plain_key }
+    end
+end
diff --git a/test/controllers/api/v1/sync_controller_test.rb b/test/controllers/api/v1/sync_controller_test.rb
index 3a920a672..fd6e18856 100644
--- a/test/controllers/api/v1/sync_controller_test.rb
+++ b/test/controllers/api/v1/sync_controller_test.rb
@@ -33,7 +33,7 @@ class Api::V1::SyncControllerTest < ActionDispatch::IntegrationTest
 
   test "should trigger sync with valid write API key" do
     assert_enqueued_with(job: SyncJob) do
-      post api_v1_sync_url, headers: api_headers(@api_key)
+      post api_v1_sync_job_url, headers: api_headers(@api_key)
     end
 
     assert_response :accepted
@@ -48,7 +48,7 @@ class Api::V1::SyncControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should reject sync with read-only API key" do
-    post api_v1_sync_url, headers: api_headers(@read_only_api_key)
+    post api_v1_sync_job_url, headers: api_headers(@read_only_api_key)
     assert_response :forbidden
 
     response_data = JSON.parse(response.body)
@@ -56,7 +56,7 @@ class Api::V1::SyncControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should reject sync without API key" do
-    post api_v1_sync_url
+    post api_v1_sync_job_url
     assert_response :unauthorized
 
     response_data = JSON.parse(response.body)
@@ -64,7 +64,7 @@ class Api::V1::SyncControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should return proper sync details in response" do
-    post api_v1_sync_url, headers: api_headers(@api_key)
+    post api_v1_sync_job_url, headers: api_headers(@api_key)
     assert_response :accepted
 
     response_data = JSON.parse(response.body)
diff --git a/test/controllers/api/v1/syncs_controller_test.rb b/test/controllers/api/v1/syncs_controller_test.rb
new file mode 100644
index 000000000..ff0943fb9
--- /dev/null
+++ b/test/controllers/api/v1/syncs_controller_test.rb
@@ -0,0 +1,211 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::SyncsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+    @account = @family.accounts.first
+
+    Sync.for_family(@family).destroy_all
+
+    @user.api_keys.active.destroy_all
+
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read-Write Key",
+      scopes: [ "read_write" ],
+      display_key: "test_rw_#{SecureRandom.hex(8)}",
+      source: "web"
+    )
+
+    @read_only_api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      display_key: "test_ro_#{SecureRandom.hex(8)}",
+      source: "mobile"
+    )
+
+    redis = Redis.new
+    redis.del("api_rate_limit:#{@api_key.id}")
+    redis.del("api_rate_limit:#{@read_only_api_key.id}")
+    redis.close
+  end
+
+  test "lists family scoped syncs" do
+    family_sync = Sync.create!(syncable: @family, status: "completed", completed_at: 1.hour.ago)
+    account_sync = Sync.create!(syncable: @account, status: "syncing", syncing_at: Time.current)
+    other_sync = Sync.create!(syncable: families(:empty), status: "completed", completed_at: 1.hour.ago)
+
+    get api_v1_syncs_url, headers: api_headers(@read_only_api_key)
+    assert_response :success
+
+    json_response = JSON.parse(response.body)
+    sync_ids = json_response["data"].map { |sync| sync["id"] }
+
+    assert_includes sync_ids, family_sync.id
+    assert_includes sync_ids, account_sync.id
+    assert_not_includes sync_ids, other_sync.id
+    assert_equal 2, json_response["meta"]["total_count"]
+  end
+
+  test "does not list account syncs outside caller account access" do
+    private_account = @family.accounts.create!(
+      owner: @user,
+      name: "Private Sync Account",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+    inaccessible_sync = Sync.create!(syncable: private_account, status: "completed", completed_at: 1.hour.ago)
+
+    @read_only_api_key.update_column(:user_id, users(:family_member).id)
+
+    get api_v1_syncs_url, headers: api_headers(@read_only_api_key)
+    assert_response :success
+
+    sync_ids = JSON.parse(response.body)["data"].map { |sync| sync["id"] }
+    assert_not_includes sync_ids, inaccessible_sync.id
+  end
+
+  test "shows a sync" do
+    sync = Sync.create!(
+      syncable: @family,
+      status: "completed",
+      completed_at: 1.hour.ago,
+      window_start_date: Date.current - 7.days,
+      window_end_date: Date.current
+    )
+
+    get api_v1_sync_url(sync), headers: api_headers(@read_only_api_key)
+    assert_response :success
+
+    data = JSON.parse(response.body)["data"]
+    assert_equal sync.id, data["id"]
+    assert_equal "completed", data["status"]
+    assert_equal false, data["in_progress"]
+    assert_equal true, data["terminal"]
+    assert_equal "Family", data["syncable"]["type"]
+    assert_equal @family.id, data["syncable"]["id"]
+    assert_nil data["error"]
+  end
+
+  test "returns latest sync" do
+    Sync.create!(syncable: @family, status: "completed", created_at: 2.hours.ago, completed_at: 2.hours.ago)
+    latest_sync = Sync.create!(syncable: @account, status: "pending", created_at: 1.minute.ago)
+
+    get latest_api_v1_syncs_url, headers: api_headers(@read_only_api_key)
+    assert_response :success
+
+    assert_equal latest_sync.id, JSON.parse(response.body)["data"]["id"]
+  end
+
+  test "latest returns null data when no sync exists" do
+    get latest_api_v1_syncs_url, headers: api_headers(@read_only_api_key)
+    assert_response :success
+
+    assert_nil JSON.parse(response.body)["data"]
+  end
+
+  test "does not expose raw sync errors" do
+    sync = Sync.create!(
+      syncable: @family,
+      status: "failed",
+      failed_at: Time.current,
+      error: "provider token secret leaked"
+    )
+
+    get api_v1_sync_url(sync), headers: api_headers(@read_only_api_key)
+    assert_response :success
+
+    data = JSON.parse(response.body)["data"]
+    assert data["error"].present?
+    assert_equal "Sync failed", data["error"]["message"]
+    refute_includes response.body, "provider token secret leaked"
+  end
+
+  test "reports failed sync errors as present without raw error text" do
+    sync = Sync.create!(
+      syncable: @family,
+      status: "failed",
+      failed_at: Time.current,
+      error: nil
+    )
+
+    get api_v1_sync_url(sync), headers: api_headers(@read_only_api_key)
+    assert_response :success
+
+    assert JSON.parse(response.body).dig("data", "error").present?
+    assert_equal "Sync failed", JSON.parse(response.body).dig("data", "error", "message")
+  end
+
+  test "omits stale sync error payload when no error is present" do
+    sync = Sync.create!(
+      syncable: @family,
+      status: "stale"
+    )
+
+    get api_v1_sync_url(sync), headers: api_headers(@read_only_api_key)
+    assert_response :success
+
+    assert_nil JSON.parse(response.body).dig("data", "error")
+  end
+
+  test "returns not found for another family sync" do
+    sync = Sync.create!(syncable: families(:empty), status: "completed")
+
+    get api_v1_sync_url(sync), headers: api_headers(@read_only_api_key)
+    assert_response :not_found
+
+    assert_equal "record_not_found", JSON.parse(response.body)["error"]
+  end
+
+  test "returns not found for malformed sync id" do
+    get api_v1_sync_url("not-a-uuid"), headers: api_headers(@read_only_api_key)
+    assert_response :not_found
+
+    assert_equal "record_not_found", JSON.parse(response.body)["error"]
+  end
+
+  test "index requires authentication" do
+    get api_v1_syncs_url
+    assert_response :unauthorized
+  end
+
+  test "latest requires authentication" do
+    get latest_api_v1_syncs_url
+    assert_response :unauthorized
+  end
+
+  test "show requires authentication" do
+    sync = Sync.create!(syncable: @family, status: "completed", completed_at: 1.hour.ago)
+
+    get api_v1_sync_url(sync)
+    assert_response :unauthorized
+  end
+
+  test "index requires read scope" do
+    api_key_without_read = ApiKey.new(
+      user: @user,
+      name: "No Read Key",
+      scopes: [],
+      source: "monitoring",
+      display_key: "no_read_#{SecureRandom.hex(8)}"
+    )
+    api_key_without_read.save!(validate: false)
+
+    get api_v1_syncs_url, headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+  ensure
+    api_key_without_read&.destroy
+  end
+
+  private
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.plain_key }
+    end
+end
diff --git a/test/controllers/api/v1/transactions_controller_test.rb b/test/controllers/api/v1/transactions_controller_test.rb
index 8ddb0ebf7..1f5123d9e 100644
--- a/test/controllers/api/v1/transactions_controller_test.rb
+++ b/test/controllers/api/v1/transactions_controller_test.rb
@@ -66,6 +66,44 @@ class Api::V1::TransactionsControllerTest < ActionDispatch::IntegrationTest
     end
   end
 
+  test "should include disabled account transactions in index history" do
+    disabled_transaction = create_disabled_account_transaction(name: "Closed Account Grocery")
+
+    get api_v1_transactions_url, headers: api_headers(@api_key)
+    assert_response :success
+
+    response_data = JSON.parse(response.body)
+    transaction_ids = response_data["transactions"].map { |transaction| transaction["id"] }
+    assert_includes transaction_ids, disabled_transaction.id
+  end
+
+  test "should exclude pending deletion account transactions from index history" do
+    pending_deletion_transaction = create_account_transaction(
+      status: "pending_deletion",
+      name: "Pending Delete Account Grocery"
+    )
+
+    get api_v1_transactions_url, headers: api_headers(@api_key)
+    assert_response :success
+
+    response_data = JSON.parse(response.body)
+    transaction_ids = response_data["transactions"].map { |transaction| transaction["id"] }
+    assert_not_includes transaction_ids, pending_deletion_transaction.id
+  end
+
+  test "should filter disabled account transactions by account_id" do
+    disabled_transaction = create_disabled_account_transaction(name: "Closed Account Filter")
+    disabled_account = disabled_transaction.entry.account
+
+    get api_v1_transactions_url,
+        params: { account_id: disabled_account.id },
+        headers: api_headers(@api_key)
+    assert_response :success
+
+    response_data = JSON.parse(response.body)
+    assert_equal [ disabled_transaction.id ], response_data["transactions"].map { |transaction| transaction["id"] }
+  end
+
   test "should filter transactions by date range" do
     start_date = 1.month.ago.to_date
     end_date = Date.current
@@ -83,6 +121,22 @@ class Api::V1::TransactionsControllerTest < ActionDispatch::IntegrationTest
     end
   end
 
+  test "should filter disabled account transactions by date range" do
+    disabled_transaction = create_disabled_account_transaction(
+      name: "Closed Account Date Range",
+      date: Date.current - 3.days
+    )
+
+    get api_v1_transactions_url,
+        params: { start_date: Date.current - 4.days, end_date: Date.current - 2.days },
+        headers: api_headers(@api_key)
+    assert_response :success
+
+    response_data = JSON.parse(response.body)
+    transaction_ids = response_data["transactions"].map { |transaction| transaction["id"] }
+    assert_includes transaction_ids, disabled_transaction.id
+  end
+
   test "should search transactions" do
     # Create a transaction with a specific name for testing
     entry = @account.entries.create!(
@@ -103,6 +157,19 @@ class Api::V1::TransactionsControllerTest < ActionDispatch::IntegrationTest
     assert_not_nil found_transaction, "Should find the coffee transaction"
   end
 
+  test "should search disabled account transactions" do
+    disabled_transaction = create_disabled_account_transaction(name: "Closed Account Coffee")
+
+    get api_v1_transactions_url,
+        params: { search: "Closed Account Coffee" },
+        headers: api_headers(@api_key)
+    assert_response :success
+
+    response_data = JSON.parse(response.body)
+    found_transaction = response_data["transactions"].find { |transaction| transaction["id"] == disabled_transaction.id }
+    assert_not_nil found_transaction, "Should find disabled account transactions in global history search"
+  end
+
   test "should paginate transactions" do
     get api_v1_transactions_url,
         params: { page: 1, per_page: 5 },
@@ -144,9 +211,33 @@ class Api::V1::TransactionsControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
   end
 
-  test "should return 404 for non-existent transaction" do
+  test "should show disabled account transaction" do
+    disabled_transaction = create_disabled_account_transaction(name: "Closed Account Show")
+
+    get api_v1_transaction_url(disabled_transaction), headers: api_headers(@api_key)
+    assert_response :success
+
+    response_data = JSON.parse(response.body)
+    assert_equal disabled_transaction.id, response_data["id"]
+    assert_equal disabled_transaction.entry.account_id, response_data["account"]["id"]
+  end
+
+  test "should return 404 for valid missing transaction id" do
+    get api_v1_transaction_url(SecureRandom.uuid), headers: api_headers(@api_key)
+    assert_response :not_found
+
+    response_data = JSON.parse(response.body)
+    assert_equal "not_found", response_data["error"]
+    assert_equal "Transaction not found", response_data["message"]
+  end
+
+  test "should return 404 for malformed id" do
     get api_v1_transaction_url(999999), headers: api_headers(@api_key)
     assert_response :not_found
+
+    response_data = JSON.parse(response.body)
+    assert_equal "not_found", response_data["error"]
+    assert_equal "Transaction not found", response_data["message"]
   end
 
   test "should reject show request without API key" do
@@ -179,6 +270,220 @@ class Api::V1::TransactionsControllerTest < ActionDispatch::IntegrationTest
     assert_equal @account.id, response_data["account"]["id"]
   end
 
+  test "should create transaction with external idempotency key" do
+    transaction_params = {
+      transaction: {
+        account_id: @account.id,
+        name: "Imported Transaction",
+        amount: 25.00,
+        date: Date.current,
+        currency: "USD",
+        nature: "expense",
+        external_id: "import-txn-1",
+        source: "external_import"
+      }
+    }
+
+    assert_difference("@account.entries.count", 1) do
+      post api_v1_transactions_url,
+           params: transaction_params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :created
+    response_data = JSON.parse(response.body)
+    assert_equal "import-txn-1", response_data["external_id"]
+    assert_equal "external_import", response_data["source"]
+
+    entry = @account.entries.find_by!(external_id: "import-txn-1", source: "external_import")
+    assert_equal response_data["id"], entry.transaction.id
+  end
+
+  test "should use default source when external_id provided without source" do
+    transaction_params = {
+      transaction: {
+        account_id: @account.id,
+        name: "Imported Transaction",
+        amount: 25.00,
+        date: Date.current,
+        currency: "USD",
+        nature: "expense",
+        external_id: "default-source-test"
+      }
+    }
+
+    assert_difference("@account.entries.count", 1) do
+      post api_v1_transactions_url,
+           params: transaction_params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :created
+    response_data = JSON.parse(response.body)
+    entry = @account.entries.find_by!(external_id: "default-source-test")
+    assert_equal "api", entry.source
+    assert_equal "api", response_data["source"]
+
+    assert_no_difference("@account.entries.count") do
+      post api_v1_transactions_url,
+           params: transaction_params.deep_merge(transaction: { name: "Changed Name" }),
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :ok
+  end
+
+  test "should reject source without external idempotency key" do
+    transaction_params = {
+      transaction: {
+        account_id: @account.id,
+        name: "Imported Transaction",
+        amount: 25.00,
+        date: Date.current,
+        currency: "USD",
+        nature: "expense",
+        source: "external_import"
+      }
+    }
+
+    assert_no_difference("@account.entries.count") do
+      post api_v1_transactions_url,
+           params: transaction_params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+    assert_equal "Source requires external_id", response_data["message"]
+    assert_equal [ "Source requires external_id" ], response_data["errors"]
+  end
+
+  test "should return existing transaction for duplicate external idempotency key" do
+    transaction_params = {
+      transaction: {
+        account_id: @account.id,
+        name: "Imported Transaction",
+        amount: 25.00,
+        date: Date.current,
+        currency: "USD",
+        nature: "expense",
+        external_id: "import-txn-2",
+        source: "external_import"
+      }
+    }
+
+    post api_v1_transactions_url,
+         params: transaction_params,
+         headers: api_headers(@api_key)
+    assert_response :created
+    created_data = JSON.parse(response.body)
+
+    assert_no_difference("@account.entries.count") do
+      post api_v1_transactions_url,
+           params: transaction_params.deep_merge(transaction: { name: "Changed Name" }),
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :ok
+    response_data = JSON.parse(response.body)
+    assert_equal created_data["id"], response_data["id"]
+    assert_equal "Imported Transaction", response_data["name"]
+  end
+
+  test "should scope external idempotency keys to account" do
+    other_account = @family.accounts.create!(
+      name: "Other API Account",
+      accountable: Depository.new,
+      balance: 0,
+      currency: "USD"
+    )
+    transaction_params = {
+      transaction: {
+        name: "Imported Transaction",
+        amount: 25.00,
+        date: Date.current,
+        currency: "USD",
+        nature: "expense",
+        external_id: "shared-import-txn",
+        source: "external_import"
+      }
+    }
+
+    assert_difference("Entry.count", 2) do
+      post api_v1_transactions_url,
+           params: transaction_params.deep_merge(transaction: { account_id: @account.id }),
+           headers: api_headers(@api_key)
+      assert_response :created
+
+      post api_v1_transactions_url,
+           params: transaction_params.deep_merge(transaction: { account_id: other_account.id }),
+           headers: api_headers(@api_key)
+      assert_response :created
+    end
+  end
+
+  test "should scope external idempotency keys to source" do
+    transaction_params = {
+      transaction: {
+        account_id: @account.id,
+        name: "Imported Transaction",
+        amount: 25.00,
+        date: Date.current,
+        currency: "USD",
+        nature: "expense",
+        external_id: "shared-source-txn",
+        source: "external_import"
+      }
+    }
+
+    assert_difference("Entry.count", 2) do
+      post api_v1_transactions_url,
+           params: transaction_params,
+           headers: api_headers(@api_key)
+      assert_response :created
+
+      post api_v1_transactions_url,
+           params: transaction_params.deep_merge(transaction: { source: "other_import" }),
+           headers: api_headers(@api_key)
+      assert_response :created
+    end
+
+    @account.entries.find_by!(external_id: "shared-source-txn", source: "external_import")
+    @account.entries.find_by!(external_id: "shared-source-txn", source: "other_import")
+  end
+
+  test "should reject external idempotency key collision with non-transaction entry" do
+    @account.entries.create!(
+      name: "Existing valuation",
+      amount: 100,
+      currency: "USD",
+      date: Date.current,
+      external_id: "import-non-transaction",
+      source: "external_import",
+      entryable: Valuation.new
+    )
+
+    post api_v1_transactions_url,
+         params: {
+           transaction: {
+             account_id: @account.id,
+             name: "Imported Transaction",
+             amount: 25.00,
+             date: Date.current - 1.day,
+             currency: "USD",
+             nature: "expense",
+             external_id: "import-non-transaction",
+             source: "external_import"
+           }
+         },
+         headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
   test "should reject create with read-only API key" do
     transaction_params = {
       transaction: {
@@ -209,6 +514,31 @@ class Api::V1::TransactionsControllerTest < ActionDispatch::IntegrationTest
     assert_response :unprocessable_entity
   end
 
+  test "should reject invalid date on create" do
+    transaction_params = {
+      transaction: {
+        account_id: @account.id,
+        name: "Invalid Date Transaction",
+        amount: 25.00,
+        date: "not-a-date",
+        currency: "USD",
+        nature: "expense"
+      }
+    }
+
+    assert_no_difference("@account.entries.count") do
+      post api_v1_transactions_url,
+           params: transaction_params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+    assert_equal "Transaction could not be created", response_data["message"]
+    assert response_data["errors"].any? { |error| error.match?(/Date/) }
+  end
+
   test "should reject create without API key" do
     post api_v1_transactions_url, params: { transaction: { name: "Test" } }
     assert_response :unauthorized
@@ -450,4 +780,28 @@ end
                         "non-income transactions should have non-positive signed_amount_cents"
       end
     end
+
+    def create_disabled_account_transaction(name:, date: Date.current)
+      create_account_transaction(status: "disabled", name: name, date: date)
+    end
+
+    def create_account_transaction(status:, name:, date: Date.current)
+      account = @family.accounts.create!(
+        name: "#{status.titleize} Checking #{SecureRandom.hex(4)}",
+        balance: 0,
+        currency: "USD",
+        status: status,
+        accountable: Depository.new
+      )
+
+      entry = account.entries.create!(
+        name: name,
+        amount: 12.34,
+        currency: "USD",
+        date: date,
+        entryable: Transaction.new
+      )
+
+      entry.transaction
+    end
 end
diff --git a/test/controllers/api/v1/transfers_controller_test.rb b/test/controllers/api/v1/transfers_controller_test.rb
new file mode 100644
index 000000000..e74dcfbda
--- /dev/null
+++ b/test/controllers/api/v1/transfers_controller_test.rb
@@ -0,0 +1,203 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Api::V1::TransfersControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+    @user.api_keys.active.destroy_all
+
+    @api_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Key",
+      scopes: [ "read" ],
+      source: "web",
+      display_key: "test_read_#{SecureRandom.hex(8)}"
+    )
+
+    @account = @family.accounts.create!(
+      name: "Transfer Checking",
+      accountable: Depository.new,
+      balance: 500,
+      currency: "USD"
+    )
+    @destination_account = @family.accounts.create!(
+      name: "Transfer Savings",
+      accountable: Depository.new,
+      balance: 1000,
+      currency: "USD"
+    )
+
+    outflow = create_transaction(@account, amount: 100, date: Date.parse("2024-01-15"), name: "Transfer to savings")
+    inflow = create_transaction(@destination_account, amount: -100, date: Date.parse("2024-01-15"), name: "Transfer from checking")
+    @transfer = Transfer.create!(
+      outflow_transaction: outflow,
+      inflow_transaction: inflow,
+      status: "confirmed",
+      notes: "Confirmed by user"
+    )
+
+    other_family = families(:empty)
+    other_account = other_family.accounts.create!(name: "Other Checking", accountable: Depository.new, balance: 0, currency: "USD")
+    other_destination = other_family.accounts.create!(name: "Other Savings", accountable: Depository.new, balance: 0, currency: "USD")
+    other_outflow = create_transaction(other_account, amount: 50, date: Date.parse("2024-01-15"), name: "Other outflow")
+    other_inflow = create_transaction(other_destination, amount: -50, date: Date.parse("2024-01-15"), name: "Other inflow")
+    @other_transfer = Transfer.create!(outflow_transaction: other_outflow, inflow_transaction: other_inflow)
+  end
+
+  test "lists transfers scoped to the current family" do
+    get api_v1_transfers_url, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert response_data.key?("transfers")
+    assert response_data.key?("pagination")
+    assert_includes response_data["transfers"].map { |transfer| transfer["id"] }, @transfer.id
+    assert_not_includes response_data["transfers"].map { |transfer| transfer["id"] }, @other_transfer.id
+  end
+
+  test "permits read write scope" do
+    read_write_key = ApiKey.create!(
+      user: @user,
+      name: "Test Read Write Key",
+      scopes: [ "read_write" ],
+      source: "mobile",
+      display_key: "test_read_write_#{SecureRandom.hex(8)}"
+    )
+
+    get api_v1_transfers_url, headers: api_headers(read_write_key)
+
+    assert_response :success
+  end
+
+  test "shows a transfer" do
+    get api_v1_transfer_url(@transfer), headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_equal @transfer.id, response_data["id"]
+    assert_equal "confirmed", response_data["status"]
+    assert_equal "Confirmed by user", response_data["notes"]
+    assert_equal "Transfer Savings", response_data.dig("inflow_transaction", "account", "name")
+    assert_equal "Transfer Checking", response_data.dig("outflow_transaction", "account", "name")
+    assert response_data.key?("amount_cents")
+  end
+
+  test "returns not found for another family's transfer" do
+    get api_v1_transfer_url(@other_transfer), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "returns not found for malformed transfer id" do
+    get api_v1_transfer_url("not-a-uuid"), headers: api_headers(@api_key)
+
+    assert_response :not_found
+    response_data = JSON.parse(response.body)
+    assert_equal "record_not_found", response_data["error"]
+  end
+
+  test "filters transfers by status" do
+    get api_v1_transfers_url, params: { status: "confirmed" }, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_equal [ @transfer.id ], response_data["transfers"].map { |transfer| transfer["id"] }
+  end
+
+  test "filters transfers by account_id" do
+    get api_v1_transfers_url, params: { account_id: @account.id }, headers: api_headers(@api_key)
+
+    assert_response :success
+    response_data = JSON.parse(response.body)
+    assert_includes response_data["transfers"].map { |transfer| transfer["id"] }, @transfer.id
+  end
+
+  test "rejects malformed account_id filter" do
+    get api_v1_transfers_url, params: { account_id: "not-a-uuid" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "rejects invalid status filter" do
+    get api_v1_transfers_url, params: { status: "settled" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "rejects invalid date filter" do
+    get api_v1_transfers_url, params: { start_date: "01/15/2024" }, headers: api_headers(@api_key)
+
+    assert_response :unprocessable_entity
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "filters transfers when either transaction side date matches" do
+    matched_outflow = create_transaction(@account, amount: 75, date: Date.parse("2024-02-10"), name: "Dated outflow")
+    matched_inflow = create_transaction(@destination_account, amount: -75, date: Date.parse("2024-02-10"), name: "Dated inflow")
+    date_matched_transfer = Transfer.create!(outflow_transaction: matched_outflow, inflow_transaction: matched_inflow)
+
+    partial_outflow = create_transaction(@account, amount: 80, date: Date.parse("2024-02-10"), name: "Partial outflow")
+    partial_inflow = create_transaction(@destination_account, amount: -80, date: Date.parse("2024-02-12"), name: "Partial inflow")
+    partial_date_transfer = Transfer.create!(outflow_transaction: partial_outflow, inflow_transaction: partial_inflow)
+
+    get api_v1_transfers_url,
+        params: { start_date: "2024-02-10", end_date: "2024-02-10" },
+        headers: api_headers(@api_key)
+
+    assert_response :success
+    transfer_ids = JSON.parse(response.body)["transfers"].map { |transfer| transfer["id"] }
+    assert_includes transfer_ids, date_matched_transfer.id
+    assert_includes transfer_ids, partial_date_transfer.id
+    assert_not_includes transfer_ids, @transfer.id
+  end
+
+  test "requires authentication" do
+    get api_v1_transfers_url
+
+    assert_response :unauthorized
+  end
+
+  test "requires read scope" do
+    # ApiKey.create! rejects empty scopes; bypass validation to exercise runtime authorization.
+    api_key_without_read = ApiKey.new(
+      user: @user,
+      name: "No Read Key",
+      scopes: [],
+      source: "mobile",
+      display_key: "no_read_#{SecureRandom.hex(8)}"
+    )
+    api_key_without_read.save!(validate: false)
+
+    get api_v1_transfers_url, headers: api_headers(api_key_without_read)
+
+    assert_response :forbidden
+  ensure
+    api_key_without_read&.destroy
+  end
+
+  private
+
+    def create_transaction(account, amount:, date:, name:)
+      entry = account.entries.create!(
+        date: date,
+        amount: amount,
+        name: name,
+        currency: account.currency,
+        entryable: Transaction.new(kind: "funds_movement")
+      )
+      entry.entryable
+    end
+
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.display_key }
+    end
+end
diff --git a/test/controllers/api/v1/usage_controller_test.rb b/test/controllers/api/v1/usage_controller_test.rb
index 272358261..02f4ee8c2 100644
--- a/test/controllers/api/v1/usage_controller_test.rb
+++ b/test/controllers/api/v1/usage_controller_test.rb
@@ -111,26 +111,28 @@ class Api::V1::UsageControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should work correctly when approaching rate limit" do
-    # Make 98 requests to get close to the limit
-    98.times do
+    travel_to Time.zone.local(2026, 1, 1, 12, 15, 0) do
+      # Make 98 requests to get close to the limit
+      98.times do
+        get "/api/v1/test", headers: { "X-Api-Key" => @api_key.display_key }
+        assert_response :success
+      end
+
+      # Check usage - this should be request 99
+      get "/api/v1/usage", headers: { "X-Api-Key" => @api_key.display_key }
+      assert_response :success
+
+      response_body = JSON.parse(response.body)
+      assert_equal 99, response_body["rate_limit"]["current_count"]
+      assert_equal 1, response_body["rate_limit"]["remaining"]
+
+      # One more request should hit the limit
       get "/api/v1/test", headers: { "X-Api-Key" => @api_key.display_key }
       assert_response :success
+
+      # Now we should be rate limited
+      get "/api/v1/usage", headers: { "X-Api-Key" => @api_key.display_key }
+      assert_response :too_many_requests
     end
-
-    # Check usage - this should be request 99
-    get "/api/v1/usage", headers: { "X-Api-Key" => @api_key.display_key }
-    assert_response :success
-
-    response_body = JSON.parse(response.body)
-    assert_equal 99, response_body["rate_limit"]["current_count"]
-    assert_equal 1, response_body["rate_limit"]["remaining"]
-
-    # One more request should hit the limit
-    get "/api/v1/test", headers: { "X-Api-Key" => @api_key.display_key }
-    assert_response :success
-
-    # Now we should be rate limited
-    get "/api/v1/usage", headers: { "X-Api-Key" => @api_key.display_key }
-    assert_response :too_many_requests
   end
 end
diff --git a/test/controllers/api/v1/users_controller_test.rb b/test/controllers/api/v1/users_controller_test.rb
index 9a8be9d85..853348d49 100644
--- a/test/controllers/api/v1/users_controller_test.rb
+++ b/test/controllers/api/v1/users_controller_test.rb
@@ -12,6 +12,7 @@ class Api::V1::UsersControllerTest < ActionDispatch::IntegrationTest
       user: @user,
       name: "Test Read-Write Key",
       scopes: [ "read_write" ],
+      source: "web",
       display_key: "test_rw_#{SecureRandom.hex(8)}"
     )
 
@@ -56,6 +57,7 @@ class Api::V1::UsersControllerTest < ActionDispatch::IntegrationTest
       user: users(:family_member),
       name: "Member Read-Write Key",
       scopes: [ "read_write" ],
+      source: "web",
       display_key: "test_member_#{SecureRandom.hex(8)}"
     )
 
@@ -69,13 +71,65 @@ class Api::V1::UsersControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "reset enqueues FamilyResetJob and returns 200" do
-    assert_enqueued_with(job: FamilyResetJob) do
+    assert_enqueued_with(job: FamilyResetJob, args: [ @user.family ]) do
       delete "/api/v1/users/reset", headers: api_headers(@api_key)
     end
 
     assert_response :ok
     body = JSON.parse(response.body)
     assert_equal "Account reset has been initiated", body["message"]
+    assert_equal "queued", body["status"]
+    assert_equal @user.family.id, body["family_id"]
+    assert body["job_id"].present?
+    assert_equal "/api/v1/users/reset/status", body["status_url"]
+  end
+
+  test "reset returns controlled error when enqueue fails" do
+    FamilyResetJob.stub(:perform_later, ->(_family) { raise StandardError, "queue down" }) do
+      delete "/api/v1/users/reset", headers: api_headers(@api_key)
+    end
+
+    assert_response :internal_server_error
+    body = JSON.parse(response.body)
+    assert_equal "reset_enqueue_failed", body["error"]
+    assert_equal "Account reset could not be queued", body["message"]
+    assert_not_includes response.body, "queue down"
+  end
+
+  test "reset status requires authentication" do
+    get "/api/v1/users/reset/status"
+    assert_response :unauthorized
+  end
+
+  test "reset status requires admin role" do
+    non_admin_api_key = ApiKey.create!(
+      user: users(:family_member),
+      name: "Member Read Key",
+      scopes: [ "read_write" ],
+      source: "web",
+      display_key: "test_member_read_#{SecureRandom.hex(8)}"
+    )
+
+    get "/api/v1/users/reset/status", headers: api_headers(non_admin_api_key)
+
+    assert_response :forbidden
+  end
+
+  test "reset status returns family data counts" do
+    get "/api/v1/users/reset/status", headers: api_headers(@read_only_api_key)
+
+    assert_response :ok
+    body = JSON.parse(response.body)
+    assert_equal @user.family.id, body["family_id"]
+    assert_includes %w[complete data_remaining], body["status"]
+    assert_equal body["counts"].values.sum.zero?, body["reset_complete"]
+    assert body["counts"].key?("accounts")
+    assert body["counts"].key?("categories")
+    assert body["counts"].key?("tags")
+    assert body["counts"].key?("merchants")
+    assert body["counts"].key?("plaid_items")
+    assert body["counts"].key?("imports")
+    assert body["counts"].key?("budgets")
   end
 
   # -- Delete account --------------------------------------------------------
@@ -92,6 +146,7 @@ class Api::V1::UsersControllerTest < ActionDispatch::IntegrationTest
       user: solo_user,
       name: "Solo Key",
       scopes: [ "read_write" ],
+      source: "web",
       display_key: "test_solo_#{SecureRandom.hex(8)}"
     )
 
@@ -129,6 +184,6 @@ class Api::V1::UsersControllerTest < ActionDispatch::IntegrationTest
   private
 
     def api_headers(api_key)
-      { "X-Api-Key" => api_key.display_key }
+      { "X-Api-Key" => api_key.plain_key }
     end
 end
diff --git a/test/controllers/api/v1/valuations_controller_test.rb b/test/controllers/api/v1/valuations_controller_test.rb
index 0864470c1..b1a24bc97 100644
--- a/test/controllers/api/v1/valuations_controller_test.rb
+++ b/test/controllers/api/v1/valuations_controller_test.rb
@@ -17,6 +17,7 @@ class Api::V1::ValuationsControllerTest < ActionDispatch::IntegrationTest
       user: @user,
       name: "Test Read-Write Key",
       scopes: [ "read_write" ],
+      source: "web",
       display_key: "test_rw_#{SecureRandom.hex(8)}"
     )
 
@@ -33,6 +34,92 @@ class Api::V1::ValuationsControllerTest < ActionDispatch::IntegrationTest
     Redis.new.del("api_rate_limit:#{@read_only_api_key.id}")
   end
 
+  # INDEX action tests
+  test "should get index with valid API key" do
+    get api_v1_valuations_url, headers: api_headers(@api_key)
+    assert_response :success
+
+    response_data = JSON.parse(response.body)
+    assert response_data.key?("valuations")
+    assert response_data.key?("pagination")
+    assert response_data["valuations"].is_a?(Array)
+    assert response_data["pagination"].key?("page")
+    assert response_data["pagination"].key?("per_page")
+    assert response_data["pagination"].key?("total_count")
+    assert response_data["pagination"].key?("total_pages")
+  end
+
+  test "should get index with read-only API key" do
+    get api_v1_valuations_url, headers: api_headers(@read_only_api_key)
+    assert_response :success
+  end
+
+  test "should filter index by account_id" do
+    get api_v1_valuations_url,
+        params: { account_id: @account.id },
+        headers: api_headers(@api_key)
+    assert_response :success
+
+    response_data = JSON.parse(response.body)
+    response_data["valuations"].each do |valuation|
+      assert_equal @account.id, valuation["account"]["id"]
+    end
+  end
+
+  test "should filter index by date range" do
+    entry = @valuation.entry
+
+    get api_v1_valuations_url,
+        params: { start_date: entry.date, end_date: entry.date },
+        headers: api_headers(@api_key)
+    assert_response :success
+
+    response_data = JSON.parse(response.body)
+    assert_includes response_data["valuations"].map { |valuation| valuation["id"] }, entry.id
+    response_data["valuations"].each do |valuation|
+      valuation_date = Date.iso8601(valuation["date"])
+      assert_equal entry.date, valuation_date
+    end
+  end
+
+  test "should reject index with invalid date filter" do
+    get api_v1_valuations_url,
+        params: { start_date: "04/30/2026" },
+        headers: api_headers(@api_key)
+    assert_response :unprocessable_entity
+
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+  end
+
+  test "should reject index with malformed account_id filter" do
+    get api_v1_valuations_url,
+        params: { account_id: "not-a-uuid" },
+        headers: api_headers(@api_key)
+    assert_response :unprocessable_entity
+
+    response_data = JSON.parse(response.body)
+    assert_equal "validation_failed", response_data["error"]
+    assert_equal "account_id must be a valid UUID", response_data["message"]
+  end
+
+  test "should not expose internal index errors" do
+    Api::V1::ValuationsController.any_instance.stubs(:safe_page_param).raises(StandardError, "database password leaked")
+
+    get api_v1_valuations_url, headers: api_headers(@api_key)
+    assert_response :internal_server_error
+
+    response_data = JSON.parse(response.body)
+    assert_equal "internal_server_error", response_data["error"]
+    assert_equal "An unexpected error occurred", response_data["message"]
+    assert_not_includes response.body, "database password leaked"
+  end
+
+  test "should reject index without API key" do
+    get api_v1_valuations_url
+    assert_response :unauthorized
+  end
+
   # CREATE action tests
   test "should create valuation with valid parameters" do
     valuation_params = {
@@ -56,6 +143,81 @@ class Api::V1::ValuationsControllerTest < ActionDispatch::IntegrationTest
     assert_equal @account.id, response_data["account"]["id"]
   end
 
+  test "should upsert valuation for same account and date when requested" do
+    existing_entry = @valuation.entry
+    valuation_params = {
+      upsert: "true",
+      valuation: {
+        account_id: existing_entry.account.id,
+        amount: 12_345.67,
+        date: existing_entry.date,
+        notes: "API correction"
+      }
+    }
+
+    assert_no_difference("@family.entries.valuations.count") do
+      post api_v1_valuations_url,
+           params: valuation_params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :ok
+    response_data = JSON.parse(response.body)
+    assert_equal existing_entry.id, response_data["id"]
+    assert_equal existing_entry.date.to_s, response_data["date"]
+    assert_equal "API correction", response_data["notes"]
+    assert_equal BigDecimal("12345.67"), existing_entry.reload.amount
+  end
+
+  test "should create valuation when upsert is requested without an existing same-date valuation" do
+    valuation_date = Date.current + 3.days
+    valuation_params = {
+      upsert: "true",
+      valuation: {
+        account_id: @account.id,
+        amount: 9876.54,
+        date: valuation_date,
+        notes: "New API valuation"
+      }
+    }
+
+    assert_difference("@family.entries.valuations.count", 1) do
+      post api_v1_valuations_url,
+           params: valuation_params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :created
+    response_data = JSON.parse(response.body)
+    assert_equal valuation_date.to_s, response_data["date"]
+    assert_equal "New API valuation", response_data["notes"]
+  end
+
+  test "should accept nested upsert flag for same-date valuation writes" do
+    existing_entry = @valuation.entry
+    valuation_params = {
+      valuation: {
+        account_id: existing_entry.account.id,
+        amount: 22_222.22,
+        date: existing_entry.date,
+        notes: "Nested upsert correction",
+        upsert: "true"
+      }
+    }
+
+    assert_no_difference("@family.entries.valuations.count") do
+      post api_v1_valuations_url,
+           params: valuation_params,
+           headers: api_headers(@api_key)
+    end
+
+    assert_response :ok
+    response_data = JSON.parse(response.body)
+    assert_equal existing_entry.id, response_data["id"]
+    assert_equal "Nested upsert correction", response_data["notes"]
+    assert_equal BigDecimal("22222.22"), existing_entry.reload.amount
+  end
+
   test "should reject create with read-only API key" do
     valuation_params = {
       valuation: {
@@ -207,6 +369,6 @@ class Api::V1::ValuationsControllerTest < ActionDispatch::IntegrationTest
   private
 
     def api_headers(api_key)
-      { "X-Api-Key" => api_key.display_key }
+      { "X-Api-Key" => api_key.plain_key }
     end
 end
diff --git a/test/controllers/brex_items_controller_test.rb b/test/controllers/brex_items_controller_test.rb
new file mode 100644
index 000000000..b443f2023
--- /dev/null
+++ b/test/controllers/brex_items_controller_test.rb
@@ -0,0 +1,488 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class BrexItemsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in users(:family_admin)
+    SyncJob.stubs(:perform_later)
+
+    @family = families(:dylan_family)
+    clear_brex_cache_entries
+    @existing_item = brex_items(:one)
+    @second_item = BrexItem.create!(
+      family: @family,
+      name: "Business Brex",
+      token: "second_brex_token",
+      base_url: "https://api.brex.com"
+    )
+  end
+
+  teardown do
+    clear_brex_cache_entries
+  end
+
+  test "create adds a new brex connection without overwriting existing credentials" do
+    existing_token = @existing_item.token
+
+    assert_difference "BrexItem.count", 1 do
+      post brex_items_url, params: {
+        brex_item: {
+          name: "Joint Brex",
+          token: "joint_brex_token",
+          base_url: "https://api.brex.com"
+        }
+      }
+    end
+
+    assert_redirected_to accounts_path
+    assert_equal existing_token, @existing_item.reload.token
+    assert_equal "joint_brex_token", @family.brex_items.find_by!(name: "Joint Brex").token
+  end
+
+  test "create uses localized default name when submitted name is blank" do
+    assert_difference "BrexItem.count", 1 do
+      post brex_items_url, params: {
+        brex_item: {
+          name: "  ",
+          token: "default_name_token",
+          base_url: "https://api.brex.com"
+        }
+      }
+    end
+
+    assert_redirected_to accounts_path
+    assert_equal I18n.t("brex_items.default_connection_name"), @family.brex_items.order(:created_at).last.name
+  end
+
+  test "update changes only the selected brex connection" do
+    existing_token = @existing_item.token
+
+    patch brex_item_url(@second_item), params: {
+      brex_item: {
+        name: "Renamed Business Brex",
+        token: "updated_second_token",
+        base_url: "https://api-staging.brex.com"
+      }
+    }
+
+    assert_redirected_to accounts_path
+    assert_equal existing_token, @existing_item.reload.token
+    assert_equal "Renamed Business Brex", @second_item.reload.name
+    assert_equal "updated_second_token", @second_item.token
+    assert_equal "https://api-staging.brex.com", @second_item.base_url
+  end
+
+  test "update rejects arbitrary brex base url" do
+    patch brex_item_url(@second_item), params: {
+      brex_item: {
+        name: "Renamed Business Brex",
+        token: "updated_second_token",
+        base_url: "https://evil.example.test"
+      }
+    }
+
+    assert_redirected_to settings_providers_path
+    assert_includes flash[:alert], "https://api.brex.com"
+    assert_equal "https://api.brex.com", @second_item.reload.base_url
+    assert_equal "second_brex_token", @second_item.token
+  end
+
+  test "blank token update preserves the selected brex token" do
+    original_token = @second_item.token
+
+    patch brex_item_url(@second_item), params: {
+      brex_item: {
+        name: "Renamed Business Brex",
+        token: "",
+        base_url: "https://api.brex.com"
+      }
+    }
+
+    assert_redirected_to accounts_path
+    assert_equal "Renamed Business Brex", @second_item.reload.name
+    assert_equal original_token, @second_item.token
+  end
+
+  test "update expires selected brex account cache when credentials change" do
+    Rails.cache.expects(:delete).with(brex_cache_key(@existing_item)).never
+    Rails.cache.expects(:delete).with(brex_cache_key(@second_item)).once
+
+    patch brex_item_url(@second_item), params: {
+      brex_item: {
+        name: "Renamed Business Brex",
+        token: "updated_second_token",
+        base_url: "https://api-staging.brex.com"
+      }
+    }
+
+    assert_redirected_to accounts_path
+  end
+
+  test "update does not expire selected brex account cache for name-only changes" do
+    Rails.cache.expects(:delete).never
+
+    patch brex_item_url(@second_item), params: {
+      brex_item: {
+        name: "Renamed Business Brex"
+      }
+    }
+
+    assert_redirected_to accounts_path
+    assert_equal "Renamed Business Brex", @second_item.reload.name
+  end
+
+  test "preload accounts uses selected brex item cache key" do
+    Rails.cache.expects(:read).with(brex_cache_key(@second_item)).returns(nil)
+    Rails.cache.expects(:write).with(brex_cache_key(@second_item), brex_accounts_payload, expires_in: 5.minutes)
+
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(accounts: brex_accounts_payload)
+    Provider::Brex.expects(:new)
+      .with(@second_item.token, base_url: @second_item.effective_base_url)
+      .returns(provider)
+
+    get preload_accounts_brex_items_url, params: { brex_item_id: @second_item.id }, as: :json
+
+    assert_response :success
+    response = JSON.parse(@response.body)
+    assert_equal true, response["success"]
+    assert_equal true, response["has_accounts"]
+  end
+
+  test "select accounts requires an explicit connection when multiple brex items exist" do
+    get select_accounts_brex_items_url, params: { accountable_type: "Depository" }
+
+    assert_redirected_to settings_providers_path
+    assert_equal I18n.t("brex_items.select_accounts.select_connection"), flash[:alert]
+  end
+
+  test "select accounts renders the selected brex item id" do
+    Rails.cache.expects(:read).with(brex_cache_key(@second_item)).returns(nil)
+    Rails.cache.expects(:write).with(brex_cache_key(@second_item), brex_accounts_payload, expires_in: 5.minutes)
+
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(accounts: brex_accounts_payload)
+    Provider::Brex.expects(:new)
+      .with(@second_item.token, base_url: @second_item.effective_base_url)
+      .returns(provider)
+
+    get select_accounts_brex_items_url, params: {
+      brex_item_id: @second_item.id,
+      accountable_type: "Depository"
+    }
+
+    assert_response :success
+    assert_includes @response.body, %(name="brex_item_id")
+    assert_includes @response.body, %(value="#{@second_item.id}")
+  end
+
+  test "select accounts rejects protocol relative return paths" do
+    Rails.cache.expects(:read).with(brex_cache_key(@second_item)).returns(brex_accounts_payload)
+
+    get select_accounts_brex_items_url, params: {
+      brex_item_id: @second_item.id,
+      accountable_type: "Depository",
+      return_to: "//evil.example/accounts"
+    }
+
+    assert_response :success
+    refute_includes @response.body, "//evil.example/accounts"
+  end
+
+  test "select accounts rejects backslash and unsafe local return paths" do
+    [
+      "/\\evil.example/accounts",
+      "/%2fevil.example/accounts",
+      "/%2Fevil.example/accounts",
+      "/%5cevil.example/accounts",
+      "/%5Cevil.example/accounts",
+      "/\naccounts",
+      "/ accounts",
+      "/"
+    ].each do |return_to|
+      Rails.cache.expects(:read).with(brex_cache_key(@second_item)).returns(brex_accounts_payload)
+
+      get select_accounts_brex_items_url, params: {
+        brex_item_id: @second_item.id,
+        accountable_type: "Depository",
+        return_to: return_to
+      }
+
+      assert_response :success
+      assert_select %(input[name="return_to"]) do |fields|
+        assert fields.first["value"].blank?
+      end
+    end
+  end
+
+  test "select existing account rejects unsafe return paths" do
+    account = @family.accounts.create!(
+      name: "Manual Checking",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+
+    [
+      "//evil.example/accounts",
+      "\\evil.example/accounts",
+      "/\\evil.example/accounts",
+      "/%2fevil.example/accounts",
+      "/%2Fevil.example/accounts",
+      "/%5cevil.example/accounts",
+      "/%5Cevil.example/accounts",
+      "/\naccounts",
+      "/ accounts",
+      "   ",
+      "/"
+    ].each do |return_to|
+      Rails.cache.expects(:read).with(brex_cache_key(@second_item)).returns(brex_accounts_payload)
+
+      get select_existing_account_brex_items_url, params: {
+        brex_item_id: @second_item.id,
+        account_id: account.id,
+        return_to: return_to
+      }
+
+      assert_response :success
+      assert_select %(input[name="return_to"]) do |fields|
+        assert fields.first["value"].blank?
+      end
+    end
+  end
+
+  test "select existing account preserves safe local return path" do
+    account = @family.accounts.create!(
+      name: "Manual Checking",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+    return_to = "/accounts?tab=manual"
+
+    Rails.cache.expects(:read).with(brex_cache_key(@second_item)).returns(brex_accounts_payload)
+
+    get select_existing_account_brex_items_url, params: {
+      brex_item_id: @second_item.id,
+      account_id: account.id,
+      return_to: return_to
+    }
+
+    assert_response :success
+    assert_select %(input[name="return_to"][value="#{return_to}"])
+  end
+
+  test "select existing account redirects when account id is invalid" do
+    get select_existing_account_brex_items_url, params: {
+      brex_item_id: @second_item.id,
+      account_id: SecureRandom.uuid
+    }
+
+    assert_redirected_to accounts_path
+    assert_equal I18n.t("brex_items.select_existing_account.no_account_specified"), flash[:alert]
+  end
+
+  test "select existing account renders the selected brex item id" do
+    account = @family.accounts.create!(
+      name: "Manual Checking",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+
+    Rails.cache.expects(:read).with(brex_cache_key(@second_item)).returns(nil)
+    Rails.cache.expects(:write).with(brex_cache_key(@second_item), brex_accounts_payload, expires_in: 5.minutes)
+
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(accounts: brex_accounts_payload)
+    Provider::Brex.expects(:new)
+      .with(@second_item.token, base_url: @second_item.effective_base_url)
+      .returns(provider)
+
+    get select_existing_account_brex_items_url, params: {
+      brex_item_id: @second_item.id,
+      account_id: account.id
+    }
+
+    assert_response :success
+    assert_includes @response.body, %(name="brex_item_id")
+    assert_includes @response.body, %(value="#{@second_item.id}")
+  end
+
+  test "link accounts uses selected brex item and allows duplicate upstream ids across items" do
+    @existing_item.brex_accounts.create!(
+      account_id: "shared_brex_account",
+      name: "Shared Checking",
+      currency: "USD",
+      current_balance: 1000
+    )
+
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(accounts: brex_accounts_payload)
+    Provider::Brex.expects(:new)
+      .with(@second_item.token, base_url: @second_item.effective_base_url)
+      .returns(provider)
+
+    assert_difference -> { @second_item.brex_accounts.where(account_id: "shared_brex_account").count }, 1 do
+      assert_difference "AccountProvider.count", 1 do
+        post link_accounts_brex_items_url, params: {
+          brex_item_id: @second_item.id,
+          account_ids: [ "shared_brex_account" ],
+          accountable_type: "Depository"
+        }
+      end
+    end
+
+    assert_redirected_to accounts_path
+    assert_equal 1, @existing_item.brex_accounts.where(account_id: "shared_brex_account").count
+  end
+
+  test "link accounts does not silently use the first connection when multiple items exist" do
+    assert_no_difference "BrexAccount.count" do
+      assert_no_difference "Account.count" do
+        post link_accounts_brex_items_url, params: {
+          account_ids: [ "shared_brex_account" ],
+          accountable_type: "Depository"
+        }
+      end
+    end
+
+    assert_redirected_to settings_providers_path
+    assert_equal I18n.t("brex_items.link_accounts.select_connection"), flash[:alert]
+  end
+
+  test "link existing account does not silently use the first connection when multiple items exist" do
+    account = @family.accounts.create!(
+      name: "Manual Checking",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+
+    assert_no_difference "BrexAccount.count" do
+      assert_no_difference "AccountProvider.count" do
+        post link_existing_account_brex_items_url, params: {
+          account_id: account.id,
+          brex_account_id: "shared_brex_account"
+        }
+      end
+    end
+
+    assert_redirected_to settings_providers_path
+    assert_equal I18n.t("brex_items.link_existing_account.select_connection"), flash[:alert]
+  end
+
+  test "link existing account requires account id" do
+    assert_no_difference "AccountProvider.count" do
+      post link_existing_account_brex_items_url, params: {
+        brex_item_id: @second_item.id,
+        brex_account_id: "shared_brex_account"
+      }
+    end
+
+    assert_redirected_to accounts_path
+    assert_equal I18n.t("brex_items.link_existing_account.no_account_specified"), flash[:alert]
+  end
+
+  test "link existing account redirects when account id is invalid" do
+    assert_no_difference "AccountProvider.count" do
+      post link_existing_account_brex_items_url, params: {
+        brex_item_id: @second_item.id,
+        account_id: SecureRandom.uuid,
+        brex_account_id: "shared_brex_account"
+      }
+    end
+
+    assert_redirected_to accounts_path
+    assert_equal I18n.t("brex_items.link_existing_account.no_account_specified"), flash[:alert]
+  end
+
+  test "sync only queues a sync for the selected brex item" do
+    assert_difference -> { Sync.where(syncable: @second_item).count }, 1 do
+      assert_no_difference -> { Sync.where(syncable: @existing_item).count } do
+        post sync_brex_item_url(@second_item)
+      end
+    end
+
+    assert_response :redirect
+  end
+
+  test "complete account setup ignores unsupported account type and subtype params" do
+    valid_brex_account = @second_item.brex_accounts.create!(
+      account_id: "setup_valid",
+      account_kind: "cash",
+      name: "Setup Valid",
+      currency: "USD",
+      current_balance: 100
+    )
+    unsupported_brex_account = @second_item.brex_accounts.create!(
+      account_id: "setup_unsupported",
+      account_kind: "cash",
+      name: "Setup Unsupported",
+      currency: "USD",
+      current_balance: 100
+    )
+
+    assert_difference "AccountProvider.count", 1 do
+      post complete_account_setup_brex_item_url(@second_item), params: {
+        account_types: {
+          valid_brex_account.id => "Depository",
+          unsupported_brex_account.id => "Investment",
+          "not-a-brex-account" => "Depository"
+        },
+        account_subtypes: {
+          valid_brex_account.id => "savings",
+          unsupported_brex_account.id => "brokerage",
+          "not-a-brex-account" => "checking"
+        }
+      }
+    end
+
+    assert_redirected_to accounts_path
+    assert_equal "savings", valid_brex_account.reload.account.accountable.subtype
+    assert_nil unsupported_brex_account.reload.account_provider
+    assert_match(/skipped/i, flash[:notice])
+  end
+
+  test "complete account setup treats scalar setup params as empty" do
+    assert_no_difference "AccountProvider.count" do
+      post complete_account_setup_brex_item_url(@second_item), params: {
+        account_types: "not-a-hash",
+        account_subtypes: "also-not-a-hash"
+      }
+    end
+
+    assert_redirected_to accounts_path
+    assert_equal I18n.t("brex_items.complete_account_setup.no_accounts"), flash[:alert]
+  end
+
+  private
+
+    def brex_accounts_payload
+      [
+        {
+          id: "shared_brex_account",
+          name: "Shared Checking",
+          account_kind: "cash",
+          status: "active",
+          current_balance: { amount: 100_000, currency: "USD" },
+          available_balance: { amount: 95_000, currency: "USD" }
+        }
+      ]
+    end
+
+    def brex_cache_key(brex_item)
+      BrexItem::AccountFlow.cache_key(@family, brex_item)
+    end
+
+    def clear_brex_cache_entries
+      return unless defined?(@family) && @family.present?
+      return unless Rails.cache.respond_to?(:delete_matched)
+
+      Rails.cache.delete_matched("brex_accounts_#{@family.id}_*")
+    rescue NotImplementedError
+      # Some test cache stores do not implement delete_matched; tests that depend
+      # on cache state stub exact Brex cache keys instead of relying on globals.
+    end
+end
diff --git a/test/controllers/budget_categories_controller_test.rb b/test/controllers/budget_categories_controller_test.rb
index 96c6348a5..5bea22d96 100644
--- a/test/controllers/budget_categories_controller_test.rb
+++ b/test/controllers/budget_categories_controller_test.rb
@@ -2,6 +2,7 @@ require "test_helper"
 
 class BudgetCategoriesControllerTest < ActionDispatch::IntegrationTest
   include ActionView::RecordIdentifier
+  include EntriesTestHelper
 
   setup do
     sign_in users(:family_admin)
@@ -50,6 +51,19 @@ class BudgetCategoriesControllerTest < ActionDispatch::IntegrationTest
     )
   end
 
+  test "index marks budget form values as privacy-sensitive" do
+    parent_form_selector = "##{dom_id(@parent_budget_category, :form)}"
+    uncategorized_form_selector = "##{dom_id(@budget, :uncategorized_budget_category_form)}"
+
+    get budget_budget_categories_path(@budget)
+
+    assert_response :success
+    assert_select "#{parent_form_selector} .privacy-sensitive.privacy-sensitive-interactive input##{dom_id(@parent_budget_category, :budgeted_spending)}"
+    assert_select "#{parent_form_selector} p.text-secondary.privacy-sensitive", text: /\/m avg/
+    assert_select "#{uncategorized_form_selector} .privacy-sensitive input[name='uncategorized']"
+    assert_select "#{uncategorized_form_selector} p.text-secondary.privacy-sensitive", text: /\/m avg/
+  end
+
   test "updating a subcategory adjusts the parent budget by the same delta" do
     assert_changes -> { @parent_budget_category.reload.budgeted_spending.to_f }, from: 500.0, to: 550.0 do
       patch budget_budget_category_path(@budget, @electric_budget_category),
@@ -94,4 +108,58 @@ class BudgetCategoriesControllerTest < ActionDispatch::IntegrationTest
 
     assert_equal 0.0, @electric_budget_category.reload.budgeted_spending.to_f
   end
+
+  test "show drilldown excludes BUDGET_EXCLUDED_KINDS transfers from recent transactions" do
+    # Issue #1059: a matched depository <-> CC pair becomes
+    # (cc_payment outflow + funds_movement inflow). Both kinds are in
+    # BUDGET_EXCLUDED_KINDS so the budget aggregate excludes them, but
+    # the per-category drilldown previously listed them anyway --
+    # appearing under whatever category they retained (or under
+    # Uncategorized once the matcher cleared the category). Filter
+    # them out so the drilldown matches the aggregate.
+    create_transaction(
+      date: @budget.start_date,
+      account: accounts(:depository),
+      amount: 500,
+      name: "BUG_1059_REPRO_OUTFLOW"
+    )
+    create_transaction(
+      date: @budget.start_date,
+      account: accounts(:credit_card),
+      amount: -500,
+      name: "BUG_1059_REPRO_INFLOW"
+    )
+    @family.auto_match_transfers!
+
+    get budget_budget_category_path(@budget, BudgetCategory.uncategorized.id)
+    assert_response :success
+    refute_includes @response.body, "BUG_1059_REPRO_OUTFLOW",
+      "matched cc_payment outflow must not appear in Uncategorized drilldown"
+    refute_includes @response.body, "BUG_1059_REPRO_INFLOW",
+      "matched funds_movement inflow must not appear in Uncategorized drilldown"
+  end
+
+  test "show drilldown still lists loan_payment transfers (intentionally budget-tracked)" do
+    # loan_payment is NOT in BUDGET_EXCLUDED_KINDS. The drilldown should
+    # keep showing loan_payment transfers so the user can see what's
+    # under Uncategorized (or whichever category they manually set).
+    create_transaction(
+      date: @budget.start_date,
+      account: accounts(:depository),
+      amount: 500,
+      name: "MORTGAGE_REPRO_OUTFLOW"
+    )
+    create_transaction(
+      date: @budget.start_date,
+      account: accounts(:loan),
+      amount: -500,
+      name: "MORTGAGE_REPRO_INFLOW"
+    )
+    @family.auto_match_transfers!
+
+    get budget_budget_category_path(@budget, BudgetCategory.uncategorized.id)
+    assert_response :success
+    assert_includes @response.body, "MORTGAGE_REPRO_OUTFLOW",
+      "loan_payment outflow remains visible (kind is not BUDGET_EXCLUDED)"
+  end
 end
diff --git a/test/controllers/categories_controller_test.rb b/test/controllers/categories_controller_test.rb
index 2f7c8ff5e..33bdf6641 100644
--- a/test/controllers/categories_controller_test.rb
+++ b/test/controllers/categories_controller_test.rb
@@ -4,11 +4,15 @@ class CategoriesControllerTest < ActionDispatch::IntegrationTest
   setup do
     sign_in users(:family_admin)
     @transaction = transactions :one
+    ensure_tailwind_build
   end
 
   test "index" do
     get categories_url
     assert_response :success
+    assert_select "#category_#{categories(:food_and_drink).id} > [data-testid='category-content']", count: 1
+    assert_select "#category_#{categories(:food_and_drink).id} > [data-testid='category-actions']", count: 1
+    assert_select "#category_#{categories(:food_and_drink).id} [data-testid='category-name']", text: categories(:food_and_drink).name
   end
 
   test "new" do
diff --git a/test/controllers/category/deletions_controller_test.rb b/test/controllers/category/deletions_controller_test.rb
index c8bd3d37c..4cc5c166d 100644
--- a/test/controllers/category/deletions_controller_test.rb
+++ b/test/controllers/category/deletions_controller_test.rb
@@ -4,11 +4,14 @@ class Category::DeletionsControllerTest < ActionDispatch::IntegrationTest
   setup do
     sign_in users(:family_admin)
     @category = categories(:food_and_drink)
+    ensure_tailwind_build
   end
 
   test "new" do
     get new_category_deletion_url(@category)
     assert_response :success
+    assert_select "turbo-frame#modal"
+    assert_select "turbo-frame#modal button span.min-w-0.truncate", text: /Delete "Food & Drink" and leave uncategorized/
   end
 
   test "create with replacement" do
diff --git a/test/controllers/coinstats_items_controller_test.rb b/test/controllers/coinstats_items_controller_test.rb
index a3bfc24e0..13c1d7d4e 100644
--- a/test/controllers/coinstats_items_controller_test.rb
+++ b/test/controllers/coinstats_items_controller_test.rb
@@ -9,9 +9,7 @@ class CoinstatsItemsControllerTest < ActionDispatch::IntegrationTest
       name: "Test CoinStats Connection",
       api_key: "test_api_key_123"
     )
-    tailwind_build = Rails.root.join("app/assets/builds/tailwind.css")
-    FileUtils.mkdir_p(tailwind_build.dirname)
-    File.write(tailwind_build, "/* test */") unless tailwind_build.exist?
+    ensure_tailwind_build
   end
 
   # Helper to wrap data in Provider::Response
diff --git a/test/controllers/exchange_rates_controller_test.rb b/test/controllers/exchange_rates_controller_test.rb
new file mode 100644
index 000000000..13b7b6965
--- /dev/null
+++ b/test/controllers/exchange_rates_controller_test.rb
@@ -0,0 +1,173 @@
+require "test_helper"
+
+class ExchangeRatesControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    sign_in @user
+  end
+
+  test "returns rate for different currencies" do
+    ExchangeRate.create!(
+      from_currency: "EUR",
+      to_currency: "USD",
+      date: Date.current,
+      rate: 1.2
+    )
+
+    get exchange_rate_url, params: {
+      from: "EUR",
+      to: "USD",
+      date: Date.current
+    }
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    assert_equal 1.2, json_response["rate"]
+  end
+
+  test "returns same_currency flag for matching currencies" do
+    get exchange_rate_url, params: {
+      from: "USD",
+      to: "USD"
+    }
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    assert json_response["same_currency"]
+    assert_equal 1.0, json_response["rate"]
+  end
+
+  test "uses provided date for rate lookup" do
+    custom_date = 3.days.ago.to_date
+    ExchangeRate.create!(
+      from_currency: "EUR",
+      to_currency: "USD",
+      date: custom_date,
+      rate: 1.25
+    )
+
+    get exchange_rate_url, params: {
+      from: "EUR",
+      to: "USD",
+      date: custom_date
+    }
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    assert_equal 1.25, json_response["rate"]
+  end
+
+  test "defaults to current date when not provided" do
+    ExchangeRate.create!(
+      from_currency: "EUR",
+      to_currency: "USD",
+      date: Date.current,
+      rate: 1.2
+    )
+
+    get exchange_rate_url, params: {
+      from: "EUR",
+      to: "USD"
+    }
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    assert_equal 1.2, json_response["rate"]
+  end
+
+  test "returns 400 when from currency is missing" do
+    get exchange_rate_url, params: {
+      to: "USD"
+    }
+
+    assert_response :bad_request
+    json_response = JSON.parse(response.body)
+    assert_equal "from and to currencies are required", json_response["error"]
+  end
+
+  test "returns 400 when to currency is missing" do
+    get exchange_rate_url, params: {
+      from: "EUR"
+    }
+
+    assert_response :bad_request
+    json_response = JSON.parse(response.body)
+    assert_equal "from and to currencies are required", json_response["error"]
+  end
+
+  test "returns 400 on invalid date format" do
+    get exchange_rate_url, params: {
+      from: "EUR",
+      to: "USD",
+      date: "not-a-date"
+    }
+
+    assert_response :bad_request
+    json_response = JSON.parse(response.body)
+    assert_equal "Invalid date format", json_response["error"]
+  end
+
+  test "returns 404 when rate not found" do
+    get exchange_rate_url, params: {
+      from: "EUR",
+      to: "USD",
+      date: Date.current
+    }
+
+    assert_response :not_found
+    json_response = JSON.parse(response.body)
+    assert_equal "Exchange rate not found", json_response["error"]
+  end
+
+  test "handles uppercase and lowercase currency codes" do
+    ExchangeRate.create!(
+      from_currency: "EUR",
+      to_currency: "USD",
+      date: Date.current,
+      rate: 1.2
+    )
+
+    get exchange_rate_url, params: {
+      from: "eur",
+      to: "usd"
+    }
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    assert_equal 1.2, json_response["rate"]
+  end
+
+  test "returns numeric rate even when object has rate method" do
+    # Create mock object that returns a rate
+    rate_obj = OpenStruct.new(rate: 1.2)
+
+    ExchangeRate.expects(:find_or_fetch_rate)
+                .with(from: "EUR", to: "USD", date: Date.current)
+                .returns(rate_obj)
+
+    get exchange_rate_url, params: {
+      from: "EUR",
+      to: "USD"
+    }
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    assert_equal 1.2, json_response["rate"]
+    assert_instance_of Float, json_response["rate"]
+  end
+
+  test "returns error when find_or_fetch_rate raises exception" do
+    ExchangeRate.expects(:find_or_fetch_rate)
+                .with(from: "EUR", to: "USD", date: Date.current)
+                .raises(StandardError, "Rate fetch failed")
+
+    get exchange_rate_url, params: {
+      from: "EUR",
+      to: "USD"
+    }
+
+    assert_response :bad_request
+    json_response = JSON.parse(response.body)
+    assert_equal "Failed to fetch exchange rate", json_response["error"]
+  end
+end
diff --git a/test/controllers/ibkr_items_controller_test.rb b/test/controllers/ibkr_items_controller_test.rb
new file mode 100644
index 000000000..fbb0bccb0
--- /dev/null
+++ b/test/controllers/ibkr_items_controller_test.rb
@@ -0,0 +1,100 @@
+require "test_helper"
+
+class IbkrItemsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in @user = users(:family_admin)
+    @ibkr_item = ibkr_items(:configured_item)
+  end
+
+  test "select_existing_account renders available ibkr accounts" do
+    get select_existing_account_ibkr_items_url, params: { account_id: accounts(:investment).id }
+
+    assert_response :success
+    assert_includes response.body, ibkr_accounts(:main_account).name
+  end
+
+  test "create redirects to accounts on success" do
+    assert_difference "IbkrItem.count", 1 do
+      post ibkr_items_url, params: {
+        ibkr_item: {
+          query_id: "QUERYNEW",
+          token: "TOKENNEW"
+        }
+      }
+    end
+
+    assert_redirected_to accounts_path
+  end
+
+  test "update redirects to accounts on success" do
+    patch ibkr_item_url(@ibkr_item), params: {
+      ibkr_item: {
+        query_id: "",
+        token: ""
+      }
+    }
+
+    assert_redirected_to accounts_path
+  end
+
+  test "complete_account_setup creates investment account and provider link" do
+    assert_difference "Account.count", 1 do
+      assert_difference "AccountProvider.count", 1 do
+        post complete_account_setup_ibkr_item_url(@ibkr_item), params: {
+          account_ids: [ ibkr_accounts(:main_account).id ]
+        }
+      end
+    end
+
+    created_account = Account.order(created_at: :desc).first
+    assert_equal "Investment", created_account.accountable_type
+    assert_equal "brokerage", created_account.accountable.subtype
+    assert_redirected_to accounts_path
+
+    ibkr_accounts(:main_account).reload
+    assert_equal created_account, ibkr_accounts(:main_account).current_account
+  end
+
+  test "link_existing_account links manual investment account" do
+    account = accounts(:investment)
+
+    assert_difference "AccountProvider.count", 1 do
+      post link_existing_account_ibkr_items_url, params: {
+        account_id: account.id,
+        ibkr_account_id: ibkr_accounts(:main_account).id
+      }
+    end
+
+    assert_redirected_to account_path(account)
+    ibkr_accounts(:main_account).reload
+    assert_equal account, ibkr_accounts(:main_account).current_account
+  end
+
+  test "link_existing_account rejects already linked ibkr account" do
+    original_account = accounts(:investment)
+    ibkr_account = ibkr_accounts(:main_account)
+    AccountProvider.create!(account: original_account, provider: ibkr_account)
+
+    replacement_account = Account.create!(
+      family: @ibkr_item.family,
+      owner: @user,
+      name: "Replacement Brokerage Account",
+      balance: 2500,
+      cash_balance: 2500,
+      currency: "USD",
+      accountable: Investment.create!(subtype: "brokerage")
+    )
+
+    assert_no_difference "AccountProvider.count" do
+      post link_existing_account_ibkr_items_url, params: {
+        account_id: replacement_account.id,
+        ibkr_account_id: ibkr_account.id
+      }
+    end
+
+    assert_redirected_to account_path(replacement_account)
+    assert_equal "This Interactive Brokers account is already linked.", flash[:alert]
+    ibkr_account.reload
+    assert_equal original_account, ibkr_account.current_account
+  end
+end
diff --git a/test/controllers/import/rows_controller_test.rb b/test/controllers/import/rows_controller_test.rb
index e6394d944..c58c07d02 100644
--- a/test/controllers/import/rows_controller_test.rb
+++ b/test/controllers/import/rows_controller_test.rb
@@ -18,7 +18,7 @@ class Import::RowsControllerTest < ActionDispatch::IntegrationTest
 
   test "show trade row" do
     import = @user.family.imports.create!(type: "TradeImport")
-    row = import.rows.create!(date: "01/01/2024", currency: "USD", qty: 10, price: 100, ticker: "AAPL")
+    row = import.rows.create!(source_row_number: 1, date: "01/01/2024", currency: "USD", qty: 10, price: 100, ticker: "AAPL")
 
     get import_row_path(import, row)
 
@@ -29,7 +29,7 @@ class Import::RowsControllerTest < ActionDispatch::IntegrationTest
 
   test "show account row" do
     import = @user.family.imports.create!(type: "AccountImport")
-    row = import.rows.create!(name: "Test Account", amount: 10000, currency: "USD")
+    row = import.rows.create!(source_row_number: 1, name: "Test Account", amount: 10000, currency: "USD")
 
     get import_row_path(import, row)
 
@@ -40,7 +40,7 @@ class Import::RowsControllerTest < ActionDispatch::IntegrationTest
 
   test "show mint row" do
     import = @user.family.imports.create!(type: "MintImport")
-    row = import.rows.create!(date: "01/01/2024", amount: 100, currency: "USD")
+    row = import.rows.create!(source_row_number: 1, date: "01/01/2024", amount: 100, currency: "USD")
 
     get import_row_path(import, row)
 
diff --git a/test/controllers/imports_controller_test.rb b/test/controllers/imports_controller_test.rb
index dbea78d2d..eea32693a 100644
--- a/test/controllers/imports_controller_test.rb
+++ b/test/controllers/imports_controller_test.rb
@@ -3,6 +3,7 @@ require "test_helper"
 class ImportsControllerTest < ActionDispatch::IntegrationTest
   setup do
     sign_in @user = users(:family_admin)
+    ensure_tailwind_build
   end
 
   test "gets index" do
@@ -33,6 +34,7 @@ class ImportsControllerTest < ActionDispatch::IntegrationTest
     assert_select "button", text: "Import transactions", count: 0
     assert_select "button", text: "Import investments", count: 0
     assert_select "button", text: "Import from Mint", count: 1
+    assert_select "button", text: "Import from Actual Budget", count: 1
     assert_select "button", text: "Import from Quicken (QIF)", count: 1
     assert_select "span", text: "Import accounts first to unlock this option.", count: 2
     assert_select "div[aria-disabled=true]", count: 3
diff --git a/test/controllers/indexa_capital_items_controller_test.rb b/test/controllers/indexa_capital_items_controller_test.rb
index 1f0df601b..f382bb275 100644
--- a/test/controllers/indexa_capital_items_controller_test.rb
+++ b/test/controllers/indexa_capital_items_controller_test.rb
@@ -56,9 +56,7 @@ class IndexaCapitalItemsControllerTest < ActionDispatch::IntegrationTest
 
     assert_difference "Account.count", 1 do
       post complete_account_setup_indexa_capital_item_url(@item), params: {
-        accounts: {
-          ica.id => { account_type: "investment", subtype: "brokerage" }
-        }
+        account_ids: [ ica.id ]
       }
     end
 
@@ -80,21 +78,15 @@ class IndexaCapitalItemsControllerTest < ActionDispatch::IntegrationTest
 
     assert_no_difference "Account.count" do
       post complete_account_setup_indexa_capital_item_url(@item), params: {
-        accounts: {
-          ica.id => { account_type: "investment" }
-        }
+        account_ids: [ ica.id ]
       }
     end
   end
 
-  test "complete_account_setup with all skipped redirects to setup" do
-    ica = indexa_capital_accounts(:mutual_fund)
-
+  test "complete_account_setup with no selected accounts redirects to setup" do
     assert_no_difference "Account.count" do
       post complete_account_setup_indexa_capital_item_url(@item), params: {
-        accounts: {
-          ica.id => { account_type: "skip" }
-        }
+        account_ids: []
       }
     end
 
diff --git a/test/controllers/kraken_items_controller_test.rb b/test/controllers/kraken_items_controller_test.rb
new file mode 100644
index 000000000..e287fcecb
--- /dev/null
+++ b/test/controllers/kraken_items_controller_test.rb
@@ -0,0 +1,278 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class KrakenItemsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in users(:family_admin)
+    SyncJob.stubs(:perform_later)
+
+    @family = families(:dylan_family)
+    @existing_item = kraken_items(:one)
+    kraken_items(:requires_update).update!(scheduled_for_deletion: true)
+    @second_item = KrakenItem.create!(
+      family: @family,
+      name: "Business Kraken",
+      api_key: "second_kraken_key",
+      api_secret: "second_kraken_secret"
+    )
+  end
+
+  test "create adds a new kraken connection without overwriting existing credentials" do
+    existing_key = @existing_item.api_key
+    existing_secret = @existing_item.api_secret
+
+    assert_difference "KrakenItem.count", 1 do
+      post kraken_items_url, params: {
+        kraken_item: {
+          name: "Joint Kraken",
+          api_key: "joint_kraken_key",
+          api_secret: "joint_kraken_secret"
+        }
+      }
+    end
+
+    assert_redirected_to settings_providers_path
+    assert_equal existing_key, @existing_item.reload.api_key
+    assert_equal existing_secret, @existing_item.api_secret
+    assert_equal "joint_kraken_key", @family.kraken_items.find_by!(name: "Joint Kraken").api_key
+  end
+
+  test "update changes only the selected kraken connection" do
+    existing_key = @existing_item.api_key
+
+    patch kraken_item_url(@second_item), params: {
+      kraken_item: {
+        name: "Renamed Business Kraken",
+        api_key: "updated_second_key",
+        api_secret: "updated_second_secret"
+      }
+    }
+
+    assert_redirected_to settings_providers_path
+    assert_equal existing_key, @existing_item.reload.api_key
+    assert_equal "Renamed Business Kraken", @second_item.reload.name
+    assert_equal "updated_second_key", @second_item.api_key
+    assert_equal "updated_second_secret", @second_item.api_secret
+  end
+
+  test "blank secret update preserves the selected kraken credentials" do
+    original_key = @second_item.api_key
+    original_secret = @second_item.api_secret
+
+    patch kraken_item_url(@second_item), params: {
+      kraken_item: {
+        name: "Renamed Business Kraken",
+        api_key: "",
+        api_secret: ""
+      }
+    }
+
+    assert_redirected_to settings_providers_path
+    assert_equal "Renamed Business Kraken", @second_item.reload.name
+    assert_equal original_key, @second_item.api_key
+    assert_equal original_secret, @second_item.api_secret
+  end
+
+  test "create rejects whitespace-only credentials" do
+    assert_no_difference "KrakenItem.count" do
+      post kraken_items_url, params: {
+        kraken_item: {
+          name: "Blank Kraken",
+          api_key: "   ",
+          api_secret: "\n"
+        }
+      }
+    end
+
+    assert_redirected_to settings_providers_path
+    assert_match(/API key can't be blank/i, flash[:alert])
+  end
+
+  test "select accounts requires an explicit connection when multiple kraken items exist" do
+    get select_accounts_kraken_items_url, params: { accountable_type: "Crypto" }
+
+    assert_redirected_to settings_providers_path
+    assert_equal "Choose a Kraken connection in Provider Settings.", flash[:alert]
+  end
+
+  test "select accounts targets selected kraken item" do
+    get select_accounts_kraken_items_url, params: {
+      kraken_item_id: @second_item.id,
+      accountable_type: "Crypto"
+    }
+
+    assert_redirected_to setup_accounts_kraken_item_path(@second_item, return_to: nil)
+  end
+
+  test "select accounts rejects protocol-relative return paths" do
+    get select_accounts_kraken_items_url, params: {
+      kraken_item_id: @second_item.id,
+      accountable_type: "Crypto",
+      return_to: "//evil.example/accounts"
+    }
+
+    assert_redirected_to setup_accounts_kraken_item_path(@second_item, return_to: nil)
+  end
+
+  test "sync only queues a sync for the selected kraken item" do
+    assert_difference -> { Sync.where(syncable: @second_item).count }, 1 do
+      assert_no_difference -> { Sync.where(syncable: @existing_item).count } do
+        post sync_kraken_item_url(@second_item)
+      end
+    end
+
+    assert_response :redirect
+  end
+
+  test "setup accounts creates crypto exchange account for selected item only" do
+    first_account = kraken_accounts(:one)
+    second_account = @second_item.kraken_accounts.create!(
+      name: "Second Kraken",
+      account_id: "combined",
+      account_type: "combined",
+      currency: "USD",
+      current_balance: 1000
+    )
+    KrakenAccount::Processor.any_instance.stubs(:process).returns(nil)
+
+    assert_difference "Account.count", 1 do
+      post complete_account_setup_kraken_item_url(@second_item), params: {
+        selected_accounts: [ second_account.id ]
+      }
+    end
+
+    assert_redirected_to accounts_path
+    assert_nil first_account.reload.current_account
+    assert_equal "Crypto", second_account.reload.current_account.accountable_type
+    assert_equal "exchange", second_account.current_account.accountable.subtype
+  end
+
+  test "link existing account links manual crypto exchange account to selected kraken account" do
+    manual_account = manual_crypto_exchange_account
+    kraken_account = @second_item.kraken_accounts.create!(
+      name: "Kraken",
+      account_id: "combined",
+      account_type: "combined",
+      currency: "USD",
+      current_balance: 1000
+    )
+
+    assert_difference "AccountProvider.count", 1 do
+      post link_existing_account_kraken_items_url, params: {
+        kraken_item_id: @second_item.id,
+        account_id: manual_account.id,
+        kraken_account_id: kraken_account.id
+      }
+    end
+
+    assert_redirected_to accounts_path
+    assert_equal manual_account, kraken_account.reload.current_account
+  end
+
+  test "link existing account requires explicit connection when multiple items exist" do
+    account = manual_crypto_exchange_account
+
+    assert_no_difference "AccountProvider.count" do
+      post link_existing_account_kraken_items_url, params: {
+        account_id: account.id,
+        kraken_account_id: "combined"
+      }
+    end
+
+    assert_redirected_to settings_providers_path
+    assert_equal "Choose a Kraken connection before linking accounts.", flash[:alert]
+  end
+
+  test "link existing account rejects non crypto accounts" do
+    account = @family.accounts.create!(
+      name: "Manual Checking",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+    kraken_account = @second_item.kraken_accounts.create!(name: "Kraken", account_id: "combined", account_type: "combined", currency: "USD")
+
+    assert_no_difference "AccountProvider.count" do
+      post link_existing_account_kraken_items_url, params: {
+        kraken_item_id: @second_item.id,
+        account_id: account.id,
+        kraken_account_id: kraken_account.id
+      }
+    end
+
+    assert_redirected_to account_path(account)
+  end
+
+  test "link existing account rejects accounts with existing provider links" do
+    account = manual_crypto_exchange_account
+    linked_kraken_account = kraken_accounts(:one)
+    AccountProvider.create!(account: account, provider: linked_kraken_account)
+    kraken_account = @second_item.kraken_accounts.create!(name: "Kraken", account_id: "combined", account_type: "combined", currency: "USD")
+
+    assert_no_difference "AccountProvider.count" do
+      post link_existing_account_kraken_items_url, params: {
+        kraken_item_id: @second_item.id,
+        account_id: account.id,
+        kraken_account_id: kraken_account.id
+      }
+    end
+
+    assert_redirected_to account_path(account)
+  end
+
+  test "link existing account rejects kraken accounts already linked elsewhere" do
+    linked_account = manual_crypto_exchange_account
+    available_account = manual_crypto_exchange_account
+    kraken_account = @second_item.kraken_accounts.create!(name: "Kraken", account_id: "combined", account_type: "combined", currency: "USD")
+    AccountProvider.create!(account: linked_account, provider: kraken_account)
+
+    assert_no_difference "AccountProvider.count" do
+      post link_existing_account_kraken_items_url, params: {
+        kraken_item_id: @second_item.id,
+        account_id: available_account.id,
+        kraken_account_id: kraken_account.id
+      }
+    end
+
+    assert_redirected_to account_path(available_account)
+  end
+
+  test "select existing account renders selected kraken item id" do
+    account = manual_crypto_exchange_account
+    @second_item.kraken_accounts.create!(name: "Kraken", account_id: "combined", account_type: "combined", currency: "USD")
+
+    get select_existing_account_kraken_items_url, params: {
+      kraken_item_id: @second_item.id,
+      account_id: account.id
+    }
+
+    assert_response :success
+    assert_includes @response.body, %(name="kraken_item_id")
+    assert_includes @response.body, %(value="#{@second_item.id}")
+  end
+
+  test "cannot access another family's kraken item" do
+    other_item = KrakenItem.create!(
+      family: families(:empty),
+      name: "Other Kraken",
+      api_key: "other_key",
+      api_secret: "other_secret"
+    )
+
+    get setup_accounts_kraken_item_url(other_item)
+
+    assert_response :not_found
+  end
+
+  private
+
+    def manual_crypto_exchange_account
+      @family.accounts.create!(
+        name: "Manual Crypto",
+        balance: 0,
+        currency: "USD",
+        accountable: Crypto.create!(subtype: "exchange")
+      )
+    end
+end
diff --git a/test/controllers/loans_controller_test.rb b/test/controllers/loans_controller_test.rb
index 094933642..67fff1859 100644
--- a/test/controllers/loans_controller_test.rb
+++ b/test/controllers/loans_controller_test.rb
@@ -23,6 +23,7 @@ class LoansControllerTest < ActionDispatch::IntegrationTest
           notes: "Mortgage notes",
           accountable_type: "Loan",
           accountable_attributes: {
+            subtype: "mortgage",
             interest_rate: 5.5,
             term_months: 60,
             rate_type: "fixed",
@@ -40,6 +41,7 @@ class LoansControllerTest < ActionDispatch::IntegrationTest
     assert_equal "Local Bank", created_account[:institution_name]
     assert_equal "localbank.example", created_account[:institution_domain]
     assert_equal "Mortgage notes", created_account[:notes]
+    assert_equal "mortgage", created_account.accountable.subtype
     assert_equal 5.5, created_account.accountable.interest_rate
     assert_equal 60, created_account.accountable.term_months
     assert_equal "fixed", created_account.accountable.rate_type
@@ -63,6 +65,7 @@ class LoansControllerTest < ActionDispatch::IntegrationTest
           accountable_type: "Loan",
           accountable_attributes: {
             id: @account.accountable_id,
+            subtype: "auto",
             interest_rate: 4.5,
             term_months: 48,
             rate_type: "fixed",
@@ -79,6 +82,7 @@ class LoansControllerTest < ActionDispatch::IntegrationTest
     assert_equal "Updated Bank", @account[:institution_name]
     assert_equal "updatedbank.example", @account[:institution_domain]
     assert_equal "Updated loan notes", @account[:notes]
+    assert_equal "auto", @account.accountable.subtype
     assert_equal 4.5, @account.accountable.interest_rate
     assert_equal 48, @account.accountable.term_months
     assert_equal "fixed", @account.accountable.rate_type
diff --git a/test/controllers/mercury_items_controller_test.rb b/test/controllers/mercury_items_controller_test.rb
new file mode 100644
index 000000000..fbd7d3cc9
--- /dev/null
+++ b/test/controllers/mercury_items_controller_test.rb
@@ -0,0 +1,268 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class MercuryItemsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in users(:family_admin)
+    Rails.cache.clear
+    SyncJob.stubs(:perform_later)
+
+    @family = families(:dylan_family)
+    @existing_item = mercury_items(:one)
+    @second_item = MercuryItem.create!(
+      family: @family,
+      name: "Business Mercury",
+      token: "second_mercury_token",
+      base_url: "https://api.mercury.com/api/v1"
+    )
+  end
+
+  teardown do
+    Rails.cache.clear
+  end
+
+  test "create adds a new mercury connection without overwriting existing credentials" do
+    existing_token = @existing_item.token
+
+    assert_difference "MercuryItem.count", 1 do
+      post mercury_items_url, params: {
+        mercury_item: {
+          name: "Joint Mercury",
+          token: "joint_mercury_token",
+          base_url: "https://api.mercury.com/api/v1"
+        }
+      }
+    end
+
+    assert_redirected_to accounts_path
+    assert_equal existing_token, @existing_item.reload.token
+    assert_equal "joint_mercury_token", @family.mercury_items.find_by!(name: "Joint Mercury").token
+  end
+
+  test "update changes only the selected mercury connection" do
+    existing_token = @existing_item.token
+
+    patch mercury_item_url(@second_item), params: {
+      mercury_item: {
+        name: "Renamed Business Mercury",
+        token: "updated_second_token",
+        base_url: "https://api-sandbox.mercury.com/api/v1"
+      }
+    }
+
+    assert_redirected_to accounts_path
+    assert_equal existing_token, @existing_item.reload.token
+    assert_equal "Renamed Business Mercury", @second_item.reload.name
+    assert_equal "updated_second_token", @second_item.token
+    assert_equal "https://api-sandbox.mercury.com/api/v1", @second_item.base_url
+  end
+
+  test "blank token update preserves the selected mercury token" do
+    original_token = @second_item.token
+
+    patch mercury_item_url(@second_item), params: {
+      mercury_item: {
+        name: "Renamed Business Mercury",
+        token: "",
+        base_url: "https://api.mercury.com/api/v1"
+      }
+    }
+
+    assert_redirected_to accounts_path
+    assert_equal "Renamed Business Mercury", @second_item.reload.name
+    assert_equal original_token, @second_item.token
+  end
+
+  test "update expires selected mercury account cache when credentials change" do
+    Rails.cache.expects(:delete).with(mercury_cache_key(@existing_item)).never
+    Rails.cache.expects(:delete).with(mercury_cache_key(@second_item)).once
+
+    patch mercury_item_url(@second_item), params: {
+      mercury_item: {
+        name: "Renamed Business Mercury",
+        token: "updated_second_token",
+        base_url: "https://api-sandbox.mercury.com/api/v1"
+      }
+    }
+
+    assert_redirected_to accounts_path
+  end
+
+  test "update does not expire selected mercury account cache for name-only changes" do
+    Rails.cache.expects(:delete).never
+
+    patch mercury_item_url(@second_item), params: {
+      mercury_item: {
+        name: "Renamed Business Mercury"
+      }
+    }
+
+    assert_redirected_to accounts_path
+    assert_equal "Renamed Business Mercury", @second_item.reload.name
+  end
+
+  test "preload accounts uses selected mercury item cache key" do
+    Rails.cache.expects(:read).with(mercury_cache_key(@second_item)).returns(nil)
+    Rails.cache.expects(:write).with(mercury_cache_key(@second_item), mercury_accounts_payload, expires_in: 5.minutes)
+
+    provider = mock("mercury_provider")
+    provider.expects(:get_accounts).returns(accounts: mercury_accounts_payload)
+    Provider::Mercury.expects(:new)
+      .with(@second_item.token, base_url: @second_item.effective_base_url)
+      .returns(provider)
+
+    get preload_accounts_mercury_items_url, params: { mercury_item_id: @second_item.id }, as: :json
+
+    assert_response :success
+    response = JSON.parse(@response.body)
+    assert_equal true, response["success"]
+    assert_equal true, response["has_accounts"]
+  end
+
+  test "select accounts requires an explicit connection when multiple mercury items exist" do
+    get select_accounts_mercury_items_url, params: { accountable_type: "Depository" }
+
+    assert_redirected_to settings_providers_path
+    assert_equal "Choose a Mercury connection in Provider Settings.", flash[:alert]
+  end
+
+  test "select accounts renders the selected mercury item id" do
+    Rails.cache.expects(:read).with(mercury_cache_key(@second_item)).returns(nil)
+    Rails.cache.expects(:write).with(mercury_cache_key(@second_item), mercury_accounts_payload, expires_in: 5.minutes)
+
+    provider = mock("mercury_provider")
+    provider.expects(:get_accounts).returns(accounts: mercury_accounts_payload)
+    Provider::Mercury.expects(:new)
+      .with(@second_item.token, base_url: @second_item.effective_base_url)
+      .returns(provider)
+
+    get select_accounts_mercury_items_url, params: {
+      mercury_item_id: @second_item.id,
+      accountable_type: "Depository"
+    }
+
+    assert_response :success
+    assert_includes @response.body, %(name="mercury_item_id")
+    assert_includes @response.body, %(value="#{@second_item.id}")
+  end
+
+  test "select existing account renders the selected mercury item id" do
+    account = @family.accounts.create!(
+      name: "Manual Checking",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+
+    Rails.cache.expects(:read).with(mercury_cache_key(@second_item)).returns(nil)
+    Rails.cache.expects(:write).with(mercury_cache_key(@second_item), mercury_accounts_payload, expires_in: 5.minutes)
+
+    provider = mock("mercury_provider")
+    provider.expects(:get_accounts).returns(accounts: mercury_accounts_payload)
+    Provider::Mercury.expects(:new)
+      .with(@second_item.token, base_url: @second_item.effective_base_url)
+      .returns(provider)
+
+    get select_existing_account_mercury_items_url, params: {
+      mercury_item_id: @second_item.id,
+      account_id: account.id
+    }
+
+    assert_response :success
+    assert_includes @response.body, %(name="mercury_item_id")
+    assert_includes @response.body, %(value="#{@second_item.id}")
+  end
+
+  test "link accounts uses selected mercury item and allows duplicate upstream ids across items" do
+    @existing_item.mercury_accounts.create!(
+      account_id: "shared_mercury_account",
+      name: "Shared Checking",
+      currency: "USD",
+      current_balance: 1000
+    )
+
+    provider = mock("mercury_provider")
+    provider.expects(:get_accounts).returns(accounts: mercury_accounts_payload)
+    Provider::Mercury.expects(:new)
+      .with(@second_item.token, base_url: @second_item.effective_base_url)
+      .returns(provider)
+
+    assert_difference -> { @second_item.mercury_accounts.where(account_id: "shared_mercury_account").count }, 1 do
+      assert_difference "AccountProvider.count", 1 do
+        post link_accounts_mercury_items_url, params: {
+          mercury_item_id: @second_item.id,
+          account_ids: [ "shared_mercury_account" ],
+          accountable_type: "Depository"
+        }
+      end
+    end
+
+    assert_redirected_to accounts_path
+    assert_equal 1, @existing_item.mercury_accounts.where(account_id: "shared_mercury_account").count
+  end
+
+  test "link accounts does not silently use the first connection when multiple items exist" do
+    assert_no_difference "MercuryAccount.count" do
+      assert_no_difference "Account.count" do
+        post link_accounts_mercury_items_url, params: {
+          account_ids: [ "shared_mercury_account" ],
+          accountable_type: "Depository"
+        }
+      end
+    end
+
+    assert_redirected_to settings_providers_path
+    assert_equal "Choose a Mercury connection before linking accounts.", flash[:alert]
+  end
+
+  test "link existing account does not silently use the first connection when multiple items exist" do
+    account = @family.accounts.create!(
+      name: "Manual Checking",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+
+    assert_no_difference "MercuryAccount.count" do
+      assert_no_difference "AccountProvider.count" do
+        post link_existing_account_mercury_items_url, params: {
+          account_id: account.id,
+          mercury_account_id: "shared_mercury_account"
+        }
+      end
+    end
+
+    assert_redirected_to settings_providers_path
+    assert_equal "Choose a Mercury connection before linking accounts.", flash[:alert]
+  end
+
+  test "sync only queues a sync for the selected mercury item" do
+    assert_difference -> { Sync.where(syncable: @second_item).count }, 1 do
+      assert_no_difference -> { Sync.where(syncable: @existing_item).count } do
+        post sync_mercury_item_url(@second_item)
+      end
+    end
+
+    assert_response :redirect
+  end
+
+  private
+
+    def mercury_accounts_payload
+      [
+        {
+          id: "shared_mercury_account",
+          nickname: "Shared Checking",
+          name: "Shared Checking",
+          status: "active",
+          type: "checking",
+          currentBalance: 1000
+        }
+      ]
+    end
+
+    def mercury_cache_key(mercury_item)
+      "mercury_accounts_#{@family.id}_#{mercury_item.id}"
+    end
+end
diff --git a/test/controllers/mfa_controller_test.rb b/test/controllers/mfa_controller_test.rb
index b653df41a..f43fe3555 100644
--- a/test/controllers/mfa_controller_test.rb
+++ b/test/controllers/mfa_controller_test.rb
@@ -1,4 +1,5 @@
 require "test_helper"
+require "webauthn/fake_client"
 
 class MfaControllerTest < ActionDispatch::IntegrationTest
   setup do
@@ -38,7 +39,12 @@ class MfaControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
     assert @user.reload.otp_required?
     assert_equal 8, @user.otp_backup_codes.length
+    assert @user.otp_backup_codes.all? { |code| code.start_with?("$2") }
     assert_select "div.grid-cols-2" # Check for backup codes grid
+    rendered_codes = css_select("div.grid-cols-2 div").map { |node| node.text.strip }
+    assert_equal 8, rendered_codes.length
+    assert rendered_codes.all? { |code| code.match?(/\A[0-9a-f]{16}\z/) }
+    assert_empty rendered_codes & @user.otp_backup_codes
   end
 
   test "does not enable MFA with invalid code" do
@@ -64,6 +70,21 @@ class MfaControllerTest < ActionDispatch::IntegrationTest
     assert_select "form[action=?]", verify_mfa_path
   end
 
+  test "verify shows WebAuthn option when credentials are registered" do
+    @user.setup_mfa!
+    @user.enable_mfa!
+    register_webauthn_credential
+    sign_out
+
+    post sessions_path, params: { email: @user.email, password: user_password_test }
+    get verify_mfa_path
+
+    assert_response :success
+    assert_select "button", text: I18n.t("mfa.verify.webauthn_button")
+    assert_select "[data-webauthn-authentication-error-fallback-value=?]", I18n.t("mfa.verify_webauthn.invalid_credential")
+    assert_select "p[data-webauthn-authentication-target='error'][aria-live='assertive'][aria-atomic='true'][aria-hidden='true']"
+  end
+
   test "verify_code authenticates with valid TOTP" do
     @user.setup_mfa!
     @user.enable_mfa!
@@ -80,17 +101,19 @@ class MfaControllerTest < ActionDispatch::IntegrationTest
 
   test "verify_code authenticates with valid backup code" do
     @user.setup_mfa!
-    @user.enable_mfa!
+    backup_code = @user.enable_mfa!.first
+    matching_digest = @user.otp_backup_codes.find { |digest| BCrypt::Password.new(digest).is_password?(backup_code) }
+    assert_not_nil matching_digest
     sign_out
 
     post sessions_path, params: { email: @user.email, password: user_password_test }
-    backup_code = @user.otp_backup_codes.first
 
     post verify_mfa_path, params: { code: backup_code }
 
     assert_redirected_to root_path
     assert Session.exists?(user_id: @user.id)
-    assert_not @user.reload.otp_backup_codes.include?(backup_code)
+    assert_equal 7, @user.reload.otp_backup_codes.size
+    assert_not_includes @user.otp_backup_codes, matching_digest
   end
 
   test "verify_code rejects invalid codes" do
@@ -105,9 +128,114 @@ class MfaControllerTest < ActionDispatch::IntegrationTest
     assert_not Session.exists?(user_id: @user.id)
   end
 
+  test "webauthn_options require a pending MFA session" do
+    post webauthn_options_mfa_path, as: :json
+
+    assert_response :unprocessable_entity
+  end
+
+  test "verify_webauthn authenticates with a registered credential" do
+    @user.setup_mfa!
+    @user.enable_mfa!
+    client = register_webauthn_credential
+    stored_credential = @user.webauthn_credentials.first
+    sign_out
+
+    post sessions_path, params: { email: @user.email, password: user_password_test }
+    post webauthn_options_mfa_path, as: :json
+    assert_response :success
+
+    options = JSON.parse(response.body)
+    assertion = client.get(
+      challenge: options.fetch("challenge"),
+      rp_id: "www.example.com",
+      allow_credentials: [ stored_credential.credential_id ]
+    )
+
+    post verify_webauthn_mfa_path, params: { credential: assertion }, as: :json
+
+    assert_response :success
+    assert_equal root_path, JSON.parse(response.body).fetch("redirect_url")
+    assert Session.exists?(user_id: @user.id)
+    assert stored_credential.reload.last_used_at.present?
+    assert_operator stored_credential.sign_count, :>, 0
+  end
+
+  test "verify_webauthn authenticates with configured relying party id" do
+    with_webauthn_config(rp_id: "example.test", allowed_origins: [ "https://app.example.test" ]) do
+      @user.setup_mfa!
+      @user.enable_mfa!
+      client = register_webauthn_credential(origin: "https://app.example.test", rp_id: "example.test")
+      stored_credential = @user.webauthn_credentials.first
+      sign_out
+
+      post sessions_path, params: { email: @user.email, password: user_password_test }
+      post webauthn_options_mfa_path, as: :json
+      assert_response :success
+
+      options = JSON.parse(response.body)
+      assert_equal "example.test", options.fetch("rpId")
+      assertion = client.get(
+        challenge: options.fetch("challenge"),
+        rp_id: "example.test",
+        allow_credentials: [ stored_credential.credential_id ]
+      )
+
+      post verify_webauthn_mfa_path, params: { credential: assertion }, as: :json
+
+      assert_response :success
+      assert_equal root_path, JSON.parse(response.body).fetch("redirect_url")
+    end
+  end
+
+  test "verify_webauthn rejects invalid credentials" do
+    @user.setup_mfa!
+    @user.enable_mfa!
+    client = register_webauthn_credential
+    stored_credential = @user.webauthn_credentials.first
+    sign_out
+
+    post sessions_path, params: { email: @user.email, password: user_password_test }
+    post webauthn_options_mfa_path, as: :json
+    options = JSON.parse(response.body)
+    assertion = client.get(
+      challenge: options.fetch("challenge"),
+      rp_id: "www.example.com",
+      allow_credentials: [ stored_credential.credential_id ]
+    )
+    assertion["id"] = "invalid"
+
+    post verify_webauthn_mfa_path, params: { credential: assertion }, as: :json
+
+    assert_response :unprocessable_entity
+    assert_not Session.exists?(user_id: @user.id)
+  end
+
+  test "verify_webauthn rejects malformed credential payloads" do
+    @user.setup_mfa!
+    @user.enable_mfa!
+    register_webauthn_credential
+    sign_out
+
+    post sessions_path, params: { email: @user.email, password: user_password_test }
+    post webauthn_options_mfa_path, as: :json
+    assert_response :success
+
+    post verify_webauthn_mfa_path, params: { credential: [] }, as: :json
+
+    assert_response :unprocessable_entity
+    assert_equal I18n.t("mfa.verify_webauthn.invalid_credential"), JSON.parse(response.body).fetch("error")
+    assert_not Session.exists?(user_id: @user.id)
+  end
+
   test "disable removes MFA" do
     @user.setup_mfa!
     @user.enable_mfa!
+    @user.webauthn_credentials.create!(
+      nickname: "YubiKey",
+      credential_id: "disable-mfa-credential",
+      public_key: "public-key"
+    )
 
     delete disable_mfa_path
 
@@ -115,5 +243,35 @@ class MfaControllerTest < ActionDispatch::IntegrationTest
     assert_not @user.reload.otp_required?
     assert_nil @user.otp_secret
     assert_empty @user.otp_backup_codes
+    assert_empty @user.webauthn_credentials
   end
+
+  private
+    def register_webauthn_credential(origin: "http://www.example.com", rp_id: "www.example.com")
+      client = WebAuthn::FakeClient.new(origin)
+
+      post options_settings_webauthn_credentials_path, as: :json
+      options = JSON.parse(response.body)
+      credential = client.create(challenge: options.fetch("challenge"), rp_id: rp_id)
+      post settings_webauthn_credentials_path, params: {
+        webauthn_credential: { nickname: "MacBook Touch ID" },
+        credential: credential
+      }, as: :json
+      assert_response :success
+
+      client
+    end
+
+    def with_webauthn_config(rp_id:, allowed_origins:)
+      config = Rails.application.config.x.webauthn
+      previous_rp_id = config.rp_id
+      previous_allowed_origins = config.allowed_origins
+      config.rp_id = rp_id
+      config.allowed_origins = allowed_origins
+
+      yield
+    ensure
+      config.rp_id = previous_rp_id
+      config.allowed_origins = previous_allowed_origins
+    end
 end
diff --git a/test/controllers/oidc_accounts_controller_test.rb b/test/controllers/oidc_accounts_controller_test.rb
index bd38aedcc..a24079931 100644
--- a/test/controllers/oidc_accounts_controller_test.rb
+++ b/test/controllers/oidc_accounts_controller_test.rb
@@ -115,7 +115,7 @@ class OidcAccountsControllerTest < ActionController::TestCase
 
     get :link
     assert_response :success
-    assert_select "h3", text: "Create New Account"
+    assert_select "p", text: /Create New Account/
     assert_select "strong", text: new_user_auth["email"]
   end
 
@@ -128,7 +128,7 @@ class OidcAccountsControllerTest < ActionController::TestCase
     get :link
     assert_response :success
 
-    assert_select "h3", text: "Create New Account"
+    assert_select "p", text: /Create New Account/
     # No create account button rendered
     assert_select "button", text: "Create Account", count: 0
     assert_select "p", text: /New account creation via single sign-on is disabled/
diff --git a/test/controllers/pages_controller_test.rb b/test/controllers/pages_controller_test.rb
index 73c39f5a1..023a983f9 100644
--- a/test/controllers/pages_controller_test.rb
+++ b/test/controllers/pages_controller_test.rb
@@ -43,6 +43,25 @@ class PagesControllerTest < ActionDispatch::IntegrationTest
     assert_select "[data-controller='sankey-chart']"
   end
 
+  test "dashboard renders sankey chart zoom controls and stable node ids" do
+    parent_category = @family.categories.create!(name: "Shopping", color: "#FF5733")
+    subcategory = @family.categories.create!(name: "Groceries", parent: parent_category, color: "#33FF57")
+
+    create_transaction(account: @family.accounts.first, name: "General shopping", amount: 100, category: parent_category)
+    create_transaction(account: @family.accounts.first, name: "Grocery store", amount: 50, category: subcategory)
+
+    get root_path
+
+    assert_response :ok
+    assert_select "[data-sankey-chart-target='zoomOutButton'][hidden]", count: 2
+
+    chart = css_select("[data-controller='sankey-chart']").first
+    sankey_data = JSON.parse(chart["data-sankey-chart-data-value"])
+
+    assert_includes sankey_data.fetch("nodes").map { |node| node.fetch("id") }, "cash_flow_node"
+    assert sankey_data.fetch("nodes").any? { |node| node.fetch("id").start_with?("expense_") }
+  end
+
   test "changelog" do
     VCR.use_cassette("git_repository_provider/fetch_latest_release_notes") do
       get changelog_path
diff --git a/test/controllers/properties_controller_test.rb b/test/controllers/properties_controller_test.rb
index 890f8b17e..ce5a97847 100644
--- a/test/controllers/properties_controller_test.rb
+++ b/test/controllers/properties_controller_test.rb
@@ -14,6 +14,7 @@ class PropertiesControllerTest < ActionDispatch::IntegrationTest
         account: {
           name: "New Property",
           subtype: "house",
+          currency: "EUR",
           institution_name: "Property Lender",
           institution_domain: "propertylender.example",
           notes: "Property notes",
@@ -31,6 +32,7 @@ class PropertiesControllerTest < ActionDispatch::IntegrationTest
     assert created_account.accountable.is_a?(Property)
     assert_equal "draft", created_account.status
     assert_equal 0, created_account.balance
+    assert_equal "EUR", created_account.currency
     assert_equal "Property Lender", created_account[:institution_name]
     assert_equal "propertylender.example", created_account[:institution_domain]
     assert_equal "Property notes", created_account[:notes]
@@ -93,8 +95,12 @@ class PropertiesControllerTest < ActionDispatch::IntegrationTest
       }
     }
 
+    @account.reload
+    assert_equal 600000, @account.balance
+    assert_equal "EUR", @account.currency
+
     # If account is active, it renders balances view; otherwise redirects to address
-    if @account.reload.active?
+    if @account.active?
       assert_response :success
     else
       assert_redirected_to address_property_path(@account)
diff --git a/test/controllers/pwa_controller_test.rb b/test/controllers/pwa_controller_test.rb
new file mode 100644
index 000000000..b7b18ce5a
--- /dev/null
+++ b/test/controllers/pwa_controller_test.rb
@@ -0,0 +1,11 @@
+require "test_helper"
+
+class PwaControllerTest < ActionDispatch::IntegrationTest
+  test "manifest responds successfully for html accept headers" do
+    get "/manifest", headers: { "Accept" => "text/html" }
+
+    assert_response :success
+    assert_equal "application/manifest+json", response.media_type
+    assert_includes response.body, '"start_url": "/"'
+  end
+end
diff --git a/test/controllers/registrations_controller_test.rb b/test/controllers/registrations_controller_test.rb
index 88acdcb13..b9916dea1 100644
--- a/test/controllers/registrations_controller_test.rb
+++ b/test/controllers/registrations_controller_test.rb
@@ -59,15 +59,46 @@ class RegistrationsControllerTest < ActionDispatch::IntegrationTest
       end
 
       assert_difference "User.count", +1 do
+        invite_code = InviteCode.generate!
         post registration_url, params: { user: {
           email: "john@example.com",
           password: "Password1!",
-          invite_code: InviteCode.generate! } }
+          invite_code: invite_code } }
         assert_redirected_to root_url
+        assert_not InviteCode.exists?(token: invite_code)
       end
     end
   end
 
+  test "invite code is not consumed when signup fails validation" do
+    with_env_overrides REQUIRE_INVITE_CODE: "true" do
+      invite_code = InviteCode.generate!
+
+      assert_no_difference "User.count" do
+        post registration_url, params: { user: {
+          email: "validationfail@example.com",
+          password: "weak",
+          invite_code: invite_code } }
+      end
+
+      assert_response :unprocessable_entity
+      assert InviteCode.exists?(token: invite_code)
+    end
+  end
+
+  test "invalid invite code does not create a user" do
+    with_env_overrides REQUIRE_INVITE_CODE: "true" do
+      assert_no_difference "User.count" do
+        post registration_url, params: { user: {
+          email: "valid@example.com",
+          password: "Password1!",
+          invite_code: "invalid-token-that-does-not-exist" } }
+      end
+
+      assert_redirected_to new_registration_url
+    end
+  end
+
   test "creating account from guest invitation assigns guest role and intro layout" do
     invitation = invitations(:one)
     invitation.update!(role: "guest", email: "guest-signup@example.com")
diff --git a/test/controllers/reports_controller_test.rb b/test/controllers/reports_controller_test.rb
index c53472e99..298459d1f 100644
--- a/test/controllers/reports_controller_test.rb
+++ b/test/controllers/reports_controller_test.rb
@@ -107,12 +107,9 @@ class ReportsControllerTest < ActionDispatch::IntegrationTest
     )
 
     assert_response :ok
-    # Should show flash message about invalid date range
-    assert flash[:alert].present?, "Flash alert should be present"
-    assert_match /End date cannot be before start date/, flash[:alert]
-    # Verify the response body contains the swapped date range in the correct order
-    assert_includes @response.body, end_date.strftime("%b %-d, %Y")
-    assert_includes @response.body, start_date.strftime("%b %-d, %Y")
+    assert_equal I18n.t("reports.invalid_date_range"), flash[:alert]
+    assert_includes @response.body, end_date.strftime("%b %Y")
+    assert_includes @response.body, start_date.strftime("%b %Y")
   end
 
   test "spending patterns returns data when expense transactions exist" do
@@ -245,4 +242,99 @@ class ReportsControllerTest < ActionDispatch::IntegrationTest
     assert_select "tr[data-category='category-#{subcategory_movies.id}']", text: /^Movies/
     assert_select "tr[data-category='category-#{subcategory_games.id}']", text: /^Games/
   end
+
+  test "monthly period navigation shows previous month link" do
+    get reports_path(period_type: :monthly)
+    assert_response :ok
+
+    prev_start = Date.current.beginning_of_month - 1.month
+    prev_end = prev_start.end_of_month
+    assert_select "a[href=?]", reports_path(period_type: :monthly, start_date: prev_start, end_date: prev_end)
+  end
+
+  test "monthly period navigation disables next arrow on current month" do
+    get reports_path(period_type: :monthly)
+    assert_response :ok
+
+    assert_select "button[disabled][aria-label=?]", I18n.t("reports.index.next_period")
+  end
+
+  test "monthly period navigation shows next month link on past month" do
+    past_start = Date.current.beginning_of_month - 2.months
+    past_end = past_start.end_of_month
+    get reports_path(period_type: :monthly, start_date: past_start, end_date: past_end)
+    assert_response :ok
+
+    next_start = past_start + 1.month
+    next_end = next_start.end_of_month
+    assert_select "a[href=?]", reports_path(period_type: :monthly, start_date: next_start, end_date: next_end)
+  end
+
+  test "last 6 months next window extends to current month end when crossing boundary" do
+    start_date = Date.current.beginning_of_month - 12.months
+    end_date = start_date + 6.months - 1.day
+
+    get reports_path(period_type: :last_6_months, start_date: start_date, end_date: end_date)
+    assert_response :ok
+
+    candidate_start = start_date.beginning_of_month + 6.months
+    if candidate_start + 6.months >= Date.current.beginning_of_month
+      expected_next_end   = Date.current.end_of_month
+      expected_next_start = (expected_next_end + 1.day - 6.months).beginning_of_month
+    else
+      expected_next_start = candidate_start
+      expected_next_end   = expected_next_start + 6.months - 1.day
+    end
+
+    assert_select "a[href=?]",
+      reports_path(period_type: :last_6_months, start_date: expected_next_start, end_date: expected_next_end)
+  end
+
+  test "quarterly period navigation shows previous and next quarter links" do
+    get reports_path(period_type: :quarterly)
+    assert_response :ok
+
+    prev_start = (Date.current.beginning_of_quarter - 1.day).beginning_of_quarter
+    prev_end = prev_start.end_of_quarter
+    assert_select "a[href=?]", reports_path(period_type: :quarterly, start_date: prev_start, end_date: prev_end)
+
+    # Also verify a past quarter shows an enabled next-quarter link
+    get reports_path(period_type: :quarterly, start_date: prev_start, end_date: prev_end)
+    assert_response :ok
+
+    next_start = prev_start.next_quarter.beginning_of_quarter
+    next_end   = next_start.end_of_quarter
+    assert_select "a[href=?]", reports_path(period_type: :quarterly, start_date: next_start, end_date: next_end)
+  end
+
+  test "custom period hides period display" do
+    get reports_path(
+      period_type: :custom,
+      start_date: 1.month.ago.to_date,
+      end_date: Date.current
+    )
+    assert_response :ok
+
+    prev_start = 1.month.ago.to_date.beginning_of_month - 1.month
+    next_start = 1.month.ago.to_date.beginning_of_month + 1.month
+    assert_select "a[href*=?]", "start_date=#{prev_start}", count: 0
+    assert_select "a[href*=?]", "start_date=#{next_start}", count: 0
+  end
+
+  test "ytd period navigation shows previous year link" do
+    get reports_path(period_type: :ytd)
+    assert_response :ok
+
+    prev_year  = Date.current.year - 1
+    prev_start = Date.new(prev_year, 1, 1)
+    prev_end   = Date.new(prev_year, 12, 31)
+    assert_select "a[href=?]", reports_path(period_type: :ytd, start_date: prev_start, end_date: prev_end)
+  end
+
+  test "ytd period navigation disables next arrow on current year" do
+    get reports_path(period_type: :ytd)
+    assert_response :ok
+
+    assert_select "button[disabled][aria-label=?]", I18n.t("reports.index.next_period")
+  end
 end
diff --git a/test/controllers/rules_controller_test.rb b/test/controllers/rules_controller_test.rb
index baa30a1f3..cdbc49134 100644
--- a/test/controllers/rules_controller_test.rb
+++ b/test/controllers/rules_controller_test.rb
@@ -210,6 +210,26 @@ class RulesControllerTest < ActionDispatch::IntegrationTest
     end
   end
 
+  test "index shows blocked count in recent runs summary" do
+    rule = rules(:one)
+    RuleRun.create!(
+      rule: rule,
+      execution_type: "manual",
+      status: "success",
+      transactions_queued: 10,
+      transactions_processed: 7,
+      transactions_modified: 4,
+      pending_jobs_count: 0,
+      executed_at: Time.current
+    )
+
+    get rules_url
+
+    assert_response :success
+    assert_select "th", text: /Queued\s+Processed\s+Modified\s+Blocked/
+    assert_select "td", text: "10 / 7 / 4 / 3"
+  end
+
   test "should get confirm_all" do
     get confirm_all_rules_url
     assert_response :success
diff --git a/test/controllers/settings/debugs_controller_test.rb b/test/controllers/settings/debugs_controller_test.rb
new file mode 100644
index 000000000..7179738b8
--- /dev/null
+++ b/test/controllers/settings/debugs_controller_test.rb
@@ -0,0 +1,68 @@
+require "test_helper"
+
+class Settings::DebugsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    ensure_tailwind_build
+
+    @entry = DebugLogEntry.create!(
+      category: "security_price_fetch",
+      level: "warn",
+      message: "Could not fetch prices",
+      source: "Security::Price::Importer",
+      provider_key: "twelve_data",
+      family: families(:dylan_family),
+      account: accounts(:depository),
+      user: users(:family_admin),
+      metadata: { ticker: "AAPL" }
+    )
+  end
+
+  test "super admins can view debug log" do
+    sign_in users(:sure_support_staff)
+
+    get settings_debug_url
+
+    assert_response :success
+    assert_match "Debug event log", response.body
+    assert_match @entry.message, response.body
+  end
+
+  test "non super admins are redirected" do
+    sign_in users(:family_admin)
+
+    get settings_debug_url
+
+    assert_redirected_to root_url
+  end
+
+  test "filters by provider key" do
+    sign_in users(:sure_support_staff)
+
+    DebugLogEntry.create!(
+      category: "security_price_fetch",
+      level: "warn",
+      message: "Should be filtered out",
+      source: "Security::Price::Importer",
+      provider_key: "finnhub",
+      family: families(:dylan_family),
+      account: accounts(:depository),
+      user: users(:family_admin),
+      metadata: { ticker: "MSFT" }
+    )
+
+    get settings_debug_url, params: { provider_key: "twelve_data" }
+
+    assert_response :success
+    assert_match @entry.message, response.body
+    refute_match "Should be filtered out", response.body
+  end
+
+  test "ignores invalid uuid filters" do
+    sign_in users(:sure_support_staff)
+
+    get settings_debug_url, params: { family_id: "not-a-uuid" }
+
+    assert_response :success
+    assert_match @entry.message, response.body
+  end
+end
diff --git a/test/controllers/settings/hostings_controller_test.rb b/test/controllers/settings/hostings_controller_test.rb
index f4706c07c..4ebe20f87 100644
--- a/test/controllers/settings/hostings_controller_test.rb
+++ b/test/controllers/settings/hostings_controller_test.rb
@@ -235,6 +235,61 @@ class Settings::HostingsControllerTest < ActionDispatch::IntegrationTest
     end
   end
 
+  test "accepts valid llm budget overrides and blanks clear them" do
+    with_self_hosting do
+      patch settings_hosting_url, params: { setting: {
+        llm_context_window: "4096",
+        llm_max_response_tokens: "1024",
+        llm_max_items_per_call: "40"
+      } }
+
+      assert_redirected_to settings_hosting_url
+      assert_equal 4096, Setting.llm_context_window
+      assert_equal 1024, Setting.llm_max_response_tokens
+      assert_equal 40, Setting.llm_max_items_per_call
+
+      patch settings_hosting_url, params: { setting: {
+        llm_context_window: "",
+        llm_max_response_tokens: "",
+        llm_max_items_per_call: ""
+      } }
+
+      assert_nil Setting.llm_context_window
+      assert_nil Setting.llm_max_response_tokens
+      assert_nil Setting.llm_max_items_per_call
+    end
+  ensure
+    Setting.llm_context_window = nil
+    Setting.llm_max_response_tokens = nil
+    Setting.llm_max_items_per_call = nil
+  end
+
+  test "rejects llm budget below field minimum" do
+    with_self_hosting do
+      patch settings_hosting_url, params: { setting: { llm_context_window: "0" } }
+
+      assert_response :unprocessable_entity
+      assert_match(/must be a whole number/, flash[:alert])
+      assert_nil Setting.llm_context_window
+
+      patch settings_hosting_url, params: { setting: { llm_max_response_tokens: "-5" } }
+
+      assert_response :unprocessable_entity
+      assert_match(/must be a whole number/, flash[:alert])
+      assert_nil Setting.llm_max_response_tokens
+
+      patch settings_hosting_url, params: { setting: { llm_max_items_per_call: "not-a-number" } }
+
+      assert_response :unprocessable_entity
+      assert_match(/must be a whole number/, flash[:alert])
+      assert_nil Setting.llm_max_items_per_call
+    end
+  ensure
+    Setting.llm_context_window = nil
+    Setting.llm_max_response_tokens = nil
+    Setting.llm_max_items_per_call = nil
+  end
+
   test "can clear data only when admin" do
     with_self_hosting do
       sign_in users(:family_member)
@@ -247,4 +302,71 @@ class Settings::HostingsControllerTest < ActionDispatch::IntegrationTest
       assert_equal I18n.t("settings.hostings.not_authorized"), flash[:alert]
     end
   end
+
+  # --- Securities provider toggle ---
+
+  test "can update securities providers" do
+    with_self_hosting do
+      patch settings_hosting_url, params: { setting: { securities_providers: [ "twelve_data", "yahoo_finance" ] } }
+
+      assert_redirected_to settings_hosting_url
+      assert_equal "twelve_data,yahoo_finance", Setting.securities_providers
+    end
+  ensure
+    Setting.securities_providers = ""
+  end
+
+  test "filters out invalid provider names" do
+    with_self_hosting do
+      patch settings_hosting_url, params: { setting: { securities_providers: [ "twelve_data", "fake_provider", "hacked" ] } }
+
+      assert_redirected_to settings_hosting_url
+      # Only valid providers are stored
+      enabled = Setting.enabled_securities_providers
+      assert_includes enabled, "twelve_data"
+      refute_includes enabled, "fake_provider"
+      refute_includes enabled, "hacked"
+    end
+  ensure
+    Setting.securities_providers = ""
+  end
+
+  test "removing a provider marks linked securities offline" do
+    with_self_hosting do
+      security = Security.create!(ticker: "CSPX", exchange_operating_mic: "XLON", price_provider: "tiingo", offline: false)
+
+      # First enable tiingo
+      Setting.securities_providers = "twelve_data,tiingo"
+
+      # Then remove tiingo
+      patch settings_hosting_url, params: { setting: { securities_providers: [ "twelve_data" ] } }
+
+      security.reload
+      assert security.offline?, "Security should be marked offline when its provider is removed"
+      assert_equal "provider_disabled", security.offline_reason
+    end
+  ensure
+    Setting.securities_providers = ""
+  end
+
+  test "re-adding a provider brings securities back online" do
+    with_self_hosting do
+      security = Security.create!(
+        ticker: "CSPX2", exchange_operating_mic: "XLON",
+        price_provider: "tiingo", offline: true, offline_reason: "provider_disabled"
+      )
+
+      # Start without tiingo
+      Setting.securities_providers = "twelve_data"
+
+      # Re-add tiingo
+      patch settings_hosting_url, params: { setting: { securities_providers: [ "twelve_data", "tiingo" ] } }
+
+      security.reload
+      refute security.offline?, "Security should come back online when its provider is re-added"
+      assert_nil security.offline_reason
+    end
+  ensure
+    Setting.securities_providers = ""
+  end
 end
diff --git a/test/controllers/settings/preferences_controller_test.rb b/test/controllers/settings/preferences_controller_test.rb
index c17b03f6e..5d49f9ee0 100644
--- a/test/controllers/settings/preferences_controller_test.rb
+++ b/test/controllers/settings/preferences_controller_test.rb
@@ -4,8 +4,50 @@ class Settings::PreferencesControllerTest < ActionDispatch::IntegrationTest
   setup do
     sign_in users(:family_admin)
   end
+
   test "get" do
     get settings_preferences_url
+
     assert_response :success
   end
+
+  test "group moniker uses group currencies copy and hides legacy currency field" do
+    users(:family_admin).family.update!(moniker: "Group")
+
+    get settings_preferences_url
+
+    assert_response :success
+    assert_includes response.body, "Group Currencies"
+    assert_includes response.body, "your group"
+    assert_select "select[name='user[family_attributes][currency]']", count: 0
+  end
+
+  test "renders preview features toggle for non-admin users too" do
+    sign_in users(:family_member)
+    get settings_preferences_url
+
+    assert_response :success
+    assert_includes response.body, "Enable preview features"
+  end
+
+  test "update toggles preview_features_enabled on" do
+    user = users(:family_admin)
+    assert_not user.preview_features_enabled?
+
+    patch settings_preferences_url, params: { user: { preview_features_enabled: "1" } }
+
+    assert_redirected_to settings_preferences_url
+    assert user.reload.preview_features_enabled?
+  end
+
+  test "update toggles preview_features_enabled off" do
+    user = users(:family_admin)
+    user.update!(preferences: (user.preferences || {}).merge("preview_features_enabled" => true))
+    assert user.preview_features_enabled?
+
+    patch settings_preferences_url, params: { user: { preview_features_enabled: "0" } }
+
+    assert_redirected_to settings_preferences_url
+    assert_not user.reload.preview_features_enabled?
+  end
 end
diff --git a/test/controllers/settings/profiles_controller_test.rb b/test/controllers/settings/profiles_controller_test.rb
index 8a83923ef..9228a5ab5 100644
--- a/test/controllers/settings/profiles_controller_test.rb
+++ b/test/controllers/settings/profiles_controller_test.rb
@@ -33,7 +33,7 @@ class Settings::ProfilesControllerTest < ActionDispatch::IntegrationTest
     end
 
     assert_redirected_to settings_profile_path
-    assert_equal "Member removed successfully.", flash[:notice]
+    assert_equal I18n.t("settings.profiles.destroy.member_removed"), flash[:notice]
     assert_raises(ActiveRecord::RecordNotFound) { User.find(@member.id) }
   end
 
@@ -74,7 +74,7 @@ class Settings::ProfilesControllerTest < ActionDispatch::IntegrationTest
     end
 
     assert_redirected_to settings_profile_path
-    assert_equal "Member removed successfully.", flash[:notice]
+    assert_equal I18n.t("settings.profiles.destroy.member_removed"), flash[:notice]
     assert_raises(ActiveRecord::RecordNotFound) { User.find(@member.id) }
     assert_raises(ActiveRecord::RecordNotFound) { Invitation.find(invitation.id) }
   end
diff --git a/test/controllers/settings/providers_controller_test.rb b/test/controllers/settings/providers_controller_test.rb
index 63ac52888..0f9bce42e 100644
--- a/test/controllers/settings/providers_controller_test.rb
+++ b/test/controllers/settings/providers_controller_test.rb
@@ -1,6 +1,8 @@
 require "test_helper"
 
 class Settings::ProvidersControllerTest < ActionDispatch::IntegrationTest
+  include ActiveJob::TestHelper
+
   setup do
     sign_in users(:family_admin)
 
@@ -8,6 +10,12 @@ class Settings::ProvidersControllerTest < ActionDispatch::IntegrationTest
     Provider::Factory.ensure_adapters_loaded
   end
 
+  test "GET /settings/bank_sync redirects permanently to /settings/providers" do
+    get "/settings/bank_sync"
+    assert_redirected_to "/settings/providers"
+    assert_equal 301, response.status
+  end
+
   test "can access when self hosting is disabled (managed mode)" do
     Rails.configuration.stubs(:app_mode).returns("managed".inquiry)
     get settings_providers_url
@@ -24,6 +32,27 @@ class Settings::ProvidersControllerTest < ActionDispatch::IntegrationTest
     end
   end
 
+  test "shows configured Brex connections in bank sync settings" do
+    get settings_providers_url
+
+    assert_response :success
+    assert_includes response.body, "Brex"
+    assert_includes response.body, "Test Brex Connection"
+    assert_includes response.body, "brex-providers-panel"
+  end
+
+  test "shows Brex as available when family has no Brex connections" do
+    sign_in users(:empty)
+
+    get settings_providers_url
+
+    assert_response :success
+    assert_includes response.body, "Brex"
+    assert_includes response.body, I18n.t("settings.providers.taglines.brex")
+    assert_includes response.body, connect_form_settings_providers_path(provider_key: "brex")
+    refute_includes response.body, "Test Brex Connection"
+  end
+
   test "correctly identifies declared vs dynamic fields" do
     # All current provider fields are dynamic, but the logic should correctly
     # distinguish between declared and dynamic fields
@@ -270,16 +299,17 @@ class Settings::ProvidersControllerTest < ActionDispatch::IntegrationTest
       # We'll force an error by making the []= method raise
       Setting.expects(:[]=).with("plaid_client_id", "test").raises(StandardError.new("Database error")).once
 
-      # Mock logger to verify error is logged
-      Rails.logger.expects(:error).with(regexp_matches(/Failed to update provider settings.*Database error/)).once
+      # Mock logger to verify error is logged (pin both the exception class
+      # name and the message so a regression that drops one still fails).
+      Rails.logger.expects(:error).with(regexp_matches(/Failed to update provider settings: StandardError - Database error/)).once
 
       patch settings_providers_url, params: {
         setting: { plaid_client_id: "test" }
       }
 
-      # Controller should handle the error gracefully
+      # Controller should handle the error gracefully with generic message (no internal details)
       assert_response :unprocessable_entity
-      assert_equal "Failed to update provider settings: Database error", flash[:alert]
+      assert_equal "Failed to update provider settings. Please try again.", flash[:alert]
     end
   end
 
@@ -297,6 +327,101 @@ class Settings::ProvidersControllerTest < ActionDispatch::IntegrationTest
     end
   end
 
+  test "POST sync_all enqueues SyncAllProvidersJob" do
+    SimplefinItem.create!(
+      family: families(:dylan_family),
+      name: "Test SimpleFIN Sync All",
+      access_url: "https://bridge.simplefin.org/simplefin/access"
+    )
+    families(:dylan_family).update_column(:last_sync_all_attempted_at, nil)
+
+    assert_enqueued_with(job: SyncAllProvidersJob) do
+      post sync_all_settings_providers_path
+    end
+
+    assert_redirected_to settings_providers_path
+
+    follow_redirect!
+    assert_response :success
+    assert_match(/Syncing all connected providers/i, response.body)
+  end
+
+  test "POST sync_all respects recent sync throttle" do
+    families(:dylan_family).update_column(:last_sync_all_attempted_at, Time.current)
+
+    assert_no_enqueued_jobs only: SyncAllProvidersJob do
+      post sync_all_settings_providers_path
+    end
+
+    assert_redirected_to settings_providers_path
+    assert_equal I18n.t("settings.providers.sync_all_recently"), flash[:notice]
+  end
+
+  test "POST sync for simplefin without an active Simplefin sync enqueues SyncJob" do
+    item = SimplefinItem.create!(
+      family: families(:dylan_family),
+      name: "Test SimpleFIN Per Row Sync",
+      access_url: "https://bridge.simplefin.org/simplefin/access"
+    )
+    Sync.where(syncable_type: "SimplefinItem", syncable_id: item.id).delete_all
+
+    assert_enqueued_jobs 1, only: SyncJob do
+      post sync_provider_settings_providers_path(provider_key: "simplefin")
+    end
+
+    assert_redirected_to settings_providers_path
+
+    follow_redirect!
+    assert_response :success
+    assert_match(/Sync started/i, response.body)
+  end
+
+  test "POST sync for brex without an active Brex sync enqueues SyncJob" do
+    item = brex_items(:one)
+    Sync.where(syncable_type: "BrexItem", syncable_id: item.id).delete_all
+
+    assert_enqueued_jobs 1, only: SyncJob do
+      post sync_provider_settings_providers_path(provider_key: "brex")
+    end
+
+    assert_redirected_to settings_providers_path
+
+    follow_redirect!
+    assert_response :success
+    assert_match(/Sync started/i, response.body)
+  end
+
+  test "GET show includes Interactive Brokers in bank sync providers" do
+    get settings_providers_url
+
+    assert_response :success
+    assert_match(/Interactive Brokers/i, response.body)
+    assert_match(/Flex Query/i, response.body)
+  end
+
+  test "GET connect_form renders Interactive Brokers panel" do
+    get connect_form_settings_providers_path(provider_key: "ibkr")
+
+    assert_response :success
+    assert_match(/Interactive Brokers/i, response.body)
+    assert_match(/Query ID/i, response.body)
+  end
+
+  test "POST sync for ibkr without an active Ibkr sync enqueues SyncJob" do
+    item = ibkr_items(:configured_item)
+    Sync.where(syncable_type: "IbkrItem", syncable_id: item.id).delete_all
+
+    assert_enqueued_jobs 1, only: SyncJob do
+      post sync_provider_settings_providers_path(provider_key: "ibkr")
+    end
+
+    assert_redirected_to settings_providers_path
+
+    follow_redirect!
+    assert_response :success
+    assert_match(/Sync started/i, response.body)
+  end
+
   test "non-admin users cannot update providers" do
     with_self_hosting do
       sign_in users(:family_member)
@@ -305,7 +430,7 @@ class Settings::ProvidersControllerTest < ActionDispatch::IntegrationTest
         setting: { plaid_client_id: "test" }
       }
 
-      assert_redirected_to settings_providers_path
+      assert_redirected_to root_path
       assert_equal "Not authorized", flash[:alert]
 
       # Value should not have changed
diff --git a/test/controllers/settings/webauthn_credentials_controller_test.rb b/test/controllers/settings/webauthn_credentials_controller_test.rb
new file mode 100644
index 000000000..d2fc8c69f
--- /dev/null
+++ b/test/controllers/settings/webauthn_credentials_controller_test.rb
@@ -0,0 +1,168 @@
+require "test_helper"
+require "webauthn/fake_client"
+
+class Settings::WebauthnCredentialsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:family_admin)
+    @user.webauthn_credentials.destroy_all
+    sign_in @user
+    @user.setup_mfa!
+    @user.enable_mfa!
+    @client = WebAuthn::FakeClient.new("http://www.example.com")
+  end
+
+  test "options require enabled MFA" do
+    @user.disable_mfa!
+
+    post options_settings_webauthn_credentials_path, as: :json
+
+    assert_response :forbidden
+    assert_equal I18n.t("webauthn_credentials.mfa_required"), JSON.parse(response.body).fetch("error")
+  end
+
+  test "creates a credential from a verified registration challenge" do
+    options = registration_options
+    credential = @client.create(challenge: options.fetch("challenge"), rp_id: "www.example.com")
+
+    assert_difference -> { @user.webauthn_credentials.count }, 1 do
+      post settings_webauthn_credentials_path, params: {
+        webauthn_credential: { nickname: "MacBook Touch ID" },
+        credential: credential
+      }, as: :json
+    end
+
+    assert_response :success
+    assert_equal settings_security_path, JSON.parse(response.body).fetch("redirect_url")
+
+    stored_credential = @user.webauthn_credentials.reload.last
+    assert_equal "MacBook Touch ID", stored_credential.nickname
+    assert_equal credential.fetch("id"), stored_credential.credential_id
+    assert_includes stored_credential.transports, "internal"
+    assert @user.reload.webauthn_id.present?
+  end
+
+  test "uses configured relying party id and allowed origin" do
+    with_webauthn_config(rp_id: "example.test", allowed_origins: [ "https://app.example.test" ]) do
+      client = WebAuthn::FakeClient.new("https://app.example.test")
+      options = registration_options
+
+      assert_equal "example.test", options.dig("rp", "id")
+
+      credential = client.create(challenge: options.fetch("challenge"), rp_id: "example.test")
+
+      assert_difference -> { @user.webauthn_credentials.count }, 1 do
+        post settings_webauthn_credentials_path, params: {
+          webauthn_credential: { nickname: "Configured origin key" },
+          credential: credential
+        }, as: :json
+      end
+
+      assert_response :success
+    end
+  end
+
+  test "rejects a credential when registration challenge has already been used" do
+    options = registration_options
+    credential = @client.create(challenge: options.fetch("challenge"), rp_id: "www.example.com")
+
+    post settings_webauthn_credentials_path, params: {
+      webauthn_credential: { nickname: "MacBook Touch ID" },
+      credential: credential
+    }, as: :json
+    assert_response :success
+
+    assert_no_difference -> { @user.webauthn_credentials.count } do
+      post settings_webauthn_credentials_path, params: {
+        webauthn_credential: { nickname: "Replay" },
+        credential: credential
+      }, as: :json
+    end
+
+    assert_response :unprocessable_entity
+  end
+
+  test "rejects malformed credential payloads" do
+    registration_options
+
+    assert_no_difference -> { @user.webauthn_credentials.count } do
+      post settings_webauthn_credentials_path, params: {
+        webauthn_credential: { nickname: "Malformed" },
+        credential: []
+      }, as: :json
+    end
+
+    assert_response :unprocessable_entity
+    assert_equal I18n.t("webauthn_credentials.failure"), JSON.parse(response.body).fetch("error")
+  end
+
+  test "rejects database-level duplicate credential races" do
+    registration_options
+    @user.webauthn_credentials.create!(
+      nickname: "Existing security key",
+      credential_id: "duplicate-credential-id",
+      public_key: "public-key"
+    )
+
+    verified_credential = Struct.new(:id, :public_key, :sign_count).new("duplicate-credential-id", "new-public-key", 0)
+    relying_party = mock("webauthn_relying_party")
+    relying_party.expects(:verify_registration).returns(verified_credential)
+    Settings::WebauthnCredentialsController.any_instance.stubs(:webauthn_relying_party).returns(relying_party)
+
+    assert_no_difference -> { @user.webauthn_credentials.count } do
+      post settings_webauthn_credentials_path, params: {
+        webauthn_credential: { nickname: "Duplicate security key" },
+        credential: { id: "duplicate-credential-id", response: {} }
+      }, as: :json
+    end
+
+    assert_response :unprocessable_entity
+    assert_equal I18n.t("webauthn_credentials.failure"), JSON.parse(response.body).fetch("error")
+  end
+
+  test "uses localized default credential nickname" do
+    options = registration_options
+    credential = @client.create(challenge: options.fetch("challenge"), rp_id: "www.example.com")
+
+    post settings_webauthn_credentials_path, params: {
+      webauthn_credential: { nickname: "" },
+      credential: credential
+    }, as: :json
+
+    assert_response :success
+    assert_equal I18n.t("webauthn_credentials.default_name"), @user.webauthn_credentials.reload.last.nickname
+  end
+
+  test "destroys a credential owned by the current user" do
+    credential = @user.webauthn_credentials.create!(
+      nickname: "YubiKey",
+      credential_id: "credential-to-delete",
+      public_key: "public-key"
+    )
+
+    assert_difference -> { @user.webauthn_credentials.count }, -1 do
+      delete settings_webauthn_credential_path(credential)
+    end
+
+    assert_redirected_to settings_security_path
+  end
+
+  private
+    def registration_options
+      post options_settings_webauthn_credentials_path, as: :json
+      assert_response :success
+      JSON.parse(response.body)
+    end
+
+    def with_webauthn_config(rp_id:, allowed_origins:)
+      config = Rails.application.config.x.webauthn
+      previous_rp_id = config.rp_id
+      previous_allowed_origins = config.allowed_origins
+      config.rp_id = rp_id
+      config.allowed_origins = allowed_origins
+
+      yield
+    ensure
+      config.rp_id = previous_rp_id
+      config.allowed_origins = previous_allowed_origins
+    end
+end
diff --git a/test/controllers/simplefin_items_controller_test.rb b/test/controllers/simplefin_items_controller_test.rb
index c7e039583..23bde7608 100644
--- a/test/controllers/simplefin_items_controller_test.rb
+++ b/test/controllers/simplefin_items_controller_test.rb
@@ -476,6 +476,383 @@ class SimplefinItemsControllerTest < ActionDispatch::IntegrationTest
     assert !q.key?("open_relink_for"), "did not expect auto-open when update produced no SFAs/candidates"
   end
 
+  # Replacement detection prompt (surfaces on the SimpleFIN card when the
+  # importer's ReplacementDetector has persisted suggestions on sync_stats).
+
+  test "replacement prompt renders on accounts index when suggestions are persisted" do
+    # Create the two sfas the detector would flag
+    old_sfa = @simplefin_item.simplefin_accounts.create!(
+      name: "Citi-3831", account_id: "sf_3831",
+      currency: "USD", account_type: "credit", current_balance: 0,
+      org_data: { "name" => "Citibank" },
+      raw_transactions_payload: [
+        { "id" => "t", "transacted_at" => 90.days.ago.to_i, "posted" => 90.days.ago.to_i, "amount" => "-5" }
+      ]
+    )
+    sure_account = Account.create!(
+      family: @family,
+      name: "Citi Double Cash Card-3831",
+      balance: 0, currency: "USD",
+      accountable: CreditCard.create!(subtype: "credit_card")
+    )
+    AccountProvider.create!(account: sure_account, provider: old_sfa)
+
+    new_sfa = @simplefin_item.simplefin_accounts.create!(
+      name: "Citi-2879", account_id: "sf_2879",
+      currency: "USD", account_type: "credit", current_balance: -1200,
+      org_data: { "name" => "Citibank" },
+      raw_transactions_payload: [
+        { "id" => "n", "transacted_at" => 2.days.ago.to_i, "posted" => 2.days.ago.to_i, "amount" => "-100" }
+      ]
+    )
+
+    # Persist a suggestion on the latest sync
+    sync = @simplefin_item.syncs.create!(status: :completed, sync_stats: {
+      "replacement_suggestions" => [
+        {
+          "dormant_sfa_id" => old_sfa.id,
+          "active_sfa_id" => new_sfa.id,
+          "sure_account_id" => sure_account.id,
+          "institution_name" => "Citibank",
+          "dormant_account_name" => "Citi-3831",
+          "active_account_name" => "Citi-2879",
+          "confidence" => "high"
+        }
+      ]
+    })
+    sync.update_column(:created_at, Time.current)
+
+    get accounts_url
+    assert_response :success
+    assert_match(/Citibank card may have been replaced/, response.body)
+    assert_match(/Citi Double Cash Card-3831/, response.body)
+    assert_match(/Relink to new card/, response.body)
+  end
+
+  test "replacement prompt is suppressed once the relink has been applied" do
+    old_sfa = @simplefin_item.simplefin_accounts.create!(
+      name: "Citi-3831", account_id: "sf_3831_applied",
+      currency: "USD", account_type: "credit", current_balance: 0,
+      org_data: { "name" => "Citibank" },
+      raw_transactions_payload: [
+        { "id" => "t", "transacted_at" => 90.days.ago.to_i, "posted" => 90.days.ago.to_i, "amount" => "-5" }
+      ]
+    )
+    sure_account = Account.create!(
+      family: @family,
+      name: "Citi Double Cash Card-3831 (applied)",
+      balance: 0, currency: "USD",
+      accountable: CreditCard.create!(subtype: "credit_card")
+    )
+    new_sfa = @simplefin_item.simplefin_accounts.create!(
+      name: "Citi-2879", account_id: "sf_2879_applied",
+      currency: "USD", account_type: "credit", current_balance: -1200,
+      org_data: { "name" => "Citibank" },
+      raw_transactions_payload: [
+        { "id" => "n", "transacted_at" => 2.days.ago.to_i, "posted" => 2.days.ago.to_i, "amount" => "-100" }
+      ]
+    )
+    # Simulate the post-relink state: new_sfa is now linked to the Sure account,
+    # old_sfa is unlinked. sync_stats still carries the stale suggestion.
+    AccountProvider.create!(account: sure_account, provider: new_sfa)
+    sync = @simplefin_item.syncs.create!(status: :completed, sync_stats: {
+      "replacement_suggestions" => [
+        {
+          "dormant_sfa_id" => old_sfa.id,
+          "active_sfa_id" => new_sfa.id,
+          "sure_account_id" => sure_account.id,
+          "institution_name" => "Citibank",
+          "dormant_account_name" => "Citi-3831",
+          "active_account_name" => "Citi-2879",
+          "confidence" => "high"
+        }
+      ]
+    })
+    sync.update_column(:created_at, Time.current)
+
+    get accounts_url
+    assert_response :success
+    refute_match(/Citibank card may have been replaced/, response.body,
+      "banner should disappear once the relink has landed on the new sfa")
+  end
+
+  test "dismissing a replacement suggestion hides the banner for that pair" do
+    old_sfa = @simplefin_item.simplefin_accounts.create!(
+      name: "Citi-3831", account_id: "sf_3831_dismiss",
+      currency: "USD", account_type: "credit", current_balance: 0,
+      org_data: { "name" => "Citibank" },
+      raw_transactions_payload: [
+        { "id" => "t", "transacted_at" => 90.days.ago.to_i, "posted" => 90.days.ago.to_i, "amount" => "-5" }
+      ]
+    )
+    sure_account = Account.create!(
+      family: @family, name: "Citi Double Cash Card-3831 (dismiss)",
+      balance: 0, currency: "USD",
+      accountable: CreditCard.create!(subtype: "credit_card")
+    )
+    AccountProvider.create!(account: sure_account, provider: old_sfa)
+    new_sfa = @simplefin_item.simplefin_accounts.create!(
+      name: "Citi-2879", account_id: "sf_2879_dismiss",
+      currency: "USD", account_type: "credit", current_balance: -1200,
+      org_data: { "name" => "Citibank" },
+      raw_transactions_payload: [
+        { "id" => "n", "transacted_at" => 2.days.ago.to_i, "posted" => 2.days.ago.to_i, "amount" => "-100" }
+      ]
+    )
+    sync = @simplefin_item.syncs.create!(status: :completed, sync_stats: {
+      "replacement_suggestions" => [
+        {
+          "dormant_sfa_id" => old_sfa.id,
+          "active_sfa_id" => new_sfa.id,
+          "sure_account_id" => sure_account.id,
+          "institution_name" => "Citibank",
+          "confidence" => "high"
+        }
+      ]
+    })
+    sync.update_column(:created_at, Time.current)
+
+    # Banner is present before dismissal
+    get accounts_url
+    assert_match(/Citibank card may have been replaced/, response.body)
+
+    # Dismiss — pair key (dormant + active)
+    post dismiss_replacement_suggestion_simplefin_item_path(@simplefin_item), params: {
+      dormant_sfa_id: old_sfa.id,
+      active_sfa_id: new_sfa.id
+    }
+    sync.reload
+    assert_includes Array(sync.sync_stats["dismissed_replacement_suggestions"]),
+                    "#{old_sfa.id}:#{new_sfa.id}"
+
+    # Banner is gone after dismissal
+    get accounts_url
+    refute_match(/Citibank card may have been replaced/, response.body,
+      "banner should not render for a dismissed pair")
+  end
+
+  test "replacement prompt relink button successfully swaps AccountProvider" do
+    old_sfa = @simplefin_item.simplefin_accounts.create!(
+      name: "Old", account_id: "o1", currency: "USD",
+      account_type: "credit", current_balance: 0
+    )
+    new_sfa = @simplefin_item.simplefin_accounts.create!(
+      name: "New", account_id: "n1", currency: "USD",
+      account_type: "credit", current_balance: -500
+    )
+    sure_account = Account.create!(
+      family: @family, name: "Citi", balance: 0, currency: "USD",
+      accountable: CreditCard.create!(subtype: "credit_card")
+    )
+    AccountProvider.create!(account: sure_account, provider: old_sfa)
+
+    # The relink button posts to link_existing_account just like the modal does
+    post link_existing_account_simplefin_items_path, params: {
+      account_id: sure_account.id,
+      simplefin_account_id: new_sfa.id
+    }
+
+    sure_account.reload
+    sf_aps = sure_account.account_providers.where(provider_type: "SimplefinAccount")
+    assert_equal 1, sf_aps.count
+    assert_equal new_sfa.id, sf_aps.first.provider_id
+  end
+
+  # Same-provider relink tests (Bug #3 — allow SimpleFIN-to-SimpleFIN swap without unlink dance)
+
+  test "link_existing_account allows relink when account is already SimpleFIN-linked via AccountProvider" do
+    # @account currently linked to sfa_old (fraud-replaced card). User picks sfa_new.
+    account = Account.create!(
+      family: @family,
+      name: "Citi Double Cash",
+      balance: 0,
+      currency: "USD",
+      accountable: CreditCard.create!(subtype: "credit_card")
+    )
+    sfa_old = @simplefin_item.simplefin_accounts.create!(
+      name: "Citi Card-OLD",
+      account_id: "sf_citi_old",
+      currency: "USD",
+      account_type: "credit",
+      current_balance: 0
+    )
+    sfa_new = @simplefin_item.simplefin_accounts.create!(
+      name: "Citi Card-NEW",
+      account_id: "sf_citi_new",
+      currency: "USD",
+      account_type: "credit",
+      current_balance: -100
+    )
+    AccountProvider.create!(account: account, provider: sfa_old)
+
+    post link_existing_account_simplefin_items_path, params: {
+      account_id: account.id,
+      simplefin_account_id: sfa_new.id
+    }
+
+    assert_response :see_other
+
+    # The SimpleFIN link should now point at sfa_new
+    account.reload
+    sf_providers = account.account_providers.where(provider_type: "SimplefinAccount")
+    assert_equal 1, sf_providers.count, "should have exactly one SimpleFIN link after relink"
+    assert_equal sfa_new.id, sf_providers.first.provider_id
+
+    # Old AccountProvider for sfa_old on this account is detached
+    refute AccountProvider.exists?(account_id: account.id, provider: sfa_old),
+      "old SimpleFIN AccountProvider for this account should be detached"
+  end
+
+  test "link_existing_account allows relink when account has only legacy simplefin_account_id FK" do
+    account = Account.create!(
+      family: @family,
+      name: "Citi Double Cash",
+      balance: 0,
+      currency: "USD",
+      accountable: CreditCard.create!(subtype: "credit_card")
+    )
+    sfa_old = @simplefin_item.simplefin_accounts.create!(
+      name: "Citi Card-OLD",
+      account_id: "sf_citi_old2",
+      currency: "USD",
+      account_type: "credit",
+      current_balance: 0
+    )
+    sfa_new = @simplefin_item.simplefin_accounts.create!(
+      name: "Citi Card-NEW",
+      account_id: "sf_citi_new2",
+      currency: "USD",
+      account_type: "credit",
+      current_balance: -100
+    )
+    account.update!(simplefin_account_id: sfa_old.id)
+
+    post link_existing_account_simplefin_items_path, params: {
+      account_id: account.id,
+      simplefin_account_id: sfa_new.id
+    }
+
+    assert_response :see_other
+    account.reload
+    assert_nil account.simplefin_account_id, "legacy SimpleFIN FK should be cleared"
+    assert_equal sfa_new.id,
+      account.account_providers.where(provider_type: "SimplefinAccount").first&.provider_id
+  end
+
+  test "link_existing_account rejects when account is linked to a foreign provider (Plaid)" do
+    account = Account.create!(
+      family: @family,
+      name: "Plaid-Linked",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.create!(subtype: "checking")
+    )
+    plaid_item = PlaidItem.create!(family: @family, name: "Plaid Conn", access_token: "t", plaid_id: "p")
+    plaid_acct = PlaidAccount.create!(
+      plaid_item: plaid_item,
+      plaid_id: "p_acct_1",
+      name: "Plaid A",
+      plaid_type: "depository",
+      currency: "USD",
+      current_balance: 0
+    )
+    AccountProvider.create!(account: account, provider: plaid_acct)
+
+    sfa = @simplefin_item.simplefin_accounts.create!(
+      name: "SF-Target",
+      account_id: "sf_target_1",
+      currency: "USD",
+      account_type: "depository",
+      current_balance: 100
+    )
+
+    post link_existing_account_simplefin_items_path, params: {
+      account_id: account.id,
+      simplefin_account_id: sfa.id
+    }
+
+    # Should NOT have attached the SimpleFIN provider
+    account.reload
+    assert_empty account.account_providers.where(provider_type: "SimplefinAccount")
+    # Plaid link should remain intact
+    assert account.account_providers.where(provider_type: "PlaidAccount").exists?
+  end
+
+  # Activity badge tests (helps users distinguish live vs replaced/closed cards during setup)
+
+  test "setup_accounts renders recent-transactions badge for active sfa" do
+    @simplefin_item.simplefin_accounts.create!(
+      name: "Active Card",
+      account_id: "active_card_1",
+      currency: "USD",
+      account_type: "credit",
+      current_balance: -123.45,
+      raw_transactions_payload: [
+        { "id" => "t1", "transacted_at" => 3.days.ago.to_i, "posted" => 3.days.ago.to_i, "amount" => "-10" },
+        { "id" => "t2", "transacted_at" => 10.days.ago.to_i, "posted" => 10.days.ago.to_i, "amount" => "-20" }
+      ]
+    )
+
+    get setup_accounts_simplefin_item_url(@simplefin_item)
+    assert_response :success
+    assert_match(/2 transactions.*3 days ago/, response.body,
+      "expected active sfa to show recent transaction count and last activity")
+  end
+
+  test "setup_accounts renders 'likely closed' warning for dormant+zero-balance sfa" do
+    @simplefin_item.simplefin_accounts.create!(
+      name: "Dead Card",
+      account_id: "dead_card_1",
+      currency: "USD",
+      account_type: "credit",
+      current_balance: 0,
+      raw_transactions_payload: [
+        { "id" => "old", "transacted_at" => 120.days.ago.to_i, "posted" => 120.days.ago.to_i, "amount" => "-5" }
+      ]
+    )
+
+    get setup_accounts_simplefin_item_url(@simplefin_item)
+    assert_response :success
+    assert_match(/closed or replaced card/, response.body,
+      "expected dormant+zero-balance sfa to show closed/replaced warning")
+  end
+
+  test "setup_accounts renders 'no transactions imported' for empty sfa" do
+    @simplefin_item.simplefin_accounts.create!(
+      name: "Brand New Card",
+      account_id: "fresh_card_1",
+      currency: "USD",
+      account_type: "credit",
+      current_balance: 0,
+      raw_transactions_payload: []
+    )
+
+    get setup_accounts_simplefin_item_url(@simplefin_item)
+    assert_response :success
+    assert_match(/No transactions imported yet/, response.body)
+  end
+
+  test "setup_accounts renders 'dormant but has balance' as plain text not warning" do
+    # Legitimate dormant case: HSA/savings account with real balance but no recent activity.
+    # Should NOT be flagged as likely-closed because the balance is non-trivial.
+    @simplefin_item.simplefin_accounts.create!(
+      name: "Dormant HSA",
+      account_id: "dormant_hsa_1",
+      currency: "USD",
+      account_type: "investment",
+      current_balance: 5432.10,
+      raw_transactions_payload: [
+        { "id" => "old", "transacted_at" => 120.days.ago.to_i, "posted" => 120.days.ago.to_i, "amount" => "100" }
+      ]
+    )
+
+    get setup_accounts_simplefin_item_url(@simplefin_item)
+    assert_response :success
+    assert_match(/No activity in 120 days/, response.body)
+    refute_match(/closed or replaced card/, response.body,
+      "dormant accounts with real balances should not be marked as closed")
+  end
+
   # Stale account detection and handling tests
 
   test "setup_accounts detects stale accounts not in upstream API" do
diff --git a/test/controllers/snaptrade_items_controller_test.rb b/test/controllers/snaptrade_items_controller_test.rb
index 18048ac2d..06c4d54e9 100644
--- a/test/controllers/snaptrade_items_controller_test.rb
+++ b/test/controllers/snaptrade_items_controller_test.rb
@@ -6,6 +6,12 @@ class SnaptradeItemsControllerTest < ActionDispatch::IntegrationTest
     @snaptrade_item = snaptrade_items(:configured_item)
   end
 
+  def sign_out
+    @user.sessions.each do |session|
+      delete session_path(session)
+    end
+  end
+
   test "connect handles decryption error gracefully" do
     SnaptradeItem.any_instance
       .stubs(:user_registered?)
@@ -39,6 +45,78 @@ class SnaptradeItemsControllerTest < ActionDispatch::IntegrationTest
     assert_redirected_to portal_url
   end
 
+  test "select_accounts redirects unregistered users into connect flow" do
+    sign_out
+    sign_in @user = users(:empty)
+    snaptrade_item = snaptrade_items(:pending_registration_item)
+
+    get select_accounts_snaptrade_items_url, params: { accountable_type: "Investment", return_to: "setup_accounts" }
+
+    assert_redirected_to connect_snaptrade_item_path(snaptrade_item)
+  end
+
+  test "callback resumes setup flow after first-time connect detour" do
+    sign_out
+    sign_in @user = users(:empty)
+    snaptrade_item = snaptrade_items(:pending_registration_item)
+
+    assert_difference "Sync.count", 1 do
+      get select_accounts_snaptrade_items_url, params: { accountable_type: "Investment", return_to: "setup_accounts" }
+      assert_redirected_to connect_snaptrade_item_path(snaptrade_item)
+
+      get callback_snaptrade_items_url, params: { item_id: snaptrade_item.id }
+    end
+
+    assert_redirected_to setup_accounts_snaptrade_item_path(snaptrade_item, accountable_type: "Investment")
+  end
+
+  test "select_accounts redirects registered users to setup flow" do
+    get select_accounts_snaptrade_items_url, params: { accountable_type: "Investment", return_to: "/accounts" }
+
+    assert_redirected_to setup_accounts_snaptrade_item_path(@snaptrade_item, accountable_type: "Investment", return_to: "/accounts")
+  end
+
+  test "preload_accounts redirects unregistered users into connect flow" do
+    sign_out
+    sign_in @user = users(:empty)
+    snaptrade_item = snaptrade_items(:pending_registration_item)
+
+    assert_no_difference "Sync.count" do
+      get preload_accounts_snaptrade_items_url
+    end
+
+    assert_redirected_to connect_snaptrade_item_path(snaptrade_item)
+  end
+
+  test "preload_accounts redirects registered users to setup flow and queues sync" do
+    assert_difference "Sync.count", 1 do
+      get preload_accounts_snaptrade_items_url
+    end
+
+    assert_redirected_to setup_accounts_snaptrade_item_path(@snaptrade_item)
+  end
+
+  test "entry routing prefers a registered active item over a pending one" do
+    pending_item = @user.family.snaptrade_items.create!(
+      name: "Pending Registration",
+      client_id: "pending_client_id",
+      consumer_key: "pending_consumer_key",
+      status: :good,
+      scheduled_for_deletion: false,
+      pending_account_setup: true
+    )
+
+    get select_accounts_snaptrade_items_url, params: { accountable_type: "Investment", return_to: "/accounts" }
+    assert_redirected_to setup_accounts_snaptrade_item_path(@snaptrade_item, accountable_type: "Investment", return_to: "/accounts")
+
+    assert_difference "Sync.count", 1 do
+      get preload_accounts_snaptrade_items_url
+    end
+    assert_redirected_to setup_accounts_snaptrade_item_path(@snaptrade_item)
+
+    assert_not pending_item.user_registered?
+  end
+
   test "setup_accounts shows linkable investment and crypto accounts in dropdown" do
     get setup_accounts_snaptrade_item_url(@snaptrade_item)
 
@@ -70,6 +148,30 @@ class SnaptradeItemsControllerTest < ActionDispatch::IntegrationTest
     assert_match accounts(:crypto).name, response.body
   end
 
+  test "select_existing_account prefers registered active item over pending one" do
+    pending_item = @user.family.snaptrade_items.create!(
+      name: "Pending Registration",
+      client_id: "pending_client_id",
+      consumer_key: "pending_consumer_key",
+      status: :good,
+      scheduled_for_deletion: false,
+      pending_account_setup: true
+    )
+    pending_item.snaptrade_accounts.create!(
+      snaptrade_account_id: "pending_snaptrade_account",
+      name: "Pending Brokerage Account",
+      brokerage_name: "Pending Broker",
+      currency: "USD",
+      current_balance: 0
+    )
+
+    get select_existing_account_snaptrade_items_url, params: { account_id: accounts(:investment).id }
+
+    assert_response :success
+    assert_includes response.body, snaptrade_accounts(:fidelity_401k).name
+    refute_includes response.body, "Pending Brokerage Account"
+  end
+
   test "link_existing_account links account to snaptrade_account" do
     account = accounts(:investment)
     snaptrade_account = snaptrade_accounts(:fidelity_401k)
diff --git a/test/controllers/sophtron_items_controller_test.rb b/test/controllers/sophtron_items_controller_test.rb
new file mode 100644
index 000000000..0ae7132a1
--- /dev/null
+++ b/test/controllers/sophtron_items_controller_test.rb
@@ -0,0 +1,950 @@
+require "test_helper"
+
+class SophtronItemsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in @user = users(:family_admin)
+    @item = @user.family.sophtron_items.create!(
+      name: "Sophtron",
+      user_id: "developer-user",
+      access_key: Base64.strict_encode64("secret-key"),
+      customer_id: "cust-1"
+    )
+  end
+
+  test "select_accounts renders institution connection flow when no institution is connected" do
+    SophtronItem.any_instance.stubs(:ensure_customer!).returns("cust-1")
+
+    get select_accounts_sophtron_items_url
+
+    assert_response :success
+    assert_includes response.body, "Connect Sophtron Institution"
+  end
+
+  test "select_accounts renders institution search after failed connection attempt" do
+    @item.update!(user_institution_id: "ui-1", status: :requires_update)
+    SophtronItem.any_instance.stubs(:ensure_customer!).returns("cust-1")
+
+    get select_accounts_sophtron_items_url
+
+    assert_response :success
+    assert_includes response.body, "Connect Sophtron Institution"
+  end
+
+  test "select_accounts renders institution search after stale Sophtron timeout" do
+    @item.update!(
+      user_institution_id: "ui-1",
+      status: :good,
+      job_status: "Timeout",
+      raw_job_payload: {
+        AccountID: "00000000-0000-0000-0000-000000000000",
+        JobType: "AddAccounts",
+        JobID: "job-1",
+        SuccessFlag: false,
+        LastStep: "LogInPanel",
+        LastStatus: "Timeout"
+      }
+    )
+    SophtronItem.any_instance.stubs(:ensure_customer!).returns("cust-1")
+
+    get select_accounts_sophtron_items_url
+
+    assert_response :success
+    assert_includes response.body, "Connect Sophtron Institution"
+  end
+
+  test "select_accounts can start a new institution connection when already connected" do
+    @item.update!(user_institution_id: "ui-1", status: :good)
+    SophtronItem.any_instance.stubs(:ensure_customer!).returns("cust-1")
+
+    get select_accounts_sophtron_items_url(connect_new_institution: true)
+
+    assert_response :success
+    assert_includes response.body, "Connect Sophtron Institution"
+    assert_includes response.body, 'name="connect_new_institution"'
+  end
+
+  test "member cannot access Sophtron account selection" do
+    sign_in users(:family_member)
+
+    get select_accounts_sophtron_items_url
+
+    assert_redirected_to accounts_path
+  end
+
+  test "cannot access another family's Sophtron item" do
+    other_item = families(:empty).sophtron_items.create!(
+      name: "Other Sophtron",
+      user_id: "other-developer-user",
+      access_key: Base64.strict_encode64("other-secret")
+    )
+
+    get connection_status_sophtron_item_url(other_item)
+
+    assert_response :not_found
+  end
+
+  test "connect_institution persists job and user institution ids" do
+    provider = mock
+    provider.expects(:create_user_institution).with(
+      institution_id: "inst-1",
+      username: "bank-user",
+      password: "bank-pass",
+      pin: ""
+    ).returns({
+      JobID: "job-1",
+      UserInstitutionID: "ui-1"
+    })
+
+    SophtronItem.any_instance.stubs(:ensure_customer!).returns("cust-1")
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    post connect_institution_sophtron_item_url(@item), params: {
+      institution_id: "inst-1",
+      institution_name: "Example Bank",
+      bank_username: "bank-user",
+      bank_password: "bank-pass"
+    }
+
+    @item.reload
+    assert_equal "Sophtron", @item.name
+    assert_equal "Example Bank", @item.institution_name
+    assert_equal "job-1", @item.current_job_id
+    assert_equal "ui-1", @item.user_institution_id
+    assert_redirected_to connection_status_sophtron_item_path(@item)
+  end
+
+  test "connect_institution creates separate item for additional institution" do
+    @item.update!(
+      institution_id: "apple-inst",
+      institution_name: "Apple / Goldman Sachs",
+      user_institution_id: "ui-apple",
+      status: :good
+    )
+    @item.sophtron_accounts.create!(
+      name: "Juan",
+      account_id: "card-1",
+      currency: "USD",
+      balance: 1_947.18,
+      institution_metadata: {
+        name: "Apple / Goldman Sachs",
+        user_institution_id: "ui-apple"
+      }
+    )
+
+    provider = mock
+    provider.expects(:create_user_institution).with(
+      institution_id: "amazon-inst",
+      username: "bank-user",
+      password: "bank-pass",
+      pin: ""
+    ).returns({
+      JobID: "job-amazon",
+      UserInstitutionID: "ui-amazon"
+    })
+
+    SophtronItem.any_instance.stubs(:ensure_customer!).returns("cust-1")
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    assert_difference -> { @user.family.sophtron_items.count }, 1 do
+      post connect_institution_sophtron_item_url(@item), params: {
+        institution_id: "amazon-inst",
+        institution_name: "Amazon",
+        bank_username: "bank-user",
+        bank_password: "bank-pass",
+        connect_new_institution: true
+      }
+    end
+
+    @item.reload
+    new_item = @user.family.sophtron_items.find_by!(user_institution_id: "ui-amazon")
+
+    assert_equal "Apple / Goldman Sachs", @item.institution_name
+    assert_equal "ui-apple", @item.user_institution_id
+    assert_equal "Amazon", new_item.institution_name
+    assert_equal "ui-amazon", new_item.user_institution_id
+    assert_equal "job-amazon", new_item.current_job_id
+    assert_redirected_to connection_status_sophtron_item_path(new_item, connect_new_institution: "true")
+  end
+
+  test "Sophtron bank credentials and mfa inputs are filtered from logs" do
+    parameter_filter = ActiveSupport::ParameterFilter.new(Rails.application.config.filter_parameters)
+    filtered_params = parameter_filter.filter(
+      bank_username: "bank-user",
+      bank_password: "bank-pass",
+      security_answers: [ "blue" ],
+      captcha_input: "captcha"
+    )
+
+    assert_equal "[FILTERED]", filtered_params[:bank_username]
+    assert_equal "[FILTERED]", filtered_params[:bank_password]
+    assert_equal "[FILTERED]", filtered_params[:security_answers]
+    assert_equal "[FILTERED]", filtered_params[:captcha_input]
+  end
+
+  test "create verifies credentials and persists provisioned customer id" do
+    stub_request(:get, "https://api.sophtron.com/api/Institution/HealthCheckAuth")
+      .to_return(status: 200, body: "")
+    stub_request(:get, "https://api.sophtron.com/api/v2/customers")
+      .to_return(status: 200, body: [].to_json)
+    stub_request(:post, "https://api.sophtron.com/api/v2/customers")
+      .to_return(status: 200, body: {
+        CustomerID: "cust-new",
+        CustomerName: "Sure family #{@user.family.id}"
+      }.to_json)
+
+    assert_difference "SophtronItem.count", 1 do
+      post sophtron_items_url, params: {
+        sophtron_item: {
+          name: "New Sophtron",
+          user_id: "developer-user",
+          access_key: Base64.strict_encode64("secret-key")
+        }
+      }
+    end
+
+    item = @user.family.sophtron_items.find_by!(name: "New Sophtron")
+    assert_equal "cust-new", item.customer_id
+    assert_redirected_to accounts_path
+  end
+
+  test "connection_status renders MFA challenge when Sophtron asks for security answers" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:get_job_information).with("job-1").returns({
+      SecurityQuestion: [ "What is your favorite color?" ].to_json,
+      SuccessFlag: nil,
+      LastStatus: "Waiting"
+    })
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    get connection_status_sophtron_item_url(@item)
+
+    assert_response :success
+    assert_includes response.body, "What is your favorite color?"
+  end
+
+  test "connection_status sanitizes captcha image before rendering data uri" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:get_job_information).with("job-1").returns({
+      CaptchaImage: "YWJj+/=\"><svg onload=alert(1)>",
+      LastStatus: "Waiting"
+    })
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    get connection_status_sophtron_item_url(@item)
+
+    assert_response :success
+    captcha_src = response.body[/src="data:image\/png;base64,([^"]+)"/, 1]
+    assert_equal "YWJj+/=", captcha_src
+    assert_no_match(/svg|onload|alert|[<>"\s]/i, captcha_src)
+  end
+
+  test "connection_status renders token challenge before failed timeout handling" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:get_job_information).with("job-1").returns({
+      AccountID: "00000000-0000-0000-0000-000000000000",
+      JobType: "AddAccounts",
+      JobID: "job-1",
+      SuccessFlag: false,
+      TokenSentFlag: true,
+      TokenInputName: "Token",
+      LastStep: "TokenInput",
+      LastStatus: "Timeout"
+    })
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    get connection_status_sophtron_item_url(@item)
+
+    assert_response :success
+    assert_includes response.body, "Verification code"
+    assert_not_includes response.body, "Sophtron could not complete this connection."
+  end
+
+  test "connection_status times out after max UI polls" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:get_job_information).with("job-1").returns({
+      AccountID: "00000000-0000-0000-0000-000000000000",
+      JobType: "AddAccounts",
+      JobID: "job-1"
+    })
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    get connection_status_sophtron_item_url(@item, poll_attempt: SophtronItemsController::CONNECTION_STATUS_MAX_POLLS)
+
+    assert_response :success
+    assert_includes response.body, "Sophtron did not finish connecting"
+    assert_includes response.body, "Attempt #{SophtronItemsController::CONNECTION_STATUS_MAX_POLLS} of #{SophtronItemsController::CONNECTION_STATUS_MAX_POLLS}"
+    assert_equal "requires_update", @item.reload.status
+    assert_equal "job-1", @item.current_job_id
+  end
+
+  test "connection_status increments polling attempt while job is still running" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:get_job_information).with("job-1").returns({
+      AccountID: "00000000-0000-0000-0000-000000000000",
+      JobType: "AddAccounts",
+      JobID: "job-1"
+    })
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    get connection_status_sophtron_item_url(@item, poll_attempt: 2)
+
+    assert_response :success
+    assert_includes response.body, "Attempt 2 of #{SophtronItemsController::CONNECTION_STATUS_MAX_POLLS}"
+    assert_includes response.body, "poll_attempt=3"
+    assert_includes response.body, 'data-controller="polling"'
+    assert_includes response.body, 'data-polling-frame-id-value="modal"'
+    assert_includes response.body, 'data-turbo-prefetch="false"'
+    assert_select "a[href*='poll_attempt=3']"
+  end
+
+  test "connection_status keeps polling through the third initial attempt for delayed otp" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:get_job_information).with("job-1").returns({
+      AccountID: "00000000-0000-0000-0000-000000000000",
+      JobType: "AddAccounts",
+      JobID: "job-1"
+    })
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    get connection_status_sophtron_item_url(@item, poll_attempt: 3)
+
+    assert_response :success
+    assert_includes response.body, "Attempt 3 of #{SophtronItemsController::CONNECTION_STATUS_MAX_POLLS}"
+    assert_includes response.body, "poll_attempt=4"
+    assert_not_includes response.body, "Sophtron did not finish connecting"
+    assert_not_equal "requires_update", @item.reload.status
+  end
+
+  test "connection_status extends polling when Sophtron starts institution login before otp" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:get_job_information).with("job-1").returns({
+      AccountID: "00000000-0000-0000-0000-000000000000",
+      JobType: "AddAccounts",
+      JobID: "job-1",
+      LastStep: "LogInPanel",
+      LastStatus: "Started"
+    })
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    get connection_status_sophtron_item_url(@item, poll_attempt: SophtronItemsController::CONNECTION_STATUS_MAX_POLLS)
+
+    assert_response :success
+    assert_includes response.body, "Attempt #{SophtronItemsController::CONNECTION_STATUS_MAX_POLLS} of #{SophtronItemsController::LOGIN_PROGRESS_CONNECTION_STATUS_MAX_POLLS}"
+    assert_includes response.body, "poll_attempt=#{SophtronItemsController::CONNECTION_STATUS_MAX_POLLS + 1}"
+    assert_not_includes response.body, "Sophtron did not finish connecting"
+    assert_not_equal "requires_update", @item.reload.status
+  end
+
+  test "connection_status keeps polling after initial max when login progress was already seen" do
+    @item.update!(
+      user_institution_id: "ui-1",
+      current_job_id: "job-1",
+      raw_job_payload: {
+        AccountID: "00000000-0000-0000-0000-000000000000",
+        JobType: "AddAccounts",
+        JobID: "job-1",
+        LastStep: "LogInPanel",
+        LastStatus: "Started"
+      }
+    )
+    provider = mock
+    provider.expects(:get_job_information).with("job-1").returns({
+      AccountID: "00000000-0000-0000-0000-000000000000",
+      JobType: "AddAccounts",
+      JobID: "job-1",
+      LastStep: "LogInPanel",
+      LastStatus: "Started"
+    })
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    get connection_status_sophtron_item_url(@item, poll_attempt: SophtronItemsController::CONNECTION_STATUS_MAX_POLLS + 1)
+
+    assert_response :success
+    assert_includes response.body, "Attempt #{SophtronItemsController::CONNECTION_STATUS_MAX_POLLS + 1} of #{SophtronItemsController::LOGIN_PROGRESS_CONNECTION_STATUS_MAX_POLLS}"
+    assert_includes response.body, "poll_attempt=#{SophtronItemsController::CONNECTION_STATUS_MAX_POLLS + 2}"
+    assert_not_includes response.body, "Sophtron did not finish connecting"
+    assert_not_equal "requires_update", @item.reload.status
+  end
+
+  test "connection_status uses longer polling after mfa is submitted" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:get_job_information).with("job-1").returns({
+      AccountID: "00000000-0000-0000-0000-000000000000",
+      JobType: "AddAccounts",
+      JobID: "job-1",
+      TokenInput: "123456",
+      LastStep: "TransactionTable",
+      LastStatus: "Started"
+    })
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    get connection_status_sophtron_item_url(@item, poll_attempt: SophtronItemsController::CONNECTION_STATUS_MAX_POLLS, post_mfa: true)
+
+    assert_response :success
+    assert_includes response.body, "Attempt #{SophtronItemsController::CONNECTION_STATUS_MAX_POLLS} of 15"
+    assert_includes response.body, "poll_attempt=#{SophtronItemsController::CONNECTION_STATUS_MAX_POLLS + 1}"
+    assert_not_includes response.body, "Sophtron did not finish connecting"
+  end
+
+  test "connection_status renders accounts when post mfa completed job has available accounts" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:get_job_information).with("job-1").returns({
+      AccountID: "00000000-0000-0000-0000-000000000000",
+      JobType: "AddAccounts",
+      JobID: "job-1",
+      TokenInput: "123456",
+      LastStep: "TokenInput",
+      LastStatus: "Completed"
+    })
+    provider.expects(:get_accounts).with("ui-1").returns({
+      accounts: [
+        {
+          id: "acct-1",
+          account_id: "acct-1",
+          account_name: "Sophtron Checking",
+          institution_name: "Example Bank",
+          balance: "123.45",
+          balance_currency: "USD",
+          currency: "USD",
+          status: "active"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    get connection_status_sophtron_item_url(@item, poll_attempt: 5, post_mfa: true)
+
+    assert_response :success
+    assert_includes response.body, "Sophtron Checking"
+    assert_not_includes response.body, "poll_attempt=6"
+
+    @item.reload
+    assert_nil @item.current_job_id
+    assert_equal "good", @item.status
+    assert @item.pending_account_setup?
+  end
+
+  test "connection_status keeps polling when post mfa completed job has no accounts yet" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:get_job_information).with("job-1").returns({
+      AccountID: "00000000-0000-0000-0000-000000000000",
+      JobType: "AddAccounts",
+      JobID: "job-1",
+      TokenInput: "123456",
+      LastStep: "Reset",
+      LastStatus: "Completed"
+    })
+    provider.expects(:get_accounts).with("ui-1").returns({ accounts: [], total: 0 })
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    get connection_status_sophtron_item_url(@item, poll_attempt: 6, post_mfa: true)
+
+    assert_response :success
+    assert_includes response.body, "Attempt 6 of #{SophtronItemsController::POST_MFA_CONNECTION_STATUS_MAX_POLLS}"
+    assert_includes response.body, "poll_attempt=7"
+    assert_not_includes response.body, "Sophtron did not finish connecting"
+    assert_equal "job-1", @item.reload.current_job_id
+  end
+
+  test "connection_status ignores browser prefetches" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    SophtronItem.any_instance.expects(:sophtron_provider).never
+
+    get connection_status_sophtron_item_url(@item, poll_attempt: 2), headers: { "X-Sec-Purpose" => "prefetch" }
+
+    assert_response :no_content
+    assert_nil @item.reload.job_status
+  end
+
+  test "connection_status treats Sophtron timeout as failed" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:get_job_information).with("job-1").returns({
+      AccountID: "00000000-0000-0000-0000-000000000000",
+      JobType: "AddAccounts",
+      JobID: "job-1",
+      SuccessFlag: false,
+      LastStep: "LogInPanel",
+      LastStatus: "Timeout"
+    })
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    get connection_status_sophtron_item_url(@item)
+
+    assert_response :success
+    assert_includes response.body, "Sophtron timed out while the institution was completing login."
+    assert_includes response.body, "Unable to connect to the institution"
+    assert_includes response.body, "Bank credentials"
+    assert_includes response.body, "Verification code"
+    assert_includes response.body, "Try connecting again"
+    assert_not_includes response.body, "Check Provider Settings"
+    @item.reload
+    assert_equal "requires_update", @item.status
+    assert_nil @item.current_job_id
+    assert_nil @item.user_institution_id
+  end
+
+  test "submit_mfa sends security answer as array string" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:update_job_security_answer).with("job-1", [ "blue" ]).returns({})
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    post submit_mfa_sophtron_item_url(@item), params: {
+      mfa_type: "security_answer",
+      security_answers: [ "blue" ]
+    }
+
+    assert_redirected_to connection_status_sophtron_item_path(@item, post_mfa: true)
+  end
+
+  test "submit_mfa rejects too many security answers" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:update_job_security_answer).never
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    post submit_mfa_sophtron_item_url(@item), params: {
+      mfa_type: "security_answer",
+      security_answers: Array.new(SophtronItemsController::MAX_SECURITY_ANSWERS + 1, "blue")
+    }
+
+    assert_redirected_to connection_status_sophtron_item_path(@item)
+    assert_equal "Security answers are missing or too long.", flash[:alert]
+  end
+
+  test "submit_mfa rejects oversized security answers" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:update_job_security_answer).never
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    post submit_mfa_sophtron_item_url(@item), params: {
+      mfa_type: "security_answer",
+      security_answers: [ "a" * (SophtronItemsController::MAX_SECURITY_ANSWER_LENGTH + 1) ]
+    }
+
+    assert_redirected_to connection_status_sophtron_item_path(@item)
+    assert_equal "Security answers are missing or too long.", flash[:alert]
+  end
+
+  test "submit_mfa redirects to post mfa polling window" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    provider = mock
+    provider.expects(:update_job_token_input).with("job-1", token_input: "123456").returns({})
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    post submit_mfa_sophtron_item_url(@item), params: {
+      mfa_type: "token_input",
+      token_input: "123456"
+    }
+
+    assert_redirected_to connection_status_sophtron_item_path(@item, post_mfa: true)
+  end
+
+  test "toggle_manual_sync marks linked Sophtron institution accounts manual" do
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Sophtron Checking",
+      currency: "USD",
+      balance: 100
+    )
+    AccountProvider.create!(account: accounts(:depository), provider: sophtron_account)
+
+    assert_not @item.manual_sync?
+    assert_not sophtron_account.manual_sync?
+
+    post toggle_manual_sync_sophtron_item_url(@item)
+
+    assert_redirected_to accounts_path
+    assert_not @item.reload.manual_sync?
+    assert sophtron_account.reload.manual_sync?
+    assert_includes SophtronItem.syncable, @item
+    assert_equal "Sophtron institution now requires manual sync.", flash[:notice]
+  end
+
+  test "toggle_manual_sync can target one Sophtron institution on a mixed item" do
+    first_sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Apple Card",
+      currency: "USD",
+      balance: 100,
+      institution_metadata: { name: "Apple", user_institution_id: "ui-apple" }
+    )
+    second_sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-2",
+      name: "Amazon Card",
+      currency: "USD",
+      balance: 200,
+      institution_metadata: { name: "Amazon", user_institution_id: "ui-amazon" }
+    )
+    AccountProvider.create!(account: accounts(:depository), provider: first_sophtron_account)
+    AccountProvider.create!(account: accounts(:credit_card), provider: second_sophtron_account)
+
+    post toggle_manual_sync_sophtron_item_url(@item), params: { user_institution_id: "ui-amazon" }
+
+    assert_not first_sophtron_account.reload.manual_sync?
+    assert second_sophtron_account.reload.manual_sync?
+  end
+
+  test "toggle_manual_sync makes targeted institution automatic when whole item is manual" do
+    first_sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Apple Card",
+      currency: "USD",
+      balance: 100,
+      institution_metadata: { name: "Apple", user_institution_id: "ui-apple" }
+    )
+    second_sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-2",
+      name: "Amazon Card",
+      currency: "USD",
+      balance: 200,
+      institution_metadata: { name: "Amazon", user_institution_id: "ui-amazon" }
+    )
+    AccountProvider.create!(account: accounts(:depository), provider: first_sophtron_account)
+    AccountProvider.create!(account: accounts(:credit_card), provider: second_sophtron_account)
+    @item.update!(manual_sync: true)
+
+    post toggle_manual_sync_sophtron_item_url(@item), params: { user_institution_id: "ui-amazon" }
+
+    assert_not @item.reload.manual_sync?
+    assert first_sophtron_account.reload.manual_sync?
+    assert_not second_sophtron_account.reload.manual_sync?
+    assert_equal "Sophtron institution will sync automatically.", flash[:notice]
+  end
+
+  test "manual sync starts Sophtron refresh and renders MFA challenge" do
+    @item.update!(user_institution_id: "ui-1")
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Sophtron Checking",
+      currency: "USD",
+      balance: 100,
+      manual_sync: true
+    )
+    AccountProvider.create!(account: accounts(:depository), provider: sophtron_account)
+
+    provider = mock
+    provider.expects(:refresh_account).with("acct-1").returns({ JobID: "job-1" })
+    provider.expects(:get_job_information).with("job-1").returns({
+      SecurityQuestion: [ "What is your favorite color?" ].to_json,
+      SuccessFlag: nil,
+      LastStatus: "Waiting"
+    })
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    assert_no_enqueued_jobs only: SyncJob do
+      assert_difference -> { @item.syncs.count }, 1 do
+        post sync_sophtron_item_url(@item)
+      end
+    end
+
+    assert_response :success
+    assert_includes response.body, "What is your favorite color?"
+    assert_equal "job-1", @item.reload.current_job_id
+    assert_equal sophtron_account.id, @item.current_job_sophtron_account_id
+    assert @item.syncs.ordered.first.syncing?
+  end
+
+  test "manual sync creates its own sync when an automatic sync is visible" do
+    @item.update!(user_institution_id: "ui-1")
+    automatic_sync = @item.syncs.create!
+    automatic_sync.start!
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Sophtron Checking",
+      currency: "USD",
+      balance: 100,
+      manual_sync: true
+    )
+    AccountProvider.create!(account: accounts(:depository), provider: sophtron_account)
+
+    provider = mock
+    provider.expects(:refresh_account).with("acct-1").returns({ JobID: "job-1" })
+    provider.expects(:get_job_information).with("job-1").returns({
+      SecurityQuestion: [ "What is your favorite color?" ].to_json,
+      LastStatus: "Waiting"
+    })
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    assert_difference -> { @item.syncs.count }, 1 do
+      post sync_sophtron_item_url(@item)
+    end
+
+    assert_response :success
+    assert_equal automatic_sync.id, @item.syncs.ordered.second.id
+    manual_sync = @item.syncs.ordered.first
+    assert_equal [], manual_sync.sync_stats["manual_sync_processed_sophtron_account_ids"]
+    assert_includes response.body, "value=\"#{manual_sync.id}\""
+    assert_not_includes response.body, "value=\"#{automatic_sync.id}\""
+  end
+
+  test "manual sync does not start another refresh while one is active" do
+    @item.update!(user_institution_id: "ui-1")
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Sophtron Checking",
+      currency: "USD",
+      balance: 100,
+      manual_sync: true
+    )
+    AccountProvider.create!(account: accounts(:depository), provider: sophtron_account)
+    sync = @item.syncs.create!(sync_stats: { SophtronItemsController::MANUAL_SYNC_PROCESSED_ACCOUNT_IDS_KEY => [] })
+    sync.start!
+    @item.update!(current_job_id: "job-1", current_job_sophtron_account_id: sophtron_account.id)
+    SophtronItem.any_instance.expects(:sophtron_provider).never
+
+    post sync_sophtron_item_url(@item)
+
+    assert_redirected_to connection_status_sophtron_item_path(
+      @item,
+      manual_sync: true,
+      sync_id: sync.id,
+      sophtron_account_id: sophtron_account.id
+    )
+    assert_equal "Sophtron manual sync is already in progress.", flash[:alert]
+  end
+
+  test "manual sync refreshes every linked Sophtron account" do
+    @item.update!(user_institution_id: "ui-1")
+    first_sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Sophtron Checking",
+      currency: "USD",
+      balance: 100,
+      manual_sync: true
+    )
+    second_sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-2",
+      name: "Sophtron Card",
+      currency: "USD",
+      balance: 200,
+      manual_sync: true
+    )
+    AccountProvider.create!(account: accounts(:depository), provider: first_sophtron_account)
+    AccountProvider.create!(account: accounts(:credit_card), provider: second_sophtron_account)
+
+    provider = mock
+    sequence = sequence("sophtron manual refresh")
+    provider.expects(:refresh_account).with("acct-1").in_sequence(sequence).returns({ JobID: "job-1" })
+    provider.expects(:get_job_information).with("job-1").in_sequence(sequence).returns({ LastStatus: "Completed" })
+    provider.expects(:refresh_account).with("acct-2").in_sequence(sequence).returns({ JobID: "job-2" })
+    provider.expects(:get_job_information).with("job-2").in_sequence(sequence).returns({ LastStatus: "Completed" })
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+    SophtronItem::Importer.any_instance.expects(:import_transactions_after_refresh)
+                           .with(first_sophtron_account)
+                           .returns({ success: true, transactions_count: 1 })
+    SophtronItem::Importer.any_instance.expects(:import_transactions_after_refresh)
+                           .with(second_sophtron_account)
+                           .returns({ success: true, transactions_count: 1 })
+    SophtronAccount::Processor.any_instance.expects(:process).twice.returns({ transactions_imported: 1 })
+
+    assert_enqueued_jobs 2, only: SyncJob do
+      post sync_sophtron_item_url(@item)
+    end
+
+    assert_response :success
+    assert_includes response.body, "Transactions were downloaded after Sophtron verification."
+    @item.reload
+    assert_nil @item.current_job_id
+    assert_nil @item.current_job_sophtron_account_id
+    assert_equal(
+      [ first_sophtron_account.id, second_sophtron_account.id ].map(&:to_s),
+      @item.syncs.ordered.first.sync_stats["manual_sync_processed_sophtron_account_ids"]
+    )
+    stats = @item.syncs.ordered.first.sync_stats
+    assert_equal 2, stats["total_accounts"]
+    assert_equal 2, stats["linked_accounts"]
+    assert_equal 0, stats["unlinked_accounts"]
+    assert_equal 0, stats["total_errors"]
+    assert stats.key?("tx_seen")
+    assert stats.key?("tx_imported")
+    assert stats.key?("tx_updated")
+  end
+
+  test "manual sync clears job pointers when refresh job fails" do
+    @item.update!(user_institution_id: "ui-1")
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Sophtron Checking",
+      currency: "USD",
+      balance: 100,
+      manual_sync: true
+    )
+    AccountProvider.create!(account: accounts(:depository), provider: sophtron_account)
+
+    provider = mock
+    provider.expects(:refresh_account).with("acct-1").returns({ JobID: "job-1" })
+    provider.expects(:get_job_information).with("job-1").returns({
+      SuccessFlag: false,
+      LastStatus: "Timeout"
+    })
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    post sync_sophtron_item_url(@item)
+
+    assert_redirected_to accounts_path
+    @item.reload
+    assert_nil @item.current_job_id
+    assert_nil @item.current_job_sophtron_account_id
+    assert_equal "requires_update", @item.status
+    assert_equal "Sophtron manual sync failed", @item.last_connection_error
+    assert @item.syncs.ordered.first.failed?
+  end
+
+  test "manual sync clears job pointers when job polling raises provider error" do
+    @item.update!(user_institution_id: "ui-1")
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Sophtron Checking",
+      currency: "USD",
+      balance: 100,
+      manual_sync: true
+    )
+    AccountProvider.create!(account: accounts(:depository), provider: sophtron_account)
+
+    provider = mock
+    provider.expects(:refresh_account).with("acct-1").returns({ JobID: "job-1" })
+    provider.expects(:get_job_information)
+            .with("job-1")
+            .raises(Provider::Sophtron::Error.new("Sophtron unavailable", :api_error))
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    post sync_sophtron_item_url(@item)
+
+    assert_redirected_to accounts_path
+    @item.reload
+    assert_nil @item.current_job_id
+    assert_nil @item.current_job_sophtron_account_id
+    assert_equal "requires_update", @item.status
+    assert_equal "Sophtron unavailable", @item.last_connection_error
+    assert @item.syncs.ordered.first.failed?
+  end
+
+  test "manual sync fails and clears job pointers when processing raises" do
+    @item.update!(user_institution_id: "ui-1")
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Sophtron Checking",
+      currency: "USD",
+      balance: 100,
+      manual_sync: true
+    )
+    AccountProvider.create!(account: accounts(:depository), provider: sophtron_account)
+
+    provider = mock
+    provider.expects(:refresh_account).with("acct-1").returns({ JobID: "job-1" })
+    provider.expects(:get_job_information).with("job-1").returns({ LastStatus: "Completed" })
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+    SophtronItem::Importer.any_instance.expects(:import_transactions_after_refresh)
+                           .with(sophtron_account)
+                           .returns({ success: true, transactions_count: 1 })
+    SophtronAccount::Processor.any_instance.expects(:process).raises(StandardError.new("processor failed"))
+
+    post sync_sophtron_item_url(@item)
+
+    assert_redirected_to accounts_path
+    @item.reload
+    assert_nil @item.current_job_id
+    assert_nil @item.current_job_sophtron_account_id
+    assert_equal "requires_update", @item.status
+    assert_equal "processor failed", @item.last_connection_error
+    assert @item.syncs.ordered.first.failed?
+    assert_equal "Sophtron manual sync failed: Sophtron manual sync could not process the refreshed transactions.", flash[:alert]
+    assert_not_includes flash[:alert], "processor failed"
+  end
+
+  test "submit_mfa preserves manual sync context" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1")
+    sync = @item.syncs.create!
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Sophtron Checking",
+      currency: "USD",
+      balance: 100,
+      manual_sync: true
+    )
+    provider = mock
+    provider.expects(:update_job_token_input).with("job-1", token_input: "123456").returns({})
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    post submit_mfa_sophtron_item_url(@item), params: {
+      mfa_type: "token_input",
+      token_input: "123456",
+      manual_sync: true,
+      sync_id: sync.id,
+      sophtron_account_id: sophtron_account.id
+    }
+
+    assert_redirected_to connection_status_sophtron_item_path(
+      @item,
+      manual_sync: "true",
+      post_mfa: true,
+      sophtron_account_id: sophtron_account.id,
+      sync_id: sync.id
+    )
+  end
+
+
+  test "link_existing_account links manual account to sophtron account" do
+    @item.update!(user_institution_id: "ui-1")
+    account = accounts(:depository)
+    provider = mock
+    provider.expects(:get_accounts).with("ui-1").returns({
+      accounts: [
+        {
+          id: "acct-1",
+          account_id: "acct-1",
+          account_name: "Sophtron Checking",
+          balance: "123.45",
+          balance_currency: "USD",
+          currency: "USD",
+          account_type: "checking"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+    SophtronItem.any_instance.stubs(:start_initial_load_later)
+
+    assert_difference "AccountProvider.count", 1 do
+      post link_existing_account_sophtron_items_url, params: {
+        account_id: account.id,
+        sophtron_account_id: "acct-1"
+      }
+    end
+
+    assert account.reload.linked?
+    assert_equal "SophtronAccount", account.account_providers.first.provider_type
+    assert_redirected_to accounts_path
+  end
+end
diff --git a/test/controllers/splits_controller_test.rb b/test/controllers/splits_controller_test.rb
index 6a0cb3dad..5cb89a9ff 100644
--- a/test/controllers/splits_controller_test.rb
+++ b/test/controllers/splits_controller_test.rb
@@ -120,6 +120,26 @@ class SplitsControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
   end
 
+  test "create with excluded parameter sets child as excluded" do
+    assert_difference "Entry.count", 2 do
+      post transaction_split_path(@entry), params: {
+        split: {
+          splits: [
+            { name: "Groceries", amount: "-70", category_id: categories(:food_and_drink).id, excluded: "true" },
+            { name: "Household", amount: "-30", category_id: "", excluded: "false" }
+          ]
+        }
+      }
+    end
+
+    assert_redirected_to transactions_url
+    children = @entry.child_entries.order(:amount)
+    # Household has amount 30 (smaller), Groceries has amount 70 (larger)
+    # Household is NOT excluded, Groceries IS excluded
+    refute children.first.excluded?
+    assert children.last.excluded?
+  end
+
   # Edit action tests
   test "edit renders with existing children pre-filled" do
     @entry.split!([
@@ -193,6 +213,27 @@ class SplitsControllerTest < ActionDispatch::IntegrationTest
     assert_equal 2, @entry.reload.child_entries.count
   end
 
+  test "update with excluded parameter sets child as excluded" do
+    @entry.split!([
+      { name: "Groceries", amount: 70, category_id: nil },
+      { name: "Household", amount: 30, category_id: nil }
+    ])
+
+    patch transaction_split_path(@entry), params: {
+      split: {
+        splits: [
+          { name: "Groceries", amount: "-70", category_id: "", excluded: "true" },
+          { name: "Household", amount: "-30", category_id: "", excluded: "false" }
+        ]
+      }
+    }
+
+    assert_redirected_to transactions_url
+    children = @entry.child_entries.order(:amount)
+    refute children.first.excluded?
+    assert children.last.excluded?
+  end
+
   # Destroy from child tests
   test "destroy from child resolves to parent and unsplits" do
     @entry.split!([
diff --git a/test/controllers/transactions_controller_test.rb b/test/controllers/transactions_controller_test.rb
index 8bb91aa85..a6c2e2a05 100644
--- a/test/controllers/transactions_controller_test.rb
+++ b/test/controllers/transactions_controller_test.rb
@@ -20,7 +20,7 @@ class TransactionsControllerTest < ActionDispatch::IntegrationTest
           nature: "inflow",
           entryable_type: @entry.entryable_type,
           entryable_attributes: {
-            tag_ids: [ Tag.first.id, Tag.second.id ],
+            tag_ids: [ tags(:one).id, tags(:two).id ],
             category_id: Category.first.id,
             merchant_id: Merchant.first.id
           }
@@ -49,7 +49,7 @@ class TransactionsControllerTest < ActionDispatch::IntegrationTest
           excluded: false,
           entryable_attributes: {
             id: @entry.entryable_id,
-            tag_ids: [ Tag.first.id, Tag.second.id ],
+            tag_ids: [ tags(:one).id, tags(:two).id ],
             category_id: Category.first.id,
             merchant_id: Merchant.first.id
           }
@@ -63,7 +63,7 @@ class TransactionsControllerTest < ActionDispatch::IntegrationTest
     assert_equal Date.current, @entry.date
     assert_equal "USD", @entry.currency
     assert_equal -100, @entry.amount
-    assert_equal [ Tag.first.id, Tag.second.id ], @entry.entryable.tag_ids.sort
+    assert_equal [ tags(:one).id, tags(:two).id ].sort, @entry.entryable.tag_ids.sort
     assert_equal Category.first.id, @entry.entryable.category_id
     assert_equal Merchant.first.id, @entry.entryable.merchant_id
     assert_equal "test notes", @entry.notes
@@ -96,6 +96,47 @@ class TransactionsControllerTest < ActionDispatch::IntegrationTest
     assert_dom "#total-transactions", count: 1, text: "1"
   end
 
+  test "can update notes on split child transaction" do
+    parent = create_transaction(account: accounts(:depository), amount: 100)
+    parent.split!([ { name: "Part 1", amount: 60, category_id: nil }, { name: "Part 2", amount: 40, category_id: nil } ])
+    child = parent.child_entries.first
+
+    patch transaction_url(child), params: {
+      entry: { notes: "split child note", entryable_attributes: { id: child.entryable_id } }
+    }
+
+    assert_response :redirect
+    assert_equal "split child note", child.reload.notes
+  end
+
+  test "can update tags on split child transaction" do
+    parent = create_transaction(account: accounts(:depository), amount: 100)
+    parent.split!([ { name: "Part 1", amount: 60, category_id: nil }, { name: "Part 2", amount: 40, category_id: nil } ])
+    child = parent.child_entries.first
+    tag = tags(:one)
+
+    patch transaction_url(child), params: {
+      entry: { entryable_attributes: { id: child.entryable_id, tag_ids: [ tag.id ] } }
+    }
+
+    assert_response :redirect
+    assert_equal [ tag.id ], child.reload.entryable.tag_ids
+  end
+
+  test "split parent rows mark amount as privacy-sensitive" do
+    entry = create_transaction(account: accounts(:depository), amount: 100, name: "Split parent")
+
+    entry.split!([
+      { name: "Part 1", amount: 60, category_id: nil },
+      { name: "Part 2", amount: 40, category_id: nil }
+    ])
+
+    get transactions_url
+
+    assert_response :success
+    assert_select ".split-group > div.opacity-50 p.privacy-sensitive", count: 1
+  end
+
   test "can paginate" do
   family = families(:empty)
   sign_in users(:empty)
@@ -390,4 +431,157 @@ end
     assert_not entry.import_locked?
     assert_not entry.protected_from_sync?
   end
+
+  test "exchange_rate endpoint returns rate for different currencies" do
+    ExchangeRate.expects(:find_or_fetch_rate)
+                .with(from: "EUR", to: "USD", date: Date.current)
+                .returns(1.2)
+
+    get exchange_rate_url, params: {
+      from: "EUR",
+      to: "USD",
+      date: Date.current
+    }
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    assert_equal 1.2, json_response["rate"]
+  end
+
+  test "exchange_rate endpoint returns same_currency for matching currencies" do
+    get exchange_rate_url, params: {
+      from: "USD",
+      to: "USD"
+    }
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    assert json_response["same_currency"]
+    assert_equal 1.0, json_response["rate"]
+  end
+
+  test "exchange_rate endpoint uses provided date" do
+    custom_date = 3.days.ago.to_date
+    ExchangeRate.expects(:find_or_fetch_rate)
+                .with(from: "EUR", to: "USD", date: custom_date)
+                .returns(1.25)
+
+    get exchange_rate_url, params: {
+      from: "EUR",
+      to: "USD",
+      date: custom_date
+    }
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    assert_equal 1.25, json_response["rate"]
+  end
+
+  test "exchange_rate endpoint returns 400 when from currency is missing" do
+    get exchange_rate_url, params: {
+      to: "USD"
+    }
+
+    assert_response :bad_request
+    json_response = JSON.parse(response.body)
+    assert_equal "from and to currencies are required", json_response["error"]
+  end
+
+  test "exchange_rate endpoint returns 400 when to currency is missing" do
+    get exchange_rate_url, params: {
+      from: "EUR"
+    }
+
+    assert_response :bad_request
+    json_response = JSON.parse(response.body)
+    assert_equal "from and to currencies are required", json_response["error"]
+  end
+
+  test "exchange_rate endpoint returns 400 on invalid date format" do
+    get exchange_rate_url, params: {
+      from: "EUR",
+      to: "USD",
+      date: "not-a-date"
+    }
+
+    assert_response :bad_request
+    json_response = JSON.parse(response.body)
+    assert_equal "Invalid date format", json_response["error"]
+  end
+
+  test "exchange_rate endpoint returns 404 when rate not found" do
+    ExchangeRate.expects(:find_or_fetch_rate)
+                .with(from: "EUR", to: "USD", date: Date.current)
+                .returns(nil)
+
+    get exchange_rate_url, params: {
+      from: "EUR",
+      to: "USD"
+    }
+
+    assert_response :not_found
+    json_response = JSON.parse(response.body)
+    assert_equal "Exchange rate not found", json_response["error"]
+  end
+
+  test "creates transaction with custom exchange rate" do
+    account = @user.family.accounts.create!(
+      name: "USD Account",
+      currency: "USD",
+      balance: 1000,
+      accountable: Depository.new
+    )
+
+    assert_difference [ "Entry.count", "Transaction.count" ], 1 do
+      post transactions_url, params: {
+        entry: {
+          account_id: account.id,
+          name: "EUR transaction with custom rate",
+          date: Date.current,
+          currency: "EUR",
+          amount: 100,
+          nature: "outflow",
+          entryable_type: "Transaction",
+          entryable_attributes: {
+            category_id: Category.first.id,
+            exchange_rate: "1.5"
+          }
+        }
+      }
+    end
+
+    created_entry = Entry.order(:created_at).last
+    assert_equal "EUR", created_entry.currency
+    assert_equal 100, created_entry.amount
+    assert_equal 1.5, created_entry.transaction.extra["exchange_rate"]
+  end
+
+  test "creates transaction without custom exchange rate" do
+    account = @user.family.accounts.create!(
+      name: "USD Account",
+      currency: "USD",
+      balance: 1000,
+      accountable: Depository.new
+    )
+
+    assert_difference [ "Entry.count", "Transaction.count" ], 1 do
+      post transactions_url, params: {
+        entry: {
+          account_id: account.id,
+          name: "EUR transaction without custom rate",
+          date: Date.current,
+          currency: "EUR",
+          amount: 100,
+          nature: "outflow",
+          entryable_type: "Transaction",
+          entryable_attributes: {
+            category_id: Category.first.id
+          }
+        }
+      }
+    end
+
+    created_entry = Entry.order(:created_at).last
+    assert_nil created_entry.transaction.extra["exchange_rate"]
+  end
 end
diff --git a/test/controllers/transfers_controller_test.rb b/test/controllers/transfers_controller_test.rb
index 9959f45b2..544b10057 100644
--- a/test/controllers/transfers_controller_test.rb
+++ b/test/controllers/transfers_controller_test.rb
@@ -25,6 +25,143 @@ class TransfersControllerTest < ActionDispatch::IntegrationTest
     end
   end
 
+  test "can create transfer with custom exchange rate" do
+    usd_account = accounts(:depository)
+    eur_account = users(:family_admin).family.accounts.create!(
+      name: "EUR Account",
+      balance: 1000,
+      currency: "EUR",
+      accountable: Depository.new
+    )
+
+    assert_equal "USD", usd_account.currency
+    assert_equal "EUR", eur_account.currency
+
+    assert_difference "Transfer.count", 1 do
+      post transfers_url, params: {
+        transfer: {
+          from_account_id: usd_account.id,
+          to_account_id: eur_account.id,
+          date: Date.current,
+          amount: 100,
+          exchange_rate: 0.92
+        }
+      }
+    end
+
+    transfer = Transfer.where(
+      "outflow_transaction_id IN (?) AND inflow_transaction_id IN (?)",
+      usd_account.transactions.pluck(:id),
+      eur_account.transactions.pluck(:id)
+    ).last
+    assert_not_nil transfer
+    assert_equal "USD", transfer.outflow_transaction.entry.currency
+    assert_equal "EUR", transfer.inflow_transaction.entry.currency
+    assert_equal 100, transfer.outflow_transaction.entry.amount
+    assert_in_delta(-92, transfer.inflow_transaction.entry.amount, 0.01)
+  end
+
+  test "exchange_rate endpoint returns 400 when from currency is missing" do
+    get exchange_rate_url, params: {
+      to: "USD"
+    }
+
+    assert_response :bad_request
+    json_response = JSON.parse(response.body)
+    assert_equal "from and to currencies are required", json_response["error"]
+  end
+
+  test "exchange_rate endpoint returns 400 when to currency is missing" do
+    get exchange_rate_url, params: {
+      from: "EUR"
+    }
+
+    assert_response :bad_request
+    json_response = JSON.parse(response.body)
+    assert_equal "from and to currencies are required", json_response["error"]
+  end
+
+  test "exchange_rate endpoint returns 400 on invalid date format" do
+    get exchange_rate_url, params: {
+      from: "EUR",
+      to: "USD",
+      date: "not-a-date"
+    }
+
+    assert_response :bad_request
+    json_response = JSON.parse(response.body)
+    assert_equal "Invalid date format", json_response["error"]
+  end
+
+  test "exchange_rate endpoint returns rate for different currencies" do
+    ExchangeRate.expects(:find_or_fetch_rate)
+                .with(from: "USD", to: "EUR", date: Date.current)
+                .returns(OpenStruct.new(rate: 0.92))
+
+    get exchange_rate_url, params: {
+      from: "USD",
+      to: "EUR",
+      date: Date.current.to_s
+    }
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    assert_equal 0.92, json_response["rate"]
+  end
+
+  test "exchange_rate endpoint returns error when exchange rate unavailable" do
+    ExchangeRate.expects(:find_or_fetch_rate)
+                .with(from: "USD", to: "EUR", date: Date.current)
+                .returns(nil)
+
+    get exchange_rate_url, params: {
+      from: "USD",
+      to: "EUR",
+      date: Date.current.to_s
+    }
+
+    assert_response :not_found
+    json_response = JSON.parse(response.body)
+    assert_equal "Exchange rate not found", json_response["error"]
+  end
+
+  test "cannot create transfer when exchange rate unavailable and no custom rate provided" do
+    usd_account = accounts(:depository)
+    eur_account = users(:family_admin).family.accounts.create!(
+      name: "EUR Account",
+      balance: 1000,
+      currency: "EUR",
+      accountable: Depository.new
+    )
+
+    ExchangeRate.stubs(:find_or_fetch_rate).returns(nil)
+
+    assert_no_difference "Transfer.count" do
+      post transfers_url, params: {
+        transfer: {
+          from_account_id: usd_account.id,
+          to_account_id: eur_account.id,
+          date: Date.current,
+          amount: 100
+        }
+      }
+    end
+
+    assert_response :unprocessable_entity
+  end
+
+  test "exchange_rate endpoint returns same_currency for matching currencies" do
+    get exchange_rate_url, params: {
+      from: "USD",
+      to: "USD"
+    }
+
+    assert_response :success
+    json_response = JSON.parse(response.body)
+    assert_equal true, json_response["same_currency"]
+    assert_equal 1.0, json_response["rate"]
+  end
+
   test "soft deletes transfer" do
     assert_difference -> { Transfer.count }, -1 do
       delete transfer_url(transfers(:one))
@@ -61,4 +198,48 @@ class TransfersControllerTest < ActionDispatch::IntegrationTest
       transfer.reload
     end
   end
+
+  test "mark_as_recurring creates a recurring transfer" do
+    transfer = transfers(:one)
+    family = users(:family_admin).family
+    family.recurring_transactions.destroy_all
+
+    assert_difference -> { RecurringTransaction.where(family: family).count }, +1 do
+      post mark_as_recurring_transfer_url(transfer)
+    end
+
+    rt = RecurringTransaction.where(family: family).last
+    assert rt.transfer?
+    assert_equal transfer.outflow_transaction.entry.account, rt.account
+    assert_equal transfer.inflow_transaction.entry.account, rt.destination_account
+    assert rt.manual?
+    assert_equal I18n.t("recurring_transactions.transfer_marked_as_recurring"), flash[:notice]
+    assert_redirected_to transactions_path
+  end
+
+  test "mark_as_recurring is idempotent: second call flashes already-exists" do
+    transfer = transfers(:one)
+    family = users(:family_admin).family
+    family.recurring_transactions.destroy_all
+
+    post mark_as_recurring_transfer_url(transfer)
+    assert_equal I18n.t("recurring_transactions.transfer_marked_as_recurring"), flash[:notice]
+
+    assert_no_difference -> { RecurringTransaction.where(family: family).count } do
+      post mark_as_recurring_transfer_url(transfer)
+    end
+    assert_equal I18n.t("recurring_transactions.transfer_already_exists"), flash[:alert]
+  end
+
+  test "mark_as_recurring is rejected when recurring_transactions_disabled" do
+    transfer = transfers(:one)
+    family = users(:family_admin).family
+    family.update!(recurring_transactions_disabled: true)
+    family.recurring_transactions.destroy_all
+
+    assert_no_difference -> { RecurringTransaction.where(family: family).count } do
+      post mark_as_recurring_transfer_url(transfer)
+    end
+    assert_equal I18n.t("recurring_transactions.transfer_feature_disabled"), flash[:alert]
+  end
 end
diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
index 5ca659669..63c00b478 100644
--- a/test/controllers/users_controller_test.rb
+++ b/test/controllers/users_controller_test.rb
@@ -32,6 +32,40 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
     assert_equal "es", @user.reload.locale
   end
 
+  test "admin can update enabled family currencies" do
+    patch user_url(@user), params: {
+      user: {
+        redirect_to: "preferences",
+        family_attributes: {
+          id: @user.family.id,
+          enabled_currencies: [ "USD", "SGD" ]
+        }
+      }
+    }
+
+    assert_redirected_to settings_preferences_url
+    assert_equal [ "USD", "SGD" ], @user.family.reload.enabled_currency_codes
+  end
+
+  test "non-admin cannot update enabled family currencies" do
+    sign_in @member = users(:family_member)
+    original_codes = @member.family.enabled_currency_codes
+
+    patch user_url(@member), params: {
+      user: {
+        redirect_to: "preferences",
+        family_attributes: {
+          id: @member.family.id,
+          enabled_currencies: [ "USD", "SGD" ]
+        }
+      }
+    }
+
+    assert_redirected_to settings_profile_url
+    assert_equal I18n.t("users.reset.unauthorized"), flash[:alert]
+    assert_equal original_codes, @member.family.reload.enabled_currency_codes
+  end
+
   test "admin can reset family data" do
     account = accounts(:investment)
     category = categories(:income)
diff --git a/test/controllers/valuations_controller_test.rb b/test/controllers/valuations_controller_test.rb
index 7827906b8..b7151e606 100644
--- a/test/controllers/valuations_controller_test.rb
+++ b/test/controllers/valuations_controller_test.rb
@@ -50,4 +50,31 @@ class ValuationsControllerTest < ActionDispatch::IntegrationTest
     assert_equal 22000, @entry.amount
     assert_equal "Test notes", @entry.notes
   end
+
+  test "confirm_create with blank amount returns unprocessable entity" do
+    account = accounts(:investment)
+
+    post confirm_create_valuations_url, params: {
+      entry: {
+        amount: "",
+        date: Date.current.to_s,
+        account_id: account.id
+      }
+    }
+
+    assert_response :unprocessable_entity
+    assert_match I18n.t("valuations.errors.amount_required"), response.body
+  end
+
+  test "confirm_update with blank amount returns unprocessable entity" do
+    post confirm_update_valuation_url(@entry), params: {
+      entry: {
+        amount: "",
+        date: Date.current.to_s
+      }
+    }
+
+    assert_response :unprocessable_entity
+    assert_match I18n.t("valuations.errors.amount_required"), response.body
+  end
 end
diff --git a/test/fixtures/account_statements.yml b/test/fixtures/account_statements.yml
new file mode 100644
index 000000000..868eb8b97
--- /dev/null
+++ b/test/fixtures/account_statements.yml
@@ -0,0 +1 @@
+# Empty fixture file so account_statements is cleaned with the rest of the test fixture set.
diff --git a/test/fixtures/addresses.yml b/test/fixtures/addresses.yml
index 0124887ec..4d01359a6 100644
--- a/test/fixtures/addresses.yml
+++ b/test/fixtures/addresses.yml
@@ -4,6 +4,6 @@ one:
   locality: Los Angeles
   region: CA
   country: US
-  postal_code: 90001
+  postal_code: "90001"
   addressable: one
   addressable_type: Property
diff --git a/test/fixtures/brex_accounts.yml b/test/fixtures/brex_accounts.yml
new file mode 100644
index 000000000..ce5214b47
--- /dev/null
+++ b/test/fixtures/brex_accounts.yml
@@ -0,0 +1,7 @@
+checking_account:
+  brex_item: one
+  account_id: "cash_acc_checking_1"
+  account_kind: cash
+  name: "Brex Checking"
+  currency: USD
+  current_balance: 10000.00
diff --git a/test/fixtures/brex_items.yml b/test/fixtures/brex_items.yml
new file mode 100644
index 000000000..492f464df
--- /dev/null
+++ b/test/fixtures/brex_items.yml
@@ -0,0 +1,7 @@
+one:
+  family: dylan_family
+
+  name: "Test Brex Connection"
+  token: "test_brex_token_123"
+  base_url: "https://api-staging.brex.com"
+  status: good
diff --git a/test/fixtures/exchange_rate_pairs.yml b/test/fixtures/exchange_rate_pairs.yml
new file mode 100644
index 000000000..5aa677233
--- /dev/null
+++ b/test/fixtures/exchange_rate_pairs.yml
@@ -0,0 +1,11 @@
+eur_gbp:
+  from_currency: EUR
+  to_currency: GBP
+  first_provider_rate_on: <%= 10.years.ago.to_date %>
+  provider_name: twelve_data
+
+usd_jpy_fresh:
+  from_currency: USD
+  to_currency: JPY
+  first_provider_rate_on:
+  provider_name:
diff --git a/test/fixtures/files/ibkr/flex_statement.xml b/test/fixtures/files/ibkr/flex_statement.xml
new file mode 100644
index 000000000..ffc2c5f7f
--- /dev/null
+++ b/test/fixtures/files/ibkr/flex_statement.xml
@@ -0,0 +1,45 @@
+<FlexQueryResponse queryName="Sure Test" type="AF">
+  <FlexStatements count="2">
+    <FlexStatement accountId="U1234567" fromDate="2025-05-08" toDate="2026-05-08" whenGenerated="2026-05-08;12:00:00">
+      <AccountInformation accountId="U1234567" currency="CHF" />
+      <ChangeInPositionValues>
+        <ChangeInPositionValue accountId="U1234567" currency="BASE_SUMMARY" endOfPeriodValue="2350.50" />
+      </ChangeInPositionValues>
+      <CashReport>
+        <CashReportCurrency currency="BASE_SUMMARY" endingCash="1000.50" />
+        <CashReportCurrency currency="CHF" endingCash="1000.50" />
+        <CashReportCurrency currency="USD" endingCash="500.00" />
+      </CashReport>
+      <EquitySummaryInBase>
+        <EquitySummaryByReportDateInBase currency="CHF" reportDate="2026-05-07" cash="900.50" stock="2300.50" total="3201.00" />
+        <EquitySummaryByReportDateInBase currency="CHF" reportDate="2026-05-08" cash="1000.50" stock="2350.50" total="3351.00" />
+      </EquitySummaryInBase>
+      <OpenPositions>
+        <OpenPosition assetCategory="STK" conid="265598" securityID="US0378331005" securityIDType="ISIN" symbol="AAPL" position="10" markPrice="150.00" currency="USD" fxRateToBase="0.90" costBasisPrice="125.50" reportDate="2026-05-08" side="Long" />
+      </OpenPositions>
+      <Trades>
+        <Trade assetCategory="STK" tradeID="1001" transactionID="1001a" conid="265598" symbol="AAPL" quantity="2" tradePrice="140.00" currency="USD" fxRateToBase="0.90" buySell="BUY" tradeDate="2026-05-01" ibCommission="-1.25" ibCommissionCurrency="USD" />
+        <Trade assetCategory="STK" tradeID="1002" transactionID="1002a" conid="265598" symbol="AAPL" quantity="-1" tradePrice="155.00" currency="USD" fxRateToBase="0.92" buySell="SELL" tradeDate="2026-05-05" ibCommission="-1.10" ibCommissionCurrency="USD" />
+      </Trades>
+      <CashTransactions>
+        <CashTransaction transactionID="4001" type="Deposits/Withdrawals" amount="500.00" currency="CHF" fxRateToBase="1" reportDate="2026-05-03" />
+        <CashTransaction transactionID="4002" type="Dividends" amount="2.50" currency="USD" fxRateToBase="0.91" reportDate="2026-05-04" conid="265598" />
+      </CashTransactions>
+    </FlexStatement>
+    <FlexStatement accountId="U7654321" fromDate="2025-05-08" toDate="2026-05-08" whenGenerated="2026-05-08;12:00:00">
+      <AccountInformation accountId="U7654321" currency="USD" />
+      <ChangeInPositionValues>
+        <ChangeInPositionValue accountId="U7654321" currency="BASE_SUMMARY" endOfPeriodValue="0.00" />
+      </ChangeInPositionValues>
+      <CashReport>
+        <CashReportCurrency currency="BASE_SUMMARY" endingCash="250.00" />
+      </CashReport>
+      <EquitySummaryInBase>
+        <EquitySummaryByReportDateInBase currency="USD" reportDate="2026-05-08" cash="250.00" stock="0.00" total="250.00" />
+      </EquitySummaryInBase>
+      <OpenPositions />
+      <Trades />
+      <CashTransactions />
+    </FlexStatement>
+  </FlexStatements>
+</FlexQueryResponse>
diff --git a/test/fixtures/files/imports/actual.csv b/test/fixtures/files/imports/actual.csv
new file mode 100644
index 000000000..03c504d5d
--- /dev/null
+++ b/test/fixtures/files/imports/actual.csv
@@ -0,0 +1,5 @@
+Account,Date,Payee,Notes,Category_Group,Category,Amount,Split_Amount,Cleared
+Checking Account,2024-01-01,Landlord,January rent,Housing,Rent,-1500.00,0,Reconciled
+Credit Card,2024-01-02,Coffee Shop,Morning coffee,Food,Coffee,-4.25,0,Cleared
+Checking Account,2024-01-05,Employer,Monthly salary,Income,Paycheck,2500.00,0,Reconciled
+Checking Account,2024-01-06,Internal Transfer,Move to savings,,Transfer,-250.00,0,Not cleared
diff --git a/test/fixtures/ibkr_accounts.yml b/test/fixtures/ibkr_accounts.yml
new file mode 100644
index 000000000..8ef3649d3
--- /dev/null
+++ b/test/fixtures/ibkr_accounts.yml
@@ -0,0 +1,27 @@
+main_account:
+  ibkr_item: configured_item
+  name: Main IBKR
+  ibkr_account_id: U1234567
+  currency: CHF
+  current_balance: 3351.0
+  cash_balance: 1000.5
+  institution_metadata:
+    provider_name: Interactive Brokers
+  raw_holdings_payload: []
+  raw_activities_payload: {}
+  raw_cash_report_payload: []
+  report_date: 2026-05-08
+
+secondary_account:
+  ibkr_item: configured_item
+  name: Retirement IBKR
+  ibkr_account_id: U7654321
+  currency: USD
+  current_balance: 250
+  cash_balance: 250
+  institution_metadata:
+    provider_name: Interactive Brokers
+  raw_holdings_payload: []
+  raw_activities_payload: {}
+  raw_cash_report_payload: []
+  report_date: 2026-05-08
diff --git a/test/fixtures/ibkr_items.yml b/test/fixtures/ibkr_items.yml
new file mode 100644
index 000000000..f03973935
--- /dev/null
+++ b/test/fixtures/ibkr_items.yml
@@ -0,0 +1,15 @@
+configured_item:
+  family: dylan_family
+  name: Interactive Brokers
+  status: good
+  query_id: QUERY123
+  token: TOKEN123
+  pending_account_setup: true
+
+empty_item:
+  family: empty
+  name: Interactive Brokers
+  status: good
+  query_id: QUERYEMPTY
+  token: TOKENEMPTY
+  pending_account_setup: false
diff --git a/test/fixtures/import/rows.yml b/test/fixtures/import/rows.yml
index 7cc0fd7f4..55dc1efbf 100644
--- a/test/fixtures/import/rows.yml
+++ b/test/fixtures/import/rows.yml
@@ -1,5 +1,6 @@
 one:
   import: transaction
+  source_row_number: 1
   date: 01/01/2024
   amount: 100
-  currency: USD
\ No newline at end of file
+  currency: USD
diff --git a/test/fixtures/kraken_accounts.yml b/test/fixtures/kraken_accounts.yml
new file mode 100644
index 000000000..9038ee9dc
--- /dev/null
+++ b/test/fixtures/kraken_accounts.yml
@@ -0,0 +1,8 @@
+one:
+  kraken_item: one
+  name: Kraken
+  account_id: combined
+  account_type: combined
+  currency: USD
+  current_balance: 1234.50
+  extra: {}
diff --git a/test/fixtures/kraken_items.yml b/test/fixtures/kraken_items.yml
new file mode 100644
index 000000000..9181b1c75
--- /dev/null
+++ b/test/fixtures/kraken_items.yml
@@ -0,0 +1,20 @@
+one:
+  family: dylan_family
+  name: My Kraken
+  api_key: test_kraken_key_123
+  api_secret: test_kraken_secret_456
+  last_nonce: 0
+  status: good
+  institution_name: Kraken
+  institution_domain: kraken.com
+  institution_url: https://www.kraken.com
+  institution_color: "#5841D8"
+
+requires_update:
+  family: dylan_family
+  name: Stale Kraken
+  api_key: old_kraken_key
+  api_secret: old_kraken_secret
+  last_nonce: 0
+  status: requires_update
+  institution_name: Kraken
diff --git a/test/helpers/account_statements_helper_test.rb b/test/helpers/account_statements_helper_test.rb
new file mode 100644
index 000000000..567468bda
--- /dev/null
+++ b/test/helpers/account_statements_helper_test.rb
@@ -0,0 +1,15 @@
+require "test_helper"
+
+class AccountStatementsHelperTest < ActionView::TestCase
+  test "reconciliation label falls back for invalid checks" do
+    opening_balance = I18n.t("account_statements.reconciliation.checks.opening_balance")
+    closing_balance = I18n.t("account_statements.reconciliation.checks.closing_balance")
+    unknown_check = I18n.t("account_statements.reconciliation.checks.unknown_check")
+
+    assert_equal opening_balance, account_statement_reconciliation_label({ key: "opening_balance" })
+    assert_equal closing_balance, account_statement_reconciliation_label({ "key" => "closing_balance" })
+    assert_equal unknown_check, account_statement_reconciliation_label({})
+    assert_equal unknown_check, account_statement_reconciliation_label(nil)
+    assert_equal unknown_check, account_statement_reconciliation_label([])
+  end
+end
diff --git a/test/helpers/application_helper_test.rb b/test/helpers/application_helper_test.rb
index e4c3bf361..434735449 100644
--- a/test/helpers/application_helper_test.rb
+++ b/test/helpers/application_helper_test.rb
@@ -1,6 +1,39 @@
 require "test_helper"
 
 class ApplicationHelperTest < ActionView::TestCase
+  test "#icon normalizes icon names to lowercase" do
+    capture = []
+
+    singleton_class.send(:define_method, :lucide_icon) do |key, **opts|
+      capture << [ key, opts ]
+      "<svg></svg>".html_safe
+    end
+
+    icon("Key")
+
+    assert_equal "key", capture.first.first
+  ensure
+    singleton_class.send(:remove_method, :lucide_icon) if singleton_class.method_defined?(:lucide_icon)
+  end
+
+  test "#icon falls back when lucide icon is unknown" do
+    calls = []
+
+    singleton_class.send(:define_method, :lucide_icon) do |key, **_opts|
+      calls << key
+      raise ArgumentError, "Unknown icon #{key}" if key == "not-a-real-icon"
+
+      "<svg></svg>".html_safe
+    end
+
+    result = icon("not-a-real-icon")
+
+    assert_equal [ "not-a-real-icon", "key" ], calls
+    assert_equal "<svg></svg>", result
+  ensure
+    singleton_class.send(:remove_method, :lucide_icon) if singleton_class.method_defined?(:lucide_icon)
+  end
+
   test "#title(page_title)" do
     title("Test Title")
     assert_equal "Test Title", content_for(:title)
@@ -24,4 +57,18 @@ class ApplicationHelperTest < ActionView::TestCase
     assert_equal "$0.00", totals_by_currency(collection: [ Account.new(currency: "USD", balance: 0) ], money_method: :balance_money)
     assert_equal "-$3.00 | €7.00", totals_by_currency(collection: [ @account1, @account2, @account3 ], money_method: :balance_money, negate: true)
   end
+
+  test "#currency_picker_options_for_family returns enabled family currencies" do
+    family = families(:dylan_family)
+    family.update!(currency: "SGD", enabled_currencies: [ "USD" ])
+
+    assert_equal [ "SGD", "USD" ], currency_picker_options_for_family(family)
+  end
+
+  test "#currency_picker_options_for_family keeps selected legacy currency visible" do
+    family = families(:dylan_family)
+    family.update!(currency: "SGD", enabled_currencies: [ "USD" ])
+
+    assert_equal [ "SGD", "USD", "EUR" ], currency_picker_options_for_family(family, extra: "EUR")
+  end
 end
diff --git a/test/helpers/brex_items_helper_test.rb b/test/helpers/brex_items_helper_test.rb
new file mode 100644
index 000000000..124881220
--- /dev/null
+++ b/test/helpers/brex_items_helper_test.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class BrexItemsHelperTest < ActionView::TestCase
+  test "metadata uses translations with titleized fallback" do
+    display = BrexItemsHelper::BrexAccountDisplay.new(
+      id: "cash_1",
+      name: "Operating Cash",
+      kind: "cash",
+      currency: "USD",
+      status: "ACTIVE",
+      blank_name: false
+    )
+
+    assert_equal "Brex • USD • Cash • Active", brex_account_metadata(display)
+
+    fallback_display = BrexItemsHelper::BrexAccountDisplay.new(
+      id: "unknown_1",
+      name: "Unknown",
+      kind: "custom_kind",
+      currency: "USD",
+      status: "custom_status",
+      blank_name: false
+    )
+
+    assert_equal "Brex • USD • Custom Kind • Custom Status", brex_account_metadata(fallback_display)
+  end
+end
diff --git a/test/helpers/budgets_helper_test.rb b/test/helpers/budgets_helper_test.rb
new file mode 100644
index 000000000..4c94f627e
--- /dev/null
+++ b/test/helpers/budgets_helper_test.rb
@@ -0,0 +1,107 @@
+require "test_helper"
+
+class BudgetsHelperTest < ActionView::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @budget = budgets(:one)
+
+    @parent_category = Category.create!(
+      name: "Helper Parent #{SecureRandom.hex(4)}",
+      family: @family,
+      color: "#4da568",
+      lucide_icon: "utensils"
+    )
+
+    @child_category = Category.create!(
+      name: "Helper Child #{SecureRandom.hex(4)}",
+      parent: @parent_category,
+      family: @family
+    )
+
+    @parent_budget_category = BudgetCategory.create!(
+      budget: @budget,
+      category: @parent_category,
+      budgeted_spending: 200,
+      currency: "USD"
+    )
+
+    @child_budget_category = BudgetCategory.create!(
+      budget: @budget,
+      category: @child_category,
+      budgeted_spending: 0,
+      currency: "USD"
+    )
+  end
+
+  test "hides inheriting subcategory with no budget and no spending from on-track section" do
+    state = budget_categories_view_state(@budget)
+    group = state[:on_track_groups].find { |g| g.budget_category.id == @parent_budget_category.id }
+
+    assert group.present?
+    assert_empty group.budget_subcategories
+  end
+
+  test "shows inheriting subcategory in on-track section when it has spending" do
+    Entry.create!(
+      account: accounts(:depository),
+      entryable: Transaction.create!(category: @child_category),
+      date: Date.current,
+      name: "Helper Child Spending",
+      amount: 25,
+      currency: "USD"
+    )
+
+    budget = Budget.find(@budget.id)
+    state = budget_categories_view_state(budget)
+    group = state[:on_track_groups].find { |g| g.budget_category.category_id == @parent_category.id }
+
+    assert group.present?
+    assert_includes group.budget_subcategories.map(&:category_id), @child_category.id
+  end
+
+  test "keeps group when only subcategory is over budget" do
+    parent = Category.create!(
+      name: "Helper Group Parent #{SecureRandom.hex(4)}",
+      family: @family,
+      color: "#22c55e",
+      lucide_icon: "utensils"
+    )
+
+    child = Category.create!(
+      name: "Helper Group Child #{SecureRandom.hex(4)}",
+      parent: parent,
+      family: @family
+    )
+
+    BudgetCategory.create!(
+      budget: @budget,
+      category: parent,
+      budgeted_spending: 300,
+      currency: "USD"
+    )
+
+    BudgetCategory.create!(
+      budget: @budget,
+      category: child,
+      budgeted_spending: 50,
+      currency: "USD"
+    )
+
+    Entry.create!(
+      account: accounts(:depository),
+      entryable: Transaction.create!(category: child),
+      date: Date.current,
+      name: "Helper Child Over Budget",
+      amount: 100,
+      currency: "USD"
+    )
+
+    state = budget_categories_view_state(Budget.find(@budget.id))
+    group = state[:over_budget_groups].find { |g| g.budget_category.category_id == parent.id }
+
+    assert group.present?
+    refute group.budget_category.any_over_budget?
+    assert_equal [ child.id ], group.budget_subcategories.map(&:category_id)
+    assert group.budget_subcategories.first.any_over_budget?
+  end
+end
diff --git a/test/helpers/imports_helper_test.rb b/test/helpers/imports_helper_test.rb
new file mode 100644
index 000000000..5640f891b
--- /dev/null
+++ b/test/helpers/imports_helper_test.rb
@@ -0,0 +1,77 @@
+require "test_helper"
+require "ostruct"
+
+class ImportsHelperTest < ActionView::TestCase
+  test "dry run resource labels come from locale keys" do
+    %i[
+      transactions balances accounts categories tags rules merchants
+      recurring_transactions transfers rejected_transfers trades holdings
+      valuations budgets budget_categories
+    ].each do |key|
+      assert_equal I18n.t("imports.dry_run_resources.#{key}"), dry_run_resource(key).label
+    end
+
+    balances = dry_run_resource(:balances)
+    assert_equal "line-chart", balances.icon
+    assert_equal "text-secondary", balances.text_class
+    assert_equal "bg-container-inset", balances.bg_class
+
+    resources = %i[
+      transactions balances accounts categories tags rules merchants
+      recurring_transactions transfers rejected_transfers trades holdings
+      valuations budgets budget_categories
+    ].map { |key| dry_run_resource(key) }
+    resources.each do |resource|
+      refute_match(/\b(?:text|bg)-[a-z]+-\d{2,3}/, [ resource.text_class, resource.bg_class ].join(" "))
+    end
+  end
+
+  test "import verification view handles missing readback payload" do
+    import = OpenStruct.new(verification_payload: {})
+
+    verification = import_verification_view(import)
+
+    assert_equal "not_verified", verification.status
+    assert_equal 0, verification.checked_total
+    assert_equal 0, verification.mismatches_count
+    assert_empty verification.mismatches_preview
+    refute verification.mismatches?
+  end
+
+  test "import verification view handles nil readback payload" do
+    import = OpenStruct.new(verification_payload: { readback: nil })
+
+    verification = import_verification_view(import)
+
+    assert_equal "not_verified", verification.status
+    assert_equal 0, verification.checked_total
+    assert_equal 0, verification.mismatches_count
+    assert_empty verification.mismatches_preview
+    refute verification.mismatches?
+  end
+
+  test "import verification view shapes readback counts and mismatch preview" do
+    import = OpenStruct.new(
+      verification_payload: {
+        readback: {
+          status: "mismatch",
+          checked_counts: { accounts: 1, transactions: "2" },
+          mismatches: {
+            accounts: { expected: 1, actual: 0 },
+            transactions: { expected: 2, actual: 1 },
+            categories: { expected: 3, actual: 2 },
+            tags: { expected: 4, actual: 3 }
+          }
+        }
+      }
+    )
+
+    verification = import_verification_view(import)
+
+    assert_equal "mismatch", verification.status
+    assert_equal 3, verification.checked_total
+    assert_equal 4, verification.mismatches_count
+    assert_equal %w[accounts transactions categories], verification.mismatches_preview.map(&:first)
+    assert verification.mismatches?
+  end
+end
diff --git a/test/helpers/simplefin_items_helper_test.rb b/test/helpers/simplefin_items_helper_test.rb
new file mode 100644
index 000000000..b247f0caf
--- /dev/null
+++ b/test/helpers/simplefin_items_helper_test.rb
@@ -0,0 +1,62 @@
+require "test_helper"
+
+class SimplefinItemsHelperTest < ActionView::TestCase
+  test "#activity_when returns nil for blank time" do
+    assert_nil activity_when(nil)
+    assert_nil activity_when("")
+  end
+
+  test "#activity_when returns 'today' for current time" do
+    assert_equal "today", activity_when(Time.current)
+  end
+
+  test "#activity_when returns 'today' for earlier today" do
+    # Freeze at mid-day so 6.hours.ago is guaranteed to fall on the same
+    # calendar day regardless of when the suite runs.
+    travel_to(Time.zone.parse("2026-04-17 15:00:00")) do
+      assert_equal "today", activity_when(6.hours.ago)
+    end
+  end
+
+  test "#activity_when returns 'yesterday' one day back" do
+    assert_equal "yesterday", activity_when(1.day.ago)
+  end
+
+  test "#activity_when returns 'N days ago' for older dates" do
+    # Freeze time so relative "N days ago" stays stable regardless of the
+    # hour-of-day the suite runs.
+    travel_to(Time.zone.parse("2026-04-17 15:00:00")) do
+      assert_equal "5 days ago", activity_when(5.days.ago)
+      # 2 days ago is the first value that hits the plural "N days ago" branch
+      # (0 -> today, 1 -> yesterday, >=2 -> N days ago).
+      assert_equal "2 days ago", activity_when(2.days.ago)
+    end
+  end
+
+  test "#activity_when respects injected now: for deterministic formatting" do
+    now = Time.zone.parse("2026-04-17 12:00:00")
+    assert_equal "7 days ago", activity_when(now - 7.days, now: now)
+  end
+
+  # ---- simplefin_error_tooltip (pre-existing) ----
+  test "#simplefin_error_tooltip returns nil for blank stats" do
+    assert_nil simplefin_error_tooltip(nil)
+    assert_nil simplefin_error_tooltip({})
+    assert_nil simplefin_error_tooltip({ "total_errors" => 0 })
+  end
+
+  test "#simplefin_error_tooltip builds a sample with bucket counts" do
+    stats = {
+      "total_errors" => 3,
+      "errors" => [
+        { "name" => "Chase", "message" => "Timeout" },
+        { "name" => "Citi", "message" => "Auth" }
+      ],
+      "error_buckets" => { "auth" => 1, "network" => 2 }
+    }
+    tooltip = simplefin_error_tooltip(stats)
+    assert_includes tooltip, "Errors:"
+    assert_includes tooltip, "3"
+    assert_includes tooltip, "auth: 1"
+  end
+end
diff --git a/test/integration/active_storage_authorization_test.rb b/test/integration/active_storage_authorization_test.rb
index 75698a536..9c30d4f91 100644
--- a/test/integration/active_storage_authorization_test.rb
+++ b/test/integration/active_storage_authorization_test.rb
@@ -12,6 +12,16 @@ class ActiveStorageAuthorizationTest < ActionDispatch::IntegrationTest
       content_type: "application/pdf"
     )
     @attachment_a = @transaction_a.attachments.first
+
+    @statement_a = AccountStatement.create_from_upload!(
+      family: @user_a.family,
+      account: @transaction_a.entry.account,
+      file: uploaded_file(
+        filename: "statement.pdf",
+        content_type: "application/pdf",
+        content: "%PDF-1.4 Family A Secret Statement"
+      )
+    )
   end
 
   test "user can access attachments within their own family" do
@@ -29,6 +39,33 @@ class ActiveStorageAuthorizationTest < ActionDispatch::IntegrationTest
     assert_match(/rails\/active_storage\/disk/, response.header["Location"])
   end
 
+  test "disk service urls require authentication" do
+    sign_in @user_a
+
+    get rails_blob_path(@statement_a.original_file)
+    assert_response :redirect
+    disk_url = response.location
+    sign_out @user_a
+
+    get disk_url
+
+    assert_redirected_to new_session_url
+  end
+
+  test "disk service urls enforce statement blob authorization" do
+    sign_in @user_a
+
+    get rails_blob_path(@statement_a.original_file)
+    assert_response :redirect
+    disk_url = response.location
+    sign_out @user_a
+    sign_in @user_b
+
+    get disk_url
+
+    assert_response :not_found
+  end
+
   test "user cannot access attachments from a different family" do
     sign_in @user_b
 
@@ -55,4 +92,213 @@ class ActiveStorageAuthorizationTest < ActionDispatch::IntegrationTest
 
     assert_response :not_found
   end
+
+  test "user cannot access statement blob from a different family" do
+    sign_in @user_b
+
+    get rails_blob_path(@statement_a.original_file)
+
+    assert_response :not_found
+  end
+
+  test "unauthenticated user is redirected before statement blob access" do
+    get rails_blob_path(@statement_a.original_file)
+
+    assert_redirected_to new_session_url
+  end
+
+  test "user cannot access linked statement blob for an inaccessible account" do
+    private_account = accounts(:other_asset)
+    statement = AccountStatement.create_from_upload!(
+      family: @user_a.family,
+      account: private_account,
+      file: uploaded_file(
+        filename: "private_statement.pdf",
+        content_type: "application/pdf",
+        content: "%PDF-1.4 Private Family Statement"
+      )
+    )
+
+    sign_in users(:family_member)
+
+    get rails_blob_path(statement.original_file)
+
+    assert_response :not_found
+  end
+
+  test "user can access linked statement blob for a shared account" do
+    statement = AccountStatement.create_from_upload!(
+      family: @user_a.family,
+      account: accounts(:credit_card),
+      file: uploaded_file(
+        filename: "shared_statement.pdf",
+        content_type: "application/pdf",
+        content: "%PDF-1.4 Shared Family Statement"
+      )
+    )
+
+    sign_in users(:family_member)
+
+    get rails_blob_path(statement.original_file)
+
+    assert_response :redirect
+    follow_redirect!
+    assert_response :success
+    assert_match(/rails\/active_storage\/disk/, request.path)
+  end
+
+  test "guest cannot access unmatched statement blob" do
+    statement = AccountStatement.create_from_upload!(
+      family: @user_a.family,
+      account: nil,
+      file: uploaded_file(
+        filename: "unmatched_statement.pdf",
+        content_type: "application/pdf",
+        content: "%PDF-1.4 Unmatched Family Statement"
+      )
+    )
+
+    sign_in family_guest
+
+    get rails_blob_path(statement.original_file)
+
+    assert_response :not_found
+  end
+
+  test "orphaned statement attachment fails closed" do
+    attachment = @statement_a.original_file.attachment
+    attachment.update_columns(record_id: SecureRandom.uuid)
+
+    sign_in @user_a
+
+    get rails_blob_path(attachment)
+
+    assert_response :not_found
+  end
+
+  test "unattached blobs fail closed" do
+    blob = ActiveStorage::Blob.create_and_upload!(
+      io: StringIO.new("unattached statement"),
+      filename: "unattached.csv",
+      content_type: "text/csv"
+    )
+
+    sign_in @user_a
+
+    get rails_blob_path(blob)
+
+    assert_response :not_found
+  end
+
+  test "blob authorization checks protected attachments even when blob is also attached elsewhere" do
+    document = FamilyDocument.create!(family: @user_a.family, filename: "shared.pdf", status: "ready")
+    document.file.attach(@statement_a.original_file.blob)
+
+    sign_in @user_b
+
+    get rails_blob_path(document.file)
+
+    assert_response :not_found
+  end
+
+  test "blob authorization denies when any protected attachment is unauthorized" do
+    statement_b = AccountStatement.new(
+      family: @user_b.family,
+      filename: "shared_statement.pdf",
+      content_type: @statement_a.content_type,
+      byte_size: @statement_a.byte_size,
+      checksum: @statement_a.checksum,
+      content_sha256: @statement_a.content_sha256,
+      currency: @user_b.family.currency
+    )
+    statement_b.original_file.attach(@statement_a.original_file.blob)
+    statement_b.save!
+
+    sign_in @user_a
+
+    get rails_blob_path(@statement_a.original_file)
+
+    assert_response :not_found
+  end
+
+  test "unknown protected attachment types fail closed" do
+    blob = ActiveStorage::Blob.create_and_upload!(
+      io: StringIO.new("unknown protected attachment"),
+      filename: "unknown.csv",
+      content_type: "text/csv"
+    )
+    ActiveStorage::Attachment.insert!(
+      {
+      name: "file",
+      record_type: "ProtectedAttachmentProbe",
+      record_id: SecureRandom.uuid,
+      blob_id: blob.id,
+      created_at: Time.current
+      }
+    )
+
+    with_protected_record_types("Transaction", "AccountStatement", "ProtectedAttachmentProbe") do
+      sign_in @user_a
+
+      get rails_blob_path(blob)
+
+      assert_response :not_found
+    end
+  end
+
+  test "direct uploads require authentication" do
+    post rails_direct_uploads_path, params: {
+      blob: {
+        filename: "statement.csv",
+        byte_size: 1,
+        checksum: Digest::MD5.base64digest("1"),
+        content_type: "text/csv"
+      }
+    }, as: :json
+
+    assert_redirected_to new_session_url
+  end
+
+  test "authenticated direct uploads can create unattached blobs" do
+    sign_in @user_a
+
+    post rails_direct_uploads_path, params: {
+      blob: {
+        filename: "statement.csv",
+        byte_size: 1,
+        checksum: Digest::MD5.base64digest("1"),
+        content_type: "text/csv"
+      }
+    }, as: :json
+
+    assert_response :success
+    assert response.parsed_body["signed_id"].present?
+  end
+
+  test "orphaned transaction attachment fails closed" do
+    @attachment_a.update_columns(record_id: SecureRandom.uuid)
+
+    sign_in @user_a
+
+    get rails_blob_path(@attachment_a)
+
+    assert_response :not_found
+  end
+
+  private
+
+    def sign_out(user)
+      user.sessions.each { |session| delete session_path(session) }
+    end
+
+    def with_protected_record_types(*types)
+      previous_types = ActiveStorageAttachmentAuthorization::PROTECTED_RECORD_TYPES
+      ActiveStorageAttachmentAuthorization.send(:remove_const, :PROTECTED_RECORD_TYPES)
+      ActiveStorageAttachmentAuthorization.const_set(:PROTECTED_RECORD_TYPES, types.flatten.freeze)
+
+      yield
+    ensure
+      ActiveStorageAttachmentAuthorization.send(:remove_const, :PROTECTED_RECORD_TYPES)
+      ActiveStorageAttachmentAuthorization.const_set(:PROTECTED_RECORD_TYPES, previous_types)
+    end
 end
diff --git a/test/integration/layout_accessibility_test.rb b/test/integration/layout_accessibility_test.rb
new file mode 100644
index 000000000..5a232721f
--- /dev/null
+++ b/test/integration/layout_accessibility_test.rb
@@ -0,0 +1,27 @@
+require "test_helper"
+
+class LayoutAccessibilityTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in users(:family_admin)
+  end
+
+  test "application layout renders skip-link pointing at #main and a <main> with id=\"main\"" do
+    get root_path
+    assert_response :ok
+
+    skip_text = I18n.t("layouts.application.skip_to_main")
+
+    assert_select "a[href=\"#main\"]", text: skip_text
+    assert_select "main#main"
+  end
+
+  test "settings layout renders skip-link pointing at #main and a <main> with id=\"main\"" do
+    get settings_profile_path
+    assert_response :ok
+
+    skip_text = I18n.t("layouts.application.skip_to_main")
+
+    assert_select "a[href=\"#main\"]", text: skip_text
+    assert_select "main#main"
+  end
+end
diff --git a/test/interfaces/accountable_resource_interface_test.rb b/test/interfaces/accountable_resource_interface_test.rb
index 5ad9598e1..a17b6cf9e 100644
--- a/test/interfaces/accountable_resource_interface_test.rb
+++ b/test/interfaces/accountable_resource_interface_test.rb
@@ -14,4 +14,18 @@ module AccountableResourceInterfaceTest
     get edit_account_url(@account)
     assert_response :success
   end
+
+  test "update saves currency change" do
+    @account.update!(currency: "USD")
+
+    patch send("#{@account.accountable_type.underscore}_path", @account), params: {
+      account: {
+        name: @account.name,
+        currency: "EUR"
+      }
+    }
+
+    @account.reload
+    assert_equal "EUR", @account.currency
+  end
 end
diff --git a/test/javascript/utils/sankey_zoom_test.mjs b/test/javascript/utils/sankey_zoom_test.mjs
new file mode 100644
index 000000000..ab0425b71
--- /dev/null
+++ b/test/javascript/utils/sankey_zoom_test.mjs
@@ -0,0 +1,128 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  sankeyNodeHasChildren,
+  zoomSankeyData,
+} from "../../../app/javascript/utils/sankey_zoom.mjs";
+
+test("zooms an expense category to the clicked root and descendants", () => {
+  const data = {
+    nodes: [
+      { id: "cash_flow_node", name: "Cash Flow" },
+      { id: "expense_shopping", name: "Shopping" },
+      { id: "expense_sub_groceries", name: "Groceries" },
+      { id: "expense_sub_clothes", name: "Clothes" },
+      { id: "expense_dining", name: "Dining" },
+    ],
+    links: [
+      { source: 0, target: 1, value: 150 },
+      { source: 1, target: 2, value: 100 },
+      { source: 1, target: 3, value: 50 },
+      { source: 0, target: 4, value: 75 },
+    ],
+    currency_symbol: "$",
+  };
+
+  assert.equal(sankeyNodeHasChildren(data, "expense_shopping"), true);
+  assert.equal(sankeyNodeHasChildren(data, "expense_sub_groceries"), false);
+
+  const zoomed = zoomSankeyData(data, "expense_shopping");
+
+  assert.deepEqual(zoomed.nodes.map((node) => node.id), [
+    "expense_shopping",
+    "expense_sub_groceries",
+    "expense_sub_clothes",
+  ]);
+  assert.deepEqual(
+    zoomed.links.map((link) => [link.source, link.target, link.value]),
+    [
+      [0, 1, 100],
+      [0, 2, 50],
+    ],
+  );
+  assert.equal(zoomed.currency_symbol, "$");
+});
+
+test("zooms an income category by following incoming child links", () => {
+  const data = {
+    nodes: [
+      { id: "income_salary", name: "Salary" },
+      { id: "cash_flow_node", name: "Cash Flow" },
+      { id: "income_sub_bonus", name: "Bonus" },
+      { id: "income_sub_equity", name: "Equity" },
+      { id: "income_interest", name: "Interest" },
+    ],
+    links: [
+      { source: 0, target: 1, value: 250 },
+      { source: 2, target: 0, value: 100 },
+      { source: 3, target: 0, value: 150 },
+      { source: 4, target: 1, value: 25 },
+    ],
+    currency_symbol: "$",
+  };
+
+  assert.equal(sankeyNodeHasChildren(data, "income_salary"), true);
+  assert.equal(sankeyNodeHasChildren(data, "income_sub_bonus"), false);
+
+  const zoomed = zoomSankeyData(data, "income_salary");
+
+  assert.deepEqual(zoomed.nodes.map((node) => node.id), [
+    "income_salary",
+    "income_sub_bonus",
+    "income_sub_equity",
+  ]);
+  assert.deepEqual(
+    zoomed.links.map((link) => [link.source, link.target, link.value]),
+    [
+      [1, 0, 100],
+      [2, 0, 150],
+    ],
+  );
+});
+
+test("zooms the cashflow node to its expense (outbound) descendants", () => {
+  const data = {
+    nodes: [
+      { id: "income_salary", name: "Salary" },
+      { id: "cash_flow_node", name: "Cash Flow" },
+      { id: "expense_shopping", name: "Shopping" },
+      { id: "expense_sub_groceries", name: "Groceries" },
+    ],
+    links: [
+      { source: 0, target: 1, value: 200 },
+      { source: 1, target: 2, value: 150 },
+      { source: 2, target: 3, value: 100 },
+    ],
+  };
+
+  assert.equal(sankeyNodeHasChildren(data, "cash_flow_node"), true);
+
+  const zoomed = zoomSankeyData(data, "cash_flow_node");
+
+  assert.deepEqual(zoomed.nodes.map((node) => node.id), [
+    "cash_flow_node",
+    "expense_shopping",
+    "expense_sub_groceries",
+  ]);
+  assert.deepEqual(
+    zoomed.links.map((link) => [link.source, link.target, link.value]),
+    [
+      [0, 1, 150],
+      [1, 2, 100],
+    ],
+  );
+});
+
+test("does not zoom malformed data without a cashflow node", () => {
+  const data = {
+    nodes: [
+      { id: "expense_shopping", name: "Shopping" },
+      { id: "expense_sub_groceries", name: "Groceries" },
+    ],
+    links: [{ source: 0, target: 1, value: 100 }],
+  };
+
+  assert.equal(sankeyNodeHasChildren(data, "expense_shopping"), false);
+  assert.equal(zoomSankeyData(data, "expense_shopping"), data);
+});
diff --git a/test/jobs/debug_log_cleanup_job_test.rb b/test/jobs/debug_log_cleanup_job_test.rb
new file mode 100644
index 000000000..df66ce5be
--- /dev/null
+++ b/test/jobs/debug_log_cleanup_job_test.rb
@@ -0,0 +1,77 @@
+require "test_helper"
+
+class DebugLogCleanupJobTest < ActiveJob::TestCase
+  setup do
+    @original_retention_days = Rails.application.config.x.debug_log.retention_days
+    Rails.application.config.x.debug_log.retention_days = 90
+  end
+
+  teardown do
+    Rails.application.config.x.debug_log.retention_days = @original_retention_days
+  end
+
+  test "deletes entries older than 90 days" do
+    travel_to Time.zone.parse("2026-05-17 12:00:00") do
+      old_entry = DebugLogEntry.create!(
+        category: "old_event",
+        level: "info",
+        message: "old",
+        source: "Test",
+        created_at: 91.days.ago,
+        updated_at: 91.days.ago
+      )
+      boundary_entry = DebugLogEntry.create!(
+        category: "boundary_event",
+        level: "info",
+        message: "boundary",
+        source: "Test",
+        created_at: 90.days.ago,
+        updated_at: 90.days.ago
+      )
+      recent_entry = DebugLogEntry.create!(
+        category: "recent_event",
+        level: "info",
+        message: "recent",
+        source: "Test"
+      )
+
+      assert_difference "DebugLogEntry.count", -1 do
+        DebugLogCleanupJob.perform_now
+      end
+
+      assert_not DebugLogEntry.exists?(old_entry.id)
+      assert DebugLogEntry.exists?(boundary_entry.id)
+      assert DebugLogEntry.exists?(recent_entry.id)
+    end
+  end
+
+  test "uses configured retention days" do
+    Rails.application.config.x.debug_log.retention_days = 30
+
+    travel_to Time.zone.parse("2026-05-17 12:00:00") do
+      old_entry = DebugLogEntry.create!(
+        category: "old_event",
+        level: "info",
+        message: "old",
+        source: "Test",
+        created_at: 31.days.ago,
+        updated_at: 31.days.ago
+      )
+      boundary_entry = DebugLogEntry.create!(
+        category: "boundary_event",
+        level: "info",
+        message: "boundary",
+        source: "Test",
+        created_at: 30.days.ago,
+        updated_at: 30.days.ago
+      )
+
+      assert_difference "DebugLogEntry.count", -1 do
+        DebugLogCleanupJob.perform_now
+      end
+
+      assert_not DebugLogEntry.exists?(old_entry.id)
+      assert DebugLogEntry.exists?(boundary_entry.id)
+    end
+  end
+end
diff --git a/test/jobs/demo_family_refresh_job_test.rb b/test/jobs/demo_family_refresh_job_test.rb
index 991b2ed3c..48bd24167 100644
--- a/test/jobs/demo_family_refresh_job_test.rb
+++ b/test/jobs/demo_family_refresh_job_test.rb
@@ -61,4 +61,14 @@ class DemoFamilyRefreshJobTest < ActiveJob::TestCase
       assert_match(/\+deleting-/, @demo_user.email)
     end
   end
+
+  test "reads demo email when config_for returns symbol keys" do
+    Rails.application.stubs(:config_for).with(:demo).returns({ email: @demo_email })
+
+    generator = mock
+    generator.expects(:generate_default_data!).with(skip_clear: true, email: @demo_email)
+    Demo::Generator.expects(:new).returns(generator)
+
+    DemoFamilyRefreshJob.perform_now
+  end
 end
diff --git a/test/jobs/rule_job_test.rb b/test/jobs/rule_job_test.rb
new file mode 100644
index 000000000..c7d1c462a
--- /dev/null
+++ b/test/jobs/rule_job_test.rb
@@ -0,0 +1,54 @@
+require "test_helper"
+
+class RuleJobTest < ActiveJob::TestCase
+  include EntriesTestHelper
+
+  setup do
+    @family = families(:empty)
+    @account = @family.accounts.create!(name: "Rule job test", balance: 1000, currency: "USD", accountable: Depository.new)
+    @food_and_dining = @family.categories.create!(name: "Food & Dining")
+    @groceries = @family.categories.create!(name: "Groceries")
+  end
+
+  test "records manually locked matching transactions as blocked" do
+    20.times do |index|
+      create_transaction(
+        account: @account,
+        name: "Whole Foods #{index}",
+        date: Date.current - index.days
+      )
+    end
+
+    manually_locked_transactions = @family.transactions
+                                            .joins(:entry)
+                                            .where("entries.name LIKE ?", "Whole Foods%")
+                                            .order("entries.date DESC")
+                                            .limit(10)
+
+    manually_locked_transactions.each do |transaction|
+      transaction.update!(category: @groceries)
+      transaction.lock_attr!(:category_id)
+      transaction.entry.mark_user_modified!
+    end
+
+    rule = @family.rules.create!(
+      name: "Whole Foods Testing",
+      resource_type: "transaction",
+      effective_date: 1.year.ago.to_date,
+      conditions: [
+        Rule::Condition.new(condition_type: "transaction_name", operator: "like", value: "Whole Foods")
+      ],
+      actions: [
+        Rule::Action.new(action_type: "set_transaction_category", value: @food_and_dining.id)
+      ]
+    )
+
+    RuleJob.perform_now(rule)
+
+    rule_run = rule.rule_runs.order(:created_at).last
+    assert_equal 20, rule_run.transactions_queued
+    assert_equal 20, rule_run.transactions_processed
+    assert_equal 10, rule_run.transactions_modified
+    assert_equal 10, rule_run.transactions_blocked
+  end
+end
diff --git a/test/jobs/simplefin_holdings_apply_job_test.rb b/test/jobs/simplefin_holdings_apply_job_test.rb
index 7cc7b4c6c..1826e2495 100644
--- a/test/jobs/simplefin_holdings_apply_job_test.rb
+++ b/test/jobs/simplefin_holdings_apply_job_test.rb
@@ -124,7 +124,7 @@ class SimplefinHoldingsApplyJobTest < ActiveSupport::TestCase
     # Price derived from market_value
     assert_in_delta 500.0, holding.price.to_f, 0.01
 
-    # cost_basis should fall back to "value" field (45000)
-    assert_in_delta 45000.0, holding.cost_basis.to_f, 0.01
+    # cost_basis should fall back to "value" field and normalize total basis to per-share basis
+    assert_in_delta 450.0, holding.cost_basis.to_f, 0.01
   end
 end
diff --git a/test/jobs/sophtron_refresh_poll_job_test.rb b/test/jobs/sophtron_refresh_poll_job_test.rb
new file mode 100644
index 000000000..c29fa4d99
--- /dev/null
+++ b/test/jobs/sophtron_refresh_poll_job_test.rb
@@ -0,0 +1,47 @@
+require "test_helper"
+
+class SophtronRefreshPollJobTest < ActiveJob::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @item = @family.sophtron_items.create!(
+      name: "Sophtron",
+      user_id: "developer-user",
+      access_key: Base64.strict_encode64("secret-key"),
+      customer_id: "cust-1",
+      user_institution_id: "ui-1"
+    )
+    @account = accounts(:depository)
+    @sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Checking",
+      currency: "USD",
+      balance: 100,
+      raw_transactions_payload: [ { id: "existing-tx" } ]
+    )
+    AccountProvider.create!(account: @account, provider: @sophtron_account)
+  end
+
+  test "re-enqueues while Sophtron refresh job is still running" do
+    provider = mock
+    provider.expects(:get_job_information).with("refresh-job").returns({ LastStatus: "Started" })
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+
+    assert_enqueued_with(job: SophtronRefreshPollJob) do
+      SophtronRefreshPollJob.perform_now(@sophtron_account, job_id: "refresh-job", attempts_remaining: 2)
+    end
+  end
+
+  test "imports transactions and schedules account sync when refresh completes" do
+    provider = mock
+    provider.expects(:get_job_information).with("refresh-job").returns({ LastStatus: "Completed" })
+    SophtronItem.any_instance.stubs(:sophtron_provider).returns(provider)
+    SophtronItem::Importer.any_instance.expects(:import_transactions_after_refresh)
+                           .with(@sophtron_account)
+                           .returns({ success: true, transactions_count: 1 })
+    SophtronAccount::Processor.any_instance.expects(:process).returns({ transactions_imported: 1 })
+
+    assert_enqueued_with(job: SyncJob) do
+      SophtronRefreshPollJob.perform_now(@sophtron_account, job_id: "refresh-job")
+    end
+  end
+end
diff --git a/test/lib/active_record_encryption_config_test.rb b/test/lib/active_record_encryption_config_test.rb
new file mode 100644
index 000000000..825d357d7
--- /dev/null
+++ b/test/lib/active_record_encryption_config_test.rb
@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class ActiveRecordEncryptionConfigTest < ActiveSupport::TestCase
+  test "detects complete encryption environment" do
+    env = {
+      "ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY" => "primary",
+      "ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY" => "deterministic",
+      "ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT" => "salt"
+    }
+
+    assert ActiveRecordEncryptionConfig.complete_env?(env)
+    refute ActiveRecordEncryptionConfig.partial_env?(env)
+    assert_empty ActiveRecordEncryptionConfig.missing_env_keys(env)
+  end
+
+  test "detects partially configured encryption environment" do
+    env = {
+      "ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY" => "primary",
+      "ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY" => nil,
+      "ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT" => "salt"
+    }
+
+    refute ActiveRecordEncryptionConfig.complete_env?(env)
+    assert ActiveRecordEncryptionConfig.partial_env?(env)
+    assert_equal [ "ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY" ], ActiveRecordEncryptionConfig.missing_env_keys(env)
+    assert_includes ActiveRecordEncryptionConfig.partial_env_message(env), "ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY"
+  end
+
+  test "does not treat absent encryption environment as partial" do
+    env = {
+      "ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY" => nil,
+      "ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY" => nil,
+      "ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT" => nil
+    }
+
+    refute ActiveRecordEncryptionConfig.complete_env?(env)
+    refute ActiveRecordEncryptionConfig.partial_env?(env)
+  end
+
+  test "detects runtime encryption configuration" do
+    config = Struct.new(:primary_key, :deterministic_key, :key_derivation_salt).new("primary", "deterministic", "salt")
+
+    assert ActiveRecordEncryptionConfig.runtime_configured?(config)
+  end
+
+  test "explicit configuration excludes runtime generated config" do
+    ActiveRecordEncryptionConfig.stubs(:complete_env?).returns(false)
+    ActiveRecordEncryptionConfig.stubs(:credentials_configured?).returns(false)
+    ActiveRecordEncryptionConfig.stubs(:runtime_configured?).returns(true)
+
+    refute ActiveRecordEncryptionConfig.explicitly_configured?
+    assert ActiveRecordEncryptionConfig.ready?
+  end
+end
diff --git a/test/lib/catalan_pluralization_test.rb b/test/lib/catalan_pluralization_test.rb
new file mode 100644
index 000000000..d9cda5c18
--- /dev/null
+++ b/test/lib/catalan_pluralization_test.rb
@@ -0,0 +1,23 @@
+require "test_helper"
+require "securerandom"
+
+class CatalanPluralizationTest < ActiveSupport::TestCase
+  test "uses rails i18n plural rules for catalan" do
+    translation_key = "test_pluralization_#{SecureRandom.hex(6)}"
+
+    I18n.backend.store_translations(:ca, translation_key => {
+      sample: {
+        one: "one",
+        other: "other"
+      }
+    })
+
+    path = "#{translation_key}.sample"
+
+    assert_equal "other", I18n.t(path, locale: :ca, count: 0)
+    assert_equal "one", I18n.t(path, locale: :ca, count: 1)
+    assert_equal "other", I18n.t(path, locale: :ca, count: 2)
+    assert_equal "other", I18n.t(path, locale: :ca, count: 5)
+    assert_equal "other", I18n.t(path, locale: :ca, count: 100)
+  end
+end
diff --git a/test/lib/money_test.rb b/test/lib/money_test.rb
index 5c18105aa..8232de506 100644
--- a/test/lib/money_test.rb
+++ b/test/lib/money_test.rb
@@ -159,6 +159,15 @@ class MoneyTest < ActiveSupport::TestCase
     assert_equal "TW$1,000.12", Money.new(1000.12, :twd).format(locale: :"zh-TW")
   end
 
+  test "formats correctly for Hungarian locale" do
+    # Hungarian uses space as thousands delimiter, comma as decimal separator, symbol after number
+    # HUF has 0 decimal places (no fillér)
+    assert_equal "1 000 Ft", Money.new(1000, :huf).format(locale: :hu)
+    # Non-HUF currencies keep their own precision
+    assert_equal "1 000,12 $", Money.new(1000.12, :usd).format(locale: :hu)
+    assert_equal "1 000,12 €", Money.new(1000.12, :eur).format(locale: :hu)
+  end
+
   test "all supported locales can format money without errors" do
     # Ensure all supported locales from LanguagesHelper::SUPPORTED_LOCALES work
     supported_locales = LanguagesHelper::SUPPORTED_LOCALES
@@ -180,18 +189,27 @@ class MoneyTest < ActiveSupport::TestCase
     assert_equal Money.new(1000).exchange_to(:eur), Money.new(1000 * 1.2, :eur)
   end
 
-  test "raises when no conversion rate available and no fallback rate provided" do
+  test "raises when no conversion rate available and no fallback provided" do
     ExchangeRate.expects(:find_or_fetch_rate).returns(nil)
 
-    assert_raises Money::ConversionError do
+    assert_raises(Money::ConversionError) do
       Money.new(1000).exchange_to(:jpy)
     end
   end
 
-  test "converts currency with a fallback rate" do
-    ExchangeRate.expects(:find_or_fetch_rate).returns(nil).twice
+  test "uses custom rate when provided" do
+    ExchangeRate.expects(:find_or_fetch_rate).never
 
-    assert_equal 0, Money.new(1000).exchange_to(:jpy, fallback_rate: 0)
-    assert_equal Money.new(1000, :jpy), Money.new(1000, :usd).exchange_to(:jpy, fallback_rate: 1)
+    assert_equal Money.new(1250, :jpy), Money.new(1000, :usd).exchange_to(:jpy, custom_rate: 1.25)
+  end
+
+  test "raises error when custom rate is invalid" do
+  assert_raises(Money::ConversionError) do
+    Money.new(1000).exchange_to(:jpy, custom_rate: 0)
+  end
+
+  assert_raises(Money::ConversionError) do
+    Money.new(1000).exchange_to(:jpy, custom_rate: -1)
   end
 end
+end
diff --git a/test/lib/uuid_format_test.rb b/test/lib/uuid_format_test.rb
new file mode 100644
index 000000000..0d7389b97
--- /dev/null
+++ b/test/lib/uuid_format_test.rb
@@ -0,0 +1,17 @@
+require "test_helper"
+
+class UuidFormatTest < ActiveSupport::TestCase
+  test "valid matches canonical UUID values" do
+    uuid = SecureRandom.uuid
+
+    assert UuidFormat.valid?(uuid)
+    assert UuidFormat.valid?(uuid.upcase)
+  end
+
+  test "valid rejects non UUID values" do
+    refute UuidFormat.valid?(nil)
+    refute UuidFormat.valid?("")
+    refute UuidFormat.valid?("not-a-uuid")
+    refute UuidFormat.valid?("#{SecureRandom.uuid}-extra")
+  end
+end
diff --git a/test/models/account/current_balance_manager_test.rb b/test/models/account/current_balance_manager_test.rb
index 539a4d3c9..b3499718a 100644
--- a/test/models/account/current_balance_manager_test.rb
+++ b/test/models/account/current_balance_manager_test.rb
@@ -208,7 +208,7 @@ class Account::CurrentBalanceManagerTest < ActiveSupport::TestCase
     assert_equal 1000, @linked_account.balance
   end
 
-  test "updates existing anchor for linked account" do
+  test "preserves previous day anchor as reconciliation when updating linked account balance" do
     # First create a current anchor
     manager = Account::CurrentBalanceManager.new(@linked_account)
     result = manager.set_current_balance(1000)
@@ -216,90 +216,67 @@ class Account::CurrentBalanceManagerTest < ActiveSupport::TestCase
 
     current_anchor = @linked_account.valuations.current_anchor.first
     original_id = current_anchor.id
-    original_entry_id = current_anchor.entry.id
 
     # Travel to tomorrow to ensure date change
     travel_to Date.current + 1.day do
       # Now update it
-      assert_no_difference -> { @linked_account.entries.count } do
-        assert_no_difference -> { @linked_account.valuations.count } do
-          result = manager.set_current_balance(2000)
-          assert result.success?
-          assert result.changes_made?
-        end
+      assert_difference -> { @linked_account.entries.count } => 1,
+                       -> { @linked_account.valuations.count } => 1 do
+        result = manager.set_current_balance(2000)
+        assert result.success?
+        assert result.changes_made?
       end
 
-      current_anchor.reload
-      assert_equal original_id, current_anchor.id # Same valuation record
-      assert_equal original_entry_id, current_anchor.entry.id # Same entry record
-      assert_equal 2000, current_anchor.entry.amount
-      assert_equal Date.current, current_anchor.entry.date # Should be updated to current date
+      # The old anchor should now be a reconciliation
+      preserved_valuation = Valuation.find(original_id)
+      assert_equal "reconciliation", preserved_valuation.kind
+      assert_equal 1000, preserved_valuation.entry.amount
+      assert_equal Valuation.build_reconciliation_name(@linked_account.accountable_type), preserved_valuation.entry.name
+      assert_equal Date.yesterday, preserved_valuation.entry.date
+
+      # A new current anchor should exist for today
+      new_anchor = @linked_account.valuations.current_anchor.first
+      assert_not_equal original_id, new_anchor.id
+      assert_equal 2000, new_anchor.entry.amount
+      assert_equal Date.current, new_anchor.entry.date
     end
 
     assert_equal 2000, @linked_account.balance
   end
 
-  test "when no changes made, returns success with no changes made" do
-    # First create a current anchor
+  test "does not preserve same-day anchor as reconciliation" do
     manager = Account::CurrentBalanceManager.new(@linked_account)
+
+    # Create initial anchor
     result = manager.set_current_balance(1000)
     assert result.success?
-    assert result.changes_made?
+
+    current_anchor = @linked_account.valuations.current_anchor.first
+    original_id = current_anchor.id
 
     # Try to set the same value on the same date
-    result = manager.set_current_balance(1000)
-
-    assert result.success?
-    assert_not result.changes_made?
-    assert_nil result.error
-
-    assert_equal 1000, @linked_account.balance
-  end
-
-  test "updates only amount when balance changes" do
-    manager = Account::CurrentBalanceManager.new(@linked_account)
-
-    # Create initial anchor
-    result = manager.set_current_balance(1000)
-    assert result.success?
-
-    current_anchor = @linked_account.valuations.current_anchor.first
-    original_date = current_anchor.entry.date
-
-    # Update only the balance
-    result = manager.set_current_balance(1500)
-    assert result.success?
-    assert result.changes_made?
-
-    current_anchor.reload
-    assert_equal 1500, current_anchor.entry.amount
-    assert_equal original_date, current_anchor.entry.date # Date should remain the same if on same day
-
-    assert_equal 1500, @linked_account.balance
-  end
-
-  test "updates date when called on different day" do
-    manager = Account::CurrentBalanceManager.new(@linked_account)
-
-    # Create initial anchor
-    result = manager.set_current_balance(1000)
-    assert result.success?
-
-    current_anchor = @linked_account.valuations.current_anchor.first
-    original_amount = current_anchor.entry.amount
-
-    # Travel to tomorrow and update with same balance
-    travel_to Date.current + 1.day do
+    assert_no_difference -> { @linked_account.entries.count } do
       result = manager.set_current_balance(1000)
       assert result.success?
-      assert result.changes_made? # Should be true because date changed
-
-      current_anchor.reload
-      assert_equal original_amount, current_anchor.entry.amount
-      assert_equal Date.current, current_anchor.entry.date # Should be updated to new current date
+      assert_not result.changes_made?
     end
 
-    assert_equal 1000, @linked_account.balance
+    # Update with different value on the same day
+    assert_no_difference -> { @linked_account.entries.count } do
+      assert_no_difference -> { @linked_account.valuations.count } do
+        result = manager.set_current_balance(1500)
+        assert result.success?
+        assert result.changes_made?
+      end
+    end
+
+    current_anchor.reload
+    assert_equal original_id, current_anchor.id
+    assert_equal 1500, current_anchor.entry.amount
+    assert_equal "current_anchor", current_anchor.kind
+    assert_equal Date.current, current_anchor.entry.date
+
+    assert_equal 1500, @linked_account.balance
   end
 
   test "current_balance returns balance from current anchor" do
diff --git a/test/models/account/linkable_test.rb b/test/models/account/linkable_test.rb
index a02453c39..560cb5649 100644
--- a/test/models/account/linkable_test.rb
+++ b/test/models/account/linkable_test.rb
@@ -66,4 +66,45 @@ class Account::LinkableTest < ActiveSupport::TestCase
 
     assert @account.can_delete_holdings?
   end
+
+  # The `linked` scope mirrors `linked?` at the SQL level. These tests pin
+  # all three link types so a future schema or `linked?` change breaks the
+  # test instead of silently diverging (e.g. wrong sparkline aggregation).
+  test "linked scope matches accounts linked via account_providers" do
+    plaid_account = plaid_accounts(:one)
+    AccountProvider.create!(account: @account, provider: plaid_account)
+
+    assert_includes Account.linked, @account
+  end
+
+  test "linked scope matches accounts with legacy plaid_account_id" do
+    plaid_account = plaid_accounts(:one)
+    @account.update!(plaid_account: plaid_account)
+
+    assert_includes Account.linked, @account
+  end
+
+  test "linked scope matches accounts with legacy simplefin_account_id" do
+    simplefin_item = SimplefinItem.create!(
+      family: @family,
+      name: "Test SimpleFin",
+      access_url: "https://example.com/access_token"
+    )
+    simplefin_account = SimplefinAccount.create!(
+      simplefin_item: simplefin_item,
+      name: "Test Account",
+      account_id: "test-acct",
+      currency: "USD",
+      account_type: "checking",
+      current_balance: 0
+    )
+    @account.update!(simplefin_account: simplefin_account)
+
+    assert_includes Account.linked, @account
+  end
+
+  test "linked scope excludes manual accounts" do
+    assert @account.unlinked?
+    refute_includes Account.linked, @account
+  end
 end
diff --git a/test/models/account/market_data_importer_test.rb b/test/models/account/market_data_importer_test.rb
index 0b3f7066d..8717c8cdb 100644
--- a/test/models/account/market_data_importer_test.rb
+++ b/test/models/account/market_data_importer_test.rb
@@ -41,6 +41,7 @@ class Account::MarketDataImporterTest < ActiveSupport::TestCase
     expected_start_date = (existing_date + 1.day) - EXCHANGE_RATE_BUFFER
     end_date            = Date.current.in_time_zone("America/New_York").to_date
 
+    # Only the forward pair (CAD→USD) should be fetched; inverse (USD→CAD) is computed automatically
     @provider.expects(:fetch_exchange_rates)
              .with(from: "CAD",
                    to: "USD",
@@ -50,20 +51,15 @@ class Account::MarketDataImporterTest < ActiveSupport::TestCase
                OpenStruct.new(from: "CAD", to: "USD", date: existing_date, rate: 1.5)
              ]))
 
-    @provider.expects(:fetch_exchange_rates)
-             .with(from: "USD",
-                   to: "CAD",
-                   start_date: expected_start_date,
-                   end_date: end_date)
-             .returns(provider_success_response([
-               OpenStruct.new(from: "USD", to: "CAD", date: existing_date, rate: 0.67)
-             ]))
-
     before = ExchangeRate.count
     Account::MarketDataImporter.new(account).import_all
     after  = ExchangeRate.count
 
-    assert_operator after, :>, before + 1, "Should insert at least two new exchange-rate rows"
+    assert_operator after, :>, before + 1, "Should insert at least two new exchange-rate rows (forward + computed inverse)"
+
+    # Verify inverse rates were computed from the forward rates
+    assert ExchangeRate.where(from_currency: "USD", to_currency: "CAD").where("date > ?", existing_date).exists?,
+           "Inverse rates should be computed automatically"
   end
 
   test "syncs security prices for securities traded by the account" do
@@ -116,6 +112,141 @@ class Account::MarketDataImporterTest < ActiveSupport::TestCase
     assert_equal 1, Security::Price.where(security: security, date: trade_date).count
   end
 
+  test "caps end_date at last holding date for securities no longer held" do
+    family = Family.create!(name: "Smith", currency: "USD")
+
+    account = family.accounts.create!(
+      name: "Brokerage",
+      currency: "USD",
+      balance: 0,
+      accountable: Investment.new
+    )
+
+    current_sec    = Security.create!(ticker: "CURR", exchange_operating_mic: "XNAS")
+    historical_sec = Security.create!(ticker: "HIST", exchange_operating_mic: "XNAS")
+
+    trade_date  = 30.days.ago.to_date
+    sold_date   = 5.days.ago.to_date
+
+    [ current_sec, historical_sec ].each do |sec|
+      trade = Trade.new(security: sec, qty: 10, price: 100, currency: "USD", investment_activity_label: "Buy")
+      account.entries.create!(name: "Buy #{sec.ticker}", date: trade_date, amount: 1000, currency: "USD", entryable: trade)
+    end
+
+    # Current: most-recent holding has qty > 0 — shows up in current_holdings
+    account.holdings.create!(security: current_sec, date: Date.current, qty: 10, price: 110, amount: 1100, currency: "USD")
+
+    # Historical: most-recent holding has qty == 0 (sold) — excluded from current_holdings
+    account.holdings.create!(security: historical_sec, date: 10.days.ago.to_date, qty: 10, price: 105, amount: 1050, currency: "USD")
+    account.holdings.create!(security: historical_sec, date: sold_date, qty: 0, price: 0, amount: 0, currency: "USD")
+
+    expected_start_date = trade_date - SECURITY_PRICE_BUFFER
+
+    @provider.expects(:fetch_security_prices)
+             .with(symbol: current_sec.ticker,
+                   exchange_operating_mic: current_sec.exchange_operating_mic,
+                   start_date: expected_start_date,
+                   end_date: Date.current.in_time_zone("America/New_York").to_date)
+             .returns(provider_success_response([]))
+
+    @provider.expects(:fetch_security_prices)
+             .with(symbol: historical_sec.ticker,
+                   exchange_operating_mic: historical_sec.exchange_operating_mic,
+                   start_date: expected_start_date,
+                   end_date: sold_date)
+             .returns(provider_success_response([]))
+
+    @provider.stubs(:fetch_security_info).returns(provider_success_response(OpenStruct.new(name: "Test", logo_url: nil)))
+    @provider.stubs(:fetch_exchange_rates).returns(provider_success_response([]))
+
+    Account::MarketDataImporter.new(account).import_all
+  end
+
+  test "fetches prices through today when a sold security is repurchased before holdings are rematerialized" do
+    family = Family.create!(name: "Smith", currency: "USD")
+
+    account = family.accounts.create!(
+      name: "Brokerage",
+      currency: "USD",
+      balance: 0,
+      accountable: Investment.new
+    )
+
+    security = Security.create!(ticker: "AAPL", exchange_operating_mic: "XNAS")
+
+    original_buy_date = 60.days.ago.to_date
+    sold_date         = 30.days.ago.to_date
+    repurchase_date   = 2.days.ago.to_date
+
+    # Original buy
+    buy_trade = Trade.new(security: security, qty: 10, price: 100, currency: "USD", investment_activity_label: "Buy")
+    account.entries.create!(name: "Buy AAPL", date: original_buy_date, amount: 1000, currency: "USD", entryable: buy_trade)
+
+    # Sell trade
+    sell_trade = Trade.new(security: security, qty: -10, price: 120, currency: "USD", investment_activity_label: "Sell")
+    account.entries.create!(name: "Sell AAPL", date: sold_date, amount: 1200, currency: "USD", entryable: sell_trade)
+
+    # Stale materialized holdings — qty=0 means current_holdings excludes this security
+    account.holdings.create!(security: security, date: sold_date, qty: 0, price: 0, amount: 0, currency: "USD")
+
+    # Repurchase trade added after last materialization — holdings haven't been rematerialized yet
+    repurchase = Trade.new(security: security, qty: 5, price: 130, currency: "USD", investment_activity_label: "Buy")
+    account.entries.create!(name: "Rebuy AAPL", date: repurchase_date, amount: 650, currency: "USD", entryable: repurchase)
+
+    expected_start_date = original_buy_date - SECURITY_PRICE_BUFFER
+
+    # end_date must be Date.current, not sold_date, because the position was reopened
+    @provider.expects(:fetch_security_prices)
+             .with(symbol: security.ticker,
+                   exchange_operating_mic: security.exchange_operating_mic,
+                   start_date: expected_start_date,
+                   end_date: Date.current.in_time_zone("America/New_York").to_date)
+             .returns(provider_success_response([]))
+
+    @provider.stubs(:fetch_security_info).returns(provider_success_response(OpenStruct.new(name: "Apple", logo_url: nil)))
+    @provider.stubs(:fetch_exchange_rates).returns(provider_success_response([]))
+
+    Account::MarketDataImporter.new(account).import_all
+  end
+
+  test "skips price fetching for offline securities" do
+    family = Family.create!(name: "Smith", currency: "USD")
+
+    account = family.accounts.create!(
+      name: "Brokerage",
+      currency: "USD",
+      balance: 0,
+      accountable: Investment.new
+    )
+
+    online_sec  = Security.create!(ticker: "ONLN", exchange_operating_mic: "XNAS")
+    offline_sec = Security.create!(ticker: "OFF",  exchange_operating_mic: "XNAS", offline: true)
+
+    trade_date = 10.days.ago.to_date
+
+    [ online_sec, offline_sec ].each do |sec|
+      trade = Trade.new(security: sec, qty: 1, price: 100, currency: "USD", investment_activity_label: "Buy")
+      account.entries.create!(name: "Buy #{sec.ticker}", date: trade_date, amount: 100, currency: "USD", entryable: trade)
+    end
+
+    @provider.expects(:fetch_security_prices)
+             .with(symbol: "OFF", exchange_operating_mic: anything,
+                   start_date: anything, end_date: anything)
+             .never
+
+    @provider.expects(:fetch_security_prices)
+             .with(symbol: online_sec.ticker,
+                   exchange_operating_mic: online_sec.exchange_operating_mic,
+                   start_date: anything,
+                   end_date: anything)
+             .returns(provider_success_response([]))
+
+    @provider.stubs(:fetch_security_info).returns(provider_success_response(OpenStruct.new(name: "Test", logo_url: nil)))
+    @provider.stubs(:fetch_exchange_rates).returns(provider_success_response([]))
+
+    Account::MarketDataImporter.new(account).import_all
+  end
+
   test "handles provider error response gracefully for security prices" do
     family = Family.create!(name: "Smith", currency: "USD")
 
@@ -237,7 +368,7 @@ class Account::MarketDataImporterTest < ActiveSupport::TestCase
     expected_start_date = (existing_date + 1.day) - EXCHANGE_RATE_BUFFER
     end_date            = Date.current.in_time_zone("America/New_York").to_date
 
-    # Simulate provider returning an error response
+    # Only the forward pair (CAD→USD) should be fetched; inverse is computed automatically
     @provider.expects(:fetch_exchange_rates)
              .with(from: "CAD",
                    to: "USD",
@@ -247,15 +378,6 @@ class Account::MarketDataImporterTest < ActiveSupport::TestCase
                Provider::TwelveData::Error.new("Rate limit exceeded", details: { code: 429, message: "Rate limit exceeded" })
              ))
 
-    @provider.expects(:fetch_exchange_rates)
-             .with(from: "USD",
-                   to: "CAD",
-                   start_date: expected_start_date,
-                   end_date: end_date)
-             .returns(provider_error_response(
-               Provider::TwelveData::Error.new("Rate limit exceeded", details: { code: 429, message: "Rate limit exceeded" })
-             ))
-
     before = ExchangeRate.count
 
     # Should not raise an error, just log and continue
diff --git a/test/models/account/opening_balance_manager_test.rb b/test/models/account/opening_balance_manager_test.rb
index 67becb60a..78411bd00 100644
--- a/test/models/account/opening_balance_manager_test.rb
+++ b/test/models/account/opening_balance_manager_test.rb
@@ -192,6 +192,75 @@ class Account::OpeningBalanceManagerTest < ActiveSupport::TestCase
     assert_equal original_date, opening_anchor.entry.date # Should remain unchanged
   end
 
+  test "when existing anchor date is before later activity, update can preserve anchor date" do
+    manager = Account::OpeningBalanceManager.new(@depository_account)
+    original_date = 4.months.ago.to_date
+
+    result = manager.set_opening_balance(
+      balance: 1000,
+      date: original_date
+    )
+    assert result.success?
+
+    @depository_account.entries.create!(
+      date: 2.months.ago.to_date,
+      name: "Later transaction",
+      amount: 100,
+      currency: "USD",
+      entryable: Transaction.new
+    )
+
+    result = manager.set_opening_balance(
+      balance: 0,
+      date: original_date
+    )
+
+    assert result.success?
+    assert result.changes_made?
+
+    opening_anchor = @depository_account.valuations.opening_anchor.first
+    opening_anchor.reload
+    assert_equal 0, opening_anchor.entry.amount
+    assert_equal original_date, opening_anchor.entry.date
+  end
+
+  test "recomputes oldest entry date when older activity is added after manager initialization" do
+    oldest_date = 60.days.ago.to_date
+    @depository_account.entries.create!(
+      date: oldest_date,
+      name: "Existing transaction",
+      amount: 100,
+      currency: "USD",
+      entryable: Transaction.new
+    )
+
+    manager = Account::OpeningBalanceManager.new(@depository_account)
+
+    result = manager.set_opening_balance(
+      balance: 1000,
+      date: oldest_date - 1.day
+    )
+    assert result.success?
+
+    newly_oldest_date = oldest_date - 2.days
+    @depository_account.entries.create!(
+      date: newly_oldest_date,
+      name: "New older transaction",
+      amount: 50,
+      currency: "USD",
+      entryable: Transaction.new
+    )
+
+    result = manager.set_opening_balance(
+      balance: 1200,
+      date: newly_oldest_date
+    )
+
+    assert_not result.success?
+    assert_not result.changes_made?
+    assert_equal "Opening balance date must be before the oldest entry date", result.error
+  end
+
   test "when date is equal to or greater than account's oldest entry, returns error result" do
     # Create an entry with a specific date
     oldest_date = 60.days.ago.to_date
diff --git a/test/models/account/provider_import_adapter_test.rb b/test/models/account/provider_import_adapter_test.rb
index 2f004632f..a62c30209 100644
--- a/test/models/account/provider_import_adapter_test.rb
+++ b/test/models/account/provider_import_adapter_test.rb
@@ -280,6 +280,25 @@ class Account::ProviderImportAdapterTest < ActiveSupport::TestCase
     end
   end
 
+  test "imports trade with provider exchange rate" do
+    investment_account = accounts(:investment)
+    adapter = Account::ProviderImportAdapter.new(investment_account)
+    security = securities(:aapl)
+
+    entry = adapter.import_trade(
+      security: security,
+      quantity: 5,
+      price: 150.00,
+      amount: 750.00,
+      currency: "USD",
+      date: Date.today,
+      source: "plaid",
+      exchange_rate: 0.91
+    )
+
+    assert_equal 0.91, entry.entryable.exchange_rate
+  end
+
   test "raises error when security is missing for trade import" do
     exception = assert_raises(ArgumentError) do
       @adapter.import_trade(
@@ -489,7 +508,8 @@ class Account::ProviderImportAdapterTest < ActiveSupport::TestCase
         amount: 2000.00,
         currency: "USD",
         date: Date.today,
-        source: "plaid"
+        source: "plaid",
+        exchange_rate: 0.95
       )
 
       assert_equal entry.id, updated_entry.id
@@ -498,11 +518,46 @@ class Account::ProviderImportAdapterTest < ActiveSupport::TestCase
       assert_equal 10, updated_entry.entryable.qty
       assert_equal 200.00, updated_entry.entryable.price
       assert_equal "USD", updated_entry.entryable.currency
+      assert_equal 0.95, updated_entry.entryable.exchange_rate
       # Entry attributes should also be updated
       assert_equal 2000.00, updated_entry.amount
     end
   end
 
+  test "preserves existing exchange rate when reimport omits it" do
+    investment_account = accounts(:investment)
+    adapter = Account::ProviderImportAdapter.new(investment_account)
+    aapl = securities(:aapl)
+
+    entry = adapter.import_trade(
+      external_id: "plaid_trade_exchange_rate_preserved",
+      security: aapl,
+      quantity: 5,
+      price: 150.00,
+      amount: 750.00,
+      currency: "USD",
+      date: Date.today,
+      source: "plaid",
+      exchange_rate: 0.95
+    )
+
+    assert_no_difference "investment_account.entries.count" do
+      updated_entry = adapter.import_trade(
+        external_id: "plaid_trade_exchange_rate_preserved",
+        security: aapl,
+        quantity: 10,
+        price: 200.00,
+        amount: 2000.00,
+        currency: "USD",
+        date: Date.today,
+        source: "plaid"
+      )
+
+      assert_equal entry.id, updated_entry.id
+      assert_equal 0.95, updated_entry.entryable.exchange_rate
+    end
+  end
+
   test "raises error when external_id collision occurs across different entryable types for transaction" do
     investment_account = accounts(:investment)
     adapter = Account::ProviderImportAdapter.new(investment_account)
@@ -826,6 +881,98 @@ class Account::ProviderImportAdapterTest < ActiveSupport::TestCase
     end
   end
 
+  test "clears pending flag, preserves pending date, and records old external_id when claiming pending entry with nil extra" do
+    # Enable Banking booked transactions often have nil extra (no FX, no MCC).
+    # The deep_merge path is skipped, so we must clear the pending flag explicitly.
+    pending_date = Date.today - 2.days
+    pending_entry = @adapter.import_transaction(
+      external_id: "eb_pending_nil_extra",
+      amount: 42.00,
+      currency: "EUR",
+      date: pending_date,
+      name: "Supermarket",
+      source: "enable_banking",
+      extra: { "enable_banking" => { "pending" => true } }
+    )
+
+    assert pending_entry.transaction.pending?, "should be pending before claim"
+
+    assert_no_difference "@account.entries.count" do
+      posted_entry = @adapter.import_transaction(
+        external_id: "eb_booked_nil_extra",
+        amount: 42.00,
+        currency: "EUR",
+        date: Date.today,   # booked date is later than pending date
+        name: "Supermarket Posted",
+        source: "enable_banking",
+        extra: nil  # typical for simple Enable Banking booked transactions
+      )
+
+      assert_equal pending_entry.id, posted_entry.id, "should claim the pending entry"
+      assert_equal "eb_booked_nil_extra", posted_entry.external_id
+
+      posted_entry.reload
+
+      # Pending flag must be cleared so the entry no longer shows a pending badge
+      assert_not posted_entry.transaction.pending?, "pending flag should be cleared after claim"
+
+      # Date must be the original pending date, not the later booked date
+      assert_equal pending_date, posted_entry.date, "pending date should be preserved, not overwritten with booked date"
+
+      # Old pending external_id must be stored so the sync engine can skip re-importing it
+      claimed_ids = posted_entry.transaction.extra&.dig("auto_claimed_pending_ids") || []
+      assert_includes claimed_ids, "eb_pending_nil_extra",
+        "auto_claimed_pending_ids should record the old pending external_id"
+    end
+  end
+
+  test "preserves pending date on subsequent syncs after auto-claim" do
+    # On the first sync the pending date is captured from the pending match.
+    # On subsequent syncs the entry already exists (found by booked external_id),
+    # so pending_match is nil. auto_claimed_pending_ids signals the prior claim
+    # and the stored date must not be overwritten with the booked date.
+    pending_date = Date.today - 3.days
+    booked_date  = Date.today
+
+    @adapter.import_transaction(
+      external_id: "eb_pending_subseq",
+      amount: 75.00,
+      currency: "EUR",
+      date: pending_date,
+      name: "Coffee Shop",
+      source: "enable_banking",
+      extra: { "enable_banking" => { "pending" => true } }
+    )
+
+    # First sync: claim the pending entry
+    @adapter.import_transaction(
+      external_id: "eb_booked_subseq",
+      amount: 75.00,
+      currency: "EUR",
+      date: booked_date,
+      name: "Coffee Shop Posted",
+      source: "enable_banking",
+      extra: nil
+    )
+
+    # Simulate a subsequent sync: same booked transaction arrives again
+    assert_no_difference "@account.entries.count" do
+      re_synced = @adapter.import_transaction(
+        external_id: "eb_booked_subseq",
+        amount: 75.00,
+        currency: "EUR",
+        date: booked_date,
+        name: "Coffee Shop Posted",
+        source: "enable_banking",
+        extra: nil
+      )
+
+      re_synced.reload
+      assert_equal pending_date, re_synced.date,
+        "pending date must be preserved on subsequent syncs, not overwritten with booked date"
+    end
+  end
+
   test "does not reconcile when posted transaction has same external_id as pending" do
     # When external_id matches, normal dedup should handle it
     pending_entry = @adapter.import_transaction(
diff --git a/test/models/account/syncer_test.rb b/test/models/account/syncer_test.rb
new file mode 100644
index 000000000..6eeaec117
--- /dev/null
+++ b/test/models/account/syncer_test.rb
@@ -0,0 +1,31 @@
+require "test_helper"
+require "ostruct"
+
+class Account::SyncerTest < ActiveSupport::TestCase
+  test "applies IBKR historical balance overrides after materialization" do
+    family = families(:empty)
+    account = family.accounts.create!(
+      name: "IBKR Brokerage",
+      balance: 0,
+      cash_balance: 0,
+      currency: "CHF",
+      accountable: Investment.new(subtype: "brokerage")
+    )
+    ibkr_account = family.ibkr_items.create!(
+      name: "IBKR",
+      query_id: "QUERY123",
+      token: "TOKEN123"
+    ).ibkr_accounts.create!(
+      name: "Main",
+      ibkr_account_id: "U1234567",
+      currency: "CHF"
+    )
+    ibkr_account.ensure_account_provider!(account)
+
+    Account::MarketDataImporter.any_instance.expects(:import_all).once
+    Balance::Materializer.any_instance.expects(:materialize_balances).once
+    IbkrAccount::HistoricalBalancesSync.any_instance.expects(:sync!).once
+
+    Account::Syncer.new(account).perform_sync(OpenStruct.new(window_start_date: nil))
+  end
+end
diff --git a/test/models/account_ibkr_creation_test.rb b/test/models/account_ibkr_creation_test.rb
new file mode 100644
index 000000000..2ab8f6fcf
--- /dev/null
+++ b/test/models/account_ibkr_creation_test.rb
@@ -0,0 +1,30 @@
+require "test_helper"
+
+class AccountIbkrCreationTest < ActiveSupport::TestCase
+  fixtures :families, :ibkr_items, :ibkr_accounts
+
+  test "uses interactive brokers account id as part of the default name" do
+    ibkr_account = ibkr_accounts(:main_account)
+
+    account = Account.create_from_ibkr_account(ibkr_account)
+
+    assert_equal "Interactive Brokers (U1234567)", account.name
+    assert_equal "Investment", account.accountable_type
+    assert_equal "CHF", account.currency
+  end
+
+  test "falls back to provider name when ibkr account id is missing" do
+    family = families(:empty)
+    ibkr_item = ibkr_items(:empty_item)
+    ibkr_account = ibkr_item.ibkr_accounts.create!(
+      name: "Imported IBKR Account",
+      ibkr_account_id: nil,
+      currency: "USD"
+    )
+
+    account = Account.create_from_ibkr_account(ibkr_account)
+
+    assert_equal "Interactive Brokers", account.name
+    assert_equal family, account.family
+  end
+end
diff --git a/test/models/account_import_test.rb b/test/models/account_import_test.rb
index d433cab8f..c41148407 100644
--- a/test/models/account_import_test.rb
+++ b/test/models/account_import_test.rb
@@ -7,6 +7,38 @@ class AccountImportTest < ActiveSupport::TestCase
     @subject = @import = imports(:account)
   end
 
+  test "csv_template uses ISO dates" do
+    first_row = @import.csv_template.first
+
+    assert_equal "2024-01-01", first_row["Balance Date"]
+  end
+
+  test "generates rows from legacy account export headers with template labels" do
+    import_csv = <<~CSV
+      id,name,type,subtype,balance,currency,created_at
+      account-1,Main Checking,Depository,checking,1000.00,USD,2024-01-01T00:00:00Z
+    CSV
+
+    @import.update!(
+      raw_file_str: import_csv,
+      entity_type_col_label: "Account type*",
+      name_col_label: "Name*",
+      amount_col_label: "Balance*",
+      currency_col_label: "Currency",
+      date_col_label: "Balance Date",
+      date_format: "%Y-%m-%d"
+    )
+
+    @import.generate_rows_from_csv
+    row = @import.rows.reload.first
+
+    assert row.valid?
+    assert_equal "Depository", row.entity_type
+    assert_equal "Main Checking", row.name
+    assert_equal "1000.00", row.amount
+    assert row.date.blank?
+  end
+
   test "import creates accounts with valuations" do
     import_csv = <<~CSV
       type,name,amount,currency
@@ -164,6 +196,7 @@ class AccountImportTest < ActiveSupport::TestCase
 
   test "dry_run returns expected counts" do
     @import.rows.create!(
+      source_row_number: 1,
       entity_type: "depository",
       name: "Test Account",
       amount: "1000.00",
diff --git a/test/models/account_statement_test.rb b/test/models/account_statement_test.rb
new file mode 100644
index 000000000..a2829a0c9
--- /dev/null
+++ b/test/models/account_statement_test.rb
@@ -0,0 +1,770 @@
+require "test_helper"
+
+class AccountStatementTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @account = accounts(:depository)
+  end
+
+  OversizedDeclaredUpload = Struct.new(:original_filename, keyword_init: true) do
+    def size
+      AccountStatement::MAX_FILE_SIZE + 1
+    end
+
+    def read(*)
+      raise "oversized upload should be rejected before reading"
+    end
+  end
+
+  class UploadWithoutDeclaredSize
+    attr_reader :original_filename, :content_type
+
+    def initialize(filename:, content_type:, content:)
+      @original_filename = filename
+      @content_type = content_type
+      @io = StringIO.new(content)
+    end
+
+    def read(length)
+      @io.read(length)
+    end
+
+    def rewind
+      @io.rewind
+    end
+  end
+
+  test "creates linked statement from upload without importing transactions" do
+    assert_no_difference [ "Import.count", "Entry.count", "Transaction.count" ] do
+      statement = AccountStatement.create_from_upload!(
+        family: @family,
+        account: @account,
+        file: uploaded_file(
+          filename: "Chase_2024-01_account_6789.csv",
+          content_type: "text/csv",
+          content: "date,description,amount\n2024-01-01,Coffee,-5.00\n2024-01-31,Deposit,100.00\n"
+        )
+      )
+
+      assert statement.linked?
+      assert_equal @account, statement.account
+      assert_equal Date.new(2024, 1, 1), statement.period_start_on
+      assert_equal Date.new(2024, 1, 31), statement.period_end_on
+      assert_equal "USD", statement.currency
+      assert_equal Digest::SHA256.hexdigest("date,description,amount\n2024-01-01,Coffee,-5.00\n2024-01-31,Deposit,100.00\n"), statement.content_sha256
+      assert statement.original_file.attached?
+    end
+  end
+
+  test "suggests obvious account match without linking inbox upload" do
+    @account.update!(institution_name: "Chase Bank 6789", notes: "Private note")
+
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: nil,
+      file: uploaded_file(
+        filename: "Chase_Bank_2024-01_account_6789.pdf",
+        content_type: "application/pdf",
+        content: "%PDF-1.4 statement"
+      )
+    )
+
+    assert statement.unmatched?
+    assert_nil statement.account
+    assert_equal @account, statement.suggested_account
+    assert_operator statement.match_confidence, :>=, 0.7
+  end
+
+  test "rejects duplicate sha256 within family" do
+    file_content = "date,description,amount\n2024-01-01,Coffee,-5.00\n"
+    AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: file_content)
+    )
+
+    error = assert_raises(AccountStatement::DuplicateUploadError) do
+      AccountStatement.create_from_upload!(
+        family: @family,
+        account: @account,
+        file: uploaded_file(filename: "statement-copy.csv", content_type: "text/csv", content: file_content)
+      )
+    end
+
+    assert_equal "statement.csv", error.statement.filename
+  end
+
+  test "allows distinct files with same md5 checksum and different sha256" do
+    Digest::MD5.stubs(:base64digest).returns("same-md5-checksum")
+
+    assert_difference "AccountStatement.count", 2 do
+      AccountStatement.create_from_upload!(
+        family: @family,
+        account: @account,
+        file: uploaded_file(filename: "statement-a.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+      )
+
+      AccountStatement.create_from_upload!(
+        family: @family,
+        account: @account,
+        file: uploaded_file(filename: "statement-b.csv", content_type: "text/csv", content: "date,amount\n2024-01-02,2\n")
+      )
+    end
+  end
+
+  test "uses md5 checksum fallback for legacy statements without sha256" do
+    Digest::MD5.stubs(:base64digest).returns("legacy-md5-checksum")
+    existing = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(filename: "legacy.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    existing.update_columns(content_sha256: nil)
+
+    error = assert_raises(AccountStatement::DuplicateUploadError) do
+      AccountStatement.create_from_upload!(
+        family: @family,
+        account: @account,
+        file: uploaded_file(filename: "legacy-copy.csv", content_type: "text/csv", content: "date,amount\n2024-01-02,2\n")
+      )
+    end
+
+    assert_equal existing, error.statement
+  end
+
+  test "reports duplicate upload after database uniqueness race" do
+    file_content = "date,description,amount\n2024-01-01,Coffee,-5.00\n"
+    existing = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: file_content)
+    )
+    prepared_upload = AccountStatement.prepare_upload!(
+      uploaded_file(filename: "statement-copy.csv", content_type: "text/csv", content: file_content)
+    )
+
+    AccountStatement.stubs(:duplicate_for).returns(nil, existing)
+    AccountStatement.any_instance.stubs(:save!).raises(ActiveRecord::RecordNotUnique.new("duplicate"))
+
+    error = assert_raises(AccountStatement::DuplicateUploadError) do
+      AccountStatement.create_from_prepared_upload!(
+        family: @family,
+        account: @account,
+        prepared_upload: prepared_upload
+      )
+    end
+
+    assert_equal existing, error.statement
+  end
+
+  test "purges staged blob when database uniqueness race is re-raised" do
+    prepared_upload = AccountStatement.prepare_upload!(
+      uploaded_file(filename: "statement-copy.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+
+    AccountStatement.stubs(:duplicate_for).returns(nil)
+    AccountStatement.any_instance.stubs(:save!).raises(ActiveRecord::RecordNotUnique.new("duplicate"))
+
+    assert_no_difference [ "ActiveStorage::Blob.count", "ActiveStorage::Attachment.count" ] do
+      assert_raises(ActiveRecord::RecordNotUnique) do
+        AccountStatement.create_from_prepared_upload!(
+          family: @family,
+          account: @account,
+          prepared_upload: prepared_upload
+        )
+      end
+    end
+  end
+
+  test "purges staged blob when metadata detection fails after attach" do
+    AccountStatement::MetadataDetector.any_instance.stubs(:apply).raises(StandardError, "parser failed")
+
+    assert_no_difference [ "ActiveStorage::Blob.count", "ActiveStorage::Attachment.count" ] do
+      assert_raises(StandardError) do
+        AccountStatement.create_from_upload!(
+          family: @family,
+          account: @account,
+          file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+        )
+      end
+    end
+  end
+
+  test "with_account scope keeps account linkage semantics while enum predicate follows review status" do
+    linked_statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(filename: "linked.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    accountless_statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: nil,
+      file: uploaded_file(filename: "accountless.csv", content_type: "text/csv", content: "date,amount\n2024-01-02,2\n")
+    )
+    accountless_statement.update_columns(review_status: "linked")
+
+    assert accountless_statement.reload.linked?
+    assert_includes @family.account_statements.with_account, linked_statement
+    assert_not_includes @family.account_statements.with_account, accountless_statement
+    assert_not_includes @family.account_statements.unmatched, accountless_statement
+  end
+
+  test "allows same checksum in different families" do
+    file_content = "date,description,amount\n2024-01-01,Coffee,-5.00\n"
+
+    assert_difference "AccountStatement.count", 2 do
+      AccountStatement.create_from_upload!(
+        family: @family,
+        account: @account,
+        file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: file_content)
+      )
+
+      AccountStatement.create_from_upload!(
+        family: families(:empty),
+        account: nil,
+        file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: file_content)
+      )
+    end
+  end
+
+  test "validates linked account family" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+
+    statement.account = Account.create!(
+      family: families(:empty),
+      owner: users(:empty),
+      name: "Other family account",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+
+    assert_not statement.valid?
+    assert_includes statement.errors[:account], "is invalid"
+  end
+
+  test "validates statement currency codes" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+
+    statement.currency = "NOPE"
+
+    assert_not statement.valid?
+    assert_includes statement.errors[:currency], "is invalid"
+  end
+
+  test "rejects unsupported file extension even when mime type is broadly allowed" do
+    assert_raises(AccountStatement::InvalidUploadError) do
+      AccountStatement.create_from_upload!(
+        family: @family,
+        account: @account,
+        file: uploaded_file(filename: "statement.txt", content_type: "text/plain", content: "date,amount\n2024-01-01,1\n")
+      )
+    end
+
+    assert_raises(AccountStatement::InvalidUploadError) do
+      AccountStatement.create_from_upload!(
+        family: @family,
+        account: @account,
+        file: uploaded_file(filename: "statement.xls", content_type: "application/vnd.ms-excel", content: "date,amount\n2024-01-01,1\n")
+      )
+    end
+  end
+
+  test "rejects empty csv and xlsx statement uploads" do
+    [
+      uploaded_file(filename: "empty.csv", content_type: "text/csv", content: ""),
+      uploaded_file(
+        filename: "empty.xlsx",
+        content_type: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+        content: ""
+      )
+    ].each do |file|
+      assert_no_difference "AccountStatement.count" do
+        assert_raises(AccountStatement::InvalidUploadError) do
+          AccountStatement.create_from_upload!(family: @family, account: @account, file: file)
+        end
+      end
+    end
+  end
+
+  test "rejects declared oversized upload before reading content" do
+    assert_raises(AccountStatement::InvalidUploadError) do
+      AccountStatement.prepare_upload!(OversizedDeclaredUpload.new(original_filename: "oversized.csv"))
+    end
+  end
+
+  test "streams unknown-size uploads and rejects when content exceeds size limit" do
+    file = UploadWithoutDeclaredSize.new(
+      filename: "oversized.csv",
+      content_type: "text/csv",
+      content: "x" * (AccountStatement::MAX_FILE_SIZE + 1)
+    )
+
+    assert_raises(AccountStatement::InvalidUploadError) do
+      AccountStatement.prepare_upload!(file)
+    end
+  end
+
+  test "stores sanitized csv parser output without raw rows" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(
+        filename: "Checking_2024-01.csv",
+        content_type: "text/csv",
+        content: "posted_at,description,amount\n2024-01-01,Coffee Shop,-5.00\n2024-01-31,Payroll,100.00\n"
+      )
+    )
+
+    assert_equal Date.new(2024, 1, 1), statement.period_start_on
+    assert_equal Date.new(2024, 1, 31), statement.period_end_on
+    assert_equal "posted_at", statement.sanitized_parser_output.dig("csv", "date_header")
+    assert_equal 2, statement.sanitized_parser_output.dig("csv", "rows_sampled")
+    assert_not_includes statement.sanitized_parser_output.to_json, "Coffee Shop"
+    assert_not_includes statement.sanitized_parser_output.to_json, "Payroll"
+  end
+
+  test "detects filename dates separated by underscores" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(
+        filename: "statement_2024_01_31.csv",
+        content_type: "text/csv",
+        content: "description,amount\nCoffee,-5.00\n"
+      )
+    )
+
+    assert_equal Date.new(2024, 1, 1), statement.period_start_on
+    assert_equal Date.new(2024, 1, 31), statement.period_end_on
+  end
+
+  test "ignores unreasonable filename dates" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(
+        filename: "statement_1969_01_31.csv",
+        content_type: "text/csv",
+        content: "description,amount\nCoffee,-5.00\n"
+      )
+    )
+
+    assert_nil statement.period_start_on
+    assert_nil statement.period_end_on
+  end
+
+  test "samples csv metadata without parsing raw rows into sanitized output" do
+    rows = 300.times.map { |index| "2024-01-#{(index % 28) + 1},Row #{index}" }.join("\n")
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(
+        filename: "Checking_2024-01.csv",
+        content_type: "text/csv",
+        content: "posted_at,description\n#{rows}\n"
+      )
+    )
+
+    assert_equal 250, statement.sanitized_parser_output.dig("csv", "rows_sampled")
+    assert_not_includes statement.sanitized_parser_output.to_json, "Row 299"
+  end
+
+  test "bounds csv metadata detection column count" do
+    headers = [ "posted_at", *101.times.map { |index| "column_#{index}" } ].join(",")
+    values = [ "2024-01-01", *101.times.map { "value" } ].join(",")
+
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(
+        filename: "Checking.csv",
+        content_type: "text/csv",
+        content: "#{headers}\n#{values}\n"
+      )
+    )
+
+    assert_nil statement.sanitized_parser_output["csv"]
+  end
+
+  test "bounds csv metadata detection sample length" do
+    oversized_date = "2024-01-01" + ("x" * AccountStatement::MetadataDetector::MAX_CSV_SAMPLE_BYTES)
+
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(
+        filename: "Checking.csv",
+        content_type: "text/csv",
+        content: "posted_at,description\n#{oversized_date},oversized\n"
+      )
+    )
+
+    assert_nil statement.sanitized_parser_output["csv"]
+    assert_not_includes statement.sanitized_parser_output.to_json, oversized_date
+  end
+
+  test "preserves sanitized pdf metadata output" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: nil,
+      file: uploaded_file(
+        filename: "Statement.pdf",
+        content_type: "application/pdf",
+        content: "%PDF-1.4 statement"
+      )
+    )
+
+    assert_equal "filename_only", statement.sanitized_parser_output["pdf_detection"]
+    assert_empty statement.sanitized_parser_output["metadata_sources"]
+    assert_nil statement.institution_name_hint
+    assert_nil statement.account_name_hint
+    assert_equal 0.1.to_d, statement.parser_confidence
+  end
+
+  test "stores an actual pdf document fixture as a statement" do
+    fixture_path = file_fixture("imports/sample_bank_statement.pdf")
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: Rack::Test::UploadedFile.new(
+        fixture_path,
+        "application/pdf",
+        true,
+        original_filename: "sample_bank_statement_2024-01.pdf"
+      )
+    )
+
+    assert statement.linked?
+    assert statement.original_file.attached?
+    assert_equal "application/pdf", statement.content_type
+    assert_equal fixture_path.size, statement.byte_size
+    assert_equal Digest::SHA256.file(fixture_path).hexdigest, statement.content_sha256
+    assert_equal "filename_only", statement.sanitized_parser_output["pdf_detection"]
+    assert_equal [ "filename" ], statement.sanitized_parser_output["metadata_sources"]
+    assert_equal Date.new(2024, 1, 1), statement.period_start_on
+    assert_equal Date.new(2024, 1, 31), statement.period_end_on
+    assert statement.original_file.blob.download.start_with?("%PDF-")
+  end
+
+  test "handles malformed csv metadata detection without raw parser output" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: nil,
+      file: uploaded_file(
+        filename: "Unknown 2024-02.csv",
+        content_type: "text/csv",
+        content: "date,description\n\"unterminated"
+      )
+    )
+
+    assert_equal Date.new(2024, 2, 1), statement.period_start_on
+    assert_equal Date.new(2024, 2, 29), statement.period_end_on
+    assert_nil statement.sanitized_parser_output["csv"]
+    assert_not_includes statement.sanitized_parser_output.to_json, "unterminated"
+  end
+
+  test "reports reconciliation unavailable when balances are missing" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    statement.update!(
+      period_start_on: Date.new(2024, 1, 1),
+      period_end_on: Date.new(2024, 1, 31),
+      closing_balance: 100
+    )
+
+    assert_empty statement.reconciliation_checks
+    assert_equal "unavailable", statement.reconciliation_status
+  end
+
+  test "coverage requires account" do
+    error = assert_raises(ArgumentError) do
+      AccountStatement::Coverage.new(nil)
+    end
+    assert_match(/account is required/, error.message)
+  end
+
+  test "database constraints reject invalid persisted status values" do
+    attrs = {
+      family_id: @family.id,
+      filename: "statement.csv",
+      content_type: "text/csv",
+      byte_size: 1,
+      checksum: SecureRandom.base64(16),
+      source: "provider_sync",
+      upload_status: "stored",
+      review_status: "unmatched"
+    }
+
+    assert_raises(ActiveRecord::StatementInvalid) do
+      AccountStatement.transaction(requires_new: true) do
+        AccountStatement.insert_all!([ attrs ], record_timestamps: true)
+      end
+    end
+  end
+
+  test "database constraints reject empty persisted statement byte sizes" do
+    attrs = {
+      family_id: @family.id,
+      filename: "empty.csv",
+      content_type: "text/csv",
+      byte_size: 0,
+      checksum: SecureRandom.base64(16),
+      source: "manual_upload",
+      upload_status: "stored",
+      review_status: "unmatched"
+    }
+
+    assert_raises(ActiveRecord::StatementInvalid) do
+      AccountStatement.transaction(requires_new: true) do
+        AccountStatement.insert_all!([ attrs ], record_timestamps: true)
+      end
+    end
+  end
+
+  test "moves linked statements to inbox when account is deleted" do
+    account = Account.create!(
+      family: @family,
+      owner: users(:family_admin),
+      name: "Temporary Checking",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+
+    account.destroy!
+
+    statement.reload
+    assert_nil statement.account
+    assert statement.unmatched?
+    assert_includes @family.account_statements.unmatched, statement
+  end
+
+  test "unlink clears invalid recomputed suggestion" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    other_account = Account.create!(
+      family: families(:empty),
+      owner: users(:empty),
+      name: "Other family account",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+    invalid_match = AccountStatement::AccountMatcher::Match.new(account: other_account, confidence: 0.9)
+    AccountStatement::AccountMatcher.any_instance.stubs(:best_match).returns(invalid_match)
+
+    statement.unlink!
+
+    statement.reload
+    assert_nil statement.account
+    assert_nil statement.suggested_account
+    assert_nil statement.match_confidence
+    assert statement.unmatched?
+  end
+
+  test "preserves explicit rejected review status" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+
+    statement.reject_match!
+
+    assert statement.rejected?
+    assert_equal @account, statement.account
+  end
+
+  test "preserves rejected review status across unrelated saves" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    statement.reject_match!
+
+    statement.update!(period_start_on: Date.new(2024, 1, 1))
+
+    assert statement.rejected?
+    assert_equal @account, statement.account
+  end
+
+  test "allows intentional review status changes away from rejected" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    statement.reject_match!
+
+    statement.link_to_account!(@account)
+
+    assert statement.linked?
+    assert_equal @account, statement.account
+  end
+
+  test "normalizes account last four hint when matching accounts" do
+    @account.update!(institution_name: "Acme Bank ABCD", notes: "Private note")
+
+    statement = AccountStatement.new(
+      family: @family,
+      institution_name_hint: "Acme",
+      account_last4_hint: "ABCD",
+      currency: @account.currency
+    )
+
+    match = AccountStatement::AccountMatcher.new(statement).best_match
+
+    assert_equal @account, match.account
+    assert_operator match.confidence, :>=, 0.75.to_d
+  end
+
+  test "does not match account last four hints from account notes" do
+    @account.update!(institution_name: "Acme Bank", notes: "Masked statement suffix abcd")
+
+    statement = AccountStatement.new(
+      family: @family,
+      account_last4_hint: "ABCD",
+      currency: @account.currency
+    )
+
+    assert_nil AccountStatement::AccountMatcher.new(statement).best_match
+  end
+
+  test "coverage year selection spans historical account data through last completed month" do
+    account = Account.create!(
+      family: @family,
+      owner: users(:family_admin),
+      name: "Historical Checking",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+
+    travel_to Date.new(2026, 5, 6) do
+      create_statement(account: account, month: Date.new(2024, 2, 1), content: "historical")
+
+      current_year_coverage = AccountStatement::Coverage.for_year(account, nil)
+      historical_coverage = AccountStatement::Coverage.for_year(account, 2024)
+
+      assert_equal 2026, current_year_coverage.selected_year
+      assert_equal [ 2026, 2025, 2024 ], current_year_coverage.available_years
+
+      historical_statuses = historical_coverage.months.index_by(&:date).transform_values(&:status)
+      assert_equal "not_expected", historical_statuses[Date.new(2024, 1, 1)]
+      assert_equal "covered", historical_statuses[Date.new(2024, 2, 1)]
+      assert_equal "missing", historical_statuses[Date.new(2024, 3, 1)]
+
+      current_statuses = current_year_coverage.months.index_by(&:date).transform_values(&:status)
+      assert_equal "missing", current_statuses[Date.new(2026, 4, 1)]
+      assert_equal "not_expected", current_statuses[Date.new(2026, 5, 1)]
+    end
+  end
+
+  test "coverage start can come from balances entries and suggested statements" do
+    account = Account.create!(
+      family: @family,
+      owner: users(:family_admin),
+      name: "Archive Checking",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+
+    account.entries.create!(
+      name: "Old transaction",
+      date: Date.new(2021, 6, 15),
+      amount: 10,
+      currency: "USD",
+      entryable: Transaction.new
+    )
+    account.balances.create!(date: Date.new(2020, 3, 31), balance: 100, currency: "USD")
+    create_statement(account: nil, suggested_account: account, month: Date.new(2019, 7, 1), content: "suggested")
+
+    travel_to Date.new(2026, 5, 6) do
+      coverage = AccountStatement::Coverage.for_year(account, 2019)
+      statuses = coverage.months.index_by(&:date).transform_values(&:status)
+
+      assert_equal [ 2026, 2025, 2024, 2023, 2022, 2021, 2020, 2019 ], coverage.available_years
+      assert_equal "not_expected", statuses[Date.new(2019, 6, 1)]
+      assert_equal "ambiguous", statuses[Date.new(2019, 7, 1)]
+    end
+  end
+
+  test "coverage marks covered duplicate ambiguous and mismatched months" do
+    covered_month = 5.months.ago.to_date.beginning_of_month
+    missing_month = 4.months.ago.to_date.beginning_of_month
+    duplicate_month = 3.months.ago.to_date.beginning_of_month
+    ambiguous_month = 2.months.ago.to_date.beginning_of_month
+    mismatched_month = 1.month.ago.to_date.beginning_of_month
+
+    create_statement(account: @account, month: covered_month, content: "covered")
+    create_statement(account: @account, month: duplicate_month, content: "duplicate-a")
+    create_statement(account: @account, month: duplicate_month, content: "duplicate-b")
+    create_statement(account: nil, suggested_account: @account, month: ambiguous_month, content: "ambiguous")
+    create_statement(account: @account, month: mismatched_month, content: "mismatched", closing_balance: 120)
+
+    @account.balances.create!(
+      date: mismatched_month.end_of_month,
+      balance: 100,
+      currency: "USD",
+      start_cash_balance: 100,
+      cash_inflows: 0,
+      cash_outflows: 0
+    )
+
+    coverage = AccountStatement::Coverage.new(
+      @account,
+      start_month: covered_month,
+      end_month: mismatched_month
+    )
+
+    statuses = coverage.months.index_by(&:date).transform_values(&:status)
+    assert_equal "covered", statuses[covered_month]
+    assert_equal "missing", statuses[missing_month]
+    assert_equal "duplicate", statuses[duplicate_month]
+    assert_equal "ambiguous", statuses[ambiguous_month]
+    assert_equal "mismatched", statuses[mismatched_month]
+  end
+
+  private
+
+    def create_statement(account:, month:, content:, suggested_account: nil, closing_balance: nil)
+      statement = AccountStatement.create_from_upload!(
+        family: @family,
+        account: account,
+        file: uploaded_file(
+          filename: "statement_#{content}_#{month.strftime('%Y-%m')}.csv",
+          content_type: "text/csv",
+          content: "date,amount\n#{month},1\n#{month.end_of_month},2\n#{content}\n"
+        )
+      )
+      statement.update!(
+        suggested_account: suggested_account,
+        period_start_on: month,
+        period_end_on: month.end_of_month,
+        closing_balance: closing_balance
+      )
+      statement
+    end
+end
diff --git a/test/models/account_test.rb b/test/models/account_test.rb
index 48bfbb6c3..6b1507159 100644
--- a/test/models/account_test.rb
+++ b/test/models/account_test.rb
@@ -99,6 +99,13 @@ class AccountTest < ActiveSupport::TestCase
     assert_equal opening_date, opening_anchor.entry.date
   end
 
+  test "accountable display names expose singular and group contexts" do
+    assert_equal "Investment", Investment.singular_display_name
+    assert_equal "Investments", Investment.display_name
+    assert_equal "Cash", Depository.singular_display_name
+    assert_equal "Cash", Depository.display_name
+  end
+
   test "gets short/long subtype label" do
     investment = Investment.new(subtype: "hsa")
     account = @family.accounts.create!(
@@ -205,6 +212,42 @@ class AccountTest < ActiveSupport::TestCase
     assert_not ActiveStorage::Attachment.exists?(attachment_id)
   end
 
+  test "destroying account moves linked statements to inbox after commit" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    statement.update!(match_confidence: 0.8)
+
+    @account.destroy!
+
+    statement.reload
+    assert_nil statement.account_id
+    assert_equal "unmatched", statement.review_status
+    assert_nil statement.match_confidence
+  end
+
+  test "rolled back account destroy keeps linked statements unchanged" do
+    statement = AccountStatement.create_from_upload!(
+      family: @family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    statement.update!(match_confidence: 0.8)
+
+    Account.transaction do
+      @account.destroy!
+      raise ActiveRecord::Rollback
+    end
+
+    statement.reload
+    assert Account.exists?(@account.id)
+    assert_equal @account.id, statement.account_id
+    assert_equal "linked", statement.review_status
+    assert_equal 0.8.to_d, statement.match_confidence
+  end
+
   # Account sharing tests
 
   test "owned_by? returns true for account owner" do
@@ -288,4 +331,55 @@ class AccountTest < ActiveSupport::TestCase
     assert_equal "read_write", share.permission
     assert share.include_in_finances?
   end
+
+  test "current_holdings prefers latest provider snapshot holdings across currencies" do
+    account = @family.accounts.create!(
+      owner: @admin,
+      name: "Linked Brokerage",
+      balance: 1000,
+      currency: "USD",
+      accountable: Investment.new
+    )
+
+    coinstats_item = @family.coinstats_items.create!(name: "CoinStats", api_key: "test-key")
+    coinstats_account = coinstats_item.coinstats_accounts.create!(name: "Brokerage", currency: "USD")
+    account_provider = AccountProvider.create!(account: account, provider: coinstats_account)
+
+    eur_security = Security.create!(ticker: "ASML", name: "ASML")
+    chf_security = Security.create!(ticker: "NOVN", name: "Novartis")
+
+    provider_holding = account.holdings.create!(
+      security: eur_security,
+      date: Date.current,
+      qty: 2,
+      price: 500,
+      amount: 1000,
+      currency: "EUR",
+      account_provider: account_provider,
+      cost_basis: 450
+    )
+
+    account.holdings.create!(
+      security: eur_security,
+      date: Date.current,
+      qty: 2,
+      price: 540,
+      amount: 1080,
+      currency: "USD"
+    )
+
+    second_provider_holding = account.holdings.create!(
+      security: chf_security,
+      date: Date.current,
+      qty: 3,
+      price: 90,
+      amount: 270,
+      currency: "CHF",
+      account_provider: account_provider,
+      cost_basis: 80
+    )
+
+    assert_equal [ provider_holding.id, second_provider_holding.id ].sort, account.current_holdings.pluck(:id).sort
+    assert_equal %w[CHF EUR], account.current_holdings.pluck(:currency).sort
+  end
 end
diff --git a/test/models/actual_import_test.rb b/test/models/actual_import_test.rb
new file mode 100644
index 000000000..7cc0b3470
--- /dev/null
+++ b/test/models/actual_import_test.rb
@@ -0,0 +1,53 @@
+require "test_helper"
+
+class ActualImportTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+  end
+
+  test "default column mappings are applied after create" do
+    import = @family.imports.create!(type: "ActualImport")
+
+    ActualImport.default_column_mappings.each do |attribute, value|
+      assert_equal value, import.public_send(attribute)
+    end
+  end
+
+  test "generated rows preserve stable source row numbers" do
+    import = @family.imports.create!(
+      type: "ActualImport",
+      raw_file_str: file_fixture("imports/actual.csv").read,
+      col_sep: ","
+    )
+
+    import.generate_rows_from_csv
+
+    assert_equal (1..4).to_a, import.rows.order(:source_row_number).pluck(:source_row_number)
+  end
+
+  test "generated rows combine category group and category" do
+    import = @family.imports.create!(
+      type: "ActualImport",
+      raw_file_str: file_fixture("imports/actual.csv").read,
+      col_sep: ","
+    )
+
+    import.generate_rows_from_csv
+
+    assert_equal "Food: Coffee", import.rows.order(:source_row_number).second.category
+    assert_equal "Income: Paycheck", import.rows.order(:source_row_number).third.category
+    assert_equal "Transfer", import.rows.order(:source_row_number).fourth.category
+  end
+
+  test "generated rows fall back to category group when category is blank" do
+    import = @family.imports.create!(
+      type: "ActualImport",
+      raw_file_str: file_fixture("imports/actual.csv").read.sub("Housing,Rent", "Housing,"),
+      col_sep: ","
+    )
+
+    import.generate_rows_from_csv
+
+    assert_equal "Housing", import.rows.order(:source_row_number).first.category
+  end
+end
diff --git a/test/models/address_test.rb b/test/models/address_test.rb
index 47890d040..6e23eadc7 100644
--- a/test/models/address_test.rb
+++ b/test/models/address_test.rb
@@ -39,6 +39,12 @@ class AddressTest < ActiveSupport::TestCase
     assert_equal "", address.to_s
   end
 
+  test "accepts alphanumeric postal codes" do
+    address = addresses(:one)
+    address.update!(postal_code: "SW1A 2AA")
+    assert_equal "SW1A 2AA", address.reload.postal_code
+  end
+
   test "can strip extras commas and spaces" do
     address = Address.new(
       line1: "123 Main St ,",
diff --git a/test/models/assistant/history_trimmer_test.rb b/test/models/assistant/history_trimmer_test.rb
new file mode 100644
index 000000000..abd94324e
--- /dev/null
+++ b/test/models/assistant/history_trimmer_test.rb
@@ -0,0 +1,93 @@
+require "test_helper"
+
+class Assistant::HistoryTrimmerTest < ActiveSupport::TestCase
+  test "returns empty array for empty input" do
+    assert_equal [], Assistant::HistoryTrimmer.new([], max_tokens: 1000).call
+    assert_equal [], Assistant::HistoryTrimmer.new(nil, max_tokens: 1000).call
+  end
+
+  test "returns empty array when max_tokens is zero or negative" do
+    messages = [ { role: "user", content: "hi" } ]
+    assert_equal [], Assistant::HistoryTrimmer.new(messages, max_tokens: 0).call
+    assert_equal [], Assistant::HistoryTrimmer.new(messages, max_tokens: -10).call
+  end
+
+  test "keeps full history when budget is generous" do
+    messages = [
+      { role: "user", content: "a" * 40 },
+      { role: "assistant", content: "b" * 40 },
+      { role: "user", content: "c" * 40 }
+    ]
+
+    result = Assistant::HistoryTrimmer.new(messages, max_tokens: 10_000).call
+
+    assert_equal messages, result
+  end
+
+  test "drops oldest messages when budget is tight" do
+    messages = [
+      { role: "user", content: "a" * 100 },
+      { role: "assistant", content: "b" * 100 },
+      { role: "user", content: "c" * 100 }
+    ]
+
+    # ~40 tokens per message; budget of 60 should keep only the last one
+    result = Assistant::HistoryTrimmer.new(messages, max_tokens: 60).call
+
+    assert_equal 1, result.size
+    assert_equal "c" * 100, result.first[:content]
+  end
+
+  test "keeps tool_call and tool_result as an atomic pair" do
+    messages = [
+      { role: "user", content: "a" * 40 },
+      { role: "assistant", content: "", tool_calls: [ { id: "c1", type: "function", function: { name: "f", arguments: "{}" } } ] },
+      { role: "tool", tool_call_id: "c1", name: "f", content: "result" },
+      { role: "assistant", content: "follow up" }
+    ]
+
+    # Small budget: should keep the newest assistant follow-up. Pair is either
+    # kept together or dropped together — never split.
+    result = Assistant::HistoryTrimmer.new(messages, max_tokens: 20).call
+
+    tool_call_idx = result.index { |m| m[:role] == "assistant" && m[:tool_calls] }
+    tool_result_idx = result.index { |m| m[:role] == "tool" }
+
+    if tool_call_idx
+      assert_not_nil tool_result_idx, "tool_call without paired tool_result"
+      assert tool_result_idx > tool_call_idx, "tool_result must follow its tool_call"
+    else
+      assert_nil tool_result_idx, "tool_result without paired tool_call leaked through"
+    end
+  end
+
+  test "never splits tool_call + tool_result pair when dropping" do
+    messages = [
+      { role: "assistant", content: "", tool_calls: [ { id: "c1", type: "function", function: { name: "f", arguments: "{}" } } ] },
+      { role: "tool", tool_call_id: "c1", name: "f", content: "x" * 200 },
+      { role: "user", content: "y" * 20 }
+    ]
+
+    # Budget big enough for the user turn, not for the pair
+    result = Assistant::HistoryTrimmer.new(messages, max_tokens: 15).call
+
+    assert_equal 1, result.size
+    assert_equal "user", result.first[:role]
+  end
+
+  test "handles multiple tool results following a single assistant tool_calls message" do
+    messages = [
+      { role: "user", content: "hi" },
+      { role: "assistant", content: "", tool_calls: [
+        { id: "c1", type: "function", function: { name: "f1", arguments: "{}" } },
+        { id: "c2", type: "function", function: { name: "f2", arguments: "{}" } }
+      ] },
+      { role: "tool", tool_call_id: "c1", name: "f1", content: "r1" },
+      { role: "tool", tool_call_id: "c2", name: "f2", content: "r2" }
+    ]
+
+    result = Assistant::HistoryTrimmer.new(messages, max_tokens: 10_000).call
+
+    assert_equal messages, result
+  end
+end
diff --git a/test/models/assistant/token_estimator_test.rb b/test/models/assistant/token_estimator_test.rb
new file mode 100644
index 000000000..a22313c9f
--- /dev/null
+++ b/test/models/assistant/token_estimator_test.rb
@@ -0,0 +1,40 @@
+require "test_helper"
+
+class Assistant::TokenEstimatorTest < ActiveSupport::TestCase
+  test "estimate is zero for nil or empty" do
+    assert_equal 0, Assistant::TokenEstimator.estimate(nil)
+    assert_equal 0, Assistant::TokenEstimator.estimate("")
+    assert_equal 0, Assistant::TokenEstimator.estimate([])
+  end
+
+  test "estimate applies chars/4 with safety factor for strings" do
+    # 100 chars / 4 = 25 tokens, × 1.25 safety factor, ceil = 32
+    assert_equal 32, Assistant::TokenEstimator.estimate("a" * 100)
+  end
+
+  test "estimate sums across arrays" do
+    # Use lengths that avoid ceil rounding drift: 80 chars → 20 tokens → 25.0 ceil → 25.
+    string_estimate = Assistant::TokenEstimator.estimate("a" * 80)
+    array_estimate  = Assistant::TokenEstimator.estimate([ "a" * 80, "a" * 80 ])
+
+    assert_equal string_estimate * 2, array_estimate
+  end
+
+  test "estimate serializes hashes via JSON" do
+    hash = { role: "assistant", content: "hi" }
+    # {"role":"assistant","content":"hi"} => 35 chars / 4 × 1.25 ceil = 11
+    assert_equal 11, Assistant::TokenEstimator.estimate(hash)
+  end
+
+  test "estimate handles nested structures" do
+    nested = [ { role: "user", content: "hello" }, { role: "assistant", content: "world" } ]
+    # Each hash gets JSON-serialized and summed
+    expected = nested.sum { |h| Assistant::TokenEstimator.estimate(h) }
+    assert_equal expected, Assistant::TokenEstimator.estimate(nested)
+  end
+
+  test "estimate coerces unknown types via to_s" do
+    assert Assistant::TokenEstimator.estimate(12345) > 0
+    assert Assistant::TokenEstimator.estimate(:symbol) > 0
+  end
+end
diff --git a/test/models/assistant_message_test.rb b/test/models/assistant_message_test.rb
index 1e85aa21d..7c359c46b 100644
--- a/test/models/assistant_message_test.rb
+++ b/test/models/assistant_message_test.rb
@@ -12,7 +12,7 @@ class AssistantMessageTest < ActiveSupport::TestCase
     streams = capture_turbo_stream_broadcasts(@chat)
     assert_equal 2, streams.size
     assert_equal "append", streams.first["action"]
-    assert_equal "messages", streams.first["target"]
+    assert_equal @chat.messages_target, streams.first["target"]
     assert_equal "update", streams.last["action"]
     assert_equal "assistant_message_#{message.id}", streams.last["target"]
   end
diff --git a/test/models/assistant_test.rb b/test/models/assistant_test.rb
index b396cf7ed..8ce2ca511 100644
--- a/test/models/assistant_test.rb
+++ b/test/models/assistant_test.rb
@@ -14,6 +14,10 @@ class AssistantTest < ActiveSupport::TestCase
     @provider = mock
     @expected_session_id = @chat.id.to_s
     @expected_user_identifier = ::Digest::SHA256.hexdigest(@chat.user_id.to_s)
+    @expected_conversation_history = [
+      { role: "user", content: "Can you help me understand my spending habits?" },
+      { role: "user", content: "What is my net worth?" }
+    ]
   end
 
   test "errors get added to chat" do
@@ -100,6 +104,7 @@ class AssistantTest < ActiveSupport::TestCase
     @provider.expects(:chat_response).with do |message, **options|
       assert_equal @expected_session_id, options[:session_id]
       assert_equal @expected_user_identifier, options[:user_identifier]
+      assert_equal @expected_conversation_history, options[:messages]
       text_chunks.each do |text_chunk|
         options[:streamer].call(text_chunk)
       end
@@ -154,6 +159,7 @@ class AssistantTest < ActiveSupport::TestCase
     @provider.expects(:chat_response).with do |message, **options|
       assert_equal @expected_session_id, options[:session_id]
       assert_equal @expected_user_identifier, options[:user_identifier]
+      assert_equal @expected_conversation_history, options[:messages]
       call2_text_chunks.each do |text_chunk|
         options[:streamer].call(text_chunk)
       end
@@ -165,6 +171,7 @@ class AssistantTest < ActiveSupport::TestCase
     @provider.expects(:chat_response).with do |message, **options|
       assert_equal @expected_session_id, options[:session_id]
       assert_equal @expected_user_identifier, options[:user_identifier]
+      assert_equal @expected_conversation_history, options[:messages]
       options[:streamer].call(call1_response_chunk)
       true
     end.returns(call1_response).once.in_sequence(sequence)
@@ -219,11 +226,13 @@ class AssistantTest < ActiveSupport::TestCase
       "EXTERNAL_ASSISTANT_URL" => "http://localhost:18789/v1/chat",
       "EXTERNAL_ASSISTANT_TOKEN" => "test-token"
     ) do
-      assert_difference "AssistantMessage.count", 1 do
-        assistant.respond_to(@message)
+      assistant_message = pending_assistant_message
+
+      assert_no_difference "AssistantMessage.count" do
+        assistant.respond_to(@message, assistant_message: assistant_message)
       end
 
-      response_msg = @chat.messages.where(type: "AssistantMessage").last
+      response_msg = assistant_message.reload
       assert_equal "Your net worth is $124,200.", response_msg.content
       assert_equal "ext-agent:main", response_msg.ai_model
     end
@@ -361,12 +370,13 @@ class AssistantTest < ActiveSupport::TestCase
       "EXTERNAL_ASSISTANT_TOKEN" => "test-token"
     ) do
       assistant = Assistant::External.new(@chat)
-      assistant.respond_to(@message)
+      assistant_message = pending_assistant_message
+      assistant.respond_to(@message, assistant_message: assistant_message)
 
       @chat.reload
       assert_nil @chat.error
 
-      response = @chat.messages.where(type: "AssistantMessage").last
+      response = assistant_message.reload
       assert_equal "Based on your accounts, your net worth is $50,000.", response.content
       assert_equal "ext-agent:main", response.ai_model
     end
@@ -407,9 +417,10 @@ class AssistantTest < ActiveSupport::TestCase
       "EXTERNAL_ASSISTANT_URL" => "http://localhost:18789/v1/chat",
       "EXTERNAL_ASSISTANT_TOKEN" => "test-token"
     ) do
-      assistant.respond_to(@message)
+      assistant_message = pending_assistant_message
+      assistant.respond_to(@message, assistant_message: assistant_message)
 
-      response = @chat.messages.where(type: "AssistantMessage").last
+      response = assistant_message.reload
       assert_equal "ext-agent:custom", response.ai_model
     end
   end
@@ -418,6 +429,95 @@ class AssistantTest < ActiveSupport::TestCase
     assert_raises(Assistant::Error) { Assistant.for_chat(nil) }
   end
 
+  test "builtin demotes a partially-streamed assistant message to failed on error" do
+    @assistant.expects(:get_model_provider).with("gpt-4.1").returns(@provider)
+
+    boom = StandardError.new("boom mid-stream")
+
+    @provider.expects(:chat_response).with do |_prompt, **options|
+      # Simulate a partial text chunk landing before the error propagates.
+      options[:streamer].call(provider_text_chunk("partial tokens "))
+      true
+    end.returns(provider_error_response(boom))
+
+    @assistant.respond_to(@message)
+
+    partial = @chat.messages.where(type: "AssistantMessage").order(:created_at).last
+    assert partial.present?, "partial assistant message should be persisted"
+    assert_equal "failed", partial.status
+    assert_equal "partial tokens ", partial.content
+  end
+
+  test "conversation_history excludes failed and pending messages" do
+    # Add a failed assistant turn; it must NOT leak into history.
+    AssistantMessage.create!(
+      chat: @chat,
+      content: "partial error response",
+      ai_model: "gpt-4.1",
+      status: "failed"
+    )
+
+    @assistant.expects(:get_model_provider).with("gpt-4.1").returns(@provider)
+
+    captured_history = nil
+    @provider.expects(:chat_response).with do |_prompt, **options|
+      captured_history = options[:messages]
+      options[:streamer].call(
+        provider_response_chunk(id: "1", model: "gpt-4.1", messages: [ provider_message(id: "1", text: "ok") ], function_requests: [])
+      )
+      true
+    end.returns(provider_success_response(
+      provider_response_chunk(id: "1", model: "gpt-4.1", messages: [ provider_message(id: "1", text: "ok") ], function_requests: []).data
+    ))
+
+    @assistant.respond_to(@message)
+
+    contents = captured_history.map { |m| m[:content] }
+    assert_not_includes contents, "partial error response"
+  end
+
+  test "conversation_history serializes assistant tool_calls with paired tool result" do
+    assistant_msg = AssistantMessage.create!(
+      chat: @chat,
+      content: "Looking that up",
+      ai_model: "gpt-4.1",
+      status: "complete"
+    )
+
+    ToolCall::Function.create!(
+      message: assistant_msg,
+      provider_id: "call_abc",
+      provider_call_id: "call_abc",
+      function_name: "get_net_worth",
+      function_arguments: { foo: "bar" },
+      function_result: { amount: 1000, currency: "USD" }
+    )
+
+    @assistant.expects(:get_model_provider).with("gpt-4.1").returns(@provider)
+
+    captured_history = nil
+    @provider.expects(:chat_response).with do |_prompt, **options|
+      captured_history = options[:messages]
+      options[:streamer].call(
+        provider_response_chunk(id: "1", model: "gpt-4.1", messages: [ provider_message(id: "1", text: "ok") ], function_requests: [])
+      )
+      true
+    end.returns(provider_success_response(
+      provider_response_chunk(id: "1", model: "gpt-4.1", messages: [ provider_message(id: "1", text: "ok") ], function_requests: []).data
+    ))
+
+    @assistant.respond_to(@message)
+
+    tool_call_entry = captured_history.find { |m| m[:role] == "assistant" && m[:tool_calls].present? }
+    tool_result_entry = captured_history.find { |m| m[:role] == "tool" }
+
+    assert_not_nil tool_call_entry, "tool_call message missing from history"
+    assert_not_nil tool_result_entry, "tool_result message missing from history"
+    assert_equal "call_abc", tool_call_entry[:tool_calls].first[:id]
+    assert_equal "call_abc", tool_result_entry[:tool_call_id]
+    assert_equal "get_net_worth", tool_result_entry[:name]
+  end
+
   private
 
     def mock_external_sse_response(sse_body)
@@ -440,6 +540,10 @@ class AssistantTest < ActiveSupport::TestCase
       capture
     end
 
+    def pending_assistant_message
+      @chat.messages.where(type: "AssistantMessage", status: "pending").order(:created_at).last
+    end
+
     def provider_function_request(id:, call_id:, function_name:, function_args:)
       Provider::LlmConcept::ChatFunctionRequest.new(
         id: id,
diff --git a/test/models/balance/forward_calculator_test.rb b/test/models/balance/forward_calculator_test.rb
index 3d2c9fa26..22c8a5a61 100644
--- a/test/models/balance/forward_calculator_test.rb
+++ b/test/models/balance/forward_calculator_test.rb
@@ -693,8 +693,8 @@ class Balance::ForwardCalculatorTest < ActiveSupport::TestCase
   end
 
   test "multi-currency account falls back to full recalc so late exchange rate imports are picked up" do
-    # Step 1: Create account with a EUR entry but NO exchange rate yet.
-    # SyncCache will use fallback_rate: 1, so the €500 entry is treated as $500.
+    # Step 1: Create account with a EUR entry and a stale exchange rate (1:1 EUR→USD).
+    # This simulates an initial sync where an imprecise rate is available.
     account = create_account_with_ledger(
       account: { type: Depository, currency: "USD" },
       entries: [
@@ -703,14 +703,16 @@ class Balance::ForwardCalculatorTest < ActiveSupport::TestCase
         { type: "transaction", date: 2.days.ago.to_date, amount: -500, currency: "EUR" }
       ]
     )
+    ExchangeRate.create!(date: 2.days.ago.to_date, from_currency: "EUR", to_currency: "USD", rate: 1.0)
 
-    # First full sync — balances computed with fallback rate (1:1 EUR→USD).
+    # First full sync — balances computed with stale rate (1:1 EUR→USD).
+    # opening 100 + $100 txn + €500*1.0 = $700
     Balance::Materializer.new(account, strategy: :forward).materialize_balances
     stale_balance = account.balances.find_by(date: 2.days.ago.to_date)
     assert stale_balance, "Balance should exist after full sync"
 
-    # Step 2: Exchange rate arrives later (e.g. daily cron imports it).
-    ExchangeRate.create!(date: 2.days.ago.to_date, from_currency: "EUR", to_currency: "USD", rate: 1.2)
+    # Step 2: Corrected exchange rate arrives later (e.g. daily cron imports it).
+    ExchangeRate.find_by!(date: 2.days.ago.to_date, from_currency: "EUR", to_currency: "USD").update!(rate: 1.2)
 
     # Step 3: Next sync requests incremental from today — but the guard should
     # force a full recalc because the account has multi-currency entries.
@@ -725,7 +727,7 @@ class Balance::ForwardCalculatorTest < ActiveSupport::TestCase
     # The EUR entry on 2.days.ago is now converted at 1.2, so the balance
     # picks up the corrected rate: opening 100 + $100 txn + €500*1.2 = $800
     # (without the guard, incremental mode would have seeded from the stale
-    # $700 balance computed with fallback_rate 1, and never corrected it).
+    # $700 balance computed with rate 1.0, and never corrected it).
     corrected = result.find { |b| b.date == 2.days.ago.to_date }
     assert corrected
     assert_equal 800, corrected.balance,
diff --git a/test/models/balance/reverse_calculator_test.rb b/test/models/balance/reverse_calculator_test.rb
index c3ba12ba4..cee497bc8 100644
--- a/test/models/balance/reverse_calculator_test.rb
+++ b/test/models/balance/reverse_calculator_test.rb
@@ -28,29 +28,21 @@ class Balance::ReverseCalculatorTest < ActiveSupport::TestCase
     )
   end
 
-  # An artificial constraint we put on the reverse sync because it's confusing in both the code and the UI
-  # to think about how an absolute "Valuation" affects balances when syncing backwards. Furthermore, since
-  # this is typically a Plaid sync, we expect Plaid to provide us the history.
-  # Note: while "reconciliation" valuations don't affect balance, `current_anchor` and `opening_anchor` do.
-  test "reconciliation valuations do not affect balance for reverse syncs" do
+  # Reconciliation valuations act as waypoints during reverse syncs. This ensures that
+  # historical balances accurately reflect the API-reported values, even if the transaction
+  # history is incomplete or missing.
+  test "reconciliation valuations act as waypoints that reset balance for reverse syncs" do
     account = create_account_with_ledger(
       account: { type: Depository, balance: 20000, cash_balance: 20000, currency: "USD" },
       entries: [
         { type: "current_anchor", date: Date.current, balance: 20000 },
-        { type: "reconciliation", date: 1.day.ago, balance: 17000 }, # Ignored
-        { type: "reconciliation", date: 2.days.ago, balance: 17000 }, # Ignored
+        { type: "reconciliation", date: 2.days.ago, balance: 17000 }, # Waypoint!
         { type: "opening_anchor", date: 4.days.ago, balance: 15000 }
       ]
     )
 
     calculated = Balance::ReverseCalculator.new(account).calculate
 
-    # The "opening anchor" works slightly differently than most would expect. Since it's an artificial
-    # value provided by the user to set the date/balance of the start of the account, we must assume
-    # that there are "missing" entries following it. Because of this, we cannot "carry forward" this value
-    # like we do for a "forward sync". We simply sync backwards normally, then set the balance on opening
-    # date equal to this anchor. This is not "ideal", but is a constraint put on us since we cannot guarantee
-    # a 100% full entries history.
     assert_calculated_ledger_balances(
       calculated_data: calculated,
       expected_data: [
@@ -67,18 +59,164 @@ class Balance::ReverseCalculatorTest < ActiveSupport::TestCase
           balances: { start: 20000, start_cash: 20000, start_non_cash: 0, end_cash: 20000, end_non_cash: 0, end: 20000 },
           flows: 0,
           adjustments: 0
-        },
+        }, # Derived from Current anchor
         {
           date: 2.days.ago,
+          legacy_balances: { balance: 17000, cash_balance: 17000 },
+          balances: { start: 17000, start_cash: 17000, start_non_cash: 0, end_cash: 17000, end_non_cash: 0, end: 17000 },
+          flows: 0,
+          adjustments: 0
+        }, # Reset by Reconciliation waypoint
+        {
+          date: 3.days.ago,
+          legacy_balances: { balance: 17000, cash_balance: 17000 },
+          balances: { start: 17000, start_cash: 17000, start_non_cash: 0, end_cash: 17000, end_non_cash: 0, end: 17000 },
+          flows: 0,
+          adjustments: { cash_adjustments: 0, non_cash_adjustments: 0 }
+        }, # Derived from Reconciliation waypoint
+        {
+          date: 4.days.ago,
+          legacy_balances: { balance: 15000, cash_balance: 15000 },
+          balances: { start: 15000, start_cash: 15000, start_non_cash: 0, end_cash: 15000, end_non_cash: 0, end: 15000 },
+          flows: 0,
+          adjustments: 0
+        } # Opening anchor
+      ]
+    )
+  end
+
+  # Steady-state production scenario: after several consecutive daily syncs, a chain of
+  # reconciliation waypoints accumulates. Each waypoint must independently reset the
+  # balance without interactions leaking between them or toward the opening_anchor.
+  # Non-monotonic balance values (up and down) confirm each reset is truly independent.
+  test "multiple consecutive reconciliation waypoints thread through independently" do
+    account = create_account_with_ledger(
+      account: { type: Depository, balance: 25000, cash_balance: 25000, currency: "USD" },
+      entries: [
+        { type: "current_anchor", date: Date.current, balance: 25000 },
+        { type: "reconciliation", date: 1.day.ago, balance: 23000 },   # Waypoint 1 (down)
+        { type: "reconciliation", date: 2.days.ago, balance: 24500 },  # Waypoint 2 (up — non-monotonic)
+        { type: "reconciliation", date: 3.days.ago, balance: 21000 },  # Waypoint 3 (down)
+        { type: "reconciliation", date: 4.days.ago, balance: 22000 },  # Waypoint 4 (up — non-monotonic)
+        { type: "transaction", date: 5.days.ago, amount: 500 },        # Expense in the gap
+        { type: "transaction", date: 6.days.ago, amount: -300 },       # Income in the gap
+        { type: "opening_anchor", date: 7.days.ago, balance: 18000 }
+      ]
+    )
+
+    calculated = Balance::ReverseCalculator.new(account).calculate
+
+    assert_calculated_ledger_balances(
+      calculated_data: calculated,
+      expected_data: [
+        {
+          date: Date.current,
+          legacy_balances: { balance: 25000, cash_balance: 25000 },
+          balances: { start: 25000, start_cash: 25000, start_non_cash: 0, end_cash: 25000, end_non_cash: 0, end: 25000 },
+          flows: 0,
+          adjustments: 0
+        }, # Current anchor
+        {
+          date: 1.day.ago,
+          legacy_balances: { balance: 23000, cash_balance: 23000 },
+          balances: { start: 23000, start_cash: 23000, start_non_cash: 0, end_cash: 23000, end_non_cash: 0, end: 23000 },
+          flows: 0,
+          adjustments: 0
+        }, # Waypoint 1: reset to 23000 (independent of current_anchor 25000)
+        {
+          date: 2.days.ago,
+          legacy_balances: { balance: 24500, cash_balance: 24500 },
+          balances: { start: 24500, start_cash: 24500, start_non_cash: 0, end_cash: 24500, end_non_cash: 0, end: 24500 },
+          flows: 0,
+          adjustments: 0
+        }, # Waypoint 2: reset UP to 24500 (proves no carry-forward from waypoint 1's 23000)
+        {
+          date: 3.days.ago,
+          legacy_balances: { balance: 21000, cash_balance: 21000 },
+          balances: { start: 21000, start_cash: 21000, start_non_cash: 0, end_cash: 21000, end_non_cash: 0, end: 21000 },
+          flows: 0,
+          adjustments: 0
+        }, # Waypoint 3: reset down to 21000
+        {
+          date: 4.days.ago,
+          legacy_balances: { balance: 22000, cash_balance: 22000 },
+          balances: { start: 22000, start_cash: 22000, start_non_cash: 0, end_cash: 22000, end_non_cash: 0, end: 22000 },
+          flows: 0,
+          adjustments: 0
+        }, # Waypoint 4: reset up to 22000 (last waypoint before the gap)
+        {
+          date: 5.days.ago,
+          legacy_balances: { balance: 22000, cash_balance: 22000 },
+          balances: { start: 22500, start_cash: 22500, start_non_cash: 0, end_cash: 22000, end_non_cash: 0, end: 22000 },
+          flows: { cash_inflows: 0, cash_outflows: 500 },
+          adjustments: 0
+        }, # Expense derived from waypoint 4's 22000
+        {
+          date: 6.days.ago,
+          legacy_balances: { balance: 22500, cash_balance: 22500 },
+          balances: { start: 22200, start_cash: 22200, start_non_cash: 0, end_cash: 22500, end_non_cash: 0, end: 22500 },
+          flows: { cash_inflows: 300, cash_outflows: 0 },
+          adjustments: { cash_adjustments: 0, non_cash_adjustments: 0 }
+        }, # Income derived further back, right before opening_anchor
+        {
+          date: 7.days.ago,
+          legacy_balances: { balance: 18000, cash_balance: 18000 },
+          balances: { start: 18000, start_cash: 18000, start_non_cash: 0, end_cash: 18000, end_non_cash: 0, end: 18000 },
+          flows: 0,
+          adjustments: 0
+        } # Opening anchor
+      ]
+    )
+  end
+
+  test "same-day flows are not ignored when processing current_anchor valuation" do
+    # This regression test ensures that the ReverseCalculator does not mistake the
+    # current_anchor valuation (on Date.current) for a reconciliation waypoint,
+    # which would cause it to reset the balance and ignore same-day transactions.
+    account = create_account_with_ledger(
+      account: { type: Depository, balance: 20000, cash_balance: 20000, currency: "USD" },
+      entries: [
+        { type: "current_anchor", date: Date.current, balance: 20000 },
+        # A transaction on the same day as the current anchor!
+        # If we incorrectly "reset" at Date.current, this flow is ignored.
+        { type: "transaction", date: Date.current, amount: -500 },
+        { type: "reconciliation", date: 2.days.ago, balance: 18000 },
+        { type: "opening_anchor", date: 4.days.ago, balance: 15000 }
+      ]
+    )
+
+    calculated = Balance::ReverseCalculator.new(account).calculate
+
+    assert_calculated_ledger_balances(
+      calculated_data: calculated,
+      expected_data: [
+        {
+          date: Date.current,
           legacy_balances: { balance: 20000, cash_balance: 20000 },
-          balances: { start: 20000, start_cash: 20000, start_non_cash: 0, end_cash: 20000, end_non_cash: 0, end: 20000 },
+          # Since there was a $500 income (amount: -500) today, the START balance
+          # of today must be 19500 to end at 20000.
+          balances: { start: 19500, start_cash: 19500, start_non_cash: 0, end_cash: 20000, end_non_cash: 0, end: 20000 },
+          flows: { cash_inflows: 500, cash_outflows: 0 },
+          adjustments: 0
+        },
+        {
+          date: 1.day.ago,
+          legacy_balances: { balance: 19500, cash_balance: 19500 },
+          balances: { start: 19500, start_cash: 19500, start_non_cash: 0, end_cash: 19500, end_non_cash: 0, end: 19500 },
           flows: 0,
           adjustments: 0
         },
+        {
+          date: 2.days.ago,
+          legacy_balances: { balance: 18000, cash_balance: 18000 },
+          balances: { start: 18000, start_cash: 18000, start_non_cash: 0, end_cash: 18000, end_non_cash: 0, end: 18000 },
+          flows: 0,
+          adjustments: 0
+        }, # Reset by Reconciliation waypoint
         {
           date: 3.days.ago,
-          legacy_balances: { balance: 20000, cash_balance: 20000 },
-          balances: { start: 20000, start_cash: 20000, start_non_cash: 0, end_cash: 20000, end_non_cash: 0, end: 20000 },
+          legacy_balances: { balance: 18000, cash_balance: 18000 },
+          balances: { start: 18000, start_cash: 18000, start_non_cash: 0, end_cash: 18000, end_non_cash: 0, end: 18000 },
           flows: 0,
           adjustments: { cash_adjustments: 0, non_cash_adjustments: 0 }
         },
@@ -93,6 +231,7 @@ class Balance::ReverseCalculatorTest < ActiveSupport::TestCase
     )
   end
 
+
   # Investment account balances are made of two components: cash and holdings.
   test "anchors on investment accounts calculate cash balance dynamically based on holdings value" do
     account = create_account_with_ledger(
diff --git a/test/models/balance/sync_cache_test.rb b/test/models/balance/sync_cache_test.rb
new file mode 100644
index 000000000..cbc14df7b
--- /dev/null
+++ b/test/models/balance/sync_cache_test.rb
@@ -0,0 +1,256 @@
+require "test_helper"
+
+class Balance::SyncCacheTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @account = @family.accounts.create!(
+      name: "Test Account",
+      accountable: Investment.new,
+      currency: "USD",
+      balance: 1000
+    )
+  end
+
+  test "uses custom exchange rate from transaction extra field when present" do
+    # Create a transaction with EUR currency and custom exchange rate
+    _entry = @account.entries.create!(
+      date: Date.current,
+      name: "Test Transaction",
+      amount: 100,  # €100
+      currency: "EUR",
+      entryable: Transaction.new(
+        category: @family.categories.first,
+        extra: { "exchange_rate" => "1.5" }  # Custom rate: 1.5 (vs actual rate might be different)
+      )
+    )
+
+    sync_cache = Balance::SyncCache.new(@account)
+    converted_entries = sync_cache.send(:converted_entries)
+
+    converted_entry = converted_entries.first
+    assert_equal "USD", converted_entry.currency
+    assert_equal 150.0, converted_entry.amount  # 100 * 1.5 = 150
+  end
+
+  test "uses standard exchange rate lookup when custom rate not present" do
+    # Create an exchange rate in the database
+    ExchangeRate.create!(
+      from_currency: "EUR",
+      to_currency: "USD",
+      date: Date.current,
+      rate: 1.2
+    )
+
+    _entry = @account.entries.create!(
+      date: Date.current,
+      name: "Test Transaction",
+      amount: 100,  # €100
+      currency: "EUR",
+      entryable: Transaction.new(
+        category: @family.categories.first,
+        extra: {}  # No custom exchange rate
+      )
+    )
+
+    sync_cache = Balance::SyncCache.new(@account)
+    converted_entries = sync_cache.send(:converted_entries)
+
+    converted_entry = converted_entries.first
+    assert_equal "USD", converted_entry.currency
+    assert_equal 120.0, converted_entry.amount  # 100 * 1.2 = 120
+  end
+
+  test "uses custom exchange rate from trade when present" do
+    security = Security.create!(ticker: "TST", name: "Test")
+
+    _entry = @account.entries.create!(
+      date: Date.current,
+      name: "Test Trade",
+      amount: 100,
+      currency: "EUR",
+      entryable: Trade.new(
+        security: security,
+        qty: 1,
+        price: 100,
+        currency: "EUR",
+        exchange_rate: 1.5
+      )
+    )
+
+    sync_cache = Balance::SyncCache.new(@account)
+    converted_entries = sync_cache.send(:converted_entries)
+
+    converted_entry = converted_entries.first
+    assert_equal "USD", converted_entry.currency
+    assert_equal 150.0, converted_entry.amount
+  end
+
+  test "converts multiple entries with correct rates" do
+    # Create exchange rates
+    ExchangeRate.create!(
+      from_currency: "EUR",
+      to_currency: "USD",
+      date: Date.current,
+      rate: 1.2
+    )
+    ExchangeRate.create!(
+      from_currency: "GBP",
+      to_currency: "USD",
+      date: Date.current,
+      rate: 1.27
+    )
+
+    # Create multiple entries in different currencies
+    _eur_entry = @account.entries.create!(
+      date: Date.current,
+      name: "EUR Transaction",
+      amount: 100,
+      currency: "EUR",
+      entryable: Transaction.new(
+        category: @family.categories.first,
+        extra: {}
+      )
+    )
+
+    _gbp_entry = @account.entries.create!(
+      date: Date.current,
+      name: "GBP Transaction",
+      amount: 50,
+      currency: "GBP",
+      entryable: Transaction.new(
+        category: @family.categories.first,
+        extra: {}
+      )
+    )
+
+    _usd_entry = @account.entries.create!(
+      date: Date.current,
+      name: "USD Transaction",
+      amount: 75,
+      currency: "USD",
+      entryable: Transaction.new(
+        category: @family.categories.first,
+        extra: {}
+      )
+    )
+
+    sync_cache = Balance::SyncCache.new(@account)
+    converted_entries = sync_cache.send(:converted_entries)
+
+    assert_equal 3, converted_entries.length
+
+    # All should be in USD
+    converted_entries.each { |e| assert_equal "USD", e.currency }
+
+    # Check converted amounts
+    # Sort amounts to check regardless of order
+    amounts = converted_entries.map(&:amount).sort
+    assert_in_delta 63.5, amounts[0], 0.01   # 50 GBP * 1.27
+    assert_in_delta 75.0, amounts[1], 0.01   # 75 USD * 1.0
+    assert_in_delta 120.0, amounts[2], 0.01  # 100 EUR * 1.2
+  end
+
+  # get_holdings_value
+
+  test "returns 0 for date with no holdings" do
+    cache = Balance::SyncCache.new(@account)
+    assert_equal 0, cache.get_holdings_value(Date.current)
+  end
+
+  test "sums holdings value for a single date" do
+    security = Security.create!(ticker: "TST", name: "Test")
+
+    @account.holdings.create!(security: security, date: Date.current, qty: 10, price: 100, amount: 1000, currency: "USD")
+    @account.holdings.create!(security: security, date: 1.day.ago.to_date, qty: 10, price: 90, amount: 900, currency: "USD")
+
+    cache = Balance::SyncCache.new(@account)
+    assert_equal 1000, cache.get_holdings_value(Date.current)
+    assert_equal 900, cache.get_holdings_value(1.day.ago.to_date)
+  end
+
+  test "sums multiple holdings on the same date" do
+    s1 = Security.create!(ticker: "S1", name: "Security 1")
+    s2 = Security.create!(ticker: "S2", name: "Security 2")
+
+    @account.holdings.create!(security: s1, date: Date.current, qty: 10, price: 100, amount: 1000, currency: "USD")
+    @account.holdings.create!(security: s2, date: Date.current, qty: 5, price: 200, amount: 1000, currency: "USD")
+
+    assert_equal 2000, Balance::SyncCache.new(@account).get_holdings_value(Date.current)
+  end
+
+  test "converts foreign currency holdings to account currency" do
+    ExchangeRate.create!(from_currency: "EUR", to_currency: "USD", date: Date.current, rate: 1.5)
+
+    security = Security.create!(ticker: "TST", name: "Test")
+    @account.holdings.create!(security: security, date: Date.current, qty: 1, price: 100, amount: 100, currency: "EUR")
+
+    assert_equal 150.0, Balance::SyncCache.new(@account).get_holdings_value(Date.current)
+  end
+
+  test "falls back to 1:1 conversion rate when exchange rate is missing for a foreign currency holding" do
+    security = Security.create!(ticker: "TST", name: "Test")
+    @account.holdings.create!(security: security, date: Date.current, qty: 1, price: 100, amount: 100, currency: "EUR")
+
+    assert_equal 100, Balance::SyncCache.new(@account).get_holdings_value(Date.current)
+  end
+
+  test "prioritizes custom rate over fetched rate" do
+    # Create fetched rate
+    ExchangeRate.create!(
+      from_currency: "EUR",
+      to_currency: "USD",
+      date: Date.current,
+      rate: 1.2
+    )
+
+    # Create entry with custom rate that differs from fetched
+    _entry = @account.entries.create!(
+      date: Date.current,
+      name: "EUR Transaction with custom rate",
+      amount: 100,
+      currency: "EUR",
+      entryable: Transaction.new(
+        category: @family.categories.first,
+        extra: { "exchange_rate" => "1.5" }
+      )
+    )
+
+    sync_cache = Balance::SyncCache.new(@account)
+    converted_entries = sync_cache.send(:converted_entries)
+
+    converted_entry = converted_entries.first
+    # Should use custom rate (1.5), not fetched rate (1.2)
+    assert_equal 150.0, converted_entry.amount  # 100 * 1.5, not 100 * 1.2
+  end
+
+  test "prioritizes trade custom rate over fetched rate" do
+    ExchangeRate.create!(
+      from_currency: "EUR",
+      to_currency: "USD",
+      date: Date.current,
+      rate: 1.2
+    )
+
+    security = Security.create!(ticker: "TST2", name: "Test 2")
+
+    _entry = @account.entries.create!(
+      date: Date.current,
+      name: "EUR Trade with custom rate",
+      amount: 100,
+      currency: "EUR",
+      entryable: Trade.new(
+        security: security,
+        qty: 1,
+        price: 100,
+        currency: "EUR",
+        exchange_rate: 1.5
+      )
+    )
+
+    sync_cache = Balance::SyncCache.new(@account)
+    converted_entries = sync_cache.send(:converted_entries)
+
+    converted_entry = converted_entries.first
+    assert_equal 150.0, converted_entry.amount
+  end
+end
diff --git a/test/models/balance_sheet_test.rb b/test/models/balance_sheet_test.rb
index 9021baf27..558657279 100644
--- a/test/models/balance_sheet_test.rb
+++ b/test/models/balance_sheet_test.rb
@@ -56,9 +56,9 @@ class BalanceSheetTest < ActiveSupport::TestCase
     asset_groups = BalanceSheet.new(@family).assets.account_groups
 
     assert_equal 3, asset_groups.size
-    assert_equal 1000 + 2000, asset_groups.find { |ag| ag.name == I18n.t("accounts.types.depository") }.total
-    assert_equal 3000, asset_groups.find { |ag| ag.name == I18n.t("accounts.types.investment") }.total
-    assert_equal 5000, asset_groups.find { |ag| ag.name == I18n.t("accounts.types.other_asset") }.total
+    assert_equal 1000 + 2000, asset_groups.find { |ag| ag.name == Depository.display_name }.total
+    assert_equal 3000, asset_groups.find { |ag| ag.name == Investment.display_name }.total
+    assert_equal 5000, asset_groups.find { |ag| ag.name == OtherAsset.display_name }.total
   end
 
   test "calculates liability group totals" do
@@ -71,8 +71,8 @@ class BalanceSheetTest < ActiveSupport::TestCase
     liability_groups = BalanceSheet.new(@family).liabilities.account_groups
 
     assert_equal 2, liability_groups.size
-    assert_equal 1000 + 2000, liability_groups.find { |ag| ag.name == I18n.t("accounts.types.credit_card") }.total
-    assert_equal 3000 + 5000, liability_groups.find { |ag| ag.name == I18n.t("accounts.types.other_liability") }.total
+    assert_equal 1000 + 2000, liability_groups.find { |ag| ag.name == CreditCard.display_name }.total
+    assert_equal 3000 + 5000, liability_groups.find { |ag| ag.name == OtherLiability.display_name }.total
   end
 
   private
diff --git a/test/models/brex_account/transactions/processor_test.rb b/test/models/brex_account/transactions/processor_test.rb
new file mode 100644
index 000000000..74c4a2a3a
--- /dev/null
+++ b/test/models/brex_account/transactions/processor_test.rb
@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class BrexAccount::Transactions::ProcessorTest < ActiveSupport::TestCase
+  setup do
+    @brex_item = brex_items(:one)
+    @brex_account = @brex_item.brex_accounts.create!(
+      account_id: "cash_unlinked",
+      account_kind: "cash",
+      name: "Unlinked Cash",
+      currency: "USD",
+      raw_transactions_payload: [
+        {
+          id: "tx_skipped",
+          amount: { amount: 1_00, currency: "USD" },
+          description: "Skipped transaction",
+          posted_at_date: "2026-01-02"
+        }
+      ]
+    )
+  end
+
+  test "counts intentionally skipped transactions separately from failures" do
+    result = BrexAccount::Transactions::Processor.new(@brex_account).process
+
+    assert result[:success]
+    assert_equal 1, result[:total]
+    assert_equal 0, result[:imported]
+    assert_equal 1, result[:skipped]
+    assert_equal 0, result[:failed]
+    assert_equal "No linked account", result[:skipped_transactions].first[:reason]
+    assert_empty result[:errors]
+  end
+
+  test "imports linked transactions successfully" do
+    link_brex_account!
+
+    result = BrexAccount::Transactions::Processor.new(@brex_account).process
+
+    assert result[:success]
+    assert_equal 1, result[:total]
+    assert_equal 1, result[:imported]
+    assert_equal 0, result[:skipped]
+    assert_equal 0, result[:failed]
+    assert_empty result[:skipped_transactions]
+    assert_empty result[:errors]
+  end
+
+  test "aggregates partial transaction failures" do
+    link_brex_account!
+    @brex_account.update!(
+      raw_transactions_payload: [
+        {
+          id: "tx_success",
+          amount: { amount: 1_00, currency: "USD" },
+          description: "Successful transaction",
+          posted_at_date: "2026-01-02"
+        },
+        {
+          id: "tx_failure",
+          amount: { amount: 2_00, currency: "USD" },
+          description: "Failed transaction",
+          posted_at_date: "not-a-date"
+        }
+      ]
+    )
+
+    result = BrexAccount::Transactions::Processor.new(@brex_account).process
+
+    assert_not result[:success]
+    assert_equal 2, result[:total]
+    assert_equal 1, result[:imported]
+    assert_equal 0, result[:skipped]
+    assert_equal 1, result[:failed]
+    assert_empty result[:skipped_transactions]
+    assert_equal "tx_failure", result[:errors].first[:transaction_id]
+    assert_match(/Unable to parse transaction date/, result[:errors].first[:error])
+  end
+
+  private
+
+    def link_brex_account!
+      account = @brex_item.family.accounts.create!(
+        name: "Linked Cash",
+        balance: 0,
+        currency: "USD",
+        accountable: Depository.new
+      )
+      AccountProvider.create!(account: account, provider: @brex_account)
+    end
+end
diff --git a/test/models/brex_account_test.rb b/test/models/brex_account_test.rb
new file mode 100644
index 000000000..6d0d60769
--- /dev/null
+++ b/test/models/brex_account_test.rb
@@ -0,0 +1,210 @@
+require "test_helper"
+
+class BrexAccountTest < ActiveSupport::TestCase
+  setup do
+    @family_a = families(:dylan_family)
+    @family_b = families(:empty)
+
+    @item_a = BrexItem.create!(
+      family: @family_a,
+      name: "Family A Brex",
+      token: "token_a",
+      base_url: "https://api-staging.brex.com",
+      status: "good"
+    )
+
+    @item_b = BrexItem.create!(
+      family: @family_b,
+      name: "Family B Brex",
+      token: "token_b",
+      base_url: "https://api-staging.brex.com",
+      status: "good"
+    )
+  end
+
+  test "same account_id can be linked under different brex_items" do
+    BrexAccount.create!(
+      brex_item: @item_a,
+      account_id: "shared_brex_acc_1",
+      name: "Checking",
+      currency: "USD",
+      current_balance: 5000
+    )
+
+    # A second family connecting the same Brex account must succeed and produce
+    # an independent ledger (separate BrexAccount row, separate Account).
+    assert_difference "BrexAccount.count", 1 do
+      BrexAccount.create!(
+        brex_item: @item_b,
+        account_id: "shared_brex_acc_1",
+        name: "Checking",
+        currency: "USD",
+        current_balance: 5000
+      )
+    end
+  end
+
+  test "declares raw Brex payloads as encrypted" do
+    skip "Encryption not configured" unless BrexAccount.encryption_ready?
+
+    encrypted_attributes = BrexAccount.encrypted_attributes.map(&:to_s)
+
+    assert_includes encrypted_attributes, "raw_payload"
+    assert_includes encrypted_attributes, "raw_transactions_payload"
+  end
+
+  test "same account_id can be linked under different brex_items in the same family" do
+    item_a_2 = BrexItem.create!(
+      family: @family_a,
+      name: "Family A Second Brex",
+      token: "token_a_2",
+      base_url: "https://api-staging.brex.com",
+      status: "good"
+    )
+
+    BrexAccount.create!(
+      brex_item: @item_a,
+      account_id: "shared_brex_acc_1",
+      name: "Checking",
+      currency: "USD",
+      current_balance: 5000
+    )
+
+    assert_difference "BrexAccount.count", 1 do
+      BrexAccount.create!(
+        brex_item: item_a_2,
+        account_id: "shared_brex_acc_1",
+        name: "Checking",
+        currency: "USD",
+        current_balance: 5000
+      )
+    end
+  end
+
+  test "same account_id cannot appear twice under the same brex_item" do
+    BrexAccount.create!(
+      brex_item: @item_a,
+      account_id: "duplicate_acc",
+      name: "Checking",
+      currency: "USD",
+      current_balance: 1000
+    )
+
+    duplicate = BrexAccount.new(
+      brex_item: @item_a,
+      account_id: "duplicate_acc",
+      name: "Checking",
+      currency: "USD",
+      current_balance: 1000
+    )
+    refute duplicate.valid?
+    assert_includes duplicate.errors[:account_id], "has already been taken"
+
+    assert_raises(ActiveRecord::RecordInvalid) do
+      BrexAccount.create!(
+        brex_item: @item_a,
+        account_id: "duplicate_acc",
+        name: "Checking",
+        currency: "USD",
+        current_balance: 1000
+      )
+    end
+  end
+
+  test "minor-unit money converts to decimal account balances" do
+    brex_account = @item_a.brex_accounts.create!(
+      account_id: "cash_1",
+      name: "Operating",
+      currency: "USD",
+      account_kind: "cash"
+    )
+
+    brex_account.upsert_brex_snapshot!(
+      {
+        id: "cash_1",
+        name: "Operating",
+        account_kind: "cash",
+        current_balance: { amount: 123_456, currency: "USD" },
+        available_balance: { amount: 120_000, currency: "USD" }
+      }
+    )
+
+    assert_equal BigDecimal("1234.56"), brex_account.current_balance
+    assert_equal BigDecimal("1200.0"), brex_account.available_balance
+  end
+
+  test "invalid Brex money amount falls back to zero" do
+    assert_equal BigDecimal("0"), BrexAccount.money_to_decimal(amount: "not-a-number", currency: "USD")
+  end
+
+  test "snapshot sanitizes full account and routing numbers" do
+    brex_account = @item_a.brex_accounts.create!(
+      account_id: "cash_2",
+      name: "Operating",
+      currency: "USD",
+      account_kind: "cash"
+    )
+
+    brex_account.upsert_brex_snapshot!(
+      {
+        id: "cash_2",
+        name: "Operating",
+        account_kind: "cash",
+        current_balance: { amount: 100, currency: "USD" },
+        account_number: "account-last4-9012",
+        routing_number: "routing-last4-0021",
+        token: "test-token-placeholder"
+      }
+    )
+
+    payload = brex_account.raw_payload
+    refute_includes payload.values.compact.map(&:to_s).join(" "), "account-last4-9012"
+    refute_includes payload.values.compact.map(&:to_s).join(" "), "routing-last4-0021"
+    assert_equal "9012", payload["account_number_last4"]
+    assert_equal "0021", payload["routing_number_last4"]
+    assert_equal "[FILTERED]", payload["token"]
+  end
+
+  test "transaction payload sanitizer drops arbitrary card metadata" do
+    sanitized = BrexAccount.sanitize_payload(
+      {
+        id: "tx_1",
+        card_metadata: {
+          card_id: "card_1",
+          pan: "test-pan-placeholder",
+          private_note: "private",
+          last_four: "card ending 1111"
+        }
+      }
+    )
+
+    assert_equal({ "card_id" => "card_1", "last_four" => "1111" }, sanitized["card_metadata"])
+    refute_includes sanitized.to_s, "test-pan-placeholder"
+    refute_includes sanitized.to_s, "private"
+  end
+
+  test "transaction payload sanitizer limits card metadata last four to digits" do
+    sanitized = BrexAccount.sanitize_payload(card_metadata: { card_last_four: "card id abc9876" })
+
+    assert_equal "9876", sanitized["card_metadata"]["last_four"]
+    refute_includes sanitized.to_s, "abc9876"
+  end
+
+  test "linked_account uses the cached account association" do
+    brex_account = @item_a.brex_accounts.create!(
+      account_id: "cash_linked_alias",
+      name: "Linked Alias",
+      currency: "USD",
+      account_kind: "cash"
+    )
+    account = @family_a.accounts.create!(
+      name: "Linked Alias",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+    AccountProvider.create!(account: account, provider: brex_account)
+
+    assert_equal brex_account.account, brex_account.linked_account
+  end
+end
diff --git a/test/models/brex_entry/processor_test.rb b/test/models/brex_entry/processor_test.rb
new file mode 100644
index 000000000..aa36765dc
--- /dev/null
+++ b/test/models/brex_entry/processor_test.rb
@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class BrexEntry::ProcessorTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @brex_item = brex_items(:one)
+    @account = @family.accounts.create!(
+      name: "Brex Card",
+      balance: 0,
+      currency: "USD",
+      accountable: CreditCard.new
+    )
+    @brex_account = @brex_item.brex_accounts.create!(
+      account_id: BrexAccount.card_account_id,
+      account_kind: "card",
+      name: "Brex Card",
+      currency: "USD",
+      current_balance: 0
+    )
+    AccountProvider.create!(account: @account, provider: @brex_account)
+  end
+
+  test "imports card purchase with Brex signed amount preserved" do
+    entry = BrexEntry::Processor.new(card_transaction(amount: 12_34), brex_account: @brex_account).process
+
+    assert_equal BigDecimal("12.34"), entry.amount
+    assert_equal "USD", entry.currency
+    assert_equal "brex", entry.source
+    assert_equal Date.new(2026, 1, 2), entry.date
+    assert_equal "STAPLES", entry.transaction.merchant.name
+    assert_equal "card_1", entry.transaction.extra.dig("brex", "card_id")
+    assert_equal "STAPLES", entry.transaction.extra.dig("brex", "merchant", "raw_descriptor")
+    refute_includes entry.transaction.extra.dig("brex", "merchant").to_s, "test-pan-placeholder"
+    refute_includes entry.transaction.extra.dig("brex", "merchant").to_s, "pan"
+  end
+
+  test "imports card payment as negative amount" do
+    entry = BrexEntry::Processor.new(card_transaction(id: "tx_payment", amount: -50_00, type: "COLLECTION"), brex_account: @brex_account).process
+
+    assert_equal BigDecimal("-50.0"), entry.amount
+    assert_equal "cc_payment", entry.transaction.kind
+  end
+
+  test "is idempotent by external id and source" do
+    transaction = card_transaction(id: "tx_duplicate", amount: 12_34)
+
+    assert_difference -> { @account.entries.where(source: "brex", external_id: "brex_tx_duplicate").count }, 1 do
+      BrexEntry::Processor.new(transaction, brex_account: @brex_account).process
+      BrexEntry::Processor.new(transaction, brex_account: @brex_account).process
+    end
+  end
+
+  test "tolerates nullable Brex fields and unknown types" do
+    transaction = {
+      id: "tx_nullable",
+      amount: nil,
+      description: "Cash movement",
+      posted_at_date: "2026-01-03",
+      initiated_at_date: "2026-01-02",
+      type: "NEW_BREX_TYPE"
+    }
+
+    entry = BrexEntry::Processor.new(transaction, brex_account: @brex_account).process
+
+    assert_equal BigDecimal("0"), entry.amount
+    assert_equal "Cash movement", entry.name
+    assert_equal "NEW_BREX_TYPE", entry.transaction.extra.dig("brex", "type")
+  end
+
+  test "uses localized default transaction name" do
+    transaction = card_transaction(id: "tx_default_name", amount: 12_34)
+    transaction.delete(:description)
+    transaction.delete(:merchant)
+
+    entry = BrexEntry::Processor.new(transaction, brex_account: @brex_account).process
+
+    assert_equal I18n.t("brex_items.entries.default_name"), entry.name
+  end
+
+  test "logs validation failure without re-reading missing external id" do
+    Rails.logger.expects(:error).with(regexp_matches(/Validation error for transaction brex_unknown/)).once
+
+    assert_raises(ArgumentError) do
+      BrexEntry::Processor.new(card_transaction(id: nil, amount: 12_34), brex_account: @brex_account).process
+    end
+  end
+
+  test "logs save failure with cached external id" do
+    Account::ProviderImportAdapter.any_instance
+                                  .expects(:import_transaction)
+                                  .raises(ActiveRecord::RecordInvalid.new(Entry.new))
+    Rails.logger.expects(:error).with(regexp_matches(/Failed to save transaction brex_tx_save_failure/)).once
+
+    assert_raises(StandardError) do
+      BrexEntry::Processor.new(card_transaction(id: "tx_save_failure", amount: 12_34), brex_account: @brex_account).process
+    end
+  end
+
+  test "logs missing transaction currency before using account fallback" do
+    Rails.logger.expects(:warn).with(regexp_matches(/Invalid Brex currency nil for transaction tx_missing_currency/)).once
+
+    entry = BrexEntry::Processor.new(
+      card_transaction(id: "tx_missing_currency", amount: 12_34).tap { |transaction| transaction[:amount].delete(:currency) },
+      brex_account: @brex_account
+    ).process
+
+    assert_equal "USD", entry.currency
+  end
+
+  private
+
+    def card_transaction(id: "tx_1", amount:, type: "CARD_EXPENSE")
+      {
+        id: id,
+        amount: { amount: amount, currency: "USD" },
+        description: "Office supplies",
+        posted_at_date: "2026-01-02",
+        initiated_at_date: "2026-01-01",
+        type: type,
+        card_id: "card_1",
+        merchant: {
+          raw_descriptor: "STAPLES",
+          card_metadata: {
+            pan: "test-pan-placeholder"
+          }
+        }
+      }
+    end
+end
diff --git a/test/models/brex_item/account_flow_test.rb b/test/models/brex_item/account_flow_test.rb
new file mode 100644
index 000000000..60a2207dd
--- /dev/null
+++ b/test/models/brex_item/account_flow_test.rb
@@ -0,0 +1,394 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class BrexItem::AccountFlowTest < ActiveSupport::TestCase
+  setup do
+    SyncJob.stubs(:perform_later)
+    @family = families(:dylan_family)
+    @brex_item = brex_items(:one)
+  end
+
+  test "requires explicit item when multiple credentialed connections exist" do
+    BrexItem.create!(
+      family: @family,
+      name: "Second Brex",
+      token: "second_brex_token",
+      base_url: "https://api.brex.com"
+    )
+
+    flow = BrexItem::AccountFlow.new(family: @family)
+
+    assert_not flow.selected?
+    assert flow.selection_required?
+  end
+
+  test "preload payload returns explicit selection error when multiple connections exist" do
+    BrexItem.create!(
+      family: @family,
+      name: "Second Brex",
+      token: "second_brex_token",
+      base_url: "https://api.brex.com"
+    )
+
+    payload = BrexItem::AccountFlow.new(family: @family).preload_payload
+
+    assert_equal false, payload[:success]
+    assert_equal "select_connection", payload[:error]
+    assert_nil payload[:has_accounts]
+  end
+
+  test "preload payload treats cached empty accounts as a cache hit" do
+    cache_key = BrexItem::AccountFlow.cache_key(@family, @brex_item)
+    Rails.cache.expects(:read).with(cache_key).returns([])
+    Rails.cache.expects(:write).never
+    @brex_item.expects(:brex_provider).never
+
+    payload = BrexItem::AccountFlow.new(family: @family, brex_item: @brex_item).preload_payload
+
+    assert payload[:success]
+    assert_equal false, payload[:has_accounts]
+    assert_equal true, payload[:cached]
+  end
+
+  test "account cache keys isolate multiple credentialed connections with shared upstream ids" do
+    second_item = BrexItem.create!(
+      family: @family,
+      name: "Second Brex",
+      token: "second_brex_token",
+      base_url: "https://api.brex.com"
+    )
+    first_cache_key = BrexItem::AccountFlow.cache_key(@family, @brex_item)
+    second_cache_key = BrexItem::AccountFlow.cache_key(@family, second_item)
+
+    refute_equal first_cache_key, second_cache_key
+
+    Rails.cache.expects(:read).with(first_cache_key).never
+    Rails.cache.expects(:read).with(second_cache_key).returns(
+      [ { id: BrexAccount.card_account_id, name: "Second Brex Card", account_kind: "card" } ]
+    )
+    Rails.cache.expects(:write).never
+
+    result = BrexItem::AccountFlow.new(family: @family, brex_item: second_item).select_accounts_result(accountable_type: "CreditCard")
+
+    assert result.success?
+    assert_equal [ "Second Brex Card" ], result.available_accounts.map { |account| account.with_indifferent_access[:name] }
+  end
+
+  test "preload payload reports invalid explicit connection as selection error" do
+    payload = BrexItem::AccountFlow.new(
+      family: @family,
+      brex_item_id: " #{SecureRandom.uuid} "
+    ).preload_payload
+
+    assert_equal false, payload[:success]
+    assert_equal "select_connection", payload[:error]
+    assert_nil payload[:has_accounts]
+  end
+
+  test "import accounts reports missing selected item as no api token" do
+    flow = BrexItem::AccountFlow.new(family: @family, brex_item_id: SecureRandom.uuid)
+
+    assert_raises BrexItem::AccountFlow::NoApiTokenError do
+      flow.import_accounts_from_api_if_needed
+    end
+  end
+
+  test "link result returns navigation instead of raising expected selection errors" do
+    BrexItem.create!(
+      family: @family,
+      name: "Second Brex",
+      token: "second_brex_token",
+      base_url: "https://api.brex.com"
+    )
+
+    result = BrexItem::AccountFlow.new(family: @family).link_new_accounts_result(
+      account_ids: [ "cash_import_1" ],
+      accountable_type: "Depository"
+    )
+
+    assert_equal :settings_providers, result.target
+    assert_equal :alert, result.flash_type
+    assert_equal I18n.t("brex_items.link_accounts.select_connection"), result.message
+  end
+
+  test "link new accounts rejects unsupported account type before creating accounts" do
+    flow = BrexItem::AccountFlow.new(family: @family, brex_item: @brex_item)
+    @brex_item.expects(:brex_provider).never
+
+    assert_no_difference [ "Account.count", "BrexAccount.count", "AccountProvider.count" ] do
+      result = flow.link_new_accounts_result(
+        account_ids: [ "cash_import_1" ],
+        accountable_type: "Investment"
+      )
+
+      assert_equal :new_account, result.target
+      assert_equal :alert, result.flash_type
+      assert_equal I18n.t("brex_items.link_accounts.invalid_account_type"), result.message
+    end
+  end
+
+  test "link new accounts converts unexpected errors into navigation alerts" do
+    flow = BrexItem::AccountFlow.new(family: @family, brex_item: @brex_item)
+    flow.expects(:link_new_accounts!).raises(StandardError, "link failure")
+
+    result = flow.link_new_accounts_result(
+      account_ids: [ "cash_import_1" ],
+      accountable_type: "Depository"
+    )
+
+    assert_equal :new_account, result.target
+    assert_equal :alert, result.flash_type
+    assert_equal I18n.t("brex_items.errors.unexpected_error"), result.message
+  end
+
+  test "link existing account converts unexpected errors into navigation alerts" do
+    account = @family.accounts.create!(
+      name: "Manual Checking",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+    flow = BrexItem::AccountFlow.new(family: @family, brex_item: @brex_item)
+    flow.expects(:link_existing_account!).raises(StandardError, "link existing failure")
+
+    result = flow.link_existing_account_result(account: account, brex_account_id: "cash_import_1")
+
+    assert_equal :accounts, result.target
+    assert_equal :alert, result.flash_type
+    assert_equal I18n.t("brex_items.errors.unexpected_error"), result.message
+  end
+
+  test "imports provider accounts into the selected item" do
+    brex_item = BrexItem.create!(
+      family: @family,
+      name: "Import Brex",
+      token: "import_brex_token",
+      base_url: "https://api.brex.com"
+    )
+
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(
+      accounts: [
+        {
+          id: "cash_import_1",
+          name: "Imported Cash",
+          account_kind: "cash",
+          current_balance: { amount: 12_345, currency: "USD" },
+          account_number: "account-last4-3456"
+        }
+      ]
+    )
+    brex_item.expects(:brex_provider).returns(provider)
+
+    flow = BrexItem::AccountFlow.new(family: @family, brex_item: brex_item)
+
+    assert_difference -> { brex_item.brex_accounts.count }, 1 do
+      assert_nil flow.import_accounts_from_api_if_needed
+    end
+
+    brex_account = brex_item.brex_accounts.find_by!(account_id: "cash_import_1")
+    assert_equal "Imported Cash", brex_account.name
+    assert_equal "3456", brex_account.raw_payload["account_number_last4"]
+    refute_includes brex_account.raw_payload.to_s, "account-last4-3456"
+  end
+
+  test "refreshes existing provider accounts during setup discovery" do
+    brex_item = BrexItem.create!(
+      family: @family,
+      name: "Refresh Brex",
+      token: "refresh_brex_token",
+      base_url: "https://api.brex.com"
+    )
+    brex_item.brex_accounts.create!(
+      account_id: "cash_import_1",
+      name: "Old Cash",
+      currency: "USD",
+      account_kind: "cash",
+      current_balance: 1
+    )
+
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(
+      accounts: [
+        {
+          id: "cash_import_1",
+          name: "Updated Cash",
+          account_kind: "cash",
+          current_balance: { amount: 12_345, currency: "USD" }
+        }
+      ]
+    )
+    brex_item.expects(:brex_provider).returns(provider)
+
+    flow = BrexItem::AccountFlow.new(family: @family, brex_item: brex_item)
+
+    assert_no_difference -> { brex_item.brex_accounts.count } do
+      assert_nil flow.import_accounts_from_api_if_needed
+    end
+
+    brex_account = brex_item.brex_accounts.find_by!(account_id: "cash_import_1")
+    assert_equal "Updated Cash", brex_account.name
+    assert_equal BigDecimal("123.45"), brex_account.current_balance
+  end
+
+  test "complete setup result is unsuccessful when any account creation fails" do
+    first_brex_account = @brex_item.brex_accounts.create!(
+      account_id: "setup_result_partial_1",
+      account_kind: "cash",
+      name: "Setup Result Partial One",
+      currency: "USD",
+      current_balance: 100
+    )
+    second_brex_account = @brex_item.brex_accounts.create!(
+      account_id: "setup_result_partial_2",
+      account_kind: "cash",
+      name: "Setup Result Partial Two",
+      currency: "USD",
+      current_balance: 100
+    )
+    second_brex_account.update_column(:name, nil)
+
+    result = BrexItem::AccountFlow.new(family: @family, brex_item: @brex_item).complete_setup_result(
+      account_types: {
+        first_brex_account.id => "Depository",
+        second_brex_account.id => "Depository"
+      },
+      account_subtypes: {}
+    )
+
+    refute result.success?
+    assert_match(/failed/i, result.message)
+    assert first_brex_account.reload.account_provider.present?
+    assert_nil second_brex_account.reload.account_provider
+  end
+
+  test "complete setup creates account links with default subtype" do
+    brex_account = @brex_item.brex_accounts.create!(
+      account_id: "setup_cash_1",
+      account_kind: "cash",
+      name: "Setup Cash",
+      currency: "USD",
+      current_balance: 100
+    )
+
+    flow = BrexItem::AccountFlow.new(family: @family, brex_item: @brex_item)
+
+    assert_difference "AccountProvider.count", 1 do
+      result = flow.complete_setup!(
+        account_types: { brex_account.id => "Depository" },
+        account_subtypes: {}
+      )
+
+      assert_equal 1, result.created_count
+      assert_equal 0, result.skipped_count
+    end
+
+    account = brex_account.reload.account
+    assert_equal "Setup Cash", account.name
+    assert_equal Depository::DEFAULT_SUBTYPE, account.accountable.subtype
+  end
+
+  test "complete setup keeps prior accounts when one account creation fails" do
+    first_brex_account = @brex_item.brex_accounts.create!(
+      account_id: "setup_partial_1",
+      account_kind: "cash",
+      name: "Setup Partial One",
+      currency: "USD",
+      current_balance: 100
+    )
+    second_brex_account = @brex_item.brex_accounts.create!(
+      account_id: "setup_partial_2",
+      account_kind: "cash",
+      name: "Setup Partial Two",
+      currency: "USD",
+      current_balance: 100
+    )
+    second_brex_account.update_column(:name, nil)
+
+    result = BrexItem::AccountFlow.new(family: @family, brex_item: @brex_item).complete_setup!(
+      account_types: {
+        first_brex_account.id => "Depository",
+        second_brex_account.id => "Depository"
+      },
+      account_subtypes: {}
+    )
+
+    assert_equal 1, result.created_count
+    assert_equal 1, result.failed_count
+    assert first_brex_account.reload.account_provider.present?
+    assert_nil second_brex_account.reload.account_provider
+  end
+
+  test "link new accounts rolls back account creation when provider link fails" do
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(
+      accounts: [
+        {
+          id: "rollback_cash_1",
+          name: "Rollback Cash",
+          account_kind: "cash",
+          current_balance: { amount: 12_345, currency: "USD" }
+        }
+      ]
+    )
+    @brex_item.expects(:brex_provider).returns(provider)
+    AccountProvider.expects(:create!).raises(ActiveRecord::RecordInvalid.new(AccountProvider.new))
+
+    flow = BrexItem::AccountFlow.new(family: @family, brex_item: @brex_item)
+
+    assert_no_difference [ "Account.count", "BrexAccount.count", "AccountProvider.count" ] do
+      assert_raises(ActiveRecord::RecordInvalid) do
+        flow.link_new_accounts!(account_ids: [ "rollback_cash_1" ], accountable_type: "Depository")
+      end
+    end
+  end
+
+  test "link existing account rolls back provider account when link creation fails" do
+    account = @family.accounts.create!(
+      name: "Existing Cash",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(
+      accounts: [
+        {
+          id: "rollback_existing_cash_1",
+          name: "Rollback Existing Cash",
+          account_kind: "cash",
+          current_balance: { amount: 12_345, currency: "USD" }
+        }
+      ]
+    )
+    @brex_item.expects(:brex_provider).returns(provider)
+    AccountProvider.expects(:create!).raises(ActiveRecord::RecordInvalid.new(AccountProvider.new))
+
+    flow = BrexItem::AccountFlow.new(family: @family, brex_item: @brex_item)
+
+    assert_no_difference [ "BrexAccount.count", "AccountProvider.count" ] do
+      assert_raises(ActiveRecord::RecordInvalid) do
+        flow.link_existing_account!(account: account, brex_account_id: "rollback_existing_cash_1")
+      end
+    end
+  end
+
+  test "complete setup result returns localized notice" do
+    brex_account = @brex_item.brex_accounts.create!(
+      account_id: "setup_result_cash_1",
+      account_kind: "cash",
+      name: "Setup Result Cash",
+      currency: "USD",
+      current_balance: 100
+    )
+
+    result = BrexItem::AccountFlow.new(family: @family, brex_item: @brex_item).complete_setup_result(
+      account_types: { brex_account.id => "Depository" },
+      account_subtypes: {}
+    )
+
+    assert result.success?
+    assert_equal I18n.t("brex_items.complete_account_setup.success", count: 1), result.message
+  end
+end
diff --git a/test/models/brex_item/importer_test.rb b/test/models/brex_item/importer_test.rb
new file mode 100644
index 000000000..ed64f5e81
--- /dev/null
+++ b/test/models/brex_item/importer_test.rb
@@ -0,0 +1,331 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class BrexItem::ImporterTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @brex_item = brex_items(:one)
+    @account = @family.accounts.create!(
+      name: "Operating Cash",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new(subtype: "checking")
+    )
+    @brex_account = @brex_item.brex_accounts.create!(
+      account_id: "cash_1",
+      account_kind: "cash",
+      name: "Operating Cash",
+      currency: "USD",
+      current_balance: 0
+    )
+    AccountProvider.create!(account: @account, provider: @brex_account)
+  end
+
+  test "imports account discovery and fetches transactions only for linked accounts" do
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(accounts: [ cash_account_payload, card_account_payload ])
+    provider.expects(:get_cash_transactions).with("cash_1", start_date: Date.new(2026, 1, 1)).returns(
+      transactions: [
+        {
+          id: "cash_tx_1",
+          amount: { amount: 12_34, currency: "USD" },
+          description: "Wire fee",
+          posted_at_date: "2026-01-02"
+        }
+      ]
+    )
+    provider.expects(:get_primary_card_transactions).never
+
+    result = BrexItem::Importer.new(@brex_item, brex_provider: provider, sync_start_date: Date.new(2026, 1, 1)).import
+
+    assert result[:success]
+    assert_equal 1, result[:accounts_updated]
+    assert_equal 1, result[:accounts_created]
+    assert_equal [ "cash_tx_1" ], @brex_account.reload.raw_transactions_payload.map { |tx| tx["id"] }
+    assert_equal "card", @brex_item.brex_accounts.find_by!(account_id: BrexAccount.card_account_id).account_kind
+  end
+
+  test "counts only newly stored transactions as imported" do
+    @brex_account.update!(
+      raw_transactions_payload: [
+        {
+          id: "cash_tx_1",
+          amount: { amount: 12_34, currency: "USD" },
+          description: "Existing wire fee",
+          posted_at_date: "2026-01-02"
+        }
+      ]
+    )
+
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(accounts: [ cash_account_payload ])
+    provider.expects(:get_cash_transactions).with("cash_1", start_date: anything).returns(
+      transactions: [
+        {
+          id: "cash_tx_1",
+          amount: { amount: 12_34, currency: "USD" },
+          description: "Existing wire fee",
+          posted_at_date: "2026-01-02"
+        },
+        {
+          id: "cash_tx_2",
+          amount: { amount: 56_78, currency: "USD" },
+          description: "New wire fee",
+          posted_at_date: "2026-01-03"
+        }
+      ]
+    )
+
+    result = BrexItem::Importer.new(@brex_item, brex_provider: provider, sync_start_date: Date.new(2026, 1, 1)).import
+
+    assert result[:success]
+    assert_equal 1, result[:transactions_imported]
+    assert_equal [ "cash_tx_1", "cash_tx_2" ], @brex_account.reload.raw_transactions_payload.map { |tx| tx["id"] }
+  end
+
+  test "keeps raw transaction snapshots bounded to the sync window" do
+    @brex_account.update!(
+      raw_transactions_payload: [
+        {
+          id: "old_cash_tx",
+          amount: { amount: 12_34, currency: "USD" },
+          description: "Old wire fee",
+          posted_at_date: "2025-12-01"
+        },
+        {
+          id: "recent_cash_tx",
+          amount: { amount: 56_78, currency: "USD" },
+          description: "Recent wire fee",
+          posted_at_date: "2026-01-02"
+        }
+      ]
+    )
+
+    sync_start_date = Date.new(2026, 1, 1)
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(accounts: [ cash_account_payload ])
+    provider.expects(:get_cash_transactions).with("cash_1", start_date: sync_start_date).returns(
+      transactions: [
+        {
+          id: "ignored_before_window",
+          amount: { amount: 1_00, currency: "USD" },
+          description: "Ignored old transaction",
+          posted_at_date: "2025-12-31"
+        },
+        {
+          id: "new_cash_tx",
+          amount: { amount: 2_00, currency: "USD" },
+          description: "New transaction",
+          posted_at_date: "2026-01-03"
+        }
+      ]
+    )
+
+    result = BrexItem::Importer.new(@brex_item, brex_provider: provider, sync_start_date: sync_start_date).import
+
+    assert result[:success]
+    assert_equal 1, result[:transactions_imported]
+    assert_equal [ "recent_cash_tx", "new_cash_tx" ], @brex_account.reload.raw_transactions_payload.map { |tx| tx["id"] }
+  end
+
+  test "uses explicit sync start date for cash and card transaction fetches" do
+    card_account = @family.accounts.create!(
+      name: "Brex Card",
+      balance: 0,
+      currency: "USD",
+      accountable: CreditCard.new
+    )
+    brex_card_account = @brex_item.brex_accounts.create!(
+      account_id: BrexAccount.card_account_id,
+      account_kind: "card",
+      name: "Brex Card",
+      currency: "USD",
+      current_balance: 0
+    )
+    AccountProvider.create!(account: card_account, provider: brex_card_account)
+
+    sync_start_date = Date.new(2026, 2, 1)
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(accounts: [ cash_account_payload, card_account_payload ])
+    provider.expects(:get_cash_transactions).with("cash_1", start_date: sync_start_date).returns(transactions: [])
+    provider.expects(:get_primary_card_transactions).with(start_date: sync_start_date).returns(transactions: [])
+
+    result = BrexItem::Importer.new(
+      @brex_item,
+      brex_provider: provider,
+      sync_start_date: sync_start_date
+    ).import
+
+    assert result[:success]
+  end
+
+  test "imports aggregate card transactions only into the selected connection" do
+    first_card_account = @family.accounts.create!(
+      name: "First Brex Card",
+      balance: 0,
+      currency: "USD",
+      accountable: CreditCard.new
+    )
+    first_brex_card_account = @brex_item.brex_accounts.create!(
+      account_id: BrexAccount.card_account_id,
+      account_kind: "card",
+      name: "First Brex Card",
+      currency: "USD",
+      current_balance: 0
+    )
+    AccountProvider.create!(account: first_card_account, provider: first_brex_card_account)
+
+    second_item = BrexItem.create!(
+      family: @family,
+      name: "Second Brex",
+      token: "second_brex_token",
+      base_url: "https://api.brex.com"
+    )
+    second_card_account = @family.accounts.create!(
+      name: "Second Brex Card",
+      balance: 0,
+      currency: "USD",
+      accountable: CreditCard.new
+    )
+    second_brex_card_account = second_item.brex_accounts.create!(
+      account_id: BrexAccount.card_account_id,
+      account_kind: "card",
+      name: "Second Brex Card",
+      currency: "USD",
+      current_balance: 0,
+      raw_transactions_payload: [
+        {
+          id: "second_connection_card_tx",
+          amount: { amount: 42_00, currency: "USD" },
+          description: "Existing second connection card transaction",
+          posted_at_date: "2026-02-01"
+        }
+      ]
+    )
+    AccountProvider.create!(account: second_card_account, provider: second_brex_card_account)
+
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(accounts: [ cash_account_payload, card_account_payload ])
+    provider.expects(:get_cash_transactions).with("cash_1", start_date: anything).returns(transactions: [])
+    provider.expects(:get_primary_card_transactions).with(start_date: anything).returns(
+      transactions: [
+        {
+          id: "first_connection_card_tx",
+          amount: { amount: 21_00, currency: "USD" },
+          description: "First connection card transaction",
+          posted_at_date: "2026-02-02",
+          card_id: "card_account_1"
+        }
+      ]
+    )
+
+    result = BrexItem::Importer.new(@brex_item, brex_provider: provider, sync_start_date: Date.new(2026, 2, 1)).import
+
+    assert result[:success]
+    assert_equal [ "first_connection_card_tx" ], first_brex_card_account.reload.raw_transactions_payload.map { |tx| tx["id"] }
+    assert_equal [ "second_connection_card_tx" ], second_brex_card_account.reload.raw_transactions_payload.map { |tx| tx["id"] }
+  end
+
+  test "raises and reports snapshot persistence failures" do
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(accounts: [ cash_account_payload ])
+    @brex_item.expects(:upsert_brex_snapshot!).raises(StandardError.new("snapshot failed"))
+
+    error = assert_raises StandardError do
+      BrexItem::Importer.new(@brex_item, brex_provider: provider).import
+    end
+
+    assert_equal "snapshot failed", error.message
+  end
+
+  test "marks item as requiring update on authorization errors" do
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).raises(
+      Provider::Brex::BrexError.new("Access forbidden", :access_forbidden, http_status: 403, trace_id: "trace_123")
+    )
+
+    result = BrexItem::Importer.new(@brex_item, brex_provider: provider).import
+
+    refute result[:success]
+    assert @brex_item.reload.requires_update?
+  end
+
+  test "clears requires update after a clean import" do
+    @brex_item.update!(status: :requires_update)
+
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(accounts: [ cash_account_payload ])
+    provider.expects(:get_cash_transactions).with("cash_1", start_date: anything).returns(transactions: [])
+
+    result = BrexItem::Importer.new(@brex_item, brex_provider: provider).import
+
+    assert result[:success]
+    assert @brex_item.reload.good?
+  end
+
+  test "refreshes already discovered unlinked accounts during import" do
+    unlinked_account = @brex_item.brex_accounts.create!(
+      account_id: "cash_unlinked_1",
+      account_kind: "cash",
+      name: "Old Unlinked Cash",
+      currency: "USD",
+      current_balance: 1
+    )
+
+    provider = mock("brex_provider")
+    provider.expects(:get_accounts).returns(
+      accounts: [
+        cash_account_payload,
+        cash_account_payload.merge(
+          id: "cash_unlinked_1",
+          name: "Updated Unlinked Cash",
+          current_balance: { amount: 987_65, currency: "USD" }
+        )
+      ]
+    )
+    provider.expects(:get_cash_transactions).with("cash_1", start_date: anything).returns(transactions: [])
+
+    result = BrexItem::Importer.new(@brex_item, brex_provider: provider).import
+
+    assert result[:success]
+    assert_equal 2, result[:accounts_updated]
+    assert_equal "Updated Unlinked Cash", unlinked_account.reload.name
+    assert_equal BigDecimal("987.65"), unlinked_account.current_balance
+  end
+
+  private
+
+    def cash_account_payload
+      {
+        id: "cash_1",
+        name: "Operating Cash",
+        account_kind: "cash",
+        status: "ACTIVE",
+        current_balance: { amount: 120_000, currency: "USD" },
+        available_balance: { amount: 110_000, currency: "USD" },
+        account_number: "account-last4-9012",
+        routing_number: "routing-last4-0021"
+      }
+    end
+
+    def card_account_payload
+      {
+        id: BrexAccount.card_account_id,
+        name: "Brex Card",
+        account_kind: "card",
+        status: "ACTIVE",
+        current_balance: { amount: 1_234, currency: "USD" },
+        available_balance: { amount: 100_000, currency: "USD" },
+        account_limit: { amount: 150_000, currency: "USD" },
+        raw_card_accounts: [
+          {
+            id: "card_account_1",
+            card_metadata: {
+              pan: "test-pan-placeholder"
+            }
+          }
+        ]
+      }
+    end
+end
diff --git a/test/models/brex_item/syncer_test.rb b/test/models/brex_item/syncer_test.rb
new file mode 100644
index 000000000..ce192c5a5
--- /dev/null
+++ b/test/models/brex_item/syncer_test.rb
@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class BrexItem::SyncerTest < ActiveSupport::TestCase
+  setup do
+    @brex_item = brex_items(:one)
+    @syncer = BrexItem::Syncer.new(@brex_item)
+  end
+
+  test "passes sync window start date to importer" do
+    window_start_date = Date.new(2026, 2, 1)
+    sync = mock_sync(window_start_date: window_start_date)
+
+    @brex_item.expects(:import_latest_brex_data).with(sync_start_date: window_start_date).once
+
+    @syncer.perform_sync(sync)
+  end
+
+  test "records localized setup status text and counts" do
+    window_start_date = Date.new(2026, 2, 1)
+    sync = recording_sync(window_start_date: window_start_date)
+
+    @brex_item.expects(:import_latest_brex_data).with(sync_start_date: window_start_date).once
+
+    @syncer.perform_sync(sync)
+
+    assert_equal [
+      I18n.t("brex_items.syncer.importing_accounts"),
+      I18n.t("brex_items.syncer.checking_account_configuration"),
+      I18n.t("brex_items.syncer.accounts_need_setup", count: 1)
+    ], sync.updates.filter_map { |attrs| attrs[:status_text] }
+
+    assert_equal 1, sync.sync_stats["total_accounts"]
+    assert_equal 0, sync.sync_stats["linked_accounts"]
+    assert_equal 1, sync.sync_stats["unlinked_accounts"]
+  end
+
+  test "records importer failure counts in health stats" do
+    sync = recording_sync(window_start_date: Date.new(2026, 2, 1))
+    @brex_item.expects(:import_latest_brex_data).returns(
+      success: false,
+      accounts_failed: 2,
+      transactions_failed: 1
+    )
+
+    @syncer.perform_sync(sync)
+
+    assert_equal 2, sync.sync_stats["total_errors"]
+    assert_equal [
+      I18n.t("brex_items.syncer.accounts_failed", count: 2),
+      I18n.t("brex_items.syncer.transactions_failed", count: 1)
+    ], sync.sync_stats["errors"].map { |error| error["message"] }
+  end
+
+  test "records account processing and scheduling failures in health stats" do
+    account = @brex_item.family.accounts.create!(
+      name: "Linked Brex Checking",
+      balance: 0,
+      currency: "USD",
+      accountable: Depository.new
+    )
+    brex_account = @brex_item.brex_accounts.first
+    AccountProvider.create!(account: account, provider: brex_account)
+
+    sync = recording_sync(window_start_date: Date.new(2026, 2, 1))
+    @brex_item.expects(:import_latest_brex_data).returns(
+      success: true,
+      accounts_failed: 0,
+      transactions_failed: 0
+    )
+    @brex_item.expects(:process_accounts).returns([
+      { brex_account_id: brex_account.id, success: false, error: "processing failure" }
+    ])
+    @brex_item.expects(:schedule_account_syncs).returns([
+      { account_id: account.id, success: false, error: "scheduling failure" }
+    ])
+
+    @syncer.perform_sync(sync)
+
+    assert_equal 2, sync.sync_stats["total_errors"]
+    assert_equal [
+      I18n.t("brex_items.syncer.account_processing_failed", count: 1),
+      I18n.t("brex_items.syncer.account_sync_failed", count: 1)
+    ], sync.sync_stats["errors"].map { |error| error["message"] }
+  end
+
+  test "raises user safe credential error for Brex auth failures" do
+    sync = mock_sync(window_start_date: Date.new(2026, 2, 1))
+    @brex_item.expects(:import_latest_brex_data)
+              .raises(Provider::Brex::BrexError.new("raw upstream auth body", :unauthorized, http_status: 401))
+    Sentry.expects(:capture_exception)
+
+    error = assert_raises(BrexItem::Syncer::SafeSyncError) do
+      @syncer.perform_sync(sync)
+    end
+
+    assert_equal I18n.t("brex_items.syncer.credentials_invalid"), error.message
+  end
+
+  private
+
+    def mock_sync(window_start_date:)
+      sync = mock("sync")
+      sync.stubs(:respond_to?).with(:status_text).returns(true)
+      sync.stubs(:respond_to?).with(:sync_stats).returns(true)
+      sync.stubs(:sync_stats).returns({})
+      sync.stubs(:window_start_date).returns(window_start_date)
+      sync.stubs(:window_end_date).returns(nil)
+      sync.stubs(:update!)
+      sync
+    end
+
+    def recording_sync(window_start_date:)
+      Class.new do
+        attr_accessor :sync_stats, :status_text
+        attr_reader :updates
+
+        define_method(:initialize) do |start_date|
+          @window_start_date = start_date
+          @window_end_date = nil
+          @created_at = Time.current
+          @sync_stats = {}
+          @updates = []
+        end
+
+        attr_reader :window_start_date, :window_end_date, :created_at
+
+        def update!(attributes)
+          @updates << attributes
+          self.sync_stats = attributes[:sync_stats] if attributes.key?(:sync_stats)
+          self.status_text = attributes[:status_text] if attributes.key?(:status_text)
+        end
+      end.new(window_start_date)
+    end
+end
diff --git a/test/models/brex_item_test.rb b/test/models/brex_item_test.rb
new file mode 100644
index 000000000..9d454b2fd
--- /dev/null
+++ b/test/models/brex_item_test.rb
@@ -0,0 +1,198 @@
+require "test_helper"
+
+class BrexItemTest < ActiveSupport::TestCase
+  def setup
+    @brex_item = brex_items(:one)
+  end
+
+  test "fixture is valid" do
+    assert @brex_item.valid?
+  end
+
+  test "belongs to family" do
+    assert_equal families(:dylan_family), @brex_item.family
+  end
+
+  test "credentials_configured returns true when token present" do
+    assert @brex_item.credentials_configured?
+  end
+
+  test "credentials_configured returns false when token blank" do
+    @brex_item.token = nil
+    assert_not @brex_item.credentials_configured?
+  end
+
+  test "credentials_configured returns false when token is whitespace" do
+    @brex_item.token = "   "
+    assert_not @brex_item.credentials_configured?
+  end
+
+  test "effective_base_url returns custom url when set" do
+    assert_equal "https://api-staging.brex.com", @brex_item.effective_base_url
+  end
+
+  test "effective_base_url returns default when base_url blank" do
+    @brex_item.base_url = nil
+    assert_equal "https://api.brex.com", @brex_item.effective_base_url
+  end
+
+  test "base_url accepts official Brex API roots" do
+    assert BrexItem.new(family: families(:empty), name: "Production", token: "token", base_url: "https://api.brex.com").valid?
+    assert BrexItem.new(family: families(:empty), name: "Staging", token: "token", base_url: "https://api-staging.brex.com").valid?
+  end
+
+  test "base_url normalizes official URL case and trailing slash" do
+    item = BrexItem.create!(
+      family: families(:empty),
+      name: "Normalized Brex",
+      token: "token",
+      base_url: " HTTPS://API.BREX.COM/ "
+    )
+
+    assert_equal "https://api.brex.com", item.base_url
+  end
+
+  test "token is stripped before validation and save" do
+    item = BrexItem.create!(
+      family: families(:empty),
+      name: "Token Normalized Brex",
+      token: "  normalized_token  ",
+      base_url: "https://api.brex.com"
+    )
+
+    assert_equal "normalized_token", item.token
+  end
+
+  test "token cannot be blanked on update" do
+    original_token = @brex_item.token
+
+    assert_raises(ActiveRecord::RecordInvalid) do
+      @brex_item.update!(token: "   ")
+    end
+
+    assert_equal original_token, @brex_item.reload.token
+    assert_includes @brex_item.errors[:token], "can't be blank"
+  end
+
+  test "base_url rejects non-Brex hosts and endpoint paths" do
+    [
+      "http://api.brex.com",
+      "https://evil.example.test",
+      "https://localhost",
+      "https://127.0.0.1",
+      "https://10.0.0.1",
+      "https://api.brex.com.evil.example",
+      "https://api.brex.com@127.0.0.1",
+      "https://api.brex.com:444",
+      "https://api.brex.com/v2",
+      "https://api.brex.com?debug=true",
+      "//api.brex.com"
+    ].each do |base_url|
+      item = BrexItem.new(family: families(:empty), name: "Invalid Brex", token: "token", base_url: base_url)
+
+      refute item.valid?, "Expected #{base_url.inspect} to be invalid"
+      assert_includes item.errors[:base_url], I18n.t("activerecord.errors.models.brex_item.attributes.base_url.official_hosts_only")
+    end
+  end
+
+  test "brex_provider returns Provider::Brex instance" do
+    provider = @brex_item.brex_provider
+    assert_instance_of Provider::Brex, provider
+    assert_equal @brex_item.token, provider.token
+  end
+
+  test "declares Brex token and raw payload as encrypted" do
+    skip "Encryption not configured" unless BrexItem.encryption_ready?
+
+    assert_includes BrexItem.encrypted_attributes.map(&:to_s), "token"
+    assert_includes BrexItem.encrypted_attributes.map(&:to_s), "raw_payload"
+  end
+
+  test "resolve for returns explicit credentialed item scoped to family" do
+    resolved = BrexItem.resolve_for(family: @brex_item.family, brex_item_id: " #{@brex_item.id} ")
+
+    assert_equal @brex_item, resolved
+  end
+
+  test "resolve for refuses explicit items without usable credentials" do
+    item = BrexItem.create!(
+      family: @brex_item.family,
+      name: "Blank Resolve Brex",
+      token: "temporary_token",
+      base_url: "https://api.brex.com"
+    )
+    item.update_column(:token, "   ")
+
+    assert_nil BrexItem.resolve_for(family: @brex_item.family, brex_item_id: item.id)
+  end
+
+  test "resolve for does not select one item when multiple credentialed items exist" do
+    BrexItem.create!(
+      family: @brex_item.family,
+      name: "Second Resolve Brex",
+      token: "second_resolve_token",
+      base_url: "https://api.brex.com"
+    )
+
+    assert_nil BrexItem.resolve_for(family: @brex_item.family)
+  end
+
+  test "schema requires name and token" do
+    columns = BrexItem.columns.index_by(&:name)
+
+    assert_equal false, columns["name"].null
+    assert_equal false, columns["token"].null
+  end
+
+  test "brex_provider returns nil when credentials not configured" do
+    @brex_item.token = nil
+    assert_nil @brex_item.brex_provider
+  end
+
+  test "brex_provider returns nil when persisted base_url is not allowed" do
+    @brex_item.update_column(:base_url, "https://evil.example.test")
+
+    assert_nil @brex_item.reload.brex_provider
+  end
+
+  test "family credential check ignores blank and scheduled for deletion items" do
+    family = families(:empty)
+    blank_item = BrexItem.create!(
+      family: family,
+      name: "Blank Brex",
+      token: "temporary_token",
+      base_url: "https://api-staging.brex.com"
+    )
+    blank_item.update_column(:token, "")
+
+    whitespace_item = BrexItem.create!(
+      family: family,
+      name: "Whitespace Brex",
+      token: "temporary_token",
+      base_url: "https://api-staging.brex.com"
+    )
+    whitespace_item.update_column(:token, "   ")
+
+    deleted_item = BrexItem.create!(
+      family: family,
+      name: "Deleted Brex",
+      token: "deleted_token",
+      base_url: "https://api-staging.brex.com",
+      scheduled_for_deletion: true
+    )
+
+    refute family.has_brex_credentials?
+
+    whitespace_item.update_column(:token, "configured_token")
+    assert family.has_brex_credentials?
+
+    whitespace_item.update_column(:token, "   ")
+    deleted_item.update!(scheduled_for_deletion: false)
+    assert family.has_brex_credentials?
+  end
+
+  test "syncer returns BrexItem::Syncer instance" do
+    syncer = @brex_item.send(:syncer)
+    assert_instance_of BrexItem::Syncer, syncer
+  end
+end
diff --git a/test/models/budget_category_test.rb b/test/models/budget_category_test.rb
index d0f0b71a6..d6408c530 100644
--- a/test/models/budget_category_test.rb
+++ b/test/models/budget_category_test.rb
@@ -169,4 +169,90 @@ class BudgetCategoryTest < ActiveSupport::TestCase
     assert_equal 20, @subcategory_with_limit_bc.reload.budgeted_spending
     assert_equal 50, @subcategory_inheriting_bc.reload.budgeted_spending
   end
+
+  test "budgeted? returns true only when display_budgeted_spending > 0" do
+    @subcategory_with_limit_bc.stubs(:display_budgeted_spending).returns(100)
+    assert @subcategory_with_limit_bc.budgeted?
+
+    @subcategory_with_limit_bc.stubs(:display_budgeted_spending).returns(0)
+    refute @subcategory_with_limit_bc.budgeted?
+
+    @subcategory_with_limit_bc.stubs(:display_budgeted_spending).returns(nil)
+    refute @subcategory_with_limit_bc.budgeted?
+  end
+
+  test "unbudgeted_with_spending? is true only when not budgeted and has spending" do
+    @subcategory_with_limit_bc.stubs(:budgeted?).returns(false)
+    @subcategory_with_limit_bc.stubs(:actual_spending).returns(10)
+    assert @subcategory_with_limit_bc.unbudgeted_with_spending?
+
+    @subcategory_with_limit_bc.stubs(:budgeted?).returns(true)
+    assert_not @subcategory_with_limit_bc.unbudgeted_with_spending?
+
+    @subcategory_with_limit_bc.stubs(:budgeted?).returns(false)
+    @subcategory_with_limit_bc.stubs(:actual_spending).returns(0)
+    assert_not @subcategory_with_limit_bc.unbudgeted_with_spending?
+
+    @subcategory_with_limit_bc.stubs(:actual_spending).returns(nil)
+    assert_not @subcategory_with_limit_bc.unbudgeted_with_spending?
+  end
+
+  test "over_budget_with_budget? requires both budgeted and over_budget" do
+    @subcategory_with_limit_bc.stubs(:budgeted?).returns(true)
+    @subcategory_with_limit_bc.stubs(:over_budget?).returns(true)
+    assert @subcategory_with_limit_bc.over_budget_with_budget?
+
+    @subcategory_with_limit_bc.stubs(:over_budget?).returns(false)
+    assert_not @subcategory_with_limit_bc.over_budget_with_budget?
+
+    @subcategory_with_limit_bc.stubs(:budgeted?).returns(false)
+    @subcategory_with_limit_bc.stubs(:over_budget?).returns(true)
+    assert_not @subcategory_with_limit_bc.over_budget_with_budget?
+  end
+
+  test "on_track? is true only when budgeted and not over_budget" do
+    @subcategory_with_limit_bc.stubs(:budgeted?).returns(true)
+    @subcategory_with_limit_bc.stubs(:over_budget?).returns(false)
+    assert @subcategory_with_limit_bc.on_track?
+
+    @subcategory_with_limit_bc.stubs(:over_budget?).returns(true)
+    assert_not @subcategory_with_limit_bc.on_track?
+
+    @subcategory_with_limit_bc.stubs(:budgeted?).returns(false)
+    @subcategory_with_limit_bc.stubs(:over_budget?).returns(false)
+    assert_not @subcategory_with_limit_bc.on_track?
+  end
+
+  test "any_over_budget? is true if either condition is true" do
+    @subcategory_with_limit_bc.stubs(:unbudgeted_with_spending?).returns(true)
+    @subcategory_with_limit_bc.stubs(:over_budget_with_budget?).returns(false)
+    assert @subcategory_with_limit_bc.any_over_budget?
+
+    @subcategory_with_limit_bc.stubs(:unbudgeted_with_spending?).returns(false)
+    @subcategory_with_limit_bc.stubs(:over_budget_with_budget?).returns(true)
+    assert @subcategory_with_limit_bc.any_over_budget?
+
+    @subcategory_with_limit_bc.stubs(:unbudgeted_with_spending?).returns(false)
+    @subcategory_with_limit_bc.stubs(:over_budget_with_budget?).returns(false)
+    assert_not @subcategory_with_limit_bc.any_over_budget?
+  end
+
+  test "visible_on_track? behavior for different category types" do
+    # 1. not on_track => always false
+    @subcategory_with_limit_bc.stubs(:on_track?).returns(false)
+    assert_not @subcategory_with_limit_bc.visible_on_track?
+
+    # 2. normal category (not subcategory) => true if on_track
+    @parent_budget_category.stubs(:on_track?).returns(true)
+    assert @parent_budget_category.visible_on_track?
+
+    # 3. subcategory inheriting, no spending => hidden
+    @subcategory_inheriting_bc.stubs(:on_track?).returns(true)
+    @subcategory_inheriting_bc.stubs(:actual_spending).returns(0)
+    assert_not @subcategory_inheriting_bc.visible_on_track?
+
+    # 4. subcategory inheriting, has spending => visible
+    @subcategory_inheriting_bc.stubs(:actual_spending).returns(10)
+    assert @subcategory_inheriting_bc.visible_on_track?
+  end
 end
diff --git a/test/models/budget_test.rb b/test/models/budget_test.rb
index 13f8f5a2b..56e791e75 100644
--- a/test/models/budget_test.rb
+++ b/test/models/budget_test.rb
@@ -58,8 +58,35 @@ class BudgetTest < ActiveSupport::TestCase
     refute Budget.budget_date_valid?(3.years.ago.beginning_of_month, family: @family)
   end
 
-  test "budget_date_valid? does not allow future dates beyond current month" do
-    refute Budget.budget_date_valid?(2.months.from_now, family: @family)
+  test "budget_date_valid? allows future dates up to 2 years ahead" do
+    travel_to Date.current.beginning_of_month do
+      assert Budget.budget_date_valid?(Date.current.beginning_of_month + 1.month, family: @family)
+      assert Budget.budget_date_valid?(Date.current.beginning_of_month + 2.years, family: @family)
+    end
+  end
+
+  test "budget_date_valid? does not allow future dates beyond 2 years ahead" do
+    travel_to Date.current.beginning_of_month do
+      refute Budget.budget_date_valid?(Date.current.beginning_of_month + 2.years + 1.month, family: @family)
+    end
+  end
+
+  test "budget_date_valid? for custom month start allows dates up to 2 years ahead" do
+    @family.update!(month_start_day: 15)
+
+    travel_to Date.current.beginning_of_month do
+      cap_start = @family.current_custom_month_period.start_date + 2.years
+      assert Budget.budget_date_valid?(cap_start, family: @family)
+    end
+  end
+
+  test "budget_date_valid? for custom month start does not allow dates beyond 2 years ahead" do
+    @family.update!(month_start_day: 15)
+
+    travel_to Date.current.beginning_of_month do
+      beyond_cap = @family.current_custom_month_period.start_date + 2.years + 1.month
+      refute Budget.budget_date_valid?(beyond_cap, family: @family)
+    end
   end
 
   test "previous_budget_param returns nil when date is too old" do
@@ -75,6 +102,49 @@ class BudgetTest < ActiveSupport::TestCase
     assert_nil budget.previous_budget_param
   end
 
+  test "next_budget_param returns next month when current month budget is selected" do
+    travel_to Date.current.beginning_of_month do
+      budget = Budget.create!(
+        family: @family,
+        start_date: Date.current.beginning_of_month,
+        end_date: Date.current.end_of_month,
+        currency: "USD"
+      )
+
+      assert_equal Budget.date_to_param(Date.current.beginning_of_month + 1.month), budget.next_budget_param
+    end
+  end
+
+  test "next_budget_param returns nil at future cap" do
+    travel_to Date.current.beginning_of_month do
+      cap_start = Date.current.beginning_of_month + 2.years
+      budget = Budget.create!(
+        family: @family,
+        start_date: cap_start,
+        end_date: cap_start.end_of_month,
+        currency: "USD"
+      )
+
+      assert_nil budget.next_budget_param
+    end
+  end
+
+  test "next_budget_param returns nil at future cap for custom month start" do
+    @family.update!(month_start_day: 15)
+
+    travel_to Date.current.beginning_of_month do
+      cap_start = @family.current_custom_month_period.start_date + 2.years
+      budget = Budget.create!(
+        family: @family,
+        start_date: cap_start,
+        end_date: cap_start + 1.month - 1.day,
+        currency: "USD"
+      )
+
+      assert_nil budget.next_budget_param
+    end
+  end
+
   test "actual_spending nets refunds against expenses in same category" do
     family = families(:dylan_family)
     budget = Budget.find_or_bootstrap(family, start_date: Date.current.beginning_of_month)
@@ -155,6 +225,61 @@ class BudgetTest < ActiveSupport::TestCase
     )
   end
 
+  test "to_donut_segments_json only includes top-level budget categories" do
+    family = @family
+    budget = Budget.find_or_bootstrap(family, start_date: Date.current.beginning_of_month)
+    budget.update!(budgeted_spending: 500, currency: family.currency)
+
+    parent_category = Category.create!(
+      name: "Transport #{Time.now.to_f}",
+      family: family,
+      color: "#6471eb"
+    )
+
+    child_category = Category.create!(
+      name: "Petrol #{Time.now.to_f}",
+      family: family,
+      parent: parent_category,
+      color: "#61c9ea"
+    )
+
+    standalone_category = Category.create!(
+      name: "Shopping #{Time.now.to_f}",
+      family: family,
+      color: "#df4e92"
+    )
+
+    budget.sync_budget_categories
+
+    parent_budget_category = budget.budget_categories.find_by!(category: parent_category)
+    child_budget_category = budget.budget_categories.find_by!(category: child_category)
+    standalone_budget_category = budget.budget_categories.find_by!(category: standalone_category)
+
+    parent_budget_category.update!(budgeted_spending: 150, currency: family.currency)
+    child_budget_category.update!(budgeted_spending: 50, currency: family.currency)
+    standalone_budget_category.update!(budgeted_spending: 100, currency: family.currency)
+
+    budget.stubs(:allocations_valid?).returns(true)
+    budget.stubs(:available_to_spend).returns(200)
+    budget.stubs(:budget_category_actual_spending).with(parent_budget_category).returns(63.11)
+    budget.stubs(:budget_category_actual_spending).with(standalone_budget_category).returns(25)
+
+    segments = budget.to_donut_segments_json
+
+    segment_ids = segments.pluck(:id)
+    segments_by_id = segments.index_by { |segment| segment[:id] }
+
+    assert_equal 3, segments.size
+    assert_includes segment_ids, parent_budget_category.id
+    assert_includes segment_ids, standalone_budget_category.id
+    assert_includes segment_ids, "unused"
+    refute_includes segment_ids, child_budget_category.id
+
+    assert_equal 63.11, segments_by_id[parent_budget_category.id][:amount]
+    assert_equal 25, segments_by_id[standalone_budget_category.id][:amount]
+    assert_equal 200, segments_by_id["unused"][:amount]
+  end
+
   test "actual_spending subtracts uncategorized refunds" do
     family = families(:dylan_family)
     budget = Budget.find_or_bootstrap(family, start_date: Date.current.beginning_of_month)
diff --git a/test/models/chat_test.rb b/test/models/chat_test.rb
index 93ddcf43f..ed0ef3267 100644
--- a/test/models/chat_test.rb
+++ b/test/models/chat_test.rb
@@ -18,14 +18,25 @@ class ChatTest < ActiveSupport::TestCase
     assert_equal 3, chat.conversation_messages.count
   end
 
+  test "uses chat-scoped stream targets" do
+    first_chat = chats(:one)
+    second_chat = chats(:two)
+
+    assert_not_equal "messages", first_chat.messages_target
+    assert_not_equal "chat-error", first_chat.error_target
+    assert_not_equal first_chat.messages_target, second_chat.messages_target
+    assert_not_equal first_chat.error_target, second_chat.error_target
+  end
+
   test "creates with initial message" do
     prompt = "Test prompt"
 
     assert_difference "@user.chats.count", 1 do
       chat = @user.chats.start!(prompt, model: "gpt-4.1")
 
-      assert_equal 1, chat.messages.count
+      assert_equal 2, chat.messages.count
       assert_equal 1, chat.messages.where(type: "UserMessage").count
+      assert_equal 1, chat.messages.where(type: "AssistantMessage", status: "pending").count
     end
   end
 
@@ -35,8 +46,8 @@ class ChatTest < ActiveSupport::TestCase
     assert_difference "@user.chats.count", 1 do
       chat = @user.chats.start!(prompt, model: nil)
 
-      assert_equal 1, chat.messages.count
-      assert_equal Provider::Openai::DEFAULT_MODEL, chat.messages.first.ai_model
+      assert_equal 2, chat.messages.count
+      assert_equal Provider::Openai::DEFAULT_MODEL, chat.messages.find_by!(type: "UserMessage").ai_model
     end
   end
 
@@ -46,8 +57,8 @@ class ChatTest < ActiveSupport::TestCase
     assert_difference "@user.chats.count", 1 do
       chat = @user.chats.start!(prompt, model: "")
 
-      assert_equal 1, chat.messages.count
-      assert_equal Provider::Openai::DEFAULT_MODEL, chat.messages.first.ai_model
+      assert_equal 2, chat.messages.count
+      assert_equal Provider::Openai::DEFAULT_MODEL, chat.messages.find_by!(type: "UserMessage").ai_model
     end
   end
 
@@ -57,7 +68,59 @@ class ChatTest < ActiveSupport::TestCase
     with_env_overrides OPENAI_MODEL: "custom-model" do
       chat = @user.chats.start!(prompt, model: "")
 
-      assert_equal "custom-model", chat.messages.first.ai_model
+      assert_equal "custom-model", chat.messages.find_by!(type: "UserMessage").ai_model
     end
   end
+
+  test "returns nil presentable error message when no error is stored" do
+    chat = chats(:one)
+
+    chat.update!(error: nil)
+
+    assert_nil chat.presentable_error_message
+  end
+
+  test "surfaces a friendly rate limit error" do
+    chat = chats(:one)
+
+    chat.add_error(StandardError.new("OpenAI API error 429: rate limit exceeded"))
+
+    assert_equal I18n.t("chat.errors.rate_limited"), chat.presentable_error_message
+    assert_match "429", chat.technical_error_message
+  end
+
+  test "surfaces a friendly temporary provider error" do
+    chat = chats(:one)
+
+    chat.add_error(StandardError.new("OpenAI API error 503: service unavailable"))
+
+    assert_equal I18n.t("chat.errors.temporarily_unavailable"), chat.presentable_error_message
+    assert_match "503", chat.technical_error_message
+  end
+
+  test "surfaces a friendly auth configuration error" do
+    chat = chats(:one)
+
+    chat.add_error(StandardError.new("OpenAI API error: invalid api key"))
+
+    assert_equal I18n.t("chat.errors.misconfigured"), chat.presentable_error_message
+    assert_match "invalid api key", chat.technical_error_message
+  end
+
+  test "surfaces a friendly default error for unrecognized errors" do
+    chat = chats(:one)
+
+    chat.add_error(StandardError.new("something totally unknown happened"))
+
+    assert_equal I18n.t("chat.errors.default"), chat.presentable_error_message
+  end
+
+  test "falls back to a friendly message for legacy serialized errors" do
+    chat = chats(:one)
+
+    chat.update!(error: "OpenAI API error 429: rate limit exceeded".to_json)
+
+    assert_equal I18n.t("chat.errors.rate_limited"), chat.presentable_error_message
+    assert_equal "OpenAI API error 429: rate limit exceeded", chat.technical_error_message
+  end
 end
diff --git a/test/models/coinstats_account_test.rb b/test/models/coinstats_account_test.rb
index 804f79e33..7ff88468d 100644
--- a/test/models/coinstats_account_test.rb
+++ b/test/models/coinstats_account_test.rb
@@ -291,6 +291,20 @@ class CoinstatsAccountTest < ActiveSupport::TestCase
     assert_nil CoinstatsAccount.find_by(id: wallet_a.id)
   end
 
+  test "defi_source? returns true when source is defi" do
+    @coinstats_account.update!(raw_payload: { source: "defi", address: "0x123", blockchain: "ethereum" })
+    assert @coinstats_account.defi_source?
+    refute @coinstats_account.wallet_source?
+  end
+
+  test "wallet_source? returns true for wallet with address and blockchain, false for defi" do
+    @coinstats_account.update!(raw_payload: { address: "0x123", blockchain: "ethereum" })
+    assert @coinstats_account.wallet_source?
+
+    @coinstats_account.update!(raw_payload: { source: "defi", address: "0x123", blockchain: "ethereum" })
+    refute @coinstats_account.wallet_source?
+  end
+
   test "portfolio exchange account derives total and cash balances from embedded coins" do
     @family.update!(currency: "EUR")
 
diff --git a/test/models/coinstats_item/importer_test.rb b/test/models/coinstats_item/importer_test.rb
index 96ccafc0d..af4436bb3 100644
--- a/test/models/coinstats_item/importer_test.rb
+++ b/test/models/coinstats_item/importer_test.rb
@@ -10,6 +10,8 @@ class CoinstatsItem::ImporterTest < ActiveSupport::TestCase
     )
 
     @mock_provider = mock("Provider::Coinstats")
+    # Stub DeFi endpoint globally — individual tests override if needed
+    @mock_provider.stubs(:get_wallet_defi).returns(success_response({ protocols: [] }))
   end
 
   # Helper to wrap data in Provider::Response
@@ -592,4 +594,218 @@ class CoinstatsItem::ImporterTest < ActiveSupport::TestCase
     assert_equal 5000.0, coinstats_account1.current_balance.to_f  # 2.0 * 2500
     assert_equal 4500.0, coinstats_account2.current_balance.to_f  # 0.1 * 45000
   end
+
+  # DeFi / staking tests
+
+  test "creates DeFi account with balance equal to total position value, not quantity * price" do
+    crypto = Crypto.create!
+    account = @family.accounts.create!(
+      accountable: crypto,
+      name: "Ethereum Wallet",
+      balance: 1000,
+      currency: "USD"
+    )
+    coinstats_account = @coinstats_item.coinstats_accounts.create!(
+      name: "Ethereum (0x12...abc)",
+      currency: "USD",
+      account_id: "ethereum",
+      raw_payload: { address: "0x123abc", blockchain: "ethereum" }
+    )
+    AccountProvider.create!(account: account, provider: coinstats_account)
+
+    # DeFi response: 32 ETH staked, total position value = $70,272 (= 32 * $2196)
+    # The `price` field is TotalValueDto (total position value), NOT price per token.
+    defi_response = {
+      protocols: [
+        {
+          id: "lido",
+          name: "Lido",
+          logo: "https://example.com/lido.png",
+          investments: [
+            {
+              name: "Staking",
+              assets: [
+                {
+                  title: "Deposit",
+                  coinId: "ethereum",
+                  symbol: "ETH",
+                  amount: 32.0,
+                  price: { USD: 70272.0 }  # total value, not per-token
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+
+    @mock_provider.expects(:get_wallet_defi)
+      .with(address: "0x123abc", connection_id: "ethereum")
+      .returns(success_response(defi_response))
+
+    @mock_provider.stubs(:get_wallet_balances).returns(success_response([]))
+    @mock_provider.stubs(:extract_wallet_balance).returns([])
+    @mock_provider.stubs(:get_wallet_transactions).returns(success_response([]))
+    @mock_provider.stubs(:extract_wallet_transactions).returns([])
+
+    assert_difference "CoinstatsAccount.count", 1 do
+      assert_difference "Account.count", 1 do
+        CoinstatsItem::Importer.new(@coinstats_item, coinstats_provider: @mock_provider).import
+      end
+    end
+
+    defi_account = @coinstats_item.coinstats_accounts.find_by(account_id: "defi:ethereum:lido:staking:ethereum:deposit")
+    assert_not_nil defi_account
+    assert_equal "defi", defi_account.raw_payload["source"]
+    # Balance must be the total position value ($70,272), NOT 32 * $70,272
+    assert_equal 70272.0, defi_account.current_balance.to_f
+    assert_equal "ETH (Lido Staking)", defi_account.name
+  end
+
+  test "zeros out DeFi account when staking position is no longer active" do
+    crypto = Crypto.create!
+    account = @family.accounts.create!(
+      accountable: crypto,
+      name: "Ethereum Wallet",
+      balance: 1000,
+      currency: "USD"
+    )
+    wallet_account = @coinstats_item.coinstats_accounts.create!(
+      name: "Ethereum (0x12...abc)",
+      currency: "USD",
+      account_id: "ethereum",
+      raw_payload: { address: "0x123abc", blockchain: "ethereum" }
+    )
+    AccountProvider.create!(account: account, provider: wallet_account)
+
+    # Existing DeFi account from a previous sync
+    defi_crypto = Crypto.create!
+    defi_linked_account = @family.accounts.create!(
+      accountable: defi_crypto,
+      name: "ETH (Lido Staking)",
+      balance: 70272,
+      currency: "USD"
+    )
+    defi_account = @coinstats_item.coinstats_accounts.create!(
+      name: "ETH (Lido Staking)",
+      currency: "USD",
+      account_id: "defi:ethereum:lido:staking:ethereum:deposit",
+      wallet_address: "0x123abc",
+      current_balance: 70272,
+      raw_payload: {
+        source: "defi",
+        address: "0x123abc",
+        blockchain: "ethereum",
+        protocol_id: "lido",
+        amount: 32.0,
+        balance: 70272.0
+      }
+    )
+    AccountProvider.create!(account: defi_linked_account, provider: defi_account)
+
+    # DeFi response returns empty — position has been fully unstaked
+    @mock_provider.expects(:get_wallet_defi)
+      .with(address: "0x123abc", connection_id: "ethereum")
+      .returns(success_response({ protocols: [] }))
+
+    @mock_provider.stubs(:get_wallet_balances).returns(success_response([]))
+    @mock_provider.stubs(:extract_wallet_balance).returns([])
+    @mock_provider.stubs(:get_wallet_transactions).returns(success_response([]))
+    @mock_provider.stubs(:extract_wallet_transactions).returns([])
+
+    CoinstatsItem::Importer.new(@coinstats_item, coinstats_provider: @mock_provider).import
+
+    defi_account.reload
+    assert_equal 0.0, defi_account.current_balance.to_f
+  end
+
+  test "defi accounts are skipped in wallet update loop" do
+    crypto = Crypto.create!
+    account = @family.accounts.create!(
+      accountable: crypto,
+      name: "Ethereum Wallet",
+      balance: 1000,
+      currency: "USD"
+    )
+    wallet_account = @coinstats_item.coinstats_accounts.create!(
+      name: "Ethereum",
+      currency: "USD",
+      account_id: "ethereum",
+      raw_payload: { address: "0x123abc", blockchain: "ethereum" }
+    )
+    AccountProvider.create!(account: account, provider: wallet_account)
+
+    defi_crypto = Crypto.create!
+    defi_linked_account = @family.accounts.create!(
+      accountable: defi_crypto,
+      name: "ETH (Lido Staking)",
+      balance: 1000,
+      currency: "USD"
+    )
+    defi_account = @coinstats_item.coinstats_accounts.create!(
+      name: "ETH (Lido Staking)",
+      currency: "USD",
+      account_id: "defi:ethereum:lido:staking:ethereum:deposit",
+      wallet_address: "0x123abc",
+      current_balance: 1000,
+      raw_payload: {
+        source: "defi",
+        address: "0x123abc",
+        blockchain: "ethereum",
+        amount: 0.5,
+        balance: 1000.0
+      }
+    )
+    AccountProvider.create!(account: defi_linked_account, provider: defi_account)
+
+    # get_wallet_defi called once (for the one wallet), get_wallet_balances/transactions only
+    # called once despite two linked accounts (DeFi account excluded from wallet fetch)
+    @mock_provider.expects(:get_wallet_defi)
+      .with(address: "0x123abc", connection_id: "ethereum")
+      .once
+      .returns(success_response({ protocols: [] }))
+
+    @mock_provider.expects(:get_wallet_balances).with("ethereum:0x123abc").once
+      .returns(success_response([]))
+    @mock_provider.stubs(:extract_wallet_balance).returns([])
+    @mock_provider.expects(:get_wallet_transactions).with("ethereum:0x123abc").once
+      .returns(success_response([]))
+    @mock_provider.stubs(:extract_wallet_transactions).returns([])
+
+    result = CoinstatsItem::Importer.new(@coinstats_item, coinstats_provider: @mock_provider).import
+
+    assert result[:success]
+  end
+
+  test "propagates DeFi sync failure into accounts_failed count" do
+    crypto = Crypto.create!
+    account = @family.accounts.create!(
+      accountable: crypto,
+      name: "Ethereum Wallet",
+      balance: 1000,
+      currency: "USD"
+    )
+    coinstats_account = @coinstats_item.coinstats_accounts.create!(
+      name: "Ethereum",
+      currency: "USD",
+      account_id: "ethereum",
+      raw_payload: { address: "0x123abc", blockchain: "ethereum" }
+    )
+    AccountProvider.create!(account: account, provider: coinstats_account)
+
+    @mock_provider.expects(:get_wallet_defi)
+      .with(address: "0x123abc", connection_id: "ethereum")
+      .raises(Provider::Coinstats::Error.new("DeFi endpoint unavailable"))
+
+    @mock_provider.stubs(:get_wallet_balances).returns(success_response([]))
+    @mock_provider.stubs(:extract_wallet_balance).returns([])
+    @mock_provider.stubs(:get_wallet_transactions).returns(success_response([]))
+    @mock_provider.stubs(:extract_wallet_transactions).returns([])
+
+    result = CoinstatsItem::Importer.new(@coinstats_item, coinstats_provider: @mock_provider).import
+
+    # Wallet account still updated, but DeFi failure is counted
+    assert_equal 1, result[:accounts_failed]
+    refute result[:success]
+  end
 end
diff --git a/test/models/debug_log_entry_test.rb b/test/models/debug_log_entry_test.rb
new file mode 100644
index 000000000..47cdb6291
--- /dev/null
+++ b/test/models/debug_log_entry_test.rb
@@ -0,0 +1,20 @@
+require "test_helper"
+
+class DebugLogEntryTest < ActiveSupport::TestCase
+  test "capture infers provider key and family from account" do
+    entry = DebugLogEntry.capture(
+      category: "provider_sync",
+      level: "warn",
+      message: "Provider event",
+      source: "Provider::Test",
+      account: accounts(:depository),
+      provider: :twelve_data,
+      metadata: { test: true }
+    )
+
+    assert entry.persisted?
+    assert_equal "twelve_data", entry.provider_key
+    assert_equal accounts(:depository), entry.account
+    assert_equal accounts(:depository).family, entry.family
+  end
+end
diff --git a/test/models/enable_banking_account/processor_test.rb b/test/models/enable_banking_account/processor_test.rb
new file mode 100644
index 000000000..6bdbebda1
--- /dev/null
+++ b/test/models/enable_banking_account/processor_test.rb
@@ -0,0 +1,89 @@
+require "test_helper"
+
+class EnableBankingAccount::ProcessorTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @account = accounts(:depository)
+    @enable_banking_item = EnableBankingItem.create!(
+      family: @family,
+      name: "Test EB",
+      country_code: "FR",
+      application_id: "app_id",
+      client_certificate: "cert"
+    )
+    @enable_banking_account = EnableBankingAccount.create!(
+      enable_banking_item: @enable_banking_item,
+      name: "Compte courant",
+      uid: "hash_abc",
+      currency: "EUR",
+      current_balance: 1500.00
+    )
+    AccountProvider.create!(account: @account, provider: @enable_banking_account)
+  end
+
+  test "calls set_current_balance instead of direct account update" do
+    EnableBankingAccount::Processor.new(@enable_banking_account).process
+
+    assert_equal 1500.0, @account.reload.cash_balance
+  end
+
+  test "updates account currency" do
+    @enable_banking_account.update!(currency: "USD")
+
+    EnableBankingAccount::Processor.new(@enable_banking_account).process
+
+    assert_equal "USD", @account.reload.currency
+  end
+
+  test "does nothing when no linked account" do
+    @account.account_providers.destroy_all
+
+    result = EnableBankingAccount::Processor.new(@enable_banking_account).process
+    assert_nil result
+  end
+
+  test "sets CC balance to available_credit when credit_limit is present" do
+    cc_account = accounts(:credit_card)
+    @enable_banking_account.update!(
+      current_balance: 450.00,
+      credit_limit: 1000.00
+    )
+    AccountProvider.find_by(provider: @enable_banking_account)&.destroy
+    AccountProvider.create!(account: cc_account, provider: @enable_banking_account)
+
+    EnableBankingAccount::Processor.new(@enable_banking_account).process
+
+    assert_equal 550.0, cc_account.reload.cash_balance
+    if cc_account.accountable.respond_to?(:available_credit)
+      assert_equal 550.0, cc_account.accountable.reload.available_credit
+    end
+  end
+
+  test "falls back to stored available_credit when credit_limit is absent" do
+    cc_account = accounts(:credit_card)
+    cc_account.accountable.update!(available_credit: 1000.0)
+
+    @enable_banking_account.update!(current_balance: 300.00, credit_limit: nil)
+
+    AccountProvider.find_by(provider: @enable_banking_account)&.destroy
+    AccountProvider.create!(account: cc_account, provider: @enable_banking_account)
+
+    EnableBankingAccount::Processor.new(@enable_banking_account).process
+
+    assert_equal 700.0, cc_account.reload.cash_balance
+  end
+
+  test "sets CC balance to raw outstanding when credit_limit is absent" do
+    cc_account = accounts(:credit_card)
+    cc_account.accountable.update!(available_credit: nil)
+
+    @enable_banking_account.update!(current_balance: 300.00, credit_limit: nil)
+
+    AccountProvider.find_by(provider: @enable_banking_account)&.destroy
+    AccountProvider.create!(account: cc_account, provider: @enable_banking_account)
+
+    EnableBankingAccount::Processor.new(@enable_banking_account).process
+
+    assert_equal 300.0, cc_account.reload.cash_balance
+  end
+end
diff --git a/test/models/enable_banking_account/transactions/processor_test.rb b/test/models/enable_banking_account/transactions/processor_test.rb
new file mode 100644
index 000000000..81426dce3
--- /dev/null
+++ b/test/models/enable_banking_account/transactions/processor_test.rb
@@ -0,0 +1,313 @@
+require "test_helper"
+
+class EnableBankingAccount::Transactions::ProcessorTest < ActiveSupport::TestCase
+  include EntriesTestHelper
+
+  setup do
+    @family = families(:dylan_family)
+    @account = accounts(:depository)
+
+    @enable_banking_item = EnableBankingItem.create!(
+      family:              @family,
+      name:                "Test EB Item",
+      country_code:        "FR",
+      application_id:      "app_id",
+      client_certificate:  "cert"
+    )
+    @enable_banking_account = EnableBankingAccount.create!(
+      enable_banking_item: @enable_banking_item,
+      name:                "Compte courant",
+      uid:                 "uid_txn_proc_test",
+      currency:            "EUR",
+      current_balance:     1000.00
+    )
+    AccountProvider.create!(account: @account, provider: @enable_banking_account)
+  end
+
+  # Minimal raw transaction payload hash matching the shape EnableBankingEntry::Processor expects
+  def raw_pending_transaction(transaction_id:)
+    {
+      transaction_id:       transaction_id,
+      value_date:           3.days.ago.to_date.to_s,
+      transaction_amount:   { amount: "25.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      _pending:             true
+    }
+  end
+
+  test "does not re-import a pending transaction whose external_id was manually merged" do
+    pending_ext_id = "enable_banking_PDNG_MERGED"
+
+    # Simulate a previously-merged state: a posted transaction carries the pending's external_id
+    # in its manual_merge metadata, which is how merge_with_duplicate! records the merge.
+    posted_entry = create_transaction(
+      account:     @account,
+      name:        "Coffee Shop",
+      date:        1.day.ago.to_date,
+      amount:      25,
+      currency:    "EUR",
+      external_id: "enable_banking_BOOK_SETTLED",
+      source:      "enable_banking"
+    )
+    posted_entry.transaction.update!(
+      extra: {
+        "manual_merge" => {
+          "merged_from_entry_id"    => SecureRandom.uuid,
+          "merged_from_external_id" => pending_ext_id,
+          "merged_at"               => Time.current.iso8601,
+          "source"                  => "enable_banking"
+        }
+      }
+    )
+    posted_entry.mark_user_modified!
+
+    # Raw payload contains the pending transaction that was already merged
+    @enable_banking_account.update!(
+      raw_transactions_payload: [
+        raw_pending_transaction(transaction_id: "PDNG_MERGED")
+      ]
+    )
+
+    assert_no_difference "@account.entries.count" do
+      EnableBankingAccount::Transactions::Processor.new(@enable_banking_account).process
+    end
+  end
+
+  test "imports a pending transaction that has NOT been merged" do
+    @enable_banking_account.update!(
+      raw_transactions_payload: [
+        raw_pending_transaction(transaction_id: "PDNG_NEW_UNMERGED")
+      ]
+    )
+
+    assert_difference "@account.entries.count", 1 do
+      EnableBankingAccount::Transactions::Processor.new(@enable_banking_account).process
+    end
+  end
+
+  test "imports non-excluded transactions alongside excluded ones in the same batch" do
+    pending_ext_id = "enable_banking_PDNG_SKIP_ME"
+
+    posted_entry = create_transaction(
+      account:     @account,
+      name:        "Already Merged",
+      date:        2.days.ago.to_date,
+      amount:      15,
+      currency:    "EUR",
+      external_id: "enable_banking_BOOK_ALREADY",
+      source:      "enable_banking"
+    )
+    posted_entry.transaction.update!(
+      extra: {
+        "manual_merge" => {
+          "merged_from_external_id" => pending_ext_id,
+          "merged_at"               => Time.current.iso8601,
+          "source"                  => "enable_banking"
+        }
+      }
+    )
+
+    @enable_banking_account.update!(
+      raw_transactions_payload: [
+        raw_pending_transaction(transaction_id: "PDNG_SKIP_ME"),          # excluded
+        raw_pending_transaction(transaction_id: "PDNG_BRAND_NEW_12345")   # should be imported
+      ]
+    )
+
+    assert_difference "@account.entries.count", 1 do
+      EnableBankingAccount::Transactions::Processor.new(@enable_banking_account).process
+    end
+  end
+
+  test "excludes all external_ids when multiple pending entries were merged into the same posted entry" do
+    pending_ext_id_1 = "enable_banking_PDNG_MULTI_1"
+    pending_ext_id_2 = "enable_banking_PDNG_MULTI_2"
+
+    posted_entry = create_transaction(
+      account:     @account,
+      name:        "Multi Merge",
+      date:        2.days.ago.to_date,
+      amount:      30,
+      currency:    "EUR",
+      external_id: "enable_banking_BOOK_MULTI",
+      source:      "enable_banking"
+    )
+    posted_entry.transaction.update!(
+      extra: {
+        "manual_merge" => [
+          { "merged_from_external_id" => pending_ext_id_1, "merged_at" => 2.days.ago.iso8601, "source" => "enable_banking" },
+          { "merged_from_external_id" => pending_ext_id_2, "merged_at" => 1.day.ago.iso8601,  "source" => "enable_banking" }
+        ]
+      }
+    )
+
+    @enable_banking_account.update!(
+      raw_transactions_payload: [
+        raw_pending_transaction(transaction_id: "PDNG_MULTI_1"),  # excluded
+        raw_pending_transaction(transaction_id: "PDNG_MULTI_2"),  # excluded
+        raw_pending_transaction(transaction_id: "PDNG_MULTI_NEW") # new — should import
+      ]
+    )
+
+    result = nil
+    assert_difference "@account.entries.count", 1 do
+      result = EnableBankingAccount::Transactions::Processor.new(@enable_banking_account).process
+    end
+    assert_equal 2, result[:skipped]
+    assert_equal 1, result[:imported]
+  end
+
+  test "imports id-less transaction using content fingerprint" do
+    tx = {
+      "booking_date" => Date.current.to_s,
+      "transaction_amount" => { "amount" => "19.99", "currency" => "EUR" },
+      "credit_debit_indicator" => "DBIT",
+      "creditor" => { "name" => "Spotify" }
+    }
+    @enable_banking_account.update!(raw_transactions_payload: [ tx ])
+
+    assert_difference "@account.entries.count", 1 do
+      EnableBankingAccount::Transactions::Processor.new(@enable_banking_account).process
+    end
+
+    expected_id = EnableBankingEntry::Processor.compute_external_id(tx)
+    assert @account.entries.exists?(external_id: expected_id, source: "enable_banking")
+  end
+
+  test "id-less transaction does not appear in failed count" do
+    tx = {
+      "booking_date" => Date.current.to_s,
+      "transaction_amount" => { "amount" => "5.00", "currency" => "EUR" },
+      "credit_debit_indicator" => "CRDT",
+      "debtor" => { "name" => "Employer" }
+    }
+    @enable_banking_account.update!(raw_transactions_payload: [ tx ])
+
+    result = EnableBankingAccount::Transactions::Processor.new(@enable_banking_account).process
+
+    assert_equal 0, result[:failed]
+  end
+
+  test "does not re-import a pending transaction whose external_id was auto-claimed" do
+    # When a pending entry is automatically matched to a booked transaction by the
+    # amount/date heuristic (find_pending_transaction), the old pending external_id
+    # is stored in auto_claimed_pending_ids so subsequent syncs don't recreate it.
+    pending_ext_id = "enable_banking_PDNG_AUTO_CLAIMED"
+
+    booked_entry = create_transaction(
+      account:     @account,
+      name:        "Grocery Store",
+      date:        1.day.ago.to_date,
+      amount:      55,
+      currency:    "EUR",
+      external_id: "enable_banking_BOOK_SETTLED",
+      source:      "enable_banking"
+    )
+    booked_entry.transaction.update!(
+      extra: {
+        "auto_claimed_pending_ids" => [ pending_ext_id ]
+      }
+    )
+
+    @enable_banking_account.update!(
+      raw_transactions_payload: [
+        raw_pending_transaction(transaction_id: "PDNG_AUTO_CLAIMED")
+      ]
+    )
+
+    assert_no_difference "@account.entries.count" do
+      EnableBankingAccount::Transactions::Processor.new(@enable_banking_account).process
+    end
+  end
+
+  test "does not re-import when both manual_merge and auto_claimed_pending_ids exclusions are present" do
+    manually_merged_ext_id  = "enable_banking_PDNG_MANUAL"
+    auto_claimed_ext_id     = "enable_banking_PDNG_AUTO"
+
+    manual_entry = create_transaction(
+      account:     @account,
+      name:        "Manual Merge Entry",
+      date:        2.days.ago.to_date,
+      amount:      20,
+      currency:    "EUR",
+      external_id: "enable_banking_BOOK_MANUAL",
+      source:      "enable_banking"
+    )
+    manual_entry.transaction.update!(
+      extra: {
+        "manual_merge" => {
+          "merged_from_external_id" => manually_merged_ext_id,
+          "merged_at"               => Time.current.iso8601,
+          "source"                  => "enable_banking"
+        }
+      }
+    )
+
+    auto_entry = create_transaction(
+      account:     @account,
+      name:        "Auto Claimed Entry",
+      date:        1.day.ago.to_date,
+      amount:      30,
+      currency:    "EUR",
+      external_id: "enable_banking_BOOK_AUTO",
+      source:      "enable_banking"
+    )
+    auto_entry.transaction.update!(
+      extra: { "auto_claimed_pending_ids" => [ auto_claimed_ext_id ] }
+    )
+
+    @enable_banking_account.update!(
+      raw_transactions_payload: [
+        raw_pending_transaction(transaction_id: "PDNG_MANUAL"),         # excluded via manual_merge
+        raw_pending_transaction(transaction_id: "PDNG_AUTO"),           # excluded via auto_claimed_pending_ids
+        raw_pending_transaction(transaction_id: "PDNG_BRAND_NEW_XXXX")  # new — should import
+      ]
+    )
+
+    result = nil
+    assert_difference "@account.entries.count", 1 do
+      result = EnableBankingAccount::Transactions::Processor.new(@enable_banking_account).process
+    end
+    assert_equal 2, result[:skipped]
+    assert_equal 1, result[:imported]
+  end
+
+  test "handles empty raw_transactions_payload gracefully" do
+    @enable_banking_account.update!(raw_transactions_payload: nil)
+
+    result = EnableBankingAccount::Transactions::Processor.new(@enable_banking_account).process
+
+    assert_equal true, result[:success]
+    assert_equal 0, result[:total]
+  end
+
+  test "reports excluded transactions as skipped, not imported or failed" do
+    pending_ext_id = "enable_banking_PDNG_SKIP_STATS"
+
+    posted_entry = create_transaction(
+      account:     @account,
+      name:        "Stats Test",
+      date:        2.days.ago.to_date,
+      amount:      50,
+      currency:    "EUR",
+      external_id: "enable_banking_BOOK_STATS",
+      source:      "enable_banking"
+    )
+    posted_entry.transaction.update!(
+      extra: { "manual_merge" => { "merged_from_external_id" => pending_ext_id } }
+    )
+
+    @enable_banking_account.update!(
+      raw_transactions_payload: [
+        raw_pending_transaction(transaction_id: "PDNG_SKIP_STATS")
+      ]
+    )
+
+    result = EnableBankingAccount::Transactions::Processor.new(@enable_banking_account).process
+
+    assert_equal true, result[:success]
+    assert_equal 1,    result[:skipped]
+    assert_equal 0,    result[:imported]
+    assert_equal 0,    result[:failed]
+  end
+end
diff --git a/test/models/enable_banking_account_test.rb b/test/models/enable_banking_account_test.rb
new file mode 100644
index 000000000..d638e0ec0
--- /dev/null
+++ b/test/models/enable_banking_account_test.rb
@@ -0,0 +1,152 @@
+require "test_helper"
+
+class EnableBankingAccountTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @item = EnableBankingItem.create!(
+      family: @family,
+      name: "Test EB",
+      country_code: "FR",
+      application_id: "app_id",
+      client_certificate: "cert"
+    )
+    @account = EnableBankingAccount.create!(
+      enable_banking_item: @item,
+      name: "Mon compte",
+      uid: "hash_abc123",
+      currency: "EUR"
+    )
+  end
+
+  # suggested_account_type / suggested_subtype mapping
+  test "suggests Depository checking for CACC" do
+    @account.update!(account_type: "CACC")
+    assert_equal "Depository", @account.suggested_account_type
+    assert_equal "checking", @account.suggested_subtype
+  end
+
+  test "suggests Depository savings for SVGS" do
+    @account.update!(account_type: "SVGS")
+    assert_equal "Depository", @account.suggested_account_type
+    assert_equal "savings", @account.suggested_subtype
+  end
+
+  test "suggests CreditCard for CARD" do
+    @account.update!(account_type: "CARD")
+    assert_equal "CreditCard", @account.suggested_account_type
+    assert_equal "credit_card", @account.suggested_subtype
+  end
+
+  test "suggests Loan for LOAN" do
+    @account.update!(account_type: "LOAN")
+    assert_equal "Loan", @account.suggested_account_type
+    assert_nil @account.suggested_subtype
+  end
+
+  test "suggests Loan mortgage for MORT" do
+    @account.update!(account_type: "MORT")
+    assert_equal "Loan", @account.suggested_account_type
+    assert_equal "mortgage", @account.suggested_subtype
+  end
+
+  test "returns nil for OTHR" do
+    @account.update!(account_type: "OTHR")
+    assert_nil @account.suggested_account_type
+    assert_nil @account.suggested_subtype
+  end
+
+  test "suggests Depository savings for MOMA and ONDP" do
+    @account.update!(account_type: "MOMA")
+    assert_equal "Depository", @account.suggested_account_type
+    assert_equal "savings", @account.suggested_subtype
+
+    @account.update!(account_type: "ONDP")
+    assert_equal "Depository", @account.suggested_account_type
+    assert_equal "savings", @account.suggested_subtype
+  end
+
+  test "suggests Depository checking for NREX, TAXE, and TRAS" do
+    @account.update!(account_type: "NREX")
+    assert_equal "Depository", @account.suggested_account_type
+    assert_equal "checking", @account.suggested_subtype
+
+    @account.update!(account_type: "TAXE")
+    assert_equal "Depository", @account.suggested_account_type
+    assert_equal "checking", @account.suggested_subtype
+
+    @account.update!(account_type: "TRAS")
+    assert_equal "Depository", @account.suggested_account_type
+    assert_equal "checking", @account.suggested_subtype
+  end
+
+  test "returns nil when account_type is blank" do
+    @account.update!(account_type: nil)
+    assert_nil @account.suggested_account_type
+    assert_nil @account.suggested_subtype
+  end
+
+  test "is case insensitive for account type mapping" do
+    @account.update!(account_type: "svgs")
+    assert_equal "Depository", @account.suggested_account_type
+    assert_equal "savings", @account.suggested_subtype
+  end
+
+  # upsert_enable_banking_snapshot! stores new fields
+  test "stores product from snapshot" do
+    @account.upsert_enable_banking_snapshot!({
+      uid: "hash_abc123",
+      identification_hash: "hash_abc123",
+      currency: "EUR",
+      cash_account_type: "SVGS",
+      product: "Livret A"
+    })
+    assert_equal "Livret A", @account.reload.product
+  end
+
+  test "stores identification_hashes from snapshot" do
+    @account.upsert_enable_banking_snapshot!({
+      uid: "uid_uuid_123",
+      identification_hash: "hash_abc123",
+      identification_hashes: [ "hash_abc123", "hash_old456" ],
+      currency: "EUR",
+      cash_account_type: "CACC"
+    })
+    reloaded_account = @account.reload
+    assert_includes reloaded_account.identification_hashes, "hash_abc123"
+    assert_includes reloaded_account.identification_hashes, "hash_old456"
+  end
+
+  test "stores credit_limit from snapshot" do
+    @account.upsert_enable_banking_snapshot!({
+      uid: "uid_uuid_123",
+      identification_hash: "hash_abc123",
+      currency: "EUR",
+      cash_account_type: "CARD",
+      credit_limit: { amount: "2000.00", currency: "EUR" }
+    })
+    assert_equal 2000.00, @account.reload.credit_limit.to_f
+  end
+
+  test "stores account_servicer bic in institution_metadata" do
+    @account.upsert_enable_banking_snapshot!({
+      uid: "uid_uuid_123",
+      identification_hash: "hash_abc123",
+      currency: "EUR",
+      cash_account_type: "CACC",
+      account_servicer: { bic_fi: "BOURFRPPXXX", name: "Boursobank" }
+    })
+    metadata = @account.reload.institution_metadata
+    assert_equal "BOURFRPPXXX", metadata["bic"]
+    assert_equal "Boursobank", metadata["servicer_name"]
+  end
+
+  test "stores empty identification_hashes when not in snapshot" do
+    @account.upsert_enable_banking_snapshot!({
+      uid: "uid_uuid_123",
+      identification_hash: "hash_abc123",
+      currency: "EUR",
+      cash_account_type: "CACC"
+    })
+    assert_equal [], @account.reload.identification_hashes
+  end
+end
diff --git a/test/models/enable_banking_entry/processor_test.rb b/test/models/enable_banking_entry/processor_test.rb
index 33e55f46e..5b54b29be 100644
--- a/test/models/enable_banking_entry/processor_test.rb
+++ b/test/models/enable_banking_entry/processor_test.rb
@@ -83,17 +83,89 @@ class EnableBankingEntry::ProcessorTest < ActiveSupport::TestCase
     end
   end
 
-  test "raises ArgumentError when both transaction_id and entry_reference are nil" do
+  # --- compute_external_id unit tests ---
+
+  test "compute_external_id returns transaction_id-based id when present" do
+    assert_equal "enable_banking_txn_abc",
+      EnableBankingEntry::Processor.compute_external_id(transaction_id: "txn_abc", entry_reference: "ref_xyz")
+  end
+
+  test "compute_external_id falls back to entry_reference when transaction_id is blank" do
+    assert_equal "enable_banking_ref_xyz",
+      EnableBankingEntry::Processor.compute_external_id(transaction_id: nil, entry_reference: "ref_xyz")
+  end
+
+  test "compute_external_id returns content fingerprint when both id fields are absent" do
+    tx = {
+      booking_date: "2026-03-15",
+      transaction_amount: { amount: "42.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      creditor: { name: "Spar" }
+    }
+    result = EnableBankingEntry::Processor.compute_external_id(tx)
+    assert result.start_with?("enable_banking_content_"), "Expected content fingerprint, got: #{result}"
+  end
+
+  test "compute_external_id fingerprint is stable across calls" do
+    tx = {
+      booking_date: "2026-03-15",
+      transaction_amount: { amount: "42.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      creditor: { name: "Spar" }
+    }
+    assert_equal EnableBankingEntry::Processor.compute_external_id(tx),
+                 EnableBankingEntry::Processor.compute_external_id(tx)
+  end
+
+  test "compute_external_id returns nil for transaction with no identifiable content" do
+    assert_nil EnableBankingEntry::Processor.compute_external_id({})
+    assert_nil EnableBankingEntry::Processor.compute_external_id(transaction_id: nil, entry_reference: nil)
+  end
+
+  # --- ID-less transaction processing ---
+
+  test "imports transaction using content fingerprint when transaction_id and entry_reference are absent" do
     tx = {
       transaction_id: nil,
       entry_reference: nil,
       booking_date: Date.current.to_s,
       transaction_amount: { amount: "10.00", currency: "EUR" },
-      creditor: { name: "Test" },
+      creditor: { name: "Lidl" },
       credit_debit_indicator: "DBIT",
       status: "BOOK"
     }
 
+    assert_difference "@account.entries.count", 1 do
+      EnableBankingEntry::Processor.new(tx, enable_banking_account: @enable_banking_account).process
+    end
+
+    expected_id = EnableBankingEntry::Processor.compute_external_id(tx)
+    assert @account.entries.exists?(external_id: expected_id, source: "enable_banking")
+  end
+
+  test "does not create duplicate when same id-less transaction is processed twice" do
+    tx = {
+      transaction_id: nil,
+      entry_reference: nil,
+      booking_date: Date.current.to_s,
+      transaction_amount: { amount: "10.00", currency: "EUR" },
+      creditor: { name: "Lidl" },
+      credit_debit_indicator: "DBIT",
+      status: "BOOK"
+    }
+
+    assert_difference "@account.entries.count", 1 do
+      EnableBankingEntry::Processor.new(tx, enable_banking_account: @enable_banking_account).process
+    end
+
+    assert_no_difference "@account.entries.count" do
+      EnableBankingEntry::Processor.new(tx, enable_banking_account: @enable_banking_account).process
+    end
+  end
+
+  test "raises ArgumentError for transaction with no identifiable content at all" do
+    tx = { transaction_id: nil, entry_reference: nil }
+
     assert_raises(ArgumentError) do
       EnableBankingEntry::Processor.new(tx, enable_banking_account: @enable_banking_account).process
     end
@@ -117,4 +189,245 @@ class EnableBankingEntry::ProcessorTest < ActiveSupport::TestCase
     entry = @account.entries.find_by!(external_id: "enable_banking_string_key_ref", source: "enable_banking")
     assert_equal 15.0, entry.amount.to_f
   end
+
+  test "includes note field in transaction notes alongside remittance_information" do
+    tx = {
+      entry_reference: "ref_note",
+      transaction_id: nil,
+      booking_date: Date.current.to_s,
+      transaction_amount: { amount: "10.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      remittance_information: [ "Facture 2026-001" ],
+      note: "Détail comptable interne",
+      status: "BOOK"
+    }
+
+    EnableBankingEntry::Processor.new(tx, enable_banking_account: @enable_banking_account).process
+    entry = @account.entries.find_by!(external_id: "enable_banking_ref_note")
+    assert_includes entry.notes, "Facture 2026-001"
+    assert_includes entry.notes, "Détail comptable interne"
+  end
+
+  test "stores exchange_rate in extra when present" do
+    tx = {
+      entry_reference: "ref_fx",
+      transaction_id: nil,
+      booking_date: Date.current.to_s,
+      transaction_amount: { amount: "100.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      exchange_rate: {
+        unit_currency: "USD",
+        exchange_rate: "1.0821",
+        rate_type: "SPOT",
+        instructed_amount: { amount: "108.21", currency: "USD" }
+      },
+      status: "BOOK"
+    }
+
+    EnableBankingEntry::Processor.new(tx, enable_banking_account: @enable_banking_account).process
+    entry = @account.entries.find_by!(external_id: "enable_banking_ref_fx")
+    eb_extra = entry.transaction&.extra&.dig("enable_banking")
+    assert_equal "1.0821", eb_extra["fx_rate"]
+    assert_equal "USD", eb_extra["fx_unit_currency"]
+    assert_equal "108.21", eb_extra["fx_instructed_amount"]
+  end
+
+  test "stores merchant_category_code in extra when present" do
+    tx = {
+      entry_reference: "ref_mcc",
+      transaction_id: nil,
+      booking_date: Date.current.to_s,
+      transaction_amount: { amount: "25.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      merchant_category_code: "5411",
+      status: "BOOK"
+    }
+
+    EnableBankingEntry::Processor.new(tx, enable_banking_account: @enable_banking_account).process
+    entry = @account.entries.find_by!(external_id: "enable_banking_ref_mcc")
+    eb_extra = entry.transaction&.extra&.dig("enable_banking")
+    assert_equal "5411", eb_extra["merchant_category_code"]
+  end
+
+  test "stores pending true in extra for PDNG-tagged transactions" do
+    tx = {
+      entry_reference: "ref_pdng",
+      transaction_id: nil,
+      booking_date: Date.current.to_s,
+      transaction_amount: { amount: "15.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      status: "PDNG",
+      _pending: true
+    }
+
+    EnableBankingEntry::Processor.new(tx, enable_banking_account: @enable_banking_account).process
+    entry = @account.entries.find_by!(external_id: "enable_banking_ref_pdng")
+    eb_extra = entry.transaction&.extra&.dig("enable_banking")
+    assert_equal true, eb_extra["pending"]
+  end
+
+  test "does not add enable_banking extra key when no extra data present" do
+    tx = {
+      entry_reference: "ref_noextra",
+      transaction_id: nil,
+      booking_date: Date.current.to_s,
+      transaction_amount: { amount: "5.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      status: "BOOK"
+    }
+
+    EnableBankingEntry::Processor.new(tx, enable_banking_account: @enable_banking_account).process
+    entry = @account.entries.find_by!(external_id: "enable_banking_ref_noextra")
+    assert_nil entry.transaction&.extra&.dig("enable_banking")
+  end
+
+  def build_processor(data)
+    EnableBankingEntry::Processor.new(data, enable_banking_account: Object.new)
+  end
+
+  def build_name(data)
+    build_processor(data).send(:name)
+  end
+
+  test "skips technical card counterparty and falls back to remittance_information" do
+    name = build_name(
+      credit_debit_indicator: "CRDT",
+      debtor_name: "CARD-1234",
+      remittance_information: [ "ACME SHOP" ],
+      bank_transaction_code: { description: "Card Purchase" }
+    )
+
+    assert_equal "ACME SHOP", name
+  end
+
+  test "uses counterparty when it is human readable" do
+    name = build_name(
+      credit_debit_indicator: "CRDT",
+      debtor_name: "ACME SHOP",
+      remittance_information: [ "Receipt #42" ],
+      bank_transaction_code: { description: "Transfer" }
+    )
+
+    assert_equal "ACME SHOP", name
+  end
+
+  test "falls back to top-level counterparty name when nested name is blank" do
+    processor = build_processor(
+      credit_debit_indicator: "CRDT",
+      debtor: { name: "" },
+      debtor_name: "ACME SHOP"
+    )
+
+    assert_equal "ACME SHOP", processor.send(:name)
+
+    merchant = stub(id: 789)
+    import_adapter = mock("import_adapter")
+    import_adapter.expects(:find_or_create_merchant).with(
+      provider_merchant_id: "enable_banking_merchant_c0b09f27a4375bb8d8d477ed552a9aa1",
+      name: "ACME SHOP",
+      source: "enable_banking"
+    ).returns(merchant)
+
+    processor.stubs(:import_adapter).returns(import_adapter)
+
+    assert_equal merchant, processor.send(:merchant)
+  end
+
+  test "builds merchant from remittance when counterparty is technical card id" do
+    processor = build_processor(
+      credit_debit_indicator: "CRDT",
+      debtor_name: "CARD-1234",
+      remittance_information: [ "ACME SHOP" ],
+      bank_transaction_code: { description: "Card Purchase" }
+    )
+
+    merchant = stub(id: 123)
+    import_adapter = mock("import_adapter")
+    import_adapter.expects(:find_or_create_merchant).with(
+      provider_merchant_id: "enable_banking_merchant_c0b09f27a4375bb8d8d477ed552a9aa1",
+      name: "ACME SHOP",
+      source: "enable_banking"
+    ).returns(merchant)
+
+    processor.stubs(:import_adapter).returns(import_adapter)
+
+    assert_equal merchant, processor.send(:merchant)
+  end
+
+  test "uses remittance fallback for debit technical card counterparty" do
+    processor = build_processor(
+      credit_debit_indicator: "DBIT",
+      creditor_name: "CARD-1234",
+      remittance_information: [ "ACME SHOP" ],
+      bank_transaction_code: { description: "Card Purchase" }
+    )
+
+    assert_equal "ACME SHOP", processor.send(:name)
+
+    merchant = stub(id: 321)
+    import_adapter = mock("import_adapter")
+    import_adapter.expects(:find_or_create_merchant).with(
+      provider_merchant_id: "enable_banking_merchant_c0b09f27a4375bb8d8d477ed552a9aa1",
+      name: "ACME SHOP",
+      source: "enable_banking"
+    ).returns(merchant)
+
+    processor.stubs(:import_adapter).returns(import_adapter)
+
+    assert_equal merchant, processor.send(:merchant)
+  end
+
+  test "truncates remittance-derived merchant names before persisting" do
+    long_name = "A" * 150
+    truncated_name = "A" * 100
+    processor = build_processor(
+      credit_debit_indicator: "CRDT",
+      debtor_name: "CARD-1234",
+      remittance_information: [ long_name ]
+    )
+
+    merchant = stub(id: 654)
+    import_adapter = mock("import_adapter")
+    import_adapter.expects(:find_or_create_merchant).with(
+      provider_merchant_id: "enable_banking_merchant_#{Digest::MD5.hexdigest(truncated_name.downcase)}",
+      name: truncated_name,
+      source: "enable_banking"
+    ).returns(merchant)
+
+    processor.stubs(:import_adapter).returns(import_adapter)
+
+    assert_equal merchant, processor.send(:merchant)
+  end
+
+  test "uses string remittance fallback for technical card counterparty" do
+    processor = build_processor(
+      credit_debit_indicator: "CRDT",
+      debtor_name: "CARD-1234",
+      remittance_information: "ACME SHOP"
+    )
+
+    assert_equal "ACME SHOP", processor.send(:name)
+
+    merchant = stub(id: 456)
+    import_adapter = mock("import_adapter")
+    import_adapter.expects(:find_or_create_merchant).with(
+      provider_merchant_id: "enable_banking_merchant_c0b09f27a4375bb8d8d477ed552a9aa1",
+      name: "ACME SHOP",
+      source: "enable_banking"
+    ).returns(merchant)
+
+    processor.stubs(:import_adapter).returns(import_adapter)
+
+    assert_equal merchant, processor.send(:merchant)
+  end
+
+  test "does not build merchant from remittance when counterparty is blank" do
+    processor = build_processor(
+      credit_debit_indicator: "CRDT",
+      debtor_name: nil,
+      remittance_information: [ "Invoice 12345" ]
+    )
+
+    assert_nil processor.send(:merchant)
+  end
 end
diff --git a/test/models/enable_banking_item/importer_error_handling_test.rb b/test/models/enable_banking_item/importer_error_handling_test.rb
new file mode 100644
index 000000000..e5b9192cb
--- /dev/null
+++ b/test/models/enable_banking_item/importer_error_handling_test.rb
@@ -0,0 +1,112 @@
+require "test_helper"
+require "ostruct"
+
+class EnableBankingItem::ImporterErrorHandlingTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @enable_banking_item = EnableBankingItem.create!(
+      family: @family,
+      name: "Test Enable Banking",
+      country_code: "AT",
+      application_id: "test_app_id",
+      client_certificate: "test_cert",
+      session_id: "test_session",
+      session_expires_at: 1.day.from_now,
+      status: :good
+    )
+
+    @mock_provider = OpenStruct.new
+    @importer = EnableBankingItem::Importer.new(@enable_banking_item, enable_banking_provider: @mock_provider)
+  end
+
+  test "handle_sync_error handles unauthorized EnableBankingError" do
+    error = Provider::EnableBanking::EnableBankingError.new("Unauthorized", :unauthorized)
+    message = @importer.send(:handle_sync_error, error)
+
+    assert_equal I18n.t("enable_banking_items.errors.session_invalid"), message
+    assert @enable_banking_item.reload.requires_update?
+  end
+
+  test "handle_sync_error handles not_found EnableBankingError" do
+    error = Provider::EnableBanking::EnableBankingError.new("Not Found", :not_found)
+    message = @importer.send(:handle_sync_error, error)
+
+    assert_equal I18n.t("enable_banking_items.errors.session_invalid"), message
+    assert @enable_banking_item.reload.requires_update?
+  end
+
+  test "handle_sync_error handles other EnableBankingError as api_error" do
+    error = Provider::EnableBanking::EnableBankingError.new("Some API error", :internal_server_error)
+    message = @importer.send(:handle_sync_error, error)
+
+    assert_equal I18n.t("enable_banking_items.errors.api_error"), message
+    assert_not @enable_banking_item.reload.requires_update?
+  end
+
+  test "fetch_session_data updates status to requires_update on unauthorized error" do
+    def @mock_provider.get_session(**args)
+      raise Provider::EnableBanking::EnableBankingError.new("Unauthorized", :unauthorized)
+    end
+
+    @importer.send(:fetch_session_data)
+
+    assert @enable_banking_item.reload.requires_update?
+  end
+
+  test "fetch_and_store_transactions updates status to requires_update on unauthorized error" do
+    enable_banking_account = EnableBankingAccount.new(uid: "test_uid")
+    @importer.stubs(:determine_sync_start_date).returns(Date.today)
+    @importer.expects(:fetch_paginated_transactions).raises(Provider::EnableBanking::EnableBankingError.new("Unauthorized", :unauthorized))
+
+    @importer.send(:fetch_and_store_transactions, enable_banking_account)
+
+    assert @enable_banking_item.reload.requires_update?
+  end
+
+  test "fetch_and_store_transactions succeeds and skips pending when ASPSP rejects PDNG transaction_status" do
+    enable_banking_account = EnableBankingAccount.new(uid: "test_uid")
+    @importer.stubs(:determine_sync_start_date).returns(Date.today)
+    @importer.stubs(:include_pending?).returns(true)
+
+    pdng_error = Provider::EnableBanking::EnableBankingError.new(
+      "Validation error from Enable Banking API: {\"message\":\"Wrong transactionStatus provided in getAccountTransactions call: PDNG\"}",
+      :validation_error
+    )
+
+    @importer.stubs(:fetch_paginated_transactions).with(enable_banking_account, has_entries(transaction_status: "BOOK")).returns([])
+    @importer.stubs(:fetch_paginated_transactions).with(enable_banking_account, has_entries(transaction_status: "PDNG")).raises(pdng_error)
+
+    result = @importer.send(:fetch_and_store_transactions, enable_banking_account)
+
+    assert result[:success]
+  end
+
+  test "fetch_and_store_transactions fails when validation error is unrelated to transactionStatus" do
+    enable_banking_account = EnableBankingAccount.new(uid: "test_uid")
+    @importer.stubs(:determine_sync_start_date).returns(Date.today)
+    @importer.stubs(:include_pending?).returns(true)
+
+    date_error = Provider::EnableBanking::EnableBankingError.new(
+      "Validation error from Enable Banking API: {\"message\":\"Invalid date_from format\"}",
+      :validation_error
+    )
+
+    @importer.stubs(:fetch_paginated_transactions).with(enable_banking_account, has_entries(transaction_status: "BOOK")).returns([])
+    @importer.stubs(:fetch_paginated_transactions).with(enable_banking_account, has_entries(transaction_status: "PDNG")).raises(date_error)
+
+    result = @importer.send(:fetch_and_store_transactions, enable_banking_account)
+
+    assert_not result[:success]
+  end
+
+  test "fetch_and_update_balance updates status to requires_update on unauthorized error" do
+    enable_banking_account = EnableBankingAccount.new(uid: "test_uid")
+    def @mock_provider.get_account_balances(**args)
+      raise Provider::EnableBanking::EnableBankingError.new("Unauthorized", :unauthorized)
+    end
+
+    @importer.send(:fetch_and_update_balance, enable_banking_account)
+
+    assert @enable_banking_item.reload.requires_update?
+  end
+end
diff --git a/test/models/enable_banking_item/importer_id_less_test.rb b/test/models/enable_banking_item/importer_id_less_test.rb
new file mode 100644
index 000000000..2ca068fcc
--- /dev/null
+++ b/test/models/enable_banking_item/importer_id_less_test.rb
@@ -0,0 +1,145 @@
+require "test_helper"
+
+class EnableBankingItem::ImporterIdLessTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @account = accounts(:depository)
+
+    @enable_banking_item = EnableBankingItem.create!(
+      family: @family,
+      name: "Test EB",
+      country_code: "RO",
+      application_id: "test_app_id",
+      client_certificate: "test_cert",
+      session_id: "test_session",
+      session_expires_at: 1.day.from_now,
+      sync_start_date: 1.month.ago.to_date
+    )
+    @enable_banking_account = EnableBankingAccount.create!(
+      enable_banking_item: @enable_banking_item,
+      name: "Current Account",
+      uid: "hash_idless_test",
+      account_id: "uuid-idless-1234-abcd",
+      currency: "RON"
+    )
+    AccountProvider.create!(account: @account, provider: @enable_banking_account)
+
+    @mock_provider = mock()
+    @importer = EnableBankingItem::Importer.new(@enable_banking_item, enable_banking_provider: @mock_provider)
+  end
+
+  def id_less_tx(amount: "50.00", creditor: "Kaufland", date: Date.current.to_s)
+    {
+      booking_date: date,
+      transaction_amount: { amount: amount, currency: "RON" },
+      credit_debit_indicator: "DBIT",
+      creditor: { name: creditor }
+    }
+  end
+
+  test "stores id-less transactions in raw_transactions_payload on first sync" do
+    tx = id_less_tx
+
+    @importer.stubs(:fetch_paginated_transactions).with(@enable_banking_account, has_entry(transaction_status: "BOOK")).returns([ tx ])
+    @importer.stubs(:fetch_paginated_transactions).with(@enable_banking_account, has_entry(transaction_status: "PDNG")).returns([])
+    @importer.stubs(:include_pending?).returns(false)
+    @importer.stubs(:determine_sync_start_date).returns(1.month.ago.to_date)
+
+    @importer.send(:fetch_and_store_transactions, @enable_banking_account)
+
+    @enable_banking_account.reload
+    assert_equal 1, @enable_banking_account.raw_transactions_payload.count
+  end
+
+  test "does not re-store id-less transaction on second sync" do
+    tx = id_less_tx
+
+    # First sync
+    @importer.stubs(:fetch_paginated_transactions).with(@enable_banking_account, has_entry(transaction_status: "BOOK")).returns([ tx ])
+    @importer.stubs(:fetch_paginated_transactions).with(@enable_banking_account, has_entry(transaction_status: "PDNG")).returns([])
+    @importer.stubs(:include_pending?).returns(false)
+    @importer.stubs(:determine_sync_start_date).returns(1.month.ago.to_date)
+
+    @importer.send(:fetch_and_store_transactions, @enable_banking_account)
+    @enable_banking_account.reload
+    assert_equal 1, @enable_banking_account.raw_transactions_payload.count
+
+    # Second sync with the same transaction
+    @importer.send(:fetch_and_store_transactions, @enable_banking_account)
+    @enable_banking_account.reload
+    assert_equal 1, @enable_banking_account.raw_transactions_payload.count
+  end
+
+  test "stores multiple distinct id-less transactions separately" do
+    tx1 = id_less_tx(amount: "50.00", creditor: "Kaufland")
+    tx2 = id_less_tx(amount: "12.50", creditor: "Starbucks")
+
+    @importer.stubs(:fetch_paginated_transactions).with(@enable_banking_account, has_entry(transaction_status: "BOOK")).returns([ tx1, tx2 ])
+    @importer.stubs(:fetch_paginated_transactions).with(@enable_banking_account, has_entry(transaction_status: "PDNG")).returns([])
+    @importer.stubs(:include_pending?).returns(false)
+    @importer.stubs(:determine_sync_start_date).returns(1.month.ago.to_date)
+
+    @importer.send(:fetch_and_store_transactions, @enable_banking_account)
+
+    @enable_banking_account.reload
+    assert_equal 2, @enable_banking_account.raw_transactions_payload.count
+  end
+
+  test "removes stored id-less pending entry when its booked counterpart arrives" do
+    tx = id_less_tx(amount: "30.00", creditor: "Netflix")
+    pending_tx = tx.merge(_pending: true)
+
+    @enable_banking_account.update!(raw_transactions_payload: [ pending_tx ])
+
+    @importer.stubs(:fetch_paginated_transactions).with(@enable_banking_account, has_entry(transaction_status: "BOOK")).returns([ tx ])
+    @importer.stubs(:fetch_paginated_transactions).with(@enable_banking_account, has_entry(transaction_status: "PDNG")).returns([])
+    @importer.stubs(:include_pending?).returns(true)
+    @importer.stubs(:determine_sync_start_date).returns(1.month.ago.to_date)
+
+    @importer.send(:fetch_and_store_transactions, @enable_banking_account)
+
+    @enable_banking_account.reload
+    stored = @enable_banking_account.raw_transactions_payload
+    assert_equal 1, stored.count
+    assert_nil stored.first["_pending"]
+  end
+
+  # Regression: pending row has entry_reference only; booked counterpart gains
+  # transaction_id on settlement. Fingerprints diverge but entry_reference is
+  # stable — the pending entry must still be removed from stored payload.
+  test "removes stored pending entry when settled book row gains a transaction_id" do
+    entry_ref = "REF-SETTLE-123"
+
+    pending_tx = {
+      "entry_reference" => entry_ref,
+      "booking_date" => Date.current.to_s,
+      "transaction_amount" => { "amount" => "15.00", "currency" => "RON" },
+      "credit_debit_indicator" => "DBIT",
+      "creditor" => { "name" => "Bolt" },
+      "_pending" => true
+    }
+
+    booked_tx = {
+      transaction_id: "TXN-NEW-456",
+      entry_reference: entry_ref,
+      booking_date: Date.current.to_s,
+      transaction_amount: { amount: "15.00", currency: "RON" },
+      credit_debit_indicator: "DBIT",
+      creditor: { name: "Bolt" }
+    }
+
+    @enable_banking_account.update!(raw_transactions_payload: [ pending_tx ])
+
+    @importer.stubs(:fetch_paginated_transactions).with(@enable_banking_account, has_entry(transaction_status: "BOOK")).returns([ booked_tx ])
+    @importer.stubs(:fetch_paginated_transactions).with(@enable_banking_account, has_entry(transaction_status: "PDNG")).returns([])
+    @importer.stubs(:include_pending?).returns(true)
+    @importer.stubs(:determine_sync_start_date).returns(1.month.ago.to_date)
+
+    @importer.send(:fetch_and_store_transactions, @enable_banking_account)
+
+    @enable_banking_account.reload
+    stored = @enable_banking_account.raw_transactions_payload
+    assert_equal 1, stored.count, "Stale pending entry should have been removed"
+    assert_nil stored.first["_pending"], "Remaining entry should be the booked row"
+  end
+end
diff --git a/test/models/enable_banking_item/importer_pdng_test.rb b/test/models/enable_banking_item/importer_pdng_test.rb
new file mode 100644
index 000000000..3d444ebf4
--- /dev/null
+++ b/test/models/enable_banking_item/importer_pdng_test.rb
@@ -0,0 +1,146 @@
+require "test_helper"
+
+class EnableBankingItem::ImporterPdngTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @account = accounts(:depository)
+
+    @enable_banking_item = EnableBankingItem.create!(
+      family: @family,
+      name: "Test EB",
+      country_code: "FR",
+      application_id: "test_app_id",
+      client_certificate: "test_cert",
+      session_id: "test_session",
+      session_expires_at: 1.day.from_now,
+      sync_start_date: Date.new(2026, 3, 1)
+    )
+    @enable_banking_account = EnableBankingAccount.create!(
+      enable_banking_item: @enable_banking_item,
+      name: "Compte courant",
+      uid: "hash_abc123",
+      account_id: "uuid-1234-5678-abcd",
+      currency: "EUR"
+    )
+    AccountProvider.create!(account: @account, provider: @enable_banking_account)
+
+    @mock_provider = mock()
+    @importer = EnableBankingItem::Importer.new(@enable_banking_item, enable_banking_provider: @mock_provider)
+  end
+
+  # --- Post-fetch date filtering ---
+
+  test "filters out transactions before sync_start_date" do
+    old_tx = {
+      entry_reference: "old_ref",
+      transaction_id: nil,
+      booking_date: "2024-01-15",  # Before sync_start_date of 2026-03-01
+      transaction_amount: { amount: "50.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      status: "BOOK"
+    }
+    recent_tx = {
+      entry_reference: "recent_ref",
+      transaction_id: nil,
+      booking_date: "2026-03-10",
+      transaction_amount: { amount: "30.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      status: "BOOK"
+    }
+
+    result = @importer.send(:filter_transactions_by_date, [ old_tx, recent_tx ], Date.new(2026, 3, 1))
+
+    assert_equal 1, result.count
+    assert_equal "recent_ref", result.first[:entry_reference]
+  end
+
+  test "uses value_date when booking_date is absent for filtering" do
+    tx_only_value_date = {
+      entry_reference: "vd_ref",
+      transaction_id: nil,
+      value_date: "2024-06-01",  # Before sync_start_date
+      transaction_amount: { amount: "10.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      status: "BOOK"
+    }
+
+    result = @importer.send(:filter_transactions_by_date, [ tx_only_value_date ], Date.new(2026, 3, 1))
+
+    assert_equal 0, result.count
+  end
+
+  test "keeps transactions with no date (cannot determine, keep to avoid data loss)" do
+    tx_no_date = {
+      entry_reference: "nodate_ref",
+      transaction_id: nil,
+      transaction_amount: { amount: "10.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      status: "BOOK"
+    }
+
+    result = @importer.send(:filter_transactions_by_date, [ tx_no_date ], Date.new(2026, 3, 1))
+
+    assert_equal 1, result.count
+  end
+
+  test "keeps transactions on exactly sync_start_date" do
+    boundary_tx = {
+      entry_reference: "boundary_ref",
+      transaction_id: nil,
+      booking_date: "2026-03-01",  # Exactly on sync_start_date
+      transaction_amount: { amount: "10.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      status: "BOOK"
+    }
+
+    result = @importer.send(:filter_transactions_by_date, [ boundary_tx ], Date.new(2026, 3, 1))
+
+    assert_equal 1, result.count
+  end
+
+  # --- PDNG transaction tagging ---
+
+  test "tags PDNG transactions with pending: true in extra" do
+    pdng_tx = {
+      entry_reference: "pdng_ref",
+      transaction_id: "pdng_txn",
+      booking_date: Date.current.to_s,
+      transaction_amount: { amount: "20.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      status: "PDNG"
+    }
+
+    result = @importer.send(:tag_as_pending, [ pdng_tx ])
+
+    assert_equal true, result.first[:_pending]
+  end
+
+  test "tags all passed transactions regardless of status (caller is responsible for filtering)" do
+    # tag_as_pending blindly marks everything passed to it.
+    # The caller (fetch_and_store_transactions) is responsible for only passing PDNG transactions.
+    any_tx = {
+      entry_reference: "any_ref",
+      transaction_id: "any_txn",
+      booking_date: Date.current.to_s,
+      transaction_amount: { amount: "20.00", currency: "EUR" },
+      credit_debit_indicator: "DBIT",
+      status: "BOOK"
+    }
+
+    result = @importer.send(:tag_as_pending, [ any_tx ])
+
+    assert_equal true, result.first[:_pending]
+  end
+
+  # --- identification_hashes matching ---
+
+  test "find_enable_banking_account_by_hash uses identification_hashes for matching" do
+    # Account already exists with uid = identification_hash
+    @enable_banking_account.update!(identification_hashes: [ "hash_abc123", "hash_old_xyz" ])
+
+    # Lookup by a secondary hash that is in identification_hashes
+    found = @importer.send(:find_enable_banking_account_by_hash, "hash_old_xyz")
+
+    assert_equal @enable_banking_account.id, found.id
+  end
+end
diff --git a/test/models/entry_split_test.rb b/test/models/entry_split_test.rb
index c9869210d..a7efa4d09 100644
--- a/test/models/entry_split_test.rb
+++ b/test/models/entry_split_test.rb
@@ -174,4 +174,51 @@ class EntrySplitTest < ActiveSupport::TestCase
     assert children.first.split_child?
     refute @entry.split_child?
   end
+
+  test "split! creates child entries with excluded: true when specified" do
+    splits = [
+      { name: "Part 1", amount: 50, category_id: nil, excluded: true },
+      { name: "Part 2", amount: 50, category_id: nil, excluded: false }
+    ]
+
+    children = @entry.split!(splits)
+
+    assert_equal 2, children.size
+    assert children.first.excluded?
+    refute children.last.excluded?
+  end
+
+  test "split! properly casts excluded from string values" do
+    splits = [
+      { name: "Part 1", amount: 50, category_id: nil, excluded: "true" },
+      { name: "Part 2", amount: 50, category_id: nil, excluded: "false" }
+    ]
+
+    children = @entry.split!(splits)
+
+    assert children.first.excluded?
+    refute children.last.excluded?
+  end
+
+  test "excluded split children are excluded from balance calculations" do
+    @entry.split!([
+      { name: "Part 1", amount: 50, category_id: nil, excluded: true },
+      { name: "Part 2", amount: 50, category_id: nil, excluded: false }
+    ])
+
+    # Parent is always excluded for splits
+    assert @entry.reload.excluded?
+
+    # Excluded child should be filtered out by where(excluded: false)
+    excluded_child = @entry.child_entries.find { |c| c.name == "Part 1" }
+    non_excluded_child = @entry.child_entries.find { |c| c.name == "Part 2" }
+
+    assert excluded_child.excluded?
+    refute non_excluded_child.excluded?
+
+    # where(excluded: false) should only include the non-excluded child
+    visible_entries = Entry.where(id: @entry.child_entries.map(&:id)).where(excluded: false)
+    assert_includes visible_entries.pluck(:id), non_excluded_child.id
+    refute_includes visible_entries.pluck(:id), excluded_child.id
+  end
 end
diff --git a/test/models/exchange_rate/importer_test.rb b/test/models/exchange_rate/importer_test.rb
index dab40fa81..9de97e51e 100644
--- a/test/models/exchange_rate/importer_test.rb
+++ b/test/models/exchange_rate/importer_test.rb
@@ -61,9 +61,9 @@ class ExchangeRate::ImporterTest < ActiveSupport::TestCase
       end_date: Date.current
     ).import_provider_rates
 
-    db_rates = ExchangeRate.order(:date)
-    assert_equal 4, db_rates.count
-    assert_equal [ 1.2, 1.25, 1.3, 1.3 ], db_rates.map(&:rate)
+    forward_rates = ExchangeRate.where(from_currency: "USD", to_currency: "EUR").order(:date)
+    assert_equal 4, forward_rates.count
+    assert_equal [ 1.2, 1.25, 1.3, 1.3 ], forward_rates.map(&:rate)
   end
 
   test "no provider calls when all rates exist" do
@@ -137,12 +137,359 @@ class ExchangeRate::ImporterTest < ActiveSupport::TestCase
       end_date: future_date
     ).import_provider_rates
 
-    assert_equal 1, ExchangeRate.count
+    # 1 forward rate + 1 inverse rate
+    assert_equal 2, ExchangeRate.count
+  end
+
+  test "upserts inverse rates alongside forward rates" do
+    ExchangeRate.delete_all
+
+    provider_response = provider_success_response([
+      OpenStruct.new(from: "USD", to: "EUR", date: Date.current, rate: 0.85)
+    ])
+
+    @provider.expects(:fetch_exchange_rates)
+             .with(from: "USD", to: "EUR", start_date: get_provider_fetch_start_date(Date.current), end_date: Date.current)
+             .returns(provider_response)
+
+    ExchangeRate::Importer.new(
+      exchange_rate_provider: @provider,
+      from: "USD",
+      to: "EUR",
+      start_date: Date.current,
+      end_date: Date.current
+    ).import_provider_rates
+
+    forward = ExchangeRate.find_by(from_currency: "USD", to_currency: "EUR", date: Date.current)
+    inverse = ExchangeRate.find_by(from_currency: "EUR", to_currency: "USD", date: Date.current)
+
+    assert_not_nil forward, "Forward rate should be stored"
+    assert_not_nil inverse, "Inverse rate should be computed and stored"
+    assert_in_delta 0.85, forward.rate.to_f, 0.0001
+    assert_in_delta (1.0 / 0.85), inverse.rate.to_f, 0.0001
+  end
+
+  test "fresh provider values overwrite stale DB rows within the sync window" do
+    ExchangeRate.delete_all
+
+    # Day 1: correct, Day 2: missing (gap), Day 3: stale/wrong, Today: missing.
+    # The gap at day 2 causes effective_start_date = day 2, so the LOCF loop
+    # covers days 2-4. Day 3's stale value should be overwritten by the
+    # provider's fresh value (provider wins over DB).
+    ExchangeRate.create!(from_currency: "USD", to_currency: "EUR", date: 3.days.ago.to_date, rate: 0.86)
+    ExchangeRate.create!(from_currency: "USD", to_currency: "EUR", date: 1.day.ago.to_date, rate: 0.9253)
+
+    provider_response = provider_success_response([
+      OpenStruct.new(from: "USD", to: "EUR", date: 2.days.ago.to_date, rate: 0.87),
+      OpenStruct.new(from: "USD", to: "EUR", date: 1.day.ago.to_date, rate: 0.88),
+      OpenStruct.new(from: "USD", to: "EUR", date: Date.current,        rate: 0.89)
+    ])
+
+    @provider.expects(:fetch_exchange_rates)
+             .with(from: "USD", to: "EUR", start_date: get_provider_fetch_start_date(2.days.ago.to_date), end_date: Date.current)
+             .returns(provider_response)
+
+    ExchangeRate::Importer.new(
+      exchange_rate_provider: @provider,
+      from: "USD",
+      to: "EUR",
+      start_date: 3.days.ago.to_date,
+      end_date: Date.current
+    ).import_provider_rates
+
+    db_rates = ExchangeRate.where(from_currency: "USD", to_currency: "EUR").order(:date)
+    assert_equal 4, db_rates.count
+    assert_equal [ 0.86, 0.87, 0.88, 0.89 ], db_rates.map(&:rate)
+  end
+
+  test "backfills missing inverse rates when forward rates already exist" do
+    ExchangeRate.delete_all
+
+    # Create forward rates without inverses (simulating pre-inverse-computation data)
+    (2.days.ago.to_date..Date.current).each_with_index do |date, idx|
+      ExchangeRate.create!(from_currency: "USD", to_currency: "EUR", date: date, rate: 0.85 + idx * 0.01)
+    end
+
+    # All forward rates exist, so no provider call — but inverse backfill should fire
+    @provider.expects(:fetch_exchange_rates).never
+
+    ExchangeRate::Importer.new(
+      exchange_rate_provider: @provider,
+      from: "USD",
+      to: "EUR",
+      start_date: 2.days.ago.to_date,
+      end_date: Date.current
+    ).import_provider_rates
+
+    inverse_rates = ExchangeRate.where(from_currency: "EUR", to_currency: "USD").order(:date)
+    assert_equal 3, inverse_rates.count
+
+    inverse_rates.each do |inv|
+      forward = ExchangeRate.find_by(from_currency: "USD", to_currency: "EUR", date: inv.date)
+      assert_in_delta (1.0 / forward.rate.to_f), inv.rate.to_f, 0.0001
+    end
+  end
+
+  test "logs error and imports nothing when provider returns only zero and nil rates" do
+    ExchangeRate.delete_all
+    ExchangeRatePair.delete_all
+
+    provider_response = provider_success_response([
+      OpenStruct.new(from: "USD", to: "EUR", date: 2.days.ago.to_date, rate: 0),
+      OpenStruct.new(from: "USD", to: "EUR", date: 1.day.ago.to_date,  rate: nil),
+      OpenStruct.new(from: "USD", to: "EUR", date: Date.current,        rate: 0)
+    ])
+
+    @provider.expects(:fetch_exchange_rates).returns(provider_response)
+
+    ExchangeRate::Importer.new(
+      exchange_rate_provider: @provider,
+      from: "USD",
+      to: "EUR",
+      start_date: 2.days.ago.to_date,
+      end_date: Date.current
+    ).import_provider_rates
+
+    assert_equal 0, ExchangeRate.where(from_currency: "USD", to_currency: "EUR").count
+  end
+
+  test "handles rate limit error gracefully" do
+    ExchangeRate.delete_all
+
+    rate_limit_error = Provider::TwelveData::RateLimitError.new("Rate limit exceeded")
+
+    @provider.expects(:fetch_exchange_rates).once.returns(
+      provider_error_response(rate_limit_error)
+    )
+
+    # Should not raise — logs warning and returns without importing
+    ExchangeRate::Importer.new(
+      exchange_rate_provider: @provider,
+      from: "USD",
+      to: "EUR",
+      start_date: Date.current,
+      end_date: Date.current
+    ).import_provider_rates
+
+    assert_equal 0, ExchangeRate.count, "No rates should be imported on rate limit error"
+  end
+
+  # === Clamping tests (Phase 2) ===
+
+  test "advances gapfill start when pair predates provider history" do
+    ExchangeRate.delete_all
+    ExchangeRatePair.delete_all
+
+    # Provider only returns rates starting 5 days ago (simulating limited history).
+    # start_date is 30 days ago — provider can't serve anything before 5 days ago.
+    provider_response = provider_success_response([
+      OpenStruct.new(from: "USD", to: "EUR", date: 5.days.ago.to_date, rate: 1.1),
+      OpenStruct.new(from: "USD", to: "EUR", date: 4.days.ago.to_date, rate: 1.2),
+      OpenStruct.new(from: "USD", to: "EUR", date: 3.days.ago.to_date, rate: 1.3),
+      OpenStruct.new(from: "USD", to: "EUR", date: 2.days.ago.to_date, rate: 1.4),
+      OpenStruct.new(from: "USD", to: "EUR", date: 1.day.ago.to_date,  rate: 1.5),
+      OpenStruct.new(from: "USD", to: "EUR", date: Date.current,        rate: 1.6)
+    ])
+
+    @provider.expects(:fetch_exchange_rates).returns(provider_response)
+
+    ExchangeRate::Importer.new(
+      exchange_rate_provider: @provider,
+      from: "USD",
+      to: "EUR",
+      start_date: 30.days.ago.to_date,
+      end_date: Date.current
+    ).import_provider_rates
+
+    forward_rates = ExchangeRate.where(from_currency: "USD", to_currency: "EUR").order(:date)
+    assert_equal 6, forward_rates.count
+    assert_equal 5.days.ago.to_date, forward_rates.first.date
+
+    pair = ExchangeRatePair.find_by(from_currency: "USD", to_currency: "EUR")
+    assert_equal 5.days.ago.to_date, pair.first_provider_rate_on
+  end
+
+  test "pre-coverage fallback picks earliest valid provider row, skipping zero leaders" do
+    ExchangeRate.delete_all
+    ExchangeRatePair.delete_all
+
+    provider_response = provider_success_response([
+      OpenStruct.new(from: "USD", to: "EUR", date: 4.days.ago.to_date, rate: 0),
+      OpenStruct.new(from: "USD", to: "EUR", date: 3.days.ago.to_date, rate: nil),
+      OpenStruct.new(from: "USD", to: "EUR", date: 2.days.ago.to_date, rate: 1.3),
+      OpenStruct.new(from: "USD", to: "EUR", date: 1.day.ago.to_date,  rate: 1.4),
+      OpenStruct.new(from: "USD", to: "EUR", date: Date.current,        rate: 1.5)
+    ])
+
+    @provider.expects(:fetch_exchange_rates).returns(provider_response)
+
+    ExchangeRate::Importer.new(
+      exchange_rate_provider: @provider,
+      from: "USD",
+      to: "EUR",
+      start_date: 30.days.ago.to_date,
+      end_date: Date.current
+    ).import_provider_rates
+
+    pair = ExchangeRatePair.find_by(from_currency: "USD", to_currency: "EUR")
+    assert_equal 2.days.ago.to_date, pair.first_provider_rate_on
+  end
+
+  test "first_provider_rate_on is moved earlier when provider extends backward coverage" do
+    ExchangeRate.delete_all
+    ExchangeRatePair.delete_all
+
+    ExchangeRatePair.create!(
+      from_currency: "USD", to_currency: "EUR",
+      first_provider_rate_on: 3.days.ago.to_date,
+      provider_name: Setting.exchange_rate_provider.to_s
+    )
+
+    # Provider now returns an earlier date with clear_cache
+    provider_response = provider_success_response([
+      OpenStruct.new(from: "USD", to: "EUR", date: 10.days.ago.to_date, rate: 1.0),
+      OpenStruct.new(from: "USD", to: "EUR", date: 9.days.ago.to_date,  rate: 1.1),
+      OpenStruct.new(from: "USD", to: "EUR", date: Date.current,         rate: 1.5)
+    ])
+
+    @provider.expects(:fetch_exchange_rates).returns(provider_response)
+
+    ExchangeRate::Importer.new(
+      exchange_rate_provider: @provider,
+      from: "USD",
+      to: "EUR",
+      start_date: 30.days.ago.to_date,
+      end_date: Date.current,
+      clear_cache: true
+    ).import_provider_rates
+
+    pair = ExchangeRatePair.find_by!(from_currency: "USD", to_currency: "EUR")
+    assert_equal 10.days.ago.to_date, pair.first_provider_rate_on
+  end
+
+  test "first_provider_rate_on is NOT moved forward when provider shrinks coverage" do
+    ExchangeRate.delete_all
+    ExchangeRatePair.delete_all
+
+    ExchangeRatePair.create!(
+      from_currency: "USD", to_currency: "EUR",
+      first_provider_rate_on: 10.days.ago.to_date,
+      provider_name: Setting.exchange_rate_provider.to_s
+    )
+
+    # Provider now only returns from 3 days ago (shrunk window)
+    provider_response = provider_success_response([
+      OpenStruct.new(from: "USD", to: "EUR", date: 3.days.ago.to_date, rate: 1.3),
+      OpenStruct.new(from: "USD", to: "EUR", date: Date.current,        rate: 1.5)
+    ])
+
+    @provider.expects(:fetch_exchange_rates).returns(provider_response)
+
+    ExchangeRate::Importer.new(
+      exchange_rate_provider: @provider,
+      from: "USD",
+      to: "EUR",
+      start_date: 30.days.ago.to_date,
+      end_date: Date.current,
+      clear_cache: true
+    ).import_provider_rates
+
+    pair = ExchangeRatePair.find_by!(from_currency: "USD", to_currency: "EUR")
+    assert_equal 10.days.ago.to_date, pair.first_provider_rate_on
+  end
+
+  test "incremental sync on pre-coverage pair skips pre-coverage window" do
+    ExchangeRate.delete_all
+    ExchangeRatePair.delete_all
+
+    clamp_date = 5.days.ago.to_date
+    ExchangeRatePair.create!(
+      from_currency: "USD", to_currency: "EUR",
+      first_provider_rate_on: clamp_date,
+      provider_name: Setting.exchange_rate_provider.to_s
+    )
+
+    # Seed DB with rates from clamp to yesterday
+    (clamp_date..1.day.ago.to_date).each_with_index do |date, idx|
+      ExchangeRate.create!(from_currency: "USD", to_currency: "EUR", date: date, rate: 1.0 + idx * 0.01)
+    end
+
+    # Provider returns today's rate
+    provider_response = provider_success_response([
+      OpenStruct.new(from: "USD", to: "EUR", date: Date.current, rate: 1.5)
+    ])
+
+    @provider.expects(:fetch_exchange_rates)
+             .with(from: "USD", to: "EUR",
+                   start_date: get_provider_fetch_start_date(Date.current),
+                   end_date: Date.current)
+             .returns(provider_response)
+
+    ExchangeRate::Importer.new(
+      exchange_rate_provider: @provider,
+      from: "USD",
+      to: "EUR",
+      start_date: 30.days.ago.to_date,
+      end_date: Date.current
+    ).import_provider_rates
+
+    assert_equal 1.5, ExchangeRate.find_by(from_currency: "USD", to_currency: "EUR", date: Date.current).rate
+  end
+
+  test "skips provider call when all rates exist in clamped range" do
+    ExchangeRate.delete_all
+    ExchangeRatePair.delete_all
+
+    clamp_date = 3.days.ago.to_date
+    ExchangeRatePair.create!(
+      from_currency: "USD", to_currency: "EUR",
+      first_provider_rate_on: clamp_date,
+      provider_name: Setting.exchange_rate_provider.to_s
+    )
+
+    (clamp_date..Date.current).each_with_index do |date, idx|
+      ExchangeRate.create!(from_currency: "USD", to_currency: "EUR", date: date, rate: 1.0 + idx * 0.01)
+    end
+
+    @provider.expects(:fetch_exchange_rates).never
+
+    ExchangeRate::Importer.new(
+      exchange_rate_provider: @provider,
+      from: "USD",
+      to: "EUR",
+      start_date: 30.days.ago.to_date,
+      end_date: Date.current
+    ).import_provider_rates
+  end
+
+  test "clamps provider fetch to max_history_days when provider exposes limit" do
+    ExchangeRate.delete_all
+    ExchangeRatePair.delete_all
+
+    @provider.stubs(:max_history_days).returns(10)
+
+    provider_response = provider_success_response([
+      OpenStruct.new(from: "USD", to: "EUR", date: Date.current, rate: 1.5)
+    ])
+
+    expected_start = Date.current - 10.days
+    @provider.expects(:fetch_exchange_rates)
+             .with(from: "USD", to: "EUR",
+                   start_date: expected_start,
+                   end_date: Date.current)
+             .returns(provider_response)
+
+    ExchangeRate::Importer.new(
+      exchange_rate_provider: @provider,
+      from: "USD",
+      to: "EUR",
+      start_date: 60.days.ago.to_date,
+      end_date: Date.current
+    ).import_provider_rates
   end
 
   private
     def get_provider_fetch_start_date(start_date)
-      # We fetch with a 5 day buffer to account for weekends and holidays
-      start_date - 5.days
+      start_date - ExchangeRate::Importer::PROVISIONAL_LOOKBACK_DAYS.days
     end
 end
diff --git a/test/models/exchange_rate_pair_test.rb b/test/models/exchange_rate_pair_test.rb
new file mode 100644
index 000000000..7a832fb83
--- /dev/null
+++ b/test/models/exchange_rate_pair_test.rb
@@ -0,0 +1,78 @@
+require "test_helper"
+
+class ExchangeRatePairTest < ActiveSupport::TestCase
+  test "for_pair creates a new pair if none exists" do
+    ExchangeRatePair.delete_all
+    pair = ExchangeRatePair.for_pair(from: "USD", to: "EUR")
+
+    assert_equal "USD", pair.from_currency
+    assert_equal "EUR", pair.to_currency
+    assert_nil pair.first_provider_rate_on
+  end
+
+  test "for_pair returns existing pair idempotently" do
+    ExchangeRatePair.delete_all
+    pair1 = ExchangeRatePair.for_pair(from: "USD", to: "EUR")
+    pair2 = ExchangeRatePair.for_pair(from: "USD", to: "EUR")
+
+    assert_equal pair1.id, pair2.id
+  end
+
+  test "for_pair auto-resets clamp when provider changes" do
+    ExchangeRatePair.delete_all
+
+    original_provider = Setting.exchange_rate_provider
+    begin
+      Setting.exchange_rate_provider = "twelve_data"
+      ExchangeRatePair.create!(
+        from_currency: "USD",
+        to_currency: "EUR",
+        first_provider_rate_on: 1.year.ago.to_date,
+        provider_name: "twelve_data"
+      )
+
+      Setting.exchange_rate_provider = "yahoo_finance"
+      refreshed = ExchangeRatePair.for_pair(from: "USD", to: "EUR")
+
+      assert_nil refreshed.first_provider_rate_on
+      assert_equal "yahoo_finance", refreshed.provider_name
+    ensure
+      Setting.exchange_rate_provider = original_provider
+    end
+  end
+
+  test "record_first_provider_rate_on sets date on NULL" do
+    ExchangeRatePair.delete_all
+    ExchangeRatePair.for_pair(from: "USD", to: "EUR")
+
+    ExchangeRatePair.record_first_provider_rate_on(from: "USD", to: "EUR", date: 6.months.ago.to_date)
+
+    pair = ExchangeRatePair.find_by!(from_currency: "USD", to_currency: "EUR")
+    assert_equal 6.months.ago.to_date, pair.first_provider_rate_on
+  end
+
+  test "record_first_provider_rate_on moves earlier but not forward" do
+    ExchangeRatePair.delete_all
+
+    original_provider = Setting.exchange_rate_provider
+    begin
+      Setting.exchange_rate_provider = "twelve_data"
+      ExchangeRatePair.create!(
+        from_currency: "USD",
+        to_currency: "EUR",
+        first_provider_rate_on: 6.months.ago.to_date,
+        provider_name: "twelve_data"
+      )
+
+      ExchangeRatePair.record_first_provider_rate_on(from: "USD", to: "EUR", date: 1.year.ago.to_date)
+      pair = ExchangeRatePair.find_by!(from_currency: "USD", to_currency: "EUR")
+      assert_equal 1.year.ago.to_date, pair.first_provider_rate_on
+
+      ExchangeRatePair.record_first_provider_rate_on(from: "USD", to: "EUR", date: 3.months.ago.to_date)
+      pair.reload
+      assert_equal 1.year.ago.to_date, pair.first_provider_rate_on
+    ensure
+      Setting.exchange_rate_provider = original_provider
+    end
+  end
+end
diff --git a/test/models/family/data_exporter_test.rb b/test/models/family/data_exporter_test.rb
index e25ed0e5d..206c5e9d6 100644
--- a/test/models/family/data_exporter_test.rb
+++ b/test/models/family/data_exporter_test.rb
@@ -5,6 +5,7 @@ class Family::DataExporterTest < ActiveSupport::TestCase
     @family = families(:dylan_family)
     @other_family = families(:empty)
     @exporter = Family::DataExporter.new(@family)
+    @opening_anchor_date = Date.parse("2024-05-01")
 
     # Create some test data for the family
     @account = @family.accounts.create!(
@@ -13,6 +14,13 @@ class Family::DataExporterTest < ActiveSupport::TestCase
       balance: 1000,
       currency: "USD"
     )
+    @account.entries.create!(
+      date: @opening_anchor_date,
+      amount: 1000,
+      name: "Opening balance",
+      currency: "USD",
+      entryable: Valuation.new(kind: "opening_anchor")
+    )
 
     @category = @family.categories.create!(
       name: "Test Category",
@@ -47,7 +55,7 @@ class Family::DataExporterTest < ActiveSupport::TestCase
     assert zip_data.is_a?(StringIO)
 
     # Check that the zip contains all expected files
-    expected_files = [ "accounts.csv", "transactions.csv", "trades.csv", "categories.csv", "rules.csv", "all.ndjson" ]
+    expected_files = [ "version.txt", "accounts.csv", "transactions.csv", "trades.csv", "categories.csv", "rules.csv", "attachments.json", "all.ndjson" ]
 
     Zip::File.open_buffer(zip_data) do |zip|
       actual_files = zip.entries.map(&:name)
@@ -55,21 +63,132 @@ class Family::DataExporterTest < ActiveSupport::TestCase
     end
   end
 
+  test "exports attachment manifest metadata without binary payloads" do
+    entry = @account.entries.create!(
+      name: "Receipt Transaction",
+      amount: 12.34,
+      currency: "USD",
+      date: Date.current,
+      entryable: Transaction.new
+    )
+    transaction = entry.transaction
+    transaction.attachments.attach(
+      io: StringIO.new("receipt bytes"),
+      filename: "receipt.pdf",
+      content_type: "application/pdf"
+    )
+
+    family_document = @family.family_documents.create!(
+      filename: "statement.pdf",
+      status: "ready"
+    )
+    family_document.file.attach(
+      io: StringIO.new("statement bytes"),
+      filename: "statement.pdf",
+      content_type: "application/pdf"
+    )
+
+    other_account = @other_family.accounts.create!(
+      name: "Other Attachment Account",
+      accountable: Depository.new,
+      balance: 0,
+      currency: "USD"
+    )
+    other_entry = other_account.entries.create!(
+      name: "Other Receipt",
+      amount: 1,
+      currency: "USD",
+      date: Date.current,
+      entryable: Transaction.new
+    )
+    other_entry.transaction.attachments.attach(
+      io: StringIO.new("other bytes"),
+      filename: "other-receipt.pdf",
+      content_type: "application/pdf"
+    )
+
+    zip_data = @exporter.generate_export
+
+    Zip::File.open_buffer(zip_data) do |zip|
+      manifest = JSON.parse(zip.read("attachments.json"))
+      attachments = manifest["attachments"]
+      filenames = attachments.map { |attachment| attachment["filename"] }
+
+      assert_equal 1, manifest["version"]
+      assert_equal false, manifest["binary_included"]
+      assert_includes filenames, "receipt.pdf"
+      assert_includes filenames, "statement.pdf"
+      refute_includes filenames, "other-receipt.pdf"
+
+      transaction_item = attachments.find { |attachment| attachment["record_type"] == "Transaction" }
+      assert_equal transaction.id, transaction_item["record_id"]
+      assert_equal entry.id, transaction_item["entry_id"]
+      assert_equal @account.id, transaction_item["account_id"]
+      assert_equal "attachments", transaction_item["name"]
+      assert_equal "application/pdf", transaction_item["content_type"]
+      assert_equal false, transaction_item["binary_included"]
+
+      document_item = attachments.find { |attachment| attachment["record_type"] == "FamilyDocument" }
+      assert_equal family_document.id, document_item["record_id"]
+      assert_equal "ready", document_item["status"]
+      assert_equal "file", document_item["name"]
+      assert_equal false, document_item["binary_included"]
+    end
+  end
+
+  test "exports split parent receipts in attachment manifest" do
+    split_parent = create_transaction_entry(
+      @account,
+      amount: 60,
+      date: Date.parse("2024-01-25"),
+      name: "Split parent receipt"
+    )
+    split_parent.entryable.attachments.attach(
+      io: StringIO.new("split parent receipt bytes"),
+      filename: "split-parent-receipt.pdf",
+      content_type: "application/pdf"
+    )
+    split_parent.split!([
+      { name: "Split child", amount: 60, category_id: @category.id }
+    ])
+
+    zip_data = @exporter.generate_export
+
+    Zip::File.open_buffer(zip_data) do |zip|
+      manifest = JSON.parse(zip.read("attachments.json"))
+      attachment = manifest["attachments"].find { |item| item["filename"] == "split-parent-receipt.pdf" }
+
+      assert attachment
+      assert_equal "Transaction", attachment["record_type"]
+      assert_equal split_parent.entryable.id, attachment["record_id"]
+      assert_equal split_parent.id, attachment["entry_id"]
+      assert_equal @account.id, attachment["account_id"]
+    end
+  end
+
   test "generates valid CSV files" do
     zip_data = @exporter.generate_export
 
     Zip::File.open_buffer(zip_data) do |zip|
       # Check accounts.csv
       accounts_csv = zip.read("accounts.csv")
-      assert accounts_csv.include?("id,name,type,subtype,balance,currency,created_at")
+      assert_equal [ "id", "name", "type", "subtype", "balance", "currency", "created_at" ],
+                   CSV.parse(accounts_csv, headers: true).headers
+
+      # Check version marker
+      version_txt = zip.read("version.txt")
+      assert_includes version_txt, "export_version: 2"
+      refute_includes version_txt, "csv_export_version"
 
       # Check transactions.csv
       transactions_csv = zip.read("transactions.csv")
-      assert transactions_csv.include?("date,account_name,amount,name,category,tags,notes,currency")
+      assert_equal [ "date", "account_name", "amount", "name", "category", "tags", "notes", "currency" ],
+                   CSV.parse(transactions_csv, headers: true).headers
 
       # Check trades.csv
       trades_csv = zip.read("trades.csv")
-      assert trades_csv.include?("date,account_name,ticker,quantity,price,amount,currency")
+      assert_equal [ "date", "account_name", "ticker", "quantity", "price", "amount", "currency" ],
+                   CSV.parse(trades_csv, headers: true).headers
 
       # Check categories.csv
       categories_csv = zip.read("categories.csv")
@@ -81,6 +200,109 @@ class Family::DataExporterTest < ActiveSupport::TestCase
     end
   end
 
+  test "exports transaction CSV rows with restored legacy ISO date stored amount account name and comma tags" do
+    tag2 = @family.tags.create!(name: "Food, Dining|Cafe", color: "#0000FF")
+    entry = @account.entries.create!(
+      name: "CSV Grocery",
+      amount: 42.50,
+      currency: "USD",
+      date: Date.parse("2024-05-15"),
+      notes: "Weekly grocery run",
+      entryable: Transaction.new(category: @category)
+    )
+    entry.transaction.tags << @tag
+    entry.transaction.tags << tag2
+
+    zip_data = @exporter.generate_export
+
+    Zip::File.open_buffer(zip_data) do |zip|
+      rows = CSV.parse(zip.read("transactions.csv"), headers: true)
+      row = rows.find { |csv_row| csv_row["name"] == "CSV Grocery" }
+
+      assert_not_nil row
+      assert_equal "2024-05-15", row["date"]
+      assert_equal "42.5", row["amount"]
+      assert_equal @account.name, row["account_name"]
+      assert_includes row["tags"], ","
+      assert_includes row["tags"], "\\,"
+      assert_includes row["tags"], "\\|"
+      assert_equal [ @tag.name, tag2.name ].sort, Import::Row.new(tags: row["tags"]).tags_list.sort
+    end
+  end
+
+  test "exported CSV files can generate matching import rows" do
+    create_csv_export_trade!
+    @account.entries.create!(
+      name: "CSV Importable Transaction",
+      amount: 15.25,
+      currency: "USD",
+      date: Date.parse("2024-05-16"),
+      entryable: Transaction.new(category: @category)
+    )
+
+    zip_data = @exporter.generate_export
+
+    Zip::File.open_buffer(zip_data) do |zip|
+      accounts_csv = zip.read("accounts.csv")
+      account_import = @other_family.imports.create!(
+        type: "AccountImport",
+        raw_file_str: accounts_csv,
+        entity_type_col_label: "Account type*",
+        name_col_label: "Name*",
+        amount_col_label: "Balance*",
+        currency_col_label: "Currency",
+        date_col_label: "Balance Date",
+        date_format: "%Y-%m-%d"
+      )
+      account_import.generate_rows_from_csv
+      account_row = account_import.rows.reload.find_by!(name: @account.name)
+      assert account_row.valid?
+      assert_equal @account.accountable_type, account_row.entity_type
+      assert_equal BigDecimal(@account.balance.to_s), BigDecimal(account_row.amount)
+      assert account_row.date.blank?
+
+      transaction_import = @other_family.imports.create!(
+        type: "TransactionImport",
+        raw_file_str: zip.read("transactions.csv"),
+        date_col_label: "date*",
+        amount_col_label: "amount*",
+        name_col_label: "name",
+        currency_col_label: "currency",
+        category_col_label: "category",
+        tags_col_label: "tags",
+        account_col_label: "account",
+        notes_col_label: "notes",
+        date_format: "%Y-%m-%d",
+        signage_convention: "inflows_negative"
+      )
+      transaction_import.generate_rows_from_csv
+      transaction_row = transaction_import.rows.reload.find_by!(name: "CSV Importable Transaction")
+      assert transaction_row.valid?
+      assert_equal @account.name, transaction_row.account
+      assert_equal BigDecimal("15.25"), transaction_row.signed_amount
+
+      trade_import = @other_family.imports.create!(
+        type: "TradeImport",
+        raw_file_str: zip.read("trades.csv"),
+        date_col_label: "date*",
+        ticker_col_label: "ticker*",
+        exchange_operating_mic_col_label: "exchange_operating_mic",
+        currency_col_label: "currency",
+        qty_col_label: "qty*",
+        price_col_label: "price*",
+        account_col_label: "account",
+        name_col_label: "name",
+        date_format: "%Y-%m-%d",
+        signage_convention: "inflows_positive"
+      )
+      trade_import.generate_rows_from_csv
+      trade_row = trade_import.rows.reload.find_by!(ticker: @csv_export_trade_ticker)
+      assert trade_row.valid?
+      assert_equal @account.name, trade_row.account
+      assert_equal BigDecimal("10"), BigDecimal(trade_row.qty)
+    end
+  end
+
   test "generates valid NDJSON file" do
     zip_data = @exporter.generate_export
 
@@ -215,9 +437,56 @@ class Family::DataExporterTest < ActiveSupport::TestCase
       assert_equal "set_transaction_category", actions[0]["action_type"]
       # Should export category name instead of UUID
       assert_equal "Test Category", actions[0]["value"]
+      assert_equal({ "type" => "Category", "id" => @category.id, "name" => "Test Category" }, actions[0]["value_ref"])
     end
   end
 
+  test "exports rule condition value refs for mapped operands" do
+    category_rule = @family.rules.build(
+      name: "Category Condition Rule",
+      resource_type: "transaction",
+      active: true
+    )
+    category_rule.conditions.build(
+      condition_type: "transaction_category",
+      operator: "=",
+      value: @category.id
+    )
+    category_rule.actions.build(action_type: "auto_categorize")
+    category_rule.save!
+
+    zip_data = @exporter.generate_export
+
+    Zip::File.open_buffer(zip_data) do |zip|
+      rule_data = zip.read("all.ndjson").split("\n").filter_map do |line|
+        parsed = JSON.parse(line)
+        parsed if parsed["type"] == "Rule" && parsed["data"]["name"] == "Category Condition Rule"
+      end.first
+
+      condition = rule_data["data"]["conditions"].first
+      assert_equal "Test Category", condition["value"]
+      assert_equal({ "type" => "Category", "id" => @category.id, "name" => "Test Category" }, condition["value_ref"])
+    end
+  end
+
+  test "rule operand lookup skips name fallback for stale UUID values" do
+    stale_uuid = SecureRandom.uuid
+    relation = mock
+    relation.expects(:find_by).with(id: stale_uuid).once.returns(nil)
+    relation.expects(:find_by).with(name: stale_uuid).never
+
+    operand = @exporter.send(
+      :rule_operand,
+      stale_uuid,
+      type: "Category",
+      relation: relation,
+      fallback_to_name: true
+    )
+
+    assert_equal stale_uuid, operand[:value]
+    assert_nil operand[:value_ref]
+  end
+
   test "exports rule actions and maps tag UUIDs to names" do
     # Create a rule with a tag action
     tag_rule = @family.rules.build(
@@ -256,6 +525,7 @@ class Family::DataExporterTest < ActiveSupport::TestCase
       assert_equal "set_transaction_tags", actions[0]["action_type"]
       # Should export tag name instead of UUID
       assert_equal "Test Tag", actions[0]["value"]
+      assert_equal({ "type" => "Tag", "id" => @tag.id, "name" => "Test Tag" }, actions[0]["value_ref"])
     end
   end
 
@@ -310,6 +580,252 @@ class Family::DataExporterTest < ActiveSupport::TestCase
     end
   end
 
+  test "exports valuation kind in NDJSON" do
+    valuation_entry = @account.entries.create!(
+      date: Date.parse("2020-04-01"),
+      amount: 1000,
+      name: "Opening balance",
+      currency: "USD",
+      entryable: Valuation.new(kind: "opening_anchor")
+    )
+
+    zip_data = @exporter.generate_export
+
+    Zip::File.open_buffer(zip_data) do |zip|
+      ndjson_content = zip.read("all.ndjson")
+      valuation_lines = ndjson_content.split("\n").select do |line|
+        JSON.parse(line)["type"] == "Valuation"
+      end
+
+      assert valuation_lines.any?
+
+      valuation_data = valuation_lines
+        .map { |line| JSON.parse(line) }
+        .find { |line| line.dig("data", "entry_id") == valuation_entry.id }
+
+      assert valuation_data
+      assert_equal "opening_anchor", valuation_data["data"]["kind"]
+    end
+  end
+
+  test "exports recurring transactions in NDJSON" do
+    merchant = @family.merchants.create!(name: "Internet Provider")
+    recurring_transaction = @family.recurring_transactions.create!(
+      account: @account,
+      merchant: merchant,
+      amount: -89.99,
+      currency: "USD",
+      expected_day_of_month: 14,
+      last_occurrence_date: Date.parse("2024-01-14"),
+      next_expected_date: Date.parse("2024-02-14"),
+      status: "active",
+      occurrence_count: 6,
+      manual: true,
+      expected_amount_min: -95,
+      expected_amount_max: -85,
+      expected_amount_avg: -89.99
+    )
+
+    zip_data = @exporter.generate_export
+
+    Zip::File.open_buffer(zip_data) do |zip|
+      ndjson_content = zip.read("all.ndjson")
+      recurring_data = ndjson_content
+        .split("\n")
+        .map { |line| JSON.parse(line) }
+        .find { |line| line["type"] == "RecurringTransaction" && line.dig("data", "id") == recurring_transaction.id }
+
+      assert recurring_data
+      assert_equal recurring_transaction.id, recurring_data["data"]["id"]
+      assert_equal @account.id, recurring_data["data"]["account_id"]
+      assert_equal merchant.id, recurring_data["data"]["merchant_id"]
+      assert_equal "-89.99", BigDecimal(recurring_data["data"]["amount"].to_s).to_s("F")
+      assert_equal "active", recurring_data["data"]["status"]
+      assert_equal true, recurring_data["data"]["manual"]
+      assert_not recurring_data["data"].key?("family_id")
+    end
+  end
+
+  test "exports transfer decisions and rejected transfers in NDJSON" do
+    destination_account = @family.accounts.create!(
+      name: "Savings Account",
+      accountable: Depository.new,
+      balance: 0,
+      currency: "USD"
+    )
+
+    transfer_outflow = create_transaction_entry(@account, amount: 100, date: Date.parse("2024-01-15"), name: "Transfer to savings")
+    transfer_inflow = create_transaction_entry(destination_account, amount: -100, date: Date.parse("2024-01-15"), name: "Transfer from checking")
+    transfer = Transfer.create!(
+      outflow_transaction: transfer_outflow.entryable,
+      inflow_transaction: transfer_inflow.entryable,
+      status: "confirmed",
+      notes: "Confirmed by user"
+    )
+
+    rejected_outflow = create_transaction_entry(@account, amount: 25, date: Date.parse("2024-01-20"), name: "Candidate outflow")
+    rejected_inflow = create_transaction_entry(destination_account, amount: -25, date: Date.parse("2024-01-20"), name: "Candidate inflow")
+    rejected_transfer = RejectedTransfer.create!(
+      outflow_transaction: rejected_outflow.entryable,
+      inflow_transaction: rejected_inflow.entryable
+    )
+
+    zip_data = @exporter.generate_export
+
+    Zip::File.open_buffer(zip_data) do |zip|
+      ndjson_records = zip.read("all.ndjson").split("\n").map { |line| JSON.parse(line) }
+
+      transfer_data = ndjson_records.find { |record| record["type"] == "Transfer" && record.dig("data", "id") == transfer.id }
+      assert transfer_data
+      assert_equal transfer_inflow.entryable.id, transfer_data["data"]["inflow_transaction_id"]
+      assert_equal transfer_outflow.entryable.id, transfer_data["data"]["outflow_transaction_id"]
+      assert_equal "confirmed", transfer_data["data"]["status"]
+      assert_equal "Confirmed by user", transfer_data["data"]["notes"]
+
+      rejected_transfer_data = ndjson_records.find { |record| record["type"] == "RejectedTransfer" && record.dig("data", "id") == rejected_transfer.id }
+      assert rejected_transfer_data
+      assert_equal rejected_inflow.entryable.id, rejected_transfer_data["data"]["inflow_transaction_id"]
+      assert_equal rejected_outflow.entryable.id, rejected_transfer_data["data"]["outflow_transaction_id"]
+
+      # Transfer decisions must follow Transaction records so import can remap both sides.
+      transaction_indices = ndjson_records.each_index.select { |index| ndjson_records[index]["type"] == "Transaction" }
+      transfer_index = ndjson_records.index(transfer_data)
+      rejected_transfer_index = ndjson_records.index(rejected_transfer_data)
+
+      assert_operator transaction_indices.max, :<, transfer_index
+      assert_operator transaction_indices.max, :<, rejected_transfer_index
+    end
+  end
+
+  test "does not export transfer decisions for split parent transactions" do
+    destination_account = @family.accounts.create!(
+      name: "Split Transfer Savings",
+      accountable: Depository.new,
+      balance: 0,
+      currency: "USD"
+    )
+
+    split_parent_outflow = create_transaction_entry(@account, amount: 60, date: Date.parse("2024-01-25"), name: "Split transfer parent")
+    split_parent_outflow.split!([
+      { name: "Split transfer child", amount: 60, category_id: @category.id }
+    ])
+    transfer_inflow = create_transaction_entry(destination_account, amount: -60, date: Date.parse("2024-01-25"), name: "Split transfer inflow")
+    transfer = Transfer.create!(
+      outflow_transaction: split_parent_outflow.entryable,
+      inflow_transaction: transfer_inflow.entryable,
+      status: "confirmed"
+    )
+
+    zip_data = @exporter.generate_export
+
+    Zip::File.open_buffer(zip_data) do |zip|
+      ndjson_records = zip.read("all.ndjson").split("\n").map { |line| JSON.parse(line) }
+
+      transaction_ids = ndjson_records
+        .select { |record| record["type"] == "Transaction" }
+        .map { |record| record.dig("data", "id") }
+      transfer_ids = ndjson_records
+        .select { |record| record["type"] == "Transfer" }
+        .map { |record| record.dig("data", "id") }
+
+      assert_not_includes transaction_ids, split_parent_outflow.entryable.id
+      assert_not_includes transfer_ids, transfer.id
+    end
+  end
+
+  test "exports balance history in NDJSON for backup verification" do
+    balance = @account.balances.create!(
+      date: Date.parse("2024-01-15"),
+      balance: 1234.56,
+      cash_balance: 1234.56,
+      start_cash_balance: 1000,
+      start_non_cash_balance: 0,
+      cash_inflows: 234.56,
+      cash_outflows: 0,
+      flows_factor: 1,
+      currency: "USD"
+    )
+
+    zip_data = @exporter.generate_export
+
+    Zip::File.open_buffer(zip_data) do |zip|
+      ndjson_records = zip.read("all.ndjson").split("\n").map { |line| JSON.parse(line) }
+      balance_data = ndjson_records.find { |record| record["type"] == "Balance" && record.dig("data", "id") == balance.id }
+
+      assert balance_data
+      assert_equal @account.id, balance_data["data"]["account_id"]
+      assert_equal "2024-01-15", balance_data["data"]["date"]
+      assert_equal "1234.56", BigDecimal(balance_data["data"]["balance"].to_s).to_s("F")
+      assert_equal "USD", balance_data["data"]["currency"]
+    end
+  end
+
+  test "exports balance history chronologically" do
+    @account.balances.create!(date: Date.parse("2024-03-01"), balance: 300, flows_factor: 1, currency: "USD")
+    @account.balances.create!(date: Date.parse("2024-01-01"), balance: 100, flows_factor: 1, currency: "USD")
+
+    zip_data = @exporter.generate_export
+
+    Zip::File.open_buffer(zip_data) do |zip|
+      balance_dates = zip.read("all.ndjson")
+        .split("\n")
+        .map { |line| JSON.parse(line) }
+        .select { |record| record["type"] == "Balance" }
+        .map { |record| Date.iso8601(record.dig("data", "date")) }
+
+      assert_equal balance_dates.sort, balance_dates
+    end
+  end
+
+  test "exports holding snapshots in NDJSON" do
+    investment_account = @family.accounts.create!(
+      name: "Investment Account",
+      accountable: Investment.new,
+      balance: 25_000,
+      currency: "USD"
+    )
+    security = Security.create!(
+      ticker: "VTI#{SecureRandom.hex(4).upcase}",
+      name: "Vanguard Total Stock Market ETF",
+      country_code: "US",
+      exchange_operating_mic: "ARCX"
+    )
+    holding = investment_account.holdings.create!(
+      security: security,
+      date: Date.parse("2024-01-15"),
+      qty: 100,
+      price: 250.25,
+      amount: 25_025,
+      currency: "USD",
+      cost_basis: 200,
+      cost_basis_source: "manual",
+      cost_basis_locked: true,
+      security_locked: true
+    )
+
+    zip_data = @exporter.generate_export
+
+    Zip::File.open_buffer(zip_data) do |zip|
+      ndjson_records = zip.read("all.ndjson").split("\n").map { |line| JSON.parse(line) }
+      holding_data = ndjson_records.find { |record| record["type"] == "Holding" && record.dig("data", "id") == holding.id }
+
+      assert holding_data
+      assert_equal investment_account.id, holding_data["data"]["account_id"]
+      assert_equal security.id, holding_data["data"]["security_id"]
+      assert_equal security.ticker, holding_data["data"]["ticker"]
+      assert_equal "ARCX", holding_data["data"]["exchange_operating_mic"]
+      assert_equal "2024-01-15", holding_data["data"]["date"]
+      assert_equal "100.0", BigDecimal(holding_data["data"]["qty"].to_s).to_s("F")
+      assert_equal "250.25", BigDecimal(holding_data["data"]["price"].to_s).to_s("F")
+      assert_equal "25025.0", BigDecimal(holding_data["data"]["amount"].to_s).to_s("F")
+      assert_equal "200.0", BigDecimal(holding_data["data"]["cost_basis"].to_s).to_s("F")
+      assert_equal "manual", holding_data["data"]["cost_basis_source"]
+      assert_equal true, holding_data["data"]["cost_basis_locked"]
+      assert_not holding_data["data"].key?("created_at")
+      assert_not holding_data["data"].key?("updated_at")
+    end
+  end
+
   test "only exports rules from the specified family" do
     # Create a rule for another family that should NOT be exported
     other_rule = @other_family.rules.build(
@@ -341,4 +857,38 @@ class Family::DataExporterTest < ActiveSupport::TestCase
       refute ndjson_content.include?(other_rule.name)
     end
   end
+
+  private
+
+    def create_transaction_entry(account, amount:, date:, name:)
+      account.entries.create!(
+        date: date,
+        amount: amount,
+        name: name,
+        currency: account.currency,
+        entryable: Transaction.new(kind: "funds_movement")
+      )
+    end
+
+    def create_csv_export_trade!
+      security = Security.create!(
+        ticker: "CSV#{SecureRandom.hex(3).upcase}",
+        name: "CSV Export Security",
+        exchange_operating_mic: "XNAS"
+      )
+      @csv_export_trade_ticker = security.ticker
+
+      @account.entries.create!(
+        date: Date.parse("2024-05-17"),
+        amount: 1500,
+        name: "CSV Export Buy",
+        currency: "USD",
+        entryable: Trade.new(
+          security: security,
+          qty: 10,
+          price: 150,
+          currency: "USD"
+        )
+      )
+    end
 end
diff --git a/test/models/family/data_importer_test.rb b/test/models/family/data_importer_test.rb
index 29f4f5bb1..c6c75dda1 100644
--- a/test/models/family/data_importer_test.rb
+++ b/test/models/family/data_importer_test.rb
@@ -31,6 +31,327 @@ class Family::DataImporterTest < ActiveSupport::TestCase
     assert_equal "Depository", account.accountable_type
   end
 
+  test "imports non-destructive account status from ndjson" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "disabled-account",
+          name: "Closed Checking",
+          balance: "0.00",
+          currency: "USD",
+          accountable_type: "Depository",
+          status: "disabled"
+        }
+      }
+    ])
+
+    importer = Family::DataImporter.new(@family, ndjson)
+    result = importer.import!
+
+    account = result[:accounts].first
+    assert_equal "Closed Checking", account.name
+    assert_equal "disabled", account.status
+  end
+
+  test "does not import pending deletion account status" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "pending-delete-account",
+          name: "Pending Delete Checking",
+          balance: "0.00",
+          currency: "USD",
+          accountable_type: "Depository",
+          status: "pending_deletion"
+        }
+      }
+    ])
+
+    importer = Family::DataImporter.new(@family, ndjson)
+    result = importer.import!
+
+    account = result[:accounts].first
+    assert_equal "Pending Delete Checking", account.name
+    assert_equal "active", account.status
+  end
+
+  test "imports raw balance history records" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "acct-1",
+          name: "Balance History Checking",
+          balance: "1200.00",
+          currency: "USD",
+          accountable_type: "Depository"
+        }
+      },
+      {
+        type: "Balance",
+        data: {
+          id: "balance-1",
+          account_id: "acct-1",
+          date: "2024-01-31",
+          balance: "1200.00",
+          currency: "USD",
+          cash_balance: "1100.00",
+          start_cash_balance: "1000.00",
+          start_non_cash_balance: "0.00",
+          cash_inflows: "300.00",
+          cash_outflows: "200.00",
+          non_cash_inflows: "0.00",
+          non_cash_outflows: "0.00",
+          net_market_flows: "0.00",
+          cash_adjustments: "0.00",
+          non_cash_adjustments: "0.00",
+          flows_factor: 1
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    account = @family.accounts.find_by!(name: "Balance History Checking")
+    balance = account.balances.find_by!(date: Date.parse("2024-01-31"), currency: "USD")
+
+    assert_equal 1200.0, balance.balance.to_f
+    assert_equal 1100.0, balance.cash_balance.to_f
+    assert_equal 1000.0, balance.start_cash_balance.to_f
+    assert_equal 300.0, balance.cash_inflows.to_f
+    assert_equal 200.0, balance.cash_outflows.to_f
+    assert_equal 1, balance.flows_factor
+  end
+
+  test "imports duplicate raw balance records idempotently by account date and currency" do
+    balance_record = {
+      type: "Balance",
+      data: {
+        id: "balance-1",
+        account_id: "acct-1",
+        date: "2024-01-31",
+        balance: "1200.00",
+        currency: "USD",
+        cash_balance: "1100.00",
+        flows_factor: 1
+      }
+    }
+
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "acct-1",
+          name: "Idempotent Balance Checking",
+          balance: "1200.00",
+          currency: "USD",
+          accountable_type: "Depository"
+        }
+      },
+      balance_record,
+      balance_record.deep_merge(data: { id: "balance-1-duplicate", balance: "1300.00", cash_balance: "1250.00" })
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    account = @family.accounts.find_by!(name: "Idempotent Balance Checking")
+    assert_equal 1, account.balances.where(date: Date.parse("2024-01-31"), currency: "USD").count
+
+    balance = account.balances.find_by!(date: Date.parse("2024-01-31"), currency: "USD")
+    assert_equal 1300.0, balance.balance.to_f
+    assert_equal 1250.0, balance.cash_balance.to_f
+  end
+
+  test "preserves omitted raw balance components on duplicate records" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "acct-1",
+          name: "Partial Balance Checking",
+          balance: "1200.00",
+          currency: "USD",
+          accountable_type: "Depository"
+        }
+      },
+      {
+        type: "Balance",
+        data: {
+          id: "balance-1",
+          account_id: "acct-1",
+          date: "2024-01-31",
+          balance: "1200.00",
+          currency: "USD",
+          cash_balance: "1100.00",
+          cash_inflows: "300.00",
+          cash_outflows: "200.00",
+          flows_factor: -1
+        }
+      },
+      {
+        type: "Balance",
+        data: {
+          id: "balance-1-partial",
+          account_id: "acct-1",
+          date: "2024-01-31",
+          balance: "1300.00",
+          currency: "USD"
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    account = @family.accounts.find_by!(name: "Partial Balance Checking")
+    balance = account.balances.find_by!(date: Date.parse("2024-01-31"), currency: "USD")
+
+    assert_equal 1300.0, balance.balance.to_f
+    assert_equal 1100.0, balance.cash_balance.to_f
+    assert_equal 300.0, balance.cash_inflows.to_f
+    assert_equal 200.0, balance.cash_outflows.to_f
+    assert_equal(-1, balance.flows_factor)
+  end
+
+  test "dates synthesized account opening balance before imported balance history" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "acct-1",
+          name: "Balance Anchored Checking",
+          balance: "500.00",
+          currency: "USD",
+          accountable_type: "Depository"
+        }
+      },
+      {
+        type: "Balance",
+        data: {
+          id: "balance-1",
+          account_id: "acct-1",
+          date: "2024-02-01",
+          balance: "500.00",
+          currency: "USD"
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    account = @family.accounts.find_by!(name: "Balance Anchored Checking")
+    opening_anchor = account.valuations.opening_anchor.first
+
+    assert_not_nil opening_anchor
+    assert_equal Date.parse("2024-01-31"), opening_anchor.entry.date
+  end
+
+  test "dates synthesized account opening balance before oldest imported activity" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "acct-1",
+          name: "Main Account",
+          balance: "5000",
+          currency: "USD",
+          accountable_type: "Depository"
+        }
+      },
+      {
+        type: "Transaction",
+        data: {
+          id: "txn-1",
+          account_id: "acct-1",
+          date: "2020-04-02",
+          amount: "-50.00",
+          name: "Grocery Store",
+          currency: "USD"
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    account = @family.accounts.find_by!(name: "Main Account")
+    opening_anchor = account.valuations.opening_anchor.first
+
+    assert_not_nil opening_anchor
+    assert_equal Date.parse("2020-04-01"), opening_anchor.entry.date
+  end
+
+  test "clamps explicit account opening balance dates before imported activity" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "acct-1",
+          name: "Main Account",
+          balance: "5000",
+          currency: "USD",
+          accountable_type: "Depository",
+          opening_balance_date: "2020-04-02"
+        }
+      },
+      {
+        type: "Transaction",
+        data: {
+          id: "txn-1",
+          account_id: "acct-1",
+          date: "2020-04-02",
+          amount: "-50.00",
+          name: "Grocery Store",
+          currency: "USD"
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    account = @family.accounts.find_by!(name: "Main Account")
+    opening_anchor = account.valuations.opening_anchor.first
+
+    assert_not_nil opening_anchor
+    assert_equal Date.parse("2020-04-01"), opening_anchor.entry.date
+  end
+
+  test "imports explicit opening anchor valuations without synthesizing duplicates" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "acct-1",
+          name: "Main Account",
+          balance: "5000",
+          currency: "USD",
+          accountable_type: "Depository"
+        }
+      },
+      {
+        type: "Valuation",
+        data: {
+          id: "val-opening",
+          account_id: "acct-1",
+          date: "2020-04-01",
+          amount: "5000",
+          name: "Opening balance",
+          currency: "USD",
+          kind: "opening_anchor"
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    account = @family.accounts.find_by!(name: "Main Account")
+    opening_anchors = account.valuations.opening_anchor.to_a
+
+    assert_equal 1, opening_anchors.count
+    assert_equal Date.parse("2020-04-01"), opening_anchors.first.entry.date
+    assert_equal 5000.0, opening_anchors.first.entry.amount.to_f
+  end
+
   test "imports categories with parent relationships" do
     ndjson = build_ndjson([
       {
@@ -103,6 +424,255 @@ class Family::DataImporterTest < ActiveSupport::TestCase
     assert_not_nil merchant
   end
 
+  test "imports recurring transactions with remapped account and merchant references" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "acct-1",
+          name: "Main Checking",
+          balance: "5000",
+          currency: "USD",
+          accountable_type: "Depository"
+        }
+      },
+      {
+        type: "Merchant",
+        data: {
+          id: "merchant-1",
+          name: "Internet Provider"
+        }
+      },
+      {
+        type: "RecurringTransaction",
+        data: {
+          id: "recurring-1",
+          account_id: "acct-1",
+          merchant_id: "merchant-1",
+          amount: "-89.99",
+          currency: "USD",
+          expected_day_of_month: 14,
+          last_occurrence_date: "2024-01-14",
+          next_expected_date: "2024-02-14",
+          status: "active",
+          occurrence_count: 6,
+          manual: true,
+          expected_amount_min: "-95.00",
+          expected_amount_max: "-85.00",
+          expected_amount_avg: "-89.99"
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    recurring_transaction = @family.recurring_transactions.first
+    assert_not_nil recurring_transaction
+    assert_equal "Main Checking", recurring_transaction.account.name
+    assert_equal "Internet Provider", recurring_transaction.merchant.name
+    assert_equal(-89.99, recurring_transaction.amount.to_f)
+    assert_equal "USD", recurring_transaction.currency
+    assert_equal 14, recurring_transaction.expected_day_of_month
+    assert_equal Date.parse("2024-01-14"), recurring_transaction.last_occurrence_date
+    assert_equal Date.parse("2024-02-14"), recurring_transaction.next_expected_date
+    assert_equal "active", recurring_transaction.status
+    assert_equal 6, recurring_transaction.occurrence_count
+    assert_equal true, recurring_transaction.manual
+    assert_equal(-95.0, recurring_transaction.expected_amount_min.to_f)
+    assert_equal(-85.0, recurring_transaction.expected_amount_max.to_f)
+    assert_equal(-89.99, recurring_transaction.expected_amount_avg.to_f)
+  end
+
+  test "round trips recurring transaction export semantics" do
+    source_family = Family.create!(name: "Recurring Source", currency: "USD")
+    source_account = source_family.accounts.create!(
+      name: "Source Checking",
+      accountable: Depository.new,
+      balance: 1000,
+      currency: "USD"
+    )
+    source_merchant = source_family.merchants.create!(name: "Internet Provider")
+
+    source_family.recurring_transactions.create!(
+      account: source_account,
+      merchant: source_merchant,
+      amount: -89.99,
+      currency: "USD",
+      expected_day_of_month: 14,
+      last_occurrence_date: Date.parse("2024-01-14"),
+      next_expected_date: Date.parse("2024-02-14"),
+      status: "active",
+      occurrence_count: 6,
+      manual: true,
+      expected_amount_min: -95,
+      expected_amount_max: -85,
+      expected_amount_avg: -89.99
+    )
+
+    source_family.recurring_transactions.create!(
+      name: "Quarterly Insurance",
+      amount: 240,
+      currency: "USD",
+      expected_day_of_month: 28,
+      last_occurrence_date: Date.parse("2024-01-28"),
+      next_expected_date: Date.parse("2024-04-28"),
+      status: "inactive",
+      occurrence_count: 2,
+      manual: false
+    )
+
+    ndjson = nil
+    Zip::File.open_buffer(Family::DataExporter.new(source_family).generate_export) do |zip|
+      ndjson = zip.read("all.ndjson")
+    end
+
+    assert_not_nil ndjson
+    assert ndjson.include?('"type":"RecurringTransaction"')
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    assert_equal 2, @family.recurring_transactions.count
+
+    restored_account = @family.accounts.find_by!(name: "Source Checking")
+    restored_merchant = @family.merchants.find_by!(name: "Internet Provider")
+    restored_provider = @family.recurring_transactions.find_by!(merchant: restored_merchant)
+
+    assert_equal restored_account, restored_provider.account
+    assert_equal(-89.99, restored_provider.amount.to_f)
+    assert_equal "USD", restored_provider.currency
+    assert_equal 14, restored_provider.expected_day_of_month
+    assert_equal Date.parse("2024-01-14"), restored_provider.last_occurrence_date
+    assert_equal Date.parse("2024-02-14"), restored_provider.next_expected_date
+    assert_equal "active", restored_provider.status
+    assert_equal 6, restored_provider.occurrence_count
+    assert_equal true, restored_provider.manual
+    assert_equal(-95.0, restored_provider.expected_amount_min.to_f)
+    assert_equal(-85.0, restored_provider.expected_amount_max.to_f)
+    assert_equal(-89.99, restored_provider.expected_amount_avg.to_f)
+
+    restored_named = @family.recurring_transactions.find_by!(name: "Quarterly Insurance")
+    assert_nil restored_named.account
+    assert_nil restored_named.merchant
+    assert_equal 240.0, restored_named.amount.to_f
+    assert_equal 28, restored_named.expected_day_of_month
+    assert_equal Date.parse("2024-01-28"), restored_named.last_occurrence_date
+    assert_equal Date.parse("2024-04-28"), restored_named.next_expected_date
+    assert_equal "inactive", restored_named.status
+    assert_equal 2, restored_named.occurrence_count
+    assert_equal false, restored_named.manual
+  end
+
+  test "imports recurring transactions with unknown status fallback" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "acct-1",
+          name: "Main Checking",
+          balance: "5000",
+          currency: "USD",
+          accountable_type: "Depository"
+        }
+      },
+      {
+        type: "Merchant",
+        data: {
+          id: "merchant-1",
+          name: "Streaming Service"
+        }
+      },
+      {
+        type: "RecurringTransaction",
+        data: {
+          id: "recurring-1",
+          account_id: "acct-1",
+          merchant_id: "merchant-1",
+          amount: "-15.99",
+          currency: "USD",
+          expected_day_of_month: "8",
+          last_occurrence_date: "2024-01-08",
+          next_expected_date: "2024-02-08",
+          status: "paused",
+          occurrence_count: 2
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    recurring_transaction = @family.recurring_transactions.first
+    assert_not_nil recurring_transaction
+    assert_equal 8, recurring_transaction.expected_day_of_month
+    assert_equal Date.parse("2024-01-08"), recurring_transaction.last_occurrence_date
+    assert_equal Date.parse("2024-02-08"), recurring_transaction.next_expected_date
+    assert_equal "active", recurring_transaction.status
+  end
+
+  test "skips recurring transactions with missing recurrence dates" do
+    ndjson = build_ndjson([
+      {
+        type: "RecurringTransaction",
+        data: {
+          id: "recurring-1",
+          amount: "-15.99",
+          currency: "USD",
+          expected_day_of_month: "8",
+          last_occurrence_date: nil,
+          status: "active",
+          occurrence_count: 2,
+          name: "Streaming Service"
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    assert_equal 0, @family.recurring_transactions.count
+  end
+
+  test "skips recurring transactions when referenced account is missing" do
+    ndjson = build_ndjson([
+      {
+        type: "RecurringTransaction",
+        data: {
+          id: "recurring-1",
+          account_id: "missing-account",
+          amount: "-89.99",
+          currency: "USD",
+          expected_day_of_month: 14,
+          last_occurrence_date: "2024-01-14",
+          next_expected_date: "2024-02-14",
+          status: "active",
+          name: "Internet Provider"
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    assert_equal 0, @family.recurring_transactions.count
+  end
+
+  test "skips recurring transactions with blank expected day" do
+    ndjson = build_ndjson([
+      {
+        type: "RecurringTransaction",
+        data: {
+          id: "recurring-1",
+          amount: "-89.99",
+          currency: "USD",
+          expected_day_of_month: "",
+          status: "active",
+          name: "Internet Provider"
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    assert_equal 0, @family.recurring_transactions.count
+  end
+
   test "imports transactions with references" do
     ndjson = build_ndjson([
       {
@@ -202,6 +772,350 @@ class Family::DataImporterTest < ActiveSupport::TestCase
     assert_equal 150.0, trade.price.to_f
   end
 
+  test "imports holding snapshots with security identity" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "inv-acct-1",
+          name: "Investment Account",
+          balance: "10000",
+          currency: "USD",
+          accountable_type: "Investment"
+        }
+      },
+      {
+        type: "Holding",
+        data: {
+          id: "holding-1",
+          account_id: "inv-acct-1",
+          security_id: "security-1",
+          ticker: "VTI",
+          security_name: "Vanguard Total Stock Market ETF",
+          exchange_operating_mic: "ARCX",
+          country_code: "US",
+          date: "2024-01-15",
+          qty: "100",
+          price: "250.25",
+          amount: "25025.00",
+          currency: "USD",
+          cost_basis: "200.00",
+          cost_basis_source: "manual",
+          cost_basis_locked: true,
+          security_locked: true
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    account = @family.accounts.find_by!(name: "Investment Account")
+    holding = account.holdings.first
+
+    assert_not_nil holding
+    assert_equal Date.parse("2024-01-15"), holding.date
+    assert_equal "VTI", holding.security.ticker
+    assert_equal "Vanguard Total Stock Market ETF", holding.security.name
+    assert_equal "ARCX", holding.security.exchange_operating_mic
+    assert_equal 100.0, holding.qty.to_f
+    assert_equal 250.25, holding.price.to_f
+    assert_equal 25_025.0, holding.amount.to_f
+    assert_equal 200.0, holding.cost_basis.to_f
+    assert_equal "manual", holding.cost_basis_source
+    assert holding.cost_basis_locked
+    assert holding.security_locked
+
+    opening_anchor = account.valuations.opening_anchor.first
+    assert_equal Date.parse("2024-01-14"), opening_anchor.entry.date
+  end
+
+  test "imports duplicate holding snapshots idempotently by account security date and currency" do
+    holding_record = {
+      type: "Holding",
+      data: {
+        id: "holding-1",
+        account_id: "inv-acct-1",
+        security_id: "security-1",
+        ticker: "VTI",
+        security_name: "Vanguard Total Stock Market ETF",
+        exchange_operating_mic: "ARCX",
+        kind: "unsupported",
+        date: "2024-01-15",
+        qty: "100",
+        price: "250.25",
+        amount: "25025.00",
+        currency: "USD"
+      }
+    }
+
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "inv-acct-1",
+          name: "Investment Account",
+          balance: "10000",
+          currency: "USD",
+          accountable_type: "Investment"
+        }
+      },
+      holding_record,
+      holding_record.deep_merge(data: { id: "holding-1-duplicate", qty: "101", amount: "25275.25" })
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    account = @family.accounts.find_by!(name: "Investment Account")
+    assert_equal 1, account.holdings.count
+
+    holding = account.holdings.first
+    assert_equal 101.0, holding.qty.to_f
+    assert_equal 25_275.25, holding.amount.to_f
+    assert_equal "standard", holding.security.kind
+  end
+
+  test "imports same holding date in different currencies separately" do
+    holding_record = {
+      type: "Holding",
+      data: {
+        id: "holding-1",
+        account_id: "inv-acct-1",
+        security_id: "security-1",
+        ticker: "VTI",
+        security_name: "Vanguard Total Stock Market ETF",
+        exchange_operating_mic: "ARCX",
+        date: "2024-01-15",
+        qty: "100",
+        price: "250.25",
+        amount: "25025.00",
+        currency: "USD"
+      }
+    }
+
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "inv-acct-1",
+          name: "Investment Account",
+          balance: "10000",
+          currency: "USD",
+          accountable_type: "Investment"
+        }
+      },
+      holding_record,
+      holding_record.deep_merge(data: { id: "holding-2", currency: "CAD", amount: "34034.00" })
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    account = @family.accounts.find_by!(name: "Investment Account")
+    assert_equal 2, account.holdings.count
+    assert_equal %w[CAD USD], account.holdings.order(:currency).pluck(:currency)
+  end
+
+  test "round trips holding snapshots through full export" do
+    source_family = Family.create!(
+      name: "Source Family",
+      currency: "USD",
+      locale: "en",
+      date_format: "%Y-%m-%d"
+    )
+    source_account = source_family.accounts.create!(
+      name: "Round Trip Investment",
+      accountable: Investment.new,
+      balance: 25_000,
+      currency: "USD"
+    )
+    source_security = Security.create!(
+      ticker: "VTI#{SecureRandom.hex(4).upcase}",
+      name: "Vanguard Total Stock Market ETF",
+      country_code: "US",
+      exchange_operating_mic: "ARCX"
+    )
+    source_account.holdings.create!(
+      security: source_security,
+      date: Date.parse("2024-01-15"),
+      qty: 100,
+      price: 250.25,
+      amount: 25_025,
+      currency: "USD",
+      cost_basis: 200,
+      cost_basis_source: "manual",
+      cost_basis_locked: true,
+      security_locked: true
+    )
+
+    zip_data = Family::DataExporter.new(source_family).generate_export
+    ndjson = nil
+    Zip::File.open_buffer(zip_data) do |zip|
+      ndjson = zip.read("all.ndjson")
+    end
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    imported_account = @family.accounts.find_by!(name: "Round Trip Investment")
+    imported_holding = imported_account.holdings.find_by!(date: Date.parse("2024-01-15"))
+
+    assert_equal source_security.ticker, imported_holding.security.ticker
+    assert_equal "ARCX", imported_holding.security.exchange_operating_mic
+    assert_equal 100.0, imported_holding.qty.to_f
+    assert_equal 250.25, imported_holding.price.to_f
+    assert_equal 25_025.0, imported_holding.amount.to_f
+    assert_equal 200.0, imported_holding.cost_basis.to_f
+    assert_equal "manual", imported_holding.cost_basis_source
+    assert imported_holding.cost_basis_locked
+    assert imported_holding.security_locked
+  end
+
+  test "round trips raw balance history through full export" do
+    source_family = Family.create!(
+      name: "Source Balance Family",
+      currency: "USD",
+      locale: "en",
+      date_format: "%Y-%m-%d"
+    )
+    source_account = source_family.accounts.create!(
+      name: "Round Trip Balance Checking",
+      accountable: Depository.new,
+      balance: 1_500,
+      currency: "USD"
+    )
+    source_account.balances.create!(
+      date: Date.parse("2024-01-31"),
+      balance: 1_500,
+      cash_balance: 1_450,
+      currency: "USD",
+      start_cash_balance: 1_000,
+      start_non_cash_balance: 0,
+      cash_inflows: 700,
+      cash_outflows: 250,
+      non_cash_inflows: 0,
+      non_cash_outflows: 0,
+      net_market_flows: 0,
+      cash_adjustments: 0,
+      non_cash_adjustments: 0,
+      flows_factor: 1
+    )
+
+    zip_data = Family::DataExporter.new(source_family).generate_export
+    ndjson = nil
+    Zip::File.open_buffer(zip_data) do |zip|
+      ndjson = zip.read("all.ndjson")
+    end
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    imported_account = @family.accounts.find_by!(name: "Round Trip Balance Checking")
+    imported_balance = imported_account.balances.find_by!(date: Date.parse("2024-01-31"), currency: "USD")
+
+    assert_equal 1500.0, imported_balance.balance.to_f
+    assert_equal 1450.0, imported_balance.cash_balance.to_f
+    assert_equal 1000.0, imported_balance.start_cash_balance.to_f
+    assert_equal 700.0, imported_balance.cash_inflows.to_f
+    assert_equal 250.0, imported_balance.cash_outflows.to_f
+  end
+
+  test "imports holding snapshots with ticker fallback when exchange mic is missing" do
+    existing_security = Security.create!(
+      ticker: "VTI",
+      name: "Existing VTI",
+      exchange_operating_mic: "ARCX"
+    )
+
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "inv-acct-1",
+          name: "Investment Account",
+          balance: "10000",
+          currency: "USD",
+          accountable_type: "Investment"
+        }
+      },
+      {
+        type: "Holding",
+        data: {
+          id: "holding-1",
+          account_id: "inv-acct-1",
+          ticker: "VTI",
+          security_name: "Imported VTI",
+          date: "2024-01-15",
+          qty: "100",
+          price: "250.25",
+          amount: "25025.00",
+          currency: "USD",
+          cost_basis_locked: false,
+          security_locked: false
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    holding = @family.accounts.find_by!(name: "Investment Account").holdings.first
+    assert_equal existing_security, holding.security
+    assert_equal 1, Security.where(ticker: "VTI").count
+  end
+
+  test "updates cached security with safe holding metadata" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "inv-acct-1",
+          name: "Investment Account",
+          balance: "10000",
+          currency: "USD",
+          accountable_type: "Investment"
+        }
+      },
+      {
+        type: "Trade",
+        data: {
+          id: "trade-1",
+          account_id: "inv-acct-1",
+          security_id: "security-1",
+          ticker: "VTI",
+          date: "2024-01-10",
+          qty: "10",
+          price: "250.00",
+          amount: "-2500.00",
+          currency: "USD"
+        }
+      },
+      {
+        type: "Holding",
+        data: {
+          id: "holding-1",
+          account_id: "inv-acct-1",
+          security_id: "security-1",
+          ticker: "VTI",
+          security_name: "Vanguard Total Stock Market ETF",
+          exchange_operating_mic: "ARCX",
+          country_code: "US",
+          website_url: "https://investor.vanguard.com",
+          date: "2024-01-15",
+          qty: "100",
+          price: "250.25",
+          amount: "25025.00",
+          currency: "USD",
+          cost_basis_locked: false,
+          security_locked: false
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    security = @family.holdings.first.security
+    assert_equal "Vanguard Total Stock Market ETF", security.name
+    assert_equal "ARCX", security.exchange_operating_mic
+    assert_equal "US", security.country_code
+    assert_equal "https://investor.vanguard.com", security.website_url
+  end
+
   test "imports valuations" do
     ndjson = build_ndjson([
       {
@@ -238,6 +1152,232 @@ class Family::DataImporterTest < ActiveSupport::TestCase
     assert_equal 520000.0, valuation.entry.amount.to_f
   end
 
+  test "imports unknown valuation kinds as reconciliations" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "prop-acct-1",
+          name: "Property",
+          balance: "500000",
+          currency: "USD",
+          accountable_type: "Property"
+        }
+      },
+      {
+        type: "Valuation",
+        data: {
+          id: "val-1",
+          account_id: "prop-acct-1",
+          date: "2024-06-15",
+          amount: "520000",
+          name: "Updated valuation",
+          currency: "USD",
+          kind: "legacy_unknown_kind"
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    account = @family.accounts.find_by!(name: "Property")
+    valuation = account.valuations.joins(:entry).find_by!(entries: { name: "Updated valuation" })
+    assert_equal "reconciliation", valuation.kind
+  end
+
+  test "imports transfer decisions and rejected transfers with remapped transactions" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "checking",
+          name: "Checking",
+          balance: "1000",
+          currency: "USD",
+          accountable_type: "Depository"
+        }
+      },
+      {
+        type: "Account",
+        data: {
+          id: "savings",
+          name: "Savings",
+          balance: "2500",
+          currency: "USD",
+          accountable_type: "Depository"
+        }
+      },
+      {
+        type: "Transaction",
+        data: {
+          id: "transfer-outflow",
+          account_id: "checking",
+          date: "2024-01-15",
+          amount: "100.00",
+          name: "Transfer to savings",
+          currency: "USD",
+          kind: "funds_movement"
+        }
+      },
+      {
+        type: "Transaction",
+        data: {
+          id: "transfer-inflow",
+          account_id: "savings",
+          date: "2024-01-15",
+          amount: "-100.00",
+          name: "Transfer from checking",
+          currency: "USD",
+          kind: "funds_movement"
+        }
+      },
+      {
+        type: "Transfer",
+        data: {
+          id: "transfer-1",
+          inflow_transaction_id: "transfer-inflow",
+          outflow_transaction_id: "transfer-outflow",
+          status: "confirmed",
+          notes: "Confirmed by user"
+        }
+      },
+      {
+        type: "Transaction",
+        data: {
+          id: "rejected-outflow",
+          account_id: "checking",
+          date: "2024-01-20",
+          amount: "25.00",
+          name: "Candidate outflow",
+          currency: "USD",
+          kind: "standard"
+        }
+      },
+      {
+        type: "Transaction",
+        data: {
+          id: "rejected-inflow",
+          account_id: "savings",
+          date: "2024-01-20",
+          amount: "-25.00",
+          name: "Candidate inflow",
+          currency: "USD",
+          kind: "standard"
+        }
+      },
+      {
+        type: "RejectedTransfer",
+        data: {
+          id: "rejected-transfer-1",
+          inflow_transaction_id: "rejected-inflow",
+          outflow_transaction_id: "rejected-outflow"
+        }
+      }
+    ])
+
+    Family::DataImporter.new(@family, ndjson).import!
+
+    transfer = Transfer.find_by!(notes: "Confirmed by user")
+    assert_not_nil transfer
+    assert_equal "confirmed", transfer.status
+    assert_equal "Confirmed by user", transfer.notes
+    assert_equal "Transfer from checking", transfer.inflow_transaction.entry.name
+    assert_equal "Transfer to savings", transfer.outflow_transaction.entry.name
+
+    rejected_transfer = RejectedTransfer
+      .joins(inflow_transaction: :entry)
+      .find_by!(entries: { name: "Candidate inflow" })
+    assert_not_nil rejected_transfer
+    assert_equal "Candidate inflow", rejected_transfer.inflow_transaction.entry.name
+    assert_equal "Candidate outflow", rejected_transfer.outflow_transaction.entry.name
+  end
+
+  test "imports duplicate transfer decisions idempotently with unknown status fallback" do
+    ndjson = build_ndjson([
+      {
+        type: "Account",
+        data: {
+          id: "checking",
+          name: "Checking",
+          balance: "1000",
+          currency: "USD",
+          accountable_type: "Depository"
+        }
+      },
+      {
+        type: "Account",
+        data: {
+          id: "savings",
+          name: "Savings",
+          balance: "2500",
+          currency: "USD",
+          accountable_type: "Depository"
+        }
+      },
+      {
+        type: "Transaction",
+        data: {
+          id: "transfer-outflow",
+          account_id: "checking",
+          date: "2024-01-15",
+          amount: "100.00",
+          name: "Transfer to savings",
+          currency: "USD",
+          kind: "funds_movement"
+        }
+      },
+      {
+        type: "Transaction",
+        data: {
+          id: "transfer-inflow",
+          account_id: "savings",
+          date: "2024-01-15",
+          amount: "-100.00",
+          name: "Transfer from checking",
+          currency: "USD",
+          kind: "funds_movement"
+        }
+      },
+      {
+        type: "Transfer",
+        data: {
+          id: "transfer-1",
+          inflow_transaction_id: "transfer-inflow",
+          outflow_transaction_id: "transfer-outflow",
+          status: "settled"
+        }
+      },
+      {
+        type: "Transfer",
+        data: {
+          id: "transfer-1-duplicate",
+          inflow_transaction_id: "transfer-inflow",
+          outflow_transaction_id: "transfer-outflow",
+          status: "settled"
+        }
+      }
+    ])
+
+    fallback_logs = []
+
+    Rails.logger.stubs(:debug).with do |*args|
+      message = args.first
+      fallback_logs << message if message.to_s.include?("Unknown transfer status")
+      true
+    end
+
+    assert_difference("Transfer.count", 1) do
+      Family::DataImporter.new(@family, ndjson).import!
+    end
+
+    assert_equal [ 'Unknown transfer status "settled"; defaulting to pending' ], fallback_logs
+
+    imported_transfer = Transfer
+      .joins(inflow_transaction: :entry)
+      .find_by!(entries: { name: "Transfer from checking" })
+    assert_equal "pending", imported_transfer.status
+  end
+
   test "imports budgets" do
     ndjson = build_ndjson([
       {
@@ -358,6 +1498,119 @@ class Family::DataImporterTest < ActiveSupport::TestCase
     assert_equal category.id, action.value
   end
 
+  test "imports rules from normalized operand value refs" do
+    ndjson = build_ndjson([
+      {
+        type: "Rule",
+        version: 1,
+        data: {
+          name: "Map Merchant To Dining",
+          resource_type: "transaction",
+          active: true,
+          conditions: [
+            {
+              condition_type: "transaction_merchant",
+              operator: "=",
+              value_ref: {
+                type: "Merchant",
+                id: "source-merchant-id",
+                name: "Coffee Bar"
+              }
+            }
+          ],
+          actions: [
+            {
+              action_type: "set_transaction_category",
+              value_ref: {
+                type: "Category",
+                id: "source-category-id",
+                name: "Dining"
+              }
+            }
+          ]
+        }
+      }
+    ])
+
+    importer = Family::DataImporter.new(@family, ndjson)
+    importer.import!
+
+    rule = @family.rules.find_by!(name: "Map Merchant To Dining")
+    merchant = @family.merchants.find_by!(name: "Coffee Bar")
+    category = @family.categories.find_by!(name: "Dining")
+
+    assert_equal merchant.id, rule.conditions.first.value
+    assert_equal category.id, rule.actions.first.value
+  end
+
+  test "imports rule value refs when legacy operand values are stale UUIDs" do
+    stale_merchant_id = SecureRandom.uuid
+    stale_category_id = SecureRandom.uuid
+    ndjson = build_ndjson([
+      {
+        type: "Rule",
+        version: 1,
+        data: {
+          name: "Map Stale UUID Operands",
+          resource_type: "transaction",
+          active: true,
+          conditions: [
+            {
+              condition_type: "transaction_merchant",
+              operator: "=",
+              value: stale_merchant_id,
+              value_ref: {
+                type: "Merchant",
+                id: stale_merchant_id,
+                name: "Coffee Bar"
+              }
+            }
+          ],
+          actions: [
+            {
+              action_type: "set_transaction_category",
+              value: stale_category_id,
+              value_ref: {
+                type: "Category",
+                id: stale_category_id,
+                name: "Dining"
+              }
+            }
+          ]
+        }
+      }
+    ])
+
+    importer = Family::DataImporter.new(@family, ndjson)
+    importer.import!
+
+    rule = @family.rules.find_by!(name: "Map Stale UUID Operands")
+    merchant = @family.merchants.find_by!(name: "Coffee Bar")
+    category = @family.categories.find_by!(name: "Dining")
+
+    assert_equal merchant.id, rule.conditions.first.value
+    assert_equal category.id, rule.actions.first.value
+    assert_not @family.merchants.exists?(name: stale_merchant_id)
+    assert_not @family.categories.exists?(name: stale_category_id)
+  end
+
+  test "preserves explicit false rule operand values" do
+    importer = Family::DataImporter.new(@family, "")
+
+    value = importer.send(
+      :rule_operand_value,
+      {
+        "value" => false,
+        "value_ref" => {
+          "type" => "Category",
+          "name" => "Fallback"
+        }
+      }
+    )
+
+    assert_equal false, value
+  end
+
   test "imports rules with compound conditions" do
     ndjson = build_ndjson([
       {
@@ -491,6 +1744,23 @@ class Family::DataImporterTest < ActiveSupport::TestCase
         }
       },
       # Transaction
+      {
+        type: "RecurringTransaction",
+        data: {
+          id: "recurring-grocery",
+          account_id: "acct-main",
+          merchant_id: "merchant-1",
+          amount: "-75.50",
+          currency: "USD",
+          expected_day_of_month: 15,
+          last_occurrence_date: "2024-01-15",
+          next_expected_date: "2024-02-15",
+          status: "active",
+          occurrence_count: 3,
+          manual: false
+        }
+      },
+      # Transaction
       {
         type: "Transaction",
         data: {
@@ -554,6 +1824,7 @@ class Family::DataImporterTest < ActiveSupport::TestCase
     assert_equal 1, @family.categories.count
     assert_equal 1, @family.tags.count
     assert_equal 1, @family.merchants.count
+    assert_equal 1, @family.recurring_transactions.count
     assert_equal 1, @family.transactions.count
     assert_equal 1, @family.budgets.count
     assert_equal 1, @family.budget_categories.count
@@ -564,6 +1835,10 @@ class Family::DataImporterTest < ActiveSupport::TestCase
     assert_equal "Food", transaction.category.name
     assert_equal "Local Grocery", transaction.merchant.name
     assert_equal "Weekly", transaction.tags.first.name
+
+    recurring_transaction = @family.recurring_transactions.first
+    assert_equal "Main Checking", recurring_transaction.account.name
+    assert_equal "Local Grocery", recurring_transaction.merchant.name
   end
 
   private
diff --git a/test/models/family/syncer_test.rb b/test/models/family/syncer_test.rb
index b164695fb..be9624109 100644
--- a/test/models/family/syncer_test.rb
+++ b/test/models/family/syncer_test.rb
@@ -5,11 +5,13 @@ class Family::SyncerTest < ActiveSupport::TestCase
     @family = families(:dylan_family)
   end
 
-  test "syncs plaid items and manual accounts" do
+  test "syncs provider items and manual accounts" do
     family_sync = syncs(:family)
 
     manual_accounts_count = @family.accounts.manual.count
-    items_count = @family.plaid_items.count
+    plaid_items_count = @family.plaid_items.syncable.count
+    brex_items_count = @family.brex_items.syncable.count
+    binance_items_count = @family.binance_items.syncable.count
 
     syncer = Family::Syncer.new(@family)
 
@@ -19,9 +21,19 @@ class Family::SyncerTest < ActiveSupport::TestCase
            .times(manual_accounts_count)
 
     PlaidItem.any_instance
-             .expects(:sync_later)
-             .with(parent_sync: family_sync, window_start_date: nil, window_end_date: nil)
-             .times(items_count)
+               .expects(:sync_later)
+               .with(parent_sync: family_sync, window_start_date: nil, window_end_date: nil)
+               .times(plaid_items_count)
+
+    BrexItem.any_instance
+            .expects(:sync_later)
+            .with(parent_sync: family_sync, window_start_date: nil, window_end_date: nil)
+            .times(brex_items_count)
+
+    BinanceItem.any_instance
+               .expects(:sync_later)
+               .with(parent_sync: family_sync, window_start_date: nil, window_end_date: nil)
+               .times(binance_items_count)
 
     syncer.perform_sync(family_sync)
 
@@ -60,6 +72,9 @@ class Family::SyncerTest < ActiveSupport::TestCase
     SimplefinItem.any_instance.stubs(:sync_later)
     LunchflowItem.any_instance.stubs(:sync_later)
     EnableBankingItem.any_instance.stubs(:sync_later)
+    SophtronItem.any_instance.stubs(:sync_later)
+    BrexItem.any_instance.stubs(:sync_later)
+    BinanceItem.any_instance.stubs(:sync_later)
 
     syncer.perform_sync(family_sync)
     syncer.perform_post_sync
diff --git a/test/models/family_test.rb b/test/models/family_test.rb
index 69a530316..f026ff6ab 100644
--- a/test/models/family_test.rb
+++ b/test/models/family_test.rb
@@ -173,6 +173,39 @@ class FamilyTest < ActiveSupport::TestCase
     assert_includes family.available_merchants, new_merchant
   end
 
+  test "enabled currencies always include the base currency" do
+    family = families(:dylan_family)
+    family.update!(currency: "SGD", enabled_currencies: [ "USD" ])
+
+    family.update!(enabled_currencies: [ "USD" ])
+
+    assert_equal [ "SGD", "USD" ], family.reload.enabled_currency_codes
+  end
+
+  test "empty enabled currencies keeps all currencies available" do
+    family = families(:dylan_family)
+    family.update!(enabled_currencies: [])
+
+    assert_nil family.reload.enabled_currencies
+    assert_equal Money::Currency.as_options.map(&:iso_code), family.reload.enabled_currency_codes
+  end
+
+  test "enabled currencies are normalized and deduplicated" do
+    family = families(:dylan_family)
+    family.update!(currency: "SGD", enabled_currencies: [ "USD", "usd", "SGD" ])
+
+    assert_equal [ "SGD", "USD" ], family.reload.enabled_currencies
+    assert_equal [ "SGD", "USD" ], family.reload.enabled_currency_codes
+  end
+
+  test "all selected currencies collapse to default behavior" do
+    family = families(:dylan_family)
+    family.update!(enabled_currencies: Money::Currency.as_options.map(&:iso_code))
+
+    assert_nil family.reload.enabled_currencies
+    assert_equal Money::Currency.as_options.map(&:iso_code), family.reload.enabled_currency_codes
+  end
+
   test "upload_document stores provided metadata on family document" do
     family = families(:dylan_family)
     family.update!(vector_store_id: nil)
diff --git a/test/models/holding/materializer_test.rb b/test/models/holding/materializer_test.rb
index 4d14a26c8..605f00478 100644
--- a/test/models/holding/materializer_test.rb
+++ b/test/models/holding/materializer_test.rb
@@ -7,6 +7,7 @@ class Holding::MaterializerTest < ActiveSupport::TestCase
     @family = families(:empty)
     @account = @family.accounts.create!(name: "Test", balance: 20000, cash_balance: 20000, currency: "USD", accountable: Investment.new)
     @aapl = securities(:aapl)
+    @msft = securities(:msft)
   end
 
   test "syncs holdings" do
@@ -123,4 +124,83 @@ class Holding::MaterializerTest < ActiveSupport::TestCase
     assert_equal BigDecimal("10"), yesterday_holding.qty
     assert_equal yesterday_holding.qty * yesterday_holding.price, yesterday_holding.amount
   end
+
+  test "cleans up calculated current-day holdings when a provider snapshot exists in another currency" do
+    ExchangeRate.create!(from_currency: "EUR", to_currency: "USD", date: Date.current, rate: 1.2)
+
+    coinstats_item = @family.coinstats_items.create!(name: "CoinStats", api_key: "test-key")
+    coinstats_account = coinstats_item.coinstats_accounts.create!(
+      name: "Brokerage",
+      currency: "USD"
+    )
+    account_provider = AccountProvider.create!(account: @account, provider: coinstats_account)
+
+    Holding.create!(
+      account: @account,
+      security: @aapl,
+      qty: 10,
+      price: 200,
+      amount: 2000,
+      currency: "EUR",
+      date: Date.current,
+      account_provider: account_provider,
+      cost_basis: 150
+    )
+
+    Holding::Materializer.new(@account, strategy: :reverse).materialize_holdings
+
+    today_holdings = @account.holdings.where(security: @aapl, date: Date.current).order(:currency)
+
+    assert_equal [ "EUR" ], today_holdings.pluck(:currency)
+    assert_equal [ account_provider.id ], today_holdings.pluck(:account_provider_id)
+  end
+
+  test "preserves same-day non-provider holdings for securities absent from the provider snapshot" do
+    ExchangeRate.create!(from_currency: "EUR", to_currency: "USD", date: Date.current, rate: 1.2)
+
+    coinstats_item = @family.coinstats_items.create!(name: "CoinStats", api_key: "test-key")
+    coinstats_account = coinstats_item.coinstats_accounts.create!(
+      name: "Brokerage",
+      currency: "USD"
+    )
+    account_provider = AccountProvider.create!(account: @account, provider: coinstats_account)
+
+    Holding.create!(
+      account: @account,
+      security: @aapl,
+      qty: 10,
+      price: 200,
+      amount: 2000,
+      currency: "EUR",
+      date: Date.current,
+      account_provider: account_provider,
+      cost_basis: 150
+    )
+
+    manual_holding = Holding.create!(
+      account: @account,
+      security: @msft,
+      qty: 3,
+      price: 250,
+      amount: 750,
+      currency: "USD",
+      date: Date.current,
+      cost_basis: 225,
+      cost_basis_source: "manual",
+      cost_basis_locked: true
+    )
+
+    Holding::Materializer.new(@account, strategy: :reverse).materialize_holdings
+
+    assert_equal manual_holding.id, manual_holding.reload.id
+    assert_equal @msft.id, manual_holding.security_id
+    assert_nil manual_holding.account_provider_id
+
+    today_holdings = @account.holdings.where(date: Date.current)
+
+    assert_equal(
+      [ [ @aapl.id, "EUR" ], [ @msft.id, "USD" ] ].sort,
+      today_holdings.pluck(:security_id, :currency).sort
+    )
+  end
 end
diff --git a/test/models/holding/portfolio_cache_test.rb b/test/models/holding/portfolio_cache_test.rb
index 4677fc411..fed652165 100644
--- a/test/models/holding/portfolio_cache_test.rb
+++ b/test/models/holding/portfolio_cache_test.rb
@@ -56,4 +56,40 @@ class Holding::PortfolioCacheTest < ActiveSupport::TestCase
     cache = Holding::PortfolioCache.new(@account, use_holdings: true)
     assert_equal holding.price, cache.get_price(@security.id, holding.date).price
   end
+
+  test "converts historical prices using the requested date exchange rate" do
+    account = families(:empty).accounts.create!(
+      name: "CHF Brokerage",
+      balance: 10000,
+      currency: "CHF",
+      accountable: Investment.new
+    )
+    holding_date = 2.days.ago.to_date
+
+    ExchangeRate.create!(from_currency: "USD", to_currency: "CHF", date: holding_date, rate: 0.80)
+    ExchangeRate.create!(from_currency: "USD", to_currency: "CHF", date: Date.current, rate: 0.95)
+
+    Holding.create!(
+      security: @security,
+      account: account,
+      date: holding_date,
+      qty: 1,
+      price: 100,
+      amount: 100,
+      currency: "USD"
+    )
+
+    Security::Price.create!(
+      security: @security,
+      date: holding_date,
+      price: 100,
+      currency: "USD"
+    )
+
+    cache = Holding::PortfolioCache.new(account, use_holdings: true)
+    converted_price = cache.get_price(@security.id, holding_date)
+
+    assert_equal BigDecimal("80.0"), converted_price.price
+    assert_equal "CHF", converted_price.currency
+  end
 end
diff --git a/test/models/holding/reverse_calculator_test.rb b/test/models/holding/reverse_calculator_test.rb
index f2cec5fde..a82a0be01 100644
--- a/test/models/holding/reverse_calculator_test.rb
+++ b/test/models/holding/reverse_calculator_test.rb
@@ -158,6 +158,84 @@ class Holding::ReverseCalculatorTest < ActiveSupport::TestCase
     end
   end
 
+  # cost_basis_for
+
+  test "cost_basis_for returns nil when there are no buy trades" do
+    security = Security.create!(ticker: "TST", name: "Test")
+    calc = calculator_with_trades(security)
+
+    assert_nil cost_basis_for(calc, security, Date.current)
+  end
+
+  test "cost_basis_for returns nil for dates before the first buy" do
+    security = Security.create!(ticker: "TST", name: "Test")
+    buy_date = 5.days.ago.to_date
+
+    calc = calculator_with_trades(security) do
+      create_trade(security, account: @account, qty: 10, price: 100, date: buy_date)
+    end
+
+    assert_nil cost_basis_for(calc, security, buy_date - 1)
+  end
+
+  test "cost_basis_for returns weighted average cost on buy date" do
+    security = Security.create!(ticker: "TST", name: "Test")
+    buy_date = 5.days.ago.to_date
+
+    calc = calculator_with_trades(security) do
+      create_trade(security, account: @account, qty: 10, price: 100, date: buy_date)
+    end
+
+    assert_in_delta 100.0, cost_basis_for(calc, security, buy_date).to_f, 1e-6
+  end
+
+  test "cost_basis_for carries forward to dates between buys" do
+    security = Security.create!(ticker: "TST", name: "Test")
+    first_buy  = 10.days.ago.to_date
+    second_buy = 3.days.ago.to_date
+
+    calc = calculator_with_trades(security) do
+      create_trade(security, account: @account, qty: 10, price: 100, date: first_buy)
+      create_trade(security, account: @account, qty: 5,  price: 130, date: second_buy)
+    end
+
+    # Between the two buys, cost basis is from the first buy only
+    assert_in_delta 100.0, cost_basis_for(calc, security, first_buy + 1).to_f, 1e-6
+    assert_in_delta 100.0, cost_basis_for(calc, security, second_buy - 1).to_f, 1e-6
+
+    # After second buy: WAC = (10*100 + 5*130) / 15 = 110.0
+    assert_in_delta 110.0, cost_basis_for(calc, security, second_buy).to_f, 1e-6
+    assert_in_delta 110.0, cost_basis_for(calc, security, Date.current).to_f, 1e-6
+  end
+
+  test "cost_basis_for accumulates multiple buys on the same date" do
+    security = Security.create!(ticker: "TST", name: "Test")
+    buy_date = 5.days.ago.to_date
+
+    calc = calculator_with_trades(security) do
+      create_trade(security, account: @account, qty: 10, price: 100, date: buy_date)
+      create_trade(security, account: @account, qty: 5,  price: 130, date: buy_date)
+    end
+
+    # WAC = (10*100 + 5*130) / 15 = 110.0 — not the intermediate value after only the first trade
+    assert_in_delta 110.0, cost_basis_for(calc, security, buy_date).to_f, 1e-6
+  end
+
+  test "cost_basis_for ignores sell trades" do
+    security = Security.create!(ticker: "TST", name: "Test")
+    buy_date  = 10.days.ago.to_date
+    sell_date = 5.days.ago.to_date
+
+    calc = calculator_with_trades(security) do
+      create_trade(security, account: @account, qty: 10,  price: 100, date: buy_date)
+      create_trade(security, account: @account, qty: -5,  price: 120, date: sell_date)
+    end
+
+    # Sell does not change cost basis
+    assert_in_delta 100.0, cost_basis_for(calc, security, sell_date).to_f, 1e-6
+    assert_in_delta 100.0, cost_basis_for(calc, security, Date.current).to_f, 1e-6
+  end
+
   private
     def assert_holdings(expected, calculated)
       expected.each do |expected_entry|
@@ -202,6 +280,18 @@ class Holding::ReverseCalculatorTest < ActiveSupport::TestCase
     # Brokerage Cash: $5,000
     # Holdings Value: $15,000
     # Total Balance: $20,000
+    def calculator_with_trades(security)
+      yield if block_given?
+      snapshot = OpenStruct.new(to_h: { security.id => 10 })
+      calc = Holding::ReverseCalculator.new(@account, portfolio_snapshot: snapshot)
+      calc.send(:precompute_cost_basis)
+      calc
+    end
+
+    def cost_basis_for(calc, security, date)
+      calc.send(:cost_basis_for, security.id, date)
+    end
+
     def load_today_portfolio
       @account.update!(cash_balance: 5000)
 
diff --git a/test/models/holding_test.rb b/test/models/holding_test.rb
index be58ed84f..32eb1b072 100644
--- a/test/models/holding_test.rb
+++ b/test/models/holding_test.rb
@@ -20,6 +20,22 @@ class HoldingTest < ActiveSupport::TestCase
     assert_in_delta expected_nvda_weight, @nvda.weight, 0.001
   end
 
+  test "calculates portfolio weight after converting foreign-currency holdings" do
+    ExchangeRate.create!(from_currency: "EUR", to_currency: "USD", date: Date.current, rate: 1.5)
+
+    foreign_security = Security.create!(ticker: "ASML", name: "ASML")
+    foreign_holding = @account.holdings.create!(
+      security: foreign_security,
+      date: Date.current,
+      qty: 1,
+      price: 100,
+      amount: 100,
+      currency: "EUR"
+    )
+
+    assert_in_delta 0.75, foreign_holding.weight, 0.001
+  end
+
   test "calculates average cost basis" do
     create_trade(@amzn.security, account: @account, qty: 10, price: 212.00, date: 1.day.ago.to_date)
     create_trade(@amzn.security, account: @account, qty: 15, price: 216.00, date: Date.current)
@@ -58,8 +74,9 @@ class HoldingTest < ActiveSupport::TestCase
     nvda_qty = BigDecimal("5") + BigDecimal("30")
     expected_nvda_usd = nvda_total_usd / nvda_qty
 
-    assert_equal Money.new(expected_amzn_usd, "CAD").exchange_to("USD", fallback_rate: 1), @amzn.avg_cost
-    assert_equal Money.new(expected_nvda_usd, "CAD").exchange_to("USD", fallback_rate: 1), @nvda.avg_cost
+    ExchangeRate.stubs(:find_or_fetch_rate).returns(OpenStruct.new(rate: 1))
+    assert_equal Money.new(expected_amzn_usd, "CAD").exchange_to("USD"), @amzn.avg_cost
+    assert_equal Money.new(expected_nvda_usd, "CAD").exchange_to("USD"), @nvda.avg_cost
   end
 
   test "calculates total return trend" do
diff --git a/test/models/ibkr_account/data_helpers_test.rb b/test/models/ibkr_account/data_helpers_test.rb
new file mode 100644
index 000000000..bc8089ac1
--- /dev/null
+++ b/test/models/ibkr_account/data_helpers_test.rb
@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class IbkrAccount::DataHelpersTest < ActiveSupport::TestCase
+  class TestHelper
+    include IbkrAccount::DataHelpers
+
+    public :parse_decimal
+  end
+
+  setup do
+    @helper = TestHelper.new
+  end
+
+  test "parse_decimal returns nil for nil input" do
+    assert_nil @helper.parse_decimal(nil)
+  end
+
+  test "parse_decimal returns nil for blank string" do
+    assert_nil @helper.parse_decimal("")
+    assert_nil @helper.parse_decimal("   ")
+  end
+
+  test "parse_decimal returns nil for dash placeholder" do
+    assert_nil @helper.parse_decimal("-")
+  end
+
+  test "parse_decimal converts parentheses notation to negative" do
+    assert_equal BigDecimal("-1234.56"), @helper.parse_decimal("(1234.56)")
+  end
+
+  test "parse_decimal converts parentheses notation with comma-separated number" do
+    assert_equal BigDecimal("-1234.56"), @helper.parse_decimal("(1,234.56)")
+  end
+
+  test "parse_decimal strips commas from positive numbers" do
+    assert_equal BigDecimal("1234.56"), @helper.parse_decimal("1,234.56")
+  end
+
+  test "parse_decimal parses plain decimal string" do
+    assert_equal BigDecimal("3351.00"), @helper.parse_decimal("3351.00")
+  end
+
+  test "parse_decimal returns nil for empty parentheses" do
+    assert_nil @helper.parse_decimal("()")
+  end
+
+  test "parse_decimal returns nil for unclosed parenthesis" do
+    assert_nil @helper.parse_decimal("(123")
+  end
+
+  test "parse_decimal returns nil for non-numeric string" do
+    assert_nil @helper.parse_decimal("N/A")
+    assert_nil @helper.parse_decimal("not_a_number")
+  end
+end
diff --git a/test/models/ibkr_account/historical_balances_sync_test.rb b/test/models/ibkr_account/historical_balances_sync_test.rb
new file mode 100644
index 000000000..66b5ee89b
--- /dev/null
+++ b/test/models/ibkr_account/historical_balances_sync_test.rb
@@ -0,0 +1,229 @@
+require "test_helper"
+
+class IbkrAccount::HistoricalBalancesSyncTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:empty)
+    @account = @family.accounts.create!(
+      name: "IBKR Brokerage",
+      balance: 0,
+      cash_balance: 0,
+      currency: "CHF",
+      accountable: Investment.new(subtype: "brokerage")
+    )
+    @ibkr_account = @family.ibkr_items.create!(
+      name: "IBKR",
+      query_id: "QUERY123",
+      token: "TOKEN123"
+    ).ibkr_accounts.create!(
+      name: "Main",
+      ibkr_account_id: "U1234567",
+      currency: "CHF",
+      current_balance: 3351,
+      cash_balance: 1000.5,
+      raw_equity_summary_payload: [
+        { report_date: "2026-05-07", total: "3201.00" },
+        { report_date: "2026-05-08", total: "3351.00" }
+      ]
+    )
+    @ibkr_account.ensure_account_provider!(@account)
+  end
+
+  # Seed an existing balance row as if the materializer already ran.
+  def seed_balance(date:, balance:, cash_balance:)
+    non_cash = balance - cash_balance
+    @account.balances.create!(
+      date: date,
+      balance: balance,
+      cash_balance: cash_balance,
+      currency: "CHF",
+      start_cash_balance: cash_balance,
+      start_non_cash_balance: non_cash,
+      cash_inflows: 0,
+      cash_outflows: 0,
+      non_cash_inflows: 0,
+      non_cash_outflows: 0,
+      net_market_flows: 0,
+      cash_adjustments: 0,
+      non_cash_adjustments: 0,
+      flows_factor: 1
+    )
+  end
+
+  test "overrides total from IBKR equity summary while preserving materializer cash split" do
+    seed_balance(date: Date.new(2026, 5, 7), balance: 3000.00, cash_balance: 900.50)
+    seed_balance(date: Date.new(2026, 5, 8), balance: 3100.00, cash_balance: 1000.50)
+
+    assert_no_difference "@account.entries.count" do
+      IbkrAccount::HistoricalBalancesSync.new(@ibkr_account).sync!
+    end
+
+    first  = @account.balances.find_by!(date: Date.new(2026, 5, 7), currency: "CHF")
+    second = @account.balances.find_by!(date: Date.new(2026, 5, 8), currency: "CHF")
+
+    # Total overridden with IBKR's reported figure
+    assert_equal BigDecimal("3201.00"), first.end_balance
+    assert_equal BigDecimal("3351.00"), second.end_balance
+
+    # Cash preserved from the materializer, not read from equity summary
+    assert_equal BigDecimal("900.50"),  first.end_cash_balance
+    assert_equal BigDecimal("1000.50"), second.end_cash_balance
+
+    # Non-cash = IBKR total - materializer cash
+    assert_equal BigDecimal("2300.50"), first.end_non_cash_balance
+    assert_equal BigDecimal("2350.50"), second.end_non_cash_balance
+  end
+
+  test "uses zero cash when no prior materializer balance exists for a date" do
+    # No existing balance rows — first-ever sync
+    IbkrAccount::HistoricalBalancesSync.new(@ibkr_account).sync!
+
+    balance = @account.balances.find_by!(date: Date.new(2026, 5, 7), currency: "CHF")
+    assert_equal BigDecimal("3201.00"), balance.end_balance
+    assert_equal BigDecimal("0"),       balance.end_cash_balance
+    assert_equal BigDecimal("3201.00"), balance.end_non_cash_balance
+  end
+
+  test "accepts rows without a currency field (Flex configs that omit the attribute)" do
+    @ibkr_account.update!(
+      raw_equity_summary_payload: [
+        { report_date: "2026-05-07", total: "3201.00" }   # no currency key
+      ]
+    )
+    seed_balance(date: Date.new(2026, 5, 7), balance: 3000.00, cash_balance: 900.50)
+
+    IbkrAccount::HistoricalBalancesSync.new(@ibkr_account).sync!
+
+    balance = @account.balances.find_by!(date: Date.new(2026, 5, 7), currency: "CHF")
+    assert_equal BigDecimal("3201.00"), balance.end_balance
+    assert_equal BigDecimal("900.50"),  balance.end_cash_balance
+  end
+
+  test "accepts rows when account currency casing differs from payload" do
+    @ibkr_account.update!(currency: "chf")
+    seed_balance(date: Date.new(2026, 5, 7), balance: 3000.00, cash_balance: 900.50)
+
+    @ibkr_account.update!(
+      raw_equity_summary_payload: [
+        { currency: "CHF", report_date: "2026-05-07", total: "3201.00" }
+      ]
+    )
+
+    IbkrAccount::HistoricalBalancesSync.new(@ibkr_account).sync!
+
+    balance = @account.balances.find_by!(date: Date.new(2026, 5, 7), currency: "CHF")
+    assert_equal BigDecimal("3201.00"), balance.end_balance
+  end
+
+  test "skips BASE_SUMMARY rows" do
+    @ibkr_account.update!(
+      raw_equity_summary_payload: [
+        { currency: "BASE_SUMMARY", report_date: "2026-05-07", total: "9999.00" },
+        { currency: "CHF",          report_date: "2026-05-07", total: "3201.00" }
+      ]
+    )
+
+    IbkrAccount::HistoricalBalancesSync.new(@ibkr_account).sync!
+
+    balance = @account.balances.find_by!(date: Date.new(2026, 5, 7), currency: "CHF")
+    assert_equal BigDecimal("3201.00"), balance.end_balance
+  end
+
+  test "skips rows with a mismatched explicit currency" do
+    @ibkr_account.update!(
+      raw_equity_summary_payload: [
+        { currency: "USD", report_date: "2026-05-07", total: "9999.00" },
+        { currency: "CHF", report_date: "2026-05-07", total: "3201.00" }
+      ]
+    )
+
+    IbkrAccount::HistoricalBalancesSync.new(@ibkr_account).sync!
+
+    balance = @account.balances.find_by!(date: Date.new(2026, 5, 7), currency: "CHF")
+    assert_equal BigDecimal("3201.00"), balance.end_balance
+  end
+
+  test "skips malformed rows and still imports valid ones" do
+    @ibkr_account.update!(
+      raw_equity_summary_payload: [
+        nil,
+        "bad-row",
+        [],
+        { report_date: "2026-05-11", total: "3400.00" }
+      ]
+    )
+    seed_balance(date: Date.new(2026, 5, 11), balance: 3300.00, cash_balance: 1100.50)
+
+    assert_nothing_raised do
+      IbkrAccount::HistoricalBalancesSync.new(@ibkr_account).sync!
+    end
+
+    balance = @account.balances.find_by!(date: Date.new(2026, 5, 11), currency: "CHF")
+    assert_equal BigDecimal("3400.00"), balance.end_balance
+    assert_equal BigDecimal("1100.50"), balance.end_cash_balance
+  end
+
+  test "fills weekend and holiday gaps by carrying forward the last IBKR total with materializer cash" do
+    # Simulate the real-world situation: IBKR has no weekend rows, and historical
+    # holdings only cover the current snapshot so the materializer writes total=cash
+    # for gap dates. HistoricalBalancesSync must write the correct total for those days.
+    @ibkr_account.update!(
+      raw_equity_summary_payload: [
+        { report_date: "2026-05-08", total: "3351.00" },  # Friday
+        # Saturday May 9 and Sunday May 10 absent — IBKR never sends them
+        { report_date: "2026-05-11", total: "3400.00" }   # Monday
+      ]
+    )
+
+    # Materializer computed correct cash for all dates; wrong total for the weekend
+    seed_balance(date: Date.new(2026, 5, 8),  balance: 3351.00, cash_balance: 900.50)
+    seed_balance(date: Date.new(2026, 5, 9),  balance: 900.50,  cash_balance: 900.50)  # wrong total
+    seed_balance(date: Date.new(2026, 5, 10), balance: 900.50,  cash_balance: 900.50)  # wrong total
+    seed_balance(date: Date.new(2026, 5, 11), balance: 3400.00, cash_balance: 910.00)
+
+    IbkrAccount::HistoricalBalancesSync.new(@ibkr_account).sync!
+
+    saturday = @account.balances.find_by!(date: Date.new(2026, 5, 9),  currency: "CHF")
+    sunday   = @account.balances.find_by!(date: Date.new(2026, 5, 10), currency: "CHF")
+
+    # Total corrected to Friday's IBKR total; cash preserved from materializer
+    assert_equal BigDecimal("3351.00"), saturday.end_balance
+    assert_equal BigDecimal("900.50"),  saturday.end_cash_balance
+    assert_equal BigDecimal("2450.50"), saturday.end_non_cash_balance
+
+    assert_equal BigDecimal("3351.00"), sunday.end_balance
+    assert_equal BigDecimal("900.50"),  sunday.end_cash_balance
+    assert_equal BigDecimal("2450.50"), sunday.end_non_cash_balance
+  end
+
+  test "skips rows with missing or unparseable total" do
+    @ibkr_account.update!(
+      raw_equity_summary_payload: [
+        { report_date: "2026-05-06", total: "N/A" },   # unparseable string — before first valid date
+        { report_date: "2026-05-07", total: nil },      # nil total
+        { report_date: "2026-05-08", total: "3351.00" } # valid
+      ]
+    )
+
+    IbkrAccount::HistoricalBalancesSync.new(@ibkr_account).sync!
+
+    # Gap-fill starts at the first valid trading day (May 8), so pre-range
+    # dates with bad totals must not produce any balance row.
+    assert_nil @account.balances.find_by(date: Date.new(2026, 5, 6), currency: "CHF")
+    assert_nil @account.balances.find_by(date: Date.new(2026, 5, 7), currency: "CHF")
+    assert_not_nil @account.balances.find_by(date: Date.new(2026, 5, 8), currency: "CHF")
+  end
+
+  test "writes balance row with zero total for fully liquidated dates" do
+    @ibkr_account.update!(
+      raw_equity_summary_payload: [
+        { report_date: "2026-05-07", total: "0"      },
+        { report_date: "2026-05-08", total: "3351.00" }
+      ]
+    )
+
+    IbkrAccount::HistoricalBalancesSync.new(@ibkr_account).sync!
+
+    balance = @account.balances.find_by!(date: Date.new(2026, 5, 7), currency: "CHF")
+    assert_equal BigDecimal("0"), balance.end_balance
+  end
+end
diff --git a/test/models/ibkr_account_processor_test.rb b/test/models/ibkr_account_processor_test.rb
new file mode 100644
index 000000000..7e2254f61
--- /dev/null
+++ b/test/models/ibkr_account_processor_test.rb
@@ -0,0 +1,281 @@
+require "test_helper"
+
+class IbkrAccountProcessorTest < ActiveSupport::TestCase
+  fixtures :families, :ibkr_items, :ibkr_accounts, :accounts, :securities
+
+  setup do
+    @family = families(:dylan_family)
+    @ibkr_account = ibkr_accounts(:main_account)
+
+    @account = @family.accounts.create!(
+      name: "IBKR Investment",
+      balance: 0,
+      cash_balance: 0,
+      currency: "CHF",
+      accountable: Investment.new(subtype: "brokerage")
+    )
+    @ibkr_account.ensure_account_provider!(@account)
+    @ibkr_account.update!(
+      raw_holdings_payload: [
+        {
+          "asset_category" => "STK",
+          "conid" => "265598",
+          "security_id" => "US0378331005",
+          "security_id_type" => "ISIN",
+          "symbol" => securities(:aapl).ticker,
+          "position" => "10",
+          "mark_price" => "150.00",
+          "currency" => "USD",
+          "fx_rate_to_base" => "0.90",
+          "cost_basis_price" => "125.50",
+          "report_date" => Date.current.to_s,
+          "side" => "Long"
+        }
+      ],
+      raw_activities_payload: {
+        trades: [
+          {
+            "asset_category" => "STK",
+            "trade_id" => "1001",
+            "transaction_id" => "1001a",
+            "conid" => "265598",
+            "symbol" => securities(:aapl).ticker,
+            "quantity" => "2",
+            "trade_price" => "140.00",
+            "currency" => "USD",
+            "fx_rate_to_base" => "0.90",
+            "buy_sell" => "BUY",
+            "trade_date" => Date.current.to_s,
+            "ib_commission" => "-1.25",
+            "ib_commission_currency" => "USD"
+          },
+          {
+            "asset_category" => "STK",
+            "trade_id" => "1002",
+            "transaction_id" => "1002a",
+            "conid" => "265598",
+            "symbol" => securities(:aapl).ticker,
+            "quantity" => "-1",
+            "trade_price" => "155.00",
+            "currency" => "USD",
+            "fx_rate_to_base" => "0.92",
+            "buy_sell" => "SELL",
+            "trade_date" => Date.current.to_s,
+            "ib_commission" => "-1.10",
+            "ib_commission_currency" => "USD"
+          }
+        ],
+        cash_transactions: [
+          {
+            "transaction_id" => "4001",
+            "type" => "Deposits/Withdrawals",
+            "amount" => "500.00",
+            "currency" => "CHF",
+            "fx_rate_to_base" => "1",
+            "report_date" => Date.current.to_s
+          },
+          {
+            "transaction_id" => "4002",
+            "type" => "Dividends",
+            "amount" => "2.50",
+            "currency" => "USD",
+            "fx_rate_to_base" => "0.91",
+            "report_date" => Date.current.to_s,
+            "conid" => "265598"
+          }
+        ]
+      },
+      report_date: Date.current,
+      current_balance: BigDecimal("3351.00"),
+      cash_balance: BigDecimal("1000.50"),
+      currency: "CHF"
+    )
+  end
+
+  test "processor imports holdings, trades, cash transactions, and commissions" do
+    IbkrAccount::Processor.new(@ibkr_account).process
+
+    @account.reload
+    assert_equal BigDecimal("3351.00"), @account.balance
+    assert_equal BigDecimal("1000.50"), @account.cash_balance
+    assert_equal "CHF", @account.currency
+
+    holding = @account.holdings.find_by(security: securities(:aapl), date: Date.current)
+    assert_not_nil holding
+    assert_equal BigDecimal("10"), holding.qty
+    assert_equal BigDecimal("150.00"), holding.price
+    assert_equal BigDecimal("125.50"), holding.cost_basis
+    assert_equal "USD", holding.currency
+
+    buy_trade = @account.entries.find_by(external_id: "ibkr_trade_1001")
+    sell_trade = @account.entries.find_by(external_id: "ibkr_trade_1002")
+    assert_not_nil buy_trade
+    assert_not_nil sell_trade
+    assert_equal "Buy", buy_trade.entryable.investment_activity_label
+    assert_equal "Sell", sell_trade.entryable.investment_activity_label
+    assert_equal BigDecimal("2"), buy_trade.entryable.qty
+    assert_equal BigDecimal("-1"), sell_trade.entryable.qty
+    assert_equal BigDecimal("280.0"), buy_trade.amount
+    assert_equal BigDecimal("-155.0"), sell_trade.amount
+    assert_equal "USD", buy_trade.currency
+    assert_equal "USD", sell_trade.currency
+    assert_equal 0.9, buy_trade.entryable.exchange_rate
+    assert_equal 0.92, sell_trade.entryable.exchange_rate
+
+    dividend = @account.entries.find_by(external_id: "ibkr_cash_4002")
+    assert_not_nil dividend
+    assert_equal "Dividend", dividend.entryable.investment_activity_label
+    assert_equal BigDecimal("-2.5"), dividend.amount
+    assert_equal securities(:aapl).id, dividend.entryable.extra["security_id"]
+
+    commission_one = @account.entries.find_by(external_id: "ibkr_trade_fee_1001")
+    commission_two = @account.entries.find_by(external_id: "ibkr_trade_fee_1002")
+    assert_not_nil commission_one
+    assert_not_nil commission_two
+    assert_equal BigDecimal("1.25"), commission_one.amount
+    assert_equal BigDecimal("1.1"), commission_two.amount
+    assert_equal "USD", commission_one.currency
+    assert_equal "USD", commission_two.currency
+    assert_equal securities(:aapl).id, commission_one.entryable.extra["security_id"]
+    assert_equal securities(:aapl).id, commission_two.entryable.extra["security_id"]
+
+    deposit = @account.entries.find_by(external_id: "ibkr_cash_4001")
+
+    assert_not_nil deposit
+    assert_equal "Contribution", deposit.entryable.investment_activity_label
+    assert_equal BigDecimal("-500"), deposit.amount
+    assert_equal "CHF", deposit.currency
+
+    assert_equal "USD", dividend.currency
+  end
+
+  test "processor computes weighted provider cost basis for grouped lots" do
+    @ibkr_account.update!(
+      raw_holdings_payload: [
+        {
+          "asset_category" => "STK",
+          "conid" => "265598",
+          "security_id" => "US0378331005",
+          "security_id_type" => "ISIN",
+          "symbol" => securities(:aapl).ticker,
+          "position" => "10",
+          "mark_price" => "150.00",
+          "currency" => "USD",
+          "fx_rate_to_base" => "0.90",
+          "cost_basis_price" => "125.50",
+          "report_date" => Date.current.to_s,
+          "side" => "Long"
+        },
+        {
+          "asset_category" => "STK",
+          "conid" => "265598",
+          "security_id" => "US0378331005",
+          "security_id_type" => "ISIN",
+          "symbol" => securities(:aapl).ticker,
+          "position" => "20",
+          "mark_price" => "150.00",
+          "currency" => "USD",
+          "fx_rate_to_base" => "0.90",
+          "cost_basis_price" => "122.00",
+          "report_date" => Date.current.to_s,
+          "side" => "Long"
+        }
+      ]
+    )
+
+    IbkrAccount::Processor.new(@ibkr_account).process
+
+    holding = @account.holdings.find_by(security: securities(:aapl), date: Date.current)
+
+    assert_not_nil holding
+    assert_equal BigDecimal("30"), holding.qty
+    assert_in_delta BigDecimal("123.1667"), holding.cost_basis, BigDecimal("0.0001")
+  end
+
+  test "processor repairs default opening anchor after importing activity entries" do
+    result = Account::OpeningBalanceManager.new(@account).set_opening_balance(
+      balance: @ibkr_account.current_balance,
+      date: 2.years.ago.to_date
+    )
+
+    assert result.success?
+
+    opening_anchor = @account.valuations.opening_anchor.includes(:entry).first
+    assert_not_nil opening_anchor
+    assert_equal @ibkr_account.current_balance.to_d, opening_anchor.entry.amount.to_d
+
+    IbkrAccount::Processor.new(@ibkr_account).process
+
+    opening_anchor.reload
+    assert_equal BigDecimal("0"), opening_anchor.entry.amount.to_d
+  end
+
+  test "processor imports commission-free trades without creating fee entries" do
+    @ibkr_account.update!(
+      raw_activities_payload: {
+        trades: [
+          {
+            "asset_category" => "STK",
+            "trade_id" => "1003",
+            "transaction_id" => "1003a",
+            "conid" => "265598",
+            "symbol" => securities(:aapl).ticker,
+            "quantity" => "3",
+            "trade_price" => "145.00",
+            "currency" => "USD",
+            "fx_rate_to_base" => "0.91",
+            "buy_sell" => "BUY",
+            "trade_date" => Date.current.to_s
+          }
+        ],
+        cash_transactions: []
+      }
+    )
+
+    IbkrAccount::Processor.new(@ibkr_account).process
+
+    trade = @account.entries.find_by(external_id: "ibkr_trade_1003")
+    fee = @account.entries.find_by(external_id: "ibkr_trade_fee_1003")
+
+    assert_not_nil trade
+    assert_equal BigDecimal("3"), trade.entryable.qty
+    assert_equal BigDecimal("435.0"), trade.amount
+    assert_equal "USD", trade.currency
+    assert_nil fee
+  end
+
+  test "processor logs and falls back to current date for invalid trade_date" do
+    @ibkr_account.update!(
+      raw_activities_payload: {
+        trades: [
+          {
+            "asset_category" => "STK",
+            "trade_id" => "1004",
+            "transaction_id" => "1004a",
+            "conid" => "265598",
+            "symbol" => securities(:aapl).ticker,
+            "quantity" => "1",
+            "trade_price" => "146.00",
+            "currency" => "USD",
+            "fx_rate_to_base" => "0.91",
+            "buy_sell" => "BUY",
+            "trade_date" => "not-a-date"
+          }
+        ],
+        cash_transactions: []
+      }
+    )
+
+    Rails.logger.expects(:warn).with do |message|
+      message.include?("IbkrAccount::DataHelpers - Missing or invalid trade_date") &&
+        message.include?("1004")
+    end
+
+    IbkrAccount::Processor.new(@ibkr_account).process
+
+    trade = @account.entries.find_by(external_id: "ibkr_trade_1004")
+
+    assert_not_nil trade
+    assert_equal Date.current, trade.date
+  end
+end
diff --git a/test/models/ibkr_item/sync_complete_event_test.rb b/test/models/ibkr_item/sync_complete_event_test.rb
new file mode 100644
index 000000000..5fe628434
--- /dev/null
+++ b/test/models/ibkr_item/sync_complete_event_test.rb
@@ -0,0 +1,23 @@
+require "test_helper"
+
+class IbkrItem::SyncCompleteEventTest < ActiveSupport::TestCase
+  fixtures :families, :ibkr_items
+
+  test "broadcast refreshes linked accounts, provider item, and family stream" do
+    ibkr_item = ibkr_items(:configured_item)
+    family = ibkr_item.family
+    account = mock("account")
+
+    ibkr_item.stubs(:accounts).returns([ account ])
+    account.expects(:broadcast_sync_complete).once
+    ibkr_item.expects(:broadcast_replace_to).with(
+      family,
+      target: "ibkr_item_#{ibkr_item.id}",
+      partial: "ibkr_items/ibkr_item",
+      locals: { ibkr_item: ibkr_item }
+    ).once
+    family.expects(:broadcast_sync_complete).once
+
+    IbkrItem::SyncCompleteEvent.new(ibkr_item).broadcast
+  end
+end
diff --git a/test/models/ibkr_item/syncer_test.rb b/test/models/ibkr_item/syncer_test.rb
new file mode 100644
index 000000000..ecb6786bb
--- /dev/null
+++ b/test/models/ibkr_item/syncer_test.rb
@@ -0,0 +1,26 @@
+require "test_helper"
+
+class IbkrItem::SyncerTest < ActiveSupport::TestCase
+  fixtures :families, :ibkr_items
+
+  setup do
+    @ibkr_item = ibkr_items(:configured_item)
+  end
+
+  test "perform_sync records a single auth error when credentials are missing" do
+    @ibkr_item.update!(token: nil)
+    syncer = IbkrItem::Syncer.new(@ibkr_item)
+    sync = @ibkr_item.syncs.create!
+
+    error = assert_raises(Provider::IbkrFlex::ConfigurationError) do
+      syncer.perform_sync(sync)
+    end
+
+    assert_equal "IBKR credentials are missing.", error.message
+    assert_equal "requires_update", @ibkr_item.reload.status
+
+    stats = sync.reload.sync_stats
+    assert_equal 1, stats["total_errors"]
+    assert_equal [ { "message" => "IBKR credentials are missing.", "category" => "auth_error" } ], stats["errors"]
+  end
+end
diff --git a/test/models/ibkr_item_importer_test.rb b/test/models/ibkr_item_importer_test.rb
new file mode 100644
index 000000000..c91d967e5
--- /dev/null
+++ b/test/models/ibkr_item_importer_test.rb
@@ -0,0 +1,42 @@
+require "test_helper"
+
+class IbkrItemImporterTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:empty)
+    @ibkr_item = @family.ibkr_items.create!(
+      name: "Interactive Brokers",
+      query_id: "QUERY123",
+      token: "TOKEN123"
+    )
+  end
+
+  test "imports accounts from parsed flex statement" do
+    provider = mock("ibkr_provider")
+    provider.expects(:download_statement).returns(file_fixture("ibkr/flex_statement.xml").read)
+
+    assert_difference "IbkrAccount.count", 2 do
+      result = IbkrItem::Importer.new(@ibkr_item, ibkr_provider: provider).import
+      assert_equal true, result[:success]
+      assert_equal 2, result[:accounts_imported]
+    end
+
+    primary_account = @ibkr_item.ibkr_accounts.find_by!(ibkr_account_id: "U1234567")
+    assert_equal "CHF", primary_account.currency
+    assert_equal BigDecimal("3351.0"), primary_account.current_balance
+    assert_equal 2, primary_account.raw_equity_summary_payload.size
+    assert_equal 1, primary_account.raw_holdings_payload.size
+    assert_equal 2, primary_account.raw_activities_payload["trades"].size
+    assert_equal 2, primary_account.raw_activities_payload["cash_transactions"].size
+  end
+
+  test "raises parse error for malformed flex statement xml" do
+    provider = mock("ibkr_provider")
+    provider.expects(:download_statement).returns("<FlexQueryResponse><FlexStatement>")
+
+    error = assert_raises(IbkrItem::ReportParser::ParseError) do
+      IbkrItem::Importer.new(@ibkr_item, ibkr_provider: provider).import
+    end
+
+    assert_match "Invalid IBKR Flex XML", error.message
+  end
+end
diff --git a/test/models/ibkr_item_report_parser_test.rb b/test/models/ibkr_item_report_parser_test.rb
new file mode 100644
index 000000000..b2c252221
--- /dev/null
+++ b/test/models/ibkr_item_report_parser_test.rb
@@ -0,0 +1,58 @@
+require "test_helper"
+
+class IbkrItemReportParserTest < ActiveSupport::TestCase
+  test "parses accounts, balances, and positions from flex xml" do
+    parsed = IbkrItem::ReportParser.new(file_fixture("ibkr/flex_statement.xml").read).parse
+
+    assert_equal "Sure Test", parsed[:metadata]["query_name"]
+    assert_equal 2, parsed[:accounts].size
+
+    first_account = parsed[:accounts].first
+    assert_equal "U1234567", first_account[:ibkr_account_id]
+    assert_equal "CHF", first_account[:currency]
+    assert_equal BigDecimal("1000.50"), first_account[:cash_balance]
+    assert_equal BigDecimal("3351.00"), first_account[:current_balance]
+    assert_equal 2, first_account[:equity_summary_in_base].size
+    assert_equal 1, first_account[:open_positions].size
+    assert_equal 2, first_account[:trades].size
+    assert_equal 2, first_account[:cash_transactions].size
+
+    second_account = parsed[:accounts].second
+    assert_equal "U7654321", second_account[:ibkr_account_id]
+    assert_equal BigDecimal("250"), second_account[:cash_balance]
+    assert_equal BigDecimal("250"), second_account[:current_balance]
+    assert_equal 1, second_account[:equity_summary_in_base].size
+  end
+
+  test "raises parse error for malformed xml" do
+    error = assert_raises(IbkrItem::ReportParser::ParseError) do
+      IbkrItem::ReportParser.new("<FlexQueryResponse><FlexStatement>").parse
+    end
+
+    assert_match "Invalid IBKR Flex XML", error.message
+  end
+
+  test "raises parse error when flex statements are missing" do
+    error = assert_raises(IbkrItem::ReportParser::ParseError) do
+      IbkrItem::ReportParser.new('<FlexQueryResponse queryName="Sure Test" />').parse
+    end
+
+    assert_equal "Invalid IBKR Flex XML: no FlexStatement nodes found.", error.message
+  end
+
+  test "raises parse error when flex statement account id is missing" do
+    xml = <<~XML
+      <FlexQueryResponse queryName="Sure Test">
+        <FlexStatement>
+          <AccountInformation currency="CHF" />
+        </FlexStatement>
+      </FlexQueryResponse>
+    XML
+
+    error = assert_raises(IbkrItem::ReportParser::ParseError) do
+      IbkrItem::ReportParser.new(xml).parse
+    end
+
+    assert_equal "Invalid IBKR Flex XML: missing account identifier in FlexStatement.", error.message
+  end
+end
diff --git a/test/models/ibkr_item_test.rb b/test/models/ibkr_item_test.rb
new file mode 100644
index 000000000..53737a120
--- /dev/null
+++ b/test/models/ibkr_item_test.rb
@@ -0,0 +1,20 @@
+require "test_helper"
+
+class IbkrItemTest < ActiveSupport::TestCase
+  fixtures :families, :ibkr_items
+
+  test "syncable excludes items without token" do
+    item = IbkrItem.create!(
+      family: families(:empty),
+      name: "Interactive Brokers",
+      query_id: "QUERYNEW",
+      token: "TOKENNEW"
+    )
+
+    item.token = nil
+    item.save!(validate: false)
+
+    assert_includes IbkrItem.syncable, ibkr_items(:configured_item)
+    refute_includes IbkrItem.syncable, item
+  end
+end
diff --git a/test/models/indexa_capital_account/processor_test.rb b/test/models/indexa_capital_account/processor_test.rb
index f22678cf3..d18558b7c 100644
--- a/test/models/indexa_capital_account/processor_test.rb
+++ b/test/models/indexa_capital_account/processor_test.rb
@@ -35,7 +35,7 @@ class IndexaCapitalAccount::ProcessorTest < ActiveSupport::TestCase
     assert_nothing_raised { processor.process }
   end
 
-  test "processor updates account balance from holdings value" do
+  test "processor trusts API current_balance over holdings sum when present" do
     @indexa_capital_account.update!(
       current_balance: 38905.21,
       raw_holdings_payload: [
@@ -59,6 +59,34 @@ class IndexaCapitalAccount::ProcessorTest < ActiveSupport::TestCase
     processor = IndexaCapitalAccount::Processor.new(@indexa_capital_account)
     processor.process
 
+    @account.reload
+    assert_in_delta 38905.21, @account.balance.to_f, 0.01
+  end
+
+  test "processor falls back to holdings sum when current_balance is missing" do
+    @indexa_capital_account.update!(
+      current_balance: nil,
+      raw_holdings_payload: [
+        {
+          "amount" => 16333.96,
+          "titles" => 32.26,
+          "price" => 506.32,
+          "instrument" => { "identifier" => "IE00BFPM9V94", "name" => "Vanguard US 500" }
+        },
+        {
+          "amount" => 10759.05,
+          "titles" => 40.34,
+          "price" => 266.71,
+          "instrument" => { "identifier" => "IE00BFPM9L96", "name" => "Vanguard European" }
+        }
+      ]
+    )
+
+    @account.update!(balance: 0)
+
+    processor = IndexaCapitalAccount::Processor.new(@indexa_capital_account)
+    processor.process
+
     @account.reload
     assert_in_delta 27093.01, @account.balance.to_f, 0.01
   end
diff --git a/test/models/investment_statement_test.rb b/test/models/investment_statement_test.rb
new file mode 100644
index 000000000..3bb50dff8
--- /dev/null
+++ b/test/models/investment_statement_test.rb
@@ -0,0 +1,190 @@
+require "test_helper"
+
+class InvestmentStatementTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:empty)
+    # families(:empty) defaults to currency "USD"
+    @statement = InvestmentStatement.new(@family, user: nil)
+  end
+
+  test "portfolio_value and cash_balance with a single-currency family" do
+    create_investment_account(balance: 1000, cash_balance: 100)
+
+    assert_equal 1000, @statement.portfolio_value
+    assert_equal 100, @statement.cash_balance
+    assert_equal 900, @statement.holdings_value
+  end
+
+  test "portfolio_value converts foreign-currency accounts to family currency" do
+    create_investment_account(balance: 1921.92, cash_balance: -162, currency: "USD")
+    create_investment_account(balance: 1000, cash_balance: 1000, currency: "EUR")
+
+    ExchangeRate.create!(
+      from_currency: "EUR",
+      to_currency: "USD",
+      date: Date.current,
+      rate: 1.1
+    )
+
+    # 1921.92 + 1000 * 1.1 = 3021.92
+    assert_in_delta 3021.92, @statement.portfolio_value, 0.001
+    # -162 + 1000 * 1.1 = 938
+    assert_in_delta 938, @statement.cash_balance, 0.001
+    # 3021.92 - 938 = 2083.92
+    assert_in_delta 2083.92, @statement.holdings_value, 0.001
+  end
+
+  test "portfolio_value falls back to 1:1 when FX rate is missing" do
+    create_investment_account(balance: 1921.92, currency: "USD")
+    create_investment_account(balance: 1000, currency: "EUR")
+
+    # No ExchangeRate row → rates_for defaults to 1
+    assert_in_delta 2921.92, @statement.portfolio_value, 0.001
+  end
+
+  test "current_holdings includes holdings from every investment account regardless of currency" do
+    usd_account = create_investment_account(balance: 2100, currency: "USD")
+    eur_account = create_investment_account(balance: 2000, currency: "EUR")
+
+    usd_security = Security.create!(ticker: "AAPL", name: "Apple")
+    eur_security = Security.create!(ticker: "ASML", name: "ASML")
+
+    Holding.create!(
+      account: usd_account, security: usd_security, date: Date.current,
+      qty: 10, price: 210, amount: 2100, currency: "USD"
+    )
+    Holding.create!(
+      account: eur_account, security: eur_security, date: Date.current,
+      qty: 4, price: 500, amount: 2000, currency: "EUR"
+    )
+
+    assert_equal 2, @statement.current_holdings.count
+  end
+
+  test "top_holdings ranks by family-currency value across currencies" do
+    usd_account = create_investment_account(balance: 2100, currency: "USD")
+    eur_account = create_investment_account(balance: 2000, currency: "EUR")
+
+    usd_security = Security.create!(ticker: "AAPL", name: "Apple")
+    eur_security = Security.create!(ticker: "ASML", name: "ASML")
+
+    Holding.create!(
+      account: usd_account, security: usd_security, date: Date.current,
+      qty: 10, price: 210, amount: 2100, currency: "USD"
+    )
+    Holding.create!(
+      account: eur_account, security: eur_security, date: Date.current,
+      qty: 4, price: 500, amount: 2000, currency: "EUR"
+    )
+
+    ExchangeRate.create!(
+      from_currency: "EUR", to_currency: "USD",
+      date: Date.current, rate: 1.1
+    )
+
+    # 2000 EUR = 2200 USD > 2100 USD, so ASML outranks AAPL in family currency
+    top = @statement.top_holdings(limit: 2)
+    assert_equal %w[ASML AAPL], top.map(&:ticker)
+  end
+
+  test "allocation weights sum to 100% with mixed currencies" do
+    usd_account = create_investment_account(balance: 2100, currency: "USD")
+    eur_account = create_investment_account(balance: 2000, currency: "EUR")
+
+    usd_security = Security.create!(ticker: "AAPL", name: "Apple")
+    eur_security = Security.create!(ticker: "ASML", name: "ASML")
+
+    Holding.create!(
+      account: usd_account, security: usd_security, date: Date.current,
+      qty: 10, price: 210, amount: 2100, currency: "USD"
+    )
+    Holding.create!(
+      account: eur_account, security: eur_security, date: Date.current,
+      qty: 4, price: 500, amount: 2000, currency: "EUR"
+    )
+
+    ExchangeRate.create!(
+      from_currency: "EUR", to_currency: "USD",
+      date: Date.current, rate: 1.1
+    )
+
+    allocation = @statement.allocation
+    assert_equal 2, allocation.size
+    assert_in_delta 100.0, allocation.sum(&:weight), 0.01
+    # Every row is labeled in family currency
+    assert allocation.all? { |a| a.amount.currency.iso_code == "USD" }
+  end
+
+  test "unrealized_gains sums in family currency with mixed-currency holdings" do
+    usd_account = create_investment_account(balance: 2100, currency: "USD")
+    eur_account = create_investment_account(balance: 2000, currency: "EUR")
+
+    usd_security = Security.create!(ticker: "AAPL", name: "Apple")
+    eur_security = Security.create!(ticker: "ASML", name: "ASML")
+
+    Holding.create!(
+      account: usd_account, security: usd_security, date: Date.current,
+      qty: 10, price: 210, amount: 2100, currency: "USD",
+      cost_basis: 200, cost_basis_locked: true
+    )
+    Holding.create!(
+      account: eur_account, security: eur_security, date: Date.current,
+      qty: 4, price: 500, amount: 2000, currency: "EUR",
+      cost_basis: 450, cost_basis_locked: true
+    )
+
+    ExchangeRate.create!(
+      from_currency: "EUR", to_currency: "USD",
+      date: Date.current, rate: 1.1
+    )
+
+    # AAPL unrealized = 2100 - (10 * 200) = 100 USD
+    # ASML unrealized = 2000 - (4 * 450) = 200 EUR → 220 USD @ 1.1
+    # Total = 320 USD
+    assert_in_delta 320, @statement.unrealized_gains, 0.001
+    assert_equal "USD", @statement.unrealized_gains_money.currency.iso_code
+  end
+
+  test "unrealized_gains_trend is denominated in family currency" do
+    usd_account = create_investment_account(balance: 2100, currency: "USD")
+    eur_account = create_investment_account(balance: 2000, currency: "EUR")
+
+    usd_security = Security.create!(ticker: "AAPL", name: "Apple")
+    eur_security = Security.create!(ticker: "ASML", name: "ASML")
+
+    Holding.create!(
+      account: usd_account, security: usd_security, date: Date.current,
+      qty: 10, price: 210, amount: 2100, currency: "USD",
+      cost_basis: 200, cost_basis_locked: true
+    )
+    Holding.create!(
+      account: eur_account, security: eur_security, date: Date.current,
+      qty: 4, price: 500, amount: 2000, currency: "EUR",
+      cost_basis: 450, cost_basis_locked: true
+    )
+
+    ExchangeRate.create!(
+      from_currency: "EUR", to_currency: "USD",
+      date: Date.current, rate: 1.1
+    )
+
+    trend = @statement.unrealized_gains_trend
+    assert_equal "USD", trend.current.currency.iso_code
+    assert_equal "USD", trend.previous.currency.iso_code
+    # current = 2100 USD + (2000 EUR * 1.1) = 4300 USD
+    assert_in_delta 4300, trend.current.amount, 0.001
+    # previous (cost basis) = (10 * 200) USD + (4 * 450 * 1.1) EUR→USD = 2000 + 1980 = 3980 USD
+    assert_in_delta 3980, trend.previous.amount, 0.001
+  end
+
+  private
+    def create_investment_account(balance:, cash_balance: 0, currency: "USD")
+      @family.accounts.create!(
+        name: "Investment #{SecureRandom.hex(3)}",
+        balance: balance,
+        cash_balance: cash_balance,
+        currency: currency,
+        accountable: Investment.new
+      )
+    end
+end
diff --git a/test/models/investment_test.rb b/test/models/investment_test.rb
index dbae27153..34f047cc2 100644
--- a/test/models/investment_test.rb
+++ b/test/models/investment_test.rb
@@ -99,6 +99,10 @@ class InvestmentTest < ActiveSupport::TestCase
     assert_equal :tax_advantaged, investment.tax_treatment
   end
 
+  test "tax_treatment returns tax_advantaged for French AV" do
+    investment = Investment.new(subtype: "assurance_vie")
+    assert_equal :tax_advantaged, investment.tax_treatment
+  end
   # Generic account types
 
   test "tax_treatment returns tax_deferred for generic pension and retirement" do
@@ -129,11 +133,47 @@ class InvestmentTest < ActiveSupport::TestCase
   end
 
   test "all subtypes have valid region values" do
-    valid_regions = [ "us", "uk", "ca", "au", "eu", nil ]
+    valid_regions = [ "us", "uk", "ca", "au", "eu", "in", nil ]
 
     Investment::SUBTYPES.each do |key, metadata|
       assert_includes valid_regions, metadata[:region],
         "Subtype #{key} has invalid region: #{metadata[:region]}"
     end
   end
+
+  # India account types
+
+  test "India pension subtypes have tax_advantaged treatment" do
+    %w[nps apy].each do |subtype|
+      investment = Investment.new(subtype: subtype)
+      assert_equal :tax_advantaged, investment.tax_treatment, "Expected #{subtype} to be tax_advantaged"
+    end
+  end
+
+  test "India equity subtypes are taxable" do
+    %w[indian_stocks indian_equity indian_etf].each do |subtype|
+      investment = Investment.new(subtype: subtype)
+      assert_equal :taxable, investment.tax_treatment, "Expected #{subtype} to be taxable"
+    end
+  end
+
+  test "life insurance is tax_advantaged" do
+    investment = Investment.new(subtype: "life_insurance")
+    assert_equal :tax_advantaged, investment.tax_treatment
+  end
+
+  test "India subtypes all belong to the 'in' region" do
+    india_keys = Investment::SUBTYPES.keys.select { |k| Investment::SUBTYPES.dig(k, :region) == "in" }
+    assert india_keys.any?, "Expected at least one India subtype"
+    india_keys.each do |key|
+      assert_equal "in", Investment::SUBTYPES.dig(key, :region), "Expected #{key} to have region 'in'"
+    end
+  end
+
+  test "subtypes_grouped_for_select places India region first for INR users" do
+    grouped = Investment.subtypes_grouped_for_select(currency: "INR")
+    assert grouped.any?, "grouped should not be empty"
+    first_group_label = grouped.first[0]
+    assert_equal I18n.t("accounts.subtype_regions.in"), first_group_label
+  end
 end
diff --git a/test/models/kraken_account/asset_normalizer_test.rb b/test/models/kraken_account/asset_normalizer_test.rb
new file mode 100644
index 000000000..540caf4d3
--- /dev/null
+++ b/test/models/kraken_account/asset_normalizer_test.rb
@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class KrakenAccount::AssetNormalizerTest < ActiveSupport::TestCase
+  test "normalizes kraken symbols through metadata and fallbacks" do
+    normalizer = KrakenAccount::AssetNormalizer.new(
+      "XXBT" => { "altname" => "XBT" },
+      "XETH" => { "altname" => "ETH" },
+      "ZUSD" => { "altname" => "USD" }
+    )
+
+    assert_equal "BTC", normalizer.normalize("XXBT")[:symbol]
+    assert_equal "ETH", normalizer.normalize("XETH")[:symbol]
+    assert_equal "USD", normalizer.normalize("ZUSD")[:symbol]
+  end
+
+  test "preserves kraken suffix variants while pricing base asset" do
+    normalizer = KrakenAccount::AssetNormalizer.new("XETH" => { "altname" => "ETH" })
+
+    parsed = normalizer.normalize("XETH.F")
+
+    assert_equal "ETH.F", parsed[:symbol]
+    assert_equal "ETH", parsed[:price_symbol]
+    assert_equal ".F", parsed[:suffix]
+    assert_equal "XETH", parsed[:raw_base]
+  end
+end
diff --git a/test/models/kraken_account/holdings_processor_test.rb b/test/models/kraken_account/holdings_processor_test.rb
new file mode 100644
index 000000000..171e332bf
--- /dev/null
+++ b/test/models/kraken_account/holdings_processor_test.rb
@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class KrakenAccount::HoldingsProcessorTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @family.update!(currency: "USD")
+    @item = KrakenItem.create!(
+      family: @family,
+      name: "Kraken",
+      api_key: "k",
+      api_secret: "s"
+    )
+    @kraken_account = @item.kraken_accounts.create!(
+      name: "Kraken",
+      account_id: "combined",
+      account_type: "combined",
+      currency: "USD",
+      current_balance: 30_000,
+      raw_payload: {
+        "assets" => [
+          { "symbol" => "BTC", "price_symbol" => "BTC", "balance" => "0.5", "price_usd" => "60000.0", "source" => "spot" }
+        ]
+      }
+    )
+    @account = Account.create!(
+      family: @family,
+      name: "Kraken",
+      balance: 0,
+      currency: "USD",
+      accountable: Crypto.create!(subtype: "exchange")
+    )
+    @account_provider = AccountProvider.create!(account: @account, provider: @kraken_account)
+    @security = Security.create!(ticker: "CRYPTO:BTC", name: "BTC", exchange_operating_mic: "XKRA", offline: true)
+    KrakenAccount::SecurityResolver.stubs(:resolve).returns(@security)
+  end
+
+  test "imports holdings with account_provider_id" do
+    import_adapter = mock
+    import_adapter.expects(:import_holding).with(
+      has_entries(
+        security: @security,
+        quantity: 0.5.to_d,
+        amount: 30_000.to_d,
+        currency: "USD",
+        price: 60_000.to_d,
+        external_id: "kraken_BTC_spot_#{Date.current}",
+        account_provider_id: @account_provider.id,
+        source: "kraken"
+      )
+    )
+    Account::ProviderImportAdapter.stubs(:new).returns(import_adapter)
+
+    KrakenAccount::HoldingsProcessor.new(@kraken_account).process
+  end
+
+  test "does not overwrite a different provider holding with the same security/date/currency" do
+    binance_item = BinanceItem.create!(family: @family, name: "Binance", api_key: "b", api_secret: "s")
+    binance_account = binance_item.binance_accounts.create!(name: "Binance", account_type: "combined", currency: "USD")
+    binance_provider = AccountProvider.create!(account: @account, provider: binance_account)
+    existing = @account.holdings.create!(
+      security: @security,
+      qty: 0.25,
+      amount: 15_000,
+      currency: "USD",
+      date: Date.current,
+      price: 60_000,
+      account_provider_id: binance_provider.id
+    )
+
+    assert_no_difference -> { @account.holdings.count } do
+      KrakenAccount::HoldingsProcessor.new(@kraken_account).process
+    end
+
+    assert_equal binance_provider.id, existing.reload.account_provider_id
+    assert_nil existing.external_id
+    assert_nil @account.holdings.find_by(external_id: "kraken_BTC_spot_#{Date.current}")
+  end
+
+  test "does not log raw asset payloads when holding import fails" do
+    raw_asset = {
+      "symbol" => "BTC",
+      "price_symbol" => "BTC",
+      "balance" => "0.5",
+      "price_usd" => "60000.0",
+      "source" => "spot",
+      "account_balance_detail" => "sensitive payload"
+    }
+    @kraken_account.update!(raw_payload: { "assets" => [ raw_asset ] })
+    failing_adapter = mock
+    failing_adapter.stubs(:import_holding).raises(StandardError, "boom")
+    Account::ProviderImportAdapter.stubs(:new).returns(failing_adapter)
+
+    Rails.logger.expects(:error)
+      .with("KrakenAccount::HoldingsProcessor - failed asset symbol=BTC: boom")
+
+    KrakenAccount::HoldingsProcessor.new(@kraken_account).process
+  end
+end
diff --git a/test/models/kraken_account/processor_test.rb b/test/models/kraken_account/processor_test.rb
new file mode 100644
index 000000000..157b654a7
--- /dev/null
+++ b/test/models/kraken_account/processor_test.rb
@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class KrakenAccount::ProcessorTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @family.update!(currency: "USD")
+    @item = KrakenItem.create!(family: @family, name: "Kraken", api_key: "k", api_secret: "s")
+    @kraken_account = @item.kraken_accounts.create!(
+      name: "Kraken",
+      account_id: "combined",
+      account_type: "combined",
+      currency: "USD",
+      current_balance: 1000,
+      raw_payload: {
+        "asset_metadata" => {
+          "XXBT" => { "altname" => "XBT" },
+          "ZUSD" => { "altname" => "USD" }
+        },
+        "pair_metadata" => {
+          "XXBTZUSD" => { "altname" => "XBTUSD", "base" => "XXBT", "quote" => "ZUSD" }
+        }
+      },
+      raw_transactions_payload: {
+        "trades" => {
+          "buy_tx" => trade_payload("buy", "0.001", "50.00", "0.10"),
+          "sell_tx" => trade_payload("sell", "0.002", "120.00", "0.20")
+        }
+      }
+    )
+    @account = Account.create!(
+      family: @family,
+      name: "Kraken",
+      balance: 0,
+      currency: "USD",
+      accountable: Crypto.create!(subtype: "exchange")
+    )
+    AccountProvider.create!(account: @account, provider: @kraken_account)
+    @security = Security.create!(ticker: "CRYPTO:BTC", name: "BTC", exchange_operating_mic: "XKRA", offline: true)
+    KrakenAccount::SecurityResolver.stubs(:resolve).returns(@security)
+    KrakenAccount::HoldingsProcessor.any_instance.stubs(:process).returns(nil)
+  end
+
+  test "imports buy and sell spot fills as trade entries" do
+    assert_difference -> { @account.entries.where(source: "kraken").count }, 2 do
+      KrakenAccount::Processor.new(@kraken_account).process
+    end
+
+    buy = @account.entries.find_by!(external_id: "kraken_trade_buy_tx", source: "kraken")
+    assert_equal(-50.to_d, buy.amount)
+    assert_equal "USD", buy.currency
+    assert_equal 0.001.to_d, buy.trade.qty
+    assert_equal 50_000.to_d, buy.trade.price
+    assert_equal 0.10.to_d, buy.trade.fee
+    assert_equal "Buy", buy.trade.investment_activity_label
+
+    sell = @account.entries.find_by!(external_id: "kraken_trade_sell_tx", source: "kraken")
+    assert_equal 120.to_d, sell.amount
+    assert_equal(-0.002.to_d, sell.trade.qty)
+    assert_equal 0.20.to_d, sell.trade.fee
+    assert_equal "Sell", sell.trade.investment_activity_label
+  end
+
+  test "trade import is idempotent by txid" do
+    assert_difference -> { @account.entries.where(source: "kraken").count }, 2 do
+      KrakenAccount::Processor.new(@kraken_account).process
+    end
+
+    assert_no_difference -> { @account.entries.where(source: "kraken").count } do
+      KrakenAccount::Processor.new(@kraken_account).process
+    end
+  end
+
+  test "updates linked crypto account balance without cash balance" do
+    KrakenAccount::Processor.new(@kraken_account).process
+
+    @account.reload
+    assert_equal 1000.to_d, @account.balance
+    assert_equal 0.to_d, @account.cash_balance
+    assert_equal "USD", @account.currency
+  end
+
+  private
+
+    def trade_payload(type, volume, cost, fee)
+      price = volume.to_d.zero? ? 0.to_d : cost.to_d / volume.to_d
+
+      {
+        "ordertxid" => "order_#{type}",
+        "pair" => "XBTUSD",
+        "time" => Time.current.to_f,
+        "type" => type,
+        "price" => price.to_s("F"),
+        "cost" => cost,
+        "fee" => fee,
+        "vol" => volume
+      }
+    end
+end
diff --git a/test/models/kraken_item/importer_test.rb b/test/models/kraken_item/importer_test.rb
new file mode 100644
index 000000000..2da355bb9
--- /dev/null
+++ b/test/models/kraken_item/importer_test.rb
@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class KrakenItem::ImporterTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @item = KrakenItem.create!(
+      family: @family,
+      name: "Kraken",
+      api_key: "k",
+      api_secret: "s"
+    )
+    @provider = mock
+    @provider.stubs(:get_api_key_info).returns({ "name" => "Sure read-only" })
+    @provider.stubs(:get_asset_pairs).returns(pair_metadata)
+    @provider.stubs(:get_trades_history).returns({ "count" => 0, "trades" => {} })
+    @provider.stubs(:get_ticker).returns(nil)
+  end
+
+  test "creates a combined kraken account from BalanceEx" do
+    @provider.stubs(:get_asset_info).returns(asset_metadata)
+    @provider.stubs(:get_extended_balance).returns(
+      "XXBT" => { "balance" => "1.0", "credit" => "0", "credit_used" => "0", "hold_trade" => "0.25" },
+      "ZUSD" => { "balance" => "50.0", "credit" => "0", "credit_used" => "0", "hold_trade" => "0" }
+    )
+    @provider.stubs(:get_ticker).with("XBTUSD").returns("XXBTZUSD" => { "c" => [ "50000.00" ] })
+
+    assert_difference "@item.kraken_accounts.count", 1 do
+      KrakenItem::Importer.new(@item, kraken_provider: @provider).import
+    end
+
+    account = @item.kraken_accounts.first
+    assert_equal "combined", account.account_id
+    assert_equal "combined", account.account_type
+    assert_equal "USD", account.currency
+    assert_in_delta 50_050, account.current_balance, 0.01
+
+    btc = account.raw_payload["assets"].find { |asset| asset["symbol"] == "BTC" }
+    assert_equal "0.75", btc["available"]
+    assert_equal "0.25", btc["hold_trade"]
+  end
+
+  test "preserves suffix assets in metadata and marks missing prices" do
+    @provider.stubs(:get_asset_info).returns(asset_metadata)
+    @provider.stubs(:get_extended_balance).returns(
+      "XETH.F" => { "balance" => "2.0", "credit" => "0", "credit_used" => "0", "hold_trade" => "0" }
+    )
+
+    KrakenItem::Importer.new(@item, kraken_provider: @provider).import
+
+    account = @item.kraken_accounts.first
+    eth = account.raw_payload["assets"].first
+    assert_equal "ETH.F", eth["symbol"]
+    assert_equal "ETH", eth["price_symbol"]
+    assert_equal ".F", eth["suffix"]
+    assert_equal "missing", eth["price_status"]
+    assert_includes account.extra.dig("kraken", "missing_prices"), "ETH.F"
+  end
+
+  test "paginates TradesHistory in 50 fill pages" do
+    @provider.stubs(:get_asset_info).returns({})
+    @provider.stubs(:get_extended_balance).returns({})
+    first_page = 50.times.to_h { |i| [ "tx#{i}", trade_payload("tx#{i}") ] }
+    second_page = { "tx50" => trade_payload("tx50") }
+
+    @provider.expects(:get_trades_history).with(start: nil, offset: 0).returns({ "count" => 51, "trades" => first_page })
+    @provider.expects(:get_trades_history).with(start: nil, offset: 50).returns({ "count" => 51, "trades" => second_page })
+
+    result = KrakenItem::Importer.new(@item, kraken_provider: @provider).import
+
+    assert_equal 51, result[:trades_imported]
+    assert_equal 51, @item.kraken_accounts.first.raw_transactions_payload["trades"].size
+  end
+
+  test "marks item requires_update when required endpoint reports permission error" do
+    @provider.stubs(:get_asset_info).returns({})
+    @provider.stubs(:get_asset_pairs).returns({})
+    @provider.stubs(:get_extended_balance).raises(Provider::Kraken::PermissionError, "EGeneral:Permission denied")
+
+    assert_raises(Provider::Kraken::PermissionError) do
+      KrakenItem::Importer.new(@item, kraken_provider: @provider).import
+    end
+
+    assert @item.reload.requires_update?
+  end
+
+  private
+
+    def asset_metadata
+      {
+        "XXBT" => { "altname" => "XBT" },
+        "XETH" => { "altname" => "ETH" },
+        "ZUSD" => { "altname" => "USD" }
+      }
+    end
+
+    def pair_metadata
+      {
+        "XXBTZUSD" => { "altname" => "XBTUSD", "base" => "XXBT", "quote" => "ZUSD" }
+      }
+    end
+
+    def trade_payload(txid)
+      {
+        "ordertxid" => "order_#{txid}",
+        "pair" => "XBTUSD",
+        "time" => Time.current.to_f,
+        "type" => "buy",
+        "price" => "50000.0",
+        "cost" => "50.0",
+        "fee" => "0.1",
+        "vol" => "0.001"
+      }
+    end
+end
diff --git a/test/models/kraken_item_test.rb b/test/models/kraken_item_test.rb
new file mode 100644
index 000000000..69c08d2f2
--- /dev/null
+++ b/test/models/kraken_item_test.rb
@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class KrakenItemTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @item = KrakenItem.create!(
+      family: @family,
+      name: "My Kraken",
+      api_key: "test_key",
+      api_secret: "test_secret"
+    )
+  end
+
+  test "belongs to family" do
+    assert_equal @family, @item.family
+  end
+
+  test "has good status by default" do
+    assert_equal "good", @item.status
+  end
+
+  test "strips credential whitespace before validation" do
+    item = KrakenItem.create!(
+      family: @family,
+      name: "Whitespace Kraken",
+      api_key: " key \n",
+      api_secret: " secret \n"
+    )
+
+    assert_equal "key", item.api_key
+    assert_equal "secret", item.api_secret
+  end
+
+  test "rejects whitespace-only credentials" do
+    item = KrakenItem.new(family: @family, name: "Blank Kraken", api_key: "   ", api_secret: "\n")
+
+    assert_not item.valid?
+    assert_includes item.errors[:api_key], "can't be blank"
+    assert_includes item.errors[:api_secret], "can't be blank"
+  end
+
+  test "credentials_configured rejects whitespace-only values" do
+    @item.update_columns(api_key: "   ", api_secret: "secret")
+
+    assert_not @item.reload.credentials_configured?
+  end
+
+  test "next_nonce is monotonic even when stored nonce is ahead of clock" do
+    @item.update!(last_nonce: 9_000_000_000_000_000_000)
+
+    first = @item.next_nonce!.to_i
+    second = @item.next_nonce!.to_i
+
+    assert_equal 9_000_000_000_000_000_001, first
+    assert_equal 9_000_000_000_000_000_002, second
+    assert_equal second, @item.reload.last_nonce
+  end
+
+  test "kraken provider uses item nonce generator" do
+    @item.update!(last_nonce: 9_000_000_000_000_000_000)
+    provider = @item.kraken_provider
+
+    nonce = provider.send(:nonce_generator).call
+
+    assert_equal "9000000000000000001", nonce
+    assert_equal 9_000_000_000_000_000_001, @item.reload.last_nonce
+  end
+
+  test "duplicate combined account ids are scoped by kraken item" do
+    other_item = KrakenItem.create!(
+      family: @family,
+      name: "Other Kraken",
+      api_key: "other_key",
+      api_secret: "other_secret"
+    )
+
+    @item.kraken_accounts.create!(name: "Main", account_id: "combined", account_type: "combined", currency: "USD")
+    other_account = other_item.kraken_accounts.create!(name: "Other", account_id: "combined", account_type: "combined", currency: "USD")
+
+    assert other_account.persisted?
+  end
+
+  test "encrypts credentials when active record encryption is configured" do
+    skip "Encryption not configured" unless KrakenItem.encryption_ready?
+
+    item = KrakenItem.create!(
+      family: @family,
+      name: "Encrypted Kraken",
+      api_key: "encrypted_key",
+      api_secret: "encrypted_secret"
+    )
+
+    quoted_id = KrakenItem.connection.quote(item.id)
+    raw = KrakenItem.connection.select_one("SELECT api_key, api_secret FROM kraken_items WHERE id = #{quoted_id}")
+    assert_not_equal "encrypted_key", raw["api_key"]
+    assert_not_equal "encrypted_secret", raw["api_secret"]
+  end
+end
diff --git a/test/models/loan_test.rb b/test/models/loan_test.rb
index c39679bfb..05ce9fa05 100644
--- a/test/models/loan_test.rb
+++ b/test/models/loan_test.rb
@@ -1,6 +1,13 @@
 require "test_helper"
 
 class LoanTest < ActiveSupport::TestCase
+  test "rejects invalid subtype" do
+    loan = Loan.new(subtype: "invalid")
+
+    assert_not loan.valid?
+    assert_includes loan.errors[:subtype], "is not included in the list"
+  end
+
   test "calculates correct monthly payment for fixed rate loan" do
     loan_account = Account.create! \
       family: families(:dylan_family),
@@ -8,6 +15,7 @@ class LoanTest < ActiveSupport::TestCase
       balance: 500000,
       currency: "USD",
       accountable: Loan.create!(
+        subtype: "mortgage",
         interest_rate: 3.5,
         term_months: 360,
         rate_type: "fixed"
diff --git a/test/models/lunchflow_item_test.rb b/test/models/lunchflow_item_test.rb
new file mode 100644
index 000000000..13b06f2fd
--- /dev/null
+++ b/test/models/lunchflow_item_test.rb
@@ -0,0 +1,31 @@
+require "test_helper"
+
+class LunchflowItemTest < ActiveSupport::TestCase
+  def setup
+    @lunchflow_item = lunchflow_items(:one)
+  end
+
+  test "effective_base_url returns default when base_url blank" do
+    @lunchflow_item.base_url = nil
+
+    assert_equal LunchflowItem::DEFAULT_BASE_URL, @lunchflow_item.effective_base_url
+  end
+
+  test "effective_base_url returns default for non-lunchflow host" do
+    @lunchflow_item.base_url = "https://169.254.169.254/latest/meta-data"
+
+    assert_equal LunchflowItem::DEFAULT_BASE_URL, @lunchflow_item.effective_base_url
+  end
+
+  test "effective_base_url returns default for non-https scheme" do
+    @lunchflow_item.base_url = "http://lunchflow.app/api/v1"
+
+    assert_equal LunchflowItem::DEFAULT_BASE_URL, @lunchflow_item.effective_base_url
+  end
+
+  test "effective_base_url returns canonical default for valid lunchflow url" do
+    @lunchflow_item.base_url = "https://lunchflow.app/api/v1/"
+
+    assert_equal LunchflowItem::DEFAULT_BASE_URL, @lunchflow_item.effective_base_url
+  end
+end
diff --git a/test/models/market_data_importer_test.rb b/test/models/market_data_importer_test.rb
index 37d3070fe..27c4f5f0b 100644
--- a/test/models/market_data_importer_test.rb
+++ b/test/models/market_data_importer_test.rb
@@ -43,6 +43,7 @@ class MarketDataImporterTest < ActiveSupport::TestCase
     expected_start_date = (SNAPSHOT_START_DATE + 1.day) - EXCHANGE_RATE_BUFFER
     end_date            = Date.current.in_time_zone("America/New_York").to_date
 
+    # Only the forward pair (CAD→USD) should be fetched; inverse (USD→CAD) is computed automatically
     @provider.expects(:fetch_exchange_rates)
              .with(from: "CAD",
                    to: "USD",
@@ -52,20 +53,11 @@ class MarketDataImporterTest < ActiveSupport::TestCase
                OpenStruct.new(from: "CAD", to: "USD", date: SNAPSHOT_START_DATE, rate: 1.5)
              ]))
 
-    @provider.expects(:fetch_exchange_rates)
-             .with(from: "USD",
-                   to: "CAD",
-                   start_date: expected_start_date,
-                   end_date: end_date)
-             .returns(provider_success_response([
-               OpenStruct.new(from: "USD", to: "CAD", date: SNAPSHOT_START_DATE, rate: 0.67)
-             ]))
-
     before = ExchangeRate.count
     MarketDataImporter.new(mode: :snapshot).import_exchange_rates
     after  = ExchangeRate.count
 
-    assert_operator after, :>, before + 1, "Should insert at least two new exchange-rate rows"
+    assert_operator after, :>, before + 1, "Should insert at least two new exchange-rate rows (forward + computed inverse)"
   end
 
   test "syncs security prices" do
diff --git a/test/models/mercury_account_test.rb b/test/models/mercury_account_test.rb
index 801728bdf..92497581e 100644
--- a/test/models/mercury_account_test.rb
+++ b/test/models/mercury_account_test.rb
@@ -44,6 +44,34 @@ class MercuryAccountTest < ActiveSupport::TestCase
     end
   end
 
+  test "same account_id can be linked under different mercury_items in the same family" do
+    item_a_2 = MercuryItem.create!(
+      family: @family_a,
+      name: "Family A Second Mercury",
+      token: "token_a_2",
+      base_url: "https://api-sandbox.mercury.com/api/v1",
+      status: "good"
+    )
+
+    MercuryAccount.create!(
+      mercury_item: @item_a,
+      account_id: "shared_merc_acc_1",
+      name: "Checking",
+      currency: "USD",
+      current_balance: 5000
+    )
+
+    assert_difference "MercuryAccount.count", 1 do
+      MercuryAccount.create!(
+        mercury_item: item_a_2,
+        account_id: "shared_merc_acc_1",
+        name: "Checking",
+        currency: "USD",
+        current_balance: 5000
+      )
+    end
+  end
+
   test "same account_id cannot appear twice under the same mercury_item" do
     MercuryAccount.create!(
       mercury_item: @item_a,
diff --git a/test/models/mercury_item_test.rb b/test/models/mercury_item_test.rb
index 365697ec4..91d67c26d 100644
--- a/test/models/mercury_item_test.rb
+++ b/test/models/mercury_item_test.rb
@@ -22,6 +22,11 @@ class MercuryItemTest < ActiveSupport::TestCase
     assert_not @mercury_item.credentials_configured?
   end
 
+  test "credentials_configured returns false when token is whitespace" do
+    @mercury_item.token = "   "
+    assert_not @mercury_item.credentials_configured?
+  end
+
   test "effective_base_url returns custom url when set" do
     assert_equal "https://api-sandbox.mercury.com/api/v1", @mercury_item.effective_base_url
   end
@@ -42,6 +47,42 @@ class MercuryItemTest < ActiveSupport::TestCase
     assert_nil @mercury_item.mercury_provider
   end
 
+  test "family credential check ignores blank and scheduled for deletion items" do
+    family = families(:empty)
+    blank_item = MercuryItem.create!(
+      family: family,
+      name: "Blank Mercury",
+      token: "temporary_token",
+      base_url: "https://api-sandbox.mercury.com/api/v1"
+    )
+    blank_item.update_column(:token, "")
+
+    whitespace_item = MercuryItem.create!(
+      family: family,
+      name: "Whitespace Mercury",
+      token: "temporary_token",
+      base_url: "https://api-sandbox.mercury.com/api/v1"
+    )
+    whitespace_item.update_column(:token, "   ")
+
+    deleted_item = MercuryItem.create!(
+      family: family,
+      name: "Deleted Mercury",
+      token: "deleted_token",
+      base_url: "https://api-sandbox.mercury.com/api/v1",
+      scheduled_for_deletion: true
+    )
+
+    refute family.has_mercury_credentials?
+
+    whitespace_item.update_column(:token, "configured_token")
+    assert family.has_mercury_credentials?
+
+    whitespace_item.update_column(:token, "   ")
+    deleted_item.update!(scheduled_for_deletion: false)
+    assert family.has_mercury_credentials?
+  end
+
   test "syncer returns MercuryItem::Syncer instance" do
     syncer = @mercury_item.send(:syncer)
     assert_instance_of MercuryItem::Syncer, syncer
diff --git a/test/models/mint_import_test.rb b/test/models/mint_import_test.rb
new file mode 100644
index 000000000..599e18b10
--- /dev/null
+++ b/test/models/mint_import_test.rb
@@ -0,0 +1,27 @@
+require "test_helper"
+
+class MintImportTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+  end
+
+  test "default column mappings are applied after create" do
+    import = @family.imports.create!(type: "MintImport")
+
+    MintImport.default_column_mappings.each do |attribute, value|
+      assert_equal value, import.public_send(attribute)
+    end
+  end
+
+  test "generated rows preserve stable source row numbers" do
+    import = @family.imports.create!(
+      type: "MintImport",
+      raw_file_str: file_fixture("imports/mint.csv").read,
+      col_sep: ","
+    )
+
+    import.generate_rows_from_csv
+
+    assert_equal (1..10).to_a, import.rows.order(:source_row_number).pluck(:source_row_number)
+  end
+end
diff --git a/test/models/oidc_identity_test.rb b/test/models/oidc_identity_test.rb
index 43342964b..52a807a8f 100644
--- a/test/models/oidc_identity_test.rb
+++ b/test/models/oidc_identity_test.rb
@@ -57,6 +57,41 @@ class OidcIdentityTest < ActiveSupport::TestCase
     end
   end
 
+  test "sync_user_attributes! preserves user-edited first and last name" do
+    # Regression for #1103: every SSO login used to overwrite user.first_name
+    # with the IdP value, clobbering edits the user made inside Sure.
+    @user.update!(first_name: "Adam", last_name: "Smith")
+    auth = OmniAuth::AuthHash.new(
+      provider: @oidc_identity.provider,
+      uid: @oidc_identity.uid,
+      info: { email: @user.email, first_name: "Ben", last_name: "Jones" }
+    )
+
+    @oidc_identity.sync_user_attributes!(auth)
+
+    @user.reload
+    assert_equal "Adam", @user.first_name
+    assert_equal "Smith", @user.last_name
+    # Identity record itself still mirrors the IdP for audit / debugging.
+    assert_equal "Ben",   @oidc_identity.info["first_name"]
+    assert_equal "Jones", @oidc_identity.info["last_name"]
+  end
+
+  test "sync_user_attributes! fills blank user names from the IdP" do
+    @user.update!(first_name: nil, last_name: nil)
+    auth = OmniAuth::AuthHash.new(
+      provider: @oidc_identity.provider,
+      uid: @oidc_identity.uid,
+      info: { email: @user.email, first_name: "Ben", last_name: "Jones" }
+    )
+
+    @oidc_identity.sync_user_attributes!(auth)
+
+    @user.reload
+    assert_equal "Ben", @user.first_name
+    assert_equal "Jones", @user.last_name
+  end
+
   test "creates from omniauth hash" do
     auth = OmniAuth::AuthHash.new({
       provider: "google_oauth2",
diff --git a/test/models/pdf_import_test.rb b/test/models/pdf_import_test.rb
index 37281b5cc..e6d89bfe2 100644
--- a/test/models/pdf_import_test.rb
+++ b/test/models/pdf_import_test.rb
@@ -41,6 +41,19 @@ class PdfImportTest < ActiveSupport::TestCase
     assert_not @processed_import.publishable?
   end
 
+  test "status detail cleaned check requires account and transaction statement" do
+    @import_with_rows.update!(account: accounts(:depository), document_type: "bank_statement")
+
+    assert @import_with_rows.cleaned_from_validation_stats?(invalid_rows_count: 0)
+    assert_not @import_with_rows.cleaned_from_validation_stats?(invalid_rows_count: 1)
+
+    @import_with_rows.update!(account: nil)
+    assert_not @import_with_rows.cleaned_from_validation_stats?(invalid_rows_count: 0)
+
+    @import_with_rows.update!(account: accounts(:depository), document_type: "other")
+    assert_not @import_with_rows.cleaned_from_validation_stats?(invalid_rows_count: 0)
+  end
+
   test "column_keys returns transaction columns" do
     assert_equal %i[date amount name category notes], @import.column_keys
   end
@@ -118,6 +131,7 @@ class PdfImportTest < ActiveSupport::TestCase
 
   test "mapping_steps includes CategoryMapping when rows have categories" do
     @import_with_rows.rows.create!(
+      source_row_number: 1,
       date: "01/15/2024",
       amount: -50.00,
       currency: "USD",
diff --git a/test/models/provider/binance_public_test.rb b/test/models/provider/binance_public_test.rb
new file mode 100644
index 000000000..bf0476043
--- /dev/null
+++ b/test/models/provider/binance_public_test.rb
@@ -0,0 +1,673 @@
+require "test_helper"
+
+class Provider::BinancePublicTest < ActiveSupport::TestCase
+  setup do
+    @provider = Provider::BinancePublic.new
+    @provider.stubs(:throttle_request)
+  end
+
+  # ================================
+  #       Search
+  # ================================
+
+  test "search_securities returns one result per supported quote" do
+    @provider.stubs(:exchange_info_symbols).returns(sample_exchange_info)
+
+    response = @provider.search_securities("BTC")
+
+    assert response.success?
+    tickers = response.data.map(&:symbol)
+    assert_includes tickers, "BTCUSD"
+    assert_includes tickers, "BTCEUR"
+    assert_includes tickers, "BTCJPY"
+    assert_includes tickers, "BTCBRL"
+    assert_includes tickers, "BTCTRY"
+    refute_includes tickers, "BTCGBP", "GBP has zero Binance pairs and should never surface"
+  end
+
+  test "search_securities maps USDT pair to USD currency" do
+    @provider.stubs(:exchange_info_symbols).returns(sample_exchange_info)
+
+    response = @provider.search_securities("BTC")
+    usd_row = response.data.find { |s| s.symbol == "BTCUSD" }
+
+    assert_equal "USD", usd_row.currency
+    assert_equal "BNCX", usd_row.exchange_operating_mic
+    assert_nil usd_row.country_code, "Crypto is jurisdictionless — country must be nil so non-AE families resolve"
+    assert_equal "BTC", usd_row.name
+  end
+
+  test "search_securities preserves native EUR pair currency" do
+    @provider.stubs(:exchange_info_symbols).returns(sample_exchange_info)
+
+    response = @provider.search_securities("BTC")
+    eur_row = response.data.find { |s| s.symbol == "BTCEUR" }
+
+    assert_equal "EUR", eur_row.currency
+    assert_equal "BNCX", eur_row.exchange_operating_mic
+  end
+
+  test "search_securities is case insensitive" do
+    @provider.stubs(:exchange_info_symbols).returns(sample_exchange_info)
+
+    upper = @provider.search_securities("ETH").data
+    lower = @provider.search_securities("eth").data
+
+    assert_equal upper.map(&:symbol).sort, lower.map(&:symbol).sort
+  end
+
+  test "search_securities skips unsupported quote assets like BNB" do
+    info = [
+      info_row("BTC", "USDT"),
+      info_row("BTC", "BNB"),
+      info_row("BTC", "BTC")
+    ]
+    @provider.stubs(:exchange_info_symbols).returns(info)
+
+    response = @provider.search_securities("BTC")
+    assert_equal [ "BTCUSD" ], response.data.map(&:symbol)
+  end
+
+  test "search_securities strips CRYPTO: prefix from holdings-processor symbols" do
+    @provider.stubs(:exchange_info_symbols).returns(sample_exchange_info)
+
+    response = @provider.search_securities("CRYPTO:BTC")
+
+    assert response.success?
+    assert_includes response.data.map(&:symbol), "BTCUSD"
+  end
+
+  test "search_securities returns a synthetic stablecoin result without hitting exchangeInfo" do
+    @provider.expects(:exchange_info_symbols).never
+
+    response = @provider.search_securities("CRYPTO:USDT")
+
+    assert response.success?
+    assert_equal 1, response.data.size
+    row = response.data.first
+    assert_equal "USDTUSD", row.symbol
+    assert_equal "USDT", row.name
+    assert_equal "USD", row.currency
+    assert_equal "BNCX", row.exchange_operating_mic
+    assert_nil row.country_code
+  end
+
+  test "parse_ticker treats stablecoin/USD search-result form as stablecoin" do
+    parsed = @provider.send(:parse_ticker, "USDTUSD")
+    assert parsed[:stablecoin]
+    assert_nil parsed[:binance_pair]
+    assert_equal "USDT", parsed[:base]
+    assert_equal "USD", parsed[:display_currency]
+  end
+
+  test "search_securities returns empty array when query does not match" do
+    @provider.stubs(:exchange_info_symbols).returns(sample_exchange_info)
+
+    response = @provider.search_securities("NONEXISTENTCOIN")
+    assert response.success?
+    assert_empty response.data
+  end
+
+  test "search_securities ranks exact matches first" do
+    info = [
+      info_row("BTCB", "USDT"),  # contains "BTC"
+      info_row("BTC",  "USDT"),  # exact match
+      info_row("WBTC", "USDT")   # contains "BTC"
+    ]
+    @provider.stubs(:exchange_info_symbols).returns(info)
+
+    tickers = @provider.search_securities("BTC").data.map(&:name)
+    assert_equal "BTC", tickers.first
+  end
+
+  test "search_securities matches when user types the full display ticker (BTCEUR)" do
+    @provider.stubs(:exchange_info_symbols).returns(sample_exchange_info)
+
+    response = @provider.search_securities("BTCEUR")
+
+    assert response.success?
+    tickers = response.data.map(&:symbol)
+    assert_includes tickers, "BTCEUR"
+    # Should NOT return every BTC pair — narrow query, narrow result set.
+    refute_includes tickers, "BTCJPY"
+    refute_includes tickers, "BTCBRL"
+    refute_includes tickers, "BTCTRY"
+  end
+
+  test "search_securities matches BTCUSD against the raw BTCUSDT pair" do
+    @provider.stubs(:exchange_info_symbols).returns(sample_exchange_info)
+
+    response = @provider.search_securities("BTCUSD")
+
+    assert response.success?
+    tickers = response.data.map(&:symbol)
+    # "BTCUSD" is a prefix of Binance's raw "BTCUSDT" — that single USDT-backed
+    # USD variant is what should come back (we store it as BTCUSD for the user).
+    assert_equal [ "BTCUSD" ], tickers
+  end
+
+  test "search_securities ranks exact symbol match above base prefix match" do
+    info = [
+      info_row("BTC", "USDT"),   # base="BTC", symbol="BTCUSDT"
+      info_row("BTC", "EUR"),    # base="BTC", symbol="BTCEUR"  <- exact symbol match
+      info_row("BTCB", "EUR")    # base="BTCB", symbol="BTCBEUR"
+    ]
+    @provider.stubs(:exchange_info_symbols).returns(info)
+
+    response = @provider.search_securities("BTCEUR")
+    assert_equal [ "BTCEUR" ], response.data.map(&:symbol)
+  end
+
+  test "search_securities ignores delisted pairs" do
+    info = [
+      info_row("BTC", "USDT", status: "TRADING"),
+      info_row("LUNA", "USDT", status: "BREAK")
+    ]
+    # exchange_info_symbols already filters by TRADING status, but double-check
+    # that delisted symbols don't leak through the path that fetches them.
+    @provider.stubs(:exchange_info_symbols).returns(info.select { |s| s["status"] == "TRADING" })
+
+    tickers = @provider.search_securities("LUNA").data.map(&:symbol)
+    assert_empty tickers
+  end
+
+  # ================================
+  #       Ticker parsing
+  # ================================
+
+  test "parse_ticker maps USD suffix to USDT pair" do
+    parsed = @provider.send(:parse_ticker, "BTCUSD")
+    assert_equal "BTCUSDT", parsed[:binance_pair]
+    assert_equal "BTC", parsed[:base]
+    assert_equal "USD", parsed[:display_currency]
+  end
+
+  test "parse_ticker keeps EUR suffix as-is" do
+    parsed = @provider.send(:parse_ticker, "ETHEUR")
+    assert_equal "ETHEUR", parsed[:binance_pair]
+    assert_equal "ETH", parsed[:base]
+    assert_equal "EUR", parsed[:display_currency]
+  end
+
+  test "parse_ticker returns nil for unsupported suffix" do
+    assert_nil @provider.send(:parse_ticker, "BTCBNB")
+    assert_nil @provider.send(:parse_ticker, "GIBBERISH")
+  end
+
+  test "parse_ticker strips CRYPTO: prefix from holdings processors" do
+    parsed = @provider.send(:parse_ticker, "CRYPTO:BTCUSD")
+    assert_equal "BTCUSDT", parsed[:binance_pair]
+    assert_equal "BTC", parsed[:base]
+    assert_equal "USD", parsed[:display_currency]
+  end
+
+  test "parse_ticker flags USD stablecoins for synthetic pricing" do
+    %w[USDT USDC BUSD DAI FDUSD TUSD USDP PYUSD].each do |stable|
+      parsed = @provider.send(:parse_ticker, "CRYPTO:#{stable}")
+      assert parsed[:stablecoin], "expected #{stable} to be flagged as stablecoin"
+      assert_nil parsed[:binance_pair]
+      assert_equal stable, parsed[:base]
+      assert_equal "USD", parsed[:display_currency]
+    end
+  end
+
+  test "parse_ticker defaults prefixed bare base assets to the USDT pair" do
+    parsed = @provider.send(:parse_ticker, "CRYPTO:SOL")
+    assert_equal "SOLUSDT", parsed[:binance_pair]
+    assert_equal "SOL", parsed[:base]
+    assert_equal "USD", parsed[:display_currency]
+  end
+
+  test "parse_ticker still rejects unprefixed malformed tickers" do
+    # No CRYPTO: prefix → behaves like a Binance-search ticker (must end in a
+    # supported fiat). Protects against false defaults like "BTCBNB" → "BTCBNBUSDT".
+    assert_nil @provider.send(:parse_ticker, "SOL")
+    assert_nil @provider.send(:parse_ticker, "BTCBNB")
+  end
+
+  test "fetch_security_prices returns synthetic 1.0 USD prices for stablecoins" do
+    # No HTTP call expected — short-circuited entirely.
+    @provider.expects(:client).never
+
+    response = @provider.fetch_security_prices(
+      symbol: "CRYPTO:USDT",
+      exchange_operating_mic: "BNCX",
+      start_date: Date.parse("2026-01-01"),
+      end_date: Date.parse("2026-01-03")
+    )
+
+    assert response.success?
+    assert_equal 3, response.data.size
+    assert response.data.all? { |p| p.price == 1.0 && p.currency == "USD" }
+    assert_equal Date.parse("2026-01-01"), response.data.first.date
+    assert_equal Date.parse("2026-01-03"), response.data.last.date
+  end
+
+  test "fetch_security_price returns 1.0 USD for a stablecoin single day" do
+    @provider.expects(:client).never
+
+    response = @provider.fetch_security_price(
+      symbol: "CRYPTO:USDT",
+      exchange_operating_mic: "BNCX",
+      date: Date.parse("2026-01-15")
+    )
+
+    assert response.success?
+    assert_equal 1.0, response.data.price
+    assert_equal "USD", response.data.currency
+  end
+
+  test "fetch_security_info handles stablecoin (no Binance pair link)" do
+    response = @provider.fetch_security_info(symbol: "CRYPTO:USDT", exchange_operating_mic: "BNCX")
+
+    assert response.success?
+    assert_equal "USDT", response.data.name
+    assert_equal "crypto", response.data.kind
+    assert_nil response.data.links
+  end
+
+  test "fetch_security_prices resolves a bare CRYPTO: ticker against the USDT pair" do
+    rows = [ kline_row("2026-01-15", "150.25") ]
+    mock_client_returning_klines(rows)
+
+    response = @provider.fetch_security_prices(
+      symbol: "CRYPTO:SOL",
+      exchange_operating_mic: "BNCX",
+      start_date: Date.parse("2026-01-15"),
+      end_date: Date.parse("2026-01-15")
+    )
+
+    assert response.success?
+    assert_equal 1, response.data.size
+    assert_equal "USD", response.data.first.currency
+    assert_in_delta 150.25, response.data.first.price
+  end
+
+  # ================================
+  #       Single price
+  # ================================
+
+  test "fetch_security_price returns Price for a single day" do
+    mock_client_returning_klines([
+      kline_row("2026-01-15", "42000.50")
+    ])
+
+    response = @provider.fetch_security_price(
+      symbol: "BTCUSD",
+      exchange_operating_mic: "BNCX",
+      date: Date.parse("2026-01-15")
+    )
+
+    assert response.success?
+    assert_equal Date.parse("2026-01-15"), response.data.date
+    assert_in_delta 42000.50, response.data.price
+    assert_equal "USD", response.data.currency
+    assert_equal "BNCX", response.data.exchange_operating_mic
+  end
+
+  test "fetch_security_price raises InvalidSecurityPriceError for empty response" do
+    mock_client_returning_klines([])
+
+    response = @provider.fetch_security_price(
+      symbol: "BTCUSD",
+      exchange_operating_mic: "BNCX",
+      date: Date.parse("2026-01-15")
+    )
+
+    assert_not response.success?
+    assert_instance_of Provider::BinancePublic::InvalidSecurityPriceError, response.error
+  end
+
+  test "fetch_security_price fails for unsupported ticker" do
+    response = @provider.fetch_security_price(
+      symbol: "NOPE",
+      exchange_operating_mic: "BNCX",
+      date: Date.current
+    )
+
+    assert_not response.success?
+    assert_instance_of Provider::BinancePublic::InvalidSecurityPriceError, response.error
+  end
+
+  # ================================
+  #       Historical prices
+  # ================================
+
+  test "fetch_security_prices returns rows across a small range" do
+    rows = (0..4).map { |i| kline_row(Date.parse("2026-01-01") + i.days, (40000 + i).to_s) }
+    mock_client_returning_klines(rows)
+
+    response = @provider.fetch_security_prices(
+      symbol: "BTCUSD",
+      exchange_operating_mic: "BNCX",
+      start_date: Date.parse("2026-01-01"),
+      end_date: Date.parse("2026-01-05")
+    )
+
+    assert response.success?
+    assert_equal 5, response.data.size
+    assert_equal Date.parse("2026-01-01"), response.data.first.date
+    assert_equal Date.parse("2026-01-05"), response.data.last.date
+    assert response.data.all? { |p| p.currency == "USD" }
+  end
+
+  test "fetch_security_prices filters out zero-close rows" do
+    rows = [
+      kline_row("2026-01-01", "40000"),
+      kline_row("2026-01-02", "0"),
+      kline_row("2026-01-03", "41000")
+    ]
+    mock_client_returning_klines(rows)
+
+    response = @provider.fetch_security_prices(
+      symbol: "BTCUSD",
+      exchange_operating_mic: "BNCX",
+      start_date: Date.parse("2026-01-01"),
+      end_date: Date.parse("2026-01-03")
+    )
+
+    assert_equal 2, response.data.size
+  end
+
+  test "fetch_security_prices paginates when range exceeds KLINE_MAX_LIMIT" do
+    first_batch  = Array.new(1000) { |i| kline_row(Date.parse("2022-01-01") + i.days, "40000") }
+    second_batch = Array.new(200)  { |i| kline_row(Date.parse("2024-09-27") + i.days, "42000") }
+
+    mock_response_1 = mock
+    mock_response_1.stubs(:body).returns(first_batch.to_json)
+    mock_response_2 = mock
+    mock_response_2.stubs(:body).returns(second_batch.to_json)
+
+    mock_client = mock
+    mock_client.expects(:get).twice.returns(mock_response_1).then.returns(mock_response_2)
+    @provider.stubs(:client).returns(mock_client)
+
+    response = @provider.fetch_security_prices(
+      symbol: "BTCUSD",
+      exchange_operating_mic: "BNCX",
+      start_date: Date.parse("2022-01-01"),
+      end_date: Date.parse("2025-04-14")
+    )
+
+    assert response.success?
+    assert_equal 1200, response.data.size
+  end
+
+  test "fetch_security_prices does NOT terminate on a short (straddle) batch" do
+    # Regression: a window that straddles the pair's listing date returns
+    # fewer than KLINE_MAX_LIMIT rows but more valid data exists in subsequent
+    # windows. The old `break if batch.size < KLINE_MAX_LIMIT` dropped that
+    # tail. Mock: first call = 638 rows (straddle), second call = 800 rows
+    # (mid-history), third call = 300 rows (final tail).
+    first_batch  = Array.new(638) { |i| kline_row(Date.parse("2020-01-03") + i.days, "7000") }
+    second_batch = Array.new(800) { |i| kline_row(Date.parse("2021-10-02") + i.days, "40000") }
+    third_batch  = Array.new(300) { |i| kline_row(Date.parse("2024-06-28") + i.days, "62000") }
+
+    mock_response_1 = mock
+    mock_response_1.stubs(:body).returns(first_batch.to_json)
+    mock_response_2 = mock
+    mock_response_2.stubs(:body).returns(second_batch.to_json)
+    mock_response_3 = mock
+    mock_response_3.stubs(:body).returns(third_batch.to_json)
+
+    mock_client = mock
+    mock_client.expects(:get).times(3)
+      .returns(mock_response_1).then
+      .returns(mock_response_2).then
+      .returns(mock_response_3)
+    @provider.stubs(:client).returns(mock_client)
+
+    response = @provider.fetch_security_prices(
+      symbol: "BTCUSD",
+      exchange_operating_mic: "BNCX",
+      start_date: Date.parse("2019-01-05"),
+      end_date: Date.parse("2026-04-10")
+    )
+
+    assert response.success?
+    assert_equal 1738, response.data.size
+  end
+
+  test "fetch_security_prices skips pre-listing empty windows and collects later data" do
+    # Regression for the BTCEUR bug: asking for a range starting before the
+    # pair's listing date used to return zero prices because the first empty
+    # window tripped `break if batch.blank?`.
+    empty_batch = []
+    real_batch  = (0..4).map { |i| kline_row(Date.parse("2020-01-03") + i.days, "6568") }
+
+    mock_response_empty = mock
+    mock_response_empty.stubs(:body).returns(empty_batch.to_json)
+    mock_response_real = mock
+    mock_response_real.stubs(:body).returns(real_batch.to_json)
+
+    mock_client = mock
+    mock_client.expects(:get).twice
+      .returns(mock_response_empty).then
+      .returns(mock_response_real)
+    @provider.stubs(:client).returns(mock_client)
+
+    response = @provider.fetch_security_prices(
+      symbol: "BTCEUR",
+      exchange_operating_mic: "BNCX",
+      start_date: Date.parse("2017-01-01"),
+      end_date: Date.parse("2020-01-07")
+    )
+
+    assert response.success?
+    assert_equal 5, response.data.size
+    assert_equal Date.parse("2020-01-03"), response.data.first.date
+    assert response.data.all? { |p| p.currency == "EUR" }
+  end
+
+  test "fetch_security_prices terminates on empty window once data has been seen" do
+    # Post-delisting / end-of-history scenario: first window returns data,
+    # second window returns empty → stop to avoid wasting calls.
+    first_batch = (0..2).map { |i| kline_row(Date.parse("2017-08-17") + i.days, "4500") }
+    empty_batch = []
+
+    mock_response_1 = mock
+    mock_response_1.stubs(:body).returns(first_batch.to_json)
+    mock_response_2 = mock
+    mock_response_2.stubs(:body).returns(empty_batch.to_json)
+
+    mock_client = mock
+    mock_client.expects(:get).twice
+      .returns(mock_response_1).then
+      .returns(mock_response_2)
+    @provider.stubs(:client).returns(mock_client)
+
+    response = @provider.fetch_security_prices(
+      symbol: "BTCUSD",
+      exchange_operating_mic: "BNCX",
+      start_date: Date.parse("2017-08-17"),
+      end_date: Date.parse("2024-09-24")
+    )
+
+    assert response.success?
+    assert_equal 3, response.data.size
+  end
+
+  test "fetch_security_prices uses native quote currency for EUR pair" do
+    rows = [ kline_row("2026-01-15", "38000.12") ]
+    mock_client_returning_klines(rows)
+
+    response = @provider.fetch_security_prices(
+      symbol: "BTCEUR",
+      exchange_operating_mic: "BNCX",
+      start_date: Date.parse("2026-01-15"),
+      end_date: Date.parse("2026-01-15")
+    )
+
+    assert_equal "EUR", response.data.first.currency
+  end
+
+  test "fetch_security_prices returns empty array for unsupported ticker wrapped as error" do
+    response = @provider.fetch_security_prices(
+      symbol: "NOPE",
+      exchange_operating_mic: "BNCX",
+      start_date: Date.current - 5,
+      end_date: Date.current
+    )
+
+    assert_not response.success?
+    assert_instance_of Provider::BinancePublic::InvalidSecurityPriceError, response.error
+  end
+
+  # ================================
+  #       Info
+  # ================================
+
+  test "fetch_security_info returns crypto kind and nil logo_url" do
+    response = @provider.fetch_security_info(symbol: "BTCUSD", exchange_operating_mic: "BNCX")
+
+    assert response.success?
+    assert_equal "BTC", response.data.name
+    assert_equal "crypto", response.data.kind
+    assert_match(/binance\.com/, response.data.links)
+    # logo_url is always nil — crypto logos are resolved at render time via
+    # Security#display_logo_url using the Brandfetch probe verdict, so the
+    # provider has nothing sensible to persist here.
+    assert_nil response.data.logo_url
+  end
+
+  # ================================
+  #       Quote currency coverage
+  # ================================
+
+  test "parse_ticker rejects GBP (unsupported)" do
+    assert_nil @provider.send(:parse_ticker, "BTCGBP")
+  end
+
+  test "parse_ticker maps JPY pair" do
+    parsed = @provider.send(:parse_ticker, "BTCJPY")
+    assert_equal "BTCJPY", parsed[:binance_pair]
+    assert_equal "BTC", parsed[:base]
+    assert_equal "JPY", parsed[:display_currency]
+  end
+
+  test "parse_ticker maps BRL pair" do
+    parsed = @provider.send(:parse_ticker, "ETHBRL")
+    assert_equal "ETHBRL", parsed[:binance_pair]
+    assert_equal "ETH", parsed[:base]
+    assert_equal "BRL", parsed[:display_currency]
+  end
+
+  test "fetch_security_prices returns JPY currency for a BTCJPY range" do
+    rows = [ kline_row("2026-01-15", "10800000") ]
+    mock_client_returning_klines(rows)
+
+    response = @provider.fetch_security_prices(
+      symbol: "BTCJPY",
+      exchange_operating_mic: "BNCX",
+      start_date: Date.parse("2026-01-15"),
+      end_date: Date.parse("2026-01-15")
+    )
+
+    assert_equal "JPY", response.data.first.currency
+    assert_in_delta 10_800_000.0, response.data.first.price
+  end
+
+  test "fetch_security_prices returns BRL currency for a BTCBRL range" do
+    rows = [ kline_row("2026-01-15", "350000") ]
+    mock_client_returning_klines(rows)
+
+    response = @provider.fetch_security_prices(
+      symbol: "BTCBRL",
+      exchange_operating_mic: "BNCX",
+      start_date: Date.parse("2026-01-15"),
+      end_date: Date.parse("2026-01-15")
+    )
+
+    assert_equal "BRL", response.data.first.currency
+  end
+
+  # ================================
+  #       Logo URL plumbing
+  # ================================
+
+  test "search_securities populates each result with the Brandfetch crypto URL" do
+    @provider.stubs(:exchange_info_symbols).returns(sample_exchange_info)
+    Setting.stubs(:brand_fetch_client_id).returns("test-client-id")
+    Setting.stubs(:brand_fetch_logo_size).returns(120)
+
+    response = @provider.search_securities("BTC")
+
+    expected = "https://cdn.brandfetch.io/crypto/BTC/icon/fallback/lettermark/w/120/h/120?c=test-client-id"
+    assert response.data.all? { |s| s.logo_url == expected }
+  end
+
+  test "search_securities leaves logo_url nil when Brandfetch is not configured" do
+    @provider.stubs(:exchange_info_symbols).returns(sample_exchange_info)
+    Setting.stubs(:brand_fetch_client_id).returns(nil)
+
+    response = @provider.search_securities("BTC")
+
+    assert response.data.all? { |s| s.logo_url.nil? }
+  end
+
+  # ================================
+  #       Helpers
+  # ================================
+
+  private
+
+    def sample_exchange_info
+      [
+        info_row("BTC", "USDT"),
+        info_row("BTC", "EUR"),
+        info_row("BTC", "JPY"),
+        info_row("BTC", "BRL"),
+        info_row("BTC", "TRY"),
+        info_row("ETH", "USDT"),
+        info_row("ETH", "EUR"),
+        info_row("ETH", "JPY"),
+        info_row("SOL", "USDT"),
+        info_row("BNB", "USDT")
+      ]
+    end
+
+    def info_row(base, quote, status: "TRADING")
+      {
+        "symbol"     => "#{base}#{quote}",
+        "baseAsset"  => base,
+        "quoteAsset" => quote,
+        "status"     => status
+      }
+    end
+
+    # Mimics Binance /api/v3/klines row format.
+    # Index 0 = open time (ms), index 4 = close price (string)
+    def kline_row(date, close)
+      date = Date.parse(date) if date.is_a?(String)
+      open_time_ms = Time.utc(date.year, date.month, date.day).to_i * 1000
+      [
+        open_time_ms,      # 0: Open time
+        "0",               # 1: Open
+        "0",               # 2: High
+        "0",               # 3: Low
+        close.to_s,        # 4: Close
+        "0",               # 5: Volume
+        open_time_ms + (24 * 60 * 60 * 1000 - 1),  # 6: Close time
+        "0", 0, "0", "0", "0"
+      ]
+    end
+
+    def mock_client_returning_klines(rows)
+      mock_response = mock
+      mock_response.stubs(:body).returns(rows.to_json)
+      mock_client = mock
+      mock_client.stubs(:get).returns(mock_response)
+      @provider.stubs(:client).returns(mock_client)
+    end
+
+    # Rails.cache in the test env is a NullStore by default, so Rails.cache.fetch
+    # re-runs the block every time. Swap in a real MemoryStore so cache-hit
+    # assertions are meaningful, then restore the original.
+    def with_memory_cache
+      original = Rails.cache
+      Rails.cache = ActiveSupport::Cache::MemoryStore.new
+      yield
+    ensure
+      Rails.cache = original
+    end
+end
diff --git a/test/models/provider/brex_adapter_test.rb b/test/models/provider/brex_adapter_test.rb
new file mode 100644
index 000000000..10fd26aad
--- /dev/null
+++ b/test/models/provider/brex_adapter_test.rb
@@ -0,0 +1,224 @@
+require "uri"
+
+require "test_helper"
+
+class Provider::BrexAdapterTest < ActiveSupport::TestCase
+  test "supports Depository accounts" do
+    assert_includes Provider::BrexAdapter.supported_account_types, "Depository"
+  end
+
+  test "supports CreditCard accounts" do
+    assert_includes Provider::BrexAdapter.supported_account_types, "CreditCard"
+  end
+
+  test "does not support Investment accounts" do
+    assert_not_includes Provider::BrexAdapter.supported_account_types, "Investment"
+  end
+
+  test "returns fallback connection config when no credentials exist yet" do
+    # Brex is a per-family provider - any family can connect
+    family = families(:empty)
+    configs = Provider::BrexAdapter.connection_configs(family: family)
+
+    assert_equal 1, configs.length
+    assert_equal "brex", configs.first[:key]
+    assert_equal I18n.t("brex_items.provider_connection.default_name"), configs.first[:name]
+    assert configs.first[:can_connect]
+  end
+
+  test "returns one connection config per credentialed brex item" do
+    family = families(:dylan_family)
+    first_item = brex_items(:one)
+    second_item = BrexItem.create!(
+      family: family,
+      name: "Business Brex",
+      token: "second_brex_token",
+      base_url: "https://api.brex.com"
+    )
+
+    configs = Provider::BrexAdapter.connection_configs(family: family)
+
+    assert_equal 2, configs.length
+    assert_equal [ "brex_#{second_item.id}", "brex_#{first_item.id}" ], configs.map { |config| config[:key] }
+    assert_equal [
+      I18n.t("brex_items.provider_connection.name", name: second_item.name),
+      I18n.t("brex_items.provider_connection.name", name: first_item.name)
+    ], configs.map { |config| config[:name] }
+
+    new_account_uri = URI.parse(configs.first[:new_account_path].call("Depository", "/accounts"))
+    assert_equal "/brex_items/select_accounts", new_account_uri.path
+    assert_includes new_account_uri.query, "brex_item_id=#{second_item.id}"
+
+    existing_account_uri = URI.parse(configs.first[:existing_account_path].call(accounts(:depository).id))
+    assert_equal "/brex_items/select_existing_account", existing_account_uri.path
+    assert_includes existing_account_uri.query, "brex_item_id=#{second_item.id}"
+  end
+
+  test "connection configs ignore items with whitespace-only tokens" do
+    family = families(:dylan_family)
+    BrexItem.create!(
+      family: family,
+      name: "Blank Brex",
+      token: "temporary_token",
+      base_url: "https://api.brex.com"
+    ).update_column(:token, "   ")
+
+    configs = Provider::BrexAdapter.connection_configs(family: family)
+
+    assert_equal [ "brex_#{brex_items(:one).id}" ], configs.map { |config| config[:key] }
+  end
+
+  test "build_provider returns nil when family is nil" do
+    assert_nil Provider::BrexAdapter.build_provider(family: nil)
+  end
+
+  test "build_provider returns nil when family has no brex items" do
+    family = families(:empty)
+    assert_nil Provider::BrexAdapter.build_provider(family: family)
+  end
+
+  test "build_provider returns Brex provider when credentials configured" do
+    family = families(:dylan_family)
+    provider = Provider::BrexAdapter.build_provider(family: family)
+
+    assert_instance_of Provider::Brex, provider
+  end
+
+  test "build_provider uses explicit brex item credentials" do
+    family = families(:dylan_family)
+    second_item = BrexItem.create!(
+      family: family,
+      name: "Business Brex",
+      token: "second_brex_token",
+      base_url: "https://api.brex.com"
+    )
+
+    provider = Provider::BrexAdapter.build_provider(family: family, brex_item_id: second_item.id)
+
+    assert_instance_of Provider::Brex, provider
+    assert_equal "second_brex_token", provider.token
+    assert_equal "https://api.brex.com", provider.base_url
+  end
+
+  test "build_provider does not pick the first connection when multiple credentials exist" do
+    family = families(:dylan_family)
+    BrexItem.create!(
+      family: family,
+      name: "Business Brex",
+      token: "second_brex_token",
+      base_url: "https://api.brex.com"
+    )
+
+    assert_nil Provider::BrexAdapter.build_provider(family: family)
+  end
+
+  test "build_provider strips surrounding token whitespace" do
+    family = families(:dylan_family)
+    second_item = BrexItem.create!(
+      family: family,
+      name: "Business Brex",
+      token: " second_brex_token \n",
+      base_url: "https://api.brex.com"
+    )
+
+    provider = Provider::BrexAdapter.build_provider(family: family, brex_item_id: second_item.id)
+
+    assert_equal "second_brex_token", provider.token
+  end
+
+  test "build_provider refuses brex items outside the family" do
+    family = families(:dylan_family)
+    other_item = BrexItem.create!(
+      family: families(:empty),
+      name: "Other Brex",
+      token: "other_brex_token",
+      base_url: "https://api.brex.com"
+    )
+
+    assert_nil Provider::BrexAdapter.build_provider(family: family, brex_item_id: other_item.id)
+  end
+
+  test "build_provider refuses explicit brex item without usable credentials" do
+    family = families(:dylan_family)
+    blank_item = BrexItem.create!(
+      family: family,
+      name: "Blank Brex",
+      token: "temporary_token",
+      base_url: "https://api.brex.com"
+    )
+    blank_item.update_column(:token, "   ")
+
+    assert_nil Provider::BrexAdapter.build_provider(family: family, brex_item_id: blank_item.id)
+  end
+
+  test "build_provider refuses explicit brex item with invalid persisted base_url" do
+    family = families(:dylan_family)
+    item = BrexItem.create!(
+      family: family,
+      name: "Invalid URL Brex",
+      token: "token",
+      base_url: "https://api.brex.com"
+    )
+    item.update_column(:base_url, "https://evil.example.test")
+
+    assert_nil Provider::BrexAdapter.build_provider(family: family, brex_item_id: item.id)
+  end
+
+  test "reads institution metadata from brex account column" do
+    brex_account = brex_items(:one).brex_accounts.create!(
+      account_id: "metadata_cash",
+      account_kind: "cash",
+      name: "Metadata Cash",
+      currency: "USD",
+      institution_metadata: {
+        "name" => "Brex",
+        "domain" => "brex.com",
+        "url" => "https://brex.com"
+      }
+    )
+
+    adapter = Provider::BrexAdapter.new(brex_account)
+
+    assert_equal "brex.com", brex_account.institution_metadata["domain"]
+    assert_equal "brex.com", adapter.institution_domain
+    assert_equal "Brex", adapter.institution_name
+    assert_equal "https://brex.com", adapter.institution_url
+  end
+
+  test "falls back to brex item institution metadata" do
+    brex_item = brex_items(:one)
+    brex_item.update!(
+      institution_name: "Brex Item Name",
+      institution_url: "https://brex.com/item",
+      institution_color: "#123456"
+    )
+    brex_account = brex_item.brex_accounts.create!(
+      account_id: "metadata_fallback_cash",
+      account_kind: "cash",
+      name: "Metadata Fallback Cash",
+      currency: "USD"
+    )
+
+    adapter = Provider::BrexAdapter.new(brex_account)
+
+    assert_equal "Brex Item Name", adapter.institution_name
+    assert_equal "https://brex.com/item", adapter.institution_url
+    assert_equal "#123456", adapter.institution_color
+  end
+
+  test "logs institution urls without hosts" do
+    brex_account = brex_items(:one).brex_accounts.create!(
+      account_id: "metadata_bad_url_cash",
+      account_kind: "cash",
+      name: "Metadata Bad URL Cash",
+      currency: "USD",
+      institution_metadata: {
+        "url" => "not-a-url"
+      }
+    )
+
+    Rails.logger.expects(:warn).with(regexp_matches(/institution URL has no host/))
+
+    assert_nil Provider::BrexAdapter.new(brex_account).institution_domain
+  end
+end
diff --git a/test/models/provider/brex_test.rb b/test/models/provider/brex_test.rb
new file mode 100644
index 000000000..f84185bff
--- /dev/null
+++ b/test/models/provider/brex_test.rb
@@ -0,0 +1,289 @@
+require "test_helper"
+
+class Provider::BrexTest < ActiveSupport::TestCase
+  def setup
+    @provider = Provider::Brex.new("test_token", base_url: "https://api-staging.brex.com")
+  end
+
+  test "initializes with token and default base_url" do
+    provider = Provider::Brex.new("my_token")
+    assert_equal "my_token", provider.token
+    assert_equal "https://api.brex.com", provider.base_url
+  end
+
+  test "initializes with custom base_url" do
+    assert_equal "test_token", @provider.token
+    assert_equal "https://api-staging.brex.com", @provider.base_url
+  end
+
+  test "initializes with stripped token and removes trailing base url slash" do
+    provider = Provider::Brex.new(" test_token \n", base_url: "https://api.brex.com/")
+
+    assert_equal "test_token", provider.token
+    assert_equal "https://api.brex.com", provider.base_url
+  end
+
+  test "initializes with official staging base url" do
+    provider = Provider::Brex.new("test_token", base_url: "https://api-staging.brex.com/")
+
+    assert_equal "https://api-staging.brex.com", provider.base_url
+  end
+
+  test "rejects arbitrary base urls" do
+    [
+      "http://api.brex.com",
+      "https://evil.example.test",
+      "https://localhost",
+      "https://127.0.0.1",
+      "https://10.0.0.1",
+      "https://api.brex.com.evil.example",
+      "https://api.brex.com@127.0.0.1",
+      "https://api.brex.com:444",
+      "https://api.brex.com/v1",
+      "https://api.brex.com?host=evil.example.test",
+      "//api.brex.com"
+    ].each do |base_url|
+      assert_raises ArgumentError do
+        Provider::Brex.new("test_token", base_url: base_url)
+      end
+    end
+  end
+
+  test "BrexError includes error_type" do
+    error = Provider::Brex::BrexError.new("Test error", :unauthorized)
+    assert_equal "Test error", error.message
+    assert_equal :unauthorized, error.error_type
+  end
+
+  test "BrexError defaults error_type to unknown" do
+    error = Provider::Brex::BrexError.new("Test error")
+    assert_equal :unknown, error.error_type
+  end
+
+  test "fetches cash accounts from the v2 endpoint with bearer auth" do
+    response = OpenStruct.new(
+      code: 200,
+      body: { items: [ { id: "cash_1", name: "Operating" } ] }.to_json,
+      headers: {}
+    )
+
+    Provider::Brex.expects(:get)
+      .with(
+        "https://api.brex.com/v2/accounts/cash?limit=1000",
+        headers: {
+          "Authorization" => "Bearer test_token",
+          "Content-Type" => "application/json",
+          "Accept" => "application/json"
+        }
+      )
+      .returns(response)
+
+    accounts = Provider::Brex.new(" test_token ").get_cash_accounts
+
+    assert_equal 1, accounts.length
+    assert_equal "cash_1", accounts.first[:id]
+    assert_equal "cash", accounts.first[:account_kind]
+  end
+
+  test "fetches card accounts from the paginated v2 endpoint" do
+    response = OpenStruct.new(
+      code: 200,
+      body: [ { id: "card_account_1", status: "ACTIVE" } ].to_json,
+      headers: {}
+    )
+
+    Provider::Brex.expects(:get)
+      .with(
+        "https://api.brex.com/v2/accounts/card?limit=1000",
+        headers: {
+          "Authorization" => "Bearer test_token",
+          "Content-Type" => "application/json",
+          "Accept" => "application/json"
+        }
+      )
+      .returns(response)
+
+    accounts = Provider::Brex.new("test_token").get_card_accounts
+
+    assert_equal 1, accounts.length
+    assert_equal "card_account_1", accounts.first[:id]
+    assert_equal "card", accounts.first[:account_kind]
+  end
+
+  test "aggregates card accounts into one provider account" do
+    cash_response = OpenStruct.new(
+      code: 200,
+      body: { items: [] }.to_json,
+      headers: {}
+    )
+    card_response = OpenStruct.new(
+      code: 200,
+      body: {
+        items: [
+          {
+            id: "card_account_1",
+            status: "ACTIVE",
+            current_balance: { amount: 12_345, currency: "USD" },
+            available_balance: { amount: 100_000, currency: "USD" },
+            account_limit: { amount: 250_000, currency: "USD" }
+          }
+        ]
+      }.to_json,
+      headers: {}
+    )
+
+    Provider::Brex.stubs(:get).returns(cash_response, card_response)
+
+    accounts_data = Provider::Brex.new("test_token").get_accounts
+
+    assert_equal [ "card_primary" ], accounts_data[:accounts].map { |account| account[:id] }
+    assert_equal "card", accounts_data[:accounts].first[:account_kind]
+    assert_equal 1, accounts_data[:accounts].first[:card_accounts_count]
+  end
+
+  test "does not aggregate mixed currency card balances" do
+    cash_response = OpenStruct.new(
+      code: 200,
+      body: { items: [] }.to_json,
+      headers: {}
+    )
+    card_response = OpenStruct.new(
+      code: 200,
+      body: [
+        {
+          id: "card_account_1",
+          current_balance: { amount: 12_345, currency: "USD" }
+        },
+        {
+          id: "card_account_2",
+          current_balance: { amount: 6_789, currency: "EUR" }
+        }
+      ].to_json,
+      headers: {}
+    )
+
+    Provider::Brex.stubs(:get).returns(cash_response, card_response)
+
+    accounts_data = Provider::Brex.new("test_token").get_accounts
+
+    assert_nil accounts_data[:accounts].first[:current_balance]
+  end
+
+  test "guards repeated pagination cursors" do
+    first_response = OpenStruct.new(
+      code: 200,
+      body: { items: [ { id: "tx_1" } ], next_cursor: "cursor_1" }.to_json,
+      headers: {}
+    )
+    second_response = OpenStruct.new(
+      code: 200,
+      body: { items: [ { id: "tx_2" } ], next_cursor: "cursor_1" }.to_json,
+      headers: {}
+    )
+
+    Provider::Brex.stubs(:get).returns(first_response, second_response)
+
+    error = assert_raises Provider::Brex::BrexError do
+      Provider::Brex.new("test_token").get_primary_card_transactions
+    end
+
+    assert_equal :pagination_error, error.error_type
+  end
+
+  test "guards pagination page cap" do
+    responses = (1..26).map do |page|
+      OpenStruct.new(
+        code: 200,
+        body: { items: [ { id: "tx_#{page}" } ], next_cursor: "cursor_#{page}" }.to_json,
+        headers: {}
+      )
+    end
+
+    Provider::Brex.stubs(:get).returns(*responses)
+
+    error = assert_raises Provider::Brex::BrexError do
+      Provider::Brex.new("test_token").get_primary_card_transactions
+    end
+
+    assert_equal :pagination_error, error.error_type
+    assert_includes error.message, "exceeded 25 pages"
+  end
+
+  test "sends posted_at_start as RFC3339 date time" do
+    response = OpenStruct.new(
+      code: 200,
+      body: { items: [] }.to_json,
+      headers: {}
+    )
+
+    Provider::Brex.expects(:get)
+      .with(
+        "https://api.brex.com/v2/transactions/card/primary?posted_at_start=2026-01-02T00%3A00%3A00Z&limit=1000",
+        headers: {
+          "Authorization" => "Bearer test_token",
+          "Content-Type" => "application/json",
+          "Accept" => "application/json"
+        }
+      )
+      .returns(response)
+
+    Provider::Brex.new("test_token").get_primary_card_transactions(start_date: Date.new(2026, 1, 2))
+  end
+
+  test "raises clear error for invalid start date" do
+    error = assert_raises ArgumentError do
+      Provider::Brex.new("test_token").get_primary_card_transactions(start_date: "not-a-date")
+    end
+
+    assert_includes error.message, "Invalid start_date"
+  end
+
+  test "maps rate limits and exposes trace id without leaking body" do
+    response = OpenStruct.new(
+      code: 429,
+      body: { message: "secret raw provider body" }.to_json,
+      headers: { "x-brex-trace-id" => "trace_123" }
+    )
+
+    Provider::Brex.stubs(:get).returns(response)
+
+    error = assert_raises Provider::Brex::BrexError do
+      Provider::Brex.new("test_token").get_cash_accounts
+    end
+
+    assert_equal :rate_limited, error.error_type
+    assert_equal 429, error.http_status
+    assert_equal "trace_123", error.trace_id
+    refute_includes error.message, "secret raw provider body"
+  end
+
+  test "maps non-success responses without exposing provider body" do
+    expectations = {
+      400 => [ :bad_request, "Bad request to Brex API" ],
+      401 => [ :unauthorized, "Invalid Brex API token or account permissions" ],
+      403 => [ :access_forbidden, "Access forbidden - check Brex API token scopes" ],
+      404 => [ :not_found, "Brex resource not found" ],
+      500 => [ :fetch_failed, "Failed to fetch data from Brex API: HTTP 500" ]
+    }
+
+    expectations.each do |status, (error_type, message)|
+      response = OpenStruct.new(
+        code: status,
+        body: { message: "secret provider body #{status}" }.to_json,
+        headers: { "X-Brex-Trace-Id" => "trace_#{status}" }
+      )
+
+      Provider::Brex.stubs(:get).returns(response)
+
+      error = assert_raises Provider::Brex::BrexError do
+        Provider::Brex.new("test_token").get_cash_accounts
+      end
+
+      assert_equal error_type, error.error_type
+      assert_equal status, error.http_status
+      assert_equal "trace_#{status}", error.trace_id
+      assert_equal message, error.message
+      refute_includes error.message, "secret provider body"
+    end
+  end
+end
diff --git a/test/models/provider/enable_banking_test.rb b/test/models/provider/enable_banking_test.rb
new file mode 100644
index 000000000..e09c90c7e
--- /dev/null
+++ b/test/models/provider/enable_banking_test.rb
@@ -0,0 +1,64 @@
+require "test_helper"
+require "ostruct"
+require "openssl"
+
+class Provider::EnableBankingTest < ActiveSupport::TestCase
+  setup do
+    key = OpenSSL::PKey::RSA.new(2048)
+    @provider = Provider::EnableBanking.new(application_id: "test_app_id", client_certificate: key.to_pem)
+  end
+
+  test "get_account_transactions retries with corrected date_from from WRONG_TRANSACTIONS_PERIOD" do
+    requested_queries = []
+
+    validation_response = OpenStruct.new(
+      code: 422,
+      body: {
+        error: "WRONG_TRANSACTIONS_PERIOD",
+        detail: {
+          message: "Maximum days in the past allowed for transaction list is 120",
+          date_from: "2026-01-17"
+        }
+      }.to_json
+    )
+
+    success_response = OpenStruct.new(
+      code: 200,
+      body: { transactions: [] }.to_json
+    )
+
+    Provider::EnableBanking.expects(:get).twice.with do |_url, options|
+      requested_queries << options[:query].dup
+      true
+    end.returns(validation_response, success_response)
+
+    result = @provider.get_account_transactions(
+      account_id: "acct_123",
+      date_from: Date.new(2025, 12, 1),
+      transaction_status: "BOOK"
+    )
+
+    assert_equal [], result[:transactions]
+    assert_equal "2025-12-01", requested_queries.first[:date_from]
+    assert_equal "2026-01-17", requested_queries.second[:date_from]
+  end
+
+  test "validation errors expose parsed response data" do
+    response = OpenStruct.new(
+      code: 422,
+      body: {
+        error: "WRONG_TRANSACTIONS_PERIOD",
+        detail: { date_from: "2026-01-17" }
+      }.to_json
+    )
+
+    error = assert_raises Provider::EnableBanking::EnableBankingError do
+      @provider.send(:handle_response, response)
+    end
+
+    assert_equal :validation_error, error.error_type
+    assert_equal "WRONG_TRANSACTIONS_PERIOD", error.response_data[:error]
+    assert_equal Date.new(2026, 1, 17), error.corrected_date_from
+    assert error.wrong_transactions_period?
+  end
+end
diff --git a/test/models/provider/kraken_adapter_test.rb b/test/models/provider/kraken_adapter_test.rb
new file mode 100644
index 000000000..a9ce06a08
--- /dev/null
+++ b/test/models/provider/kraken_adapter_test.rb
@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+require "test_helper"
+require "uri"
+
+class Provider::KrakenAdapterTest < ActiveSupport::TestCase
+  setup do
+    kraken_items(:requires_update).update!(scheduled_for_deletion: true)
+  end
+
+  test "supports Crypto accounts only" do
+    assert_includes Provider::KrakenAdapter.supported_account_types, "Crypto"
+    assert_not_includes Provider::KrakenAdapter.supported_account_types, "Depository"
+  end
+
+  test "returns fallback connection config when no credentials exist yet" do
+    family = families(:empty)
+    configs = Provider::KrakenAdapter.connection_configs(family: family)
+
+    assert_equal 1, configs.length
+    assert_equal "kraken", configs.first[:key]
+    assert_equal I18n.t("kraken_items.provider_connection.default_name"), configs.first[:name]
+    assert configs.first[:can_connect]
+  end
+
+  test "returns one connection config per credentialed kraken item" do
+    family = families(:dylan_family)
+    first_item = kraken_items(:one)
+    second_item = KrakenItem.create!(
+      family: family,
+      name: "Business Kraken",
+      api_key: "second_kraken_key",
+      api_secret: "second_kraken_secret"
+    )
+
+    configs = Provider::KrakenAdapter.connection_configs(family: family)
+
+    assert_equal [ "kraken_#{second_item.id}", "kraken_#{first_item.id}" ], configs.map { |config| config[:key] }
+    assert_equal [
+      I18n.t("kraken_items.provider_connection.name", name: second_item.name),
+      I18n.t("kraken_items.provider_connection.name", name: first_item.name)
+    ], configs.map { |config| config[:name] }
+
+    new_account_uri = URI.parse(configs.first[:new_account_path].call("Crypto", "/accounts"))
+    assert_equal "/kraken_items/select_accounts", new_account_uri.path
+    assert_includes new_account_uri.query, "kraken_item_id=#{second_item.id}"
+
+    existing_account_uri = URI.parse(configs.first[:existing_account_path].call(accounts(:crypto).id))
+    assert_equal "/kraken_items/select_existing_account", existing_account_uri.path
+    assert_includes existing_account_uri.query, "kraken_item_id=#{second_item.id}"
+  end
+
+  test "connection configs ignore whitespace-only credentials" do
+    family = families(:dylan_family)
+    blank_item = KrakenItem.create!(
+      family: family,
+      name: "Blank Kraken",
+      api_key: "temporary_key",
+      api_secret: "temporary_secret"
+    )
+    blank_item.update_columns(api_key: "   ", api_secret: "   ")
+
+    configs = Provider::KrakenAdapter.connection_configs(family: family)
+
+    assert_equal [ "kraken_#{kraken_items(:one).id}" ], configs.map { |config| config[:key] }
+  end
+
+  test "build_provider returns nil when family is nil" do
+    assert_nil Provider::KrakenAdapter.build_provider(family: nil)
+  end
+
+  test "build_provider returns nil when family has no kraken items" do
+    assert_nil Provider::KrakenAdapter.build_provider(family: families(:empty))
+  end
+
+  test "build_provider returns Kraken provider when only one credentialed item exists" do
+    provider = Provider::KrakenAdapter.build_provider(family: families(:dylan_family))
+
+    assert_instance_of Provider::Kraken, provider
+  end
+
+  test "build_provider requires explicit item when multiple credentialed items exist" do
+    family = families(:dylan_family)
+    KrakenItem.create!(
+      family: family,
+      name: "Second Kraken",
+      api_key: "second_kraken_key",
+      api_secret: "second_kraken_secret"
+    )
+
+    assert_nil Provider::KrakenAdapter.build_provider(family: family)
+  end
+
+  test "build_provider uses explicit kraken item credentials" do
+    family = families(:dylan_family)
+    second_item = KrakenItem.create!(
+      family: family,
+      name: "Second Kraken",
+      api_key: " second_kraken_key \n",
+      api_secret: " second_kraken_secret \n"
+    )
+
+    provider = Provider::KrakenAdapter.build_provider(family: family, kraken_item_id: second_item.id)
+
+    assert_instance_of Provider::Kraken, provider
+    assert_equal "second_kraken_key", provider.api_key
+    assert_equal "second_kraken_secret", provider.api_secret
+  end
+
+  test "build_provider refuses kraken items outside the family" do
+    family = families(:dylan_family)
+    other_item = KrakenItem.create!(
+      family: families(:empty),
+      name: "Other Kraken",
+      api_key: "other_kraken_key",
+      api_secret: "other_kraken_secret"
+    )
+
+    assert_nil Provider::KrakenAdapter.build_provider(family: family, kraken_item_id: other_item.id)
+  end
+
+  test "build_provider refuses explicit kraken item without usable credentials" do
+    family = families(:dylan_family)
+    blank_item = KrakenItem.create!(
+      family: family,
+      name: "Blank Kraken",
+      api_key: "temporary_key",
+      api_secret: "temporary_secret"
+    )
+    blank_item.update_columns(api_key: "   ", api_secret: "   ")
+
+    assert_nil Provider::KrakenAdapter.build_provider(family: family, kraken_item_id: blank_item.id)
+  end
+end
diff --git a/test/models/provider/kraken_test.rb b/test/models/provider/kraken_test.rb
new file mode 100644
index 000000000..0d233420c
--- /dev/null
+++ b/test/models/provider/kraken_test.rb
@@ -0,0 +1,163 @@
+# frozen_string_literal: true
+
+require "test_helper"
+require "base64"
+
+class Provider::KrakenTest < ActiveSupport::TestCase
+  # Public Kraken docs signing sample, stored as bytes so secret scanners do
+  # not mistake the test vector for an accidentally committed credential.
+  OFFICIAL_SAMPLE_SECRET_BYTES = [
+    145, 1, 249, 29, 111, 252, 167, 91, 134, 57, 88, 219, 129, 96, 59, 22,
+    233, 192, 152, 99, 188, 150, 196, 148, 92, 219, 46, 221, 234, 48, 239,
+    171, 51, 243, 132, 53, 241, 245, 177, 159, 36, 115, 4, 112, 157, 222,
+    151, 121, 156, 79, 106, 107, 223, 71, 1, 155, 110, 102, 232, 250, 23,
+    88, 110, 94
+  ].freeze
+  OFFICIAL_SAMPLE_SIGNATURE = "4/dpxb3iT4tp/ZCVEwSnEsLxx0bqyhLpdfOpc6fn7OR8+UClSV5n9E6aSS8MPtnRfp32bAb0nmbRn6H8ndwLUQ=="
+
+  setup do
+    @provider = Provider::Kraken.new(api_key: "test_key", api_secret: official_sample_secret, nonce_generator: -> { "1616492376594" })
+  end
+
+  test "sign matches official Kraken Spot REST sample" do
+    params = {
+      "nonce" => "1616492376594",
+      "ordertype" => "limit",
+      "pair" => "XBTUSD",
+      "price" => "37500",
+      "type" => "buy",
+      "volume" => "1.25"
+    }
+
+    signature = @provider.send(:sign, "/0/private/AddOrder", params)
+
+    assert_equal OFFICIAL_SAMPLE_SIGNATURE, signature
+  end
+
+  test "auth headers include api key and signature" do
+    headers = @provider.send(:auth_headers, "/0/private/BalanceEx", { "nonce" => "1616492376594" })
+
+    assert_equal "test_key", headers["API-Key"]
+    assert headers["API-Sign"].present?
+    assert_equal 64, Base64.strict_decode64(headers["API-Sign"]).bytesize
+  end
+
+  test "private requests send signed post body and auth headers" do
+    response = mock_httparty_response(200, { "error" => [], "result" => { "name" => "Sure read-only" } })
+
+    Provider::Kraken.expects(:post)
+      .with(
+        "/0/private/GetApiKeyInfo",
+        has_entries(
+          body: "nonce=1616492376594",
+          headers: has_entries("API-Key" => "test_key", "Content-Type" => "application/x-www-form-urlencoded")
+        )
+      )
+      .returns(response)
+
+    assert_equal({ "name" => "Sure read-only" }, @provider.get_api_key_info)
+  end
+
+  test "handle response returns result on success" do
+    response = mock_httparty_response(200, { "error" => [], "result" => { "XXBT" => { "balance" => "1.0" } } })
+
+    assert_equal({ "XXBT" => { "balance" => "1.0" } }, @provider.send(:handle_response, response))
+  end
+
+  test "handle response raises api error for non 2xx" do
+    response = mock_httparty_response(500, { "error" => [ "EService:Unavailable" ] })
+
+    assert_raises(Provider::Kraken::ApiError) do
+      @provider.send(:handle_response, response)
+    end
+  end
+
+  test "handle response rejects non-envelope payloads" do
+    response = mock_httparty_response(200, [ "not", "an", "envelope" ])
+
+    error = assert_raises(Provider::Kraken::ApiError) do
+      @provider.send(:handle_response, response)
+    end
+
+    assert_equal "Malformed Kraken API response", error.message
+  end
+
+  test "handle response requires error key" do
+    response = mock_httparty_response(200, { "result" => {} })
+
+    error = assert_raises(Provider::Kraken::ApiError) do
+      @provider.send(:handle_response, response)
+    end
+
+    assert_equal "Malformed Kraken API response: missing error", error.message
+  end
+
+  test "handle response requires result key" do
+    response = mock_httparty_response(200, { "error" => [] })
+
+    error = assert_raises(Provider::Kraken::ApiError) do
+      @provider.send(:handle_response, response)
+    end
+
+    assert_equal "Malformed Kraken API response: missing result", error.message
+  end
+
+  test "handle response maps invalid key errors" do
+    assert_raises(Provider::Kraken::AuthenticationError) do
+      @provider.send(:handle_response, kraken_error_response("EAPI:Invalid key"))
+    end
+  end
+
+  test "handle response maps invalid signature errors" do
+    assert_raises(Provider::Kraken::AuthenticationError) do
+      @provider.send(:handle_response, kraken_error_response("EAPI:Invalid signature"))
+    end
+  end
+
+  test "handle response maps permission errors" do
+    assert_raises(Provider::Kraken::PermissionError) do
+      @provider.send(:handle_response, kraken_error_response("EGeneral:Permission denied"))
+    end
+  end
+
+  test "handle response maps rate limit errors" do
+    assert_raises(Provider::Kraken::RateLimitError) do
+      @provider.send(:handle_response, kraken_error_response("EAPI:Rate limit exceeded"))
+    end
+  end
+
+  test "handle response maps throttled errors as rate limits" do
+    assert_raises(Provider::Kraken::RateLimitError) do
+      @provider.send(:handle_response, kraken_error_response("EService:Throttled: 1770000000"))
+    end
+  end
+
+  test "handle response maps nonce errors" do
+    assert_raises(Provider::Kraken::NonceError) do
+      @provider.send(:handle_response, kraken_error_response("EAPI:Invalid nonce"))
+    end
+  end
+
+  test "handle response maps otp required errors" do
+    assert_raises(Provider::Kraken::OTPRequiredError) do
+      @provider.send(:handle_response, kraken_error_response("EAPI:Invalid arguments:otp required"))
+    end
+  end
+
+  private
+
+    def official_sample_secret
+      Base64.strict_encode64(OFFICIAL_SAMPLE_SECRET_BYTES.pack("C*"))
+    end
+
+    def kraken_error_response(error)
+      mock_httparty_response(200, { "error" => [ error ], "result" => nil })
+    end
+
+    def mock_httparty_response(code, body)
+      response = mock
+      response.stubs(:code).returns(code)
+      response.stubs(:parsed_response).returns(body)
+      response
+    end
+end
diff --git a/test/models/provider/mercury_adapter_test.rb b/test/models/provider/mercury_adapter_test.rb
index f89ff14ce..d60b2f177 100644
--- a/test/models/provider/mercury_adapter_test.rb
+++ b/test/models/provider/mercury_adapter_test.rb
@@ -1,3 +1,5 @@
+require "uri"
+
 require "test_helper"
 
 class Provider::MercuryAdapterTest < ActiveSupport::TestCase
@@ -9,17 +11,59 @@ class Provider::MercuryAdapterTest < ActiveSupport::TestCase
     assert_not_includes Provider::MercuryAdapter.supported_account_types, "Investment"
   end
 
-  test "returns connection configs for any family" do
+  test "returns fallback connection config when no credentials exist yet" do
     # Mercury is a per-family provider - any family can connect
-    family = families(:dylan_family)
+    family = families(:empty)
     configs = Provider::MercuryAdapter.connection_configs(family: family)
 
     assert_equal 1, configs.length
     assert_equal "mercury", configs.first[:key]
-    assert_equal "Mercury", configs.first[:name]
+    assert_equal I18n.t("mercury_items.provider_connection.default_name"), configs.first[:name]
     assert configs.first[:can_connect]
   end
 
+  test "returns one connection config per credentialed mercury item" do
+    family = families(:dylan_family)
+    first_item = mercury_items(:one)
+    second_item = MercuryItem.create!(
+      family: family,
+      name: "Business Mercury",
+      token: "second_mercury_token",
+      base_url: "https://api.mercury.com/api/v1"
+    )
+
+    configs = Provider::MercuryAdapter.connection_configs(family: family)
+
+    assert_equal 2, configs.length
+    assert_equal [ "mercury_#{second_item.id}", "mercury_#{first_item.id}" ], configs.map { |config| config[:key] }
+    assert_equal [
+      I18n.t("mercury_items.provider_connection.name", name: second_item.name),
+      I18n.t("mercury_items.provider_connection.name", name: first_item.name)
+    ], configs.map { |config| config[:name] }
+
+    new_account_uri = URI.parse(configs.first[:new_account_path].call("Depository", "/accounts"))
+    assert_equal "/mercury_items/select_accounts", new_account_uri.path
+    assert_includes new_account_uri.query, "mercury_item_id=#{second_item.id}"
+
+    existing_account_uri = URI.parse(configs.first[:existing_account_path].call(accounts(:depository).id))
+    assert_equal "/mercury_items/select_existing_account", existing_account_uri.path
+    assert_includes existing_account_uri.query, "mercury_item_id=#{second_item.id}"
+  end
+
+  test "connection configs ignore items with whitespace-only tokens" do
+    family = families(:dylan_family)
+    MercuryItem.create!(
+      family: family,
+      name: "Blank Mercury",
+      token: "temporary_token",
+      base_url: "https://api.mercury.com/api/v1"
+    ).update_column(:token, "   ")
+
+    configs = Provider::MercuryAdapter.connection_configs(family: family)
+
+    assert_equal [ "mercury_#{mercury_items(:one).id}" ], configs.map { |config| config[:key] }
+  end
+
   test "build_provider returns nil when family is nil" do
     assert_nil Provider::MercuryAdapter.build_provider(family: nil)
   end
@@ -35,4 +79,59 @@ class Provider::MercuryAdapterTest < ActiveSupport::TestCase
 
     assert_instance_of Provider::Mercury, provider
   end
+
+  test "build_provider uses explicit mercury item credentials" do
+    family = families(:dylan_family)
+    second_item = MercuryItem.create!(
+      family: family,
+      name: "Business Mercury",
+      token: "second_mercury_token",
+      base_url: "https://api.mercury.com/api/v1"
+    )
+
+    provider = Provider::MercuryAdapter.build_provider(family: family, mercury_item_id: second_item.id)
+
+    assert_instance_of Provider::Mercury, provider
+    assert_equal "second_mercury_token", provider.token
+    assert_equal "https://api.mercury.com/api/v1", provider.base_url
+  end
+
+  test "build_provider strips surrounding token whitespace" do
+    family = families(:dylan_family)
+    second_item = MercuryItem.create!(
+      family: family,
+      name: "Business Mercury",
+      token: " second_mercury_token \n",
+      base_url: "https://api.mercury.com/api/v1"
+    )
+
+    provider = Provider::MercuryAdapter.build_provider(family: family, mercury_item_id: second_item.id)
+
+    assert_equal "second_mercury_token", provider.token
+  end
+
+  test "build_provider refuses mercury items outside the family" do
+    family = families(:dylan_family)
+    other_item = MercuryItem.create!(
+      family: families(:empty),
+      name: "Other Mercury",
+      token: "other_mercury_token",
+      base_url: "https://api.mercury.com/api/v1"
+    )
+
+    assert_nil Provider::MercuryAdapter.build_provider(family: family, mercury_item_id: other_item.id)
+  end
+
+  test "build_provider refuses explicit mercury item without usable credentials" do
+    family = families(:dylan_family)
+    blank_item = MercuryItem.create!(
+      family: family,
+      name: "Blank Mercury",
+      token: "temporary_token",
+      base_url: "https://api.mercury.com/api/v1"
+    )
+    blank_item.update_column(:token, "   ")
+
+    assert_nil Provider::MercuryAdapter.build_provider(family: family, mercury_item_id: blank_item.id)
+  end
 end
diff --git a/test/models/provider/openai/batch_slicer_test.rb b/test/models/provider/openai/batch_slicer_test.rb
new file mode 100644
index 000000000..c56133991
--- /dev/null
+++ b/test/models/provider/openai/batch_slicer_test.rb
@@ -0,0 +1,74 @@
+require "test_helper"
+
+class Provider::Openai::BatchSlicerTest < ActiveSupport::TestCase
+  test "returns empty array for empty input" do
+    assert_equal [], Provider::Openai::BatchSlicer.call([], max_items: 25, max_tokens: 2000)
+  end
+
+  test "single batch when within item cap and token budget" do
+    items = Array.new(10) { |i| { id: i, name: "Item#{i}" } }
+
+    batches = Provider::Openai::BatchSlicer.call(items, max_items: 25, max_tokens: 10_000)
+
+    assert_equal 1, batches.size
+    assert_equal items, batches.first
+  end
+
+  test "splits on item cap" do
+    items = Array.new(30) { |i| { id: i } }
+
+    batches = Provider::Openai::BatchSlicer.call(items, max_items: 10, max_tokens: 100_000)
+
+    assert_equal 3, batches.size
+    assert_equal 10, batches.first.size
+    assert_equal 10, batches.last.size
+    assert_equal items, batches.flatten
+  end
+
+  test "splits on token budget" do
+    big_item = { payload: "x" * 200 }  # ~63 tokens each
+    items = Array.new(10) { big_item }
+
+    # ~125-token budget fits 2 items per batch
+    batches = Provider::Openai::BatchSlicer.call(items, max_items: 100, max_tokens: 125)
+
+    assert batches.size > 1
+    assert_equal items, batches.flatten
+    batches.each do |batch|
+      tokens = Assistant::TokenEstimator.estimate(batch)
+      assert tokens <= 125, "Batch exceeded token budget: #{tokens}"
+    end
+  end
+
+  test "raises ContextOverflowError when single item exceeds budget" do
+    huge = { payload: "x" * 10_000 }
+
+    assert_raises Provider::Openai::BatchSlicer::ContextOverflowError do
+      Provider::Openai::BatchSlicer.call([ huge ], max_items: 25, max_tokens: 500)
+    end
+  end
+
+  test "raises ContextOverflowError when fixed_tokens exceed budget" do
+    assert_raises Provider::Openai::BatchSlicer::ContextOverflowError do
+      Provider::Openai::BatchSlicer.call([ { a: 1 } ], max_items: 25, max_tokens: 500, fixed_tokens: 600)
+    end
+  end
+
+  test "respects fixed_tokens when computing available budget" do
+    items = Array.new(5) { { payload: "x" * 80 } }  # ~25 tokens each
+
+    # Budget of 200 minus fixed 100 = 100 available; fits ~4 items per batch
+    batches = Provider::Openai::BatchSlicer.call(items, max_items: 25, max_tokens: 200, fixed_tokens: 100)
+
+    assert batches.size >= 2
+    assert_equal items, batches.flatten
+  end
+
+  test "never produces empty batches" do
+    items = Array.new(7) { { id: SecureRandom.hex(4) } }
+
+    batches = Provider::Openai::BatchSlicer.call(items, max_items: 2, max_tokens: 10_000)
+
+    batches.each { |b| assert b.any?, "Empty batch produced" }
+  end
+end
diff --git a/test/models/provider/openai/chat_stream_parser_test.rb b/test/models/provider/openai/chat_stream_parser_test.rb
new file mode 100644
index 000000000..67cef1d98
--- /dev/null
+++ b/test/models/provider/openai/chat_stream_parser_test.rb
@@ -0,0 +1,95 @@
+require "test_helper"
+
+class Provider::Openai::ChatStreamParserTest < ActiveSupport::TestCase
+  test "parses output_text delta" do
+    chunk = Provider::Openai::ChatStreamParser.new(
+      { "type" => "response.output_text.delta", "delta" => "Hello" }
+    ).parsed
+
+    assert_equal "output_text", chunk.type
+    assert_equal "Hello", chunk.data
+  end
+
+  test "parses refusal delta as output_text" do
+    chunk = Provider::Openai::ChatStreamParser.new(
+      { "type" => "response.refusal.delta", "delta" => "I cannot..." }
+    ).parsed
+
+    assert_equal "output_text", chunk.type
+    assert_equal "I cannot...", chunk.data
+  end
+
+  test "returns nil for unknown event types" do
+    assert_nil Provider::Openai::ChatStreamParser.new({ "type" => "response.created" }).parsed
+    assert_nil Provider::Openai::ChatStreamParser.new({ "type" => "response.in_progress" }).parsed
+  end
+
+  test "response.failed produces an error chunk with upstream message and code" do
+    chunk = Provider::Openai::ChatStreamParser.new(
+      {
+        "type" => "response.failed",
+        "response" => {
+          "error" => { "message" => "Previous response not found", "code" => "previous_response_not_found" }
+        }
+      }
+    ).parsed
+
+    assert_equal "error", chunk.type
+    assert_equal "response.failed", chunk.data.event
+    assert_equal "Previous response not found", chunk.data.message
+    assert_equal "previous_response_not_found", chunk.data.code
+  end
+
+  test "response.incomplete produces an error chunk using incomplete_details.reason" do
+    chunk = Provider::Openai::ChatStreamParser.new(
+      {
+        "type" => "response.incomplete",
+        "response" => {
+          "incomplete_details" => { "reason" => "max_output_tokens" }
+        }
+      }
+    ).parsed
+
+    assert_equal "error", chunk.type
+    assert_equal "response.incomplete", chunk.data.event
+    assert_equal "max_output_tokens", chunk.data.message
+    assert_equal "max_output_tokens", chunk.data.code
+  end
+
+  test "response.failed without details still surfaces an event-tagged error" do
+    chunk = Provider::Openai::ChatStreamParser.new({ "type" => "response.failed" }).parsed
+
+    assert_equal "error", chunk.type
+    assert_equal "response.failed", chunk.data.event
+    assert_match(/response\.failed/, chunk.data.message)
+  end
+
+  test "top-level error event becomes an error chunk" do
+    chunk = Provider::Openai::ChatStreamParser.new(
+      { "type" => "error", "message" => "Rate limit exceeded", "code" => "rate_limit_exceeded" }
+    ).parsed
+
+    assert_equal "error", chunk.type
+    assert_equal "error", chunk.data.event
+    assert_equal "Rate limit exceeded", chunk.data.message
+    assert_equal "rate_limit_exceeded", chunk.data.code
+  end
+
+  test "response.completed parses into a response chunk" do
+    chunk = Provider::Openai::ChatStreamParser.new(
+      {
+        "type" => "response.completed",
+        "response" => {
+          "id" => "resp_1",
+          "model" => "gpt-4.1",
+          "output" => [],
+          "usage" => { "total_tokens" => 5 }
+        }
+      }
+    ).parsed
+
+    assert_equal "response", chunk.type
+    assert_equal "resp_1", chunk.data.id
+    assert_equal({ "total_tokens" => 5 }, chunk.usage)
+  end
+end
diff --git a/test/models/provider/openai_test.rb b/test/models/provider/openai_test.rb
index 879fe20e7..2db1013a4 100644
--- a/test/models/provider/openai_test.rb
+++ b/test/models/provider/openai_test.rb
@@ -330,4 +330,178 @@ class Provider::OpenaiTest < ActiveSupport::TestCase
 
     @subject.send(:create_langfuse_trace, name: "openai.test", input: { foo: "bar" })
   end
+
+  test "SUPPORTED_MODELS and VISION_CAPABLE_MODEL_PREFIXES are Ruby constants, not YAML-derived" do
+    assert_kind_of Array, Provider::Openai::SUPPORTED_MODELS
+    assert Provider::Openai::SUPPORTED_MODELS.all? { |s| s.is_a?(String) }
+    assert Provider::Openai::SUPPORTED_MODELS.frozen?
+
+    assert_kind_of Array, Provider::Openai::VISION_CAPABLE_MODEL_PREFIXES
+    assert Provider::Openai::VISION_CAPABLE_MODEL_PREFIXES.frozen?
+    assert_equal "gpt-4.1", Provider::Openai::DEFAULT_MODEL
+  end
+
+  test "budget readers default to conservative values" do
+    with_env_overrides(
+      "LLM_CONTEXT_WINDOW" => nil,
+      "LLM_MAX_RESPONSE_TOKENS" => nil,
+      "LLM_SYSTEM_PROMPT_RESERVE" => nil,
+      "LLM_MAX_HISTORY_TOKENS" => nil,
+      "LLM_MAX_ITEMS_PER_CALL" => nil
+    ) do
+      subject = Provider::Openai.new("test-token")
+      assert_equal 2048, subject.context_window
+      assert_equal 512, subject.max_response_tokens
+      assert_equal 256, subject.system_prompt_reserve
+      assert_equal 2048 - 512 - 256, subject.max_history_tokens
+      assert_equal 2048 - 512 - 256, subject.max_input_tokens
+      assert_equal 25, subject.max_items_per_call
+    end
+  end
+
+  test "budget readers respect explicit env overrides" do
+    with_env_overrides(
+      "LLM_CONTEXT_WINDOW" => "8192",
+      "LLM_MAX_RESPONSE_TOKENS" => "1024",
+      "LLM_SYSTEM_PROMPT_RESERVE" => "512",
+      "LLM_MAX_HISTORY_TOKENS" => "4096",
+      "LLM_MAX_ITEMS_PER_CALL" => "50"
+    ) do
+      subject = Provider::Openai.new("test-token")
+      assert_equal 8192, subject.context_window
+      assert_equal 1024, subject.max_response_tokens
+      assert_equal 512, subject.system_prompt_reserve
+      assert_equal 4096, subject.max_history_tokens  # explicit overrides derived
+      assert_equal 8192 - 1024 - 512, subject.max_input_tokens
+      assert_equal 50, subject.max_items_per_call
+    end
+  end
+
+  test "budget readers fall back to Setting when ENV unset" do
+    with_env_overrides(
+      "LLM_CONTEXT_WINDOW" => nil,
+      "LLM_MAX_RESPONSE_TOKENS" => nil,
+      "LLM_MAX_ITEMS_PER_CALL" => nil
+    ) do
+      Setting.llm_context_window = 8192
+      Setting.llm_max_response_tokens = 1024
+      Setting.llm_max_items_per_call = 40
+
+      subject = Provider::Openai.new("test-token")
+      assert_equal 8192, subject.context_window
+      assert_equal 1024, subject.max_response_tokens
+      assert_equal 40, subject.max_items_per_call
+    end
+  ensure
+    Setting.llm_context_window = nil
+    Setting.llm_max_response_tokens = nil
+    Setting.llm_max_items_per_call = nil
+  end
+
+  test "budget readers: ENV beats Setting when both present" do
+    with_env_overrides("LLM_CONTEXT_WINDOW" => "16384") do
+      Setting.llm_context_window = 4096
+      subject = Provider::Openai.new("test-token")
+      assert_equal 16384, subject.context_window
+    end
+  ensure
+    Setting.llm_context_window = nil
+  end
+
+  test "budget readers: zero or negative values fall through to default" do
+    with_env_overrides(
+      "LLM_CONTEXT_WINDOW" => "0",
+      "LLM_MAX_RESPONSE_TOKENS" => nil,
+      "LLM_MAX_ITEMS_PER_CALL" => nil
+    ) do
+      Setting.llm_context_window = 0
+      subject = Provider::Openai.new("test-token")
+      assert_equal 2048, subject.context_window
+    end
+  ensure
+    Setting.llm_context_window = nil
+  end
+
+  test "auto_categorize fans out oversized batches into sequential sub-calls" do
+    with_env_overrides("LLM_MAX_ITEMS_PER_CALL" => "10") do
+      subject = Provider::Openai.new("test-token")
+      transactions = Array.new(25) { |i| { id: i.to_s, name: "txn#{i}", amount: 10, classification: "expense" } }
+      user_categories = [ { id: "cat1", name: "Groceries", is_subcategory: false, parent_id: nil, classification: "expense" } ]
+
+      # Capture the batch size passed to each AutoCategorizer. `.new` is called
+      # once per sub-batch; we record each invocation's transactions count.
+      seen_sizes = []
+      fake_instance = mock
+      fake_instance.stubs(:auto_categorize).returns([])
+      Provider::Openai::AutoCategorizer.stubs(:new).with do |*_args, **kwargs|
+        seen_sizes << kwargs[:transactions].size
+        true
+      end.returns(fake_instance)
+
+      response = subject.auto_categorize(transactions: transactions, user_categories: user_categories)
+
+      assert response.success?
+      assert_equal [ 10, 10, 5 ], seen_sizes
+    end
+  end
+
+  test "streaming surfaces a useful error when the stream ends with response.failed and no completion" do
+    fake_responses = mock
+    fake_client = mock
+    fake_client.stubs(:responses).returns(fake_responses)
+    @subject.stubs(:client).returns(fake_client)
+
+    fake_responses.expects(:create).with do |*_args, **kwargs|
+      stream = kwargs.dig(:parameters, :stream)
+      stream.call({
+        "type" => "response.failed",
+        "response" => {
+          "error" => { "message" => "Previous response not found", "code" => "previous_response_not_found" }
+        }
+      })
+      true
+    end.returns(nil)
+
+    response = @subject.chat_response(
+      "hi",
+      model: @subject_model,
+      streamer: proc { |_| }
+    )
+
+    assert_not response.success?
+    assert_kind_of Provider::Openai::Error, response.error
+    assert_match(/Previous response not found/, response.error.message)
+    assert_match(/previous_response_not_found/, response.error.message)
+  end
+
+  test "streaming surfaces a useful error when the stream ends with no response and no error event" do
+    fake_responses = mock
+    fake_client = mock
+    fake_client.stubs(:responses).returns(fake_responses)
+    @subject.stubs(:client).returns(fake_client)
+
+    fake_responses.expects(:create).returns(nil)
+
+    response = @subject.chat_response(
+      "hi",
+      model: @subject_model,
+      streamer: proc { |_| }
+    )
+
+    assert_not response.success?
+    assert_kind_of Provider::Openai::Error, response.error
+    assert_match(/stream ended without a completion event/i, response.error.message)
+  end
+
+  test "build_input no longer accepts inline messages history" do
+    config = Provider::Openai::ChatConfig.new(functions: [], function_results: [])
+    # Positive control: prompt works
+    result = config.build_input(prompt: "hi")
+    assert_equal [ { role: "user", content: "hi" } ], result
+
+    # `messages:` kwarg is no longer part of the signature — calling with it must raise
+    assert_raises(ArgumentError) do
+      config.build_input(prompt: "hi", messages: [ { role: "user", content: "old" } ])
+    end
+  end
 end
diff --git a/test/models/provider/sophtron_adapter_test.rb b/test/models/provider/sophtron_adapter_test.rb
new file mode 100644
index 000000000..2c041c949
--- /dev/null
+++ b/test/models/provider/sophtron_adapter_test.rb
@@ -0,0 +1,35 @@
+require "uri"
+
+require "test_helper"
+
+class Provider::SophtronAdapterTest < ActiveSupport::TestCase
+  test "new account connection config starts a new institution connection" do
+    config = Provider::SophtronAdapter.connection_configs(family: families(:empty)).first
+
+    new_account_uri = URI.parse(config[:new_account_path].call("Depository", "/accounts"))
+
+    assert_equal "/sophtron_items/select_accounts", new_account_uri.path
+    assert_includes new_account_uri.query, "accountable_type=Depository"
+    assert_includes new_account_uri.query, "return_to=%2Faccounts"
+    assert_includes new_account_uri.query, "connect_new_institution=true"
+  end
+
+  test "institution_name does not fall back to another institution item" do
+    item = families(:dylan_family).sophtron_items.create!(
+      name: "Sophtron Connection",
+      user_id: "developer-user",
+      access_key: Base64.strict_encode64("secret-key"),
+      institution_name: "Amazon",
+      user_institution_id: "ui-amazon"
+    )
+    account = item.sophtron_accounts.create!(
+      name: "Juan",
+      account_id: "card-1",
+      currency: "USD",
+      balance: 1_947.18,
+      institution_metadata: { user_institution_id: "ui-apple" }
+    )
+
+    assert_nil Provider::SophtronAdapter.new(account).institution_name
+  end
+end
diff --git a/test/models/provider/sophtron_test.rb b/test/models/provider/sophtron_test.rb
new file mode 100644
index 000000000..dfdeeb806
--- /dev/null
+++ b/test/models/provider/sophtron_test.rb
@@ -0,0 +1,225 @@
+require "test_helper"
+
+class Provider::SophtronTest < ActiveSupport::TestCase
+  setup do
+    @access_key = Base64.strict_encode64("secret-key")
+    @provider = Provider::Sophtron.new("developer-user", @access_key)
+  end
+
+  test "builds FIApiAUTH header from last path segment only" do
+    auth_header = @provider.auth_header_for("POST", "/api/UserInstitution/CreateUserInstitution")
+    expected_auth_path = "/createuserinstitution"
+    expected_signature = Base64.strict_encode64(
+      OpenSSL::HMAC.digest(
+        OpenSSL::Digest.new("sha256"),
+        "secret-key",
+        "POST\n#{expected_auth_path}"
+      )
+    )
+
+    assert_equal "FIApiAUTH:developer-user:#{expected_signature}:#{expected_auth_path}", auth_header
+  end
+
+  test "lists v2 customers" do
+    stub_request(:get, "https://api.sophtron.com/api/v2/customers")
+      .to_return(status: 200, body: [ { CustomerID: "cust-1", CustomerName: "Sure family 1" } ].to_json)
+
+    customers = provider_data(@provider.list_customers)
+
+    assert_equal 1, customers.length
+    assert_equal "cust-1", customers.first[:CustomerID]
+  end
+
+  test "creates customer with documented body" do
+    stub_request(:post, "https://api.sophtron.com/api/v2/customers")
+      .with(body: { UniqueID: "sure-family-1", Name: "Sure family 1", Source: "Sure" }.to_json)
+      .to_return(status: 200, body: { CustomerID: "cust-1", CustomerName: "Sure family 1" }.to_json)
+
+    customer = provider_data(@provider.create_customer(unique_id: "sure-family-1", name: "Sure family 1", source: "Sure"))
+
+    assert_equal "cust-1", customer[:CustomerID]
+  end
+
+  test "health check auth accepts empty success body" do
+    stub_request(:get, "https://api.sophtron.com/api/Institution/HealthCheckAuth")
+      .to_return(status: 200, body: "")
+
+    assert_equal({}, provider_data(@provider.health_check_auth))
+  end
+
+  test "health check auth accepts non json success body" do
+    stub_request(:get, "https://api.sophtron.com/api/Institution/HealthCheckAuth")
+      .to_return(status: 200, body: "OK")
+
+    assert_equal "OK", provider_data(@provider.health_check_auth)
+  end
+
+  test "creates user institution with documented V1 body" do
+    stub_request(:post, "https://api.sophtron.com/api/UserInstitution/CreateUserInstitution")
+      .with(body: {
+        UserID: "developer-user",
+        InstitutionID: "inst-1",
+        UserName: "bank-user",
+        Password: "bank-pass",
+        PIN: ""
+      }.to_json)
+      .to_return(status: 200, body: { JobID: "job-1", UserInstitutionID: "ui-1" }.to_json)
+
+    response = provider_data(@provider.create_user_institution(
+      institution_id: "inst-1",
+      username: "bank-user",
+      password: "bank-pass"
+    ))
+
+    assert_equal "job-1", response[:JobID]
+    assert_equal "ui-1", response[:UserInstitutionID]
+  end
+
+  test "classifies Sophtron timeout job as failed" do
+    job = {
+      SuccessFlag: false,
+      LastStep: "LogInPanel",
+      LastStatus: "Timeout"
+    }
+
+    assert Provider::Sophtron.job_failed?(job)
+  end
+
+  test "classifies completed job without failure flag as completed" do
+    job = {
+      LastStep: "TokenInput",
+      LastStatus: "Completed"
+    }
+
+    assert Provider::Sophtron.job_completed?(job)
+    assert_not Provider::Sophtron.job_failed?(job)
+  end
+
+  test "does not classify completed job with failure flag as completed" do
+    job = {
+      SuccessFlag: false,
+      LastStep: "LogInPanel",
+      LastStatus: "Completed"
+    }
+
+    assert Provider::Sophtron.job_failed?(job)
+    assert_not Provider::Sophtron.job_completed?(job)
+  end
+
+  test "classifies token input prompt as requiring input" do
+    job = {
+      TokenInputName: "Token",
+      LastStep: "TokenInput",
+      LastStatus: "Started"
+    }
+
+    assert Provider::Sophtron.job_requires_input?(job)
+  end
+
+  test "does not classify submitted token as requiring input" do
+    job = {
+      TokenInputName: "Token",
+      TokenInput: "123456",
+      LastStep: "TokenInput",
+      LastStatus: "Started"
+    }
+
+    assert_not Provider::Sophtron.job_requires_input?(job)
+  end
+
+  test "submits security answers as JSON array string" do
+    stub_request(:post, "https://api.sophtron.com/api/Job/UpdateJobSecurityAnswer")
+      .with(body: { JobID: "job-1", SecurityAnswer: [ "blue" ].to_json }.to_json)
+      .to_return(status: 200, body: "")
+
+    assert_equal({}, provider_data(@provider.update_job_security_answer("job-1", [ "blue" ])))
+  end
+
+  test "fetches transactions by transaction date with documented body" do
+    stub_request(:post, "https://api.sophtron.com/api/Transaction/GetTransactionsByTransactionDate")
+      .with(body: {
+        AccountID: "acct-1",
+        StartDate: "2026-01-01",
+        EndDate: "2026-02-01"
+      }.to_json)
+      .to_return(status: 200, body: [
+        {
+          TransactionID: "tx-1",
+          Amount: "-12.34",
+          TransactionDate: "2026-01-15",
+          Description: "CHECKCARD 1234 Coffee Shop NY"
+        }
+      ].to_json)
+
+    result = provider_data(@provider.get_account_transactions("acct-1", start_date: Date.new(2026, 1, 1), end_date: Date.new(2026, 2, 1)))
+    transaction = result[:transactions].first
+
+    assert_equal "tx-1", transaction[:id]
+    assert_equal "acct-1", transaction[:accountId]
+    assert_equal "-12.34", transaction[:amount]
+    assert_equal "2026-01-15", transaction[:date]
+  end
+
+  test "normalizes TransactionId transaction identifiers" do
+    stub_request(:post, "https://api.sophtron.com/api/Transaction/GetTransactionsByTransactionDate")
+      .to_return(status: 200, body: [
+        {
+          TransactionId: "tx-1",
+          Amount: "-12.34",
+          TransactionDate: "2026-01-15",
+          Description: "CHECKCARD 1234 Coffee Shop NY"
+        }
+      ].to_json)
+
+    result = provider_data(@provider.get_account_transactions("acct-1", start_date: Date.new(2026, 1, 1), end_date: Date.new(2026, 2, 1)))
+
+    assert_equal "tx-1", result[:transactions].first[:id]
+  end
+
+  test "maps user institution accounts from V1 fields" do
+    stub_request(:post, "https://api.sophtron.com/api/UserInstitution/GetUserInstitutionAccounts")
+      .with(body: { UserInstitutionID: "ui-1" }.to_json)
+      .to_return(status: 200, body: [
+        {
+          AccountID: "acct-1",
+          AccountName: "Checking",
+          AccountType: "checking",
+          AccountBalance: "123.45",
+          AccountNumber: "00001234"
+        }
+      ].to_json)
+
+    result = provider_data(@provider.get_accounts("ui-1"))
+    account = result[:accounts].first
+
+    assert_equal "acct-1", account[:account_id]
+    assert_equal "Checking", account[:account_name]
+    assert_equal "123.45", account[:balance]
+    assert_equal "****1234", account[:account_number_mask]
+  end
+
+  test "empty success body parses as empty hash" do
+    stub_request(:post, "https://api.sophtron.com/api/Job/UpdateJobCaptcha")
+      .to_return(status: 200, body: "")
+
+    assert_equal({}, provider_data(@provider.update_job_captcha("job-1", "abc123")))
+  end
+
+  test "raises typed error on unauthorized response" do
+    stub_request(:get, "https://api.sophtron.com/api/Institution/HealthCheckAuth")
+      .to_return(status: 401, body: "bad auth")
+
+    response = @provider.health_check_auth
+
+    assert_not response.success?
+    assert_instance_of Provider::Sophtron::Error, response.error
+    assert_equal :unauthorized, response.error.error_type
+  end
+
+  private
+
+    def provider_data(response)
+      assert response.success?
+      response.data
+    end
+end
diff --git a/test/models/provider/twelve_data_test.rb b/test/models/provider/twelve_data_test.rb
new file mode 100644
index 000000000..e5c67d6ab
--- /dev/null
+++ b/test/models/provider/twelve_data_test.rb
@@ -0,0 +1,223 @@
+require "test_helper"
+
+class Provider::TwelveDataTest < ActiveSupport::TestCase
+  setup do
+    @provider = Provider::TwelveData.new("test_api_key")
+  end
+
+  # ================================
+  #     Rate Limit Detection Tests
+  # ================================
+
+  test "detects rate limit from JSON body code 429" do
+    rate_limit_body = {
+      "code" => 429,
+      "message" => "You have run out of API credits for the current minute.",
+      "status" => "error"
+    }.to_json
+
+    mock_response = mock
+    mock_response.stubs(:body).returns(rate_limit_body)
+
+    @provider.stubs(:throttle_request)
+    @provider.stubs(:client).returns(mock_client = mock)
+    mock_client.stubs(:get).returns(mock_response)
+
+    result = @provider.fetch_exchange_rates(from: "USD", to: "EUR", start_date: Date.current, end_date: Date.current)
+
+    assert_not result.success?
+    assert_instance_of Provider::TwelveData::RateLimitError, result.error
+  end
+
+  test "detects rate limit on single exchange rate fetch" do
+    rate_limit_body = {
+      "code" => 429,
+      "message" => "Rate limit exceeded"
+    }.to_json
+
+    mock_response = mock
+    mock_response.stubs(:body).returns(rate_limit_body)
+
+    @provider.stubs(:throttle_request)
+    @provider.stubs(:client).returns(mock_client = mock)
+    mock_client.stubs(:get).returns(mock_response)
+
+    result = @provider.fetch_exchange_rate(from: "USD", to: "EUR", date: Date.current)
+
+    assert_not result.success?
+    assert_instance_of Provider::TwelveData::RateLimitError, result.error
+  end
+
+  test "does not fall through to cross API when rate limited" do
+    rate_limit_body = {
+      "code" => 429,
+      "message" => "Rate limit exceeded"
+    }.to_json
+
+    mock_response = mock
+    mock_response.stubs(:body).returns(rate_limit_body)
+
+    @provider.stubs(:throttle_request)
+    mock_client = mock
+    # Should only be called once (time_series), NOT a second time (time_series/cross)
+    mock_client.expects(:get).once.returns(mock_response)
+    @provider.stubs(:client).returns(mock_client)
+
+    result = @provider.fetch_exchange_rates(from: "USD", to: "EUR", start_date: Date.current, end_date: Date.current)
+
+    assert_not result.success?
+    assert_instance_of Provider::TwelveData::RateLimitError, result.error
+  end
+
+  # ================================
+  #   Error Transformer Tests
+  # ================================
+
+  test "default_error_transformer preserves RateLimitError" do
+    error = Provider::TwelveData::RateLimitError.new("Rate limit exceeded")
+
+    result = @provider.send(:with_provider_response) { raise error }
+
+    assert_not result.success?
+    assert_instance_of Provider::TwelveData::RateLimitError, result.error
+  end
+
+  test "default_error_transformer converts Faraday 429 to RateLimitError" do
+    error = Faraday::TooManyRequestsError.new("Too Many Requests", { body: "Rate limited" })
+
+    result = @provider.send(:with_provider_response) { raise error }
+
+    assert_not result.success?
+    assert_instance_of Provider::TwelveData::RateLimitError, result.error
+  end
+
+  test "default_error_transformer wraps generic errors as Error" do
+    error = StandardError.new("Something went wrong")
+
+    result = @provider.send(:with_provider_response) { raise error }
+
+    assert_not result.success?
+    assert_instance_of Provider::TwelveData::Error, result.error
+  end
+
+  # ================================
+  #     Crypto Filter Tests
+  # ================================
+
+  test "search_securities excludes Digital Currency rows" do
+    body = {
+      "data" => [
+        {
+          "symbol" => "ETH",
+          "instrument_name" => "Grayscale Ethereum Trust ETF",
+          "mic_code" => "ARCX",
+          "instrument_type" => "ETF",
+          "country" => "United States",
+          "currency" => "USD"
+        },
+        {
+          "symbol" => "ETH/EUR",
+          "instrument_name" => "Ethereum Euro",
+          "mic_code" => "DIGITAL_CURRENCY",
+          "instrument_type" => "Digital Currency",
+          "country" => "",
+          "currency" => ""
+        },
+        {
+          "symbol" => "BTC/USD",
+          "instrument_name" => "Bitcoin US Dollar",
+          "mic_code" => "DIGITAL_CURRENCY",
+          "instrument_type" => "Digital Currency",
+          "country" => "",
+          "currency" => ""
+        }
+      ]
+    }.to_json
+
+    mock_response = mock
+    mock_response.stubs(:body).returns(body)
+    @provider.stubs(:throttle_request)
+    @provider.stubs(:client).returns(mock_client = mock)
+    mock_client.stubs(:get).returns(mock_response)
+
+    result = @provider.search_securities("ETH")
+
+    assert result.success?
+    assert_equal 1, result.data.size
+    assert_equal "ETH", result.data.first.symbol
+    refute result.data.any? { |s| s.symbol.include?("/") }
+  end
+
+  test "search_securities excludes crypto even with mixed-case instrument_type" do
+    body = {
+      "data" => [
+        {
+          "symbol" => "BTC/EUR",
+          "instrument_name" => "Bitcoin Euro",
+          "mic_code" => "",
+          "instrument_type" => "digital currency",
+          "currency" => ""
+        }
+      ]
+    }.to_json
+
+    mock_response = mock
+    mock_response.stubs(:body).returns(body)
+    @provider.stubs(:throttle_request)
+    @provider.stubs(:client).returns(mock_client = mock)
+    mock_client.stubs(:get).returns(mock_response)
+
+    result = @provider.search_securities("BTC")
+    assert_empty result.data
+  end
+
+  # ================================
+  #       Throttle Tests
+  # ================================
+
+  test "throttle_request enforces minimum interval between calls" do
+    @provider.send(:instance_variable_set, :@last_request_time, Time.current)
+
+    # Stub sleep to capture the call without actually sleeping
+    sleep_called_with = nil
+    @provider.define_singleton_method(:sleep) { |duration| sleep_called_with = duration }
+
+    # Stub cache to return under limit (read returns current count, increment charges)
+    Rails.cache.stubs(:read).returns(0)
+    Rails.cache.stubs(:increment).returns(1)
+
+    @provider.send(:throttle_request)
+
+    assert_not_nil sleep_called_with, "Should have called sleep to enforce minimum interval"
+    assert_operator sleep_called_with, :>, 0
+  end
+
+  test "throttle_request waits when per-minute credit limit is exceeded" do
+    # Stub cache read to return count at limit (adding 1 more would exceed 7)
+    Rails.cache.stubs(:read).returns(7)
+    Rails.cache.stubs(:increment).returns(8)
+
+    sleep_called = false
+    @provider.define_singleton_method(:sleep) { |_duration| sleep_called = true }
+
+    @provider.send(:throttle_request)
+
+    assert sleep_called, "Should have called sleep when credit limit exceeded"
+  end
+
+  test "throttle_request does not wait when under credit limit" do
+    # Set last_request_time far in the past so per-instance throttle doesn't trigger
+    @provider.send(:instance_variable_set, :@last_request_time, Time.at(0))
+
+    # Stub cache to return under limit
+    Rails.cache.stubs(:read).returns(3)
+    Rails.cache.stubs(:increment).returns(4)
+
+    sleep_called = false
+    @provider.define_singleton_method(:sleep) { |_duration| sleep_called = true }
+
+    @provider.send(:throttle_request)
+
+    assert_not sleep_called, "Should not sleep when under credit limit"
+  end
+end
diff --git a/test/models/provider/yahoo_finance_test.rb b/test/models/provider/yahoo_finance_test.rb
index 6dd0d30a2..da7ae6eb0 100644
--- a/test/models/provider/yahoo_finance_test.rb
+++ b/test/models/provider/yahoo_finance_test.rb
@@ -367,4 +367,107 @@ class Provider::YahooFinanceTest < ActiveSupport::TestCase
     assert_equal "EUR", currency
     assert_equal 75.75, price
   end
+
+  # ================================
+  #   Exchange Mapping Tests
+  # ================================
+
+  test "map_exchange_mic returns XNSE for NSE and NSI" do
+    assert_equal "XNSE", @provider.send(:map_exchange_mic, "NSE")
+    assert_equal "XNSE", @provider.send(:map_exchange_mic, "NSI")
+    assert_equal "XNSE", @provider.send(:map_exchange_mic, "nse")
+  end
+
+  test "map_exchange_mic returns XBOM for BSE and BOM" do
+    assert_equal "XBOM", @provider.send(:map_exchange_mic, "BSE")
+    assert_equal "XBOM", @provider.send(:map_exchange_mic, "BOM")
+  end
+
+  test "map_country_code returns IN for Indian exchanges" do
+    assert_equal "IN", @provider.send(:map_country_code, "NSE")
+    assert_equal "IN", @provider.send(:map_country_code, "BSE")
+    assert_equal "IN", @provider.send(:map_country_code, "MUMBAI")
+  end
+
+  # ================================
+  #   normalize_symbol Tests
+  # ================================
+
+  test "normalize_symbol appends configured suffix for known MICs" do
+    assert_equal "RELIANCE.NS", @provider.send(:normalize_symbol, "RELIANCE", "XNSE")
+    assert_equal "INFY.NS",     @provider.send(:normalize_symbol, "INFY", "XNSE")
+    assert_equal "500325.BO",   @provider.send(:normalize_symbol, "500325", "XBOM")
+  end
+
+  test "normalize_symbol does not double-suffix already suffixed symbols" do
+    assert_equal "RELIANCE.NS", @provider.send(:normalize_symbol, "RELIANCE.NS", "XNSE")
+    assert_equal "500325.BO",   @provider.send(:normalize_symbol, "500325.BO", "XBOM")
+  end
+
+  test "normalize_symbol leaves unconfigured MIC symbols unchanged" do
+    assert_equal "AAPL", @provider.send(:normalize_symbol, "AAPL", "XNAS")
+    assert_equal "BARC", @provider.send(:normalize_symbol, "BARC", "XLON")
+    assert_equal "AAPL", @provider.send(:normalize_symbol, "AAPL", nil)
+  end
+
+  test "normalize_symbol appends suffix to dotted symbols that do not already end with the configured suffix" do
+    assert_equal "BRK.A.NS", @provider.send(:normalize_symbol, "BRK.A", "XNSE")
+    assert_equal "BRK.B.BO", @provider.send(:normalize_symbol, "BRK.B", "XBOM")
+  end
+
+  # ================================
+  #  default_currency_for_exchange Tests
+  # ================================
+
+  test "default_currency_for_exchange returns configured currency for known Yahoo exchange names" do
+    assert_equal "INR", @provider.send(:default_currency_for_exchange, "NSE")
+    assert_equal "INR", @provider.send(:default_currency_for_exchange, "BSE")
+  end
+
+  test "default_currency_for_exchange returns nil for unknown exchanges" do
+    assert_nil @provider.send(:default_currency_for_exchange, "UNKNOWN")
+    assert_nil @provider.send(:default_currency_for_exchange, "NMS")
+  end
+
+  # ================================
+  #  deduplicate_dual_listings Tests
+  # ================================
+
+  test "deduplicate_dual_listings keeps preferred exchange when both are present" do
+    nse = Provider::SecurityConcept::Security.new(symbol: "RELIANCE.NS", name: "Reliance", logo_url: nil, exchange_operating_mic: "XNSE", country_code: "IN")
+    bse = Provider::SecurityConcept::Security.new(symbol: "500325.BO",   name: "Reliance", logo_url: nil, exchange_operating_mic: "XBOM", country_code: "IN")
+    other = Provider::SecurityConcept::Security.new(symbol: "OTHER", name: "Other", logo_url: nil, exchange_operating_mic: "XNAS", country_code: "US")
+
+    result = @provider.send(:deduplicate_dual_listings, [ nse, bse, other ])
+
+    assert_equal "XNSE", result.first.exchange_operating_mic
+    assert_not result.map(&:exchange_operating_mic).include?("XBOM"), "Lower-ranked exchange should be removed"
+    assert result.map(&:exchange_operating_mic).include?("XNAS"), "Non-dual-listed exchanges should be preserved"
+  end
+
+  test "deduplicate_dual_listings preserves unrelated securities in the same dual_list_group" do
+    reliance_nse = Provider::SecurityConcept::Security.new(symbol: "RELIANCE.NS", name: "Reliance Industries", logo_url: nil, exchange_operating_mic: "XNSE", country_code: "IN")
+    reliance_bse = Provider::SecurityConcept::Security.new(symbol: "500325.BO",   name: "Reliance Industries", logo_url: nil, exchange_operating_mic: "XBOM", country_code: "IN")
+    infy_nse     = Provider::SecurityConcept::Security.new(symbol: "INFY.NS",     name: "Infosys",             logo_url: nil, exchange_operating_mic: "XNSE", country_code: "IN")
+    other        = Provider::SecurityConcept::Security.new(symbol: "AAPL",        name: "Apple",               logo_url: nil, exchange_operating_mic: "XNAS", country_code: "US")
+
+    result = @provider.send(:deduplicate_dual_listings, [ reliance_nse, reliance_bse, infy_nse, other ])
+
+    symbols = result.map(&:symbol)
+    assert_includes symbols, "RELIANCE.NS", "Preferred listing should be kept"
+    assert_not_includes symbols, "500325.BO", "Duplicate listing should be removed"
+    assert_includes symbols, "INFY.NS", "Unrelated security in same group should be preserved"
+    assert_includes symbols, "AAPL", "Non-dual-listed security should be preserved"
+    assert_equal 3, result.size
+  end
+
+  test "deduplicate_dual_listings returns original list when no dual-listed exchanges present" do
+    securities = [
+      Provider::SecurityConcept::Security.new(symbol: "AAPL", name: "Apple", logo_url: nil, exchange_operating_mic: "XNAS", country_code: "US"),
+      Provider::SecurityConcept::Security.new(symbol: "MSFT", name: "Microsoft", logo_url: nil, exchange_operating_mic: "XNAS", country_code: "US")
+    ]
+
+    result = @provider.send(:deduplicate_dual_listings, securities)
+    assert_equal securities, result
+  end
 end
diff --git a/test/models/provider_connection_status_test.rb b/test/models/provider_connection_status_test.rb
new file mode 100644
index 000000000..fa243a715
--- /dev/null
+++ b/test/models/provider_connection_status_test.rb
@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class ProviderConnectionStatusTest < ActiveSupport::TestCase
+  test "provider registry covers syncable family provider item associations" do
+    expected_registry = Family.reflect_on_all_associations(:has_many).filter_map do |association|
+      next unless association.name.to_s.end_with?("_items")
+      next unless association.klass.included_modules.include?(Syncable)
+
+      { association: association.name, type: association.klass.name }
+    end
+
+    registered_registry = ProviderConnectionStatus::PROVIDERS.map do |provider|
+      { association: provider[:association], type: provider[:type] }
+    end
+
+    assert_equal expected_registry.sort_by { |entry| entry[:association].to_s },
+                 registered_registry.sort_by { |entry| entry[:association].to_s }
+  end
+
+  test "status summary is computed without calling provider item summary" do
+    provider = ProviderConnectionStatus::PROVIDERS.find { |entry| entry[:association] == :mercury_items }
+    item = mercury_items(:one)
+    completed_sync = item.syncs.create!(
+      status: "completed",
+      created_at: 1.hour.ago,
+      completed_at: 1.hour.ago,
+      sync_stats: {
+        total_accounts: 2,
+        linked_accounts: 1,
+        unlinked_accounts: 1
+      }
+    )
+    failed_sync = item.syncs.create!(
+      status: "failed",
+      created_at: Time.current,
+      failed_at: Time.current,
+      sync_stats: {
+        total_accounts: 9,
+        linked_accounts: 9,
+        unlinked_accounts: 0
+      }
+    )
+
+    item.expects(:sync_status_summary).never
+
+    status = ProviderConnectionStatus.new(
+      provider,
+      item,
+      latest_sync: failed_sync,
+      latest_completed_sync: completed_sync,
+      syncing: false
+    ).to_h
+
+    assert_equal "1 synced, 1 need setup", status.dig(:sync, :status_summary)
+    assert_equal failed_sync.id, status.dig(:sync, :latest, :id)
+  end
+
+  test "account counts use provider account links instead of linked account fallback" do
+    provider = ProviderConnectionStatus::PROVIDERS.find { |entry| entry[:association] == :mercury_items }
+    item = mercury_items(:one)
+    linked_provider_account = item.mercury_accounts.create!(
+      account_id: "merc_acc_savings_2",
+      name: "Mercury Savings",
+      currency: "USD"
+    )
+    AccountProvider.create!(
+      account: accounts(:other_asset),
+      provider: linked_provider_account
+    )
+
+    item.association(:mercury_accounts).reset
+
+    status = ProviderConnectionStatus.new(provider, item, syncing: false).to_h
+
+    assert_equal 2, status.dig(:accounts, :total_count)
+    assert_equal 1, status.dig(:accounts, :linked_count)
+    assert_equal 1, status.dig(:accounts, :unlinked_count)
+  end
+
+  test "kraken provider status is included without credential fields" do
+    statuses = ProviderConnectionStatus.for_family(families(:dylan_family))
+    kraken_status = statuses.find { |status| status[:provider] == "kraken" }
+
+    assert kraken_status
+    assert_equal "KrakenItem", kraken_status[:provider_type]
+    refute_includes kraken_status.keys, :api_key
+    refute_includes kraken_status.keys, :api_secret
+    assert_equal true, kraken_status[:credentials_configured]
+  end
+end
diff --git a/test/models/recurring_transaction_test.rb b/test/models/recurring_transaction_test.rb
index 7b1b506f6..20c8a28ae 100644
--- a/test/models/recurring_transaction_test.rb
+++ b/test/models/recurring_transaction_test.rb
@@ -9,6 +9,39 @@ class RecurringTransactionTest < ActiveSupport::TestCase
     @family.recurring_transactions.destroy_all
   end
 
+  test "status is required" do
+    recurring = @family.recurring_transactions.build(
+      account: @account,
+      merchant: @merchant,
+      amount: 29.99,
+      currency: "USD",
+      expected_day_of_month: 15,
+      last_occurrence_date: Date.current,
+      next_expected_date: 1.month.from_now.to_date,
+      status: nil
+    )
+
+    assert_not recurring.valid?
+    assert_includes recurring.errors[:status], "can't be blank"
+  end
+
+  test "occurrence count cannot be negative" do
+    recurring = @family.recurring_transactions.build(
+      account: @account,
+      merchant: @merchant,
+      amount: 29.99,
+      currency: "USD",
+      expected_day_of_month: 15,
+      last_occurrence_date: Date.current,
+      next_expected_date: 1.month.from_now.to_date,
+      status: "active",
+      occurrence_count: -1
+    )
+
+    assert_not recurring.valid?
+    assert_includes recurring.errors[:occurrence_count], "must be greater than or equal to 0"
+  end
+
   test "identify_patterns_for creates recurring transactions for patterns with 3+ occurrences" do
     # Create a series of transactions with same merchant and amount on similar days
     # Use dates within the last 3 months: today, 1 month ago, 2 months ago
@@ -705,4 +738,326 @@ class RecurringTransactionTest < ActiveSupport::TestCase
     assert recurring_b.present?
     assert_not_equal recurring_a, recurring_b
   end
+
+  # ----- Recurring transfers (issue #895 / discussion #1224) -----
+
+  test "transfer? is false when destination_account is absent" do
+    rt = @family.recurring_transactions.create!(
+      account: @account,
+      name: "Spotify",
+      amount: 9.99,
+      currency: "USD",
+      expected_day_of_month: 5,
+      last_occurrence_date: Date.current,
+      next_expected_date: 5.days.from_now.to_date,
+      manual: true
+    )
+    assert_not rt.transfer?
+  end
+
+  test "transfer? is true when destination_account is present" do
+    destination = accounts(:credit_card)
+    rt = @family.recurring_transactions.create!(
+      account: @account,
+      destination_account: destination,
+      name: "Transfer to #{destination.name}",
+      amount: 500,
+      currency: "USD",
+      expected_day_of_month: 1,
+      last_occurrence_date: Date.current,
+      next_expected_date: 1.month.from_now.to_date,
+      manual: true
+    )
+    assert rt.transfer?
+  end
+
+  test "validation rejects same source and destination accounts" do
+    rt = @family.recurring_transactions.build(
+      account: @account,
+      destination_account: @account,
+      name: "Self-transfer",
+      amount: 100,
+      currency: "USD",
+      expected_day_of_month: 1,
+      last_occurrence_date: Date.current,
+      next_expected_date: 1.month.from_now.to_date,
+      manual: true
+    )
+    assert_not rt.valid?
+    assert_includes rt.errors[:destination_account], "cannot be the same as the source account"
+  end
+
+  test "validation rejects dangling source account_id (account does not exist)" do
+    rt = @family.recurring_transactions.build(
+      account_id: SecureRandom.uuid, # references nothing
+      destination_account: accounts(:credit_card),
+      name: "Phantom source",
+      amount: 100,
+      currency: "USD",
+      expected_day_of_month: 1,
+      last_occurrence_date: Date.current,
+      next_expected_date: 1.month.from_now.to_date,
+      manual: true
+    )
+    assert_not rt.valid?
+    assert_includes rt.errors[:account], "must exist"
+  end
+
+  test "validation rejects dangling destination_account_id (account does not exist)" do
+    rt = @family.recurring_transactions.build(
+      account: @account,
+      destination_account_id: SecureRandom.uuid, # references nothing
+      name: "Phantom transfer",
+      amount: 100,
+      currency: "USD",
+      expected_day_of_month: 1,
+      last_occurrence_date: Date.current,
+      next_expected_date: 1.month.from_now.to_date,
+      manual: true
+    )
+    assert_not rt.valid?
+    assert_includes rt.errors[:destination_account], "must exist"
+  end
+
+  test "validation rejects destination on different family" do
+    other_family = Family.create!(name: "Other", locale: "en", date_format: "%Y-%m-%d", currency: "USD")
+    other_account = other_family.accounts.create!(name: "Other depository", balance: 0, currency: "USD", accountable: Depository.new)
+
+    rt = @family.recurring_transactions.build(
+      account: @account,
+      destination_account: other_account,
+      name: "Foreign transfer",
+      amount: 100,
+      currency: "USD",
+      expected_day_of_month: 1,
+      last_occurrence_date: Date.current,
+      next_expected_date: 1.month.from_now.to_date,
+      manual: true
+    )
+    assert_not rt.valid?
+    assert_includes rt.errors[:destination_account], "must belong to the same family as the source account"
+  end
+
+  test "create_from_transfer builds a recurring transfer with both endpoints" do
+    source = @account
+    destination = accounts(:credit_card)
+
+    outflow_entry = source.entries.create!(
+      date: 5.days.ago.to_date, amount: 250, currency: "USD",
+      name: "Manual transfer",
+      entryable: Transaction.new(kind: "standard")
+    )
+    inflow_entry = destination.entries.create!(
+      date: 5.days.ago.to_date, amount: -250, currency: "USD",
+      name: "Manual transfer",
+      entryable: Transaction.new(kind: "standard")
+    )
+    transfer = Transfer.create!(
+      outflow_transaction: outflow_entry.entryable,
+      inflow_transaction: inflow_entry.entryable
+    )
+
+    rt = RecurringTransaction.create_from_transfer(transfer)
+
+    assert rt.transfer?
+    assert_equal source, rt.account
+    assert_equal destination, rt.destination_account
+    assert_equal 250, rt.amount
+    assert_equal "USD", rt.currency
+    assert_equal 5.days.ago.to_date.day, rt.expected_day_of_month
+    assert rt.manual?
+    assert_equal "active", rt.status
+  end
+
+  test "projected_entry exposes source and destination on a recurring transfer" do
+    destination = accounts(:credit_card)
+    rt = @family.recurring_transactions.create!(
+      account: @account,
+      destination_account: destination,
+      name: "Transfer to #{destination.name}",
+      amount: 500,
+      currency: "USD",
+      expected_day_of_month: 15,
+      last_occurrence_date: Date.current,
+      next_expected_date: 15.days.from_now.to_date,
+      manual: true
+    )
+
+    projected = rt.projected_entry
+    assert projected.transfer
+    assert_equal @account, projected.source_account
+    assert_equal destination, projected.destination_account
+    assert_equal 500, projected.amount
+    assert_equal "USD", projected.currency
+  end
+
+  test "Identifier skips transfer-kind transactions" do
+    # Three depository transactions tagged as funds_movement (e.g. they're
+    # one half of a Transfer pair). Identifier shouldn't latch onto these
+    # as a single-account "pattern" because the underlying flow is two-
+    # account and is tracked on a different shape (destination_account_id).
+    [ 0, 1, 2 ].each do |months_ago|
+      transaction = Transaction.create!(merchant: @merchant, kind: "funds_movement")
+      @account.entries.create!(
+        date: months_ago.months.ago.beginning_of_month + 5.days,
+        amount: 50.00,
+        currency: "USD",
+        name: "Recurring transfer half",
+        entryable: transaction
+      )
+    end
+
+    assert_no_difference "@family.recurring_transactions.count" do
+      RecurringTransaction.identify_patterns_for!(@family)
+    end
+  end
+
+  test "Identifier creates a pattern from expense halves while ignoring co-resident transfer halves" do
+    # Same merchant, amount, day-of-month: 3 standard expenses + 3 transfer halves.
+    # Without the TRANSFER_KINDS filter, the identifier would either double-count
+    # (six occurrences) or surface a weird pattern. With the filter, only the
+    # expense pattern is created.
+    [ 0, 1, 2 ].each do |months_ago|
+      base_date = months_ago.months.ago.beginning_of_month + 5.days
+
+      @account.entries.create!(
+        date: base_date, amount: 50.00, currency: "USD", name: "Coffee",
+        entryable: Transaction.create!(merchant: @merchant, kind: "standard")
+      )
+      @account.entries.create!(
+        date: base_date, amount: 50.00, currency: "USD", name: "Half of transfer",
+        entryable: Transaction.create!(merchant: @merchant, kind: "funds_movement")
+      )
+    end
+
+    assert_difference "@family.recurring_transactions.count", 1 do
+      RecurringTransaction.identify_patterns_for!(@family)
+    end
+    assert_nil @family.recurring_transactions.last.destination_account_id
+  end
+
+  test "create_from_transfer name reflects Transfer#name (Payment vs Transfer based on destination)" do
+    # Transfer#name returns "Payment to ..." for liability destinations
+    # and "Transfer to ..." otherwise, mirroring Transfer::Creator's
+    # name_prefix logic. The recurring row should pick that up rather
+    # than hard-coding "Transfer to ...".
+    source = @account
+    cc_destination = accounts(:credit_card) # liability
+    outflow = source.entries.create!(
+      date: 5.days.ago.to_date, amount: 100, currency: "USD",
+      name: "raw", entryable: Transaction.new(kind: "standard")
+    )
+    inflow = cc_destination.entries.create!(
+      date: 5.days.ago.to_date, amount: -100, currency: "USD",
+      name: "raw", entryable: Transaction.new(kind: "standard")
+    )
+    transfer = Transfer.create!(
+      outflow_transaction: outflow.entryable, inflow_transaction: inflow.entryable
+    )
+
+    rt = RecurringTransaction.create_from_transfer(transfer)
+    assert_equal "Payment to #{cc_destination.name}", rt.name
+  end
+
+  test "create_from_transfer stores source-side currency on multi-currency transfers" do
+    source = @account # USD depository
+    destination = @family.accounts.create!(
+      name: "EUR cash", balance: 0, currency: "EUR", accountable: Depository.new
+    )
+    outflow_entry = source.entries.create!(
+      date: 5.days.ago.to_date, amount: 100, currency: "USD",
+      name: "FX transfer", entryable: Transaction.new(kind: "standard")
+    )
+    inflow_entry = destination.entries.create!(
+      date: 5.days.ago.to_date, amount: -92, currency: "EUR",
+      name: "FX transfer", entryable: Transaction.new(kind: "standard")
+    )
+    transfer = Transfer.create!(
+      outflow_transaction: outflow_entry.entryable,
+      inflow_transaction: inflow_entry.entryable
+    )
+
+    rt = RecurringTransaction.create_from_transfer(transfer)
+    assert_equal "USD", rt.currency, "stores source-side currency"
+    assert_equal 100, rt.amount,    "stores source-side amount"
+  end
+
+  test "destroying the destination account cascades to inbound recurring transfers" do
+    source = @account
+    destination = accounts(:credit_card)
+    rt = @family.recurring_transactions.create!(
+      account: source, destination_account: destination,
+      name: "Transfer to CC", amount: 250, currency: "USD",
+      expected_day_of_month: 1, last_occurrence_date: Date.current,
+      next_expected_date: 1.month.from_now.to_date, manual: true
+    )
+
+    assert_difference -> { RecurringTransaction.count }, -1 do
+      destination.destroy
+    end
+    assert_not RecurringTransaction.exists?(rt.id)
+  end
+
+  test "Cleaner skips recurring transfers so they aren't mistakenly marked inactive" do
+    # `matching_transactions` is single-account name/amount-based and never
+    # matches a Transfer pair, so without the skip the recurring transfer
+    # would flip to inactive at the 6-month threshold even when the user
+    # is still doing the transfer monthly. Issue #1590 tracks the proper
+    # pair-detection fix.
+    rt = @family.recurring_transactions.create!(
+      account: @account, destination_account: accounts(:credit_card),
+      name: "Transfer to CC", amount: 250, currency: "USD",
+      expected_day_of_month: 5,
+      last_occurrence_date: 7.months.ago.to_date,
+      next_expected_date: 5.days.from_now.to_date,
+      manual: true
+    )
+    assert rt.should_be_inactive?, "guard sanity: row would be marked inactive without the skip"
+
+    RecurringTransaction.cleanup_stale_for(@family)
+    assert_equal "active", rt.reload.status
+  end
+
+  test "Identifier#update_manual_recurring_transactions skips recurring transfers" do
+    # Same reasoning as the Cleaner skip. Without the guard, the helper
+    # would call find_matching_transaction_entries (single-account, by
+    # name) on a transfer row and silently overwrite its variance /
+    # occurrence_count with []. The variance fields should stay nil.
+    rt = @family.recurring_transactions.create!(
+      account: @account, destination_account: accounts(:credit_card),
+      name: "Transfer to CC", amount: 500, currency: "USD",
+      expected_day_of_month: 1,
+      last_occurrence_date: Date.current,
+      next_expected_date: 1.month.from_now.to_date,
+      manual: true,
+      occurrence_count: 7
+    )
+
+    RecurringTransaction.identify_patterns_for!(@family)
+
+    rt.reload
+    assert_nil rt.expected_amount_min
+    assert_nil rt.expected_amount_max
+    assert_nil rt.expected_amount_avg
+    assert_equal 7, rt.occurrence_count, "occurrence_count must not be overwritten by the manual-recurring update path"
+  end
+
+  test "unique partial index still de-duplicates non-transfer recurring rows after destination widening" do
+    base_attrs = {
+      account: @account,
+      merchant: @merchant,
+      amount: 15.99,
+      currency: "USD",
+      expected_day_of_month: 5,
+      last_occurrence_date: Date.current,
+      next_expected_date: 1.month.from_now.to_date,
+      manual: false,
+      occurrence_count: 3
+    }
+    @family.recurring_transactions.create!(base_attrs)
+
+    assert_raises(ActiveRecord::RecordNotUnique) do
+      @family.recurring_transactions.create!(base_attrs)
+    end
+  end
 end
diff --git a/test/models/security/health_checker_test.rb b/test/models/security/health_checker_test.rb
index a8efe8f7d..aef6a6c7a 100644
--- a/test/models/security/health_checker_test.rb
+++ b/test/models/security/health_checker_test.rb
@@ -11,7 +11,7 @@ class Security::HealthCheckerTest < ActiveSupport::TestCase
     Security.delete_all
 
     @provider = mock
-    Security.stubs(:provider).returns(@provider)
+    Security.any_instance.stubs(:price_data_provider).returns(@provider)
 
     # Brand new, no health check has been run yet
     @new_security = Security.create!(
diff --git a/test/models/security/price/importer_test.rb b/test/models/security/price/importer_test.rb
index 6a2fb8c42..547c4eb88 100644
--- a/test/models/security/price/importer_test.rb
+++ b/test/models/security/price/importer_test.rb
@@ -81,6 +81,271 @@ class Security::Price::ImporterTest < ActiveSupport::TestCase
     ).import_provider_prices
   end
 
+  test "logs provider fetch failures to debug log" do
+    Security::Price.delete_all
+
+    error = Provider::Error.new("Rate limit exceeded")
+
+    @provider.stubs(:fetch_security_prices).returns(provider_error_response(error))
+
+    assert_difference "DebugLogEntry.count", 1 do
+      Security::Price::Importer.new(
+        security: @security,
+        security_provider: @provider,
+        start_date: 2.days.ago.to_date,
+        end_date: Date.current
+      ).import_provider_prices
+    end
+
+    entry = DebugLogEntry.order(:created_at).last
+    assert_equal "security_price_fetch", entry.category
+    assert_equal "warn", entry.level
+    assert_equal "Could not fetch prices for ticker", entry.message
+    assert_equal "security/price/importer", entry.source.underscore
+    assert_equal @security.id, entry.metadata["security_id"]
+    assert_equal @security.ticker, entry.metadata["ticker"]
+    assert_equal "Rate limit exceeded", entry.metadata["provider_error"]
+  end
+
+  test "writes post-listing prices when holding predates provider history" do
+    # Regression: a 2018-06-15 trade for a pair the provider only has from
+    # 2020-01-03 onwards (e.g. BTCEUR on Binance) used to hit the
+    # `return 0` bail in start_price_value and write zero rows for the
+    # entire range. The fallback now advances fill_start_date to the
+    # earliest provider date and writes all post-listing prices.
+    Security::Price.delete_all
+
+    start_date = Date.parse("2018-06-15")
+    listing    = Date.parse("2020-01-03")
+    end_date   = listing + 2.days
+
+    provider_response = provider_success_response([
+      OpenStruct.new(security: @security, date: listing,           price: 6568, currency: "EUR"),
+      OpenStruct.new(security: @security, date: listing + 1.day,   price: 6700, currency: "EUR"),
+      OpenStruct.new(security: @security, date: listing + 2.days,  price: 6800, currency: "EUR")
+    ])
+
+    @provider.expects(:fetch_security_prices)
+             .with(symbol: @security.ticker, exchange_operating_mic: @security.exchange_operating_mic,
+                   start_date: get_provider_fetch_start_date(start_date), end_date: end_date)
+             .returns(provider_response)
+
+    upserted = Security::Price::Importer.new(
+      security: @security,
+      security_provider: @provider,
+      start_date: start_date,
+      end_date: end_date
+    ).import_provider_prices
+
+    db_prices = Security::Price.where(security: @security).order(:date)
+
+    # Post-listing rows are all written
+    assert_equal 3, db_prices.count
+    assert_equal [ listing, listing + 1.day, listing + 2.days ], db_prices.map(&:date)
+    assert_equal [ 6568, 6700, 6800 ], db_prices.map { |p| p.price.to_i }
+    assert db_prices.all? { |p| p.currency == "EUR" }
+
+    # Pre-listing gap is intentionally empty — no rows written before the
+    # earliest available provider price.
+    assert_equal 0, Security::Price.where(security: @security).where("date < ?", listing).count
+
+    assert_equal 3, upserted
+
+    # The earliest-available date is persisted on the Security so the next
+    # sync can short-circuit via all_prices_exist? instead of re-iterating
+    # the full (start_date..end_date) range every run.
+    assert_equal listing, @security.reload.first_provider_price_on
+  end
+
+  test "pre-listing fallback picks earliest VALID provider row, skipping nil/zero leaders" do
+    # Regression: if the provider returns a row with a nil/zero price as its
+    # earliest entry (e.g. a listing-day or halted-day placeholder), the
+    # fallback used to bail with MissingStartPriceError and drop every later
+    # valid row. It must now skip past invalid leaders and anchor on the
+    # earliest positive-price row instead.
+    Security::Price.delete_all
+
+    start_date = Date.parse("2018-06-15")
+    listing    = Date.parse("2020-01-03")
+    end_date   = listing + 3.days
+
+    provider_response = provider_success_response([
+      OpenStruct.new(security: @security, date: listing,           price: 0,    currency: "EUR"),
+      OpenStruct.new(security: @security, date: listing + 1.day,   price: nil,  currency: "EUR"),
+      OpenStruct.new(security: @security, date: listing + 2.days,  price: 6700, currency: "EUR"),
+      OpenStruct.new(security: @security, date: listing + 3.days,  price: 6800, currency: "EUR")
+    ])
+
+    @provider.expects(:fetch_security_prices)
+             .with(symbol: @security.ticker, exchange_operating_mic: @security.exchange_operating_mic,
+                   start_date: get_provider_fetch_start_date(start_date), end_date: end_date)
+             .returns(provider_response)
+
+    upserted = Security::Price::Importer.new(
+      security: @security,
+      security_provider: @provider,
+      start_date: start_date,
+      end_date: end_date
+    ).import_provider_prices
+
+    # 2 valid provider rows + LOCF for each of the 2 invalid dates before them
+    # would ALSO get skipped entirely since fill_start_date advances past them
+    # (honest gap before earliest VALID date).
+    db_prices = Security::Price.where(security: @security).order(:date)
+    assert_equal 2, db_prices.count
+    assert_equal [ listing + 2.days, listing + 3.days ], db_prices.map(&:date)
+    assert_equal [ 6700, 6800 ], db_prices.map { |p| p.price.to_i }
+
+    assert_equal 2, upserted
+    assert_equal listing + 2.days, @security.reload.first_provider_price_on
+  end
+
+  test "first_provider_price_on is moved earlier when provider extends backward coverage" do
+    # Regression: a previous sync captured first_provider_price_on = 2024-10-01
+    # (e.g. provider only had limited history then). The provider has now
+    # backfilled earlier data. A clear_cache sync should detect the new
+    # earlier date and update the column so subsequent non-clear_cache
+    # syncs use the correct wider clamp.
+    Security::Price.delete_all
+
+    @security.update!(first_provider_price_on: Date.parse("2024-10-01"))
+
+    start_date = Date.parse("2018-06-15")
+    earlier    = Date.parse("2020-01-03")
+    end_date   = earlier + 2.days
+
+    provider_response = provider_success_response([
+      OpenStruct.new(security: @security, date: earlier,          price: 6568, currency: "EUR"),
+      OpenStruct.new(security: @security, date: earlier + 1.day,  price: 6700, currency: "EUR"),
+      OpenStruct.new(security: @security, date: earlier + 2.days, price: 6800, currency: "EUR")
+    ])
+
+    @provider.expects(:fetch_security_prices)
+             .with(symbol: @security.ticker, exchange_operating_mic: @security.exchange_operating_mic,
+                   start_date: get_provider_fetch_start_date(start_date), end_date: end_date)
+             .returns(provider_response)
+
+    Security::Price::Importer.new(
+      security: @security,
+      security_provider: @provider,
+      start_date: start_date,
+      end_date: end_date,
+      clear_cache: true
+    ).import_provider_prices
+
+    assert_equal earlier, @security.reload.first_provider_price_on
+  end
+
+  test "first_provider_price_on is NOT moved forward when provider shrinks coverage" do
+    # Provider previously had data back to 2020-01-03, which we captured.
+    # A later clear_cache sync discovers the provider can now only serve
+    # from 2022-06-01 (e.g. free tier shrunk). We must NOT move the column
+    # forward, since that would silently hide older rows already in the DB.
+    Security::Price.delete_all
+
+    @security.update!(first_provider_price_on: Date.parse("2020-01-03"))
+
+    start_date = Date.parse("2018-06-15")
+    later      = Date.parse("2022-06-01")
+    end_date   = later + 2.days
+
+    provider_response = provider_success_response([
+      OpenStruct.new(security: @security, date: later,          price: 20000, currency: "EUR"),
+      OpenStruct.new(security: @security, date: later + 1.day,  price: 20500, currency: "EUR"),
+      OpenStruct.new(security: @security, date: later + 2.days, price: 21000, currency: "EUR")
+    ])
+
+    @provider.expects(:fetch_security_prices)
+             .with(symbol: @security.ticker, exchange_operating_mic: @security.exchange_operating_mic,
+                   start_date: get_provider_fetch_start_date(start_date), end_date: end_date)
+             .returns(provider_response)
+
+    Security::Price::Importer.new(
+      security: @security,
+      security_provider: @provider,
+      start_date: start_date,
+      end_date: end_date,
+      clear_cache: true
+    ).import_provider_prices
+
+    # Column stays at the earlier stored value — shrink is ignored.
+    assert_equal Date.parse("2020-01-03"), @security.reload.first_provider_price_on
+  end
+
+  test "incremental sync on pre-listing holding does NOT re-fetch pre-listing window" do
+    # Regression: when first_provider_price_on was set but a new day was
+    # missing (typical daily sync), effective_start_date iterated from the
+    # original (unclamped) start_date and immediately found the pre-listing
+    # date missing. That caused the provider to be called with the full
+    # pre-listing start_date every sync AND the gap-fill loop to re-upsert
+    # every row from listing..end_date. The clamp must shrink the iteration
+    # window to (first_provider_price_on..end_date).
+    Security::Price.delete_all
+
+    travel_to Date.parse("2024-06-01") do
+      listing    = Date.parse("2024-05-25")
+      start_date = Date.parse("2018-06-15")
+      end_date   = Date.current
+
+      @security.update!(first_provider_price_on: listing)
+      (listing..(end_date - 1.day)).each do |d|
+        Security::Price.create!(security: @security, date: d, price: 6568, currency: "EUR")
+      end
+
+      provider_response = provider_success_response([
+        OpenStruct.new(security: @security, date: end_date, price: 70_000, currency: "EUR")
+      ])
+
+      # After fix: provider is called with start_date = clamped_start_date - 7 days,
+      # NOT with the original pre-listing start_date - 7 days (= 2018-06-08).
+      @provider.expects(:fetch_security_prices)
+               .with(
+                 symbol: @security.ticker,
+                 exchange_operating_mic: @security.exchange_operating_mic,
+                 start_date: end_date - Security::Price::Importer::PROVISIONAL_LOOKBACK_DAYS.days,
+                 end_date: end_date
+               )
+               .returns(provider_response)
+
+      upserted = Security::Price::Importer.new(
+        security: @security,
+        security_provider: @provider,
+        start_date: start_date,
+        end_date: end_date
+      ).import_provider_prices
+
+      # Only today's row is upserted — not the full (listing..end_date) range.
+      assert_equal 1, upserted
+    end
+  end
+
+  test "skips re-sync for pre-listing holding once first_provider_price_on is set" do
+    # Previous sync already advanced the clamp and wrote all post-listing
+    # prices. The next sync should see all_prices_exist? return true (because
+    # expected_count is clamped to [first_provider_price_on, end_date]) and
+    # never call the provider.
+    Security::Price.delete_all
+
+    listing = Date.parse("2020-01-03")
+    end_date = listing + 2.days
+
+    @security.update!(first_provider_price_on: listing)
+    (listing..end_date).each do |date|
+      Security::Price.create!(security: @security, date: date, price: 6568, currency: "EUR")
+    end
+
+    @provider.expects(:fetch_security_prices).never
+
+    result = Security::Price::Importer.new(
+      security: @security,
+      security_provider: @provider,
+      start_date: Date.parse("2018-06-15"),
+      end_date: end_date
+    ).import_provider_prices
+
+    assert_equal 0, result
+  end
+
   test "full upsert if clear_cache is true" do
     Security::Price.delete_all
 
diff --git a/test/models/security/price_test.rb b/test/models/security/price_test.rb
index 6e8e49da1..8214831ac 100644
--- a/test/models/security/price_test.rb
+++ b/test/models/security/price_test.rb
@@ -6,9 +6,8 @@ class Security::PriceTest < ActiveSupport::TestCase
 
   setup do
     @provider = mock
-    Security.stubs(:provider).returns(@provider)
-
     @security = securities(:aapl)
+    @security.stubs(:price_data_provider).returns(@provider)
   end
 
   test "finds single security price in DB" do
diff --git a/test/models/security/provided_test.rb b/test/models/security/provided_test.rb
new file mode 100644
index 000000000..0b06d8d79
--- /dev/null
+++ b/test/models/security/provided_test.rb
@@ -0,0 +1,319 @@
+require "test_helper"
+
+class Security::ProvidedTest < ActiveSupport::TestCase
+  include ProviderTestHelper
+
+  setup do
+    @security = securities(:aapl)
+  end
+
+  # --- search_provider ---
+
+  test "search_provider returns results from multiple providers" do
+    provider_a = mock("provider_a")
+    provider_b = mock("provider_b")
+
+    result_a = Provider::SecurityConcept::Security.new(
+      symbol: "AAPL", name: "Apple Inc", logo_url: nil,
+      exchange_operating_mic: "XNAS", country_code: "US", currency: "USD"
+    )
+    result_b = Provider::SecurityConcept::Security.new(
+      symbol: "AAPL", name: "Apple Inc", logo_url: nil,
+      exchange_operating_mic: "XNAS", country_code: "US", currency: "USD"
+    )
+
+    provider_a.stubs(:class).returns(Provider::TwelveData)
+    provider_b.stubs(:class).returns(Provider::YahooFinance)
+
+    provider_a.expects(:search_securities).with("AAPL").returns(
+      provider_success_response([ result_a ])
+    )
+    provider_b.expects(:search_securities).with("AAPL").returns(
+      provider_success_response([ result_b ])
+    )
+
+    Security.stubs(:providers).returns([ provider_a, provider_b ])
+
+    results = Security.search_provider("AAPL")
+
+    # Same ticker+exchange but different providers → both appear (dedup includes provider key)
+    assert_equal 2, results.size
+    assert results.all? { |s| s.ticker == "AAPL" }
+    providers_in_results = results.map(&:price_provider).sort
+    assert_includes providers_in_results, "twelve_data"
+    assert_includes providers_in_results, "yahoo_finance"
+  end
+
+  test "search_provider deduplicates same ticker+exchange+provider" do
+    provider = mock("provider")
+    provider.stubs(:class).returns(Provider::TwelveData)
+
+    dup_result = Provider::SecurityConcept::Security.new(
+      symbol: "MSFT", name: "Microsoft", logo_url: nil,
+      exchange_operating_mic: "XNAS", country_code: "US", currency: "USD"
+    )
+
+    provider.expects(:search_securities).with("MSFT").returns(
+      provider_success_response([ dup_result, dup_result ])
+    )
+
+    Security.stubs(:providers).returns([ provider ])
+
+    results = Security.search_provider("MSFT")
+    assert_equal 1, results.size
+  end
+
+  test "search_provider returns empty array for blank symbol" do
+    assert_equal [], Security.search_provider("")
+    assert_equal [], Security.search_provider(nil)
+  end
+
+  test "search_provider returns empty array when no providers configured" do
+    Security.stubs(:providers).returns([])
+    assert_equal [], Security.search_provider("AAPL")
+  end
+
+  test "search_provider keeps fast provider results when slow provider times out" do
+    fast_provider = mock("fast_provider")
+    slow_provider = mock("slow_provider")
+
+    fast_provider.stubs(:class).returns(Provider::TwelveData)
+    slow_provider.stubs(:class).returns(Provider::YahooFinance)
+
+    fast_result = Provider::SecurityConcept::Security.new(
+      symbol: "SPY", name: "SPDR S&P 500", logo_url: nil,
+      exchange_operating_mic: "XNAS", country_code: "US", currency: "USD"
+    )
+
+    fast_provider.expects(:search_securities).with("SPY").returns(
+      provider_success_response([ fast_result ])
+    )
+    slow_provider.expects(:search_securities).with("SPY").returns(
+      provider_success_response([])
+    )
+
+    Security.stubs(:providers).returns([ fast_provider, slow_provider ])
+
+    results = Security.search_provider("SPY")
+
+    assert results.size >= 1, "Fast provider results should be returned even if slow provider returns nothing"
+    assert_equal "SPY", results.first.ticker
+  end
+
+  test "search_provider handles provider error gracefully" do
+    good_provider = mock("good_provider")
+    bad_provider = mock("bad_provider")
+
+    good_provider.stubs(:class).returns(Provider::TwelveData)
+    bad_provider.stubs(:class).returns(Provider::YahooFinance)
+
+    good_result = Provider::SecurityConcept::Security.new(
+      symbol: "GOOG", name: "Alphabet", logo_url: nil,
+      exchange_operating_mic: "XNAS", country_code: "US", currency: "USD"
+    )
+
+    good_provider.expects(:search_securities).with("GOOG").returns(
+      provider_success_response([ good_result ])
+    )
+    bad_provider.expects(:search_securities).with("GOOG").raises(StandardError, "API down")
+
+    Security.stubs(:providers).returns([ good_provider, bad_provider ])
+
+    results = Security.search_provider("GOOG")
+
+    assert_equal 1, results.size
+    assert_equal "GOOG", results.first.ticker
+  end
+
+  # --- price_data_provider ---
+
+  test "price_data_provider returns assigned provider" do
+    provider = mock("tiingo_provider")
+    Security.stubs(:provider_for).with("tiingo").returns(provider)
+
+    @security.update!(price_provider: "tiingo")
+
+    assert_equal provider, @security.price_data_provider
+  end
+
+  test "price_data_provider returns nil when assigned provider is disabled" do
+    Security.stubs(:provider_for).with("tiingo").returns(nil)
+
+    @security.update!(price_provider: "tiingo")
+
+    assert_nil @security.price_data_provider
+  end
+
+  test "price_data_provider falls back to first provider when none assigned" do
+    fallback_provider = mock("fallback")
+    Security.stubs(:providers).returns([ fallback_provider ])
+
+    @security.update!(price_provider: nil)
+
+    assert_equal fallback_provider, @security.price_data_provider
+  end
+
+  test "import_provider_details logs provider metadata failures to debug log" do
+    provider = mock("provider")
+    provider.stubs(:class).returns(Provider::TwelveData)
+    provider.stubs(:fetch_security_info).returns(
+      provider_error_response(Provider::Error.new("metadata unavailable"))
+    )
+
+    @security.stubs(:price_data_provider).returns(provider)
+
+    assert_difference "DebugLogEntry.count", 1 do
+      @security.import_provider_details
+    end
+
+    entry = DebugLogEntry.order(:created_at).last
+    assert_equal "security_metadata_fetch", entry.category
+    assert_equal "warn", entry.level
+    assert_equal "Failed to get security info", entry.message
+    assert_equal "security", entry.source.underscore
+    assert_equal @security.id, entry.metadata["security_id"]
+    assert_equal @security.ticker, entry.metadata["ticker"]
+    assert_equal "metadata unavailable", entry.metadata["provider_error"]
+    assert_equal "twelve_data", entry.provider_key
+  end
+
+  # --- provider_status ---
+
+  test "provider_status returns provider_unavailable when assigned provider disabled" do
+    Security.stubs(:provider_for).with("tiingo").returns(nil)
+
+    @security.update!(price_provider: "tiingo")
+
+    assert_equal :provider_unavailable, @security.provider_status
+  end
+
+  test "provider_status returns ok for healthy security" do
+    provider = mock("provider")
+    Security.stubs(:provider_for).with("twelve_data").returns(provider)
+
+    @security.update!(price_provider: "twelve_data", offline: false, failed_fetch_count: 0)
+
+    assert_equal :ok, @security.provider_status
+  end
+
+  # --- rank_search_results ---
+
+  # Helper to build unsaved Security objects for ranking tests
+  def build_result(ticker:, name: nil, country_code: nil, exchange_operating_mic: nil)
+    Security.new(
+      ticker: ticker,
+      name: name || ticker,
+      country_code: country_code,
+      exchange_operating_mic: exchange_operating_mic
+    )
+  end
+
+  def rank(results, query, country_code = nil)
+    Security.send(:rank_search_results, results, query, country_code)
+  end
+
+  test "ranking: AAPL exact match ranks above AAPL-prefixed and unrelated" do
+    results = [
+      build_result(ticker: "AAPLX", name: "Some AAPL Fund"),
+      build_result(ticker: "AAPL", name: "Apple Inc", country_code: "US", exchange_operating_mic: "XNAS"),
+      build_result(ticker: "AAPL", name: "Apple Inc", country_code: "GB", exchange_operating_mic: "XLON"),
+      build_result(ticker: "AAPLD", name: "AAPL Dividend ETF")
+    ]
+
+    ranked = rank(results, "AAPL", "US")
+
+    # Exact matches first, US preferred over GB
+    assert_equal "AAPL", ranked[0].ticker
+    assert_equal "US", ranked[0].country_code
+    assert_equal "AAPL", ranked[1].ticker
+    assert_equal "GB", ranked[1].country_code
+    # Prefix matches after
+    assert ranked[2..].all? { |s| s.ticker.start_with?("AAPL") && s.ticker != "AAPL" }
+  end
+
+  test "ranking: Apple name search surfaces Apple Inc above unrelated" do
+    results = [
+      build_result(ticker: "PINEAPPLE", name: "Pineapple Corp"),
+      build_result(ticker: "AAPL", name: "Apple Inc", country_code: "US"),
+      build_result(ticker: "APLE", name: "Apple Hospitality REIT"),
+      build_result(ticker: "APPL", name: "Appell Petroleum")
+    ]
+
+    ranked = rank(results, "Apple", "US")
+
+    # No ticker matches "APPLE", so all fall to name-contains or worse.
+    # "Apple Inc" and "Apple Hospitality" and "Pineapple" contain "APPLE" in name.
+    # "Appell Petroleum" does not contain "APPLE".
+    # Among name matches, alphabetical ticker breaks ties.
+    name_matches = ranked.select { |s| s.name.upcase.include?("APPLE") }
+    non_matches = ranked.reject { |s| s.name.upcase.include?("APPLE") }
+    assert name_matches.size >= 2
+    assert_equal non_matches, ranked.last(non_matches.size)
+  end
+
+  test "ranking: SPX exact match first, then SPX-prefixed" do
+    results = [
+      build_result(ticker: "SPXL", name: "Direxion Daily S&P 500 Bull 3X"),
+      build_result(ticker: "SPXS", name: "Direxion Daily S&P 500 Bear 3X"),
+      build_result(ticker: "SPX", name: "S&P 500 Index", country_code: "US"),
+      build_result(ticker: "SPXU", name: "ProShares UltraPro Short S&P 500")
+    ]
+
+    ranked = rank(results, "SPX", "US")
+
+    assert_equal "SPX", ranked[0].ticker, "Exact match should be first"
+    assert ranked[1..].all? { |s| s.ticker.start_with?("SPX") }
+  end
+
+  test "ranking: VTTI exact match first regardless of country" do
+    results = [
+      build_result(ticker: "VTI", name: "Vanguard Total Stock Market ETF", country_code: "US"),
+      build_result(ticker: "VTTI", name: "VTTI Energy Partners", country_code: "US"),
+      build_result(ticker: "VTTIX", name: "Vanguard Target 2060 Fund")
+    ]
+
+    ranked = rank(results, "VTTI", "US")
+
+    assert_equal "VTTI", ranked[0].ticker, "Exact match should be first"
+    assert_equal "VTTIX", ranked[1].ticker, "Prefix match second"
+    assert_equal "VTI", ranked[2].ticker, "Non-matching ticker last"
+  end
+
+  test "ranking: iShares S&P multi-word query is contiguous substring match" do
+    results = [
+      build_result(ticker: "IVV", name: "iShares S&P 500 ETF", country_code: "US"),
+      build_result(ticker: "CSPX", name: "iShares Core S&P 500 UCITS ETF", country_code: "GB"),
+      build_result(ticker: "IJH", name: "iShares S&P Mid-Cap ETF", country_code: "US"),
+      build_result(ticker: "UNRELATED", name: "Something Else Corp")
+    ]
+
+    ranked = rank(results, "iShares S&P", "US")
+
+    # Only names containing the exact substring "iShares S&P" match tier 2.
+    # "iShares Core S&P" does NOT match (word "Core" breaks contiguity).
+    contiguous_matches = ranked.select { |s| s.name.upcase.include?("ISHARES S&P") }
+    assert_equal 2, contiguous_matches.size, "Only IVV and IJH contain the exact substring"
+    # US contiguous matches should come first
+    assert_equal "IJH", ranked[0].ticker  # US, name match, alphabetically before IVV? No...
+    assert_includes [ "IVV", "IJH" ], ranked[0].ticker
+    assert_includes [ "IVV", "IJH" ], ranked[1].ticker
+    # Non-contiguous and unrelated should be last
+    assert_equal "UNRELATED", ranked.last.ticker
+  end
+
+  test "ranking: tesla name search finds TSLA" do
+    results = [
+      build_result(ticker: "TSLA", name: "Tesla Inc", country_code: "US"),
+      build_result(ticker: "TSLA", name: "Tesla Inc", country_code: "DE"),
+      build_result(ticker: "TL0", name: "Tesla Inc", country_code: "DE", exchange_operating_mic: "XETR"),
+      build_result(ticker: "TELSA", name: "Telsa Mining Ltd")
+    ]
+
+    ranked = rank(results, "tesla", "US")
+
+    # No ticker matches "TESLA", so all go to name matching
+    # "Tesla Inc" contains "TESLA" → tier 2, US preferred
+    assert_equal "TSLA", ranked[0].ticker
+    assert_equal "US", ranked[0].country_code, "US Tesla should rank first for US user"
+  end
+end
diff --git a/test/models/security/resolver_test.rb b/test/models/security/resolver_test.rb
index 1a557f221..791688e09 100644
--- a/test/models/security/resolver_test.rb
+++ b/test/models/security/resolver_test.rb
@@ -1,11 +1,6 @@
 require "test_helper"
 
 class Security::ResolverTest < ActiveSupport::TestCase
-  setup do
-    @provider = mock
-    Security.stubs(:provider).returns(@provider)
-  end
-
   test "resolves DB security" do
     # Given an existing security in the DB that exactly matches the lookup params
     db_security = Security.create!(ticker: "TSLA", exchange_operating_mic: "XNAS", country_code: "US")
@@ -75,4 +70,141 @@ class Security::ResolverTest < ActiveSupport::TestCase
     assert_raises(ArgumentError) { Security::Resolver.new(nil).resolve }
     assert_raises(ArgumentError) { Security::Resolver.new("").resolve }
   end
+
+  test "persists explicit price_provider on DB match" do
+    db_security = Security.create!(ticker: "CSPX", exchange_operating_mic: "XLON", country_code: "GB")
+
+    Security.expects(:search_provider).never
+    Setting.stubs(:enabled_securities_providers).returns([ "tiingo" ])
+
+    resolved = Security::Resolver.new(
+      "CSPX",
+      exchange_operating_mic: "XLON",
+      country_code: "GB",
+      price_provider: "tiingo"
+    ).resolve
+
+    assert_equal db_security, resolved
+    assert_equal "tiingo", resolved.reload.price_provider
+  end
+
+  test "persists price_provider on provider match" do
+    match = Security.new(ticker: "VWCE", exchange_operating_mic: "XETR", country_code: "DE", price_provider: "eodhd")
+
+    Security.expects(:search_provider)
+            .with("VWCE", exchange_operating_mic: "XETR")
+            .returns([ match ])
+
+    Setting.stubs(:enabled_securities_providers).returns([ "eodhd" ])
+
+    resolved = Security::Resolver.new(
+      "VWCE",
+      exchange_operating_mic: "XETR",
+      price_provider: "eodhd"
+    ).resolve
+
+    assert resolved.persisted?
+    assert_equal "eodhd", resolved.price_provider
+  end
+
+  test "rejects unknown price_provider" do
+    db_security = Security.create!(ticker: "AAPL2", exchange_operating_mic: "XNAS", country_code: "US")
+
+    Security.expects(:search_provider).never
+
+    resolved = Security::Resolver.new(
+      "AAPL2",
+      exchange_operating_mic: "XNAS",
+      country_code: "US",
+      price_provider: "fake_provider"
+    ).resolve
+
+    assert_equal db_security, resolved
+    assert_nil resolved.reload.price_provider, "Unknown providers should be rejected"
+  end
+
+  test "resolves Binance crypto match for a non-AE family" do
+    # Regression: BinancePublic search results carry country_code="AE" (the ISO
+    # 10383 MIC country), but the transactions controller passes the family's
+    # country (e.g. "US"). The resolver used to require an exact country match
+    # for both exact and close paths, so non-AE families would fall through to
+    # offline_security for every Binance pick — the user saw their BTCUSD
+    # holding resolve to an offline security that never fetched prices.
+    binance_match = Security.new(
+      ticker: "BTCUSD",
+      exchange_operating_mic: "BNCX",
+      country_code: nil,
+      price_provider: "binance_public"
+    )
+
+    Security.expects(:search_provider)
+            .with("BTCUSD", exchange_operating_mic: "BNCX", country_code: "US")
+            .returns([ binance_match ])
+
+    Setting.stubs(:enabled_securities_providers).returns([ "binance_public" ])
+
+    resolved = Security::Resolver.new(
+      "BTCUSD",
+      exchange_operating_mic: "BNCX",
+      country_code: "US",
+      price_provider: "binance_public"
+    ).resolve
+
+    assert resolved.persisted?
+    refute resolved.offline, "Binance security must not fall through to offline_security"
+    assert_equal "BTCUSD",         resolved.ticker
+    assert_equal "BNCX",           resolved.exchange_operating_mic
+    assert_equal "binance_public", resolved.price_provider
+  end
+
+  test "resolved provider match is persisted with nil name/logo_url" do
+    # Documents that find_or_create_provider_match! intentionally copies only
+    # ticker, MIC, country_code, and price_provider from the match — not name
+    # or logo_url. This means Security#import_provider_details always has
+    # blank metadata on first resolution and runs fetch_security_info +
+    # probe_brandfetch_crypto_coverage! as expected. Regression guard: if
+    # someone adds name/logo copying to the resolver, the Brandfetch
+    # coverage probe would be bypassed on first sync.
+    match = Security.new(
+      ticker: "BTCUSD",
+      exchange_operating_mic: "BNCX",
+      country_code: nil,
+      name: "BTC",
+      logo_url: "https://cdn.brandfetch.io/crypto/BTC/icon/fallback/lettermark/w/120/h/120?c=test",
+      price_provider: "binance_public"
+    )
+
+    Security.expects(:search_provider)
+            .with("BTCUSD", exchange_operating_mic: "BNCX", country_code: "US")
+            .returns([ match ])
+
+    Setting.stubs(:enabled_securities_providers).returns([ "binance_public" ])
+
+    resolved = Security::Resolver.new(
+      "BTCUSD",
+      exchange_operating_mic: "BNCX",
+      country_code: "US",
+      price_provider: "binance_public"
+    ).resolve
+
+    assert_nil resolved.reload.name, "Resolver must not copy name from the search match"
+    assert_nil resolved.logo_url,    "Resolver must not copy logo_url from the search match"
+  end
+
+  test "rejects disabled price_provider" do
+    db_security = Security.create!(ticker: "GOOG2", exchange_operating_mic: "XNAS", country_code: "US")
+
+    Security.expects(:search_provider).never
+    Setting.stubs(:enabled_securities_providers).returns([ "twelve_data" ])
+
+    resolved = Security::Resolver.new(
+      "GOOG2",
+      exchange_operating_mic: "XNAS",
+      country_code: "US",
+      price_provider: "tiingo"
+    ).resolve
+
+    assert_equal db_security, resolved
+    assert_nil resolved.reload.price_provider, "Disabled providers should be rejected"
+  end
 end
diff --git a/test/models/security_test.rb b/test/models/security_test.rb
index ee18a14fd..0c83483ee 100644
--- a/test/models/security_test.rb
+++ b/test/models/security_test.rb
@@ -68,4 +68,110 @@ class SecurityTest < ActiveSupport::TestCase
 
     assert_not_includes standard_tickers, "CASH-#{account.id.upcase}"
   end
+
+  test "crypto? is true for Binance MIC and false otherwise" do
+    crypto = Security.new(ticker: "BTCUSD", exchange_operating_mic: Provider::BinancePublic::BINANCE_MIC)
+    equity = Security.new(ticker: "AAPL",   exchange_operating_mic: "XNAS")
+    offline = Security.new(ticker: "ACME",  exchange_operating_mic: nil)
+
+    assert crypto.crypto?
+    assert_not equity.crypto?
+    assert_not offline.crypto?
+  end
+
+  test "crypto_base_asset strips the display-currency suffix" do
+    %w[USD EUR JPY BRL TRY].each do |quote|
+      sec = Security.new(ticker: "BTC#{quote}", exchange_operating_mic: Provider::BinancePublic::BINANCE_MIC)
+      assert_equal "BTC", sec.crypto_base_asset, "expected BTC#{quote} -> BTC"
+    end
+  end
+
+  test "crypto_base_asset returns nil for non-crypto securities" do
+    sec = Security.new(ticker: "AAPL", exchange_operating_mic: "XNAS")
+    assert_nil sec.crypto_base_asset
+  end
+
+  test "brandfetch_crypto_url uses the /crypto/ route and current size setting" do
+    Setting.stubs(:brand_fetch_client_id).returns("test-client-id")
+    Setting.stubs(:brand_fetch_logo_size).returns(120)
+
+    assert_equal(
+      "https://cdn.brandfetch.io/crypto/BTC/icon/fallback/lettermark/w/120/h/120?c=test-client-id",
+      Security.brandfetch_crypto_url("BTC")
+    )
+  end
+
+  test "brandfetch_crypto_url returns nil when Brandfetch is not configured" do
+    Setting.stubs(:brand_fetch_client_id).returns(nil)
+    assert_nil Security.brandfetch_crypto_url("BTC")
+  end
+
+  test "display_logo_url for crypto returns the /crypto/{base} Brandfetch URL" do
+    Setting.stubs(:brand_fetch_client_id).returns("test-client-id")
+    Setting.stubs(:brand_fetch_logo_size).returns(120)
+
+    sec = Security.new(
+      ticker: "BTCUSD",
+      exchange_operating_mic: Provider::BinancePublic::BINANCE_MIC
+    )
+
+    assert_equal(
+      "https://cdn.brandfetch.io/crypto/BTC/icon/fallback/lettermark/w/120/h/120?c=test-client-id",
+      sec.display_logo_url
+    )
+  end
+
+  test "display_logo_url for crypto falls back to stored logo_url when Brandfetch is disabled" do
+    Setting.stubs(:brand_fetch_client_id).returns(nil)
+
+    sec = Security.new(
+      ticker: "BTCUSD",
+      exchange_operating_mic: Provider::BinancePublic::BINANCE_MIC,
+      logo_url: "https://example.com/btc.png"
+    )
+
+    assert_equal "https://example.com/btc.png", sec.display_logo_url
+  end
+
+  test "display_logo_url for non-crypto prefers brandfetch over stored logo_url" do
+    Setting.stubs(:brand_fetch_client_id).returns("test-client-id")
+    Setting.stubs(:brand_fetch_logo_size).returns(120)
+
+    sec = Security.new(
+      ticker: "AAPL",
+      exchange_operating_mic: "XNAS",
+      logo_url: "https://example.com/aapl.png",
+      website_url: "https://www.apple.com"
+    )
+
+    url = sec.display_logo_url
+    assert_includes url, "cdn.brandfetch.io/apple.com"
+  end
+
+  test "display_logo_url for non-crypto falls back to logo_url when brandfetch is disabled" do
+    Setting.stubs(:brand_fetch_client_id).returns(nil)
+
+    sec = Security.new(
+      ticker: "AAPL",
+      exchange_operating_mic: "XNAS",
+      logo_url: "https://example.com/aapl.png"
+    )
+
+    assert_equal "https://example.com/aapl.png", sec.display_logo_url
+  end
+
+  test "before_save writes the /crypto/{base} URL to logo_url for new crypto securities" do
+    Setting.stubs(:brand_fetch_client_id).returns("test-client-id")
+    Setting.stubs(:brand_fetch_logo_size).returns(120)
+
+    sec = Security.create!(
+      ticker: "BTCUSD",
+      exchange_operating_mic: Provider::BinancePublic::BINANCE_MIC
+    )
+
+    assert_equal(
+      "https://cdn.brandfetch.io/crypto/BTC/icon/fallback/lettermark/w/120/h/120?c=test-client-id",
+      sec.logo_url
+    )
+  end
 end
diff --git a/test/models/simplefin_account/activity_summary_test.rb b/test/models/simplefin_account/activity_summary_test.rb
new file mode 100644
index 000000000..26f8e0cdf
--- /dev/null
+++ b/test/models/simplefin_account/activity_summary_test.rb
@@ -0,0 +1,172 @@
+require "test_helper"
+
+class SimplefinAccount::ActivitySummaryTest < ActiveSupport::TestCase
+  def build(transactions)
+    SimplefinAccount::ActivitySummary.new(transactions)
+  end
+
+  def tx(date: nil, amount: -10.0, posted: nil, pending: false, payee: "Test")
+    {
+      "id" => "TRN-#{SecureRandom.hex(4)}",
+      "amount" => amount.to_s,
+      "posted" => (posted.nil? ? 0 : posted.to_i),
+      "pending" => pending,
+      "payee" => payee,
+      "description" => payee.upcase,
+      "transacted_at" => (date || Time.current).to_i
+    }
+  end
+
+  test "empty payload is dormant with nil last_transacted_at and zero counts" do
+    summary = build([])
+    assert_nil summary.last_transacted_at
+    assert_equal 0, summary.transaction_count
+    assert_equal 0, summary.recent_transaction_count
+    assert summary.dormant?
+    refute summary.recently_active?
+  end
+
+  test "nil payload is treated as empty" do
+    summary = build(nil)
+    assert summary.dormant?
+    assert_equal 0, summary.transaction_count
+  end
+
+  test "last_transacted_at returns the most recent transaction time" do
+    latest = 3.days.ago
+    summary = build([
+      tx(date: 30.days.ago),
+      tx(date: latest),
+      tx(date: 10.days.ago)
+    ])
+    assert_in_delta latest.to_i, summary.last_transacted_at.to_i, 2
+  end
+
+  test "recent_transaction_count counts within default 60-day window" do
+    summary = build([
+      tx(date: 30.days.ago),
+      tx(date: 45.days.ago),
+      tx(date: 90.days.ago),
+      tx(date: 120.days.ago)
+    ])
+    assert_equal 2, summary.recent_transaction_count
+  end
+
+  test "recent_transaction_count honors custom window" do
+    summary = build([
+      tx(date: 10.days.ago),
+      tx(date: 20.days.ago),
+      tx(date: 40.days.ago)
+    ])
+    assert_equal 1, summary.recent_transaction_count(days: 15)
+    assert_equal 3, summary.recent_transaction_count(days: 90)
+  end
+
+  test "falls back to posted when transacted_at is zero (unknown)" do
+    # SimpleFIN uses 0 to signal "unknown" for transacted_at. Because 0 is
+    # truthy in Ruby, a naive `transacted_at || posted` short-circuits to 0
+    # and never falls back. Verify the fallback still produces the posted time.
+    posted_ts = 5.days.ago.to_i
+    summary = SimplefinAccount::ActivitySummary.new([
+      { "transacted_at" => 0, "posted" => posted_ts, "amount" => "-5" }
+    ])
+    assert_equal Time.at(posted_ts), summary.last_transacted_at
+  end
+
+  test "dormant? returns true when no activity within window" do
+    summary = build([ tx(date: 120.days.ago) ])
+    assert summary.dormant?
+    refute summary.recently_active?
+  end
+
+  test "dormant? returns false when any recent activity exists" do
+    summary = build([ tx(date: 120.days.ago), tx(date: 3.days.ago) ])
+    refute summary.dormant?
+    assert summary.recently_active?
+  end
+
+  test "days_since_last_activity returns whole days since newest tx" do
+    summary = build([ tx(date: 37.days.ago) ])
+    assert_equal 37, summary.days_since_last_activity
+  end
+
+  test "days_since_last_activity is nil when no transactions" do
+    assert_nil build([]).days_since_last_activity
+  end
+
+  test "ignores transactions with zero transacted_at and zero posted" do
+    # SimpleFIN uses posted=0 for pending; malformed entries may have transacted_at=0
+    summary = build([
+      { "id" => "a", "transacted_at" => 0, "posted" => 0, "amount" => "-5" },
+      tx(date: 3.days.ago)
+    ])
+    assert_in_delta 3.days.ago.to_i, summary.last_transacted_at.to_i, 2
+    assert_equal 1, summary.recent_transaction_count
+  end
+
+  test "falls back to posted when transacted_at is absent" do
+    posted_time = 5.days.ago.to_i
+    summary = build([
+      { "id" => "a", "amount" => "-5", "posted" => posted_time, "pending" => false }
+    ])
+    assert_in_delta posted_time, summary.last_transacted_at.to_i, 2
+    assert_equal 1, summary.recent_transaction_count
+  end
+
+  test "accepts symbol-keyed transaction hashes" do
+    summary = build([
+      { transacted_at: 3.days.ago.to_i, amount: "-5", id: "a" },
+      { "transacted_at" => 3.days.ago.to_i, "amount" => "-5", "id" => "b" }
+    ])
+    assert_equal 2, summary.recent_transaction_count
+  end
+end
+
+class SimplefinAccountActivitySummaryIntegrationTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @item = SimplefinItem.create!(
+      family: @family,
+      name: "SF Conn",
+      access_url: "https://example.com/access"
+    )
+  end
+
+  test "#activity_summary wraps raw_transactions_payload" do
+    sfa = SimplefinAccount.create!(
+      simplefin_item: @item,
+      name: "Active Card",
+      account_id: "sf-active",
+      account_type: "credit",
+      currency: "USD",
+      current_balance: -100,
+      raw_transactions_payload: [
+        {
+          "id" => "t1",
+          "amount" => "-50",
+          "posted" => 3.days.ago.to_i,
+          "transacted_at" => 3.days.ago.to_i
+        }
+      ]
+    )
+    summary = sfa.activity_summary
+    assert_kind_of SimplefinAccount::ActivitySummary, summary
+    assert summary.recently_active?
+    assert_equal 1, summary.transaction_count
+  end
+
+  test "#activity_summary handles nil raw_transactions_payload" do
+    sfa = SimplefinAccount.create!(
+      simplefin_item: @item,
+      name: "Empty Card",
+      account_id: "sf-empty",
+      account_type: "credit",
+      currency: "USD",
+      current_balance: 0,
+      raw_transactions_payload: nil
+    )
+    summary = sfa.activity_summary
+    assert_equal 0, summary.transaction_count
+    assert summary.dormant?
+  end
+end
diff --git a/test/models/simplefin_account/investments/holdings_processor_test.rb b/test/models/simplefin_account/investments/holdings_processor_test.rb
new file mode 100644
index 000000000..a3842ac6a
--- /dev/null
+++ b/test/models/simplefin_account/investments/holdings_processor_test.rb
@@ -0,0 +1,158 @@
+require "test_helper"
+
+class SimplefinAccount::Investments::HoldingsProcessorTest < ActiveSupport::TestCase
+  setup do
+    @processor = SimplefinAccount::Investments::HoldingsProcessor.new(nil)
+  end
+
+  test "cost_basis source is used unchanged as per share basis" do
+    payload = {
+      "cost_basis" => "16.61",
+      "total_cost" => "9588.61",
+      "value" => "10108.16"
+    }
+
+    raw_cost_basis, source_key = @processor.send(:cost_basis_from, payload)
+    cost_basis = @processor.send(:normalize_cost_basis, raw_cost_basis, BigDecimal("577.279"), source_key)
+
+    assert_equal BigDecimal("16.61"), cost_basis
+    assert_equal "cost_basis", source_key
+  end
+
+  test "basis source is used unchanged as per share basis" do
+    payload = {
+      "basis" => "16.61",
+      "total_cost" => "9588.61"
+    }
+
+    raw_cost_basis, source_key = @processor.send(:cost_basis_from, payload)
+    cost_basis = @processor.send(:normalize_cost_basis, raw_cost_basis, BigDecimal("577.279"), source_key)
+
+    assert_equal BigDecimal("16.61"), cost_basis
+    assert_equal "basis", source_key
+  end
+
+  test "total_cost source is normalized to per share basis" do
+    payload = {
+      "total_cost" => "9588.61"
+    }
+
+    raw_cost_basis, source_key = @processor.send(:cost_basis_from, payload)
+    cost_basis = @processor.send(:normalize_cost_basis, raw_cost_basis, BigDecimal("577.279"), source_key)
+
+    assert_equal BigDecimal("9588.61") / BigDecimal("577.279"), cost_basis
+    assert_equal "total_cost", source_key
+  end
+
+  test "value source is normalized to per share basis" do
+    payload = {
+      "value" => "9588.61"
+    }
+
+    raw_cost_basis, source_key = @processor.send(:cost_basis_from, payload)
+    cost_basis = @processor.send(:normalize_cost_basis, raw_cost_basis, BigDecimal("577.279"), source_key)
+
+    assert_equal BigDecimal("9588.61") / BigDecimal("577.279"), cost_basis
+    assert_equal "value", source_key
+  end
+
+  test "total cost source with zero quantity returns nil" do
+    payload = {
+      "total_cost" => "9588.61"
+    }
+
+    raw_cost_basis, source_key = @processor.send(:cost_basis_from, payload)
+    cost_basis = @processor.send(:normalize_cost_basis, raw_cost_basis, BigDecimal("0"), source_key)
+
+    assert_nil cost_basis
+    assert_equal "total_cost", source_key
+  end
+
+  test "total cost source with nil quantity returns nil" do
+    payload = {
+      "total_cost" => "9588.61"
+    }
+
+    raw_cost_basis, source_key = @processor.send(:cost_basis_from, payload)
+    cost_basis = @processor.send(:normalize_cost_basis, raw_cost_basis, nil, source_key)
+
+    assert_nil cost_basis
+    assert_equal "total_cost", source_key
+  end
+
+  test "cost_basis from a known total-basis institution is divided by qty" do
+    # Issue #1718 / #1182: Vanguard populates cost_basis with the total
+    # position cost. When the institution is on the allowlist we divide.
+    cost_basis = @processor.send(
+      :normalize_cost_basis,
+      BigDecimal("22004.40"),
+      BigDecimal("139.00"),
+      "cost_basis",
+      true # institution_reports_total_basis?
+    )
+
+    assert_in_delta 158.30, cost_basis.to_f, 0.01
+  end
+
+  test "basis from a known total-basis institution is divided by qty" do
+    cost_basis = @processor.send(
+      :normalize_cost_basis,
+      BigDecimal("9000.00"),
+      BigDecimal("200"),
+      "basis",
+      true
+    )
+
+    assert_equal BigDecimal("45.00"), cost_basis
+  end
+
+  test "cost_basis from a compliant institution is kept untouched (no false divide)" do
+    # Codex regression: a legitimate per-share basis on a holding with a
+    # large unrealized loss (e.g. $100/share basis now worth $5/share) must
+    # NOT be divided by qty. Per the SimpleFIN spec, cost_basis is per-share
+    # — only the institution allowlist should override that.
+    cost_basis = @processor.send(
+      :normalize_cost_basis,
+      BigDecimal("100.00"),
+      BigDecimal("100"),
+      "cost_basis",
+      false
+    )
+
+    assert_equal BigDecimal("100.00"), cost_basis
+  end
+
+  test "institution_reports_total_basis? matches Vanguard and Fidelity org metadata" do
+    cases = {
+      { "name" => "Vanguard" }                          => true,
+      { "name" => "VANGUARD BROKERAGE" }                => true,
+      { "name" => "Fidelity Investments" }              => true,
+      { "domain" => "vanguard.com" }                    => true,
+      { "domain" => "401k.fidelity.com" }               => true,
+      { "name" => "Charles Schwab", "domain" => "schwab.com" } => false,
+      { "name" => "Chase" }                             => false,
+      {}                                                => false
+    }
+
+    cases.each do |org, expected|
+      account = Struct.new(:org_data).new(org)
+      processor = SimplefinAccount::Investments::HoldingsProcessor.new(account)
+      assert_equal expected,
+        processor.send(:institution_reports_total_basis?),
+        "org_data #{org.inspect} expected #{expected}"
+    end
+  end
+
+  test "missing cost basis fields return nil" do
+    payload = {
+      "market_value" => "10108.16"
+    }
+
+    raw_cost_basis, source_key = @processor.send(:cost_basis_from, payload)
+    cost_basis = @processor.send(:normalize_cost_basis, raw_cost_basis, BigDecimal("577.279"), source_key)
+
+    assert_nil raw_cost_basis
+    assert_nil source_key
+    assert_nil cost_basis
+  end
+end
diff --git a/test/models/simplefin_account_processor_test.rb b/test/models/simplefin_account_processor_test.rb
index 0c6a33b88..b5361b365 100644
--- a/test/models/simplefin_account_processor_test.rb
+++ b/test/models/simplefin_account_processor_test.rb
@@ -64,6 +64,32 @@ class SimplefinAccountProcessorTest < ActiveSupport::TestCase
     assert_equal BigDecimal("50000"), acct.reload.balance
   end
 
+  # Many banks (and most mortgage feeds) report the loan principal
+  # outstanding as a positive number from the bank's books. The old
+  # liability path ran every Loan through OverpaymentAnalyzer +
+  # normalize_liability_balance, and the latter's fallback for
+  # `:unknown` classifications returned `-observed`, flipping a
+  # bank-reported `+50000` into `-50000`. That bug made loans _add_ to
+  # net worth instead of subtracting, so this test pins the corrected
+  # behaviour.
+  test "preserves positive provider balance for loan liabilities" do
+    sfin_acct = SimplefinAccount.create!(
+      simplefin_item: @item,
+      name: "Mortgage",
+      account_id: "loan_2",
+      currency: "USD",
+      account_type: "mortgage",
+      current_balance: BigDecimal("50000")
+    )
+
+    acct = accounts(:loan)
+    acct.update!(simplefin_account: sfin_acct)
+
+    SimplefinAccount::Processor.new(sfin_acct).send(:process_account!)
+
+    assert_equal BigDecimal("50000"), acct.reload.balance
+  end
+
   test "positive provider balance (overpayment) becomes negative for credit card liabilities" do
     sfin_acct = SimplefinAccount.create!(
       simplefin_item: @item,
diff --git a/test/models/simplefin_account_test.rb b/test/models/simplefin_account_test.rb
index daa7347ac..53aa10405 100644
--- a/test/models/simplefin_account_test.rb
+++ b/test/models/simplefin_account_test.rb
@@ -41,7 +41,7 @@ class SimplefinAccountTest < ActiveSupport::TestCase
     )
 
     refute account.valid?
-    assert_includes account.errors[:base], "SimpleFin account must have either current or available balance"
+    assert_includes account.errors[:base], I18n.t("activerecord.errors.models.simplefin_account.no_balance")
   end
 
   test "can upsert snapshot data" do
diff --git a/test/models/simplefin_item/importer_partial_errors_test.rb b/test/models/simplefin_item/importer_partial_errors_test.rb
new file mode 100644
index 000000000..d258d9850
--- /dev/null
+++ b/test/models/simplefin_item/importer_partial_errors_test.rb
@@ -0,0 +1,103 @@
+require "test_helper"
+
+# Verifies the boundary between per-institution partial errors (which must not
+# poison the whole SimpleFIN item's status) and top-level token-auth failures
+# (which legitimately flag the item for reconnection).
+class SimplefinItem::ImporterPartialErrorsTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @item = SimplefinItem.create!(
+      family: @family,
+      name: "SF Conn",
+      access_url: "https://example.com/access"
+    )
+    @sync = Sync.create!(syncable: @item)
+    @importer = SimplefinItem::Importer.new(@item, simplefin_provider: mock(), sync: @sync)
+  end
+
+  test "per-institution auth error does NOT flip item to requires_update" do
+    # Partial-response error for ONE institution (e.g. Cash App) should not
+    # poison the other 8 institutions in the same SimpleFIN connection.
+    assert_equal "good", @item.status
+
+    @importer.send(:record_errors, [
+      "Connection to Cash App may need attention. Auth required"
+    ])
+
+    @item.reload
+    assert_equal "good", @item.status,
+      "expected item to remain good; per-institution auth errors must not flip the whole connection"
+  end
+
+  test "per-institution auth error still tracks in error_buckets for observability" do
+    @importer.send(:record_errors, [
+      "Connection to Cash App may need attention. Auth required"
+    ])
+
+    stats = @sync.reload.sync_stats
+    assert_equal 1, stats.dig("error_buckets", "auth").to_i,
+      "auth-category error should still be tracked in stats"
+  end
+
+  test "multiple per-institution errors do not flip item status" do
+    @importer.send(:record_errors, [
+      "Connection to Cash App may need attention. Auth required",
+      "Please reauthenticate with Citibank",
+      "two-factor authentication failed at Chase"
+    ])
+
+    @item.reload
+    assert_equal "good", @item.status
+    assert_equal 3, @sync.reload.sync_stats.dig("error_buckets", "auth").to_i
+  end
+
+  test "hash-shaped per-institution auth error does not flip item status" do
+    @importer.send(:record_errors, [
+      { code: "auth_failure", description: "Auth required for Cash App" }
+    ])
+
+    @item.reload
+    assert_equal "good", @item.status
+  end
+
+  test "top-level handle_errors with auth failure DOES flip item to requires_update" do
+    # Distinct from record_errors: this is the token-revoked / whole-connection-dead path.
+    assert_equal "good", @item.status
+
+    assert_raises(Provider::Simplefin::SimplefinError) do
+      @importer.send(:handle_errors, [
+        { code: "auth_failure", description: "Your SimpleFIN setup token was revoked" }
+      ])
+    end
+
+    @item.reload
+    assert_equal "requires_update", @item.status,
+      "top-level token auth failures must still flag the item for reconnection"
+  end
+
+  test "previously requires_update item is cleared when no auth errors this sync" do
+    @item.update!(status: :requires_update)
+
+    # Simulate a clean sync (the maybe_clear path is already exercised in-suite;
+    # here we confirm that record_errors with zero auth errors doesn't re-flag).
+    @importer.send(:record_errors, [ "Timed out fetching Chase" ])
+
+    @item.reload
+    # record_errors alone doesn't clear - that's maybe_clear_requires_update_status's job -
+    # but it also must not RE-flag when the error isn't auth-related.
+    assert_equal "requires_update", @item.status
+  end
+
+  test "non-auth partial errors don't flip status" do
+    @importer.send(:record_errors, [
+      "Timed out fetching transactions from Chase",
+      "429 rate limit hit at Citibank"
+    ])
+
+    @item.reload
+    assert_equal "good", @item.status
+    stats = @sync.reload.sync_stats
+    assert_equal 1, stats.dig("error_buckets", "network").to_i
+    assert_equal 1, stats.dig("error_buckets", "api").to_i
+  end
+end
diff --git a/test/models/simplefin_item/replacement_detector_test.rb b/test/models/simplefin_item/replacement_detector_test.rb
new file mode 100644
index 000000000..cb0325c63
--- /dev/null
+++ b/test/models/simplefin_item/replacement_detector_test.rb
@@ -0,0 +1,259 @@
+require "test_helper"
+
+class SimplefinItem::ReplacementDetectorTest < ActiveSupport::TestCase
+  setup do
+    @family = families(:dylan_family)
+    @item = SimplefinItem.create!(
+      family: @family,
+      name: "SF Conn",
+      access_url: "https://example.com/access"
+    )
+  end
+
+  def make_sfa(name:, account_id:, account_type: "credit", org_name: "Citibank",
+               balance: -100, transactions: [])
+    @item.simplefin_accounts.create!(
+      name: name,
+      account_id: account_id,
+      currency: "USD",
+      account_type: account_type,
+      current_balance: balance,
+      org_data: { "name" => org_name },
+      raw_transactions_payload: transactions
+    )
+  end
+
+  def link(sfa, name:)
+    account = @family.accounts.create!(
+      name: name,
+      balance: (sfa.current_balance || 0).to_d,
+      currency: sfa.currency,
+      accountable: CreditCard.create!(subtype: "credit_card")
+    )
+    sfa.update!(account: account)
+    account.update!(simplefin_account_id: sfa.id)
+    account
+  end
+
+  def tx(when_ago:)
+    { "id" => SecureRandom.hex(4), "transacted_at" => when_ago.ago.to_i, "posted" => when_ago.ago.to_i, "amount" => "-5" }
+  end
+
+  test "returns empty when simplefin_item has no accounts" do
+    assert_equal [], SimplefinItem::ReplacementDetector.new(@item).call
+  end
+
+  test "returns empty when there are no active unlinked candidates" do
+    dormant = make_sfa(name: "Citi Old", account_id: "sf_old", balance: 0, transactions: [ tx(when_ago: 90.days) ])
+    link(dormant, name: "Citi Double Cash")
+    # No unlinked sfas at all
+    assert_equal [], SimplefinItem::ReplacementDetector.new(@item).call
+  end
+
+  test "detects classic fraud replacement: dormant+zero linked sfa + active unlinked sfa same org+type" do
+    dormant = make_sfa(name: "Citi-3831", account_id: "sf_3831", balance: 0,
+                       transactions: [ tx(when_ago: 45.days) ])
+    linked_account = link(dormant, name: "Citi Double Cash Card-3831")
+    active = make_sfa(name: "Citi-2879", account_id: "sf_2879", balance: -1200,
+                      transactions: [ tx(when_ago: 2.days), tx(when_ago: 5.days) ])
+
+    suggestions = SimplefinItem::ReplacementDetector.new(@item).call
+    assert_equal 1, suggestions.size
+
+    suggestion = suggestions.first
+    assert_equal dormant.id, suggestion["dormant_sfa_id"]
+    assert_equal active.id, suggestion["active_sfa_id"]
+    assert_equal linked_account.id, suggestion["sure_account_id"]
+    assert_equal "Citibank", suggestion["institution_name"]
+    assert_equal "high", suggestion["confidence"]
+  end
+
+  test "ignores candidates at different institutions" do
+    dormant = make_sfa(name: "Citi-3831", account_id: "sf_old", balance: 0,
+                       transactions: [ tx(when_ago: 60.days) ])
+    link(dormant, name: "Citi Double Cash")
+    # Active sfa at a DIFFERENT institution - not a real replacement
+    make_sfa(name: "Chase-Freedom", account_id: "sf_chase", balance: -200,
+             org_name: "Chase",
+             transactions: [ tx(when_ago: 3.days) ])
+
+    assert_empty SimplefinItem::ReplacementDetector.new(@item).call
+  end
+
+  test "ignores candidates with different account_type" do
+    dormant = make_sfa(name: "Citi-3831", account_id: "sf_old",
+                       account_type: "credit", balance: 0,
+                       transactions: [ tx(when_ago: 60.days) ])
+    link(dormant, name: "Citi Double Cash")
+    # Active sfa at same institution but different type
+    make_sfa(name: "Citi Checking", account_id: "sf_checking",
+             account_type: "depository", balance: 500,
+             transactions: [ tx(when_ago: 3.days) ])
+
+    assert_empty SimplefinItem::ReplacementDetector.new(@item).call
+  end
+
+  test "skips ambiguous matches (multiple candidates)" do
+    dormant = make_sfa(name: "Citi-3831", account_id: "sf_old", balance: 0,
+                       transactions: [ tx(when_ago: 60.days) ])
+    link(dormant, name: "Citi Double Cash")
+    # Two active unlinked Citi credit cards — can't tell which replaced it
+    make_sfa(name: "Citi-2879", account_id: "sf_new1", balance: -100,
+             transactions: [ tx(when_ago: 2.days) ])
+    make_sfa(name: "Citi-4567", account_id: "sf_new2", balance: -200,
+             transactions: [ tx(when_ago: 5.days) ])
+
+    assert_empty SimplefinItem::ReplacementDetector.new(@item).call
+  end
+
+  test "ignores dormant sfa with non-zero balance (probably legitimate dormant account)" do
+    # A savings account sitting at $5000 with no recent activity isn't
+    # fraud replacement — it's just a savings account
+    dormant = make_sfa(name: "Dormant Savings", account_id: "sf_savings",
+                       balance: 5000, transactions: [ tx(when_ago: 60.days) ])
+    link(dormant, name: "Savings Account")
+    make_sfa(name: "Citi-2879", account_id: "sf_new", balance: -100,
+             transactions: [ tx(when_ago: 2.days) ])
+
+    assert_empty SimplefinItem::ReplacementDetector.new(@item).call
+  end
+
+  test "ignores active sfa as the 'dormant' candidate" do
+    # Account with both dormant-looking AND active (recent activity): not dormant
+    active_linked = make_sfa(name: "Citi-3831", account_id: "sf_still_active",
+                             balance: 0, transactions: [ tx(when_ago: 3.days) ])
+    link(active_linked, name: "Citi Card")
+    make_sfa(name: "Citi-2879", account_id: "sf_candidate", balance: -100,
+             transactions: [ tx(when_ago: 2.days) ])
+
+    assert_empty SimplefinItem::ReplacementDetector.new(@item).call
+  end
+
+  test "suggestion uses case-insensitive org and type matching" do
+    dormant = make_sfa(name: "Citi Old", account_id: "sf_old", balance: 0,
+                       account_type: "CREDIT", org_name: "CITIBANK",
+                       transactions: [ tx(when_ago: 60.days) ])
+    link(dormant, name: "Citi Double Cash")
+    active = make_sfa(name: "Citi New", account_id: "sf_new", balance: -100,
+                      account_type: "credit", org_name: "Citibank",
+                      transactions: [ tx(when_ago: 2.days) ])
+
+    suggestions = SimplefinItem::ReplacementDetector.new(@item).call
+    assert_equal 1, suggestions.size
+    assert_equal active.id, suggestions.first["active_sfa_id"]
+  end
+
+  test "detects multiple independent replacements across institutions" do
+    # Two fraud replacements in the same sync: Citi + Chase both replaced
+    dormant_citi = make_sfa(name: "Citi-old", account_id: "sf_c_old", balance: 0,
+                            transactions: [ tx(when_ago: 60.days) ])
+    link(dormant_citi, name: "Citi")
+    make_sfa(name: "Citi-new", account_id: "sf_c_new", balance: -100,
+             transactions: [ tx(when_ago: 3.days) ])
+
+    dormant_chase = make_sfa(name: "Chase-old", account_id: "sf_ch_old",
+                             org_name: "Chase", balance: 0,
+                             transactions: [ tx(when_ago: 60.days) ])
+    link(dormant_chase, name: "Chase")
+    make_sfa(name: "Chase-new", account_id: "sf_ch_new",
+             org_name: "Chase", balance: -200,
+             transactions: [ tx(when_ago: 1.day) ])
+
+    suggestions = SimplefinItem::ReplacementDetector.new(@item).call
+    assert_equal 2, suggestions.size
+    orgs = suggestions.map { |s| s["institution_name"] }.sort
+    assert_equal [ "Chase", "Citibank" ], orgs
+  end
+
+  test "ignores non-credit account types (checking, savings, investment)" do
+    # Fraud-replacement UX is credit-card scoped for now. A depository/checking
+    # pair that matches all other detector criteria must be skipped.
+    dormant = make_sfa(name: "Old Checking", account_id: "sf_checking_old",
+                       account_type: "depository", org_name: "Chase", balance: 0,
+                       transactions: [ tx(when_ago: 60.days) ])
+    link(dormant, name: "Old Checking")
+    make_sfa(name: "New Checking", account_id: "sf_checking_new",
+             account_type: "depository", org_name: "Chase", balance: 1234,
+             transactions: [ tx(when_ago: 2.days) ])
+
+    assert_empty SimplefinItem::ReplacementDetector.new(@item).call
+  end
+
+  test "does not emit multiple suggestions pointing at the same active sfa" do
+    # Two dormant credit cards at the same institution, one new active card.
+    # Relinking both would move the provider away from the first account.
+    # Detector must skip both to avoid silent breakage.
+    dormant1 = make_sfa(name: "Citi-OLD-1", account_id: "sf_old1", balance: 0,
+                        transactions: [ tx(when_ago: 60.days) ])
+    link(dormant1, name: "Citi Card 1")
+    dormant2 = make_sfa(name: "Citi-OLD-2", account_id: "sf_old2", balance: 0,
+                        transactions: [ tx(when_ago: 60.days) ])
+    link(dormant2, name: "Citi Card 2")
+    make_sfa(name: "Citi-NEW", account_id: "sf_new", balance: -100,
+             transactions: [ tx(when_ago: 2.days) ])
+
+    suggestions = SimplefinItem::ReplacementDetector.new(@item).call
+    assert_empty suggestions, "must not emit ambiguous pairs that reuse the same active sfa"
+  end
+
+  test "treats blank institution names as non-matching (not co-institutional)" do
+    # SimpleFIN sometimes omits org_data.name. Two credit-card sfas with blank
+    # org names must NOT be treated as at the same institution — otherwise any
+    # dormant+active credit pair would auto-match regardless of provider.
+    dormant = @item.simplefin_accounts.create!(
+      name: "Mystery-OLD", account_id: "sf_mystery_old",
+      currency: "USD", account_type: "credit", current_balance: 0,
+      org_data: {},
+      raw_transactions_payload: [ tx(when_ago: 60.days) ]
+    )
+    link(dormant, name: "Mystery")
+    @item.simplefin_accounts.create!(
+      name: "Mystery-NEW", account_id: "sf_mystery_new",
+      currency: "USD", account_type: "credit", current_balance: -200,
+      org_data: {},
+      raw_transactions_payload: [ tx(when_ago: 2.days) ]
+    )
+
+    assert_empty SimplefinItem::ReplacementDetector.new(@item).call
+  end
+
+  test "ignores dormant candidate when current_balance is unknown (nil)" do
+    # nil balance is 'unknown,' not 'zero.' Treat as evidence against a match.
+    # Model-level validation normally prevents nil current_balance but upstream
+    # data has occasionally landed this way; simulate via `update_columns` to
+    # bypass validation and assert the detector's robustness.
+    dormant = make_sfa(name: "Citi-UNKNOWN-BAL", account_id: "sf_nil_bal",
+                       balance: 0, transactions: [ tx(when_ago: 60.days) ])
+    link(dormant, name: "Unknown Citi")
+    dormant.update_columns(current_balance: nil, available_balance: nil)
+    make_sfa(name: "New Citi", account_id: "sf_nil_new", balance: -100,
+             transactions: [ tx(when_ago: 2.days) ])
+
+    assert_empty SimplefinItem::ReplacementDetector.new(@item).call
+  end
+
+  test "matches sfa pairs when account_type uses 'credit card' / 'credit_card' variants" do
+    dormant = make_sfa(name: "Citi-OLD-var", account_id: "sf_var_old",
+                       account_type: "credit card", balance: 0,
+                       transactions: [ tx(when_ago: 60.days) ])
+    link(dormant, name: "Variant Citi")
+    make_sfa(name: "Citi-NEW-var", account_id: "sf_var_new",
+             account_type: "credit_card", balance: -100,
+             transactions: [ tx(when_ago: 2.days) ])
+
+    suggestions = SimplefinItem::ReplacementDetector.new(@item).call
+    assert_equal 1, suggestions.size, "canonicalized account_type should match across spacing variants"
+  end
+
+  test "ignores linked sfa with no transaction history (brand-new card, not dormant)" do
+    # A newly linked card with zero balance and no transactions yet must NOT be
+    # flagged as a replacement target. "Dormant" requires prior activity that
+    # has since gone silent; an empty payload carries no such signal.
+    fresh = make_sfa(name: "Brand New Citi", account_id: "sf_fresh", balance: 0, transactions: [])
+    link(fresh, name: "Brand New Citi Card")
+    make_sfa(name: "Other Citi", account_id: "sf_other", balance: -50,
+             transactions: [ tx(when_ago: 2.days) ])
+
+    assert_empty SimplefinItem::ReplacementDetector.new(@item).call
+  end
+end
diff --git a/test/models/snaptrade_account/activities_processor_test.rb b/test/models/snaptrade_account/activities_processor_test.rb
index dedde9de5..2c5639952 100644
--- a/test/models/snaptrade_account/activities_processor_test.rb
+++ b/test/models/snaptrade_account/activities_processor_test.rb
@@ -70,7 +70,7 @@ class SnaptradeAccount::ActivitiesProcessorTest < ActiveSupport::TestCase
     assert_equal "Sell", trade.investment_activity_label
   end
 
-  test "processes dividend cash activity" do
+  test "processes dividend cash activity as negative inflow" do
     @snaptrade_account.update!(raw_activities_payload: [
       build_cash_activity(
         id: "div_001",
@@ -89,10 +89,11 @@ class SnaptradeAccount::ActivitiesProcessorTest < ActiveSupport::TestCase
     assert entry.entryable.is_a?(Transaction), "Entry should be a Transaction"
 
     transaction = entry.entryable
+    assert_equal(-25.50, entry.amount.to_f)
     assert_equal "Dividend", transaction.investment_activity_label
   end
 
-  test "processes contribution with positive amount" do
+  test "processes contribution with negative inflow amount" do
     @snaptrade_account.update!(raw_activities_payload: [
       build_cash_activity(
         id: "contrib_001",
@@ -107,12 +108,11 @@ class SnaptradeAccount::ActivitiesProcessorTest < ActiveSupport::TestCase
 
     entry = @account.entries.find_by(external_id: "contrib_001", source: "snaptrade")
     assert_not_nil entry
-    # Amount is on entry, not transaction
-    assert_equal 500.00, entry.amount.to_f  # Positive for contributions
+    assert_equal(-500.00, entry.amount.to_f)
     assert_equal "Contribution", entry.entryable.investment_activity_label
   end
 
-  test "processes withdrawal with negative amount" do
+  test "processes withdrawal with positive outflow amount" do
     @snaptrade_account.update!(raw_activities_payload: [
       build_cash_activity(
         id: "withdraw_001",
@@ -127,10 +127,40 @@ class SnaptradeAccount::ActivitiesProcessorTest < ActiveSupport::TestCase
 
     entry = @account.entries.find_by(external_id: "withdraw_001", source: "snaptrade")
     assert_not_nil entry
-    assert_equal(-200.00, entry.amount.to_f)  # Negative for withdrawals
+    assert_equal 200.00, entry.amount.to_f
     assert_equal "Withdrawal", entry.entryable.investment_activity_label
   end
 
+  test "processes transfers with Sure sign convention" do
+    @snaptrade_account.update!(raw_activities_payload: [
+      build_cash_activity(
+        id: "transfer_in_001",
+        type: "TRANSFER_IN",
+        amount: 300.00,
+        settlement_date: Date.current.to_s
+      ),
+      build_cash_activity(
+        id: "transfer_out_001",
+        type: "TRANSFER_OUT",
+        amount: 125.00,
+        settlement_date: Date.current.to_s
+      )
+    ])
+
+    processor = SnaptradeAccount::ActivitiesProcessor.new(@snaptrade_account)
+    processor.process
+
+    transfer_in = @account.entries.find_by(external_id: "transfer_in_001", source: "snaptrade")
+    transfer_out = @account.entries.find_by(external_id: "transfer_out_001", source: "snaptrade")
+
+    assert_not_nil transfer_in
+    assert_not_nil transfer_out
+    assert_equal(-300.00, transfer_in.amount.to_f)
+    assert_equal 125.00, transfer_out.amount.to_f
+    assert_equal "Transfer", transfer_in.entryable.investment_activity_label
+    assert_equal "Transfer", transfer_out.entryable.investment_activity_label
+  end
+
   test "maps all known activity types correctly" do
     type_mappings = {
       "BUY" => "Buy",
diff --git a/test/models/snaptrade_account_processor_test.rb b/test/models/snaptrade_account_processor_test.rb
index c2127c0e2..afc90c787 100644
--- a/test/models/snaptrade_account_processor_test.rb
+++ b/test/models/snaptrade_account_processor_test.rb
@@ -129,6 +129,36 @@ class SnaptradeAccountProcessorTest < ActiveSupport::TestCase
     assert_equal 0, @account.holdings.count
   end
 
+  test "processor trusts API total for multi-currency holdings" do
+    security = securities(:aapl)
+    Account.any_instance.stubs(:set_current_balance)
+
+    @snaptrade_account.update!(
+      currency: "CHF",
+      current_balance: BigDecimal("15000.00"),
+      cash_balance: BigDecimal("1000.00"),
+      raw_holdings_payload: [
+        {
+          "symbol" => {
+            "symbol" => { "symbol" => security.ticker, "description" => security.name }
+          },
+          "units" => "10",
+          "price" => "150.00",
+          "currency" => "USD",
+          "average_purchase_price" => "125.50"
+        }
+      ],
+      raw_activities_payload: []
+    )
+
+    SnaptradeAccount::Processor.new(@snaptrade_account).process
+
+    @account.reload
+    assert_equal BigDecimal("15000.00"), @account.balance
+    assert_equal BigDecimal("1000.00"), @account.cash_balance
+    assert_equal "CHF", @account.currency
+  end
+
   # === ActivitiesProcessor Tests ===
 
   test "activities processor maps BUY type to Buy label" do
@@ -210,7 +240,7 @@ class SnaptradeAccountProcessorTest < ActiveSupport::TestCase
     assert_equal "Dividend", tx_entry.entryable.investment_activity_label
   end
 
-  test "activities processor normalizes withdrawal as negative amount" do
+  test "activities processor normalizes withdrawal as positive outflow amount" do
     @snaptrade_account.update!(
       raw_activities_payload: [
         {
@@ -228,7 +258,7 @@ class SnaptradeAccountProcessorTest < ActiveSupport::TestCase
 
     assert_equal 1, result[:transactions]
     tx_entry = @account.entries.find_by(external_id: "activity_withdraw_1")
-    assert tx_entry.amount.negative?
+    assert_equal 1000.00, tx_entry.amount.to_f
   end
 
   test "activities processor skips activities without external_id" do
diff --git a/test/models/snaptrade_item_test.rb b/test/models/snaptrade_item_test.rb
index 79e6c6689..6b31c9895 100644
--- a/test/models/snaptrade_item_test.rb
+++ b/test/models/snaptrade_item_test.rb
@@ -75,4 +75,42 @@ class SnaptradeItemTest < ActiveSupport::TestCase
     provider = item.snaptrade_provider
     assert_instance_of Provider::Snaptrade, provider
   end
+
+  test "orphaned_users only includes users for the same family" do
+    item = SnaptradeItem.new(
+      family: @family,
+      name: "Test",
+      client_id: "test",
+      consumer_key: "test",
+      snaptrade_user_id: "family_#{@family.id}_111",
+      snaptrade_user_secret: "secret"
+    )
+
+    item.stubs(:list_all_users).returns([
+      "family_#{@family.id}_111",
+      "family_#{@family.id}_222",
+      "family_999_333",
+      "legacy_user_444"
+    ])
+
+    assert_equal([ "family_#{@family.id}_222" ], item.orphaned_users)
+  end
+
+  test "delete_orphaned_user rejects users outside the current family namespace" do
+    item = SnaptradeItem.new(
+      family: @family,
+      name: "Test",
+      client_id: "test",
+      consumer_key: "test",
+      snaptrade_user_id: "family_#{@family.id}_111",
+      snaptrade_user_secret: "secret"
+    )
+
+    provider = mock
+    provider.expects(:delete_user).never
+    item.stubs(:snaptrade_provider).returns(provider)
+
+    assert_not item.delete_orphaned_user("family_999_222")
+    assert_not item.delete_orphaned_user("legacy_user_333")
+  end
 end
diff --git a/test/models/sophtron_account_test.rb b/test/models/sophtron_account_test.rb
new file mode 100644
index 000000000..9c5d197c6
--- /dev/null
+++ b/test/models/sophtron_account_test.rb
@@ -0,0 +1,24 @@
+require "test_helper"
+
+class SophtronAccountTest < ActiveSupport::TestCase
+  test "upsert_sophtron_snapshot stores owning item institution metadata fallback" do
+    item = families(:dylan_family).sophtron_items.create!(
+      name: "Sophtron Connection",
+      user_id: "developer-user",
+      access_key: Base64.strict_encode64("secret-key"),
+      institution_name: "Apple / Goldman Sachs",
+      user_institution_id: "ui-apple"
+    )
+
+    account = item.sophtron_accounts.build
+    account.upsert_sophtron_snapshot!(
+      account_id: "card-1",
+      account_name: "Juan",
+      currency: "USD",
+      balance: "1947.18"
+    )
+
+    assert_equal "Apple / Goldman Sachs", account.institution_metadata["name"]
+    assert_equal "ui-apple", account.institution_metadata["user_institution_id"]
+  end
+end
diff --git a/test/models/sophtron_item/importer_test.rb b/test/models/sophtron_item/importer_test.rb
new file mode 100644
index 000000000..85449c343
--- /dev/null
+++ b/test/models/sophtron_item/importer_test.rb
@@ -0,0 +1,332 @@
+require "test_helper"
+
+class SophtronItem::ImporterTest < ActiveSupport::TestCase
+  include ActiveJob::TestHelper
+
+  setup do
+    @family = families(:dylan_family)
+    @item = @family.sophtron_items.create!(
+      name: "Sophtron",
+      user_id: "developer-user",
+      access_key: Base64.strict_encode64("secret-key"),
+      customer_id: "cust-1",
+      user_institution_id: "ui-1"
+    )
+  end
+
+  test "fetches accounts by stored user institution id" do
+    provider = mock
+    provider.expects(:get_accounts).with("ui-1").returns({
+      accounts: [
+        {
+          account_id: "acct-1",
+          account_name: "Checking",
+          balance: "100.00",
+          balance_currency: "USD",
+          currency: "USD"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+
+    result = SophtronItem::Importer.new(@item, sophtron_provider: provider).import
+
+    assert result[:success]
+    assert_equal 1, result[:accounts_created]
+    assert_equal "acct-1", @item.sophtron_accounts.first.account_id
+  end
+
+  test "missing user institution id fails import and marks item requires update" do
+    account = accounts(:depository)
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Checking",
+      currency: "USD",
+      balance: 100
+    )
+    AccountProvider.create!(account: account, provider: sophtron_account)
+    @item.update!(user_institution_id: nil, status: :good, last_connection_error: nil)
+
+    provider = mock
+    provider.expects(:get_accounts).never
+
+    result = SophtronItem::Importer.new(@item, sophtron_provider: provider).import
+
+    assert_not result[:success]
+    assert_equal "Sophtron institution connection is incomplete", result[:error]
+    assert_equal "requires_update", @item.reload.status
+    assert_equal "Sophtron institution connection is incomplete", @item.last_connection_error
+  end
+
+  test "initial linked account import fetches transactions without starting a refresh job" do
+    account = accounts(:depository)
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Checking",
+      currency: "USD",
+      balance: 100
+    )
+    AccountProvider.create!(account: account, provider: sophtron_account)
+
+    provider = mock
+    provider.expects(:get_accounts).with("ui-1").returns({
+      accounts: [
+        {
+          account_id: "acct-1",
+          account_name: "Checking",
+          balance: "100.00",
+          balance_currency: "USD",
+          currency: "USD"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+    provider.expects(:refresh_account).never
+    provider.expects(:get_account_transactions).with("acct-1", start_date: anything).returns({
+      transactions: [
+        {
+          id: "tx-1",
+          accountId: "acct-1",
+          amount: "-12.34",
+          currency: "USD",
+          date: "2026-05-01",
+          merchant: "Coffee Shop",
+          description: "Coffee Shop"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+
+    result = SophtronItem::Importer.new(@item, sophtron_provider: provider).import
+
+    assert result[:success]
+    assert_equal 1, result[:transactions_imported]
+    assert_equal 1, sophtron_account.reload.raw_transactions_payload.count
+  end
+
+  test "automatic import skips linked accounts that require manual sync" do
+    account = accounts(:depository)
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Checking",
+      currency: "USD",
+      balance: 100,
+      manual_sync: true
+    )
+    AccountProvider.create!(account: account, provider: sophtron_account)
+
+    provider = mock
+    provider.expects(:get_accounts).with("ui-1").returns({
+      accounts: [
+        {
+          account_id: "acct-1",
+          account_name: "Checking",
+          balance: "100.00",
+          balance_currency: "USD",
+          currency: "USD"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+    provider.expects(:refresh_account).never
+    provider.expects(:get_account_transactions).never
+
+    result = SophtronItem::Importer.new(@item, sophtron_provider: provider).import
+
+    assert result[:success]
+    assert_equal 0, result[:transactions_imported]
+    assert_nil sophtron_account.reload.raw_transactions_payload
+  end
+
+  test "later sync refreshes account after an empty initial transaction fetch" do
+    account = accounts(:depository)
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Checking",
+      currency: "USD",
+      balance: 100
+    )
+    AccountProvider.create!(account: account, provider: sophtron_account)
+
+    provider = mock
+    provider.expects(:get_accounts).with("ui-1").returns({
+      accounts: [
+        {
+          account_id: "acct-1",
+          account_name: "Checking",
+          balance: "100.00",
+          balance_currency: "USD",
+          currency: "USD"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+    provider.expects(:refresh_account).never
+    provider.expects(:get_account_transactions).with("acct-1", start_date: anything).returns({
+      transactions: [],
+      total: 0
+    })
+
+    result = SophtronItem::Importer.new(@item, sophtron_provider: provider).import
+
+    assert result[:success]
+    assert_equal [], sophtron_account.reload.raw_transactions_payload
+
+    provider = mock
+    provider.expects(:get_accounts).with("ui-1").returns({
+      accounts: [
+        {
+          account_id: "acct-1",
+          account_name: "Checking",
+          balance: "100.00",
+          balance_currency: "USD",
+          currency: "USD"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+    provider.expects(:refresh_account).with("acct-1").returns({ JobID: "refresh-job" })
+    provider.expects(:get_job_information).with("refresh-job").returns({ LastStatus: "Completed" })
+    provider.expects(:get_account_transactions).with("acct-1", start_date: anything).returns({
+      transactions: [
+        {
+          id: "tx-1",
+          accountId: "acct-1",
+          amount: "-12.34",
+          currency: "USD",
+          date: "2026-05-01",
+          merchant: "Coffee Shop",
+          description: "Coffee Shop"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+
+    result = SophtronItem::Importer.new(@item, sophtron_provider: provider).import
+
+    assert result[:success]
+    assert_equal 1, result[:transactions_imported]
+    assert_equal 1, sophtron_account.reload.raw_transactions_payload.count
+  end
+
+  test "completed item sync with no stored transaction payload refreshes before fetching" do
+    account = accounts(:depository)
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Checking",
+      currency: "USD",
+      balance: 100
+    )
+    AccountProvider.create!(account: account, provider: sophtron_account)
+    @item.stubs(:last_synced_at).returns(Time.current)
+
+    provider = mock
+    provider.expects(:get_accounts).with("ui-1").returns({
+      accounts: [
+        {
+          account_id: "acct-1",
+          account_name: "Checking",
+          balance: "100.00",
+          balance_currency: "USD",
+          currency: "USD"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+    provider.expects(:refresh_account).with("acct-1").returns({ JobID: "refresh-job" })
+    provider.expects(:get_job_information).with("refresh-job").returns({ LastStatus: "Completed" })
+    provider.expects(:get_account_transactions).with("acct-1", start_date: anything).returns({
+      transactions: [
+        {
+          id: "tx-1",
+          accountId: "acct-1",
+          amount: "-12.34",
+          currency: "USD",
+          date: "2026-05-01",
+          merchant: "Coffee Shop",
+          description: "Coffee Shop"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+
+    result = SophtronItem::Importer.new(@item, sophtron_provider: provider).import
+
+    assert result[:success]
+    assert_equal 1, sophtron_account.reload.raw_transactions_payload.count
+  end
+
+  test "marks item requires update when refresh job requires mfa" do
+    account = accounts(:depository)
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Checking",
+      currency: "USD",
+      balance: 100,
+      raw_transactions_payload: [ { id: "existing-tx" } ]
+    )
+    AccountProvider.create!(account: account, provider: sophtron_account)
+
+    provider = mock
+    provider.expects(:get_accounts).with("ui-1").returns({
+      accounts: [
+        {
+          account_id: "acct-1",
+          account_name: "Checking",
+          balance: "100.00",
+          balance_currency: "USD",
+          currency: "USD"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+    provider.expects(:refresh_account).with("acct-1").returns({ JobID: "refresh-job" })
+    provider.expects(:get_job_information).with("refresh-job").returns({
+      SecurityQuestion: [ "Question?" ].to_json,
+      LastStatus: "Waiting"
+    })
+
+    result = SophtronItem::Importer.new(@item, sophtron_provider: provider).import
+
+    assert_not result[:success]
+    assert_equal "requires_update", @item.reload.status
+    assert_equal "refresh-job", @item.current_job_id
+  end
+
+  test "refresh job still running enqueues poll job without fetching transactions" do
+    account = accounts(:depository)
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Checking",
+      currency: "USD",
+      balance: 100,
+      raw_transactions_payload: [ { id: "existing-tx" } ]
+    )
+    AccountProvider.create!(account: account, provider: sophtron_account)
+
+    provider = mock
+    provider.expects(:get_accounts).with("ui-1").returns({
+      accounts: [
+        {
+          account_id: "acct-1",
+          account_name: "Checking",
+          balance: "100.00",
+          balance_currency: "USD",
+          currency: "USD"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+    provider.expects(:refresh_account).with("acct-1").returns({ JobID: "refresh-job" })
+    provider.expects(:get_job_information).with("refresh-job").returns({ LastStatus: "Started" })
+    provider.expects(:get_account_transactions).never
+
+    assert_enqueued_with(job: SophtronRefreshPollJob) do
+      result = SophtronItem::Importer.new(@item, sophtron_provider: provider).import
+
+      assert result[:success]
+      assert_equal 0, result[:transactions_imported]
+      assert_equal 0, result[:transactions_failed]
+    end
+  end
+end
diff --git a/test/models/sophtron_item_test.rb b/test/models/sophtron_item_test.rb
new file mode 100644
index 000000000..c78285698
--- /dev/null
+++ b/test/models/sophtron_item_test.rb
@@ -0,0 +1,218 @@
+require "test_helper"
+
+class SophtronItemTest < ActiveSupport::TestCase
+  include ActiveJob::TestHelper
+
+  setup do
+    @family = families(:dylan_family)
+    @item = @family.sophtron_items.create!(
+      name: "Sophtron",
+      user_id: "developer-user",
+      access_key: Base64.strict_encode64("secret-key")
+    )
+  end
+
+  test "ensure_customer reuses persisted customer id" do
+    @item.update!(customer_id: "cust-existing")
+    provider = mock
+    provider.expects(:list_customers).never
+
+    assert_equal "cust-existing", @item.ensure_customer!(provider: provider)
+  end
+
+  test "ensure_customer reuses matching listed customer" do
+    provider = mock
+    provider.expects(:list_customers).returns([
+      { CustomerID: "cust-1", CustomerName: @item.generated_customer_name }
+    ])
+    provider.expects(:create_customer).never
+
+    assert_equal "cust-1", @item.ensure_customer!(provider: provider)
+    assert_equal "cust-1", @item.customer_id
+    assert_equal @item.generated_customer_name, @item.customer_name
+  end
+
+  test "ensure_customer creates customer when no matching customer exists" do
+    provider = mock
+    provider.expects(:list_customers).returns([])
+    provider.expects(:create_customer)
+      .with(unique_id: @item.generated_customer_unique_id, name: @item.generated_customer_name, source: "Sure")
+      .returns({ CustomerID: "cust-new", CustomerName: @item.generated_customer_name })
+
+    assert_equal "cust-new", @item.ensure_customer!(provider: provider)
+    assert_equal "cust-new", @item.customer_id
+  end
+
+  test "connected_to_institution ignores failed connection attempts" do
+    @item.update!(user_institution_id: "ui-1", status: :requires_update)
+
+    assert_not @item.connected_to_institution?
+  end
+
+  test "connected_to_institution ignores jobs that are still running" do
+    @item.update!(user_institution_id: "ui-1", current_job_id: "job-1", status: :good)
+
+    assert_not @item.connected_to_institution?
+  end
+
+  test "connected_to_institution ignores stale timeout job snapshots" do
+    @item.update!(
+      user_institution_id: "ui-1",
+      status: :good,
+      job_status: "Timeout",
+      raw_job_payload: {
+        SuccessFlag: false,
+        LastStatus: "Timeout"
+      }
+    )
+
+    assert_not @item.connected_to_institution?
+  end
+
+  test "provider_display_name keeps accounts grouping provider-level" do
+    @item.update!(name: "Bank of America", institution_name: "Bank of America")
+
+    assert_equal "Sophtron Connection", @item.provider_display_name
+  end
+
+  test "fetch_remote_accounts persists Sophtron account snapshots" do
+    @item.update!(user_institution_id: "ui-1")
+    provider = mock
+    provider.expects(:get_accounts).with("ui-1").returns({
+      accounts: [
+        {
+          id: "acct-1",
+          account_id: "acct-1",
+          account_name: "Sophtron Checking",
+          balance: "123.45",
+          balance_currency: "USD",
+          currency: "USD"
+        }.with_indifferent_access
+      ],
+      total: 1
+    })
+    @item.stubs(:sophtron_provider).returns(provider)
+
+    accounts = @item.fetch_remote_accounts(force: true)
+
+    assert_equal 1, accounts.count
+    assert_equal "Sophtron Checking", @item.sophtron_accounts.find_by!(account_id: "acct-1").name
+  end
+
+  test "reject_already_linked removes accounts with existing account provider links" do
+    account = accounts(:depository)
+    sophtron_account = @item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Sophtron Checking",
+      currency: "USD",
+      balance: 100
+    )
+    AccountProvider.create!(account: account, provider: sophtron_account)
+
+    available = @item.reject_already_linked([
+      { id: "acct-1", account_name: "Linked" },
+      { id: "acct-2", account_name: "Available" }
+    ])
+
+    assert_equal [ "acct-2" ], available.map { |account_data| SophtronItem.external_account_id(account_data) }
+  end
+
+  test "build_mfa_challenge normalizes Sophtron job challenge fields" do
+    challenge = @item.build_mfa_challenge(
+      SecurityQuestion: [ "Question?" ].to_json,
+      TokenMethod: [ "sms" ].to_json,
+      TokenSentFlag: true,
+      TokenInputName: "Token",
+      TokenRead: "phone",
+      CaptchaImage: "YWJj"
+    )
+
+    assert_equal [ "Question?" ], challenge[:security_questions]
+    assert_equal [ "sms" ], challenge[:token_methods]
+    assert_equal true, challenge[:token_sent]
+    assert_equal "phone", challenge[:token_read]
+    assert_equal "YWJj", challenge[:captcha_image]
+  end
+
+  test "start_initial_load_later starts a sync when no active sync exists" do
+    assert_no_enqueued_jobs only: SophtronInitialLoadJob do
+      assert_difference "@item.syncs.count", 1 do
+        assert_enqueued_with job: SyncJob do
+          @item.start_initial_load_later
+        end
+      end
+    end
+  end
+
+  test "start_initial_load_later seeds sync window for transaction import" do
+    @item.update!(sync_start_date: Date.new(2026, 1, 1))
+
+    @item.start_initial_load_later
+
+    assert_equal Date.new(2026, 1, 1), @item.syncs.ordered.first.window_start_date
+  end
+
+  test "start_initial_load_later queues a follow-up when current sync is already running" do
+    sync = @item.syncs.create!
+    sync.start!
+
+    assert_no_difference "@item.syncs.count" do
+      assert_enqueued_with job: SophtronInitialLoadJob do
+        @item.start_initial_load_later
+      end
+    end
+  end
+  test "manual Sophtron accounts do not remove the whole item from automatic sync scope" do
+    manual_item = @family.sophtron_items.create!(
+      name: "Manual Sophtron",
+      user_id: "manual-user",
+      access_key: Base64.strict_encode64("secret-key")
+    )
+    manual_account = manual_item.sophtron_accounts.create!(
+      account_id: "acct-manual",
+      name: "Manual Sophtron Checking",
+      currency: "USD",
+      balance: 100,
+      manual_sync: true
+    )
+    auto_account = manual_item.sophtron_accounts.create!(
+      account_id: "acct-auto",
+      name: "Automatic Sophtron Checking",
+      currency: "USD",
+      balance: 100
+    )
+    AccountProvider.create!(account: accounts(:depository), provider: manual_account)
+    AccountProvider.create!(account: accounts(:credit_card), provider: auto_account)
+
+    assert_includes SophtronItem.active, manual_item
+    assert_includes SophtronItem.syncable, manual_item
+    assert_equal [ auto_account ], manual_item.automatic_sync_sophtron_accounts.to_a
+    assert_equal [ manual_account ], manual_item.manual_sync_sophtron_accounts.to_a
+  end
+
+  test "whole item manual mode removes linked accounts from automatic sync scope" do
+    manual_item = @family.sophtron_items.create!(
+      name: "Manual Sophtron",
+      user_id: "manual-user",
+      access_key: Base64.strict_encode64("secret-key"),
+      manual_sync: true
+    )
+    first_account = manual_item.sophtron_accounts.create!(
+      account_id: "acct-1",
+      name: "Manual Sophtron Checking",
+      currency: "USD",
+      balance: 100
+    )
+    second_account = manual_item.sophtron_accounts.create!(
+      account_id: "acct-2",
+      name: "Manual Sophtron Card",
+      currency: "USD",
+      balance: 200
+    )
+    AccountProvider.create!(account: accounts(:depository), provider: first_account)
+    AccountProvider.create!(account: accounts(:credit_card), provider: second_account)
+
+    assert_empty manual_item.automatic_sync_sophtron_accounts
+    assert_equal [ first_account, second_account ], manual_item.manual_sync_sophtron_accounts.to_a
+  end
+end
diff --git a/test/models/sso_provider_tester_test.rb b/test/models/sso_provider_tester_test.rb
new file mode 100644
index 000000000..e01685d62
--- /dev/null
+++ b/test/models/sso_provider_tester_test.rb
@@ -0,0 +1,34 @@
+require "test_helper"
+
+class SsoProviderTesterTest < ActiveSupport::TestCase
+  test "oidc discovery requires exact issuer match" do
+    provider = SsoProvider.new(
+      strategy: "openid_connect",
+      name: "pocket_id",
+      label: "Pocket ID",
+      issuer: "https://pocketid.example.com/",
+      client_id: "client-id",
+      client_secret: "secret"
+    )
+
+    response = stub(status: 200, success?: true, body: {
+      issuer: "https://pocketid.example.com",
+      authorization_endpoint: "https://pocketid.example.com/authorize",
+      token_endpoint: "https://pocketid.example.com/api/oidc/token"
+    }.to_json)
+
+    client = stub
+    client.stubs(:get).returns(response)
+
+    tester = SsoProviderTester.new(provider)
+    tester.stubs(:faraday_client).returns(client)
+
+    result = tester.test!
+
+    assert_not result.success?
+    assert_includes result.message, "Issuer mismatch"
+    assert_includes result.message, "trailing slash mismatch"
+    assert_equal "https://pocketid.example.com/", result.details[:expected]
+    assert_equal "https://pocketid.example.com", result.details[:actual]
+  end
+end
diff --git a/test/models/sure_import_test.rb b/test/models/sure_import_test.rb
index 87d70db8c..ff99bb6fd 100644
--- a/test/models/sure_import_test.rb
+++ b/test/models/sure_import_test.rb
@@ -37,9 +37,37 @@ class SureImportTest < ActiveSupport::TestCase
   end
 
   test "max_row_count is higher than standard imports" do
+    assert_equal 100_000, SureImport.max_row_count
     assert_equal 100_000, @import.max_row_count
   end
 
+  test "dry_run totals can be derived from existing line type counts" do
+    counts = {
+      "Account" => 2,
+      "Transaction" => 3,
+      "UnknownType" => 4
+    }
+
+    dry_run = SureImport.dry_run_totals_from_line_type_counts(counts)
+
+    assert_equal 2, dry_run[:accounts]
+    assert_equal 3, dry_run[:transactions]
+    assert_equal 0, dry_run[:categories]
+    assert_not dry_run.key?(:unknown_type)
+  end
+
+  test "ndjson line type counts ignore records without data" do
+    ndjson = [
+      { type: "Account", data: { id: "uuid-1" } },
+      { type: "Transaction" },
+      { data: { id: "uuid-2" } }
+    ].map(&:to_json).join("\n")
+
+    counts = SureImport.ndjson_line_type_counts(ndjson)
+
+    assert_equal({ "Account" => 1 }, counts)
+  end
+
   test "csv_template returns nil" do
     assert_nil @import.csv_template
   end
@@ -79,6 +107,17 @@ class SureImportTest < ActiveSupport::TestCase
     assert @import.publishable?
   end
 
+  test "status predicates honor validation stats" do
+    attach_ndjson(build_ndjson([
+      { type: "Account", data: { id: "uuid-1", name: "Test", balance: "1000", currency: "USD", accountable_type: "Depository" } }
+    ]))
+
+    assert @import.cleaned_from_validation_stats?(invalid_rows_count: 0)
+    assert @import.publishable_from_validation_stats?(invalid_rows_count: 0)
+    assert_not @import.cleaned_from_validation_stats?(invalid_rows_count: 1)
+    assert_not @import.publishable_from_validation_stats?(invalid_rows_count: 1)
+  end
+
   test "dry_run returns counts by type" do
     attach_ndjson(build_ndjson([
       { type: "Account", data: { id: "uuid-1" } },
@@ -97,6 +136,22 @@ class SureImportTest < ActiveSupport::TestCase
     assert_equal 0, dry_run[:tags]
   end
 
+  test "cached ndjson content is refreshed when attachment is replaced" do
+    attach_ndjson(build_ndjson([
+      { type: "Account", data: { id: "uuid-1" } }
+    ]))
+    assert_equal 1, @import.dry_run[:accounts]
+
+    attach_ndjson(build_ndjson([
+      { type: "Transaction", data: { id: "uuid-2" } }
+    ]))
+
+    dry_run = @import.dry_run
+    assert_equal 0, dry_run[:accounts]
+    assert_equal 1, dry_run[:transactions]
+    assert_equal 1, @import.rows_count
+  end
+
   test "sync_ndjson_rows_count! sets total row count" do
     attach_ndjson(build_ndjson([
       { type: "Account", data: { id: "uuid-1" } },
@@ -109,6 +164,52 @@ class SureImportTest < ActiveSupport::TestCase
     assert_equal 3, @import.rows_count
   end
 
+  test "sync_ndjson_rows_count! persists expected record counts" do
+    attach_ndjson(build_ndjson([
+      { type: "Account", data: { id: "account-1" } },
+      { type: "Balance", data: { id: "balance-1" } },
+      { type: "Transaction", data: { id: "transaction-1" } },
+      { type: "UnknownType", data: { id: "unknown-1" } }
+    ]))
+
+    @import.reload
+
+    assert_equal 4, @import.rows_count
+    assert_equal 1, @import.expected_record_counts["accounts"]
+    assert_equal 1, @import.expected_record_counts["balances"]
+    assert_equal 1, @import.expected_record_counts["transactions"]
+    assert_not @import.expected_record_counts.key?("unknown_type")
+    assert_equal({}, @import.readback_verification)
+  end
+
+  test "import resyncs expected counts from current attachment" do
+    attach_ndjson(build_ndjson([
+      { type: "Account", data: { id: "stale-account" } }
+    ]))
+    @import.ndjson_file.attach(
+      io: StringIO.new(build_ndjson([
+        { type: "Category", data: {
+          id: "current-category",
+          name: "Current Category",
+          color: "#407706",
+          classification: "expense",
+          lucide_icon: "shapes"
+        } }
+      ])),
+      filename: "current.ndjson",
+      content_type: "application/x-ndjson"
+    )
+
+    @import.import!
+    @import.reload
+
+    assert_equal 1, @import.rows_count
+    assert_equal 0, @import.expected_record_counts["accounts"]
+    assert_equal 1, @import.expected_record_counts["categories"]
+    assert_equal 1, @import.readback_verification.dig("expected_record_counts", "categories")
+    assert_equal "matched", @import.readback_verification["status"]
+  end
+
   test "publishes import successfully" do
     attach_ndjson(build_ndjson([
       { type: "Account", data: {
@@ -135,6 +236,163 @@ class SureImportTest < ActiveSupport::TestCase
     assert_equal "Depository", account.accountable_type
   end
 
+  test "publish records matched readback verification from family-scoped deltas" do
+    other_family = Family.create!(name: "Other Family", currency: "USD", locale: "en", date_format: "%m-%d-%Y")
+    other_family.accounts.create!(
+      name: "Other Checking",
+      balance: 100,
+      currency: "USD",
+      accountable: Depository.new
+    )
+
+    attach_ndjson(importable_history_ndjson)
+
+    @import.publish
+    @import.reload
+
+    verification = @import.readback_verification
+
+    assert_equal "complete", @import.status
+    assert_equal "matched", verification["status"]
+    assert_equal 1, verification.dig("expected_record_counts", "accounts")
+    assert_equal 1, verification.dig("expected_record_counts", "categories")
+    assert_equal 1, verification.dig("expected_record_counts", "tags")
+    assert_equal 1, verification.dig("expected_record_counts", "merchants")
+    assert_equal 1, verification.dig("expected_record_counts", "transactions")
+    assert_equal 1, verification.dig("expected_record_counts", "valuations")
+    assert_equal 1, verification.dig("actual_delta_counts", "accounts")
+    assert_equal 1, verification.dig("actual_delta_counts", "categories")
+    assert_equal 1, verification.dig("actual_delta_counts", "tags")
+    assert_equal 1, verification.dig("actual_delta_counts", "merchants")
+    assert_equal 1, verification.dig("actual_delta_counts", "transactions")
+    assert_equal 1, verification.dig("actual_delta_counts", "valuations")
+    assert_equal 0, verification.dig("checked_counts", "balances")
+    assert_empty verification["mismatches"]
+    assert_equal 1, other_family.accounts.count
+  end
+
+  test "publish verifies expected zero record types against unexpected readback deltas" do
+    attach_ndjson(build_ndjson([
+      { type: "Account", data: {
+        id: "account-1",
+        name: "Implicit Opening Anchor",
+        balance: "100.00",
+        currency: "USD",
+        accountable_type: "Depository",
+        accountable: { subtype: "checking" }
+      } }
+    ]))
+
+    @import.publish
+    @import.reload
+
+    verification = @import.readback_verification
+
+    assert_equal "complete", @import.status
+    assert_equal "mismatch", verification["status"]
+    assert_equal 0, verification.dig("expected_record_counts", "valuations")
+    assert_equal 0, verification.dig("checked_counts", "valuations")
+    assert_equal 1, verification.dig("actual_delta_counts", "valuations")
+    assert_equal({ "expected" => 0, "actual" => 1 }, verification.dig("mismatches", "valuations"))
+  end
+
+  test "publish records mismatch when expected rows are skipped by readback" do
+    attach_ndjson(build_ndjson([
+      { type: "Transaction", data: {
+        id: "transaction-1",
+        account_id: "missing-account",
+        date: "2024-01-15",
+        amount: "12.34",
+        name: "Skipped transaction",
+        currency: "USD"
+      } }
+    ]))
+
+    @import.publish
+    @import.reload
+
+    assert_equal "complete", @import.status
+    assert_equal "mismatch", @import.readback_verification["status"]
+    assert_equal({ "expected" => 1, "actual" => 0 }, @import.readback_verification.dig("mismatches", "transactions"))
+  end
+
+  test "failed publish records failed verification without partial mutation" do
+    attach_ndjson(build_ndjson([
+      { type: "Account", data: {
+        id: "account-1",
+        name: "Rollback Account",
+        balance: "100.00",
+        currency: "USD",
+        accountable_type: "Depository"
+      } },
+      { type: "Transaction", data: {
+        id: "transaction-1",
+        account_id: "account-1",
+        date: "not-a-date",
+        amount: "12.34",
+        name: "Bad date",
+        currency: "USD"
+      } }
+    ]))
+
+    initial_account_count = @family.accounts.count
+    initial_transaction_count = @family.entries.where(entryable_type: "Transaction").count
+
+    @import.publish
+    @import.reload
+
+    assert_equal "failed", @import.status
+    assert_equal initial_account_count, @family.accounts.count
+    assert_equal initial_transaction_count, @family.entries.where(entryable_type: "Transaction").count
+    assert_equal "failed", @import.readback_verification["status"]
+    assert_equal 0, @import.readback_verification.dig("actual_delta_counts", "accounts")
+    assert_equal 0, @import.readback_verification.dig("actual_delta_counts", "transactions")
+  end
+
+  test "failed publish keeps original error when failed verification cannot be recorded" do
+    before_counts = @import.send(:readback_count_snapshot)
+    original_error = StandardError.new("original import failure")
+    logged_messages = []
+
+    Rails.logger.stubs(:warn).with do |message|
+      logged_messages << message unless logged_messages.include?(message)
+      true
+    end
+    @import.stubs(:update_columns).raises(StandardError, "verification write failed")
+
+    @import.send(:record_failed_readback_verification!, before_counts:, error: original_error)
+
+    assert_match(/Failed to record Sure import readback verification/, logged_messages.first)
+    assert_match(/verification write failed/, logged_messages.first)
+  end
+
+  test "revert marks Sure readback verification as reverted" do
+    attach_ndjson(importable_history_ndjson)
+
+    @import.publish
+    assert_equal "matched", @import.reload.verification_status
+
+    @import.revert
+
+    assert_equal "pending", @import.status
+    assert_equal "reverted", @import.verification_status
+  end
+
+  test "revert failure leaves existing Sure readback verification untouched" do
+    attach_ndjson(importable_history_ndjson)
+
+    @import.publish
+    verification = @import.reload.readback_verification
+
+    @import.stub(:entries, -> { raise StandardError, "revert failed before pending" }) do
+      @import.revert
+    end
+
+    assert_equal "revert_failed", @import.status
+    assert_equal verification, @import.readback_verification
+    assert_equal "matched", @import.verification_status
+  end
+
   test "import tracks created accounts for revert" do
     attach_ndjson(build_ndjson([
       { type: "Account", data: {
@@ -184,4 +442,53 @@ class SureImportTest < ActiveSupport::TestCase
     def build_ndjson(records)
       records.map(&:to_json).join("\n")
     end
+
+    def importable_history_ndjson
+      build_ndjson([
+        { type: "Account", data: {
+          id: "account-1",
+          name: "Verified Checking",
+          balance: "1000.00",
+          currency: "USD",
+          accountable_type: "Depository",
+          accountable: { subtype: "checking" }
+        } },
+        { type: "Valuation", data: {
+          id: "valuation-1",
+          account_id: "account-1",
+          date: "2024-01-14",
+          amount: "1000.00",
+          currency: "USD",
+          kind: "opening_anchor"
+        } },
+        { type: "Category", data: {
+          id: "category-1",
+          name: "Verified Category",
+          color: "#407706",
+          classification: "expense",
+          lucide_icon: "shapes"
+        } },
+        { type: "Tag", data: {
+          id: "tag-1",
+          name: "Verified Tag",
+          color: "#407706"
+        } },
+        { type: "Merchant", data: {
+          id: "merchant-1",
+          name: "Verified Merchant",
+          color: "#407706"
+        } },
+        { type: "Transaction", data: {
+          id: "transaction-1",
+          account_id: "account-1",
+          category_id: "category-1",
+          merchant_id: "merchant-1",
+          tag_ids: [ "tag-1" ],
+          date: "2024-01-15",
+          amount: "12.34",
+          name: "Verified transaction",
+          currency: "USD"
+        } }
+      ])
+    end
 end
diff --git a/test/models/sync_test.rb b/test/models/sync_test.rb
index d1182fd51..6fa8be3c9 100644
--- a/test/models/sync_test.rb
+++ b/test/models/sync_test.rb
@@ -200,6 +200,46 @@ class SyncTest < ActiveSupport::TestCase
     assert_equal "stale", stale_syncing.reload.status
   end
 
+  test "ordered uses id as deterministic tie breaker" do
+    timestamp = Time.current.change(usec: 0)
+    older_id = SecureRandom.uuid
+    newer_id = SecureRandom.uuid
+    older_id, newer_id = [ older_id, newer_id ].sort
+
+    older_sync = Sync.create!(id: older_id, syncable: accounts(:depository), status: :completed, created_at: timestamp)
+    newer_sync = Sync.create!(id: newer_id, syncable: accounts(:connected), status: :completed, created_at: timestamp)
+
+    ordered_ids = Sync.where(id: [ older_sync.id, newer_sync.id ]).ordered.pluck(:id)
+
+    assert_equal [ newer_sync.id, older_sync.id ], ordered_ids
+  end
+
+  test "for_family includes syncable provider item associations from family reflections" do
+    family = families(:dylan_family)
+    syncable_item_associations = Family.reflect_on_all_associations(:has_many).select do |association|
+      association.name.to_s.end_with?("_items") &&
+        association.klass.included_modules.include?(Syncable)
+    rescue NameError
+      false
+    end
+
+    syncs = syncable_item_associations.filter_map do |association|
+      syncable = family.public_send(association.name).first
+      next unless syncable
+
+      Sync.create!(syncable: syncable, status: :completed)
+    end
+
+    assert syncs.any?, "Expected syncable provider item fixtures for this family"
+    assert_equal syncs.map(&:id).sort, Sync.for_family(family).where(id: syncs.map(&:id)).pluck(:id).sort
+  end
+
+  test "api error payload is present for failed syncs without raw error text" do
+    sync = Sync.create!(syncable: accounts(:depository), status: :failed)
+
+    assert_equal({ message: "Sync failed" }, sync.api_error_payload)
+  end
+
   test "expand_window_if_needed widens start and end dates on a pending sync" do
     initial_start = 1.day.ago.to_date
     initial_end   = 1.day.ago.to_date
diff --git a/test/models/trade_import_test.rb b/test/models/trade_import_test.rb
index 3fbdd3c11..533e8b79f 100644
--- a/test/models/trade_import_test.rb
+++ b/test/models/trade_import_test.rb
@@ -10,6 +10,38 @@ class TradeImportTest < ActiveSupport::TestCase
     Security.stubs(:provider).returns(@provider)
   end
 
+  test "csv_template uses ISO dates" do
+    first_row = @import.csv_template.first
+
+    assert_equal "2024-05-15", first_row["date*"]
+  end
+
+  test "generates rows from legacy quantity header with template labels" do
+    import_csv = <<~CSV
+      date,ticker,quantity,price,account_name
+      2024-05-15,AAPL,10,150.00,Trading Account
+    CSV
+
+    @import.update!(
+      raw_file_str: import_csv,
+      date_col_label: "date*",
+      ticker_col_label: "ticker*",
+      qty_col_label: "qty*",
+      price_col_label: "price*",
+      account_col_label: "account",
+      date_format: "%Y-%m-%d",
+      signage_convention: "inflows_positive"
+    )
+
+    @import.generate_rows_from_csv
+    row = @import.rows.reload.first
+
+    assert row.valid?
+    assert_equal "Trading Account", row.account
+    assert_equal "10", row.qty
+    assert_equal BigDecimal("1500"), row.signed_amount
+  end
+
   test "imports trades and accounts" do
     aapl_resolver = mock
     googl_resolver = mock
diff --git a/test/models/trade_test.rb b/test/models/trade_test.rb
index bcf09b192..6223a5fc7 100644
--- a/test/models/trade_test.rb
+++ b/test/models/trade_test.rb
@@ -52,6 +52,30 @@ class TradeTest < ActiveSupport::TestCase
     assert_equal 0, trade.fee
   end
 
+  test "exchange_rate setter stores normalized numeric value in extra" do
+    trade = Trade.new
+    trade.exchange_rate = "0.91"
+
+    assert_equal 0.91, trade.exchange_rate
+    assert_equal 0.91, trade.extra["exchange_rate"]
+  end
+
+  test "exchange_rate validation rejects invalid values" do
+    trade = Trade.new
+    trade.exchange_rate = "invalid"
+
+    assert_not trade.valid?
+    assert_includes trade.errors[:exchange_rate], "must be a number"
+  end
+
+  test "exchange_rate validation rejects non-finite values" do
+    trade = Trade.new
+    trade.exchange_rate = "NaN"
+
+    assert_not trade.valid?
+    assert_includes trade.errors[:exchange_rate], "must be a number"
+  end
+
   test "price is rounded to 10 decimal places" do
     security = Security.create!(ticker: "TEST", exchange_operating_mic: "XNAS")
 
diff --git a/test/models/transaction/activity_security_preloader_test.rb b/test/models/transaction/activity_security_preloader_test.rb
new file mode 100644
index 000000000..017dfb865
--- /dev/null
+++ b/test/models/transaction/activity_security_preloader_test.rb
@@ -0,0 +1,28 @@
+require "test_helper"
+
+class Transaction::ActivitySecurityPreloaderTest < ActiveSupport::TestCase
+  test "preloads activity securities for transactions" do
+    transaction = Transaction.new(extra: { "security_id" => securities(:aapl).id })
+
+    Transaction::ActivitySecurityPreloader.new([ transaction ]).preload
+
+    assert_equal securities(:aapl), transaction.activity_security
+  end
+
+  test "preloads activity securities for entry collections" do
+    transaction = Transaction.new(extra: { "security_id" => securities(:aapl).id })
+    entry = Entry.new(account: accounts(:depository), entryable: transaction, date: Date.current, name: "Dividend", amount: 10, currency: "USD")
+
+    Transaction::ActivitySecurityPreloader.new([ entry ]).preload
+
+    assert_equal securities(:aapl), transaction.activity_security
+  end
+
+  test "sets nil when the referenced security cannot be found" do
+    transaction = Transaction.new(extra: { "security_id" => SecureRandom.uuid })
+
+    Transaction::ActivitySecurityPreloader.new([ transaction ]).preload
+
+    assert_nil transaction.activity_security
+  end
+end
diff --git a/test/models/transaction/merge_with_duplicate_test.rb b/test/models/transaction/merge_with_duplicate_test.rb
new file mode 100644
index 000000000..8149d0973
--- /dev/null
+++ b/test/models/transaction/merge_with_duplicate_test.rb
@@ -0,0 +1,308 @@
+require "test_helper"
+
+class Transaction::MergeWithDuplicateTest < ActiveSupport::TestCase
+  include EntriesTestHelper
+
+  setup do
+    @account = accounts(:depository)
+    @family  = @account.family
+
+    @category_a = categories(:food_and_drink)
+    @category_b = categories(:income)
+
+    # Pending entry — simulates a bank-synced pending transaction
+    @pending_entry = create_transaction(
+      account:     @account,
+      name:        "Starbucks Pending",
+      date:        3.days.ago.to_date,
+      amount:      10,
+      currency:    "USD",
+      external_id: "enable_banking_PDNG123",
+      source:      "enable_banking",
+      category:    @category_a
+    )
+    @pending_entry.transaction.update!(
+      extra: { "enable_banking" => { "pending" => true } }
+    )
+
+    # Posted (booked) entry — the canonical settled transaction from the bank
+    @posted_entry = create_transaction(
+      account:  @account,
+      name:     "STARBUCKS CORP",
+      date:     1.day.ago.to_date,
+      amount:   10,
+      currency: "USD",
+      external_id: "enable_banking_BOOK456",
+      source:      "enable_banking"
+    )
+
+    # Wire up the duplicate suggestion on the pending transaction
+    @pending_entry.transaction.update!(
+      extra: @pending_entry.transaction.extra.merge(
+        "potential_posted_match" => {
+          "entry_id"      => @posted_entry.id,
+          "reason"        => "fuzzy_amount_match",
+          "posted_amount" => "10.0",
+          "confidence"    => "medium",
+          "detected_at"   => Date.current.to_s,
+          "dismissed"     => false
+        }
+      )
+    )
+  end
+
+  test "destroys the pending entry on successful merge" do
+    pending_id = @pending_entry.id
+    assert_difference "Entry.count", -1 do
+      @pending_entry.transaction.merge_with_duplicate!
+    end
+    assert_nil Entry.find_by(id: pending_id)
+  end
+
+  test "records merged_from_external_id on the surviving posted transaction" do
+    @pending_entry.transaction.merge_with_duplicate!
+
+    posted_tx = @posted_entry.transaction.reload
+    assert_equal "enable_banking_PDNG123", posted_tx.extra.dig("manual_merge", 0, "merged_from_external_id")
+  end
+
+  test "records merged_from_entry_id and source in manual_merge metadata" do
+    pending_id = @pending_entry.id
+    @pending_entry.transaction.merge_with_duplicate!
+
+    merge_meta = @posted_entry.transaction.reload.extra["manual_merge"].first
+    assert_equal pending_id, merge_meta["merged_from_entry_id"]
+    assert_equal "enable_banking", merge_meta["source"]
+    assert merge_meta["merged_at"].present?
+  end
+
+  test "appends to existing manual_merge array preserving prior merged IDs" do
+    # Seed a prior merge record directly so the posted entry already has one ID
+    prior_ext_id = "enable_banking_PDNG_PRIOR"
+    @posted_entry.transaction.update!(
+      extra: {
+        "manual_merge" => [
+          { "merged_from_external_id" => prior_ext_id, "merged_at" => 1.day.ago.iso8601, "source" => "enable_banking" }
+        ]
+      }
+    )
+
+    @pending_entry.transaction.merge_with_duplicate!
+
+    records = @posted_entry.transaction.reload.extra["manual_merge"]
+    assert_equal 2, records.size
+    assert_includes records.map { |r| r["merged_from_external_id"] }, prior_ext_id
+    assert_includes records.map { |r| r["merged_from_external_id"] }, "enable_banking_PDNG123"
+  end
+
+  test "migrates legacy single-object manual_merge to array on second merge" do
+    # Simulate an existing record written in the old single-Hash format
+    @posted_entry.transaction.update!(
+      extra: {
+        "manual_merge" => {
+          "merged_from_external_id" => "enable_banking_LEGACY",
+          "merged_at"               => 1.day.ago.iso8601,
+          "source"                  => "enable_banking"
+        }
+      }
+    )
+
+    @pending_entry.transaction.merge_with_duplicate!
+
+    records = @posted_entry.transaction.reload.extra["manual_merge"]
+    assert_kind_of Array, records
+    assert_equal 2, records.size
+    assert_includes records.map { |r| r["merged_from_external_id"] }, "enable_banking_LEGACY"
+    assert_includes records.map { |r| r["merged_from_external_id"] }, "enable_banking_PDNG123"
+  end
+
+  test "inherits date from pending entry onto posted entry" do
+    original_posted_date = @posted_entry.date
+    pending_date = @pending_entry.date
+    refute_equal original_posted_date, pending_date
+
+    @pending_entry.transaction.merge_with_duplicate!
+
+    assert_equal pending_date, @posted_entry.reload.date
+  end
+
+  test "inherits category from pending entry onto posted entry" do
+    assert_nil @posted_entry.transaction.category_id
+
+    @pending_entry.transaction.merge_with_duplicate!
+
+    assert_equal @category_a.id, @posted_entry.transaction.reload.category_id
+  end
+
+  test "overwrites existing category on posted entry with pending category" do
+    @posted_entry.transaction.update!(category: @category_b)
+
+    @pending_entry.transaction.merge_with_duplicate!
+
+    assert_equal @category_a.id, @posted_entry.transaction.reload.category_id
+  end
+
+  test "does not inherit name from pending — booked name is canonical" do
+    @pending_entry.transaction.merge_with_duplicate!
+
+    assert_equal "STARBUCKS CORP", @posted_entry.reload.name
+  end
+
+  test "marks the posted entry as user_modified to prevent future sync overwrites" do
+    refute @posted_entry.user_modified?
+
+    @pending_entry.transaction.merge_with_duplicate!
+
+    assert @posted_entry.reload.user_modified?
+  end
+
+  test "returns true on success" do
+    result = @pending_entry.transaction.merge_with_duplicate!
+    assert_equal true, result
+  end
+
+  test "returns false when no potential duplicate is set" do
+    @pending_entry.transaction.update!(extra: {})
+    result = @pending_entry.transaction.merge_with_duplicate!
+    assert_equal false, result
+  end
+
+  test "returns false when the suggested posted entry no longer exists" do
+    @posted_entry.destroy!
+    result = @pending_entry.transaction.merge_with_duplicate!
+    assert_equal false, result
+  end
+
+  test "returns false and does not destroy pending entry when posted entry is on a different account" do
+    other_account = accounts(:credit_card)
+    @posted_entry.update!(account: other_account)
+
+    result = nil
+    assert_no_difference "Entry.count" do
+      result = @pending_entry.transaction.merge_with_duplicate!
+    end
+    assert_equal false, result
+  end
+
+  test "does not update date or category when posted entry is already user_modified" do
+    # Give posted entry a category so we can assert it was preserved (avoids nil==nil comparison)
+    @posted_entry.transaction.update!(category: @category_b)
+    original_date     = @posted_entry.reload.date
+    original_category = @posted_entry.transaction.reload.category_id
+    @posted_entry.mark_user_modified!
+
+    @pending_entry.transaction.merge_with_duplicate!
+
+    assert_equal original_date,     @posted_entry.reload.date
+    assert_equal original_category, @posted_entry.transaction.reload.category_id
+  end
+
+  test "still records merge metadata even when posted entry is already user_modified" do
+    @posted_entry.mark_user_modified!
+
+    @pending_entry.transaction.merge_with_duplicate!
+
+    assert_equal "enable_banking_PDNG123",
+                 @posted_entry.transaction.reload.extra.dig("manual_merge", 0, "merged_from_external_id")
+  end
+
+  test "is idempotent when pending entry is already destroyed (concurrent merge)" do
+    @pending_entry.destroy!
+
+    result = nil
+    assert_no_difference "Entry.count" do
+      result = @pending_entry.transaction.merge_with_duplicate!
+    end
+    assert_equal true, result
+  end
+
+  test "skips storing merge metadata when pending entry has no external_id" do
+    @pending_entry.update!(external_id: nil)
+
+    @pending_entry.transaction.merge_with_duplicate!
+
+    merge_meta = @posted_entry.transaction.reload.extra&.dig("manual_merge")
+    assert_nil merge_meta
+  end
+
+  # --- C-1: concurrent deletion of posted entry ---
+
+  test "returns false when posted entry is deleted between check and lock" do
+    # Simulate the race: posted_entry exists at find_by time but is gone at lock! time.
+    # Use a stub rather than dup so id and account_id are real values — dup gives id: nil.
+    ghost = stub(account_id: @posted_entry.account_id, id: @posted_entry.id)
+    ghost.stubs(:lock!).raises(ActiveRecord::RecordNotFound)
+    @pending_entry.transaction.stubs(:potential_duplicate_entry).returns(ghost)
+
+    result = nil
+    assert_no_difference "Entry.count" do
+      result = @pending_entry.transaction.merge_with_duplicate!
+    end
+    assert_equal false, result
+  end
+
+  # --- cascade: delegated_type dependent: :destroy removes the Transaction too ---
+
+  test "destroys the pending Transaction record on successful merge" do
+    assert_difference "Transaction.count", -1 do
+      @pending_entry.transaction.merge_with_duplicate!
+    end
+  end
+
+  # --- dismiss_duplicate_suggestion! ---
+
+  test "dismiss_duplicate_suggestion! sets dismissed flag on the match" do
+    @pending_entry.transaction.dismiss_duplicate_suggestion!
+    assert_equal true, @pending_entry.transaction.reload.extra.dig("potential_posted_match", "dismissed")
+  end
+
+  test "dismiss_duplicate_suggestion! makes has_potential_duplicate? return false" do
+    @pending_entry.transaction.dismiss_duplicate_suggestion!
+    assert_not @pending_entry.transaction.reload.has_potential_duplicate?
+  end
+
+  test "dismiss_duplicate_suggestion! returns false when no suggestion is present" do
+    @pending_entry.transaction.update!(extra: {})
+    assert_equal false, @pending_entry.transaction.dismiss_duplicate_suggestion!
+  end
+
+  test "merge_with_duplicate! returns false when suggestion has been dismissed" do
+    @pending_entry.transaction.dismiss_duplicate_suggestion!
+    assert_equal false, @pending_entry.transaction.reload.merge_with_duplicate!
+  end
+
+  # --- clear_duplicate_suggestion! ---
+
+  test "clear_duplicate_suggestion! removes potential_posted_match key entirely" do
+    @pending_entry.transaction.clear_duplicate_suggestion!
+    assert_nil @pending_entry.transaction.reload.extra["potential_posted_match"]
+  end
+
+  test "clear_duplicate_suggestion! returns false when no suggestion is present" do
+    @pending_entry.transaction.update!(extra: {})
+    assert_equal false, @pending_entry.transaction.clear_duplicate_suggestion!
+  end
+
+  # --- pending_duplicate_candidates ---
+
+  test "pending_duplicate_candidates returns posted transactions from the same account" do
+    candidates = @pending_entry.transaction.pending_duplicate_candidates
+    assert_includes candidates, @posted_entry
+  end
+
+  test "pending_duplicate_candidates excludes the pending entry itself" do
+    candidates = @pending_entry.transaction.pending_duplicate_candidates
+    assert_not_includes candidates, @pending_entry
+  end
+
+  test "pending_duplicate_candidates excludes transactions from other accounts" do
+    other_entry = create_transaction(account: accounts(:credit_card), amount: 10, currency: "USD")
+    candidates = @pending_entry.transaction.pending_duplicate_candidates
+    assert_not_includes candidates, other_entry
+  end
+
+  test "pending_duplicate_candidates returns Entry.none when transaction is not pending" do
+    @pending_entry.transaction.update!(extra: {})
+    assert_equal [], @pending_entry.transaction.pending_duplicate_candidates.to_a
+  end
+end
diff --git a/test/models/transaction/search_test.rb b/test/models/transaction/search_test.rb
index 1d7521c0e..e3e899929 100644
--- a/test/models/transaction/search_test.rb
+++ b/test/models/transaction/search_test.rb
@@ -625,4 +625,25 @@ class Transaction::SearchTest < ActiveSupport::TestCase
       end
     end
   end
+
+  test "empty accessible_account_ids yields no visible transactions" do
+    create_transaction(account: @checking_account, amount: 100)
+
+    search = Transaction::Search.new(@family, filters: {}, accessible_account_ids: [])
+
+    assert_empty search.transactions_scope
+  end
+
+  test "totals handles empty accessible_account_ids without raising" do
+    create_transaction(account: @checking_account, amount: 100)
+
+    search = Transaction::Search.new(@family, filters: {}, accessible_account_ids: [])
+    totals = search.totals
+
+    assert_equal 0, totals.count
+    assert_equal Money.new(0, @family.currency), totals.expense_money
+    assert_equal Money.new(0, @family.currency), totals.income_money
+    assert_equal Money.new(0, @family.currency), totals.transfer_inflow_money
+    assert_equal Money.new(0, @family.currency), totals.transfer_outflow_money
+  end
 end
diff --git a/test/models/transaction_import_test.rb b/test/models/transaction_import_test.rb
index c832b59f1..13d638dbd 100644
--- a/test/models/transaction_import_test.rb
+++ b/test/models/transaction_import_test.rb
@@ -100,7 +100,91 @@ class TransactionImportTest < ActiveSupport::TestCase
       @import.publish
     end
 
-    assert_equal [ -100, 200, -300 ], @import.entries.map(&:amount)
+    assert_equal [ -100, 200, -300 ], @import.entries.order(:date).map(&:amount)
+  end
+
+  test "csv_template uses ISO dates" do
+    first_row = @import.csv_template.first
+
+    assert_equal "2024-05-15", first_row["date*"]
+  end
+
+  test "generates rows from legacy account_name header with template labels" do
+    import_csv = <<~CSV
+      date,account_name,amount,name
+      2024-05-15,Checking Account,42.50,Legacy Export Row
+    CSV
+
+    @import.update!(
+      raw_file_str: import_csv,
+      date_col_label: "date*",
+      amount_col_label: "amount*",
+      name_col_label: "name",
+      account_col_label: "account",
+      date_format: "%Y-%m-%d",
+      amount_type_strategy: "signed_amount",
+      signage_convention: "inflows_negative"
+    )
+
+    @import.generate_rows_from_csv
+    row = @import.rows.reload.first
+
+    assert row.valid?
+    assert_equal "Checking Account", row.account
+    assert_equal "2024-05-15", row.date
+    assert_equal BigDecimal("42.50"), row.signed_amount
+  end
+
+  test "generates rows from alias column when configured column value is blank" do
+    import_csv = <<~CSV
+      date*,account,account_name,amount,name
+      2024-05-15,,Checking Account,42.50,Legacy Export Row
+    CSV
+
+    @import.update!(
+      raw_file_str: import_csv,
+      date_col_label: "date*",
+      amount_col_label: "amount*",
+      name_col_label: "name",
+      account_col_label: "account",
+      date_format: "%Y-%m-%d",
+      amount_type_strategy: "signed_amount",
+      signage_convention: "inflows_negative"
+    )
+
+    @import.generate_rows_from_csv
+    row = @import.rows.reload.first
+
+    assert row.valid?
+    assert_equal "Checking Account", row.account
+  end
+
+  test "rejects duplicate normalized CSV headers" do
+    import_csv = <<~CSV
+      date,date*,amount,name
+      2024-05-15,2024-05-16,42.50,Duplicate Date Row
+    CSV
+
+    @import.update!(
+      raw_file_str: import_csv,
+      date_col_label: "date",
+      amount_col_label: "amount",
+      name_col_label: "name",
+      date_format: "%Y-%m-%d",
+      amount_type_strategy: "signed_amount",
+      signage_convention: "inflows_negative"
+    )
+
+    error = assert_raises(ActiveRecord::RecordInvalid) { @import.generate_rows_from_csv }
+
+    assert_includes error.record.errors.full_messages.to_sentence, "date, date*"
+  end
+
+  test "parses legacy comma tags and escaped pipe tags" do
+    assert_equal [ "groceries", "essentials" ], Import::Row.new(tags: "groceries,essentials").tags_list
+    assert_equal [ "Food, Dining", "essentials" ], Import::Row.new(tags: "Food\\, Dining,essentials").tags_list
+    assert_equal [ "Food|Dining" ], Import::Row.new(tags: "Food\\|Dining").tags_list
+    assert_equal [ "Food|Dining", "essentials" ], Import::Row.new(tags: "Food\\|Dining|essentials").tags_list
   end
 
   test "does not create duplicate when matching transaction exists with same name" do
diff --git a/test/models/transaction_test.rb b/test/models/transaction_test.rb
index 17018f778..dfbf8e96b 100644
--- a/test/models/transaction_test.rb
+++ b/test/models/transaction_test.rb
@@ -25,6 +25,18 @@ class TransactionTest < ActiveSupport::TestCase
     assert_not transaction.pending?
   end
 
+  test "pending? returns true for enable_banking pending transactions" do
+    transaction = Transaction.new(extra: { "enable_banking" => { "pending" => true } })
+
+    assert transaction.pending?
+  end
+
+  test "pending? returns false for enable_banking non-pending transactions" do
+    transaction = Transaction.new(extra: { "enable_banking" => { "pending" => false } })
+
+    assert_not transaction.pending?
+  end
+
   test "investment_contribution is a valid kind" do
     transaction = Transaction.new(kind: "investment_contribution")
 
@@ -67,4 +79,104 @@ class TransactionTest < ActiveSupport::TestCase
     assert_includes Transaction::ACTIVITY_LABELS, "Exchange"
     assert_includes Transaction::ACTIVITY_LABELS, "Other"
   end
+
+  test "exchange_rate getter returns nil when extra is nil" do
+    transaction = Transaction.new
+    assert_nil transaction.exchange_rate
+  end
+
+  test "exchange_rate setter stores normalized numeric value" do
+    transaction = Transaction.new
+    transaction.exchange_rate = "1.5"
+
+    assert_equal 1.5, transaction.exchange_rate
+  end
+
+  test "exchange_rate setter marks invalid input" do
+    transaction = Transaction.new
+    transaction.exchange_rate = "not a number"
+
+    assert_equal "not a number", transaction.extra["exchange_rate"]
+    assert transaction.extra["exchange_rate_invalid"]
+  end
+
+  test "exchange_rate setter rejects non-finite input" do
+    transaction = Transaction.new
+    transaction.exchange_rate = "Infinity"
+
+    assert_equal "Infinity", transaction.extra["exchange_rate"]
+    assert transaction.extra["exchange_rate_invalid"]
+  end
+
+  test "exchange_rate setter clears invalid flag for valid input" do
+    transaction = Transaction.new
+    transaction.exchange_rate = "not a number"
+    transaction.exchange_rate = "1.5"
+
+    assert_equal 1.5, transaction.exchange_rate
+    assert_equal false, transaction.extra["exchange_rate_invalid"]
+  end
+
+  test "exchange_rate validation rejects non-numeric input" do
+    transaction = Transaction.new(
+      category: categories(:income),
+      extra: { "exchange_rate" => "invalid" }
+    )
+    transaction.exchange_rate = "not a number"
+
+    assert_not transaction.valid?
+    assert_includes transaction.errors[:exchange_rate], "must be a number"
+  end
+
+  test "exchange_rate validation rejects zero values" do
+    transaction = Transaction.new(
+      category: categories(:income)
+    )
+    transaction.exchange_rate = 0
+
+    assert_not transaction.valid?
+    assert_includes transaction.errors[:exchange_rate], "must be greater than 0"
+  end
+
+  test "exchange_rate validation rejects negative values" do
+    transaction = Transaction.new(
+      category: categories(:income)
+    )
+    transaction.exchange_rate = -1.5
+
+    assert_not transaction.valid?
+    assert_includes transaction.errors[:exchange_rate], "must be greater than 0"
+  end
+
+  test "exchange_rate validation allows positive values" do
+    transaction = Transaction.new(
+      category: categories(:income)
+    )
+    transaction.exchange_rate = 1.5
+
+    assert transaction.valid?
+  end
+
+  test "activity_security returns the referenced security from extra metadata" do
+    security = securities(:aapl)
+    transaction = Transaction.new(extra: { "security_id" => security.id })
+
+    assert_equal security, transaction.activity_security
+  end
+
+  test "activity_security returns nil when no security metadata is present" do
+    transaction = Transaction.new(extra: {})
+
+    assert_nil transaction.activity_security
+  end
+
+  test "activity_security refreshes when security metadata changes on the same instance" do
+    transaction = Transaction.new(extra: { "security_id" => securities(:aapl).id })
+
+    assert_equal securities(:aapl), transaction.activity_security
+
+    transaction.extra["security_id"] = securities(:msft).id
+
+    assert_equal securities(:msft), transaction.activity_security
+  end
 end
diff --git a/test/models/transfer/creator_test.rb b/test/models/transfer/creator_test.rb
index a88a33a94..01a945999 100644
--- a/test/models/transfer/creator_test.rb
+++ b/test/models/transfer/creator_test.rb
@@ -218,4 +218,104 @@ class Transfer::CreatorTest < ActiveSupport::TestCase
       )
     end
   end
+
+  test "creates transfer with custom exchange rate when provided" do
+    # Create accounts with different currencies
+    usd_account = @family.accounts.create!(name: "USD Account", balance: 1000, currency: "USD", accountable: Depository.new)
+    eur_account = @family.accounts.create!(name: "EUR Account", balance: 1000, currency: "EUR", accountable: Depository.new)
+
+    custom_rate = 0.92 # 1 USD = 0.92 EUR
+    amount = 100
+
+    creator = Transfer::Creator.new(
+      family: @family,
+      source_account_id: usd_account.id,
+      destination_account_id: eur_account.id,
+      date: @date,
+      amount: amount,
+      exchange_rate: custom_rate
+    )
+
+    transfer = creator.create
+
+    assert transfer.persisted?
+
+    # Verify outflow transaction is in source currency
+    outflow = transfer.outflow_transaction
+    assert_equal amount, outflow.entry.amount
+    assert_equal "USD", outflow.entry.currency
+
+    # Verify inflow transaction uses custom exchange rate
+    inflow = transfer.inflow_transaction
+    expected_eur_amount = (amount * custom_rate * -1).round(2)
+    assert_in_delta expected_eur_amount, inflow.entry.amount, 0.01
+    assert_equal "EUR", inflow.entry.currency
+  end
+
+  test "falls back to fetched exchange rate when custom rate not provided" do
+    # Create accounts with different currencies
+    usd_account = @family.accounts.create!(name: "USD Account", balance: 1000, currency: "USD", accountable: Depository.new)
+    gbp_account = @family.accounts.create!(name: "GBP Account", balance: 1000, currency: "GBP", accountable: Depository.new)
+
+    # Mock the exchange rate lookup
+    ExchangeRate.expects(:find_or_fetch_rate)
+                .with(from: "USD", to: "GBP", date: @date)
+                .returns(OpenStruct.new(rate: 0.79))
+
+    creator = Transfer::Creator.new(
+      family: @family,
+      source_account_id: usd_account.id,
+      destination_account_id: gbp_account.id,
+      date: @date,
+      amount: 100
+    )
+
+    transfer = creator.create
+
+    assert transfer.persisted?
+    assert_equal "USD", transfer.outflow_transaction.entry.currency
+    assert_equal "GBP", transfer.inflow_transaction.entry.currency
+  end
+
+  test "raises when no exchange rate available and none provided" do
+    # Create accounts with different currencies
+    usd_account = @family.accounts.create!(name: "USD Account", balance: 1000, currency: "USD", accountable: Depository.new)
+    jpy_account = @family.accounts.create!(name: "JPY Account", balance: 100000, currency: "JPY", accountable: Depository.new)
+
+    # Mock no exchange rate found
+    ExchangeRate.expects(:find_or_fetch_rate)
+                .with(from: "USD", to: "JPY", date: @date)
+                .returns(nil)
+
+    creator = Transfer::Creator.new(
+      family: @family,
+      source_account_id: usd_account.id,
+      destination_account_id: jpy_account.id,
+      date: @date,
+      amount: 100
+    )
+
+    assert_raises(Money::ConversionError) do
+      creator.create
+    end
+  end
+
+  test "custom exchange rate with very small value is valid" do
+    usd_account = @family.accounts.create!(name: "USD Account", balance: 1000, currency: "USD", accountable: Depository.new)
+    eur_account = @family.accounts.create!(name: "EUR Account", balance: 1000, currency: "EUR", accountable: Depository.new)
+
+    creator = Transfer::Creator.new(
+      family: @family,
+      source_account_id: usd_account.id,
+      destination_account_id: eur_account.id,
+      date: @date,
+      amount: 100,
+      exchange_rate: 0.000001
+    )
+
+    transfer = creator.create
+
+    assert transfer.persisted?
+    assert_in_delta(-0.0001, transfer.inflow_transaction.entry.amount, 0.0001)
+  end
 end
diff --git a/test/models/user_message_test.rb b/test/models/user_message_test.rb
index 66d9fb42a..979bd3164 100644
--- a/test/models/user_message_test.rb
+++ b/test/models/user_message_test.rb
@@ -14,7 +14,7 @@ class UserMessageTest < ActiveSupport::TestCase
     streams = capture_turbo_stream_broadcasts(@chat)
     assert_equal 2, streams.size
     assert_equal "append", streams.first["action"]
-    assert_equal "messages", streams.first["target"]
+    assert_equal @chat.messages_target, streams.first["target"]
     assert_equal "update", streams.last["action"]
     assert_equal "user_message_#{message.id}", streams.last["target"]
   end
diff --git a/test/models/user_test.rb b/test/models/user_test.rb
index 46aa0637f..5139fff09 100644
--- a/test/models/user_test.rb
+++ b/test/models/user_test.rb
@@ -91,22 +91,69 @@ class UserTest < ActiveSupport::TestCase
   test "enable_mfa! enables MFA and generates backup codes" do
     user = users(:family_member)
     user.setup_mfa!
-    user.enable_mfa!
+    backup_codes = user.enable_mfa!
 
     assert user.otp_required?
+    assert_equal 8, backup_codes.length
+    assert backup_codes.all? { |code| code.match?(/\A[0-9a-f]{16}\z/) }
     assert_equal 8, user.otp_backup_codes.length
-    assert user.otp_backup_codes.all? { |code| code.length == 8 }
+    assert user.otp_backup_codes.all? { |code| code.start_with?("$2") }
+    assert_empty backup_codes & user.otp_backup_codes
+  end
+
+  test "enable_mfa! requires an OTP secret" do
+    user = users(:family_member)
+    user.setup_mfa!
+    user.update_column(:otp_secret, nil)
+
+    assert_raises(ArgumentError) { user.enable_mfa! }
+    assert_not user.reload.otp_required?
+    assert_empty user.otp_backup_codes
   end
 
   test "disable_mfa! removes all MFA data" do
     user = users(:family_member)
     user.setup_mfa!
     user.enable_mfa!
+    user.webauthn_credentials.create!(
+      nickname: "YubiKey",
+      credential_id: "credential-id",
+      public_key: "public-key"
+    )
+
     user.disable_mfa!
 
     assert_nil user.otp_secret
     assert_not user.otp_required?
     assert_empty user.otp_backup_codes
+    assert_empty user.webauthn_credentials
+  end
+
+  test "ensure_webauthn_id! generates a stable credential user handle" do
+    user = users(:family_member)
+    assert_nil user.webauthn_id
+
+    webauthn_id = user.ensure_webauthn_id!
+
+    assert webauthn_id.present?
+    assert_equal webauthn_id, user.reload.ensure_webauthn_id!
+  end
+
+  test "webauthn_enabled? requires MFA and at least one credential" do
+    user = users(:family_member)
+    assert_not user.webauthn_enabled?
+
+    user.setup_mfa!
+    user.enable_mfa!
+    assert_not user.webauthn_enabled?
+
+    user.webauthn_credentials.create!(
+      nickname: "Touch ID",
+      credential_id: "touch-id-credential",
+      public_key: "public-key"
+    )
+
+    assert user.webauthn_enabled?
   end
 
   test "verify_otp? validates TOTP codes" do
@@ -121,22 +168,91 @@ class UserTest < ActiveSupport::TestCase
     assert_not user.verify_otp?("123456")
   end
 
-  test "verify_otp? accepts backup codes" do
+  test "verify_otp? does not check backup code digests for normal TOTP input" do
+    user = users(:family_member)
+    user.setup_mfa!
+    user.enable_mfa!
+    valid_code = ROTP::TOTP.new(user.otp_secret, issuer: "Sure Finances").now
+
+    BCrypt::Password.expects(:new).never
+
+    assert user.verify_otp?(valid_code)
+  end
+
+  test "verify_otp? fast rejects non-backup-code input before digest checks" do
     user = users(:family_member)
     user.setup_mfa!
     user.enable_mfa!
 
-    backup_code = user.otp_backup_codes.first
+    BCrypt::Password.expects(:new).never
+
+    assert_not user.verify_otp?("not-a-backup-code")
+  end
+
+  test "verify_otp? rejects unmatched legacy-shaped backup input" do
+    user = users(:family_member)
+    user.setup_mfa!
+    user.enable_mfa!
+
+    assert_not user.verify_otp?("deadbeef")
+  end
+
+  test "verify_otp? accepts backup codes" do
+    user = users(:family_member)
+    user.setup_mfa!
+    backup_codes = user.enable_mfa!
+
+    backup_code = backup_codes.first
+    matching_digest = user.otp_backup_codes.find { |digest| BCrypt::Password.new(digest).is_password?(backup_code) }
+    assert_not_nil matching_digest
+
     assert user.verify_otp?(backup_code)
 
     # Backup code should be consumed
-    assert_not user.otp_backup_codes.include?(backup_code)
     assert_equal 7, user.otp_backup_codes.length
+    assert_not_includes user.otp_backup_codes, matching_digest
 
     # Used backup code should not work again
     assert_not user.verify_otp?(backup_code)
   end
 
+  test "verify_otp? reloads backup codes while consuming under lock" do
+    user = users(:family_member)
+    user.setup_mfa!
+    backup_code = user.enable_mfa!.first
+    stale_user = User.find(user.id)
+
+    user.update!(otp_backup_codes: [])
+
+    assert_not stale_user.verify_otp?(backup_code)
+    assert_empty stale_user.reload.otp_backup_codes
+  end
+
+  test "verify_otp? accepts and consumes legacy plaintext backup codes once" do
+    user = users(:family_member)
+    user.setup_mfa!
+    user.update!(otp_required: true, otp_backup_codes: [ "deadbeef" ])
+
+    assert user.verify_otp?("deadbeef")
+
+    assert_empty user.reload.otp_backup_codes
+    assert_not user.verify_otp?("deadbeef")
+  end
+
+  test "verify_otp? accepts and consumes migrated legacy backup code digests" do
+    user = users(:family_member)
+    user.setup_mfa!
+    user.update!(
+      otp_required: true,
+      otp_backup_codes: [ BCrypt::Password.create("deadbeef", cost: BCrypt::Engine::MIN_COST).to_s ]
+    )
+
+    assert user.verify_otp?("deadbeef")
+
+    assert_empty user.reload.otp_backup_codes
+    assert_not user.verify_otp?("deadbeef")
+  end
+
   test "provisioning_uri generates correct URI" do
     user = users(:family_member)
     user.setup_mfa!
@@ -238,6 +354,89 @@ class UserTest < ActiveSupport::TestCase
     assert user.show_ai_sidebar?
   end
 
+  test "new member defaults show_ai_sidebar to false when AI is not available" do
+    Rails.application.config.app_mode.stubs(:self_hosted?).returns(true)
+    previous = Setting.openai_access_token
+    with_env_overrides OPENAI_ACCESS_TOKEN: nil, EXTERNAL_ASSISTANT_URL: nil, EXTERNAL_ASSISTANT_TOKEN: nil do
+      Setting.openai_access_token = nil
+      user = User.new(
+        family: families(:empty),
+        email: "member-no-ai@example.com",
+        password: "Password1!",
+        password_confirmation: "Password1!",
+        role: :member
+      )
+      assert user.save, user.errors.full_messages.to_sentence
+      assert_not user.show_ai_sidebar?
+    end
+  ensure
+    Setting.openai_access_token = previous
+  end
+
+  test "new admin defaults show_ai_sidebar to true even when AI is not available" do
+    Rails.application.config.app_mode.stubs(:self_hosted?).returns(true)
+    previous = Setting.openai_access_token
+    with_env_overrides OPENAI_ACCESS_TOKEN: nil, EXTERNAL_ASSISTANT_URL: nil, EXTERNAL_ASSISTANT_TOKEN: nil do
+      Setting.openai_access_token = nil
+      user = User.new(
+        family: families(:empty),
+        email: "admin-no-ai@example.com",
+        password: "Password1!",
+        password_confirmation: "Password1!",
+        role: :admin
+      )
+      assert user.save, user.errors.full_messages.to_sentence
+      assert user.show_ai_sidebar?
+    end
+  ensure
+    Setting.openai_access_token = previous
+  end
+
+  test "new member defaults show_ai_sidebar to true when AI is available" do
+    Rails.application.config.app_mode.stubs(:self_hosted?).returns(false)
+    user = User.new(
+      family: families(:empty),
+      email: "member-with-ai@example.com",
+      password: "Password1!",
+      password_confirmation: "Password1!",
+      role: :member
+    )
+    assert user.save, user.errors.full_messages.to_sentence
+    assert user.show_ai_sidebar?
+  end
+
+  test "new guest defaults show_ai_sidebar to false when AI is not available" do
+    Rails.application.config.app_mode.stubs(:self_hosted?).returns(true)
+    previous = Setting.openai_access_token
+    with_env_overrides OPENAI_ACCESS_TOKEN: nil, EXTERNAL_ASSISTANT_URL: nil, EXTERNAL_ASSISTANT_TOKEN: nil do
+      Setting.openai_access_token = nil
+      user = User.new(
+        family: families(:empty),
+        email: "guest-no-ai@example.com",
+        password: "Password1!",
+        password_confirmation: "Password1!",
+        role: :guest
+      )
+      assert user.save, user.errors.full_messages.to_sentence
+      assert_not user.show_ai_sidebar?
+    end
+  ensure
+    Setting.openai_access_token = previous
+  end
+
+  test "new guest defaults show_ai_sidebar to false when AI is available" do
+    Rails.application.config.app_mode.stubs(:self_hosted?).returns(false)
+    user = User.new(
+      family: families(:empty),
+      email: "guest-with-ai@example.com",
+      password: "Password1!",
+      password_confirmation: "Password1!",
+      role: :guest
+    )
+    assert user.save, user.errors.full_messages.to_sentence
+    assert_not user.show_ai_sidebar?
+  end
+
   test "update_dashboard_preferences handles concurrent updates atomically" do
     @user.update!(preferences: {})
 
@@ -461,6 +660,23 @@ class UserTest < ActiveSupport::TestCase
     assert_equal "custom_role", User.role_for_new_family_creator(fallback_role: "custom_role")
   end
 
+  # Preview features preference tests
+  test "preview_features_enabled? defaults to false" do
+    @user.update!(preferences: {})
+    assert_not @user.preview_features_enabled?
+  end
+
+  test "preview_features_enabled? true only when explicitly true" do
+    @user.update!(preferences: { "preview_features_enabled" => true })
+    assert @user.preview_features_enabled?
+
+    @user.update!(preferences: { "preview_features_enabled" => false })
+    assert_not @user.preview_features_enabled?
+
+    @user.update!(preferences: { "preview_features_enabled" => "yes" })
+    assert_not @user.preview_features_enabled?, "truthy non-boolean should not enable"
+  end
+
   # ActiveStorage attachment cleanup tests
   test "purging a user removes attached profile image" do
     user = users(:family_admin)
diff --git a/test/system/account_activity_test.rb b/test/system/account_activity_test.rb
new file mode 100644
index 000000000..142314324
--- /dev/null
+++ b/test/system/account_activity_test.rb
@@ -0,0 +1,118 @@
+require "application_system_test_case"
+
+class AccountActivityTest < ApplicationSystemTestCase
+  DEFAULT_VIEWPORT_WIDTH = 1400
+  DEFAULT_VIEWPORT_HEIGHT = 1400
+
+  setup do
+    ensure_tailwind_build
+    sign_in users(:family_admin)
+    reset_viewport
+
+    @account = accounts(:depository)
+    @transaction_entry = @account.entries.create!(
+      name: "Duplicate source",
+      date: Date.current,
+      amount: 42.50,
+      currency: "USD",
+      entryable: Transaction.new(category: categories(:food_and_drink))
+    )
+    @valuation_entry = @account.entries.create!(
+      name: "Current balance",
+      date: 1.day.ago.to_date,
+      amount: 1000,
+      currency: "USD",
+      entryable: Valuation.new
+    )
+  end
+
+  test "account activity shows duplicate action for a selected transaction" do
+    visit account_url(@account, tab: "activity")
+
+    find("#" + dom_id(@transaction_entry, "selection")).check
+
+    within "#entry-selection-bar" do
+      assert_selector "a[title='Duplicate']:not(.hidden)"
+    end
+  end
+
+  test "account activity hides duplicate action for a selected valuation" do
+    visit account_url(@account, tab: "activity")
+
+    find("#" + dom_id(@valuation_entry, "selection")).check
+
+    within "#entry-selection-bar" do
+      assert_selector "a[title='Duplicate'].hidden", visible: false
+    end
+  end
+
+  test "account activity keeps long category names from overflowing the amount on mobile" do
+    category = categories(:food_and_drink)
+    category.update!(name: "Super Long Category Name That Should Stop Before The Amount On Mobile")
+
+    page.current_window.resize_to(315, 643)
+
+    visit account_url(@account, tab: "activity")
+
+    row = find("##{dom_id(@transaction_entry)}")
+    amount = row.find("p.privacy-sensitive", visible: true)
+    category_name = row.find("#category_name_mobile_#{@transaction_entry.entryable.id}", visible: true)
+
+    assert amount.visible?
+    assert category_name.visible?
+
+    row_rect = row.native.rect
+    amount_rect = amount.native.rect
+    viewport_width = page.evaluate_script("window.innerWidth")
+    page_scroll_width = page.evaluate_script("document.documentElement.scrollWidth")
+
+    assert_operator amount_rect.x + amount_rect.width, :<=, row_rect.x + row_rect.width
+    assert_operator page_scroll_width, :<=, viewport_width
+  end
+
+  test "account activity keeps long category names from overlapping the amount on wide screens" do
+    category = categories(:food_and_drink)
+    category.update!(name: "Super Long Category Name That Should Stop Before The Amount On Wide Screens Too")
+
+    page.current_window.resize_to(1280, 900)
+
+    visit account_url(@account, tab: "activity")
+
+    metrics = page.evaluate_script(<<~JS)
+      (() => {
+        const row = document.getElementById("#{dom_id(@transaction_entry)}");
+        const categoryButton = row.querySelector("##{dom_id(@transaction_entry.entryable, "category_menu_desktop")} button");
+        const categoryName = categoryButton.querySelector("[data-testid='category-name']");
+        const amount = row.querySelector(".privacy-sensitive");
+        const categoryRect = categoryButton.getBoundingClientRect();
+        const amountRect = amount.getBoundingClientRect();
+
+        return {
+          categoryRight: categoryRect.right,
+          amountLeft: amountRect.left,
+          categoryOverflow: categoryName.scrollWidth > categoryName.clientWidth
+        };
+      })()
+    JS
+
+    assert_operator metrics["categoryRight"], :<=, metrics["amountLeft"]
+    assert metrics["categoryOverflow"]
+  end
+
+  private
+    def ensure_tailwind_build
+      return if self.class.instance_variable_defined?(:@tailwind_css_built)
+
+      system({ "RAILS_ENV" => "test" }, "bin/rails", "tailwindcss:build", exception: true)
+      self.class.instance_variable_set(:@tailwind_css_built, true)
+    end
+
+    def teardown
+      reset_viewport
+      super
+    end
+
+    def reset_viewport
+      page.current_window.resize_to(DEFAULT_VIEWPORT_WIDTH, DEFAULT_VIEWPORT_HEIGHT) if page&.current_window
+    end
+end
diff --git a/test/system/accounts_test.rb b/test/system/accounts_test.rb
index 555959190..b7595f238 100644
--- a/test/system/accounts_test.rb
+++ b/test/system/accounts_test.rb
@@ -105,7 +105,7 @@ class AccountsTest < ApplicationSystemTestCase
     end
 
     def assert_account_created(accountable_type, &block)
-      click_link Accountable.from_type(accountable_type).display_name.singularize
+      click_link Accountable.from_type(accountable_type).singular_display_name
       click_link "Enter account balance" if accountable_type.in?(%w[Depository Investment Crypto Loan CreditCard])
 
       account_name = "[system test] #{accountable_type} Account"
@@ -164,6 +164,6 @@ class AccountsTest < ApplicationSystemTestCase
     end
 
     def humanized_accountable(accountable_type)
-      Accountable.from_type(accountable_type).display_name.singularize
+      Accountable.from_type(accountable_type).singular_display_name
     end
 end
diff --git a/test/system/categories_test.rb b/test/system/categories_test.rb
index 5e92f1ad4..5a5bf1732 100644
--- a/test/system/categories_test.rb
+++ b/test/system/categories_test.rb
@@ -23,4 +23,23 @@ class CategoriesTest < ApplicationSystemTestCase
 
     assert_text "Name has already been taken"
   end
+
+  test "long category names truncate before the actions menu on mobile" do
+    category = categories(:food_and_drink)
+    category.update!(name: "Super Long Category Name That Should Stop Before The Menu Button On Mobile")
+
+    page.current_window.resize_to(315, 643)
+
+    visit categories_url
+
+    row = find("##{ActionView::RecordIdentifier.dom_id(category)}")
+    actions = row.find("[data-testid='category-actions'] button", visible: true)
+
+    assert actions.visible?
+
+    viewport_width = page.evaluate_script("window.innerWidth")
+    page_scroll_width = page.evaluate_script("document.documentElement.scrollWidth")
+
+    assert_operator page_scroll_width, :<=, viewport_width
+  end
 end
diff --git a/test/system/imports_test.rb b/test/system/imports_test.rb
index 15b146e24..e5667817e 100644
--- a/test/system/imports_test.rb
+++ b/test/system/imports_test.rb
@@ -22,9 +22,7 @@ class ImportsTest < ApplicationSystemTestCase
 
     fill_in "import[raw_file_str]", with: file_fixture("imports/transactions.csv").read
 
-    within "form" do
-      click_on "Upload CSV"
-    end
+    find_field("import[raw_file_str]").find(:xpath, "./ancestor::form").click_button("Upload CSV")
 
     select "Date", from: "import[date_col_label]"
     select "YYYY-MM-DD", from: "import[date_format]"
@@ -73,9 +71,7 @@ class ImportsTest < ApplicationSystemTestCase
 
     fill_in "import[raw_file_str]", with: file_fixture("imports/trades.csv").read
 
-    within "form" do
-      click_on "Upload CSV"
-    end
+    find_field("import[raw_file_str]").find(:xpath, "./ancestor::form").click_button("Upload CSV")
 
     select "date", from: "import[date_col_label]"
     select "YYYY-MM-DD", from: "import[date_format]"
@@ -116,9 +112,7 @@ class ImportsTest < ApplicationSystemTestCase
 
     fill_in "import[raw_file_str]", with: file_fixture("imports/accounts.csv").read
 
-    within "form" do
-      click_on "Upload CSV"
-    end
+    find_field("import[raw_file_str]").find(:xpath, "./ancestor::form").click_button("Upload CSV")
 
     select "type", from: "import[entity_type_col_label]"
     select "name", from: "import[name_col_label]"
@@ -166,9 +160,7 @@ class ImportsTest < ApplicationSystemTestCase
 
     fill_in "import[raw_file_str]", with: file_fixture("imports/mint.csv").read
 
-    within "form" do
-      click_on "Upload CSV"
-    end
+    find_field("import[raw_file_str]").find(:xpath, "./ancestor::form").click_button("Upload CSV")
 
     click_on "Apply configuration"
 
@@ -195,4 +187,42 @@ class ImportsTest < ApplicationSystemTestCase
 
     click_on "Back to dashboard"
   end
+
+  test "actual import" do
+    visit new_import_path
+
+    # Pending CSV-style imports default the dialog to the Raw Data tab; Actual lives under Financial Tools.
+    click_on "Financial Tools"
+    click_on "Import from Actual Budget"
+
+    within_testid("import-tabs") do
+      click_on "Copy & Paste"
+    end
+
+    fill_in "import[raw_file_str]", with: file_fixture("imports/actual.csv").read
+
+    find_field("import[raw_file_str]").find(:xpath, "./ancestor::form").click_button("Upload CSV")
+
+    click_on "Apply configuration"
+
+    click_on "Next step"
+
+    assert_selector "h1", text: "Assign your categories"
+    click_on "Next"
+
+    assert_selector "h1", text: "Assign your accounts"
+    click_on "Next"
+
+    click_on "Publish import"
+
+    assert_text "Import in progress"
+
+    perform_enqueued_jobs
+
+    click_on "Check status"
+
+    assert_text "Import successful"
+
+    click_on "Back to dashboard"
+  end
 end
diff --git a/test/system/property_test.rb b/test/system/property_test.rb
index 769c338f4..b0a15f35d 100644
--- a/test/system/property_test.rb
+++ b/test/system/property_test.rb
@@ -15,11 +15,7 @@ class PropertiesEditTest < ApplicationSystemTestCase
     click_link "[system test] Property Account"
     find("[data-testid='account-menu']").click
     click_on "Edit"
-    assert_selector "#account_accountable_attributes_subtype"
-    assert_selector(
-        "#account_accountable_attributes_subtype option[selected]",
-        text: "Single Family Home"
-    )
+    assert_equal "single_family_home", find("#account_accountable_attributes_subtype").value
   end
 
   private
diff --git a/test/system/rules_test.rb b/test/system/rules_test.rb
new file mode 100644
index 000000000..49f4601bc
--- /dev/null
+++ b/test/system/rules_test.rb
@@ -0,0 +1,37 @@
+require "application_system_test_case"
+
+class RulesTest < ApplicationSystemTestCase
+  setup do
+    sign_in @user = users(:family_admin)
+  end
+
+  test "shows queued processed modified and blocked counts for recent rule runs" do
+    rule = @user.family.rules.create!(
+      name: "Whole Foods Testing",
+      resource_type: "transaction",
+      effective_date: 1.year.ago.to_date,
+      conditions: [
+        Rule::Condition.new(condition_type: "transaction_name", operator: "like", value: "Whole Foods")
+      ],
+      actions: [
+        Rule::Action.new(action_type: "set_transaction_category", value: categories(:food_and_drink).id)
+      ]
+    )
+
+    rule.rule_runs.create!(
+      rule_name: rule.name,
+      execution_type: "manual",
+      status: "success",
+      transactions_queued: 20,
+      transactions_processed: 20,
+      transactions_modified: 10,
+      pending_jobs_count: 0,
+      executed_at: Time.current
+    )
+
+    visit rules_path
+
+    assert_selector "th", text: /queued\s+processed\s+modified\s+blocked/i
+    assert_selector "td", text: "20 / 20 / 10 / 10"
+  end
+end
diff --git a/test/system/settings/providers_test.rb b/test/system/settings/providers_test.rb
new file mode 100644
index 000000000..549925ae0
--- /dev/null
+++ b/test/system/settings/providers_test.rb
@@ -0,0 +1,213 @@
+require "application_system_test_case"
+
+class Settings::ProvidersTest < ApplicationSystemTestCase
+  setup do
+    @user = users(:family_admin)
+    @family = families(:dylan_family)
+    login_as @user
+  end
+
+  test "shows status pill on section header for a configured provider" do
+    SimplefinItem.create!(family: @family, name: "Test SimpleFIN", access_url: "https://bridge.simplefin.org/simplefin/access")
+
+    visit settings_providers_path
+
+    within("details", text: "SimpleFIN") do
+      assert_text "Connected"
+    end
+  end
+
+  test "unconfigured SimpleFIN appears in Available with a connect affordance" do
+    visit settings_providers_path
+
+    assert_no_selector "details", text: "SimpleFIN"
+
+    within available_provider_cards_container do
+      assert_text "SimpleFIN"
+      assert_selector "a[data-turbo-frame='drawer']", text: "Connect"
+    end
+  end
+
+  test "connected providers are grouped under Your connections in alphabetical title order" do
+    SimplefinItem.create!(family: @family, name: "Test SimpleFIN", access_url: "https://bridge.simplefin.org/simplefin/access")
+
+    visit settings_providers_path
+
+    titles = all("details").map { |d| d.find("summary h3", match: :first).text.squish }
+    assert_equal titles.sort_by(&:downcase), titles, "Connection panels should render alphabetically by title"
+
+    connections_heading = page.find(:xpath, "//h2[contains(translate(normalize-space(), 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz'), 'your connections')]")
+    available_heading = page.find(:xpath, "//h2[contains(translate(normalize-space(), 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz'), 'available')]")
+    connections_y = connections_heading.native.location.y
+    available_y = available_heading.native.location.y
+
+    assert_operator connections_y, :<, page.find("details", text: "SimpleFIN").native.location.y
+    assert_operator page.find("details", text: "SimpleFIN").native.location.y, :<, available_y
+  end
+
+  test "expanding a section still works as expected" do
+    SimplefinItem.create!(family: @family, name: "Test SimpleFIN", access_url: "https://bridge.simplefin.org/simplefin/access")
+
+    visit settings_providers_path
+
+    assert_selector "details:not([open])", text: "SimpleFIN"
+
+    find("details", text: "SimpleFIN").find("summary").click
+
+    assert_selector "details[open]", text: "SimpleFIN"
+    within("details[open]", text: "SimpleFIN") do
+      assert_text "Setup Token"
+    end
+  end
+
+  test "groups providers into Your connections and Available with counts" do
+    SimplefinItem.create!(family: @family, name: "Test SimpleFIN", access_url: "https://bridge.simplefin.org/simplefin/access")
+
+    visit settings_providers_path
+
+    connections_heading = find(:xpath, "//h2[contains(translate(., 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz'), 'your connections')]")
+    normalized = connections_heading.text.squish
+    assert_match(/Your connections .*· \d+/i, normalized)
+
+    connections_y = connections_heading.native.location.y
+    available_heading = find(:xpath, "//h2[contains(translate(., 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz'), 'available')]")
+    available_y = available_heading.native.location.y
+    simplefin_y = find("details", text: "SimpleFIN").native.location.y
+
+    assert_operator connections_y, :<, simplefin_y, "Your connections heading should appear above SimpleFIN section"
+    assert_operator simplefin_y, :<, available_y, "SimpleFIN should appear above Available heading"
+
+    available_grid_top = available_provider_cards_container.native.location.y
+    assert_operator available_y, :<, available_grid_top, "Available heading should appear above the card grid"
+  end
+
+  test "action needed group is absent when no providers have issues" do
+    SimplefinItem.create!(family: @family, name: "Test SimpleFIN", access_url: "https://bridge.simplefin.org/simplefin/access")
+
+    visit settings_providers_path
+
+    assert_selector "h2", text: /\AYour connections/i
+    assert_no_selector "h2", text: /\AAction needed/i
+  end
+
+  test "enable banking with expiring session appears in your connections and auto-opens" do
+    item = EnableBankingItem.new(
+      family: @family,
+      name: "Test Bank",
+      country_code: "DE",
+      application_id: "test-app-id",
+      session_id: "test-session",
+      session_expires_at: 5.days.from_now
+    )
+    # Skip certificate validation for test purposes
+    item.save!(validate: false)
+
+    visit settings_providers_path
+
+    assert_selector "h2", text: /\AYour connections/i
+
+    # Auto-expanded warning sections hide compact meta behind `group-open:hidden`;
+    # collapse once so the re-consent copy is visible again.
+    enable = find("details", text: /Enable Banking/)
+    enable.find("summary").click if enable.matches_selector?(":open")
+
+    assert_selector "details:not([open])", text: /Enable Banking/
+    assert_text "Re-consent needed in 5 days"
+  end
+
+  test "search input filters provider cards by name" do
+    visit settings_providers_path
+
+    find('[data-providers-filter-target="input"]').set("Coinbase")
+
+    assert_selector "a[data-providers-filter-target='card']", text: /Coinbase/i
+    assert_no_selector "a[data-providers-filter-target='card']", text: /Binance/i
+  end
+
+  test "kind chip narrows the grid to providers of that kind" do
+    visit settings_providers_path
+
+    click_on "Crypto"
+
+    assert_selector "a[data-providers-filter-target='card']", text: /Coinbase/i
+    assert_no_selector "a[data-providers-filter-target='card']", text: /SimpleFIN/i
+  end
+
+  test "search shows the empty filter message when no provider matches" do
+    visit settings_providers_path
+
+    find('[data-providers-filter-target="input"]').set("zzz_no_match_zzz")
+
+    assert_selector '[data-providers-filter-target="empty"]', text: I18n.t("settings.providers.empty_filter")
+    assert_no_selector "a[data-providers-filter-target='card']", visible: true
+  end
+
+  test "available providers render as a card grid" do
+    visit settings_providers_path
+
+    within available_provider_cards_container do
+      assert_text "SimpleFIN"
+      assert_selector "a[data-turbo-frame='drawer']", minimum: 1
+    end
+  end
+
+  test "clicking a provider card opens the connect drawer" do
+    visit settings_providers_path
+
+    within available_provider_cards_container do
+      find("a[data-turbo-frame='drawer']", text: "SimpleFIN").click
+    end
+
+    assert_selector "dialog[open]"
+    assert_text "Setup Token"
+  end
+
+  test "configured plaid_eu surfaces in Your connections instead of Available" do
+    Setting["plaid_eu_client_id"] = "test_eu_client"
+    Setting["plaid_eu_secret"] = "test_eu_secret"
+
+    visit settings_providers_path
+
+    assert_selector "details summary h3", text: "Plaid EU"
+    within available_provider_cards_container do
+      assert_no_text "Plaid EU"
+    end
+  end
+
+  test "clear filters button resets search input and chip state" do
+    visit settings_providers_path
+
+    find('[data-providers-filter-target="input"]').set("zzz_no_match_zzz")
+    assert_selector '[data-providers-filter-target="empty"]', visible: true
+
+    click_on I18n.t("settings.providers.clear_filter")
+
+    assert_no_selector '[data-providers-filter-target="empty"]', visible: true
+    assert_equal "", find('[data-providers-filter-target="input"]').value
+    assert_selector "a[data-providers-filter-target='card']", text: /SimpleFIN/i
+  end
+
+  test "warn-state connection row carries warning outline class" do
+    item = EnableBankingItem.new(
+      family: @family,
+      name: "Test Bank",
+      country_code: "DE",
+      application_id: "test-app-id",
+      session_id: "test-session",
+      session_expires_at: 5.days.from_now
+    )
+    item.save!(validate: false)
+
+    visit settings_providers_path
+
+    details = find("details", text: /Enable Banking/)
+    assert_includes details[:class], "border-warning/25"
+  end
+
+  private
+
+    # Card grid rendered after the `#available` group heading (following sibling div.grid)
+    def available_provider_cards_container
+      find("#available").find(:xpath, "following-sibling::div[contains(concat(' ', normalize-space(@class), ' '), ' grid ')]")
+    end
+end
diff --git a/test/system/settings_test.rb b/test/system/settings_test.rb
index 099e55f6b..96ec24dcc 100644
--- a/test/system/settings_test.rb
+++ b/test/system/settings_test.rb
@@ -6,8 +6,12 @@ class SettingsTest < ApplicationSystemTestCase
 
     # Base settings available to all users
     @settings_links = [
-      [ "Accounts", accounts_path ],
-      [ "Bank Sync", settings_bank_sync_path ],
+      [ "Accounts", accounts_path ]
+    ]
+
+    @settings_links << [ "Bank sync", settings_providers_path ] if @user.admin?
+
+    @settings_links += [
       [ "Preferences", settings_preferences_path ],
       [ "Profile Info", settings_profile_path ],
       [ "Security", settings_security_path ],
@@ -22,6 +26,8 @@ class SettingsTest < ApplicationSystemTestCase
 
     # Add admin settings if user is admin
     if @user.admin?
+      merchants_index = @settings_links.index([ "Merchants", family_merchants_path ])
+      @settings_links.insert(merchants_index + 1, [ "Statement Vault", account_statements_path ])
       @settings_links += [
         [ "AI Prompts", settings_ai_prompts_path ],
         [ "API Key", settings_api_key_path ]
@@ -36,7 +42,7 @@ class SettingsTest < ApplicationSystemTestCase
       assert_current_path accounts_path, ignore_query: true
 
       @settings_links.each do |name, path|
-        click_link name
+        click_link name, match: :first
         assert_selector "h1", text: name
         assert_current_path path
       end
@@ -48,9 +54,10 @@ class SettingsTest < ApplicationSystemTestCase
     Rails.application.config.app_mode.stubs(:self_hosted?).returns(true)
     Provider::Registry.stubs(:get_provider).with(:twelve_data).returns(nil)
     Provider::Registry.stubs(:get_provider).with(:yahoo_finance).returns(nil)
+    Provider::Registry.stubs(:get_provider).with(:github).returns(stub(fetch_latest_release_notes: nil))
     open_settings_from_sidebar
     assert_selector "li", text: "Self-Hosting"
-    click_link "Self-Hosting"
+    click_link "Self-Hosting", match: :first
     assert_current_path settings_hosting_path
     assert_selector "h1", text: "Self-Hosting"
     find("select#setting_onboarding_state").select("Invite-only")
@@ -87,15 +94,18 @@ class SettingsTest < ApplicationSystemTestCase
       # Assert that admin-only settings are not present in the navigation
       assert_no_selector "li", text: "AI Prompts"
       assert_no_selector "li", text: "API Key"
+      assert_no_selector "li", text: "Bank sync"
+      assert_no_selector "li", text: "Statement Vault"
     end
   end
 
   private
 
     def open_settings_from_sidebar
-      within "div[data-testid=user-menu]" do
-        find("button").click
+      user_menu = find("div[data-testid=user-menu]", match: :first, visible: :visible)
+      within user_menu do
+        find("[data-DS--popover-target='button']", match: :first).click
+        click_link "Settings", match: :first
       end
-      click_link "Settings"
     end
 end
diff --git a/test/system/transactions_form_exchange_rate_test.rb b/test/system/transactions_form_exchange_rate_test.rb
new file mode 100644
index 000000000..4e611e881
--- /dev/null
+++ b/test/system/transactions_form_exchange_rate_test.rb
@@ -0,0 +1,146 @@
+require "application_system_test_case"
+
+class TransactionsFormExchangeRateTest < ApplicationSystemTestCase
+  setup do
+    @user = users(:family_admin)
+    @family = @user.family
+    @account_usd = accounts(:depository) # USD account
+    sign_in @user
+
+    # Set up real exchange rates for testing
+    @eur_usd_rate = ExchangeRate.create!(
+      from_currency: "EUR",
+      to_currency: "USD",
+      date: Date.current,
+      rate: 1.1
+    )
+
+    @gbp_usd_rate = ExchangeRate.create!(
+      from_currency: "GBP",
+      to_currency: "USD",
+      date: Date.current,
+      rate: 1.27
+    )
+  end
+
+  test "changing amount currency to different currency shows exchange rate UI" do
+    visit new_transaction_path
+
+    # Select USD account (which is in USD)
+    select_ds("Account", @account_usd)
+
+    # Currency defaults to USD (same as account)
+    # Change currency to EUR
+    find("select[data-money-field-target='currency']").find("option[value='EUR']").select_option
+
+    # Exchange rate UI should appear
+    assert_selector "[data-transaction-form-target='exchangeRateContainer']", visible: true
+  end
+
+  test "changing amount currency to same as account currency hides exchange rate UI" do
+    visit new_transaction_path
+
+    # Select USD account
+    select_ds("Account", @account_usd)
+
+    # Change to EUR first
+    find("select[data-money-field-target='currency']").find("option[value='EUR']").select_option
+
+    # Verify exchange rate UI is shown
+    assert_selector "[data-transaction-form-target='exchangeRateContainer']", visible: true
+
+    # Change back to USD (same as account)
+    find("select[data-money-field-target='currency']").find("option[value='USD']").select_option
+
+    # Exchange rate UI should hide
+    assert_selector "[data-transaction-form-target='exchangeRateContainer']", visible: false
+  end
+
+  test "exchange rate field is prefilled when rate is available" do
+    visit new_transaction_path
+
+    # Select USD account
+    select_ds("Account", @account_usd)
+
+    # Change to GBP (exchange rate is set up in fixtures)
+    find("select[data-money-field-target='currency']").find("option[value='GBP']").select_option
+
+    # Wait for exchange rate container to become visible
+    assert_selector "[data-transaction-form-target='exchangeRateContainer']", visible: true
+
+    # Exchange rate field should be populated
+    exchange_rate_field = find("[data-transaction-form-target='exchangeRateField']")
+    assert_not_empty exchange_rate_field.value
+    assert_equal "1.27", exchange_rate_field.value
+  end
+
+  test "exchange rate field is empty when rate not found" do
+    visit new_transaction_path
+
+    # Select USD account
+    select_ds("Account", @account_usd)
+
+    # Change to CHF (Swiss Franc - no rate set up in fixtures)
+    find("select[data-money-field-target='currency']").find("option[value='CHF']").select_option
+
+    # Wait for exchange rate container to become visible (manual rate entry mode)
+    assert_selector "[data-transaction-form-target='exchangeRateContainer']", visible: true
+
+    # Exchange rate section should be visible but field should be empty (manual entry)
+    exchange_rate_field = find("[data-transaction-form-target='exchangeRateField']")
+    assert_empty exchange_rate_field.value
+  end
+
+  test "exchange rate is recalculated when currency changes" do
+    visit new_transaction_path
+
+    # Select USD account
+    select_ds("Account", @account_usd)
+
+    # Change to EUR
+    find("select[data-money-field-target='currency']").find("option[value='EUR']").select_option
+
+    # Wait for EUR rate to load
+    assert_selector "[data-transaction-form-target='exchangeRateContainer']", visible: true
+    first_rate = find("[data-transaction-form-target='exchangeRateField']").value
+    assert_equal "1.10", first_rate
+
+    # Change to GBP
+    find("select[data-money-field-target='currency']").find("option[value='GBP']").select_option
+
+    # Wait for GBP rate to be updated
+    assert_selector "[data-transaction-form-target='exchangeRateContainer']", visible: true
+    second_rate = find("[data-transaction-form-target='exchangeRateField']").value
+    assert_equal "1.27", second_rate
+
+    # Rates should be different
+    assert_not_equal first_rate, second_rate
+  end
+
+  test "changing account also recalculates exchange rate for current currency" do
+    # Create a second account in EUR
+    eur_account = @family.accounts.create!(
+      name: "EUR Account",
+      balance: 1000,
+      currency: "EUR",
+      accountable: Depository.new
+    )
+
+    visit new_transaction_path
+
+    # Start with USD account, then currency EUR
+    select_ds("Account", @account_usd)
+
+    find("select[data-money-field-target='currency']").find("option[value='EUR']").select_option
+
+    # Exchange rate shown (both USD and EUR exist, they differ)
+    assert_selector "[data-transaction-form-target='exchangeRateContainer']", visible: true
+
+    # Switch to EUR account
+    select_ds("Account", eur_account)
+
+    # Now account is EUR and currency is EUR (same)
+    # Exchange rate UI should hide
+    assert_selector "[data-transaction-form-target='exchangeRateContainer']", visible: false
+  end
+end
diff --git a/test/system/transfers_test.rb b/test/system/transfers_test.rb
index 6fbd81928..a849a401c 100644
--- a/test/system/transfers_test.rb
+++ b/test/system/transfers_test.rb
@@ -27,6 +27,58 @@ class TransfersTest < ApplicationSystemTestCase
     end
   end
 
+  test "shows exchange rate field for different currencies" do
+    # Create an account with a different currency
+    eur_account = @user.family.accounts.create!(
+      name: "EUR Savings",
+      balance: 1000,
+      currency: "EUR",
+      accountable: Depository.new
+    )
+
+    # Set up exchange rate
+    ExchangeRate.create!(
+      from_currency: "USD",
+      to_currency: "EUR",
+      date: Date.current,
+      rate: 0.92
+    )
+
+    transfer_date = Date.current
+
+    click_on "New transaction"
+    click_on "Transfer"
+    assert_text "New transfer"
+
+    # Initially, exchange rate field should be hidden
+    assert_selector "[data-transfer-form-target='exchangeRateContainer'].hidden", visible: :all
+
+    # Select accounts with different currencies
+    select_ds("From", accounts(:depository))
+    select_ds("To", eur_account)
+
+    # Exchange rate container should become visible
+    assert_selector "[data-transfer-form-target='exchangeRateContainer']", visible: true
+
+    # Exchange rate field should be populated with fetched rate
+    exchange_rate_field = find("[data-transfer-form-target='exchangeRateField']")
+    assert_not_empty exchange_rate_field.value
+    assert_equal "0.92", exchange_rate_field.value
+
+    # Fill in amount
+    fill_in "transfer[amount]", with: 100
+    fill_in "Date", with: transfer_date
+
+    # Submit form
+    click_button "Create transfer"
+
+    # Should redirect and show transfer created
+    assert_current_path transactions_url
+    within "#entry-group-#{transfer_date}" do
+      assert_text "Transfer to"
+    end
+  end
+
   private
 
     def select_ds(label_text, record)
diff --git a/test/test_helper.rb b/test/test_helper.rb
index 5af3466ff..461ebe3a6 100644
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -23,6 +23,8 @@ require "minitest/autorun"
 require "mocha/minitest"
 require "aasm/minitest"
 require "webmock/minitest"
+require "rack/test"
+require "tempfile"
 require "uri"
 
 VCR.configure do |config|
@@ -81,6 +83,12 @@ module ActiveSupport
       post sessions_path, params: { email: user.email, password: user_password_test }
     end
 
+    def ensure_tailwind_build
+      tailwind_build = Rails.root.join("app/assets/builds/tailwind.css")
+      FileUtils.mkdir_p(tailwind_build.dirname)
+      File.write(tailwind_build, "/* test */") unless tailwind_build.exist?
+    end
+
     def with_env_overrides(overrides = {}, &block)
       ClimateControl.modify(**overrides, &block)
     end
@@ -90,10 +98,35 @@ module ActiveSupport
       yield
     end
 
+    def api_headers(api_key)
+      { "X-Api-Key" => api_key.plain_key }
+    end
+
     def user_password_test
       "maybetestpassword817983172"
     end
 
+    def uploaded_file(filename:, content_type:, content: "date,amount\n2024-01-01,1\n")
+      tempfile = Tempfile.new([ File.basename(filename, ".*"), File.extname(filename) ])
+      tempfile.binmode
+      tempfile.write(content)
+      tempfile.rewind
+
+      Rack::Test::UploadedFile.new(tempfile.path, content_type, true, original_filename: filename)
+    end
+
+    def family_guest
+      @family_guest ||= users(:family_admin).family.users.create!(
+        first_name: "Readonly",
+        last_name: "Guest",
+        email: "readonly-guest@example.com",
+        password: user_password_test,
+        role: "guest",
+        onboarded_at: Time.current,
+        ui_layout: "dashboard"
+      )
+    end
+
     # Ensures the Investment Contributions category exists for a family
     # Used in transfer tests where this bootstrapped category is required
     # Uses family locale to ensure consistent naming
diff --git a/test/views/layouts/shared/nav_item_view_test.rb b/test/views/layouts/shared/nav_item_view_test.rb
new file mode 100644
index 000000000..b03bcbf37
--- /dev/null
+++ b/test/views/layouts/shared/nav_item_view_test.rb
@@ -0,0 +1,27 @@
+require "test_helper"
+
+class NavItemViewTest < ActionView::TestCase
+  test "active nav item carries aria-current=\"page\"" do
+    html = render(partial: "layouts/shared/nav_item", locals: {
+      name: "Transactions",
+      path: "/transactions",
+      icon: "credit-card",
+      icon_custom: false,
+      active: true
+    })
+
+    assert_includes html, "aria-current=\"page\""
+  end
+
+  test "inactive nav item omits aria-current" do
+    html = render(partial: "layouts/shared/nav_item", locals: {
+      name: "Transactions",
+      path: "/transactions",
+      icon: "credit-card",
+      icon_custom: false,
+      active: false
+    })
+
+    assert_not_includes html, "aria-current"
+  end
+end
diff --git a/workers/preview/package-lock.json b/workers/preview/package-lock.json
new file mode 100644
index 000000000..2cfb46528
--- /dev/null
+++ b/workers/preview/package-lock.json
@@ -0,0 +1,1583 @@
+{
+  "name": "sure-preview-worker",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "sure-preview-worker",
+      "version": "1.0.0",
+      "devDependencies": {
+        "@cloudflare/containers": "^0.3.3",
+        "@cloudflare/workers-types": "^4.20250124.0",
+        "typescript": "^5.0.0",
+        "wrangler": "^4.0.0"
+      }
+    },
+    "node_modules/@cloudflare/containers": {
+      "version": "0.3.3",
+      "resolved": "https://registry.npmjs.org/@cloudflare/containers/-/containers-0.3.3.tgz",
+      "integrity": "sha512-ZSXmArCoo5bVTp8pGAJdl5WKmwtZDcffJqr4JcZEbSmMIFjU+AlBqgysuxXMgu03Rp239cOdqerbjK7H0K2krQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/@cloudflare/kv-asset-handler": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/@cloudflare/kv-asset-handler/-/kv-asset-handler-0.5.0.tgz",
+      "integrity": "sha512-jxQYkj8dSIzc0cD6cMMNdOc1UVjqSqu8BZdor5s8cGjW2I8BjODt/kWPVdY+u9zj3ms75Q5qaZgnxUad83+eAg==",
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@cloudflare/unenv-preset": {
+      "version": "2.16.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/unenv-preset/-/unenv-preset-2.16.1.tgz",
+      "integrity": "sha512-ECxObrMfyTl5bhQf/lZCXwo5G6xX9IAUo+nDMKK4SZ8m4Jvvxp52vilxyySSWh2YTZz8+HQ07qGH/2rEom1vDw==",
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "peerDependencies": {
+        "unenv": "2.0.0-rc.24",
+        "workerd": ">1.20260305.0 <2.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "workerd": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@cloudflare/workerd-darwin-64": {
+      "version": "1.20260507.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20260507.1.tgz",
+      "integrity": "sha512-S85aMwcaPJUjKWDiG6iMMnioKWtPLACa6m0j/EhHR1GYfVpnxb974cBc6d25L+sf7jHWHJI2u5hGp0UTJ7MtXQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/@cloudflare/workerd-darwin-arm64": {
+      "version": "1.20260507.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20260507.1.tgz",
+      "integrity": "sha512-GMEBu8Zp9Q97HLnf7bWJN4KjWpN5MxpeqdvHjBGWNl8UYprJI0k+Jkp89+Wh5S8vIon+HoVbDfOzPa7VwgL6Eg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/@cloudflare/workerd-linux-64": {
+      "version": "1.20260507.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20260507.1.tgz",
+      "integrity": "sha512-QlrKEBdgA3uVc0Ok0Q3+0/CW0CTjgj5ySir1i1YY5FXVv0X6GpwtnB5umjunjF2MFprss+L+iFGZzxcSvMC1nA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/@cloudflare/workerd-linux-arm64": {
+      "version": "1.20260507.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20260507.1.tgz",
+      "integrity": "sha512-eGbbupEtK2nh9V9Dhcx3vv3GTKeXqSVNgAEYVCCN0NGS9tl9HbMoHRX/4JL181FKXROMigWBCQVL//qPhsAzBQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/@cloudflare/workerd-windows-64": {
+      "version": "1.20260507.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workerd-windows-64/-/workerd-windows-64-1.20260507.1.tgz",
+      "integrity": "sha512-dmClJ/E0BAcuDetQIZFqbeAXejWrG5pysGRMQ6T83Y0IW/7IAamY2zFEkAJ10I5xwZsdHuYsZtzlOxpEXpJs7A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/@cloudflare/workers-types": {
+      "version": "4.20260511.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workers-types/-/workers-types-4.20260511.1.tgz",
+      "integrity": "sha512-FA+si7cOq9i/gtCHhIc0XJL0l1F/ApF+m00752Aj7WZFJrj3ZulT2T8/+rT3BabMT0QEnqFEGIqCgrmqhgEfMg==",
+      "dev": true,
+      "license": "MIT OR Apache-2.0"
+    },
+    "node_modules/@cspotcode/source-map-support": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/@cspotcode/source-map-support/-/source-map-support-0.8.1.tgz",
+      "integrity": "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "0.3.9"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@emnapi/runtime": {
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
+      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
+      "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz",
+      "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz",
+      "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz",
+      "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz",
+      "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz",
+      "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz",
+      "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz",
+      "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz",
+      "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz",
+      "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz",
+      "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz",
+      "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz",
+      "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz",
+      "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz",
+      "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.3.tgz",
+      "integrity": "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz",
+      "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz",
+      "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz",
+      "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz",
+      "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz",
+      "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz",
+      "integrity": "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz",
+      "integrity": "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@img/colour": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz",
+      "integrity": "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@img/sharp-darwin-arm64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.34.5.tgz",
+      "integrity": "sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-darwin-arm64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-darwin-x64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.34.5.tgz",
+      "integrity": "sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-darwin-x64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-libvips-darwin-arm64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.2.4.tgz",
+      "integrity": "sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-darwin-x64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.2.4.tgz",
+      "integrity": "sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-arm": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.2.4.tgz",
+      "integrity": "sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-arm64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.2.4.tgz",
+      "integrity": "sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-ppc64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.2.4.tgz",
+      "integrity": "sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-riscv64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.2.4.tgz",
+      "integrity": "sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-s390x": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.2.4.tgz",
+      "integrity": "sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-x64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.2.4.tgz",
+      "integrity": "sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linuxmusl-arm64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.2.4.tgz",
+      "integrity": "sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linuxmusl-x64": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.2.4.tgz",
+      "integrity": "sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-linux-arm": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.34.5.tgz",
+      "integrity": "sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-arm": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linux-arm64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.34.5.tgz",
+      "integrity": "sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-arm64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linux-ppc64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.34.5.tgz",
+      "integrity": "sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-ppc64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linux-riscv64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.34.5.tgz",
+      "integrity": "sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-riscv64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linux-s390x": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.34.5.tgz",
+      "integrity": "sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-s390x": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linux-x64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.34.5.tgz",
+      "integrity": "sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-x64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linuxmusl-arm64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.34.5.tgz",
+      "integrity": "sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linuxmusl-x64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.34.5.tgz",
+      "integrity": "sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linuxmusl-x64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-wasm32": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.34.5.tgz",
+      "integrity": "sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/runtime": "^1.7.0"
+      },
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-win32-arm64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.34.5.tgz",
+      "integrity": "sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-win32-ia32": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.34.5.tgz",
+      "integrity": "sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-win32-x64": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.34.5.tgz",
+      "integrity": "sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.9",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.9.tgz",
+      "integrity": "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.0.3",
+        "@jridgewell/sourcemap-codec": "^1.4.10"
+      }
+    },
+    "node_modules/@poppinss/colors": {
+      "version": "4.1.6",
+      "resolved": "https://registry.npmjs.org/@poppinss/colors/-/colors-4.1.6.tgz",
+      "integrity": "sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "kleur": "^4.1.5"
+      }
+    },
+    "node_modules/@poppinss/dumper": {
+      "version": "0.6.5",
+      "resolved": "https://registry.npmjs.org/@poppinss/dumper/-/dumper-0.6.5.tgz",
+      "integrity": "sha512-NBdYIb90J7LfOI32dOewKI1r7wnkiH6m920puQ3qHUeZkxNkQiFnXVWoE6YtFSv6QOiPPf7ys6i+HWWecDz7sw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@poppinss/colors": "^4.1.5",
+        "@sindresorhus/is": "^7.0.2",
+        "supports-color": "^10.0.0"
+      }
+    },
+    "node_modules/@poppinss/exception": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@poppinss/exception/-/exception-1.2.3.tgz",
+      "integrity": "sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@sindresorhus/is": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-7.2.0.tgz",
+      "integrity": "sha512-P1Cz1dWaFfR4IR+U13mqqiGsLFf1KbayybWwdd2vfctdV6hDpUkgCY0nKOLLTMSoRd/jJNjtbqzf13K8DCCXQw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/is?sponsor=1"
+      }
+    },
+    "node_modules/@speed-highlight/core": {
+      "version": "1.2.15",
+      "resolved": "https://registry.npmjs.org/@speed-highlight/core/-/core-1.2.15.tgz",
+      "integrity": "sha512-BMq1K3DsElxDWawkX6eLg9+CKJrTVGCBAWVuHXVUV2u0s2711qiChLSId6ikYPfxhdYocLNt3wWwSvDiTvFabw==",
+      "dev": true,
+      "license": "CC0-1.0"
+    },
+    "node_modules/blake3-wasm": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/blake3-wasm/-/blake3-wasm-2.1.5.tgz",
+      "integrity": "sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/cookie": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
+      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/error-stack-parser-es": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/error-stack-parser-es/-/error-stack-parser-es-1.0.5.tgz",
+      "integrity": "sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
+    "node_modules/esbuild": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.3.tgz",
+      "integrity": "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.27.3",
+        "@esbuild/android-arm": "0.27.3",
+        "@esbuild/android-arm64": "0.27.3",
+        "@esbuild/android-x64": "0.27.3",
+        "@esbuild/darwin-arm64": "0.27.3",
+        "@esbuild/darwin-x64": "0.27.3",
+        "@esbuild/freebsd-arm64": "0.27.3",
+        "@esbuild/freebsd-x64": "0.27.3",
+        "@esbuild/linux-arm": "0.27.3",
+        "@esbuild/linux-arm64": "0.27.3",
+        "@esbuild/linux-ia32": "0.27.3",
+        "@esbuild/linux-loong64": "0.27.3",
+        "@esbuild/linux-mips64el": "0.27.3",
+        "@esbuild/linux-ppc64": "0.27.3",
+        "@esbuild/linux-riscv64": "0.27.3",
+        "@esbuild/linux-s390x": "0.27.3",
+        "@esbuild/linux-x64": "0.27.3",
+        "@esbuild/netbsd-arm64": "0.27.3",
+        "@esbuild/netbsd-x64": "0.27.3",
+        "@esbuild/openbsd-arm64": "0.27.3",
+        "@esbuild/openbsd-x64": "0.27.3",
+        "@esbuild/openharmony-arm64": "0.27.3",
+        "@esbuild/sunos-x64": "0.27.3",
+        "@esbuild/win32-arm64": "0.27.3",
+        "@esbuild/win32-ia32": "0.27.3",
+        "@esbuild/win32-x64": "0.27.3"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/kleur": {
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/kleur/-/kleur-4.1.5.tgz",
+      "integrity": "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/miniflare": {
+      "version": "4.20260507.1",
+      "resolved": "https://registry.npmjs.org/miniflare/-/miniflare-4.20260507.1.tgz",
+      "integrity": "sha512-PSXBiLExTdZ4UGO/raKCHQauUpYL7F880ZRB7j0+78Rv8h7TsdN2E/iEDK9sK2Y+SPQ5wJSeAa+rDeVKoZZoEw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@cspotcode/source-map-support": "0.8.1",
+        "sharp": "^0.34.5",
+        "undici": "7.24.8",
+        "workerd": "1.20260507.1",
+        "ws": "8.18.0",
+        "youch": "4.1.0-beta.10"
+      },
+      "bin": {
+        "miniflare": "bootstrap.js"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/path-to-regexp": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.3.0.tgz",
+      "integrity": "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/pathe": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/semver": {
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
+      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/sharp": {
+      "version": "0.34.5",
+      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.34.5.tgz",
+      "integrity": "sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@img/colour": "^1.0.0",
+        "detect-libc": "^2.1.2",
+        "semver": "^7.7.3"
+      },
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-darwin-arm64": "0.34.5",
+        "@img/sharp-darwin-x64": "0.34.5",
+        "@img/sharp-libvips-darwin-arm64": "1.2.4",
+        "@img/sharp-libvips-darwin-x64": "1.2.4",
+        "@img/sharp-libvips-linux-arm": "1.2.4",
+        "@img/sharp-libvips-linux-arm64": "1.2.4",
+        "@img/sharp-libvips-linux-ppc64": "1.2.4",
+        "@img/sharp-libvips-linux-riscv64": "1.2.4",
+        "@img/sharp-libvips-linux-s390x": "1.2.4",
+        "@img/sharp-libvips-linux-x64": "1.2.4",
+        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4",
+        "@img/sharp-libvips-linuxmusl-x64": "1.2.4",
+        "@img/sharp-linux-arm": "0.34.5",
+        "@img/sharp-linux-arm64": "0.34.5",
+        "@img/sharp-linux-ppc64": "0.34.5",
+        "@img/sharp-linux-riscv64": "0.34.5",
+        "@img/sharp-linux-s390x": "0.34.5",
+        "@img/sharp-linux-x64": "0.34.5",
+        "@img/sharp-linuxmusl-arm64": "0.34.5",
+        "@img/sharp-linuxmusl-x64": "0.34.5",
+        "@img/sharp-wasm32": "0.34.5",
+        "@img/sharp-win32-arm64": "0.34.5",
+        "@img/sharp-win32-ia32": "0.34.5",
+        "@img/sharp-win32-x64": "0.34.5"
+      }
+    },
+    "node_modules/supports-color": {
+      "version": "10.2.2",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-10.2.2.tgz",
+      "integrity": "sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/supports-color?sponsor=1"
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "dev": true,
+      "license": "0BSD",
+      "optional": true
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici": {
+      "version": "7.24.8",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.8.tgz",
+      "integrity": "sha512-6KQ/+QxK49Z/p3HO6E5ZCZWNnCasyZLa5ExaVYyvPxUwKtbCPMKELJOqh7EqOle0t9cH/7d2TaaTRRa6Nhs4YQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.18.1"
+      }
+    },
+    "node_modules/unenv": {
+      "version": "2.0.0-rc.24",
+      "resolved": "https://registry.npmjs.org/unenv/-/unenv-2.0.0-rc.24.tgz",
+      "integrity": "sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "pathe": "^2.0.3"
+      }
+    },
+    "node_modules/workerd": {
+      "version": "1.20260507.1",
+      "resolved": "https://registry.npmjs.org/workerd/-/workerd-1.20260507.1.tgz",
+      "integrity": "sha512-z7JhsFSe6+X1b5fUHaVpo15VM1IRMJiLofEkq8iKdCo+Veqc+FUg5lIsuz8NwePxuSKrXtO4ZQpGkQLbPVXFhg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "workerd": "bin/workerd"
+      },
+      "engines": {
+        "node": ">=16"
+      },
+      "optionalDependencies": {
+        "@cloudflare/workerd-darwin-64": "1.20260507.1",
+        "@cloudflare/workerd-darwin-arm64": "1.20260507.1",
+        "@cloudflare/workerd-linux-64": "1.20260507.1",
+        "@cloudflare/workerd-linux-arm64": "1.20260507.1",
+        "@cloudflare/workerd-windows-64": "1.20260507.1"
+      }
+    },
+    "node_modules/wrangler": {
+      "version": "4.90.0",
+      "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.90.0.tgz",
+      "integrity": "sha512-bmNIykl59TfCUn5xQgU7IWylSsPx3LQaPLMSAq2VQHt89CBrcj9qXQ0eYfjBCWA5XTBVgten391evt7xxtXwcA==",
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "dependencies": {
+        "@cloudflare/kv-asset-handler": "0.5.0",
+        "@cloudflare/unenv-preset": "2.16.1",
+        "blake3-wasm": "2.1.5",
+        "esbuild": "0.27.3",
+        "miniflare": "4.20260507.1",
+        "path-to-regexp": "6.3.0",
+        "unenv": "2.0.0-rc.24",
+        "workerd": "1.20260507.1"
+      },
+      "bin": {
+        "wrangler": "bin/wrangler.js",
+        "wrangler2": "bin/wrangler.js"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.2"
+      },
+      "peerDependencies": {
+        "@cloudflare/workers-types": "^4.20260507.1"
+      },
+      "peerDependenciesMeta": {
+        "@cloudflare/workers-types": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/ws": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.0.tgz",
+      "integrity": "sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/youch": {
+      "version": "4.1.0-beta.10",
+      "resolved": "https://registry.npmjs.org/youch/-/youch-4.1.0-beta.10.tgz",
+      "integrity": "sha512-rLfVLB4FgQneDr0dv1oddCVZmKjcJ6yX6mS4pU82Mq/Dt9a3cLZQ62pDBL4AUO+uVrCvtWz3ZFUL2HFAFJ/BXQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@poppinss/colors": "^4.1.5",
+        "@poppinss/dumper": "^0.6.4",
+        "@speed-highlight/core": "^1.2.7",
+        "cookie": "^1.0.2",
+        "youch-core": "^0.3.3"
+      }
+    },
+    "node_modules/youch-core": {
+      "version": "0.3.3",
+      "resolved": "https://registry.npmjs.org/youch-core/-/youch-core-0.3.3.tgz",
+      "integrity": "sha512-ho7XuGjLaJ2hWHoK8yFnsUGy2Y5uDpqSTq1FkHLK4/oqKtyUU1AFbOOxY4IpC9f0fTLjwYbslUz0Po5BpD1wrA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@poppinss/exception": "^1.2.2",
+        "error-stack-parser-es": "^1.0.5"
+      }
+    }
+  }
+}
diff --git a/workers/preview/package.json b/workers/preview/package.json
new file mode 100644
index 000000000..5823dd4ba
--- /dev/null
+++ b/workers/preview/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "sure-preview-worker",
+  "version": "1.0.0",
+  "private": true,
+  "scripts": {
+    "deploy": "wrangler deploy",
+    "dev": "wrangler dev"
+  },
+  "devDependencies": {
+    "@cloudflare/containers": "^0.3.3",
+    "@cloudflare/workers-types": "^4.20250124.0",
+    "typescript": "^5.0.0",
+    "wrangler": "^4.0.0"
+  }
+}
diff --git a/workers/preview/src/index.ts b/workers/preview/src/index.ts
new file mode 100644
index 000000000..5e60a8757
--- /dev/null
+++ b/workers/preview/src/index.ts
@@ -0,0 +1,369 @@
+import { Container } from "@cloudflare/containers";
+
+interface Env {
+  RAILS_CONTAINER: DurableObjectNamespace<RailsContainer>;
+}
+
+interface DiagnosticPayload {
+  stage?: string;
+  detail?: string;
+}
+
+interface DiagnosticRecord {
+  event?: string;
+  at?: string;
+  payload?: DiagnosticPayload;
+  state?: { status?: string; lastChange?: number };
+  message?: string;
+}
+
+interface PreviewProgress {
+  phase: "cold" | "warming" | "loading-demo-data" | "ready" | "failed";
+  stage: string | null;
+  message: string;
+  detail: string;
+}
+
+interface PreviewStatusPayload {
+  state: unknown;
+  containerRunning: boolean;
+  diagnostics: DiagnosticRecord | null;
+  diagnosticsHistory: DiagnosticRecord[];
+  previewReady: boolean;
+  previewFailed: boolean;
+  progress: PreviewProgress;
+}
+
+const DIAGNOSTICS_KEY = "preview-diagnostics";
+const DIAGNOSTICS_HISTORY_KEY = "preview-diagnostics-history";
+const READY_STAGES = new Set(["demo-data-ready", "demo-data-skip"]);
+const FAILED_STAGES = new Set(["demo-data-failed", "failed"]);
+const WAITING_MESSAGES: Record<string, string> = {
+  boot: "Waking preview…",
+  "redis-start": "Starting Redis…",
+  "redis-ready": "Redis is ready.",
+  "postgres-start": "Starting PostgreSQL…",
+  "postgres-ready": "PostgreSQL is ready.",
+  "postgres-already-running": "PostgreSQL is already running.",
+  "db-setup": "Setting up the preview database…",
+  "db-prepare": "Running database setup…",
+  "db-prepare-done": "Database setup finished.",
+  "demo-data-check": "Checking sample data…",
+  "demo-data-user-present": "Found the demo user. Verifying sample data…",
+  "demo-data-deferred": "Rails is up. Loading sample data…",
+  "demo-data-load": "Loading sample data…",
+  "demo-data-ready": "Sample data is ready.",
+  "demo-data-skip": "Sample data is already ready.",
+  "demo-data-failed": "Sample data failed to load.",
+  "rails-start": "Starting Rails…",
+  "rails-up-ready": "Rails is up. Finishing sample data…",
+  "rails-up-timeout": "Rails is taking longer than expected to start.",
+};
+
+export class RailsContainer extends Container {
+  defaultPort = 3000;
+  pingEndpoint = "localhost/up";
+  entrypoint = ["/rails/bin/preview-entrypoint", "bundle", "exec", "puma", "-C", "config/puma.rb"];
+  envVars = {
+    RAILS_ENV: "production",
+    RAILS_LOG_TO_STDOUT: "true",
+    RAILS_SERVE_STATIC_FILES: "true",
+    SECRET_KEY_BASE: "preview-secret-key-base-for-pr-${PR_NUMBER}",
+    APP_DOMAIN: "sure-preview-${PR_NUMBER}.sure-finances.workers.dev",
+    APP_URL: "https://sure-preview-${PR_NUMBER}.sure-finances.workers.dev",
+    RAILS_FORCE_SSL: "false",
+    RAILS_ASSUME_SSL: "false",
+    ACTIVE_STORAGE_SERVICE: "local",
+    DISABLE_BOOTSNAP: "1",
+    BINDING: "::",
+    DEMO_DATA_SEED: "${PR_NUMBER}",
+    PREVIEW_ORIGIN: "https://sure-preview-${PR_NUMBER}.sure-finances.workers.dev",
+  };
+  sleepAfter = "30m";
+  enableInternet = true;
+
+  get runtimeContainer() {
+    return this.ctx.container!;
+  }
+
+  async recordDiagnostic(payload: Record<string, unknown>): Promise<void> {
+    const diagnostic = {
+      ...payload,
+      state: await this.getState(),
+    };
+
+    await this.ctx.storage.put(DIAGNOSTICS_KEY, diagnostic);
+
+    const history =
+      ((await this.ctx.storage.get(DIAGNOSTICS_HISTORY_KEY)) as Record<string, unknown>[] | undefined) ?? [];
+
+    history.push(diagnostic);
+
+    if (history.length > 20) {
+      history.splice(0, history.length - 20);
+    }
+
+    await this.ctx.storage.put(DIAGNOSTICS_HISTORY_KEY, history);
+  }
+
+  private async getDiagnostics(): Promise<{
+    state: unknown;
+    containerRunning: boolean;
+    diagnostics: DiagnosticRecord | null;
+    diagnosticsHistory: DiagnosticRecord[];
+  }> {
+    return {
+      state: await this.getState(),
+      containerRunning: this.runtimeContainer.running,
+      diagnostics: ((await this.ctx.storage.get(DIAGNOSTICS_KEY)) as DiagnosticRecord | undefined) ?? null,
+      diagnosticsHistory:
+        ((await this.ctx.storage.get(DIAGNOSTICS_HISTORY_KEY)) as DiagnosticRecord[] | undefined) ?? [],
+    };
+  }
+
+  private async probeRailsUp(): Promise<boolean> {
+    try {
+      const response = await this.containerFetch(new Request("https://container.internal/up"), this.defaultPort);
+      return response.ok;
+    } catch {
+      return false;
+    }
+  }
+
+  private async buildPreviewStatus(base: {
+    state: unknown;
+    containerRunning: boolean;
+    diagnostics: DiagnosticRecord | null;
+    diagnosticsHistory: DiagnosticRecord[];
+  }, options?: { probe?: boolean }): Promise<PreviewStatusPayload> {
+    const allDiagnostics = [...base.diagnosticsHistory, ...(base.diagnostics ? [base.diagnostics] : [])];
+    const entrypointDiagnostics = allDiagnostics.filter(
+      (item) => item.event === "entrypoint" && typeof item.payload?.stage === "string"
+    );
+    const latestEntrypoint = entrypointDiagnostics.at(-1) ?? null;
+    const latestStage = latestEntrypoint?.payload?.stage ?? null;
+    const latestDetail = latestEntrypoint?.payload?.detail ?? base.diagnostics?.message ?? "";
+    const sampleDataReady = entrypointDiagnostics.some((item) => READY_STAGES.has(item.payload?.stage ?? ""));
+    const liveProbeReady = options?.probe ? await this.probeRailsUp() : false;
+    const railsResponding =
+      liveProbeReady ||
+      (typeof base.state === "object" && base.state !== null && "status" in base.state
+        ? (base.state as { status?: string }).status === "healthy"
+        : false) ||
+      entrypointDiagnostics.some((item) => item.payload?.stage === "rails-up-ready");
+    const previewReady = liveProbeReady || (sampleDataReady && railsResponding);
+    const previewFailed =
+      entrypointDiagnostics.some((item) => FAILED_STAGES.has(item.payload?.stage ?? "")) ||
+      base.diagnostics?.event === "error";
+
+    let phase: PreviewProgress["phase"] = "cold";
+    if (previewFailed) {
+      phase = "failed";
+    } else if (previewReady) {
+      phase = "ready";
+    } else if (
+      latestStage === "demo-data-load" ||
+      latestStage === "demo-data-deferred" ||
+      latestStage === "rails-up-ready" ||
+      latestStage === "demo-data-check" ||
+      latestStage === "demo-data-user-present"
+    ) {
+      phase = "loading-demo-data";
+    } else if (base.containerRunning || latestEntrypoint) {
+      phase = "warming";
+    }
+
+    const message = sampleDataReady && !previewReady
+      ? "Finishing preview startup…"
+      : (latestStage ? WAITING_MESSAGES[latestStage] : undefined) ??
+        (previewFailed
+          ? "Preview startup hit an error."
+          : previewReady
+            ? "Preview is ready."
+            : base.containerRunning
+              ? "Warming preview…"
+              : "Starting preview…");
+
+    return {
+      ...base,
+      previewReady,
+      previewFailed,
+      progress: {
+        phase,
+        stage: latestStage,
+        message,
+        detail: latestDetail,
+      },
+    };
+  }
+
+  private wantsHtml(request: Request): boolean {
+    if (request.method !== "GET") return false;
+    const accept = request.headers.get("accept") ?? "";
+    const secFetchDest = request.headers.get("sec-fetch-dest") ?? "";
+    return accept.includes("text/html") || secFetchDest === "document";
+  }
+
+  private renderWaitPage(request: Request, status: PreviewStatusPayload, errorMessage?: string): Response {
+    const targetPath = new URL(request.url).pathname + new URL(request.url).search;
+    const escapedTargetPath = JSON.stringify(targetPath);
+    const escapedMessage = JSON.stringify(status.progress.message);
+    const escapedDetail = JSON.stringify(
+      status.progress.detail || errorMessage || "This preview is waking up and loading sample data."
+    );
+
+    const html = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Waking preview…</title>
+    <style>
+      :root { color-scheme: light dark; }
+      body { margin: 0; font-family: Inter, ui-sans-serif, system-ui, sans-serif; background: #0b1220; color: #e5eefc; }
+      .wrap { min-height: 100vh; display: grid; place-items: center; padding: 24px; }
+      .card { width: min(100%, 520px); background: rgba(15, 23, 42, 0.92); border: 1px solid rgba(148, 163, 184, 0.2); border-radius: 20px; padding: 28px; box-shadow: 0 20px 50px rgba(0,0,0,0.35); }
+      .spinner { width: 42px; height: 42px; border-radius: 999px; border: 4px solid rgba(148,163,184,0.28); border-top-color: #60a5fa; animation: spin 0.9s linear infinite; margin-bottom: 18px; }
+      h1 { margin: 0 0 10px; font-size: 1.5rem; }
+      p { margin: 0; line-height: 1.55; color: #cbd5e1; }
+      .detail { margin-top: 12px; font-size: 0.95rem; color: #93c5fd; }
+      .hint { margin-top: 18px; font-size: 0.9rem; color: #94a3b8; }
+      .error { margin-top: 18px; color: #fca5a5; }
+      @keyframes spin { to { transform: rotate(360deg); } }
+    </style>
+  </head>
+  <body>
+    <div class="wrap">
+      <div class="card">
+        <div class="spinner" aria-hidden="true"></div>
+        <h1 id="message"></h1>
+        <p id="detail"></p>
+        <p class="hint">Please wait — this preview is cold-starting and will redirect automatically when the sample data is ready.</p>
+        <p class="error" id="error"></p>
+      </div>
+    </div>
+    <script>
+      const targetPath = ${escapedTargetPath};
+      const messageEl = document.getElementById("message");
+      const detailEl = document.getElementById("detail");
+      const errorEl = document.getElementById("error");
+      const update = (status) => {
+        messageEl.textContent = status?.progress?.message || ${escapedMessage};
+        detailEl.textContent = status?.progress?.detail || ${escapedDetail};
+        if (status?.previewFailed) {
+          errorEl.textContent = "Preview startup hit an error. Still retrying — refresh if this persists.";
+        }
+      };
+      update(null);
+      const poll = async () => {
+        try {
+          const response = await fetch("/_container_status", { cache: "no-store" });
+          if (!response.ok) throw new Error("status " + response.status);
+          const status = await response.json();
+          update(status);
+          if (status.previewReady) {
+            window.location.replace(targetPath);
+            return;
+          }
+        } catch (error) {
+          const reason = error instanceof Error ? error.message : String(error);
+          errorEl.textContent = "Still waking the preview (" + reason + ").";
+        }
+        window.setTimeout(poll, 1500);
+      };
+      window.setTimeout(poll, 1500);
+    </script>
+  </body>
+</html>`;
+
+    return new Response(html, {
+      status: status.previewFailed ? 503 : 202,
+      headers: {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store, max-age=0",
+        "retry-after": "3",
+      },
+    });
+  }
+
+  override async fetch(request: Request): Promise<Response> {
+    const url = new URL(request.url);
+
+    if (url.pathname === "/_container_status") {
+      return Response.json(await this.buildPreviewStatus(await this.getDiagnostics(), { probe: true }));
+    }
+
+    if (url.pathname === "/_container_event" && request.method === "POST") {
+      const payload = await request.json();
+      await this.recordDiagnostic({
+        event: "entrypoint",
+        at: new Date().toISOString(),
+        payload,
+      });
+      return new Response("ok");
+    }
+
+    try {
+      return await this.containerFetch(request, this.defaultPort);
+    } catch (error) {
+      await this.recordDiagnostic({
+        event: "container-fetch-error",
+        at: new Date().toISOString(),
+        message: error instanceof Error ? error.message : String(error),
+      });
+
+      const status = await this.buildPreviewStatus(await this.getDiagnostics());
+      if (this.wantsHtml(request) && !status.previewReady) {
+        return this.renderWaitPage(
+          request,
+          status,
+          error instanceof Error ? error.message : String(error)
+        );
+      }
+
+      return new Response(
+        `Failed to serve preview container: ${error instanceof Error ? error.message : String(error)}`,
+        { status: 500 }
+      );
+    }
+  }
+
+  override async onStart(): Promise<void> {
+    await this.recordDiagnostic({
+      event: "start",
+      at: new Date().toISOString(),
+    });
+  }
+
+  override async onStop(stopParams: { exitCode?: number; reason?: string }): Promise<void> {
+    await this.recordDiagnostic({
+      event: "stop",
+      at: new Date().toISOString(),
+      exitCode: stopParams.exitCode,
+      reason: stopParams.reason,
+    });
+  }
+
+  override async onError(error: unknown): Promise<void> {
+    console.error("Rails container error:", error);
+    await this.recordDiagnostic({
+      event: "error",
+      at: new Date().toISOString(),
+      message: error instanceof Error ? error.message : String(error),
+    });
+    throw error;
+  }
+}
+
+export default {
+  async fetch(
+    request: Request,
+    env: Env,
+    _ctx: ExecutionContext
+  ): Promise<Response> {
+    const id = env.RAILS_CONTAINER.idFromName("preview");
+    const container = env.RAILS_CONTAINER.get(id);
+
+    return container.fetch(request);
+  },
+};
diff --git a/workers/preview/tsconfig.json b/workers/preview/tsconfig.json
new file mode 100644
index 000000000..61f2674cb
--- /dev/null
+++ b/workers/preview/tsconfig.json
@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ES2022",
+    "moduleResolution": "bundler",
+    "lib": ["ES2022"],
+    "types": ["@cloudflare/workers-types"],
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*.ts"]
+}
diff --git a/workers/preview/wrangler.toml b/workers/preview/wrangler.toml
new file mode 100644
index 000000000..17e95b899
--- /dev/null
+++ b/workers/preview/wrangler.toml
@@ -0,0 +1,41 @@
+# Cloudflare Containers configuration for PR preview deployments
+# This file is used as a template - the GitHub workflow substitutes PR_NUMBER
+
+name = "sure-preview-${PR_NUMBER}"
+main = "./src/index.ts"
+compatibility_date = "2026-05-11"
+
+# Enable workers.dev subdomain for preview access
+workers_dev = true
+
+# Enable container logs
+[observability]
+enabled = true
+
+# Container configuration - uses preview Dockerfile with embedded PostgreSQL
+# Note: path is relative to this config file location
+[[containers]]
+class_name = "RailsContainer"
+image = "../../Dockerfile.preview"
+instance_type = "basic"
+max_instances = 1
+
+# Durable Object binding for the container
+[[durable_objects.bindings]]
+name = "RAILS_CONTAINER"
+class_name = "RailsContainer"
+
+# Required migration for Durable Objects with SQLite
+[[migrations]]
+tag = "v1"
+new_sqlite_classes = ["RailsContainer"]
+
+# Environment variables passed to the Rails container
+[vars]
+RAILS_ENV = "development"
+RAILS_LOG_TO_STDOUT = "true"
+RAILS_SERVE_STATIC_FILES = "true"
+
+# Note: SECRET_KEY_BASE and DATABASE_URL are auto-generated by the entrypoint
+# for development previews. For custom configuration, set via:
+# wrangler secret put SECRET_KEY_BASE