diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba2c4cc..2cab376 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,8 +1,14 @@
 name: PHP Checks
 
+concurrency:
+  group: php-checks-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
+  # Pull requests validate topic branches; push runs are reserved for main to avoid
+  # duplicate CI runs for every commit on a branch that already has an open PR.
   push:
-    branches: [main, "feat/**", "fix/**", "test/**"]
+    branches: [main]
   pull_request:
   workflow_dispatch:
 
@@ -12,6 +18,7 @@ permissions:
 jobs:
   checks:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     services:
       mariadb:
         image: mariadb:10.11
@@ -31,7 +38,7 @@ jobs:
         php: ["8.2", "8.3", "8.4"]
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up PHP
         uses: shivammathur/setup-php@v2
@@ -52,10 +59,16 @@ jobs:
       - name: Check design-system assets
         run: php tests/design-system.php
 
+      - name: Check workspace UI contracts
+        run: php tests/workspace-ui.php
+
+      - name: Check deployment workflow safety
+        run: php tests/deployment-workflow.php
+
       - name: Check JavaScript syntax
         run: |
           node --check public/assets/js/ui.js
-          node --check public/assets/js/design-system-demo.js
+          node --check public/assets/js/workspace.js
 
       - name: Run MariaDB integration tests
         env:
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..29e869b
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,106 @@
+name: Deploy production
+
+on:
+  workflow_dispatch:
+    inputs:
+      confirm_production:
+        description: Type DEPLOY to confirm a production deployment
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: production-deployment
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    if: ${{ inputs.confirm_production == 'DEPLOY' && github.ref == 'refs/heads/main' }}
+    runs-on: ubuntu-latest
+    environment: production
+    timeout-minutes: 15
+    steps:
+      - name: Check out the selected revision
+        uses: actions/checkout@v5
+
+      - name: Validate deployment configuration
+        shell: bash
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
+        run: |
+          set -euo pipefail
+          for name in DEPLOY_HOST DEPLOY_USER DEPLOY_SSH_PRIVATE_KEY DEPLOY_KNOWN_HOSTS DEPLOY_PATH; do
+            if [[ -z "${!name}" ]]; then
+              echo "::error::Required production secret is missing: ${name}"
+              exit 1
+            fi
+          done
+          if [[ ! "$DEPLOY_PATH" =~ ^/[A-Za-z0-9._/-]+$ ]]; then
+            echo "::error::DEPLOY_PATH must be an absolute path using only letters, numbers, dot, underscore, slash, or hyphen"
+            exit 1
+          fi
+          if [[ "$DEPLOY_PATH" == *"/../"* || "$DEPLOY_PATH" == */.. || "$DEPLOY_PATH" == "/" || "$DEPLOY_PATH" == "/home" || "$DEPLOY_PATH" == "/var" ]]; then
+            echo "::error::DEPLOY_PATH is too broad to be a safe application target"
+            exit 1
+          fi
+
+      - name: Configure pinned SSH identity
+        shell: bash
+        env:
+          DEPLOY_SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
+        run: |
+          set -euo pipefail
+          install -m 700 -d "$HOME/.ssh"
+          printf '%s\n' "$DEPLOY_SSH_PRIVATE_KEY" > "$HOME/.ssh/deploy_key"
+          chmod 600 "$HOME/.ssh/deploy_key"
+          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
+          chmod 600 "$HOME/.ssh/known_hosts"
+
+      - name: Validate remote SSH access and target directory
+        shell: bash
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+        run: |
+          set -euo pipefail
+          port="${DEPLOY_PORT:-22}"
+          [[ "$port" =~ ^[0-9]+$ ]] || { echo "::error::DEPLOY_PORT must be numeric"; exit 1; }
+          ssh -i "$HOME/.ssh/deploy_key" -p "$port" \
+            -o BatchMode=yes -o StrictHostKeyChecking=yes \
+            "$DEPLOY_USER@$DEPLOY_HOST" \
+            "test -d '$DEPLOY_PATH' && test -w '$DEPLOY_PATH'"
+
+      - name: Deploy application files without deleting remote data
+        shell: bash
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+        run: |
+          set -euo pipefail
+          port="${DEPLOY_PORT:-22}"
+          rsync -az --checksum \
+            --exclude='/.git/' \
+            --exclude='/.github/' \
+            --exclude='/tests/' \
+            --exclude='/docs/' \
+            --exclude='/.env' \
+            --exclude='/.env.*' \
+            --exclude='/*.log' \
+            -e "ssh -i $HOME/.ssh/deploy_key -p $port -o BatchMode=yes -o StrictHostKeyChecking=yes" \
+            ./ "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/"
+
+      - name: Remove temporary SSH credentials
+        if: always()
+        shell: bash
+        run: rm -f "$HOME/.ssh/deploy_key" "$HOME/.ssh/known_hosts"
diff --git a/.htaccess b/.htaccess
new file mode 100644
index 0000000..e2f816e
--- /dev/null
+++ b/.htaccess
@@ -0,0 +1,30 @@
+Options -Indexes
+
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+
+    # Keep repository metadata and secret dotfiles inaccessible.
+    RewriteRule (^|/)\.(?!well-known/) - [F,L]
+
+    # An optional repository-root document root must never expose the source tree.
+    # Only the public assets are mapped directly; every application URL goes through PHP.
+    RewriteRule ^public(?:/|$) - [F,L,NC]
+    RewriteRule ^\.well-known/ - [END]
+    RewriteRule ^assets/(.*)$ public/assets/$1 [END,NC]
+    RewriteRule ^ public/index.php [QSA,END]
+</IfModule>
+
+<IfModule mod_mime.c>
+    AddType text/css .css
+    AddType application/javascript .js
+</IfModule>
+
+<IfModule mod_headers.c>
+    <FilesMatch "\.(?:css|js)$">
+        Header set Cache-Control "public, max-age=31536000, immutable"
+    </FilesMatch>
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+    Header always set X-Frame-Options "DENY"
+    Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'"
+</IfModule>
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8313304..a36e60d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+- Add a manual, main-only production delivery workflow with typed confirmation, production environment gate, pinned SSH host verification, destination validation, and non-destructive rsync.
+- Add CI contract tests for deployment safety and document required production secrets and controlled migration steps.
+- Reduce redundant CI traffic by running topic-branch validation through pull requests and reserving push-triggered CI for main.
+- Fix a workspace UI contract test to match idempotent `CREATE TABLE IF NOT EXISTS` migration statements.
+
+- Fix CSS/JavaScript delivery for hosts whose document root is the repository root by routing `/assets/*` to the public asset directory without exposing application source files.
+- Explicitly declare static CSS/JavaScript MIME types and apply immutable caching to versioned assets; bump workspace asset keys to avoid stale cached styles and scripts.
+- Run the previously unwired workspace UI contract test in CI and syntax-check the production `workspace.js` controller.
+- Remove the standalone visual showcase page and demo-only assets; retain shared design-system CSS that the live workspace uses.
+
+
 - Removed unused duplicate team/project settings handlers and aligned UI contract tests with the registered transactional update endpoints.
 
 - Add a project Files tab with a searchable private source-file directory, lightweight text editor, save/reload controls, and revision-history restore.
diff --git a/README.md b/README.md
index 99f907b..3b16624 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # TeamCode Hub
 
-**Version:** 0.2.0-dev  
+**Version:** 0.2.2-dev  
 **Status:** Active development
 
 TeamCode Hub is a modular, security-focused collaboration platform for software teams, designed for conventional PHP hosting with cPanel/DirectAdmin and MySQL/MariaDB.
@@ -63,7 +63,7 @@ See [docs/API.md](docs/API.md) for request bodies, status codes, retention, and
 
 ## Validation
 
-CI checks PHP syntax and smoke tests, design-system and workspace UI contracts, JavaScript syntax, and MariaDB integration tests on PHP 8.2, 8.3, and 8.4.
+CI checks PHP syntax and smoke tests, design-system and workspace UI contracts, deployment safety contracts, JavaScript syntax, and MariaDB integration tests on PHP 8.2, 8.3, and 8.4. Production delivery is manual-only from `main`, requires a typed confirmation and pinned SSH host key, and must be configured with environment-scoped deployment secrets; it never deletes remote files or runs migrations automatically.
 
 Run the lightweight local checks with:
 
@@ -71,8 +71,8 @@ Run the lightweight local checks with:
 php tests/run.php
 php tests/design-system.php
 php tests/workspace-ui.php
+php tests/deployment-workflow.php
 node --check public/assets/js/ui.js
-node --check public/assets/js/design-system-demo.js
 node --check public/assets/js/workspace.js
 ```
 
diff --git a/docs/DESIGN-SYSTEM.md b/docs/DESIGN-SYSTEM.md
index 5039cea..6046437 100644
--- a/docs/DESIGN-SYSTEM.md
+++ b/docs/DESIGN-SYSTEM.md
@@ -11,20 +11,20 @@ This document describes the shared visual and interaction foundation used by Tea
 | `public/assets/css/base.css` | Browser defaults, semantic element defaults, focus visibility, and reduced motion |
 | `public/assets/css/layout.css` | Containers, responsive grids, page shell, sidebar, and header layouts |
 | `public/assets/css/components.css` | Buttons, forms, badges, cards, alerts, tables, tabs, overlays, and feedback |
-| `public/assets/css/patterns.css` | Upload/range controls, avatar states, pagination, accordions, tooltips, workflow steps, quote/code, and footer patterns |
+| `public/assets/css/patterns.css` | Reusable upload/range controls, avatar states, pagination, accordions, tooltips, workflow steps, and content patterns |
 | `public/assets/css/utilities.css` | Small composable spacing, text, surface, and alignment helpers |
-| `public/assets/js/ui.js` | Accessible interactions shared by product pages |\n| `public/assets/css/workspace.css` | Product-specific workspace, dashboard, project, task, and chat presentation |\n| `public/assets/js/workspace.js` | Authenticated API integration and workspace interactions |\n| `public/app.html` | English workspace shell and sign-in form |
-| `public/assets/css/design-system-demo.css` | Styles unique to the reference showcase |
-| `public/assets/js/design-system-demo.js` | Demo-only button handlers |
-| `public/design-system.html` | English component reference page |
+| `public/assets/css/workspace.css` | Product-specific workspace, dashboard, team, project, task, and chat presentation |
+| `public/assets/js/ui.js` | Accessible interactions shared by product pages |
+| `public/assets/js/workspace.js` | Authenticated API integration and workspace interactions |
+| `public/app.html` | English workspace shell and sign-in form |
 
 ## Loading the design system
 
 Load the entry stylesheet and the shared UI controller from a page template. Keep product-specific styles and behavior in separate files and avoid inline style or script blocks.
 
 ```html
-<link rel="stylesheet" href="/assets/css/app.css?v=0.2.1-dev">
-<script src="/assets/js/ui.js?v=0.2.0-dev" defer></script>
+<link rel="stylesheet" href="/assets/css/app.css?v=0.2.2-dev">
+<script src="/assets/js/ui.js?v=0.2.1-dev" defer></script>
 ```
 
 The entry stylesheet imports tokens, base rules, layout, core components, extended patterns, and utilities in dependency order. Every imported stylesheet URL carries a cache key. When CSS changes, bump the CSS asset query keys in the entry imports and HTML entry points together. A production release should use its actual SemVer version.
@@ -85,14 +85,14 @@ Run:
 ```sh
 php tests/design-system.php
 node --check public/assets/js/ui.js
-node --check public/assets/js/design-system-demo.js
+node --check public/assets/js/workspace.js
 ```
 
 CI runs these checks in addition to PHP lint, smoke tests, and MariaDB integration tests. These checks do not replace manual browser review, assistive-technology testing, or visual regression testing.
 
 ## Current scope
 
-The showcase is a reference implementation of the style system, not a claim that the product dashboard, team/project screens, or chat interface are complete. Product screens must be built on the existing APIs and retain server-side authentication and authorization checks.
+The shared style layers are loaded by the actual workspace shell; they are not a standalone product or a substitute for connected application behavior. Team, project, task, file, and chat actions must use the existing APIs and retain server-side authentication and authorization checks.
 
 
 ## Extended component coverage
diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md
index 314fa66..d2e8de2 100644
--- a/docs/OPERATIONS.md
+++ b/docs/OPERATIONS.md
@@ -3,6 +3,7 @@
 ## Before deployment
 
 - Configure the document root to the repository's `public/` directory where possible.
+- If the host cannot point its document root at `public/`, the repository-root `.htaccess` provides a locked-down fallback: it exposes only `/assets/*` from `public/assets/` and routes app paths through `public/index.php`. Do not disable the root rewrite rules, because they prevent direct access to repository source files.
 - Configure database environment variables through the host or a private configuration mechanism outside the web root.
 - Create a dedicated database user with only the permissions the application requires.
 - Enable HTTPS and configure session cookie security accordingly. If TLS terminates at a trusted reverse proxy, set `APP_HTTPS=true` only when the deployment topology guarantees HTTPS to the browser.
@@ -10,6 +11,19 @@
 - Confirm private storage, configuration, backup, and log paths cannot be downloaded over HTTP.
 - Back up the database and files before applying schema changes.
 
+## GitHub Actions deployment (manual)
+
+The `.github/workflows/deploy.yml` workflow is a manual SSH-based delivery path. It only permits the `main` branch, requires typing `DEPLOY`, uses the GitHub `production` environment, verifies a pinned SSH host key, checks that the target directory already exists and is writable, and does not delete remote files. Configure environment-scoped secrets before using it:
+
+- `DEPLOY_HOST` — server hostname (no protocol or path).
+- `DEPLOY_USER` — dedicated deployment account with access only to the application directory.
+- `DEPLOY_SSH_PRIVATE_KEY` — private key for that account; never commit it.
+- `DEPLOY_KNOWN_HOSTS` — independently verified SSH host-key line(s), not output blindly trusted from a runtime `ssh-keyscan`.
+- `DEPLOY_PATH` — absolute application-root path containing the `app/` and `public/` directories; it must not be the filesystem root or a broad system directory.
+- `DEPLOY_PORT` — optional SSH port; defaults to `22`. For a non-standard port, the pinned `known_hosts` entry must use the matching `[host]:port` format.
+
+Set production environment reviewers and branch restrictions in GitHub repository settings. Point the web server document root to the deployed `public/` directory when possible. The workflow deliberately does not run database migrations or create an administrator automatically: take a backup, review pending migrations, and apply `php bin/migrate.php` from a trusted server-side CLI session as a separate controlled operation. Configure the required application environment variables on the server before enabling traffic. The first deployment must be tested on a staging target before production use.
+
 ## Registration and email verification
 
 Public registration is enabled after the account-token migration has been applied. Configure these environment variables outside the web root:
diff --git a/docs/WORKSPACE-UI.md b/docs/WORKSPACE-UI.md
index 7ab1a7a..3d2a351 100644
--- a/docs/WORKSPACE-UI.md
+++ b/docs/WORKSPACE-UI.md
@@ -7,13 +7,14 @@ This document maps the English browser application to the existing server APIs.
 - `/` — authenticated workspace shell; shows sign-in when there is no active session.
 - `/login` — the same progressive-enhancement shell, initially displaying sign-in when unauthenticated.
 - `/verify-email` — the workspace shell used to confirm a one-time token supplied in the URL fragment.
-- `/design-system.html` — component reference page.
 - `public/app.html` — semantic workspace shell.
 - `public/assets/css/app.css` and its token/base/layout/component/pattern/utility layers — shared design-system styles.
 - `public/assets/css/workspace.css` — product-only styles layered on the core design system.
 - `public/assets/js/workspace.js` — same-origin API client, navigation, rendering, forms, and chat polling.
 - `public/assets/js/ui.js` — shared design-system interactions.
 
+The preferred deployment sets the document root to `public/`. A repository-root document root is also supported by the top-level `.htaccess`, which maps `/assets/*` to `public/assets/*`, routes application paths to `public/index.php`, and blocks direct access to the `public/` prefix and repository files.
+
 Project repository links accept only public HTTPS GitHub URLs. The server shares one daily cached snapshot per repository and caps refresh attempts to 20 distinct repositories per UTC day.
 
 The HTML has no inline style or script blocks. The front controller returns HTML with a restrictive same-origin Content Security Policy. CSS and JavaScript are external, versioned files; update their query-string version when releasing a changed asset set.
@@ -103,4 +104,4 @@ php tests/workspace-ui.php
 node --check public/assets/js/workspace.js
 ```
 
-These checks validate the static asset contract and JavaScript syntax. They do not replace manual browser testing across supported devices, keyboard-only interaction, screen-reader review, or visual regression tests. The design-system showcase includes extended input, avatar, chip, accordion, workflow-step, pagination, and content patterns.
+These checks validate the static asset contract and JavaScript syntax. They do not replace manual browser testing across supported devices, keyboard-only interaction, screen-reader review, or visual regression tests. The style contract tests check actual production assets and route wiring; reusable patterns stay in the shared `patterns.css` layer instead of a separate demo page.
diff --git a/public/.htaccess b/public/.htaccess
index 26ca016..1f2475e 100644
--- a/public/.htaccess
+++ b/public/.htaccess
@@ -13,7 +13,16 @@ DirectoryIndex index.php
     RewriteRule ^ index.php [QSA,L]
 </IfModule>
 
+<IfModule mod_mime.c>
+    # Keep strict nosniff policies compatible with directly served static assets.
+    AddType text/css .css
+    AddType application/javascript .js
+</IfModule>
+
 <IfModule mod_headers.c>
+    <FilesMatch "\.(?:css|js)$">
+        Header set Cache-Control "public, max-age=31536000, immutable"
+    </FilesMatch>
     Header always set X-Content-Type-Options "nosniff"
     Header always set Referrer-Policy "strict-origin-when-cross-origin"
     Header always set X-Frame-Options "DENY"
diff --git a/public/app.html b/public/app.html
index aea8d23..66f0c3a 100644
--- a/public/app.html
+++ b/public/app.html
@@ -6,10 +6,10 @@
   <meta name="color-scheme" content="light dark">
   <meta name="description" content="TeamCode Hub — a focused workspace for teams, projects, tasks, and communication.">
   <title>TeamCode Hub — Workspace</title>
-  <link rel="stylesheet" href="/assets/css/app.css?v=0.2.1-dev">
-  <link rel="stylesheet" href="/assets/css/workspace.css?v=0.2.7-dev">
-  <script src="/assets/js/ui.js?v=0.2.0-dev" defer></script>
-  <script src="/assets/js/workspace.js?v=0.2.18-dev" defer></script>
+  <link rel="stylesheet" href="/assets/css/app.css?v=0.2.2-dev">
+  <link rel="stylesheet" href="/assets/css/workspace.css?v=0.2.8-dev">
+  <script src="/assets/js/ui.js?v=0.2.1-dev" defer></script>
+  <script src="/assets/js/workspace.js?v=0.2.19-dev" defer></script>
 </head>
 <body class="tch-workspace">
   <!-- Keyboard users can bypass navigation and jump directly to the current page content. -->
@@ -171,11 +171,11 @@ <h2 id="verify-title">Verify your email</h2>
         </a>
         <button class="btn btn-ghost btn-icon sidebar-close" type="button" data-sidebar-close aria-label="Close navigation">×</button>
       </div>
-      <div class="workspace-switcher">
+      <button class="workspace-switcher" type="button" data-page="teams" aria-label="Open your teams">
         <span class="workspace-avatar" aria-hidden="true">TC</span>
-        <span class="workspace-switcher-copy"><strong>Team workspace</strong><small id="sidebar-team-count">Loading workspace…</small></span>
-        <span class="switcher-caret" aria-hidden="true">⌄</span>
-      </div>
+        <span class="workspace-switcher-copy"><strong>Your teams</strong><small id="sidebar-team-count">Loading teams…</small></span>
+        <span class="switcher-caret" aria-hidden="true">↗</span>
+      </button>
       <nav class="side-nav" aria-label="Workspace">
         <span class="side-nav-label">WORKSPACE</span>
         <button class="side-nav-item is-active" type="button" data-page="overview"><span class="nav-icon" data-icon="grid" aria-hidden="true"></span><span>Overview</span></button>
@@ -193,7 +193,6 @@ <h2 id="verify-title">Verify your email</h2>
         <button class="side-nav-item" type="button" data-page="settings"><span class="nav-icon" data-icon="settings" aria-hidden="true"></span><span>Preferences</span></button>
       </nav>
       <div class="sidebar-bottom">
-        <div class="sidebar-help"><span class="help-mark" aria-hidden="true">?</span><span><strong>Need a hand?</strong><small>Workspace guide</small></span><span class="help-arrow" aria-hidden="true">↗</span></div>
         <div class="sidebar-profile dropdown">
           <span class="avatar avatar-dark" id="user-avatar">U</span>
           <span class="profile-copy"><strong id="sidebar-user-name">Your account</strong><small id="sidebar-user-role">Workspace member</small></span>
diff --git a/public/assets/css/app.css b/public/assets/css/app.css
index e556f68..c5afc62 100644
--- a/public/assets/css/app.css
+++ b/public/assets/css/app.css
@@ -5,12 +5,12 @@
    Production pages should load this single stylesheet with a versioned URL.
    ========================================================================== */
 
-@import url("./tokens.css?v=0.2.1-dev");
-@import url("./base.css?v=0.2.1-dev");
-@import url("./layout.css?v=0.2.1-dev");
-@import url("./components.css?v=0.2.1-dev");
-@import url("./patterns.css?v=0.2.1-dev");
-@import url("./utilities.css?v=0.2.1-dev");
+@import url("./tokens.css?v=0.2.2-dev");
+@import url("./base.css?v=0.2.2-dev");
+@import url("./layout.css?v=0.2.2-dev");
+@import url("./components.css?v=0.2.2-dev");
+@import url("./patterns.css?v=0.2.2-dev");
+@import url("./utilities.css?v=0.2.2-dev");
 
 /* Keep the document canvas consistent when pages use a full-height shell. */
 body { background: var(--surface); color: var(--text); }
diff --git a/public/assets/css/design-system-demo.css b/public/assets/css/design-system-demo.css
deleted file mode 100644
index de3df7c..0000000
--- a/public/assets/css/design-system-demo.css
+++ /dev/null
@@ -1,25 +0,0 @@
-/* ==========================================================================
-   TeamCode Hub Design System Showcase — Page-only styles
-   File: public/assets/css/design-system-demo.css
-   Purpose: Keep the reference page's layout details out of its HTML markup.
-   ========================================================================== */
-
-.demo-principles { width: min(100%, 300px); }
-.demo-swatch { height: 78px; }
-.demo-swatch-primary { background: #0a0a0a; }
-.demo-swatch-muted { background: #f4f4f5; }
-.demo-swatch-success { background: #15803d; }
-.demo-swatch-danger { background: #b91c1c; }
-.demo-divider { margin-block: 4px; }
-.demo-table-wrap { border: 0; border-radius: 0; }
-.demo-foot-note { margin-inline-start: auto; }
-.demo-tab-panel { padding-block: var(--space-4); }
-.demo-tab-panel[hidden] { display: none; }
-
-@media (max-width: 720px) {
-  .demo-foot-note { margin-inline-start: 0; }
-}
-
-/* Typography samples are classes rather than inline declarations, keeping markup clean. */
-.demo-type-display { font-size: clamp(2rem, 5vw, 2.5rem); letter-spacing: -.04em; }
-.demo-type-heading { font-size: 24px; }
diff --git a/public/assets/css/tokens.css b/public/assets/css/tokens.css
index eaca133..7ee0420 100644
--- a/public/assets/css/tokens.css
+++ b/public/assets/css/tokens.css
@@ -43,6 +43,13 @@
   /* Keep secondary copy readable on white surfaces (WCAG AA contrast target). */
   --text-muted: var(--g500);
 
+  /* Compatibility aliases used by product-level workspace components. */
+  --text-primary: var(--text);
+  --surface-hover: var(--g100);
+  --surface-subtle: var(--surface-muted);
+  --surface-code: var(--surface-raised);
+  --radius-md: var(--r-lg);
+
   /* Corner radii. */
   --r-xs: 4px;
   --r-sm: 6px;
diff --git a/public/assets/css/workspace.css b/public/assets/css/workspace.css
index 876625c..9b81d75 100644
--- a/public/assets/css/workspace.css
+++ b/public/assets/css/workspace.css
@@ -20,6 +20,9 @@
 .workspace-switcher { display:flex; align-items:center; gap:10px; width:100%; padding:11px 10px; margin-bottom:24px; border:1px solid var(--border); border-radius:var(--r-lg); background:var(--surface); text-align:left; }
 .workspace-avatar { display:grid; place-items:center; width:35px; height:35px; flex:0 0 35px; border-radius:var(--r); background:var(--g100); color:var(--text); font-size:10px; font-weight:800; letter-spacing:-.04em; }
 .workspace-switcher-copy,.profile-copy { display:flex; flex-direction:column; gap:1px; min-width:0; flex:1; }
+.workspace-switcher { text-align:left; cursor:pointer; transition:background var(--t),border-color var(--t); }
+.workspace-switcher:hover { border-color:var(--border-strong); background:var(--surface-muted); }
+.workspace-switcher:focus-visible { outline:2px solid var(--g700); outline-offset:3px; }
 .workspace-switcher-copy strong,.profile-copy strong { overflow:hidden; text-overflow:ellipsis; white-space:nowrap; font-size:12px; font-weight:650; }
 .workspace-switcher-copy small,.profile-copy small { color:var(--text-muted); font-size:11px; }
 .switcher-caret { color:var(--text-muted); font-size:18px; }
@@ -36,12 +39,6 @@
 .side-nav-item.is-active .nav-count { background:rgb(255 255 255 / 14%); color:#fff; }
 .nav-count-alert { background:var(--danger-bg); color:var(--danger); }
 .sidebar-bottom { margin-top:auto; padding-top:25px; }
-.sidebar-help { display:flex; align-items:center; gap:10px; padding:12px 10px; margin-bottom:15px; border:1px solid var(--border); border-radius:var(--r-lg); }
-.help-mark { display:grid; place-items:center; width:28px; height:28px; border:1px solid var(--border); border-radius:50%; color:var(--text-secondary); font-size:12px; font-weight:700; }
-.sidebar-help strong,.sidebar-help small { display:block; }
-.sidebar-help strong { font-size:11px; font-weight:650; }
-.sidebar-help small { color:var(--text-muted); font-size:10px; }
-.help-arrow { margin-inline-start:auto; color:var(--text-muted); font-size:14px; }
 .sidebar-profile { position:relative; display:flex; align-items:center; gap:9px; padding:13px 4px 2px; border-top:1px solid var(--border); }
 .sidebar-profile .avatar { width:34px; height:34px; border-radius:10px; font-size:11px; }
 .profile-menu-button { width:29px; min-width:29px; height:29px; font-size:18px; }
diff --git a/public/assets/js/design-system-demo.js b/public/assets/js/design-system-demo.js
deleted file mode 100644
index 8782624..0000000
--- a/public/assets/js/design-system-demo.js
+++ /dev/null
@@ -1,98 +0,0 @@
-/* ==========================================================================
-   TeamCode Hub Design System Showcase — Demo-only behavior
-   File: public/assets/js/design-system-demo.js
-   Purpose: Wire the reference page's sample buttons without inline JavaScript.
-   ========================================================================== */
-
-(function () {
-  "use strict";
-
-  /* Do not fail silently if the main interaction controller is unavailable. */
-  function initializeShowcase() {
-    const toastButton = document.getElementById("show-toast");
-    const emptyAction = document.getElementById("empty-action");
-    const year = document.getElementById("year");
-
-    if (toastButton) {
-      toastButton.addEventListener("click", function () {
-        if (window.TCHUI && typeof window.TCHUI.notify === "function") {
-          window.TCHUI.notify("This is a sample notification from the design system.");
-        }
-      });
-    }
-
-    if (emptyAction) {
-      emptyAction.addEventListener("click", function () {
-        if (window.TCHUI && typeof window.TCHUI.notify === "function") {
-          window.TCHUI.notify("The projects page will be connected when its UI is implemented.");
-        }
-      });
-    }
-
-    /* Keep removable chip examples interactive without touching application data. */
-    document.querySelectorAll(".chip .x").forEach(function (button) {
-      button.addEventListener("click", function () {
-        const chip = button.closest(".chip");
-        if (chip) chip.remove();
-        if (window.TCHUI && typeof window.TCHUI.notify === "function") {
-          window.TCHUI.notify("The example chip was removed locally.");
-        }
-      });
-    });
-
-    /* Make the showcase pager update its selected page and boundary states. */
-    document.querySelectorAll(".pager").forEach(function (pager) {
-      const pageButtons = Array.from(pager.querySelectorAll("button"))
-        .filter(function (button) {
-          return !button.hasAttribute("aria-label") && /^\d+$/.test(button.textContent.trim());
-        });
-      const previous = pager.querySelector('[aria-label="Previous page"]');
-      const next = pager.querySelector('[aria-label="Next page"]');
-
-      function selectPage(index) {
-        if (!pageButtons.length) return;
-        const boundedIndex = Math.max(0, Math.min(pageButtons.length - 1, index));
-        pageButtons.forEach(function (button, buttonIndex) {
-          const selected = buttonIndex === boundedIndex;
-          button.classList.toggle("active", selected);
-          if (selected) button.setAttribute("aria-current", "page");
-          else button.removeAttribute("aria-current");
-        });
-        if (previous) previous.disabled = boundedIndex === 0;
-        if (next) next.disabled = boundedIndex === pageButtons.length - 1;
-      }
-
-      pageButtons.forEach(function (button, index) {
-        button.addEventListener("click", function () { selectPage(index); });
-      });
-      if (previous) previous.addEventListener("click", function () {
-        const activeIndex = pageButtons.findIndex(function (button) { return button.classList.contains("active"); });
-        selectPage(activeIndex - 1);
-      });
-      if (next) next.addEventListener("click", function () {
-        const activeIndex = pageButtons.findIndex(function (button) { return button.classList.contains("active"); });
-        selectPage(activeIndex + 1);
-      });
-    });
-
-    /* File selection is preview-only; no bytes leave the browser in this showcase. */
-    const uploadInput = document.getElementById("demo-upload");
-    if (uploadInput) {
-      uploadInput.addEventListener("change", function () {
-        const file = uploadInput.files && uploadInput.files[0];
-        const dropzone = uploadInput.closest(".dropzone");
-        const title = dropzone ? dropzone.querySelector("b") : null;
-        if (title && file) title.textContent = "Selected locally: " + file.name;
-      });
-    }
-
-    /* Keep the footer year accurate without embedding script in the HTML page. */
-    if (year) year.textContent = String(new Date().getFullYear());
-  }
-
-  if (document.readyState === "loading") {
-    document.addEventListener("DOMContentLoaded", initializeShowcase, { once: true });
-  } else {
-    initializeShowcase();
-  }
-})();
diff --git a/public/assets/js/workspace.js b/public/assets/js/workspace.js
index f39f7d0..de32f4b 100644
--- a/public/assets/js/workspace.js
+++ b/public/assets/js/workspace.js
@@ -689,7 +689,13 @@
 
   function routeFromHash() {
     const hash = location.hash.replace(/^#/, "");
-    if (hash.startsWith("team/")) {\n      const teamId = Number(hash.split("/")[1]);\n      if (teamById(teamId)) openTeam(teamId);\n      else navigate("teams", false);\n      return;\n    }\n    if (hash.startsWith("project/")) {
+    if (hash.startsWith("team/")) {
+      const teamId = Number(hash.split("/")[1]);
+      if (teamById(teamId)) openTeam(teamId);
+      else navigate("teams", false);
+      return;
+    }
+    if (hash.startsWith("project/")) {
       const id = Number(hash.split("/")[1]);
       const project = projectById(id);
       if (project) openProject(project, false);
diff --git a/public/design-system.html b/public/design-system.html
deleted file mode 100644
index 84ba265..0000000
--- a/public/design-system.html
+++ /dev/null
@@ -1,324 +0,0 @@
-<!doctype html>
-<html lang="en" dir="ltr" data-theme="light">
-<head>
-  <!-- Declare the document encoding and viewport before loading the stylesheet. -->
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <meta name="color-scheme" content="light dark">
-  <meta name="description" content="TeamCode Hub design system reference and component preview.">
-  <meta name="theme-color" content="#ffffff">
-  <title>Design System — TeamCode Hub</title>
-  <!-- The design system uses the device's installed system font stack; no font download is required. -->
-  <link rel="stylesheet" href="/assets/css/app.css?v=0.2.1-dev">
-  <link rel="stylesheet" href="/assets/css/design-system-demo.css?v=0.2.0-dev">
-  <!-- Load interactions separately so styles remain usable without JavaScript. -->
-  <script src="/assets/js/ui.js?v=0.2.0-dev" defer></script>
-  <script src="/assets/js/design-system-demo.js?v=0.2.1-dev" defer></script>
-</head>
-<body>
-  <!-- Keyboard users can bypass repeated navigation and jump directly to the page content. -->
-  <a class="skip-link" href="#main-content">Skip to content</a>
-
-  <!-- A compact public header doubles as a real example of the shared navigation styles. -->
-  <header class="site-header">
-    <div class="wrap site-header__inner">
-      <a class="brand" href="/" aria-label="TeamCode Hub home">
-        <span class="brand__mark" aria-hidden="true">T</span>
-        <span>TeamCode Hub</span>
-      </a>
-      <nav class="navbar__links mobile-hide" aria-label="Primary navigation">
-        <a href="#foundations" aria-current="page">Foundations</a>
-        <a href="#components">Components</a>
-        <a href="#patterns">Patterns</a>
-      </nav>
-      <div class="navbar__end">
-        <button class="btn btn-outline btn-sm" type="button" data-theme-toggle aria-label="Switch to dark theme" aria-pressed="false">Toggle theme</button>
-        <a class="btn btn-primary btn-sm" href="#components">Explore UI</a>
-      </div>
-    </div>
-  </header>
-
-  <main id="main-content" class="wrap page-main">
-    <!-- The intro documents the intent and constraints of this design-system baseline. -->
-    <section class="page-header" aria-labelledby="page-title">
-      <div class="page-header__copy">
-        <p class="eyebrow mb-3">Interface foundation · Version 0.2.0-dev</p>
-        <h1 class="page-title" id="page-title">A calm, consistent interface.</h1>
-        <p class="page-description">A practical, accessible design system for TeamCode Hub. Neutral surfaces, clear hierarchy, predictable controls, and responsive layouts — without external font downloads or frontend dependencies.</p>
-        <div class="cluster mt-6">
-          <a class="btn btn-primary" href="#components">Browse components</a>
-          <a class="btn btn-outline" href="#foundations">View foundations</a>
-        </div>
-      </div>
-      <div class="card card-pad demo-principles" aria-label="Design principles">
-        <p class="eyebrow">Principles</p>
-        <div class="list mt-3">
-          <div class="list-item"><span class="badge badge-solid">01</span><div class="list-item__main"><p class="list-item__title">Clarity first</p><p class="list-item__desc">Content before decoration.</p></div></div>
-          <div class="list-item"><span class="badge badge-solid">02</span><div class="list-item__main"><p class="list-item__title">Accessible by default</p><p class="list-item__desc">Keyboard and screen-reader support.</p></div></div>
-          <div class="list-item"><span class="badge badge-solid">03</span><div class="list-item__main"><p class="list-item__title">No runtime dependencies</p><p class="list-item__desc">System fonts and local assets only.</p></div></div>
-        </div>
-      </div>
-    </section>
-
-    <!-- Foundations show the shared tokens before demonstrating components built from them. -->
-    <section id="foundations" class="section" aria-labelledby="foundations-title">
-      <div class="section-heading">
-        <div><p class="eyebrow">01 / Foundations</p><h2 class="section-title mt-2" id="foundations-title">Color system</h2></div>
-        <p class="section-hint">Neutral base · Semantic status colors</p>
-      </div>
-      <div class="grid grid-4">
-        <article class="card"><div class="demo-swatch demo-swatch-primary" aria-hidden="true"></div><div class="card-pad"><p class="t-strong">Primary</p><p class="t-caption">#0A0A0A</p></div></article>
-        <article class="card"><div class="demo-swatch demo-swatch-muted" aria-hidden="true"></div><div class="card-pad"><p class="t-strong">Muted surface</p><p class="t-caption">#F4F4F5</p></div></article>
-        <article class="card"><div class="demo-swatch demo-swatch-success" aria-hidden="true"></div><div class="card-pad"><p class="t-strong">Success</p><p class="t-caption">#15803D</p></div></article>
-        <article class="card"><div class="demo-swatch demo-swatch-danger" aria-hidden="true"></div><div class="card-pad"><p class="t-strong">Danger</p><p class="t-caption">#B91C1C</p></div></article>
-      </div>
-
-      <div class="section-heading mt-8">
-        <div><p class="eyebrow">Type scale</p><h2 class="section-title mt-2">System typography</h2></div>
-        <p class="section-hint">No external font request</p>
-      </div>
-      <div class="card card-pad stack">
-        <div><p class="eyebrow">Display / 40px</p><h2 class="demo-type-display">Build better together.</h2></div>
-        <div class="divider"></div>
-        <div><p class="eyebrow">Heading / 24px</p><h3 class="demo-type-heading">Project activity</h3></div>
-        <div class="divider"></div>
-        <div><p class="eyebrow">Body / 15px</p><p class="t-soft">Keep interface copy concise and actionable. Use spacing and contrast to establish hierarchy instead of adding unnecessary visual effects.</p></div>
-        <div class="divider"></div>
-        <div><p class="eyebrow">Caption / 12px</p><p class="t-muted t-small">Updated a few moments ago · All times shown in UTC</p></div>
-      </div>
-    </section>
-
-    <!-- Component previews are intentionally static unless an interaction is explicitly demonstrated. -->
-    <section id="components" class="section" aria-labelledby="components-title">
-      <div class="section-heading">
-        <div><p class="eyebrow">02 / Components</p><h2 class="section-title mt-2" id="components-title">Actions and states</h2></div>
-        <p class="section-hint">Consistent sizing and focus behavior</p>
-      </div>
-
-      <div class="card card-pad stack-lg">
-        <div>
-          <p class="label mb-3">Button variants</p>
-          <div class="cluster">
-            <button class="btn btn-primary" type="button">Create project</button>
-            <button class="btn btn-outline" type="button">Secondary</button>
-            <button class="btn btn-subtle" type="button">Subtle</button>
-            <button class="btn btn-ghost" type="button">Ghost</button>
-            <button class="btn btn-danger" type="button">Delete</button>
-            <button class="btn btn-outline" type="button" disabled>Disabled</button>
-          </div>
-        </div>
-        <div>
-          <p class="label mb-3">Status badges</p>
-          <div class="cluster">
-            <span class="badge badge-solid">Default</span><span class="badge badge-soft">Draft</span>
-            <span class="badge badge-success">Completed</span><span class="badge badge-warning">Pending</span>
-            <span class="badge badge-danger">Blocked</span><span class="badge badge-info">In review</span>
-          </div>
-        </div>
-        <div class="grid grid-2">
-          <div class="field"><label class="label" for="demo-name">Project name <span class="required-mark" aria-hidden="true">*</span></label><input class="input" id="demo-name" name="demo-name" placeholder="e.g. API gateway" required><span class="help">Choose a short, recognizable name.</span></div>
-          <div class="field"><label class="label" for="demo-status">Project status</label><select class="select" id="demo-status"><option>In progress</option><option>Planned</option><option>Completed</option></select><span class="help">Status can be changed later.</span></div>
-          <div class="field"><label class="label" for="demo-description">Description</label><textarea class="textarea" id="demo-description" placeholder="What is this project for?"></textarea></div>
-          <div class="stack">
-            <p class="label">Preferences</p>
-            <label class="check"><input type="checkbox" checked><span class="check__box" aria-hidden="true"></span><span>Send activity notifications</span></label>
-            <label class="radio"><input type="radio" name="demo-access" checked><span class="radio__box" aria-hidden="true"></span><span>Member access</span></label>
-            <label class="radio"><input type="radio" name="demo-access"><span class="radio__box" aria-hidden="true"></span><span>Read-only access</span></label>
-            <label class="switch"><input type="checkbox" checked><span class="switch__track" aria-hidden="true"></span><span>Enable project updates</span></label>
-          </div>
-        </div>
-      </div>
-
-      <div class="section-heading mt-8">
-        <div><p class="eyebrow">Feedback</p><h2 class="section-title mt-2">Alerts and notifications</h2></div>
-        <p class="section-hint">Use the tone that matches the situation</p>
-      </div>
-      <div class="stack">
-        <div class="alert alert-success" role="status"><span class="alert__icon" aria-hidden="true">✓</span><div class="alert__content"><p class="alert__title">Changes saved</p><p class="alert__text">Your project settings have been updated.</p></div></div>
-        <div class="alert alert-warning" role="status"><span class="alert__icon" aria-hidden="true">!</span><div class="alert__content"><p class="alert__title">Review required</p><p class="alert__text">Two project members are waiting for approval.</p></div></div>
-        <div class="alert alert-danger" role="alert"><span class="alert__icon" aria-hidden="true">×</span><div class="alert__content"><p class="alert__title">Action could not be completed</p><p class="alert__text">Check your access and try again.</p></div></div>
-        <div class="cluster">
-          <button class="btn btn-primary" type="button" id="show-toast">Show toast notification</button>
-          <button class="btn btn-outline" type="button" data-modal-open="example-modal">Open modal</button>
-          <div class="dropdown">
-            <button class="btn btn-outline" type="button" data-dropdown-toggle aria-controls="example-menu" aria-expanded="false">More actions <span aria-hidden="true">⌄</span></button>
-            <div class="dropdown-menu" id="example-menu" hidden>
-              <button class="menu-item" type="button">Edit details</button>
-              <button class="menu-item" type="button">Copy project link</button>
-              <div class="divider demo-divider"></div>
-              <button class="menu-item menu-item-danger" type="button">Archive project</button>
-            </div>
-          </div>
-        </div>
-      </div>
-    </section>
-
-    <!-- These examples establish shared patterns for dashboard and project pages. -->
-    <section id="patterns" class="section" aria-labelledby="patterns-title">
-      <div class="section-heading">
-        <div><p class="eyebrow">03 / Patterns</p><h2 class="section-title mt-2" id="patterns-title">Dashboard building blocks</h2></div>
-        <p class="section-hint">Responsive and content-first</p>
-      </div>
-      <div class="grid grid-3">
-        <article class="stat"><p class="stat__label">Active projects</p><p class="stat__value">12</p><p class="stat__meta"><span class="t-success">+2</span> since last month</p></article>
-        <article class="stat"><p class="stat__label">Open tasks</p><p class="stat__value">38</p><p class="stat__meta">Across 4 teams</p></article>
-        <article class="stat"><p class="stat__label">Pending reviews</p><p class="stat__value">04</p><p class="stat__meta">Requires your attention</p></article>
-      </div>
-
-      <div class="card mt-6">
-        <div class="card-head"><div><h3>Recent activity</h3><p class="card-head__sub">A compact table pattern for project updates</p></div><button class="btn btn-outline btn-sm" type="button">View all</button></div>
-        <div class="table-wrap demo-table-wrap">
-          <table class="tbl">
-            <thead><tr><th scope="col">Project</th><th scope="col">Activity</th><th scope="col">Status</th><th scope="col">Updated</th></tr></thead>
-            <tbody>
-              <tr><td><span class="t-strong">Core API</span></td><td>Task completed</td><td><span class="badge badge-success">Completed</span></td><td>5 min ago</td></tr>
-              <tr><td><span class="t-strong">Web client</span></td><td>Member invited</td><td><span class="badge badge-warning">Pending</span></td><td>28 min ago</td></tr>
-              <tr><td><span class="t-strong">Documentation</span></td><td>Project updated</td><td><span class="badge badge-info">In review</span></td><td>1 hour ago</td></tr>
-            </tbody>
-          </table>
-        </div>
-        <div class="card-foot"><span class="t-muted t-small">Showing 3 of 12 activities</span><span class="t-muted t-small demo-foot-note">Demo content only</span></div>
-      </div>
-
-      <div class="grid grid-2 mt-6">
-        <article class="card card-pad">
-          <div class="split"><div><p class="t-muted t-small">Release readiness</p><p class="stat__value mt-2">72%</p></div><span class="badge badge-info">In progress</span></div>
-          <div class="progress mt-4" data-progress="72"><span></span></div>
-          <p class="help mt-3">Progress bars expose their value to assistive technology.</p>
-        </article>
-        <article class="empty">
-          <div class="empty__icon" aria-hidden="true">＋</div>
-          <h3 class="empty__title">No pinned projects yet</h3>
-          <p class="empty__text">Pin a project to make it easier to find from your dashboard.</p>
-          <button class="btn btn-primary btn-sm" type="button" id="empty-action">Browse projects</button>
-        </article>
-      </div>
-
-      <div class="card mt-6" data-tabs-scope>
-        <div class="card-head"><div><h3>Tabbed content</h3><p class="card-head__sub">Keyboard navigation with arrow keys, Home, and End</p></div></div>
-        <div class="card-body">
-          <div class="tabs" data-tabs role="tablist" aria-label="Example project details">
-            <button class="tab" id="tab-overview" type="button" role="tab" data-tab="overview" aria-controls="panel-overview" aria-selected="true">Overview</button>
-            <button class="tab" id="tab-members" type="button" role="tab" data-tab="members" aria-controls="panel-members" aria-selected="false">Members</button>
-            <button class="tab" id="tab-settings" type="button" role="tab" data-tab="settings" aria-controls="panel-settings" aria-selected="false">Settings</button>
-          </div>
-          <section class="demo-tab-panel" id="panel-overview" role="tabpanel" aria-labelledby="tab-overview" data-tab-panel="overview"><h4 class="t-strong">Project overview</h4><p class="t-soft mt-2">Summarize the goal, current status, and next milestone here.</p></section>
-          <section class="demo-tab-panel" id="panel-members" role="tabpanel" aria-labelledby="tab-members" data-tab-panel="members" hidden><h4 class="t-strong">Project members</h4><p class="t-soft mt-2">List approved members and their effective access levels here.</p></section>
-          <section class="demo-tab-panel" id="panel-settings" role="tabpanel" aria-labelledby="tab-settings" data-tab-panel="settings" hidden><h4 class="t-strong">Project settings</h4><p class="t-soft mt-2">Keep configuration actions behind server-side permission checks.</p></section>
-        </div>
-      </div>
-      <!-- Extended component patterns make the design tokens useful beyond the initial dashboard cards. -->
-      <div class="grid grid-2 mt-6">
-        <article class="card card-pad">
-          <p class="eyebrow">Input patterns</p>
-          <h3 class="h4 mt-2">Upload and range</h3>
-          <label class="dropzone mt-4" for="demo-upload">
-            <span class="ic" aria-hidden="true">↑</span>
-            <b>Choose a file to preview the upload area</b>
-            <span>Demo only · No file is uploaded or transmitted</span>
-            <input class="sr-only" id="demo-upload" type="file" aria-describedby="demo-upload-help">
-          </label>
-          <p class="help mt-2" id="demo-upload-help">The file input is local to this showcase and has no upload handler.</p>
-          <div class="field mt-4">
-            <label class="label" for="demo-range">Preview density</label>
-            <input id="demo-range" type="range" min="1" max="5" value="3">
-            <p class="help">Native keyboard-operable range control with shared styling.</p>
-          </div>
-        </article>
-        <article class="card card-pad">
-          <p class="eyebrow">People and status</p>
-          <h3 class="h4 mt-2">Avatars and chips</h3>
-          <div class="row mt-4">
-            <span class="avatar-wrap"><span class="avatar">AL</span><span class="status" role="img" aria-label="Online"></span></span>
-            <span class="avatar-wrap"><span class="avatar dark">MK</span><span class="status off" role="img" aria-label="Offline"></span></span>
-            <span class="avatar lg">JR</span>
-          </div>
-          <div class="row mt-4">
-            <span class="chip">API team <button class="x" type="button" aria-label="Remove API team chip">×</button></span>
-            <span class="chip active">Design review <button class="x" type="button" aria-label="Remove Design review chip">×</button></span>
-          </div>
-          <label class="switch mt-4"><input type="checkbox" checked><span class="track" aria-hidden="true"></span><span>Enable project updates</span></label>
-        </article>
-      </div>
-
-      <div class="grid grid-2 mt-6">
-        <article class="card card-pad">
-          <p class="eyebrow">Disclosure</p>
-          <h3 class="h4 mt-2">Accessible accordion</h3>
-          <div class="acc mt-4">
-            <details open>
-              <summary>What belongs in a design token?</summary>
-              <div class="acc-body">A reusable decision such as color, spacing, type scale, radius, elevation, or motion belongs in a central token set.</div>
-            </details>
-            <details>
-              <summary>Do these styles download fonts?</summary>
-              <div class="acc-body">No. The font stack uses system fonts already available on the visitor's device.</div>
-            </details>
-          </div>
-        </article>
-        <article class="card card-pad">
-          <p class="eyebrow">Progress and workflow</p>
-          <h3 class="h4 mt-2">Status steps</h3>
-          <div class="steps mt-4" aria-label="Release workflow">
-            <div class="step done"><span class="dot" aria-hidden="true">✓</span><span class="txt">Plan</span></div>
-            <span class="step-line done" aria-hidden="true"></span>
-            <div class="step current" aria-current="step"><span class="dot">2</span><span class="txt">Build</span></div>
-            <span class="step-line" aria-hidden="true"></span>
-            <div class="step"><span class="dot">3</span><span class="txt">Ship</span></div>
-          </div>
-          <div class="progress-label mt-6"><span>Release readiness</span><strong>72%</strong></div>
-          <div class="progress thick" data-progress="72" role="progressbar" aria-label="Release readiness" aria-valuemin="0" aria-valuemax="100" aria-valuenow="72"><span></span></div>
-          <div class="row mt-4"><span class="badge badge-success">Healthy</span><span class="badge badge-warning">Review</span><span class="badge badge-danger">Blocked</span></div>
-        </article>
-      </div>
-
-      <div class="grid grid-2 mt-6">
-        <article class="card card-pad">
-          <p class="eyebrow">Pagination</p>
-          <h3 class="h4 mt-2">Bounded list navigation</h3>
-          <p class="small mt-2">Use pagination for large tables; prefer incremental cursors for live chat.</p>
-          <nav class="pager mt-4" aria-label="Example pagination">
-            <button type="button" disabled aria-label="Previous page">‹</button>
-            <button type="button" class="active" aria-current="page">1</button>
-            <button type="button">2</button>
-            <button type="button">3</button>
-            <span class="dots" aria-hidden="true">…</span>
-            <button type="button">8</button>
-            <button type="button" aria-label="Next page">›</button>
-          </nav>
-        </article>
-        <article class="card card-pad">
-          <p class="eyebrow">Content pattern</p>
-          <h3 class="h4 mt-2">Quote and code</h3>
-          <blockquote class="quote mt-4">
-            <p>Good interfaces make the next safe action obvious without hiding useful detail.</p>
-            <footer><b>Product principle</b> · Clarity before decoration</footer>
-          </blockquote>
-          <p class="small mt-4">Use <code class="code-inline">aria-live</code> for dynamic status messages that need to be announced.</p>
-        </article>
-      </div>
-    </section>
-  </main>
-
-  <!-- The overlay starts hidden and is opened by the UI controller. -->
-  <div class="modal-overlay" id="example-modal" role="presentation" hidden>
-    <section class="modal" role="dialog" aria-modal="true" aria-labelledby="example-modal-title" aria-describedby="example-modal-description">
-      <div class="modal-head"><div><h2 class="modal-title" id="example-modal-title">Create a project?</h2><p class="modal-description" id="example-modal-description">This is a visual interaction example. No project will be created.</p></div></div>
-      <div class="modal-body"><p class="t-soft">Dialogs should explain the consequence of an action and offer a clear way to cancel.</p></div>
-      <div class="modal-foot"><button class="btn btn-outline" type="button" data-modal-close>Cancel</button><button class="btn btn-primary" type="button" data-modal-close>Continue</button></div>
-    </section>
-  </div>
-
-  <!-- Toast messages are announced politely and populated through textContent. -->
-  <div class="toast-region" id="toast-region" aria-label="Notifications" aria-live="polite"></div>
-
-  <!-- Footer links are intentionally minimal; product navigation will grow with implemented pages. -->
-  <footer class="site-footer">
-    <div class="wrap site-footer__inner">
-      <span>© <span id="year">2026</span> TeamCode Hub</span>
-      <span>Design system · English interface · System fonts only</span>
-    </div>
-  </footer>
-
-</body>
-</html>
diff --git a/tests/deployment-workflow.php b/tests/deployment-workflow.php
new file mode 100644
index 0000000..aa291b3
--- /dev/null
+++ b/tests/deployment-workflow.php
@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * Deployment workflow contract tests. These checks protect the manual production
+ * gate and prevent unsafe defaults; they do not replace a staging deployment.
+ */
+
+$root = dirname(__DIR__);
+$workflowPath = $root . '/.github/workflows/deploy.yml';
+$workflow = is_file($workflowPath) ? file_get_contents($workflowPath) : false;
+
+if (!is_string($workflow)) {
+    throw new RuntimeException('FAIL: deployment workflow exists and is readable');
+}
+
+$checks = 0;
+$assert = static function (bool $condition, string $message) use (&$checks): void {
+    if (!$condition) {
+        throw new RuntimeException('FAIL: ' . $message);
+    }
+    $checks++;
+    echo "PASS: {$message}\n";
+};
+
+$assert(str_contains($workflow, 'workflow_dispatch:'), 'production deployment is manual-only');
+$assert(str_contains($workflow, "inputs.confirm_production == 'DEPLOY'"), 'deployment requires an explicit production confirmation');
+$assert(str_contains($workflow, "github.ref == 'refs/heads/main'"), 'production deployment only accepts the main branch');
+$assert(str_contains($workflow, 'environment: production'), 'deployment uses the protected production environment');
+$assert(str_contains($workflow, 'DEPLOY_KNOWN_HOSTS') && str_contains($workflow, 'StrictHostKeyChecking=yes'), 'SSH verifies a pinned host key');
+$assert(str_contains($workflow, 'test -d') && str_contains($workflow, 'test -w'), 'deployment checks that the destination exists and is writable');
+$assert(str_contains($workflow, 'DEPLOY_PATH must be an absolute path') && str_contains($workflow, 'DEPLOY_PATH is too broad'), 'deployment rejects unsafe destination paths');
+$assert(str_contains($workflow, 'rsync -az --checksum'), 'deployment uses incremental rsync transfer');
+$assert(!str_contains($workflow, '--delete'), 'deployment never deletes remote files by default');
+$assert(str_contains($workflow, 'if: always()') && str_contains($workflow, 'rm -f'), 'temporary SSH credentials are removed even after a failed deployment');
+$assert(!str_contains($workflow, 'bin/migrate.php') && !str_contains($workflow, 'bootstrap-admin.php'), 'deployment never runs database migrations or administrator bootstrap automatically');
+
+echo "{$checks} deployment workflow assertions passed.\n";
diff --git a/tests/design-system.php b/tests/design-system.php
index 9fecfd5..95f5a07 100644
--- a/tests/design-system.php
+++ b/tests/design-system.php
@@ -40,17 +40,17 @@
 $patterns = $read('public/assets/css/patterns.css');
 $utilities = $read('public/assets/css/utilities.css');
 $uiScript = $read('public/assets/js/ui.js');
-$demoScript = $read('public/assets/js/design-system-demo.js');
-$demoPage = $read('public/design-system.html');
-$demoCss = $read('public/assets/css/design-system-demo.css');
+$workspaceHtml = $read('public/app.html');
+$workspaceCss = $read('public/assets/css/workspace.css');
+$workspaceScript = $read('public/assets/js/workspace.js');
 
 $expectedImports = [
-    '@import url("./tokens.css?v=0.2.1-dev");',
-    '@import url("./base.css?v=0.2.1-dev");',
-    '@import url("./layout.css?v=0.2.1-dev");',
-    '@import url("./components.css?v=0.2.1-dev");',
-    '@import url("./patterns.css?v=0.2.1-dev");',
-    '@import url("./utilities.css?v=0.2.1-dev");',
+    '@import url("./tokens.css?v=0.2.2-dev");',
+    '@import url("./base.css?v=0.2.2-dev");',
+    '@import url("./layout.css?v=0.2.2-dev");',
+    '@import url("./components.css?v=0.2.2-dev");',
+    '@import url("./patterns.css?v=0.2.2-dev");',
+    '@import url("./utilities.css?v=0.2.2-dev");',
 ];
 $lastPosition = -1;
 foreach ($expectedImports as $import) {
@@ -60,7 +60,7 @@
 }
 
 $assert(str_contains($tokens, '--font-sans:') && str_contains($tokens, 'system-ui'), 'typography uses an installed system-font fallback stack');
-$assert(!preg_match('/fonts\.googleapis\.com|fonts\.gstatic\.com|use\.typekit\.net/i', $entry . $tokens . $base . $layout . $components . $patterns . $utilities . $demoCss), 'design-system CSS does not require a hosted font service');
+$assert(!preg_match('/fonts\.googleapis\.com|fonts\.gstatic\.com|use\.typekit\.net/i', $entry . $tokens . $base . $layout . $components . $patterns . $utilities), 'design-system CSS does not require a hosted font service');
 $assert(str_contains($tokens, 'data-theme="dark"'), 'an explicit dark theme token set is available');
 $assert(str_contains($base, 'prefers-reduced-motion: reduce'), 'base styles respect reduced-motion preferences');
 $assert(str_contains($base, ':focus-visible'), 'keyboard focus indicators are defined');
@@ -75,16 +75,36 @@
 $assert(str_contains($patterns, '.btn-xs') && str_contains($patterns, '.check .box') && str_contains($patterns, '.tabs.pill'), 'legacy button, form-state, and pill-tab aliases are available');
 $assert(str_contains($uiScript, 'textContent = String(message'), 'toast content is inserted as text rather than interpreted HTML');
 $assert(str_contains($uiScript, 'data-modal-open') && str_contains($uiScript, 'data-dropdown-toggle'), 'interaction controller includes modal and dropdown behavior');
-$assert(str_contains($demoPage, '<html lang="en" dir="ltr"'), 'showcase document declares English left-to-right content');
-$assert(str_contains($demoPage, '/assets/css/app.css') && str_contains($demoPage, '/assets/js/ui.js'), 'showcase loads shared assets by external URLs');
-$assert(!preg_match('/\sstyle\s*=/i', $demoPage), 'showcase HTML contains no inline style attributes');
-$assert(!preg_match('/<script\s*>/i', $demoPage), 'showcase HTML contains no inline JavaScript blocks');
-$assert(str_contains($demoPage, '/assets/css/design-system-demo.css') && str_contains($demoPage, '/assets/js/design-system-demo.js'), 'showcase-specific behavior and styles are external assets');
-$assert(str_contains($demoScript, 'window.TCHUI.notify'), 'showcase buttons use the shared notification API');
+$assert(str_contains($workspaceHtml, '<html lang="en" dir="ltr"'), 'product shell declares English left-to-right content');
+$assert(str_contains($workspaceHtml, '/assets/css/app.css?v=0.2.2-dev') && str_contains($workspaceHtml, '/assets/css/workspace.css?v=0.2.8-dev'), 'product shell links shared and workspace stylesheets with refreshed cache keys');
+$assert(str_contains($workspaceHtml, '/assets/js/ui.js?v=0.2.1-dev') && str_contains($workspaceHtml, '/assets/js/workspace.js?v=0.2.19-dev'), 'product shell links both external controllers with refreshed cache keys');
+$assert(!preg_match('/\\sstyle\\s*=/i', $workspaceHtml) && !preg_match('/<style(?:\\s|>)/i', $workspaceHtml), 'product shell contains no inline styles');
+$assert(!preg_match('/<script(?![^>]*\\bsrc=)[^>]*>/i', $workspaceHtml), 'product shell contains no inline JavaScript');
+$assert(str_contains($workspaceCss, '.app-shell') && str_contains($workspaceCss, '.project-files-layout') && str_contains($workspaceCss, '.chat-messages'), 'product stylesheet covers actual workspace, source files, and chat views');
+$assert(str_contains($workspaceScript, '/api/teams') && str_contains($workspaceScript, '/api/projects/') && str_contains($workspaceScript, 'credentials: "same-origin"'), 'workspace controller connects team/project APIs with same-origin requests');
+$assert(str_contains($workspaceScript, '"X-Csrf-Token"') && str_contains($workspaceScript, 'function renderTeams'), 'workspace mutations retain CSRF protection and team rendering');
 
 $assert(str_contains($tokens, '--text-muted: var(--g500);'), 'muted text uses a readable neutral on light surfaces');
 $assert(str_contains($tokens, '--text-muted: #a1a1aa;'), 'muted text remains legible against dark surfaces');
 
+$assert(str_contains($tokens, '--text-primary: var(--text);'), 'workspace primary text alias resolves to the active theme text token');
+$assert(str_contains($tokens, '--surface-hover: var(--g100);') && str_contains($tokens, '--surface-subtle: var(--surface-muted);'), 'workspace hover and selected surfaces resolve from the active neutral palette');
+$assert(str_contains($tokens, '--surface-code: var(--surface-raised);') && str_contains($tokens, '--radius-md: var(--r-lg);'), 'source editor surface and legacy radius aliases are defined centrally');
+
+/* Catch undefined CSS custom properties across the real production stylesheets. */
+$allCss = implode("\n", [$entry, $tokens, $base, $layout, $components, $patterns, $utilities, $workspaceCss]);
+preg_match_all('/(--[a-zA-Z0-9_-]+)\\s*:/', $allCss, $definedMatches);
+preg_match_all('/var\\(\\s*(--[a-zA-Z0-9_-]+)/', $allCss, $referencedMatches);
+$definedTokens = array_fill_keys($definedMatches[1], true);
+/* --progress is intentionally supplied on individual progress indicators, not as a global token. */
+$dynamicTokens = ['--progress' => true];
+$undefinedTokens = array_values(array_diff(
+    array_unique($referencedMatches[1]),
+    array_keys($definedTokens),
+    array_keys($dynamicTokens)
+));
+$assert($undefinedTokens === [], 'production CSS has no undefined custom properties' . ($undefinedTokens ? ': ' . implode(', ', $undefinedTokens) : ''));
+
 /* Verify every stylesheet imported by the entry point exists on disk. */
 preg_match_all('/@import\s+url\("([^"]+)"\)/', $entry, $importMatches);
 foreach ($importMatches[1] as $importUrl) {
@@ -92,14 +112,14 @@
     $assert(is_file($root . '/' . $relativePath), 'entry stylesheet import resolves: ' . $relativePath);
 }
 
-/* Verify the showcase references existing local CSS and JavaScript assets. */
-preg_match_all('/(?:href|src)="(\/assets\/[^"]+)"/', $demoPage, $assetMatches);
+/* Verify the product shell references existing local CSS and JavaScript assets. */
+preg_match_all('/(?:href|src)="(\/assets\/[^"]+)"/', $workspaceHtml, $assetMatches);
 foreach ($assetMatches[1] as $assetUrl) {
     $relativePath = 'public' . strtok($assetUrl, '?');
-    $assert(is_file($root . '/' . $relativePath), 'showcase asset URL resolves: ' . $relativePath);
+    $assert(is_file($root . '/' . $relativePath), 'product asset URL resolves: ' . $relativePath);
 }
 
-$assert(str_contains($demoScript, 'demo-upload') && str_contains($demoScript, 'selectPage'), 'showcase upload preview and pagination examples are interactive');
-$assert(str_contains($demoScript, 'chip was removed locally'), 'showcase removable chips operate locally without a server request');
+$assert(str_contains($workspaceHtml, 'id="page-content"') && str_contains($workspaceHtml, 'id="application"'), 'workspace shell contains the actual app mount points');
+$assert(str_contains($workspaceScript, 'async function boot()') && str_contains($workspaceScript, 'window.TCHWorkspace'), 'workspace controller initializes and exposes its guarded controller');
 
 echo "\n{$assertions} design-system assertions passed.\n";
diff --git a/tests/workspace-ui.php b/tests/workspace-ui.php
index 859b69c..2a1e42c 100644
--- a/tests/workspace-ui.php
+++ b/tests/workspace-ui.php
@@ -56,6 +56,7 @@
 $projectFileMigration = $read('database/migrations/20261018000400_create_project_code_files.php');
 $response = $read('app/Core/Response.php');
 $workflow = $read('.github/workflows/ci.yml');
+$rootHtaccess = $read('.htaccess');
 $htaccess = $read('public/.htaccess');
 
 $assert(str_contains($html, '<html lang="en" dir="ltr"'), 'workspace declares English left-to-right document semantics');
@@ -70,6 +71,9 @@
 $assert(str_contains($html, 'data-theme="light"') && str_contains($read('public/assets/js/ui.js'), 'root.dataset.theme = next'), 'workspace theme switcher updates the shared light/dark design tokens');
 
 $assert(str_contains($html, 'id="login-form"') && str_contains($html, 'id="application"'), 'login and authenticated application shells are present');
+
+$assert(str_contains($html, 'class="workspace-switcher" type="button" data-page="teams"') && str_contains($html, 'id="sidebar-team-count"'), 'sidebar team shortcut navigates to the real teams view and reflects the live team count');
+$assert(!str_contains($html, 'Workspace guide') && !str_contains($css, '.sidebar-help'), 'non-functional decorative workspace guide markup and styles are absent');
 $assert(str_contains($html, 'id="register-form"') && str_contains($html, 'id="verification-resend-form"') && str_contains($html, 'id="verify-screen"'), 'public registration, resend, and explicit email verification forms are present');
 $assert(str_contains($js, 'registerAccount') && str_contains($js, 'resendVerification') && str_contains($js, 'state.verificationToken'), 'authentication UI connects registration, resend, and token confirmation flows');
 $assert(str_contains($bootstrap, "/api/auth/register") && str_contains($bootstrap, "/api/auth/verification/resend") && str_contains($bootstrap, "/api/auth/verify-email"), 'public account lifecycle endpoints are registered');
@@ -81,7 +85,7 @@
 $assert(str_contains($html, 'data-page="github"') && str_contains($js, '/api/github/activity'), 'GitHub activity page is connected to its authenticated endpoint');
 $assert(str_contains($bootstrap, "'/api/projects/{projectId}/github'") && str_contains($bootstrap, 'project-github.controller'), 'project GitHub endpoints are registered through a dedicated controller');
 $assert(str_contains($bootstrap, "'/api/projects/{projectId}/files'") && str_contains($bootstrap, "'/api/projects/{projectId}/files/{fileId}'") && str_contains($bootstrap, "'/api/projects/{projectId}/files/{fileId}/edit'") && str_contains($bootstrap, "'/api/projects/{projectId}/files/{fileId}/history'") && str_contains($bootstrap, "'/api/projects/{projectId}/files/{fileId}/restore'"), 'project file listing, detail, edit, history, and restore routes are registered');
-$assert(str_contains($projectFileMigration, 'CREATE TABLE project_files') && str_contains($projectFileMigration, 'CREATE TABLE project_file_versions'), 'project file migration creates both private storage tables');
+$assert(str_contains($projectFileMigration, 'CREATE TABLE IF NOT EXISTS project_files') && str_contains($projectFileMigration, 'CREATE TABLE IF NOT EXISTS project_file_versions'), 'project file migration creates both private storage tables');
 $assert(str_contains($js, 'renderProjectFiles') && str_contains($js, 'createProjectFileModal') && str_contains($js, 'saveProjectFile') && str_contains($js, 'showProjectFileHistory'), 'project workspace connects file browsing, editing, saving, and history');
 $assert(str_contains($js, 'confirmDiscardProjectFileChanges') && str_contains($js, 'expected_version: Number(expectedVersion)'), 'file editor warns before discarding unsaved content and uses optimistic concurrency');
 $assert(str_contains($projectFileRepository, 'MAX_FILE_BYTES = 262144') && str_contains($projectFileRepository, 'MAX_PROJECT_BYTES = 10485760') && str_contains($projectFileRepository, 'MAX_PROJECT_HISTORY_BYTES = 20971520'), 'project file storage enforces per-file, project, and revision quotas');
@@ -104,6 +108,16 @@
 $assert(str_contains($css, '.admin-user-actions') && str_contains($css, '.admin-audit-event') && str_contains($css, '.admin-audit-modal'), 'account actions and audit history have responsive styles');
 $assert(str_contains($css, '.github-feed') && str_contains($css, '.github-summary'), 'GitHub activity page has dedicated responsive presentation styles');
 $assert(str_contains($html, 'id="workspace-main"') && str_contains($html, 'class="skip-link"'), 'workspace provides a skip link and main landmark');
+
+$assert(str_contains($rootHtaccess, 'RewriteRule ^assets/(.*)$ public/assets/$1 [END,NC]'), 'repository-root hosting maps requested asset URLs into the public asset directory');
+$assert(str_contains($rootHtaccess, 'AddType text/css .css') && str_contains($rootHtaccess, 'AddType application/javascript .js'), 'root-hosted assets have explicit CSS and JavaScript MIME types');
+$assert(str_contains($rootHtaccess, 'Cache-Control "public, max-age=31536000, immutable"'), 'root-hosted versioned assets use immutable caching');
+$assert(str_contains($rootHtaccess, '<FilesMatch "\\.(?:css|js)$">') && str_contains($htaccess, '<FilesMatch "\\.(?:css|js)$">'), 'both document-root modes use a correct extension match for versioned static assets');
+$assert(str_contains($rootHtaccess, 'RewriteRule ^public(?:/|$) - [F,L,NC]') && str_contains($rootHtaccess, 'RewriteRule ^ public/index.php [QSA,END]'), 'repository-root hosting protects source files and routes app requests through the public front controller');
+$assert(str_contains($htaccess, 'AddType text/css .css') && str_contains($htaccess, 'AddType application/javascript .js'), 'public hosting declares correct external CSS and JavaScript MIME types');
+$assert(str_contains($htaccess, 'Cache-Control "public, max-age=31536000, immutable"'), 'versioned public assets have an explicit immutable cache policy');
+$assert(str_contains($workflow, 'php tests/workspace-ui.php') && str_contains($workflow, 'node --check public/assets/js/workspace.js'), 'CI runs workspace UI contracts and parses the production JavaScript controller');
+$assert(str_contains($workflow, 'cancel-in-progress: true') && str_contains($workflow, 'php-checks-${{ github.workflow }}-${{ github.ref }}'), 'CI cancels superseded checks for each branch instead of building an unbounded queue');
 $assert(str_contains($html, '/assets/css/workspace.css?v='), 'product stylesheet is loaded as an external versioned asset');
 $assert(str_contains($html, '/assets/js/workspace.js?v='), 'product controller is loaded as an external versioned asset');
 $assert(!preg_match('/<style(?:\s|>)/i', $html), 'workspace HTML contains no inline style blocks');
@@ -131,7 +145,7 @@
 $assert(str_contains($js, '/api/dashboard') && str_contains($js, '/api/teams') && str_contains($js, '/api/projects/') && str_contains($js, '/api/notifications'), 'controller connects the existing dashboard, team, project, and notification APIs');
 $assert(str_contains($bootstrap, "/api/teams/{teamId}/edit") && str_contains($bootstrap, "/api/projects/{projectId}/edit"), 'team and project metadata update routes are registered');
 $workspaceController = $read('app/Http/WorkspaceController.php');
-$assert(str_contains($bootstrap, "->updateTeam(\\$request, \\$params)") && str_contains($bootstrap, "->updateProject(\\$request, \\$params)"), 'settings routes call the existing update handlers');
+$assert(str_contains($bootstrap, '->updateTeam($request, $params)') && str_contains($bootstrap, '->updateProject($request, $params)'), 'settings routes call the existing update handlers');
 $assert(str_contains($workspaceController, 'public function updateTeam(') && str_contains($workspaceController, 'public function updateProject('), 'registered settings handlers enforce validation and permissions');
 $assert(!str_contains($workspaceController, 'public function renameTeam(') && !str_contains($workspaceController, 'public function editProject('), 'unused duplicate settings handlers stay removed');
 $assert(str_contains($workspaceController, 'updateNameForOwner') && str_contains($workspaceController, 'updateMetadataForTeamManager'), 'settings controllers reuse transactional repository authorization boundaries');