diff --git a/backendServer/backend/settings/prod.py b/backendServer/backend/settings/prod.py
index 2f7de60..113b167 100644
--- a/backendServer/backend/settings/prod.py
+++ b/backendServer/backend/settings/prod.py
@@ -11,6 +11,13 @@
 # sets instead (proxy_set_header X-Real-IP $remote_addr;).
 RATELIMIT_IP_META_KEY = "HTTP_X_REAL_IP"
 
+# nginx terminates TLS and proxies to gunicorn over a Unix socket, so Django never
+# sees an HTTPS connection directly — request.is_secure() (and anything built on it,
+# like build_absolute_uri()) would compute False for every request, producing
+# http:// URLs on an https:// site. Trust the header nginx always sets instead
+# (proxy_set_header X-Forwarded-Proto $scheme; on every server block).
+SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+
 SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]  # crash at startup if missing
 
 ALLOWED_HOSTS = os.environ["DJANGO_ALLOWED_HOSTS"].split(",")
diff --git a/backendServer/broadcast/adapters/_helpers.py b/backendServer/broadcast/adapters/_helpers.py
index e14195d..7fc562c 100644
--- a/backendServer/broadcast/adapters/_helpers.py
+++ b/backendServer/broadcast/adapters/_helpers.py
@@ -110,6 +110,41 @@ def full_address(ev) -> str:
     return f"{ev.address_line1}, {mid}{ev.state} {ev.zip}"
 
 
+_FREE_TEXT_RE = re.compile(r"\bfree\b", re.I)
+_NUMBER_RE = re.compile(r"\d+(?:\.\d+)?")
+
+
+def format_cost(is_free: bool, price: str) -> str:
+    """Normalize a free-text cost into the plain number destination forms expect.
+
+    Destination sites (Triangle Weekender, ABC11) want a bare number in their
+    Cost field, not the free-text the submitter typed on The Commons — a range
+    like "5-10" gets rejected or mis-rendered. This normalizes at the adapter
+    boundary only; the raw string on CanonicalEvent is never touched.
+
+    Rules (decided by the ticket owner, 46.5):
+    - `is_free` flag, or the word "free" anywhere in the text -> "0"
+    - a range ("5-10", "$5 - $10", "5–10" en dash) -> the low value, e.g. "5"
+    - a single value ("$12", "12") -> the bare number, "12"
+    - empty input -> "" (nothing to normalize; caller's required/optional
+      handling decides what happens next)
+    - non-numeric junk with no digits at all (e.g. "TBD", "call for pricing")
+      -> passed through unchanged. We never invent a number, and forwarding
+      the original text is safer than silently dropping it.
+    """
+    if is_free:
+        return "0"
+    text = (price or "").strip()
+    if not text:
+        return ""
+    if _FREE_TEXT_RE.search(text):
+        return "0"
+    match = _NUMBER_RE.search(text)
+    if not match:
+        return text
+    return match.group(0)
+
+
 def apply_specs(page, specs, ev, timeout_ms) -> list[str]:
     """Fill the Playwright-fillable specs; return descriptors of missing required.
 
diff --git a/backendServer/broadcast/adapters/abc11_community.py b/backendServer/broadcast/adapters/abc11_community.py
index e55e7a2..7c1b951 100644
--- a/backendServer/broadcast/adapters/abc11_community.py
+++ b/backendServer/broadcast/adapters/abc11_community.py
@@ -11,6 +11,15 @@
 Field ids (cfN) and the submit button (value="save") are verified against the
 captured dump. Category (react-select) and image (custom uploader) are
 best-effort; everything else maps from canonical fields.
+
+Image: the form has exactly one `input[type=file][accept="image/*"]`, behind a
+drag-and-drop skin at `.image-field-esf .image-dropzone` — a real file input,
+not a JS-only dropzone, so a programmatic file set works through the normal
+Playwright/extension path. Emitted only when `ev.image_url` is set (mirrors
+triangle_weekender's image spec). Uploading reveals an alt-text field on
+ABC11's form; `CanonicalEvent` has no alt-text field upstream, and per the
+"adapters never invent content" rule we do not synthesize one — that field is
+left for manual follow-up (see docs/broadcast.md's adapter rules).
 """
 
 from broadcast.adapters import _helpers as h
@@ -48,24 +57,27 @@ def _duration(ev):
 
 
 # Map our canonical category slugs to a search term to type into ABC11's
-# react-select Category box; the extension types it and picks the first option.
+# react-select Category box; the extension types it and picks whichever
+# rendered option is an exact (else prefix) match, per term. ABC11's
+# vocabulary is a fixed 17-term list (verified live 2026-08-03 — see suite
+# 46.1) with no "Music"/"Family"/etc. terms, so most of our slugs have no
+# defensible match — those are left unmapped rather than guessing (a wrong
+# category is worse than none; adapters never invent content).
 _CAT_MAP = {
-    "music": "Music",
-    "arts": "Arts",
-    "family-kids": "Family",
-    "food-drink": "Food",
-    "festival": "Festival",
-    "market": "Market",
-    "literary": "Literature",
-    "community": "Community",
-    "nightlife": "Nightlife",
-    "wellness": "Health",
-    "education": "Education",
-    "sports": "Sports",
-    "film": "Film",
-    "dance": "Dance",
-    "comedy": "Comedy",
-    "theatre": "Theater",
+    "music": "Theater / Concerts",
+    "dance": "Theater / Concerts",
+    "comedy": "Theater / Concerts",
+    "theatre": "Theater / Concerts",
+    "arts": "Art / Photography / Crafts",
+    "food-drink": "Food and Beverage / Farmer's Market",
+    "market": "Food and Beverage / Farmer's Market",
+    "festival": "Festivals / Parades",
+    "community": "Community Events / Volunteerism",
+    "education": "School / Education",
+    "sports": "Sports and Recreation",
+    # Unmapped — no defensible match in ABC11's vocabulary; left out so no
+    # category is sent rather than stretching to a nearest neighbour:
+    # family-kids, literary, nightlife, wellness, film.
 }
 
 
@@ -80,14 +92,20 @@ def _cat_terms(ev) -> str:
 
 # Declared once; consumed by the server-side fill loop (h.apply_specs) and the
 # manual-review recipe export. Date/time are best-effort (optional) as before.
-# NOTE: #eventStartDate-label is the field's <label>, not the input — the
-# content-script date handler must fall back to the label's associated input.
+# NOTE: #eventStartDate-label is NOT a <label> — the id just happens to end in
+# "-label". It's the Fluent UI (Office UI Fabric) datepicker's own text input
+# (role="combobox"), the only date input on the form; the selector is correct
+# as-is and needs no fallback. What it does need is the retry handled by the
+# content-script date handler (see fillInputVerified) — Trumba's widget
+# self-populates the field with a near-current default shortly after load
+# (see the ready_selector comment below), so a value written before that
+# default fires gets silently overwritten.
 _RECIPE_FIELDS = [
     RecipeField("#cf3", "text", lambda ev: ev.title, required=True, label="Event title"),
     RecipeField("#cf4", "textarea", lambda ev: ev.description, label="Event Details"),
     RecipeField("#cf5", "text", _location, label="Location"),
     RecipeField("#cf6", "text", lambda ev: ev.event_url, label="Web link"),
-    RecipeField("#cf33293", "text", lambda ev: "0" if ev.is_free else ev.price, label="Cost"),
+    RecipeField("#cf33293", "text", lambda ev: h.format_cost(ev.is_free, ev.price), label="Cost"),
     RecipeField("#cf33704", "text", lambda ev: ev.organizer_name, label="Contact Name"),
     RecipeField("#cf34384", "text", lambda ev: ev.contact_phone, label="Contact Phone"),
     RecipeField("#cf34385", "text", lambda ev: ev.contact_email, label="Contact Email"),
@@ -105,7 +123,8 @@ def _cat_terms(ev) -> str:
         "date",
         lambda ev: _date(ev.start_datetime),
         label="Start date",
-        hint="targets a label — fall back to its input",
+        hint="Trumba's own widget self-populates a default shortly after load; "
+        "the fill must re-read and re-apply if that default overwrites us",
     ),
     RecipeField(
         "#eventStartTime",
@@ -166,7 +185,20 @@ def recipe_field_specs(self, ev):
                     lambda ev, c=cats: c,
                     recipe_only=True,
                     label="Category",
-                    hint="type each term and pick the first option",
+                    hint="react-select — extension matches each term exactly (else by "
+                    "prefix) and reports any it can't find",
+                )
+            )
+        if ev.image_url:
+            specs.append(
+                RecipeField(
+                    ".image-field-esf input[type=file]",
+                    "file",
+                    lambda ev: ev.image_url,
+                    recipe_only=True,
+                    label="Event image",
+                    hint="auto-uploaded by the extension; reveals an alt-text field "
+                    "on ABC11's form that must be filled in manually",
                 )
             )
         return specs
@@ -198,6 +230,11 @@ def fill_and_submit(self, page, ev, ctx):
                 screenshot_path=h.take_screenshot(page, ctx, self.key),
             )
 
+        if ev.image_url:
+            local = h.download_image(ev.image_url, ctx.download_dir)
+            if local:
+                _try_fill_file(page, ".image-field-esf input[type=file]", local)
+
         if h.has_captcha(page):
             return TargetResult(
                 status="needs_manual",
@@ -226,3 +263,10 @@ def _login_wall(page) -> bool:
             return page.locator("input[type='password']").first.is_visible(timeout=500)
         except Exception:
             return False
+
+
+def _try_fill_file(page, selector: str, path: str) -> None:
+    try:
+        page.locator(selector).first.set_input_files(path, timeout=5000)
+    except Exception:
+        pass
diff --git a/backendServer/broadcast/adapters/triangle_weekender.py b/backendServer/broadcast/adapters/triangle_weekender.py
index 61a7ccf..d11943f 100644
--- a/backendServer/broadcast/adapters/triangle_weekender.py
+++ b/backendServer/broadcast/adapters/triangle_weekender.py
@@ -7,12 +7,13 @@
 - Venue and Organizer are select2 "Create or Find" widgets: we type the name,
   reuse an existing entry on a close string match, otherwise pick "Create".
   Detail inputs (address/email/…) only populate when we create a new entry.
-- Categories are a select2 AJAX dropdown (remote term search); the extension
-  only selects a term on an exact label match, so unrelated site categories
-  are never picked. The custom "County" checkboxes map from our locality
-  tags, so we set those. Tags are a free-form site vocabulary (not a
-  controlled list like categories) and can't be matched reliably, so we don't
-  attempt them.
+- Categories are a select2 "AJAX" dropdown, but the typed search term never
+  actually filters it — it always renders the full ~62-term vocabulary. The
+  extension matches against that full rendered list (exact, else prefix), so
+  unrelated site categories are still never picked. The custom "County"
+  checkboxes map from our locality tags, so we set those. Tags are a
+  free-form site vocabulary (not a controlled list like categories) and
+  can't be matched reliably, so we don't attempt them.
 - A newsletter popup is scheduled to appear after a delay and can cover the
   submit button; we dismiss it before submitting.
 - No captcha on this form.
@@ -29,20 +30,22 @@
 # Locality slugs that are county/region-level only — not useful as a city name.
 _REGION_ONLY_SLUGS = frozenset({"wake", "chatham", "triangle"})
 
-# Mapping from our canonical category slugs (routing.CATEGORIES) to the search
-# terms the Triangle Weekender's AJAX category dropdown understands. The
-# extension searches each term; unmatched terms are skipped silently.
+# Mapping from our canonical category slugs (routing.CATEGORIES) to search
+# terms drawn from Triangle Weekender's real ~62-term vocabulary (verified
+# live 2026-08-03 — see suite 46.1). A slug may map to multiple labels
+# (comma-joined by _wk_category_terms, split again by the extension); the
+# extension reports any term it can't match rather than skipping it silently.
 _WK_CATEGORY_MAP: dict[str, str] = {
-    "music": "Music",
+    "music": "Music & Concerts,Live Music",
     "arts": "Arts",
-    "family-kids": "Family",
+    "family-kids": "Kids & Family,Family Fun",
     "wellness": "Wellness",
-    "food-drink": "Food",
-    "festival": "Festival",
+    "food-drink": "Food & Drink",
+    "festival": "Festivals",
     "market": "Market",
-    "literary": "Literary",
-    "community": "Community",
-    "nightlife": "Nightlife",
+    "literary": "Books & Readings,Writing",
+    "community": "Gather,Volunteerism",
+    "nightlife": "Comedy,Trivia",
     "education": "Education",
 }
 
@@ -103,7 +106,7 @@ def _end(ev):
     ),
     RecipeField("#EventEndDate", "date", lambda ev: _wk_date(_end(ev)), label="End date"),
     RecipeField("#EventURL", "text", lambda ev: ev.event_url, required=True, label="Event URL"),
-    RecipeField("#EventCost", "text", lambda ev: "0" if ev.is_free else ev.price, label="Cost"),
+    RecipeField("#EventCost", "text", lambda ev: h.format_cost(ev.is_free, ev.price), label="Cost"),
 ]
 
 
@@ -243,7 +246,8 @@ def recipe_field_specs(self, ev):
                 _wk_category_terms,
                 recipe_only=True,
                 label="Event categories",
-                hint="AJAX dropdown — extension searches each term; unmatched terms are skipped",
+                hint="select2 dropdown — extension matches each term against the full "
+                "rendered list and reports any it can't find",
             )
         )
         if ev.image_url:
diff --git a/backendServer/broadcast/tests/test_adapter_specs.py b/backendServer/broadcast/tests/test_adapter_specs.py
index 682707c..433941f 100644
--- a/backendServer/broadcast/tests/test_adapter_specs.py
+++ b/backendServer/broadcast/tests/test_adapter_specs.py
@@ -3,8 +3,10 @@
 ABC11's Duration, derived from start/end) are silently dropped on the headless
 path. No DB, no real browser — a stub Playwright page records fill() calls."""
 
+import dataclasses
 import tempfile
 from datetime import UTC, datetime
+from unittest.mock import patch
 
 from django.test import SimpleTestCase, tag
 
@@ -14,9 +16,9 @@
 
 
 class _StubLocator:
-    """Records fill() calls; everything else is inert so has_captcha()/
-    dismiss_consent()/_login_wall() (all wrapped in try/except in the
-    adapter/helpers) treat this as "nothing there" and move on."""
+    """Records fill()/set_input_files() calls; everything else is inert so
+    has_captcha()/dismiss_consent()/_login_wall() (all wrapped in try/except
+    in the adapter/helpers) treat this as "nothing there" and move on."""
 
     def __init__(self, page, selector):
         self._page = page
@@ -32,6 +34,9 @@ def is_visible(self, timeout=None):
     def fill(self, value, timeout=None):
         self._page.filled[self._selector] = value
 
+    def set_input_files(self, path, timeout=None):
+        self._page.files[self._selector] = path
+
     def click(self, timeout=None):
         self._page.clicked.append(self._selector)
 
@@ -42,6 +47,7 @@ class _StubPage:
 
     def __init__(self):
         self.filled: dict[str, str] = {}
+        self.files: dict[str, str] = {}
         self.clicked: list[str] = []
         self.url = "https://example.test/stub"
 
@@ -106,3 +112,41 @@ def test_duration_fields_are_filled_when_event_has_an_end_time(self):
         self.assertIn("#eventDurationMinutes", page.filled)
         self.assertEqual(page.filled["#eventDurationHours"], "2")
         self.assertEqual(page.filled["#eventDurationMinutes"], "30")
+
+    def test_image_is_downloaded_and_set_on_the_file_input(self):
+        """46.8: an event with an image_url must reach the file input via
+        set_input_files — the adapter used to emit no image field at all."""
+        adapter = Abc11CommunityAdapter()
+        ev = dataclasses.replace(_make_event(), image_url="https://example.com/photo.jpg")
+        page = _StubPage()
+
+        with tempfile.TemporaryDirectory() as shots, tempfile.TemporaryDirectory() as dl:
+            ctx = RunContext(
+                dry_run=True, screenshot_dir=shots, download_dir=dl, submission_id="test"
+            )
+            with patch(
+                "broadcast.adapters.abc11_community.h.download_image",
+                return_value="/tmp/fake-photo.jpg",
+            ) as mock_download:
+                result = adapter.fill_and_submit(page, ev, ctx)
+
+        self.assertEqual(result.status, "succeeded")
+        mock_download.assert_called_once_with("https://example.com/photo.jpg", dl)
+        self.assertEqual(page.files.get(".image-field-esf input[type=file]"), "/tmp/fake-photo.jpg")
+
+    def test_no_image_field_touched_when_event_has_no_image(self):
+        adapter = Abc11CommunityAdapter()
+        ev = _make_event()
+        self.assertEqual(ev.image_url, "")
+        page = _StubPage()
+
+        with tempfile.TemporaryDirectory() as shots, tempfile.TemporaryDirectory() as dl:
+            ctx = RunContext(
+                dry_run=True, screenshot_dir=shots, download_dir=dl, submission_id="test"
+            )
+            with patch("broadcast.adapters.abc11_community.h.download_image") as mock_download:
+                result = adapter.fill_and_submit(page, ev, ctx)
+
+        self.assertEqual(result.status, "succeeded")
+        mock_download.assert_not_called()
+        self.assertNotIn(".image-field-esf input[type=file]", page.files)
diff --git a/backendServer/broadcast/tests/test_category_maps_fast.py b/backendServer/broadcast/tests/test_category_maps_fast.py
new file mode 100644
index 0000000..0277d3c
--- /dev/null
+++ b/backendServer/broadcast/tests/test_category_maps_fast.py
@@ -0,0 +1,184 @@
+"""Category terms have to exist verbatim on the target site.
+
+The extension only selects a term on an exact (or, since suite 46.1, prefix)
+label match against the destination's real vocabulary — a plausible-but-wrong
+term fails silently: no error, no category, nothing in the log. These tests
+pin every mapped term against a snapshot of each site's real vocabulary, so
+the next edit that guesses a label fails here instead of on a live calendar.
+
+Vocabularies verified live 2026-08-03 (see suite 46.1):
+- Triangle Weekender: select2 "AJAX" category dropdown, but the typed search
+  term never actually filters it — it always renders the complete 62-term
+  vocabulary. Read directly off the rendered dropdown.
+- ABC11: Trumba react-select Category box, a fixed 17-option vocabulary that
+  renders in full — `[...document.querySelectorAll("[class*='__option']")]
+  .map(o => o.textContent)`.
+"""
+
+import unittest
+
+from django.test import tag
+
+from broadcast.adapters.abc11_community import _CAT_MAP, _cat_terms
+from broadcast.adapters.triangle_weekender import _WK_CATEGORY_MAP, _wk_category_terms
+
+# Note: routing.CATEGORIES is the eligibility-routing vocabulary (11 slugs) and
+# is intentionally narrower than the category slugs adapters may map from —
+# events.Category is a free-form DB table, so slugs like "sports"/"film"/
+# "dance"/"comedy"/"theatre" are legitimate even though routing doesn't use
+# them for eligibility. These tests only pin map *values* against each site's
+# real vocabulary, not map *keys* against routing.CATEGORIES.
+
+# The complete Triangle Weekender category vocabulary (62 terms), verified
+# live 2026-08-03 against the rendered select2 dropdown.
+_WEEKENDER_VOCABULARY = frozenset(
+    {
+        "Arts",
+        "Arts & Crafts",
+        "Bluegrass",
+        "Books & Readings",
+        "Career Fair",
+        "Celebrate",
+        "Comedy",
+        "Computers & Tech",
+        "Concert",
+        "Conference",
+        "Create",
+        "Dance",
+        "Editors' Picks",
+        "Educate",
+        "Education",
+        "Entertain",
+        "Explore",
+        "Family Fun",
+        "Family-Friendly",
+        "Fashion",
+        "Festivals",
+        "Film",
+        "Fitness & Health",
+        "Food & Drink",
+        "Fundraisers",
+        "Fundraisers & Charity",
+        "Games",
+        "Gather",
+        "Global",
+        "Goldston",
+        "Grand Openings",
+        "Holiday",
+        "Home & Garden",
+        "Homes & Tours",
+        "Jazz",
+        "Kids & Family",
+        "LGBTQ+",
+        "Live Music",
+        "Marathon",
+        "Market",
+        "Mixer",
+        "Move",
+        "Music & Concerts",
+        "Networking",
+        "Nonprofit",
+        "Outdoors",
+        "Photography",
+        "Pittsboro",
+        "Play",
+        "Pop-Up",
+        "Sale",
+        "Shopping",
+        "Sports",
+        "Talks & Meetings",
+        "Talks & Readings",
+        "Theater",
+        "Trail Run",
+        "Trivia",
+        "Virtual Challenge",
+        "Volunteerism",
+        "Wellness",
+        "Writing",
+    }
+)
+
+# The complete ABC11 category vocabulary (17 options), verified live
+# 2026-08-03 against the rendered react-select menu.
+_ABC11_VOCABULARY = frozenset(
+    {
+        "Art / Photography / Crafts",
+        "Community Events / Volunteerism",
+        "Conferences",
+        "Festivals / Parades",
+        "Food and Beverage / Farmer's Market",
+        "Fundraisers",
+        "Galas / Banquets / Luncheons",
+        "Job Fairs / Employment",
+        "Meetings / Hearings",
+        "Museum / Exhibitions",
+        "Reunions",
+        "Runs / Walks / Marathons",
+        "School / Education",
+        "Sports and Recreation",
+        "Theater / Concerts",
+        "Yard Sales / Garage Sales / Auctions",
+        "Misc.",
+    }
+)
+
+
+@tag("fast")
+class TriangleWeekenderCategoryMapTests(unittest.TestCase):
+    def test_every_mapped_label_exists_in_the_real_vocabulary(self):
+        for slug, joined in _WK_CATEGORY_MAP.items():
+            for label in joined.split(","):
+                self.assertIn(
+                    label,
+                    _WEEKENDER_VOCABULARY,
+                    f"{slug!r} maps to {label!r}, which is not a real Triangle "
+                    "Weekender category — re-verify the live dropdown before "
+                    "changing this map.",
+                )
+
+    def test_wk_category_terms_joins_all_labels_for_a_slug(self):
+        class _Ev:
+            categories = ["music"]
+
+        self.assertEqual(_wk_category_terms(_Ev()), "Music & Concerts,Live Music")
+
+    def test_wk_category_terms_skips_unmapped_slugs(self):
+        class _Ev:
+            categories = ["not-a-real-slug"]
+
+        self.assertEqual(_wk_category_terms(_Ev()), "")
+
+
+@tag("fast")
+class Abc11CategoryMapTests(unittest.TestCase):
+    def test_every_mapped_label_exists_in_the_real_vocabulary(self):
+        for slug, label in _CAT_MAP.items():
+            self.assertIn(
+                label,
+                _ABC11_VOCABULARY,
+                f"{slug!r} maps to {label!r}, which is not a real ABC11 category "
+                "— re-verify the live react-select menu before changing this map.",
+            )
+
+    def test_never_falls_back_to_misc(self):
+        # A wrong category is worse than none — adapters never invent content.
+        self.assertNotIn("Misc.", _CAT_MAP.values())
+
+    def test_known_unmapped_slugs_are_intentionally_left_out(self):
+        # No defensible ABC11 match exists for these — confirms the omission
+        # is deliberate, not a regression.
+        for slug in ("family-kids", "literary", "nightlife", "wellness", "film"):
+            self.assertNotIn(slug, _CAT_MAP)
+
+    def test_cat_terms_dedupes_collapsed_labels(self):
+        # music/dance/comedy/theatre all collapse to "Theater / Concerts".
+        class _Ev:
+            categories = ["music", "dance", "comedy", "theatre"]
+
+        self.assertEqual(_cat_terms(_Ev()), "Theater / Concerts")
+
+    def test_cat_terms_skips_unmapped_slugs(self):
+        class _Ev:
+            categories = ["wellness", "arts"]
+
+        self.assertEqual(_cat_terms(_Ev()), "Art / Photography / Crafts")
diff --git a/backendServer/broadcast/tests/test_cost_normalization.py b/backendServer/broadcast/tests/test_cost_normalization.py
new file mode 100644
index 0000000..a76f395
--- /dev/null
+++ b/backendServer/broadcast/tests/test_cost_normalization.py
@@ -0,0 +1,98 @@
+"""Ticket 46.5: broadcast Price is free text on The Commons but destination
+sites (Triangle Weekender, ABC11) want a bare number in their Cost field — a
+range like "5-10" got forwarded verbatim and was rejected/mis-rendered. These
+cover the shared `_helpers.format_cost` normalizer and confirm both adapters'
+recipes route the Cost field through it. No DB — pure adapter logic."""
+
+from datetime import datetime
+
+from django.test import SimpleTestCase, tag
+
+from broadcast.adapters import _helpers as h
+from broadcast.adapters import get_adapter
+from broadcast.schema import CanonicalEvent
+
+
+@tag("fast")
+class FormatCostTest(SimpleTestCase):
+    def test_free_flag_wins_regardless_of_price_text(self):
+        self.assertEqual(h.format_cost(True, "5-10"), "0")
+        self.assertEqual(h.format_cost(True, ""), "0")
+
+    def test_free_text_without_flag(self):
+        self.assertEqual(h.format_cost(False, "This event is free"), "0")
+        self.assertEqual(h.format_cost(False, "Free"), "0")
+        self.assertEqual(h.format_cost(False, "FREE!"), "0")
+
+    def test_range_takes_the_low_value(self):
+        self.assertEqual(h.format_cost(False, "5-10"), "5")
+        self.assertEqual(h.format_cost(False, "$5 - $10"), "5")
+        self.assertEqual(h.format_cost(False, "5–10"), "5")  # en dash
+        self.assertEqual(h.format_cost(False, "  5 - 10  "), "5")
+
+    def test_single_value(self):
+        self.assertEqual(h.format_cost(False, "$12"), "12")
+        self.assertEqual(h.format_cost(False, "12"), "12")
+        self.assertEqual(h.format_cost(False, "  $12.50 "), "12.50")
+
+    def test_empty_input_passes_through_as_empty(self):
+        self.assertEqual(h.format_cost(False, ""), "")
+        self.assertEqual(h.format_cost(False, "   "), "")
+
+    def test_non_numeric_junk_passes_through_unchanged(self):
+        self.assertEqual(h.format_cost(False, "TBD"), "TBD")
+        self.assertEqual(h.format_cost(False, "call for pricing"), "call for pricing")
+
+
+def _event(**over):
+    base = dict(
+        title="Jazz Night",
+        description="An evening of jazz.",
+        start_datetime=datetime(2026, 6, 20, 19, 0),
+        end_datetime=datetime(2026, 6, 20, 22, 0),
+        venue_name="Acme Hall",
+        address_line1="1 Main St",
+        zip="27312",
+        locality=["pittsboro"],
+        event_url="https://example.com/jazz",
+        organizer_name="Acme Org",
+    )
+    base.update(over)
+    return CanonicalEvent(**base)
+
+
+@tag("fast")
+class AdapterCostFieldTest(SimpleTestCase):
+    """Confirm both in-scope adapters' recipes emit the normalized value, not
+    the raw price string — and that CanonicalEvent.price itself is untouched."""
+
+    def _cost_value(self, site_key, selector, ev):
+        recipe = get_adapter(site_key).recipe(ev)
+        field = next(f for f in recipe["fields"] if f["selector"] == selector)
+        return field["value"]
+
+    def test_triangle_weekender_range_emits_low_value(self):
+        ev = _event(price="5-10", is_free=False)
+        self.assertEqual(self._cost_value("triangle_weekender", "#EventCost", ev), "5")
+        self.assertEqual(ev.price, "5-10")  # raw string untouched
+
+    def test_abc11_range_emits_low_value(self):
+        ev = _event(price="5-10", is_free=False)
+        self.assertEqual(self._cost_value("abc11_community", "#cf33293", ev), "5")
+        self.assertEqual(ev.price, "5-10")
+
+    def test_triangle_weekender_free_emits_zero(self):
+        ev = _event(price="", is_free=True)
+        self.assertEqual(self._cost_value("triangle_weekender", "#EventCost", ev), "0")
+
+    def test_abc11_free_emits_zero(self):
+        ev = _event(price="", is_free=True)
+        self.assertEqual(self._cost_value("abc11_community", "#cf33293", ev), "0")
+
+    def test_triangle_weekender_dollar_amount_emits_bare_number(self):
+        ev = _event(price="$12", is_free=False)
+        self.assertEqual(self._cost_value("triangle_weekender", "#EventCost", ev), "12")
+
+    def test_abc11_dollar_amount_emits_bare_number(self):
+        ev = _event(price="$12", is_free=False)
+        self.assertEqual(self._cost_value("abc11_community", "#cf33293", ev), "12")
diff --git a/backendServer/broadcast/tests/test_recipe.py b/backendServer/broadcast/tests/test_recipe.py
index 27fd413..4bf8e4f 100644
--- a/backendServer/broadcast/tests/test_recipe.py
+++ b/backendServer/broadcast/tests/test_recipe.py
@@ -108,6 +108,32 @@ def test_empty_optional_plain_field_dropped(self):
         recipe = get_adapter("abc11_community").recipe(_event(contact_phone=""))
         self.assertNotIn("#cf34384", _selectors(recipe))
 
+    def test_abc11_image_field_tracks_image_url(self):
+        # 46.8: abc11's recipe must emit an image field only when the event
+        # has one — previously it never emitted an image field at all.
+        with_img = _selectors(get_adapter("abc11_community").recipe(_event()))
+        self.assertIn(".image-field-esf input[type=file]", with_img)
+
+        without_img = _selectors(get_adapter("abc11_community").recipe(_event(image_url="")))
+        self.assertNotIn(".image-field-esf input[type=file]", without_img)
+
+    def test_abc11_image_field_is_file_type_recipe_only(self):
+        recipe = get_adapter("abc11_community").recipe(_event())
+        image = next(
+            f for f in recipe["fields"] if f["selector"] == ".image-field-esf input[type=file]"
+        )
+        self.assertEqual(image["type"], "file")
+        self.assertEqual(image["value"], "https://example.com/jazz.jpg")
+
+    def test_abc11_start_date_hint_no_longer_mentions_a_label_fallback(self):
+        # 46.9: the field targets a real Fluent UI datepicker input (id merely
+        # ends in "-label"), not a <label> — the old hint sent the ticket down
+        # the wrong path and must not resurface.
+        recipe = get_adapter("abc11_community").recipe(_event())
+        start = next(f for f in recipe["fields"] if f["selector"] == "#eventStartDate-label")
+        self.assertEqual(start["type"], "date")
+        self.assertNotIn("label", (start["hint"] or "").lower())
+
     def test_terms_always_emitted_even_though_recipe_only(self):
         recipe = get_adapter("triangle_weekender").recipe(_event())
         terms = next(f for f in recipe["fields"] if f["selector"] == "#terms")
diff --git a/backendServer/broadcast/tests/test_upload_image.py b/backendServer/broadcast/tests/test_upload_image.py
index 1e39182..531b18d 100644
--- a/backendServer/broadcast/tests/test_upload_image.py
+++ b/backendServer/broadcast/tests/test_upload_image.py
@@ -66,6 +66,25 @@ def test_uploads_and_returns_absolute_url(self):
         self.assertEqual(record.client_label, "uploader@example.com")
         self.assertIn(record.image.url, body["url"])
 
+    def test_forwarded_https_header_yields_https_url(self):
+        # Regression for T46.2: nginx terminates TLS and proxies to gunicorn over
+        # a Unix socket, so without SECURE_PROXY_SSL_HEADER (set in prod.py only)
+        # request.build_absolute_uri() would compute an http:// URL on an https://
+        # site — mixed-content blocked by every destination calendar. Simulate
+        # prod's trust of X-Forwarded-Proto here since the test suite runs under
+        # dev-derived settings, not prod.py.
+        with override_settings(SECURE_PROXY_SSL_HEADER=("HTTP_X_FORWARDED_PROTO", "https")):
+            with _patch_jwt("uploader@example.com"):
+                resp = self.client.post(
+                    "/broadcast/upload-image",
+                    {"image": _jpeg_upload()},
+                    format="multipart",
+                    HTTP_AUTHORIZATION="Bearer faketoken",
+                    HTTP_X_FORWARDED_PROTO="https",
+                )
+        self.assertEqual(resp.status_code, 201, resp.content)
+        self.assertTrue(resp.json()["url"].startswith("https://"))
+
     def test_png_with_alpha_is_reencoded_and_kept_as_png(self):
         resp = self._post(_png_upload_with_alpha())
         self.assertEqual(resp.status_code, 201, resp.content)
diff --git a/backendServer/events/cache.py b/backendServer/events/cache.py
index bfc409f..d09020c 100644
--- a/backendServer/events/cache.py
+++ b/backendServer/events/cache.py
@@ -36,6 +36,15 @@ def events_list_key(query_params):
     return f"events:list:v{_events_list_version()}:{digest}"
 
 
+def events_facets_key(query_params):
+    """Deterministic key for a facet-count request. Shares the list version counter
+    with `events_list_key` so `invalidate_events_list()` invalidates both."""
+    items = sorted((k, v) for k in query_params for v in query_params.getlist(k))
+    raw = "&".join(f"{k}={v}" for k, v in items)
+    digest = hashlib.sha256(raw.encode()).hexdigest()[:16]
+    return f"events:facets:v{_events_list_version()}:{digest}"
+
+
 def invalidate_events_list():
     """Bump the list version so all cached event-list pages are bypassed."""
     try:
diff --git a/backendServer/events/management/commands/retag_events.py b/backendServer/events/management/commands/retag_events.py
new file mode 100644
index 0000000..1e331d6
--- /dev/null
+++ b/backendServer/events/management/commands/retag_events.py
@@ -0,0 +1,90 @@
+"""Suite 47.3 — recompute day-part tags for every existing event.
+
+`events/tagging.py` (day_part_tags) makes `weekends`/`evenings`/`daytime`
+pure functions of `Event.date`, computed at publish time. That only covers
+events published from here on — every event already in the DB still carries
+whatever the standardizer LLM guessed (or nothing at all), some of it under
+the retired `weekends-only`/`evenings-only`/`daytime-only` slugs. This
+command backfills all of them: for every event it drops the current and
+legacy day-part slugs, then adds back `day_part_tags(event.date)`. Any other
+tags on the event (e.g. `free`, `nature`) are left untouched.
+
+Re-runnable, not a migration — `--dry-run` previews the same summary without
+writing anything, and a second real run reports 0 changed (idempotent).
+
+Run order in prod: run this command BEFORE `manage.py migrate`. A separate
+data migration deletes the orphaned `weekends-only`/`evenings-only`/
+`daytime-only` Tag rows outright (plus the retired `lgbtq-friendly` and
+`speaks-spanish` tags). If migrate runs first, those `-only` Tag rows are
+gone before this command can count them as "collapsed" — harmless, since
+tags are recomputed straight from `event.date` either way, but the reported
+collapsed-legacy-slug count would read 0 instead of the real number.
+"""
+
+from django.core.management.base import BaseCommand
+
+from events import cache as events_cache
+from events.models import Event, Tag
+from events.tagging import DAY_PART_TAGS, day_part_tags
+
+LEGACY_DAY_PART_SLUGS = frozenset({"weekends-only", "evenings-only", "daytime-only"})
+STALE_DAY_PART_SLUGS = DAY_PART_TAGS | LEGACY_DAY_PART_SLUGS
+
+
+class Command(BaseCommand):
+    help = (
+        "Recompute weekends/evenings/daytime tags for every existing event "
+        "from Event.date, dropping any stale current or legacy '-only' "
+        "day-part slugs first. Re-runnable; --dry-run previews without "
+        "writing. Run before `migrate` in prod — see module docstring."
+    )
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "--dry-run",
+            action="store_true",
+            help="Report what would change without writing anything.",
+        )
+
+    def handle(self, *args, **options):
+        dry_run = options["dry_run"]
+
+        scanned = 0
+        changed = 0
+        tags_added = 0
+        legacy_collapsed = 0
+
+        queryset = Event.objects.all().prefetch_related("tags").iterator(chunk_size=500)
+
+        for event in queryset:
+            scanned += 1
+
+            current_names = {t.name for t in event.tags.all()}
+            new_day_part = day_part_tags(event.date)
+            kept = current_names - STALE_DAY_PART_SLUGS
+            desired_names = kept | new_day_part
+
+            if desired_names == current_names:
+                continue
+
+            changed += 1
+            tags_added += len(new_day_part - current_names)
+            legacy_collapsed += len(current_names & LEGACY_DAY_PART_SLUGS)
+
+            if not dry_run:
+                tag_objs = [Tag.objects.get_or_create(name=n)[0] for n in sorted(desired_names)]
+                event.tags.set(tag_objs)
+
+        verb = "Would change" if dry_run else "Changed"
+        self.stdout.write(
+            f"Scanned {scanned} event(s). {verb} {changed}. "
+            f"Day-part tags added: {tags_added}. Legacy '-only' slugs collapsed: "
+            f"{legacy_collapsed}."
+        )
+
+        if dry_run:
+            self.stdout.write(self.style.WARNING("Dry run only — no tags were written."))
+            return
+
+        events_cache.invalidate_events_list()
+        self.stdout.write(self.style.SUCCESS("Events cache invalidated."))
diff --git a/backendServer/events/migrations/0025_delete_retired_tags.py b/backendServer/events/migrations/0025_delete_retired_tags.py
new file mode 100644
index 0000000..dcecba2
--- /dev/null
+++ b/backendServer/events/migrations/0025_delete_retired_tags.py
@@ -0,0 +1,47 @@
+"""Suite 47.3 — delete retired Tag rows outright.
+
+`lgbtq-friendly` and `speaks-spanish` were retired from the product, and
+`weekends-only`/`evenings-only`/`daytime-only` are the pre-canonicalization
+day-part slugs (superseded by `weekends`/`evenings`/`daytime`, now computed
+from `Event.date` — see events/tagging.py). Deleting the Tag rows cascades
+the M2M through-table rows, so any event still linked to one just loses that
+tag; its other tags are untouched.
+
+Run order in prod: run `manage.py retag_events` BEFORE this migration. That
+command already strips these legacy day-part slugs off every event and
+replaces them with the computed tag, so by the time this migration runs the
+`-only` rows are typically already orphaned (0 event links). Running this
+migration first wouldn't break retag_events — it recomputes tags from
+event.date regardless of which Tag rows currently exist — but retag_events'
+own "legacy slugs collapsed" count would then read 0 instead of the real
+number, since the rows it's looking for would already be gone.
+
+Not reversible: `reverse_code` is a no-op. The Tag names could be recreated,
+but the event/tag links this migration deletes cannot be reconstructed —
+pretending this is reversible would be misleading.
+"""
+
+from django.db import migrations
+
+RETIRED_TAG_NAMES = [
+    "lgbtq-friendly",
+    "speaks-spanish",
+    "weekends-only",
+    "evenings-only",
+    "daytime-only",
+]
+
+
+def delete_retired_tags(apps, schema_editor):
+    Tag = apps.get_model("events", "Tag")
+    Tag.objects.filter(name__in=RETIRED_TAG_NAMES).delete()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("events", "0024_seed_wake_forest_town"),
+    ]
+
+    operations = [
+        migrations.RunPython(delete_retired_tags, migrations.RunPython.noop),
+    ]
diff --git a/backendServer/events/serializers.py b/backendServer/events/serializers.py
index ba5ea18..75f5dca 100644
--- a/backendServer/events/serializers.py
+++ b/backendServer/events/serializers.py
@@ -1,6 +1,7 @@
 from rest_framework import serializers
 
-from .models import Category, Event, Tag, Town
+from .models import Category, Event, Town
+from .tagging import apply_tags
 
 
 class EventSerializer(serializers.ModelSerializer):
@@ -57,10 +58,7 @@ def create(self, validated_data):
 
         event = Event.objects.create(**validated_data)
 
-        for tag_name in tags_data:
-            tag_clean = tag_name.strip().lower()
-            tag_obj, _ = Tag.objects.get_or_create(name=tag_clean)
-            event.tags.add(tag_obj)
+        apply_tags(event, tags_data)
 
         for slug in categories_data:
             try:
diff --git a/backendServer/events/tagging.py b/backendServer/events/tagging.py
new file mode 100644
index 0000000..b31019c
--- /dev/null
+++ b/backendServer/events/tagging.py
@@ -0,0 +1,62 @@
+"""Day-part tags derived from an event's start time.
+
+`weekends` / `evenings` / `daytime` used to depend on the standardizer LLM
+following a prompt instruction — unreliable, and it never ran at all for
+human-submitted events (those skip Gemini entirely). They're pure functions
+of `Event.date`, so compute them instead of asking a model.
+
+`USE_TZ=True` (see `backend/settings/base.py`) means `Event.date` is stored
+and handed back in UTC regardless of the project's `TIME_ZONE` setting — so
+every caller here converts to America/New_York *first*. Skipping that
+conversion silently mis-tags evening events that cross the UTC day boundary
+(e.g. a 9pm ET Friday show is already Saturday in UTC).
+"""
+
+from collections.abc import Iterable
+from datetime import datetime
+from zoneinfo import ZoneInfo
+
+from django.utils import timezone as django_timezone
+
+from events.models import Tag
+
+DAY_PART_TAGS = frozenset({"weekends", "evenings", "daytime"})
+
+_LOCAL_TZ = ZoneInfo("America/New_York")
+
+
+def day_part_tags(dt: datetime) -> set[str]:
+    """Tags derived from an event's start time, in local (ET) wall-clock terms.
+
+    - `daytime`: local start hour < 18 (before 6:00pm)
+    - `evenings`: local start hour >= 16 (4:00pm or later)
+      The 4-6pm band deliberately yields BOTH tags — events have no end time,
+      so a 4:30pm event plausibly runs into both. Err inclusive.
+    - `weekends`: local weekday is Sat or Sun, OR Friday at 17:00 or later.
+    """
+    if django_timezone.is_naive(dt):
+        local = dt.replace(tzinfo=_LOCAL_TZ)
+    else:
+        local = dt.astimezone(_LOCAL_TZ)
+
+    tags = set()
+    if local.hour < 18:
+        tags.add("daytime")
+    if local.hour >= 16:
+        tags.add("evenings")
+
+    weekday = local.weekday()  # Mon=0 ... Sun=6
+    if weekday in (5, 6) or (weekday == 4 and local.hour >= 17):
+        tags.add("weekends")
+
+    return tags
+
+
+def apply_tags(event, supplied: Iterable[str]) -> None:
+    """Set `event.tags` to `supplied` (lowercased, deduped) with the computed
+    day-part tags for `event.date` layered on top — computed always wins over
+    a stale or LLM/user-supplied day-part slug, so those are stripped first.
+    """
+    names = {t.strip().lower() for t in supplied} - DAY_PART_TAGS
+    names |= day_part_tags(event.date)
+    event.tags.set([Tag.objects.get_or_create(name=n)[0] for n in sorted(names)])
diff --git a/backendServer/events/tests/test_facets_api_db.py b/backendServer/events/tests/test_facets_api_db.py
new file mode 100644
index 0000000..5160359
--- /dev/null
+++ b/backendServer/events/tests/test_facets_api_db.py
@@ -0,0 +1,108 @@
+from datetime import timedelta
+
+from django.core.cache import cache
+from django.test import TestCase, tag
+from django.urls import reverse
+from django.utils import timezone
+
+from events.models import Category, Event, Tag
+
+from .factories import make_event, make_town
+
+PAGE_SIZE = 30
+
+
+@tag("db")
+class EventFacetsTests(TestCase):
+    def setUp(self):
+        cache.clear()
+        self.carrboro = make_town("carrboro", "Carrboro")
+        self.chapel_hill = make_town("chapel-hill", "Chapel Hill")
+
+    def test_counts_exceed_a_single_page(self):
+        # More than PAGE_SIZE events in one town: a client-side count over the
+        # paginated list endpoint would cap at 30. The facet endpoint must not.
+        total = PAGE_SIZE + 5
+        for i in range(total):
+            make_event(f"Show {i}", town=self.carrboro, days_offset=1)
+
+        resp = self.client.get(reverse("event-facets"))
+        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(resp.data["towns"]["carrboro"], total)
+
+    def test_response_shape(self):
+        tag_free = Tag.objects.create(name="free")
+        event = make_event("Free Show", town=self.carrboro, days_offset=1)
+        event.tags.add(tag_free)
+
+        resp = self.client.get(reverse("event-facets"))
+        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(set(resp.data.keys()), {"towns", "tags"})
+        self.assertEqual(resp.data["towns"], {"carrboro": 1})
+        self.assertEqual(resp.data["tags"], {"free": 1})
+
+    def test_zero_count_facets_are_omitted(self):
+        # chapel-hill and any unused tag should never appear.
+        make_event("Carrboro Show", town=self.carrboro, days_offset=1)
+
+        resp = self.client.get(reverse("event-facets"))
+        self.assertNotIn("chapel-hill", resp.data["towns"])
+        self.assertEqual(resp.data["tags"], {})
+
+    def test_event_with_multiple_tags_counts_once_per_tag(self):
+        evenings = Tag.objects.create(name="evenings")
+        free = Tag.objects.create(name="free")
+        event = make_event("Multi Tag Show", town=self.carrboro, days_offset=1)
+        event.tags.add(evenings, free)
+
+        resp = self.client.get(reverse("event-facets"))
+        self.assertEqual(resp.data["tags"], {"evenings": 1, "free": 1})
+
+    def test_window_past_narrows_counts(self):
+        make_event("Past Show", town=self.carrboro, days_offset=-3)
+        make_event("Future Show", town=self.chapel_hill, days_offset=3)
+
+        resp = self.client.get(reverse("event-facets"), {"window": "past"})
+        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(resp.data["towns"], {"carrboro": 1})
+
+    def test_category_filter_narrows_counts_consistently_with_list(self):
+        # Migration 0012 already seeds these slugs, so fetch rather than create.
+        music, _ = Category.objects.get_or_create(slug="music", defaults={"display_name": "Music"})
+        art, _ = Category.objects.get_or_create(slug="art", defaults={"display_name": "Art"})
+
+        music_event = make_event("Music Show", town=self.carrboro, days_offset=1)
+        music_event.categories.add(music)
+        art_event = make_event("Art Show", town=self.chapel_hill, days_offset=1)
+        art_event.categories.add(art)
+
+        facets_resp = self.client.get(reverse("event-facets"), {"category": "music"})
+        list_resp = self.client.get(reverse("events"), {"category": "music"})
+
+        self.assertEqual(facets_resp.data["towns"], {"carrboro": 1})
+        self.assertEqual(list_resp.data["count"], 1)
+
+    def test_facets_are_cached_and_invalidated_with_list(self):
+        make_event("First", town=self.carrboro, days_offset=1)
+        first = self.client.get(reverse("event-facets"))
+        self.assertEqual(first.data["towns"]["carrboro"], 1)
+
+        # bulk_create bypasses post_save, so the cache is NOT invalidated.
+        Event.objects.bulk_create(
+            [
+                Event(
+                    title="Hidden",
+                    town=self.carrboro,
+                    date=timezone.now() + timedelta(days=1),
+                    venue="V",
+                    description="d",
+                ),
+            ]
+        )
+        cached = self.client.get(reverse("event-facets"))
+        self.assertEqual(cached.data["towns"]["carrboro"], 1, "second call should hit the cache")
+
+        # A normal create fires post_save -> invalidates both list and facets caches.
+        make_event("Third", town=self.carrboro, days_offset=1)
+        fresh = self.client.get(reverse("event-facets"))
+        self.assertEqual(fresh.data["towns"]["carrboro"], 3)
diff --git a/backendServer/events/tests/test_retag_events.py b/backendServer/events/tests/test_retag_events.py
new file mode 100644
index 0000000..374b9c1
--- /dev/null
+++ b/backendServer/events/tests/test_retag_events.py
@@ -0,0 +1,185 @@
+"""Suite 47.3 — retag_events management command + the 0025 data migration.
+
+retag_events backfills weekends/evenings/daytime tags (computed from
+Event.date via events.tagging.day_part_tags) onto events that predate the
+publish-time computation, and strips both the current and legacy
+'-only' day-part slugs first. Migration 0025 deletes the retired Tag rows
+outright (lgbtq-friendly, speaks-spanish, and the three orphaned '-only'
+slugs).
+"""
+
+import importlib
+from datetime import datetime
+from io import StringIO
+from zoneinfo import ZoneInfo
+
+from django.apps import apps as global_apps
+from django.core.cache import cache
+from django.core.management import call_command
+from django.test import TestCase, tag
+
+from events import cache as events_cache
+from events.models import Event, Tag
+
+from .factories import make_event, make_town
+
+migration_0025 = importlib.import_module("events.migrations.0025_delete_retired_tags")
+
+_ET = ZoneInfo("America/New_York")
+
+
+def _run_retag(dry_run=False):
+    out = StringIO()
+    call_command("retag_events", dry_run=dry_run, stdout=out)
+    return out.getvalue()
+
+
+@tag("db")
+class RetagEventsCommandTests(TestCase):
+    def setUp(self):
+        cache.clear()
+        self.town = make_town()
+
+    def test_computes_exact_tag_set_from_event_date(self):
+        # Saturday 9am ET -> daytime + weekends. Seed with a stale LLM-guessed
+        # tag plus a legacy '-only' slug, both of which should be dropped.
+        sat_9am = datetime(2026, 8, 8, 9, 0, tzinfo=_ET)
+        event = make_event("Sat morning", town=self.town, date=sat_9am)
+        stale, _ = Tag.objects.get_or_create(name="evenings")
+        legacy, _ = Tag.objects.get_or_create(name="weekends-only")
+        event.tags.set([stale, legacy])
+
+        _run_retag()
+
+        event.refresh_from_db()
+        self.assertEqual({t.name for t in event.tags.all()}, {"daytime", "weekends"})
+
+    def test_non_day_part_tags_are_preserved(self):
+        # The easiest thing to accidentally wipe with a naive .set() call.
+        sat_9am = datetime(2026, 8, 8, 9, 0, tzinfo=_ET)
+        event = make_event("Sat morning with extras", town=self.town, date=sat_9am)
+        free, _ = Tag.objects.get_or_create(name="free")
+        nature, _ = Tag.objects.get_or_create(name="nature")
+        event.tags.set([free, nature])
+
+        _run_retag()
+
+        event.refresh_from_db()
+        self.assertEqual(
+            {t.name for t in event.tags.all()}, {"daytime", "weekends", "free", "nature"}
+        )
+
+    def test_dry_run_writes_nothing(self):
+        sat_9am = datetime(2026, 8, 8, 9, 0, tzinfo=_ET)
+        event = make_event("Sat morning", town=self.town, date=sat_9am)
+        legacy, _ = Tag.objects.get_or_create(name="daytime-only")
+        event.tags.set([legacy])
+
+        output = _run_retag(dry_run=True)
+
+        event.refresh_from_db()
+        self.assertEqual({t.name for t in event.tags.all()}, {"daytime-only"})
+        self.assertIn("Would change 1", output)
+        self.assertIn("no tags were written", output)
+
+    def test_second_run_is_idempotent_and_reports_zero_changed(self):
+        sat_9am = datetime(2026, 8, 8, 9, 0, tzinfo=_ET)
+        make_event("Sat morning", town=self.town, date=sat_9am)
+        weekday_evening = datetime(2026, 8, 10, 19, 0, tzinfo=_ET)  # Monday 7pm
+        make_event("Weekday evening", town=self.town, date=weekday_evening)
+
+        first_output = _run_retag()
+        second_output = _run_retag()
+
+        self.assertIn("Changed 2", first_output)
+        self.assertIn("Changed 0", second_output)
+
+    def test_legacy_only_slugs_are_gone_from_every_event_after_run(self):
+        sat_9am = datetime(2026, 8, 8, 9, 0, tzinfo=_ET)
+        weekday_evening = datetime(2026, 8, 10, 19, 0, tzinfo=_ET)
+        e1 = make_event("A", town=self.town, date=sat_9am)
+        e2 = make_event("B", town=self.town, date=weekday_evening)
+        e1.tags.set([Tag.objects.get_or_create(name="weekends-only")[0]])
+        e2.tags.set([Tag.objects.get_or_create(name="evenings-only")[0]])
+
+        _run_retag()
+
+        legacy_names = {"weekends-only", "evenings-only", "daytime-only"}
+        for event in Event.objects.prefetch_related("tags").all():
+            self.assertFalse({t.name for t in event.tags.all()} & legacy_names)
+
+    def test_reports_scanned_added_and_collapsed_counts(self):
+        sat_9am = datetime(2026, 8, 8, 9, 0, tzinfo=_ET)
+        event = make_event("Sat morning", town=self.town, date=sat_9am)
+        legacy, _ = Tag.objects.get_or_create(name="weekends-only")
+        event.tags.set([legacy])
+
+        output = _run_retag()
+
+        self.assertIn("Scanned 1 event(s)", output)
+        self.assertIn("Changed 1", output)
+        self.assertIn("Day-part tags added: 2", output)  # daytime + weekends
+        self.assertIn("Legacy '-only' slugs collapsed: 1", output)
+
+    def test_real_run_invalidates_events_cache(self):
+        sat_9am = datetime(2026, 8, 8, 9, 0, tzinfo=_ET)
+        make_event("Sat morning", town=self.town, date=sat_9am)
+
+        before = cache.get(events_cache.EVENTS_LIST_VERSION_KEY)
+        _run_retag()
+        after = cache.get(events_cache.EVENTS_LIST_VERSION_KEY)
+
+        self.assertIsNotNone(after)
+        if before is not None:
+            self.assertGreater(after, before)
+
+
+@tag("db")
+class DeleteRetiredTagsMigrationTests(TestCase):
+    """Exercises 0025's RunPython function directly, matching the pattern in
+    test_town_backfill.py — the migration is already applied in the test DB,
+    so this proves the function itself is correct and idempotent rather than
+    depending on prod-only rows.
+    """
+
+    def test_deletes_retired_tag_rows(self):
+        for name in [
+            "lgbtq-friendly",
+            "speaks-spanish",
+            "weekends-only",
+            "evenings-only",
+            "daytime-only",
+        ]:
+            Tag.objects.get_or_create(name=name)
+
+        migration_0025.delete_retired_tags(global_apps, None)
+
+        remaining = set(
+            Tag.objects.filter(
+                name__in=[
+                    "lgbtq-friendly",
+                    "speaks-spanish",
+                    "weekends-only",
+                    "evenings-only",
+                    "daytime-only",
+                ]
+            ).values_list("name", flat=True)
+        )
+        self.assertEqual(remaining, set())
+
+    def test_linked_events_survive_with_other_tags_intact(self):
+        town = make_town()
+        event = make_event("Linked event", town=town)
+        retired = Tag.objects.get_or_create(name="lgbtq-friendly")[0]
+        keeper = Tag.objects.get_or_create(name="free")[0]
+        event.tags.set([retired, keeper])
+
+        migration_0025.delete_retired_tags(global_apps, None)
+
+        event.refresh_from_db()
+        self.assertEqual({t.name for t in event.tags.all()}, {"free"})
+
+    def test_idempotent_on_second_run(self):
+        migration_0025.delete_retired_tags(global_apps, None)
+        migration_0025.delete_retired_tags(global_apps, None)  # should not raise
+        self.assertEqual(Tag.objects.filter(name__in=migration_0025.RETIRED_TAG_NAMES).count(), 0)
diff --git a/backendServer/events/tests/test_tagging_fast.py b/backendServer/events/tests/test_tagging_fast.py
new file mode 100644
index 0000000..46da904
--- /dev/null
+++ b/backendServer/events/tests/test_tagging_fast.py
@@ -0,0 +1,63 @@
+"""day_part_tags is a pure function of an event's start datetime — no DB, no
+model instances required. See events/tagging.py for the tag rules.
+"""
+
+import unittest
+from datetime import UTC, datetime
+from zoneinfo import ZoneInfo
+
+from django.test import tag
+
+from events.tagging import day_part_tags
+
+_ET = ZoneInfo("America/New_York")
+
+
+@tag("fast")
+class DayPartTagsTests(unittest.TestCase):
+    def test_morning_is_daytime_only(self):
+        dt = datetime(2026, 8, 3, 9, 0, tzinfo=_ET)  # Monday 9am
+        self.assertEqual(day_part_tags(dt), {"daytime"})
+
+    def test_late_afternoon_is_both_daytime_and_evenings(self):
+        # 4-6pm is a deliberate overlap band: events have no end time, so a
+        # 4:30pm start plausibly runs into the evening. Err inclusive.
+        dt = datetime(2026, 8, 3, 16, 30, tzinfo=_ET)  # Monday 4:30pm
+        self.assertEqual(day_part_tags(dt), {"daytime", "evenings"})
+
+    def test_night_is_evenings_only(self):
+        dt = datetime(2026, 8, 3, 19, 0, tzinfo=_ET)  # Monday 7pm
+        self.assertEqual(day_part_tags(dt), {"evenings"})
+
+    def test_friday_afternoon_is_not_weekend(self):
+        dt = datetime(2026, 8, 7, 14, 0, tzinfo=_ET)  # Friday 2pm
+        tags = day_part_tags(dt)
+        self.assertNotIn("weekends", tags)
+        self.assertEqual(tags, {"daytime"})
+
+    def test_friday_evening_is_weekend(self):
+        dt = datetime(2026, 8, 7, 19, 0, tzinfo=_ET)  # Friday 7pm
+        tags = day_part_tags(dt)
+        self.assertIn("weekends", tags)
+        self.assertEqual(tags, {"evenings", "weekends"})
+
+    def test_saturday_morning_is_weekend(self):
+        dt = datetime(2026, 8, 8, 9, 0, tzinfo=_ET)  # Saturday 9am
+        tags = day_part_tags(dt)
+        self.assertIn("weekends", tags)
+        self.assertEqual(tags, {"daytime", "weekends"})
+
+    def test_naive_datetime_is_treated_as_already_local_not_crashed(self):
+        # Defensive handling for a naive dt: don't crash, treat it as ET
+        # wall-clock rather than raising on astimezone().
+        dt = datetime(2026, 8, 8, 9, 0)  # Saturday 9am, no tzinfo
+        self.assertEqual(day_part_tags(dt), {"daytime", "weekends"})
+
+    def test_utc_trap_friday_evening_et_stored_as_utc(self):
+        """Regression guard: 2026-08-15T01:00:00Z is Fri Aug 14 9:00pm ET, not
+        a UTC-calendar Saturday. Skipping the UTC->ET conversion would land
+        this on the wrong day (Saturday daytime) instead of the correct
+        Friday-evening/weekend classification.
+        """
+        dt = datetime(2026, 8, 15, 1, 0, tzinfo=UTC)
+        self.assertEqual(day_part_tags(dt), {"evenings", "weekends"})
diff --git a/backendServer/events/urls.py b/backendServer/events/urls.py
index 3fb17c8..58d7e4b 100644
--- a/backendServer/events/urls.py
+++ b/backendServer/events/urls.py
@@ -6,6 +6,7 @@
     path("", views.get_all, name="events"),
     path("towns/", views.get_towns, name="towns"),
     path("categories/", views.get_categories, name="categories"),
+    path("facets/", views.get_facets, name="event-facets"),
     path("me/profile", views.get_my_profile, name="my-profile"),
     path("me/events", views.get_my_events, name="my-events"),
     path("staged/<int:event_id>", views.manage_staged_event, name="manage-staged-event"),
diff --git a/backendServer/events/views.py b/backendServer/events/views.py
index ff44c88..e4159fe 100644
--- a/backendServer/events/views.py
+++ b/backendServer/events/views.py
@@ -1,6 +1,7 @@
 from datetime import timedelta
 
 from django.core.cache import cache
+from django.db.models import Count
 from django.shortcuts import get_object_or_404
 from django.utils import timezone
 from django.utils.dateparse import parse_datetime
@@ -47,10 +48,9 @@ def get_categories(request):
     return Response(data)
 
 
-@api_view(["GET"])
-def get_all(request):  # noqa: C901  # query-param filtering; complexity is inherent
+def _filtered_events_queryset(request):  # noqa: C901  # query-param filtering; complexity is inherent
     """
-    List published events (paginated, page_size=30).
+    Shared window/category/date filtering for the events list and facet-count endpoints.
 
     Query params (applied in priority order — after/before/include_past override window):
       after        ISO datetime — events on or after this datetime
@@ -61,21 +61,20 @@ def get_all(request):  # noqa: C901  # query-param filtering; complexity is inhe
                             otherwise date >= now (fills page from all future events)
                    past:    date < now
                    future:  date > now + 90 days
-    """
-    cache_key = events_cache.events_list_key(request.query_params)
-    cached = cache.get(cache_key)
-    if cached is not None:
-        return Response(cached)
 
+    Note: does NOT apply `.order_by()` — callers that care about ordering (e.g. get_all's
+    "past" window, which reverses to newest-first) must apply it themselves.
+    """
     now = timezone.now()
     ninety_days_out = now + timedelta(days=90)
 
-    events = Event.objects.all().order_by("date")
+    events = Event.objects.all()
 
     include_past = request.query_params.get("include_past", "").lower() == "true"
     after_param = request.query_params.get("after")
     before_param = request.query_params.get("before")
     window = request.query_params.get("window", "").lower()
+    is_past_window = False  # only set by the unqualified window=past branch below
 
     # after/before/include_past are explicit overrides; window applies only when none are set
     if after_param or before_param or include_past:
@@ -92,7 +91,8 @@ def get_all(request):  # noqa: C901  # query-param filtering; complexity is inhe
                 events = events.filter(date__lte=before_dt)
     else:
         if window == "past":
-            events = events.filter(date__lt=now).order_by("-date")
+            events = events.filter(date__lt=now)
+            is_past_window = True
         elif window == "future":
             events = events.filter(date__gt=ninety_days_out)
         else:  # 'default' or unset — 90-day cap unless fewer than PAGE_SIZE events exist there
@@ -106,6 +106,24 @@ def get_all(request):  # noqa: C901  # query-param filtering; complexity is inhe
     if category_param:
         events = events.filter(categories__slug__in=category_param).distinct()
 
+    return events, is_past_window
+
+
+@api_view(["GET"])
+def get_all(request):
+    """
+    List published events (paginated, page_size=30).
+
+    See `_filtered_events_queryset` for the supported query params.
+    """
+    cache_key = events_cache.events_list_key(request.query_params)
+    cached = cache.get(cache_key)
+    if cached is not None:
+        return Response(cached)
+
+    events, is_past_window = _filtered_events_queryset(request)
+    events = events.order_by("-date") if is_past_window else events.order_by("date")
+
     paginator = EventsPagination()
     page = paginator.paginate_queryset(events, request)
     serializer = EventSerializer(page, many=True)
@@ -114,6 +132,41 @@ def get_all(request):  # noqa: C901  # query-param filtering; complexity is inhe
     return Response(data)
 
 
+@api_view(["GET"])
+def get_facets(request):
+    """
+    Facet counts (towns, tags) over the full filtered event set — unpaginated.
+
+    Accepts the same window/category/date query params as `get_all`. Used by the
+    frontend sidebar so counts reflect the whole filtered result, not just the
+    current page.
+    """
+    cache_key = events_cache.events_facets_key(request.query_params)
+    cached = cache.get(cache_key)
+    if cached is not None:
+        return Response(cached)
+
+    events, _is_past_window = _filtered_events_queryset(request)
+
+    town_counts = (
+        events.exclude(town__isnull=True)
+        .values("town__slug")
+        .annotate(n=Count("pk", distinct=True))
+    )
+    tag_counts = (
+        events.exclude(tags__isnull=True)
+        .values("tags__name")
+        .annotate(n=Count("pk", distinct=True))
+    )
+
+    data = {
+        "towns": {row["town__slug"]: row["n"] for row in town_counts if row["town__slug"]},
+        "tags": {row["tags__name"]: row["n"] for row in tag_counts if row["tags__name"]},
+    }
+    cache.set(cache_key, data, events_cache.EVENTS_LIST_TTL)
+    return Response(data)
+
+
 @api_view(["GET", "DELETE"])
 @authentication_classes([BearerTokenAuthentication])
 def get_one(request, event_id):
diff --git a/backendServer/ingestion/services.py b/backendServer/ingestion/services.py
index b1f3e4c..cb5cfaf 100644
--- a/backendServer/ingestion/services.py
+++ b/backendServer/ingestion/services.py
@@ -3,7 +3,8 @@
 from django.db import transaction
 
 from accounts.models import BetterAuthUser
-from events.models import Category, Event, Tag, Town
+from events.models import Category, Event, Town
+from events.tagging import apply_tags
 from ingestion.deduplicator import (
     BROADCAST_LOCATION_SIMILARITY_THRESHOLD,
     BROADCAST_TIME_WINDOW_HOURS,
@@ -122,9 +123,7 @@ def publish_all_approved(source=None, force_town=None):  # noqa: C901  # inheren
                     source_name=source_name,
                     is_verified=is_verified,
                 )
-                for tag_name in staged.tags:
-                    tag_obj, _ = Tag.objects.get_or_create(name=tag_name.strip().lower())
-                    event.tags.add(tag_obj)
+                apply_tags(event, staged.tags)
                 if staged.category:
                     cat = Category.objects.filter(slug=staged.category).first()
                     if cat:
@@ -271,10 +270,6 @@ def ingest_direct_submission(raw_event_id, user_id):
             f"Direct submission by {organizer}" if organizer else "Direct submission by host"
         )
 
-        tags = []
-        for t in staged.tags:
-            tag_obj, _ = Tag.objects.get_or_create(name=t.strip().lower())
-            tags.append(tag_obj)
         category_obj = (
             Category.objects.filter(slug=staged.category).first() if staged.category else None
         )
@@ -292,7 +287,7 @@ def ingest_direct_submission(raw_event_id, user_id):
             event.source_name = source_name
             event.is_verified = is_verified
             event.save()
-            event.tags.set(tags)
+            apply_tags(event, staged.tags)
             event.categories.clear()
             if category_obj:
                 event.categories.add(category_obj)
@@ -310,7 +305,7 @@ def ingest_direct_submission(raw_event_id, user_id):
                 source_name=source_name,
                 is_verified=is_verified,
             )
-            event.tags.set(tags)
+            apply_tags(event, staged.tags)
             if category_obj:
                 event.categories.add(category_obj)
             staged.published_event = event
diff --git a/backendServer/ingestion/standardizer.py b/backendServer/ingestion/standardizer.py
index 9813b42..5d5d876 100644
--- a/backendServer/ingestion/standardizer.py
+++ b/backendServer/ingestion/standardizer.py
@@ -15,15 +15,10 @@
 logger = logging.getLogger(__name__)
 
 VALID_TAGS = [
-    "weekends-only",
-    "evenings-only",
-    "daytime-only",
     "free",
     "family-friendly",
     "nature",
     "small-business",
-    "lgbtq-friendly",
-    "speaks-spanish",
     "wheelchair-accessible",
     "live-music",
     "food-and-drink",
@@ -58,7 +53,6 @@
 Rules:
 - Only use tags from the provided list. Choose all that apply.
 - If the event is free or price is 0, include "free" in tags.
-- If the event time is evening (after 5pm), include "evenings-only". If daytime (before 5pm), include "daytime-only".
 - Keep descriptions factual — don't invent details that aren't in the raw data.
 - Respond with ONLY the JSON object. No markdown, no backticks, no explanation.
 
diff --git a/backendServer/ingestion/tests/test_direct_submission_db.py b/backendServer/ingestion/tests/test_direct_submission_db.py
index 29233cd..c35c2c8 100644
--- a/backendServer/ingestion/tests/test_direct_submission_db.py
+++ b/backendServer/ingestion/tests/test_direct_submission_db.py
@@ -49,7 +49,7 @@
     "description": "An evening of live jazz music in Carrboro.",
     "location_name": "Cat's Cradle",
     "town": "Carrboro",
-    "tags": ["live-music", "evenings-only"],
+    "tags": ["live-music", "evenings"],
     "price": 0,
 }
 
diff --git a/backendServer/ingestion/tests/test_tagging_db.py b/backendServer/ingestion/tests/test_tagging_db.py
new file mode 100644
index 0000000..6b365a4
--- /dev/null
+++ b/backendServer/ingestion/tests/test_tagging_db.py
@@ -0,0 +1,136 @@
+"""47.2: weekends/evenings/daytime are computed from Event.date, not the LLM.
+Exercises all three write paths that create/update an Event's tags —
+publish_all_approved (pipeline bulk publish), ingest_direct_submission
+(direct-submission publish), and EventSerializer.create (API POST) — plus the
+"computed always wins over supplied" rule shared by all of them.
+"""
+
+import json
+from datetime import UTC, datetime
+from unittest import mock
+
+from django.test import TestCase, tag
+
+from events.models import Event, Town
+from events.serializers import EventSerializer
+from events.tests.factories import make_town, make_user
+from ingestion.models import EventSource, RawEvent, StagedEvent
+from ingestion.services import ingest_direct_submission, publish_all_approved
+
+# 2026-08-15T01:00:00Z is Fri Aug 14, 9:00pm America/New_York — the UTC-trap
+# case: evening + weekend (Friday >= 5pm), not a UTC-calendar Saturday.
+FRIDAY_EVENING_ET_AS_UTC = datetime(2026, 8, 15, 1, 0, tzinfo=UTC)
+
+
+def _gemini_mocks(std_payload, score=0.0):
+    """Same pattern as test_services_db.py / test_direct_submission_db.py: a
+    single patch with side_effect so standardize_event and score_event each
+    get their own fake genai.Client() (both modules share the `genai` object).
+    """
+    fake_std = mock.Mock()
+    fake_std.models.generate_content.return_value = mock.Mock(text=json.dumps(std_payload))
+    fake_scorer = mock.Mock()
+    fake_scorer.models.generate_content.return_value = mock.Mock(
+        text=json.dumps({"score": score, "notes": ""})
+    )
+    return mock.patch(
+        "ingestion.standardizer.genai.Client",
+        side_effect=[fake_std, fake_scorer],
+    )
+
+
+@tag("db")
+class PublishAllApprovedDayPartTagsTests(TestCase):
+    def setUp(self):
+        Town.objects.get_or_create(slug="carrboro", defaults={"name": "Carrboro"})
+
+    def test_bulk_publish_computes_day_part_tags(self):
+        staged = StagedEvent.objects.create(
+            title="Friday Night Show",
+            description="d",
+            location_name="Venue",
+            town="Carrboro",
+            start_datetime=FRIDAY_EVENING_ET_AS_UTC,
+            tags=["free"],
+            status="approved",
+        )
+
+        publish_all_approved()
+
+        event = Event.objects.get(title="Friday Night Show")
+        tag_names = set(event.tags.values_list("name", flat=True))
+        self.assertEqual(tag_names, {"free", "evenings", "weekends"})
+        staged.refresh_from_db()
+        self.assertEqual(staged.published_event, event)
+
+
+@tag("db")
+class DirectSubmissionDayPartTagsTests(TestCase):
+    def setUp(self):
+        make_town(slug="carrboro")
+        self.user = make_user(user_type="BUSINESS")
+        self.source = EventSource.objects.create(
+            name="Direct Feed",
+            source_type="ics",
+            url="https://feed.test/direct.ics",
+        )
+
+    def test_direct_submission_create_branch_computes_day_part_tags(self):
+        raw = RawEvent.objects.create(
+            source=self.source,
+            raw_title="Friday Night Show",
+            raw_description="A show",
+            raw_location="Some Venue, Carrboro, NC",
+            raw_start_datetime=FRIDAY_EVENING_ET_AS_UTC,
+            source_url="",
+            source_uid="direct-uid-friday",
+        )
+        std_payload = {
+            "title": "Friday Night Show",
+            "description": "A show in Carrboro.",
+            "location_name": "Some Venue",
+            "town": "Carrboro",
+            "tags": ["live-music"],
+            "price": 0,
+        }
+
+        with _gemini_mocks(std_payload):
+            event = ingest_direct_submission(raw.id, self.user.id)
+
+        self.assertIsNotNone(event)
+        tag_names = set(event.tags.values_list("name", flat=True))
+        self.assertEqual(tag_names, {"live-music", "evenings", "weekends"})
+
+
+@tag("db")
+class SerializerCreateDayPartTagsTests(TestCase):
+    def setUp(self):
+        self.town = make_town(slug="carrboro")
+
+    def _create_event(self, tags):
+        serializer = EventSerializer(
+            data={
+                "title": "Friday Night Show",
+                "town": self.town.slug,
+                "date": FRIDAY_EVENING_ET_AS_UTC.isoformat(),
+                "venue": "Venue",
+                "description": "desc",
+                "tags": tags,
+                "categories": [],
+            }
+        )
+        self.assertTrue(serializer.is_valid(), serializer.errors)
+        return serializer.save()
+
+    def test_api_create_computes_day_part_tags(self):
+        event = self._create_event(["free"])
+        tag_names = set(event.tags.values_list("name", flat=True))
+        self.assertEqual(tag_names, {"free", "evenings", "weekends"})
+
+    def test_supplied_daytime_is_discarded_in_favor_of_computed_evenings(self):
+        # Fri 9pm ET is unambiguously evening, not daytime — a user (or
+        # stale client) checking "daytime" on this event must not survive.
+        event = self._create_event(["daytime"])
+        tag_names = set(event.tags.values_list("name", flat=True))
+        self.assertNotIn("daytime", tag_names)
+        self.assertIn("evenings", tag_names)
diff --git a/backendServer/templates/docs/pipeline_docs.html b/backendServer/templates/docs/pipeline_docs.html
index fafd23e..4b64f54 100644
--- a/backendServer/templates/docs/pipeline_docs.html
+++ b/backendServer/templates/docs/pipeline_docs.html
@@ -87,9 +87,9 @@ <h2>Phase 2 — Standardize with LLM</h2>
   <h3>Allowed Tags</h3>
   <table>
     <tr><th>Category</th><th>Tags</th></tr>
-    <tr><td>Schedule</td><td><code>weekends-only</code>, <code>evenings-only</code>, <code>daytime-only</code></td></tr>
+    <tr><td>Schedule</td><td><code>weekends</code>, <code>evenings</code>, <code>daytime</code></td></tr>
     <tr><td>Cost</td><td><code>free</code></td></tr>
-    <tr><td>Audience</td><td><code>family-friendly</code>, <code>lgbtq-friendly</code>, <code>speaks-spanish</code></td></tr>
+    <tr><td>Audience</td><td><code>family-friendly</code></td></tr>
     <tr><td>Accessibility</td><td><code>wheelchair-accessible</code></td></tr>
     <tr><td>Activity</td><td><code>live-music</code>, <code>food-and-drink</code>, <code>arts-and-culture</code>, <code>fitness-and-wellness</code>, <code>community-meetup</code>, <code>fundraiser</code>, <code>market-or-fair</code>, <code>workshop-or-class</code></td></tr>
     <tr><td>Business</td><td><code>small-business</code>, <code>nature</code></td></tr>
diff --git a/broadcastExtension/content.js b/broadcastExtension/content.js
index 32778b5..5eaee24 100644
--- a/broadcastExtension/content.js
+++ b/broadcastExtension/content.js
@@ -27,7 +27,13 @@
     return false;
   }
 
+  // Terms from a select2_multi/react_select field that matched nothing in the
+  // destination vocabulary — surfaced in the review banner so a mis-mapped
+  // category never fails silently again (see suite 46.1).
+  const unmatchedTerms = [];
+
   async function runFill(recipe) {
+    unmatchedTerms.length = 0;
     const fields = recipe.fields || [];
     // Some forms render after page "complete"; adapters can specify a
     // ready_selector, otherwise we fall back to the first field.
@@ -43,6 +49,9 @@
         console.warn("Commons Broadcast: field failed", field.selector, e);
       }
     }
+    if (unmatchedTerms.length) {
+      console.warn("Commons Broadcast: unmatched category terms", unmatchedTerms);
+    }
     showBanner(recipe);
     highlightTargets(recipe);
   }
@@ -298,20 +307,47 @@
   }
 
   // select2 result labels sometimes carry a trailing count, e.g.
-  // "Music (12)" — strip it and collapse whitespace before comparing.
+  // "Music (12)" — strip it, normalize a few punctuation variants the verified
+  // vocabularies use (&, /, apostrophes, en-dashes), and collapse whitespace
+  // before comparing.
   function normalizeSelect2Label(text) {
     return (text || "")
       .replace(/\(\d+\)\s*$/, "")
+      .replace(/&/g, "and")
+      .replace(/[’']/g, "")
+      .replace(/[–—]/g, "-")
+      .replace(/\//g, " ")
       .trim()
       .toLowerCase()
       .replace(/\s+/g, " ");
   }
 
+  // Ranked match against a list of option elements: exact normalized match
+  // first, then a prefix match (candidate label starts with the search term).
+  // No substring/token-set fallback — with ABC11's slash-compounds and TW's 62
+  // terms that produces false positives (e.g. "Market" pulling in "Art Market
+  // and Exhibition"), and the corrected category maps make it unnecessary.
+  function bestLabelMatch(options, term, getLabel) {
+    const norm = normalizeSelect2Label(term);
+    if (!norm) return null;
+    let prefix = null;
+    for (const opt of options) {
+      const label = normalizeSelect2Label(getLabel(opt));
+      if (!label) continue;
+      if (label === norm) return opt;
+      if (!prefix && label.startsWith(norm)) prefix = opt;
+    }
+    return prefix;
+  }
+
   // Multi-taxonomy select2 driver (Tribe Events categories). field.value is a
-  // comma-separated list; a term is only chosen on an exact (normalized) label
-  // match — loose substring matching pulled in unrelated site terms (e.g.
-  // "Market" matching "Art Market and Exhibition"). Unmatched terms are
-  // skipped silently, leaving the widget untouched.
+  // comma-separated list; a term is chosen on an exact (normalized) label
+  // match, else a prefix match (see bestLabelMatch) — loose substring matching
+  // pulled in unrelated site terms (e.g. "Market" matching "Art Market and
+  // Exhibition"). The search box never actually filters the AJAX dropdown (it
+  // always renders the full ~62-term vocabulary), so we match against whatever
+  // renders rather than waiting on a query that never fires. Unmatched terms
+  // are reported via unmatchedTerms, never silently dropped.
   async function fillSelect2Multi(field) {
     const terms = (field.value || "")
       .split(",")
@@ -335,7 +371,9 @@
         setNativeValue(searchInput, term);
         searchInput.dispatchEvent(new KeyboardEvent("keyup", { bubbles: true }));
 
-        await sleep(1200);
+        // The typed term never actually filters this dropdown (bug A) — just
+        // wait for it to render, not for a query that won't fire.
+        await sleep(250);
 
         // The dropdown is body-appended.
         const options = [
@@ -343,19 +381,13 @@
             ".select2-dropdown li.select2-results__option:not(.select2-results__option--disabled)"
           ),
         ];
-        const norm = normalizeSelect2Label(term);
-        let match = null;
-        for (const opt of options) {
-          const label = normalizeSelect2Label(opt.textContent);
-          if (label && label === norm) {
-            match = match || opt;
-          }
-        }
+        const match = bestLabelMatch(options, term, (opt) => opt.textContent);
 
         if (match) {
           match.dispatchEvent(new MouseEvent("mouseup", { bubbles: true }));
           await sleep(300); // let select2 register the selection
         } else {
+          unmatchedTerms.push({ field: field.label || field.selector, term });
           document.dispatchEvent(
             new KeyboardEvent("keydown", { key: "Escape", bubbles: true })
           );
@@ -369,9 +401,10 @@
   }
 
   // react-select typeahead driver (ABC11 Category). field.value is a comma-
-  // separated list; a term is only chosen on an exact (normalized) label
-  // match against the controlled vocabulary — unmatched terms are skipped
-  // silently, leaving the widget untouched.
+  // separated list; a term is chosen on an exact (normalized) label match,
+  // else a prefix match (see bestLabelMatch), against the controlled
+  // vocabulary. Unmatched terms are reported via unmatchedTerms, never
+  // silently dropped.
   async function fillReactSelect(field) {
     const terms = (field.value || "")
       .split(",")
@@ -393,13 +426,11 @@
           ...document.querySelectorAll(
             ".customSelect__option, [class*='__option']"
           ),
-        ].filter((o) => (o.textContent || "").trim());
-        const norm = normalizeSelect2Label(term);
-        const match = options.find(
+        ].filter(
           (o) =>
-            o.getAttribute("aria-disabled") !== "true" &&
-            normalizeSelect2Label(o.textContent) === norm
+            (o.textContent || "").trim() && o.getAttribute("aria-disabled") !== "true"
         );
+        const match = bestLabelMatch(options, term, (opt) => opt.textContent);
 
         if (match) {
           // react-select selects on mousedown.
@@ -407,6 +438,8 @@
           match.dispatchEvent(new MouseEvent("mouseup", { bubbles: true }));
           match.click();
           await sleep(300);
+        } else {
+          unmatchedTerms.push({ field: field.label || field.selector, term });
         }
         setNativeValue(input, "");
         await sleep(150);
@@ -463,8 +496,13 @@
     const captcha = recipe.captcha_hint
       ? ` Captcha: ${recipe.captcha_hint}.`
       : "";
+    const unmatched = unmatchedTerms.length
+      ? ` Not found in this site's category list — set manually: ${unmatchedTerms
+          .map((u) => u.term)
+          .join(", ")}.`
+      : "";
     bar.textContent =
-      `The Commons: fields filled.${captcha} Review, solve any captcha, then click Submit yourself.`;
+      `The Commons: fields filled.${captcha}${unmatched} Review, solve any captcha, then click Submit yourself.`;
     Object.assign(bar.style, {
       position: "fixed",
       top: "0",
diff --git a/broadcastWeb/src/App.tsx b/broadcastWeb/src/App.tsx
index a465af4..fa33121 100644
--- a/broadcastWeb/src/App.tsx
+++ b/broadcastWeb/src/App.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useRef, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 
 import EventForm from "./components/EventForm";
 import JobProgress from "./components/JobProgress";
@@ -28,6 +28,8 @@ import {
   redeemAccessCode,
   retryJob,
   retryStuck,
+  SessionExpiredError,
+  setTokenRefreshListener,
   submitReal,
 } from "./services/broadcastApi";
 
@@ -105,7 +107,7 @@ export const unfilledOptionalFields = (draft: EventDraft): string[] => {
   if (!draft.event_url || draft.event_url.trim() === "") missing.push("Event Page URL");
   if (!draft.ticket_url || draft.ticket_url.trim() === "") missing.push("Ticket URL");
   if (!draft.price || draft.price.trim() === "") missing.push("Price");
-  if (!draft.image_url || draft.image_url.trim() === "") missing.push("Image URL");
+  if (!draft.image_url || draft.image_url.trim() === "") missing.push("Event image");
   return missing;
 };
 
@@ -202,6 +204,9 @@ export default function App() {
   const [accessError, setAccessError] = useState("");
   const [showCodeEntry, setShowCodeEntry] = useState(false);
   const [confirmReset, setConfirmReset] = useState(false);
+  // Forces the collapsed step-3 (contact info) summary back open in place —
+  // see the "Edit" control on that summary.
+  const [contactExpanded, setContactExpanded] = useState(false);
 
   const [draft, setDraft] = useState<EventDraft>({
     ...(DRAFT.draft ?? EMPTY_DRAFT),
@@ -258,6 +263,28 @@ export default function App() {
   // Access always requires a login; a verified trial code alone is not enough.
   const hasAccess = signedIn && tier >= 1;
 
+  // broadcastApi transparently remints an expired JWT on a 401/403; keep our
+  // copy in step so the next request doesn't repeat the refresh round-trip.
+  useEffect(() => {
+    setTokenRefreshListener(setJwt);
+    return () => setTokenRefreshListener(null);
+  }, []);
+
+  // A SessionExpiredError means the Better Auth session itself is gone, so a
+  // retry can never succeed — drop the local auth state and send the user back
+  // to sign-in rather than surfacing a raw backend string.
+  const describeError = useCallback((e: unknown, fallback: string): string => {
+    if (e instanceof SessionExpiredError) {
+      setJwt(null);
+      setTier(0);
+      setIsTrial(false);
+      setUsesRemaining(null);
+      setAccessSource(null);
+      return "Your session expired — please sign in again.";
+    }
+    return e instanceof Error ? e.message : fallback;
+  }, []);
+
   useEffect(() => {
     if (session.isPending) return;
     const identity = session.data?.user?.email ?? null;
@@ -581,6 +608,7 @@ export default function App() {
     try {
       const result = await previewBroadcast(auth, toApiEvent(draft));
       setPreview(result);
+      setContactExpanded(false);
       // Coming-soon calendars are shown in the picker but can't be submitted —
       // keep them out of the default selection so they never enter the submit list.
       setSelected(
@@ -591,7 +619,7 @@ export default function App() {
         )
       );
     } catch (e) {
-      setError(e instanceof Error ? e.message : "Preview failed.");
+      setError(describeError(e, "Preview failed."));
     } finally {
       setBusy(false);
     }
@@ -605,7 +633,7 @@ export default function App() {
       await retryJob(auth, jobIdRef.current, siteKeys);
       setJob(await getJob(auth, jobIdRef.current));
     } catch (e) {
-      setError(e instanceof Error ? e.message : "Retry failed.");
+      setError(describeError(e, "Retry failed."));
     } finally {
       setBusy(false);
     }
@@ -618,7 +646,7 @@ export default function App() {
       await submitReal(auth, jobIdRef.current, siteKeys);
       setJob(await getJob(auth, jobIdRef.current));
     } catch (e) {
-      setError(e instanceof Error ? e.message : "Submit failed.");
+      setError(describeError(e, "Submit failed."));
     }
   };
 
@@ -630,7 +658,7 @@ export default function App() {
       await cancelJob(auth, jobIdRef.current);
       setJob(await getJob(auth, jobIdRef.current));
     } catch (e) {
-      setError(e instanceof Error ? e.message : "Cancel failed.");
+      setError(describeError(e, "Cancel failed."));
     } finally {
       setBusy(false);
     }
@@ -696,13 +724,16 @@ export default function App() {
       setSelected(new Set());
       setAiText("");
     } catch (e) {
-      setError(e instanceof Error ? e.message : "AI autofill failed.");
+      setError(describeError(e, "AI autofill failed."));
     } finally {
       setAiBusy(false);
     }
   };
 
   const contactEmailErr = contactEmailError(draft.contact_email);
+  // Contact fields specifically: locked by the reviewed-state lock unless the
+  // user opened them back up via the step-3 "Edit" control.
+  const contactLocked = locked && !contactExpanded;
 
   const draftValid =
     draft.title.trim() !== "" &&
@@ -727,7 +758,11 @@ export default function App() {
   // Access flow: one step active at a time; done steps collapse to a summary
   // line, upcoming steps stay visible but dimmed so the path ahead is clear.
   const step2: "todo" | "active" | "done" = !signedIn ? "todo" : hasAccess ? "done" : "active";
-  const step3: "todo" | "active" | "done" = !hasAccess ? "todo" : preview ? "done" : "active";
+  // contactExpanded lets the collapsed step-3 summary's "Edit" control force
+  // the fields back open without touching the preview/lock state of the rest
+  // of the page — re-collapses on the next successful Preview.
+  const step3: "todo" | "active" | "done" =
+    !hasAccess ? "todo" : preview && !contactExpanded ? "done" : "active";
   const step4: "todo" | "active" = preview ? "active" : "todo";
   const stepClass = (state: "todo" | "active" | "done") => `access-step access-step-${state}`;
 
@@ -855,7 +890,14 @@ export default function App() {
               <p className="step-summary">
                 {draft.organizer_name}
                 {draft.contact_email ? ` · ${draft.contact_email}` : ""}
-                {draft.contact_phone ? ` · ${draft.contact_phone}` : ""}
+                {draft.contact_phone ? ` · ${draft.contact_phone}` : ""}{" "}
+                <button
+                  type="button"
+                  className="linklike"
+                  onClick={() => setContactExpanded(true)}
+                >
+                  Edit
+                </button>
               </p>
             )}
             {step3 === "active" && (
@@ -869,7 +911,7 @@ export default function App() {
                     type="text"
                     value={draft.organizer_name ?? ""}
                     onChange={(e) => handleDraftChange({ ...draft, organizer_name: e.target.value })}
-                    disabled={busy || job !== null || locked}
+                    disabled={busy || job !== null || contactLocked}
                     maxLength={200}
                   />
                 </div>
@@ -883,7 +925,7 @@ export default function App() {
                     type="email"
                     value={draft.contact_email ?? ""}
                     onChange={(e) => handleDraftChange({ ...draft, contact_email: e.target.value })}
-                    disabled={busy || job !== null || locked}
+                    disabled={busy || job !== null || contactLocked}
                   />
                   {contactEmailErr && <p className="field-error">{contactEmailErr}</p>}
                 </div>
@@ -897,7 +939,7 @@ export default function App() {
                     type="tel"
                     value={draft.contact_phone ?? ""}
                     onChange={(e) => handleDraftChange({ ...draft, contact_phone: e.target.value })}
-                    disabled={busy || job !== null || locked}
+                    disabled={busy || job !== null || contactLocked}
                     maxLength={40}
                   />
                 </div>
@@ -950,6 +992,12 @@ export default function App() {
               Talk to support and upgrade your plan to access this feature.
             </p>
           )}
+          {locked && (
+            <p className="section-note">
+              Locked while you&rsquo;re reviewing this event — click &ldquo;Make changes&rdquo;
+              below to edit it again.
+            </p>
+          )}
           {tier >= 2 && !isDraftEmpty(draft) && (
             <p className="section-note">
               Generating will replace the event details below.
@@ -992,6 +1040,12 @@ export default function App() {
           {!isDraftEmpty(draft) && (
             <p className="hint">Draft auto-saved on this device — cleared when you start over.</p>
           )}
+          {locked && (
+            <p className="section-note">
+              Locked while you&rsquo;re reviewing this event — click &ldquo;Make changes&rdquo;
+              below to edit any field.
+            </p>
+          )}
           <EventForm
             draft={draft}
             onChange={handleDraftChange}
diff --git a/broadcastWeb/src/__tests__/App.db.test.tsx b/broadcastWeb/src/__tests__/App.db.test.tsx
index 1461cf9..3b15ce0 100644
--- a/broadcastWeb/src/__tests__/App.db.test.tsx
+++ b/broadcastWeb/src/__tests__/App.db.test.tsx
@@ -51,6 +51,8 @@ vi.mock("../services/broadcastApi", () => ({
       this.status = status;
     }
   },
+  SessionExpiredError: class SessionExpiredError extends Error {},
+  setTokenRefreshListener: vi.fn(),
   authHeaders: () => ({}),
   getAccess: getAccessMock,
   previewBroadcast: vi.fn(async () => ({ eligible: [], excluded: [] })),
@@ -370,3 +372,103 @@ describe("T8: hard reset", () => {
     });
   });
 });
+
+describe("T9: reviewed-state lock and contact-info edit affordance", () => {
+  const draftFixture = {
+    draft_id: "d1",
+    title: "Test Event",
+    description: "Test description",
+    start_datetime: "2026-01-01T10:00",
+    end_datetime: "",
+    all_day: false,
+    venue_name: "Venue",
+    address_line1: "1 Main St",
+    state: "NC",
+    zip: "27701",
+    locality: ["durham"],
+    categories: ["music"],
+    event_url: "",
+    ticket_url: "",
+    price: "",
+    is_free: true,
+    image_url: "",
+    organizer_name: "Acme Org",
+    contact_email: "acme@example.com",
+    contact_phone: "919-555-0100",
+  };
+
+  const renderWithPreview = async () => {
+    localStorage.setItem(
+      "broadcast:draft:v2",
+      JSON.stringify({
+        draft: draftFixture,
+        preview: { eligible: [], excluded: [] },
+        selected: [],
+      }),
+    );
+    // The initial draft state spreads the persisted session's sticky contact
+    // fields *after* the persisted draft (see App.tsx), so the session copy
+    // must agree with the draft fixture or it silently blanks these fields.
+    localStorage.setItem(
+      "broadcast:session:v2",
+      JSON.stringify({
+        organizer_name: draftFixture.organizer_name,
+        contact_email: draftFixture.contact_email,
+        contact_phone: draftFixture.contact_phone,
+      }),
+    );
+    useSessionMock.mockReturnValue({
+      data: { user: { email: "operator@thecommons.town" } },
+      isPending: false,
+    });
+    fetchJwtMock.mockResolvedValue("fake.jwt.token");
+    getAccessMock.mockResolvedValue({ tier: 2, is_trial: false, uses_remaining: null });
+    vi.resetModules();
+    const { default: FreshApp } = await import("../App");
+    return render(<FreshApp />);
+  };
+
+  it("dims the AI Autofill and Event form sections and names Make changes as the unlock", async () => {
+    await renderWithPreview();
+    await waitFor(() => {
+      expect(screen.getByText(/Acme Org/)).toBeInTheDocument();
+    });
+
+    const hints = screen.getAllByText(/Locked while.*reviewing this event/i);
+    expect(hints.length).toBe(2);
+    for (const hint of hints) {
+      expect(hint.textContent).toMatch(/Make changes/);
+    }
+
+    expect(screen.getByPlaceholderText(/Paste an event description/i)).toBeDisabled();
+  });
+
+  it("shows an Edit control on the collapsed contact summary that re-expands the fields in place", async () => {
+    await renderWithPreview();
+    await waitFor(() => {
+      expect(screen.getByText(/Acme Org/)).toBeInTheDocument();
+    });
+
+    // No affordance visible yet besides Edit — fields aren't rendered.
+    expect(screen.queryByLabelText(/Organizer \/ Organization Name/i)).toBeNull();
+
+    // clearDraft/clearSession aren't reset between tests in this file (unlike
+    // the other mocks in beforeEach), so snapshot call counts here rather than
+    // asserting "never called" across the whole suite run.
+    const clearDraftCallsBefore = vi.mocked(clearDraft).mock.calls.length;
+    const clearSessionCallsBefore = vi.mocked(clearSession).mock.calls.length;
+
+    const editButton = screen.getByRole("button", { name: /^Edit$/i });
+    editButton.click();
+
+    const nameInput = await screen.findByLabelText(/Organizer \/ Organization Name/i);
+    expect(nameInput).toHaveValue("Acme Org");
+    expect(nameInput).toBeEnabled();
+    expect(screen.getByLabelText(/Contact Email/i)).toHaveValue("acme@example.com");
+
+    // Reusing "Edit" must not touch the reset/sign-out path.
+    expect(vi.mocked(clearDraft).mock.calls.length).toBe(clearDraftCallsBefore);
+    expect(vi.mocked(clearSession).mock.calls.length).toBe(clearSessionCallsBefore);
+    expect(signOutMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/broadcastWeb/src/services/__tests__/broadcastApiAuthRetry.fast.test.ts b/broadcastWeb/src/services/__tests__/broadcastApiAuthRetry.fast.test.ts
new file mode 100644
index 0000000..9169d2d
--- /dev/null
+++ b/broadcastWeb/src/services/__tests__/broadcastApiAuthRetry.fast.test.ts
@@ -0,0 +1,212 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { EventDraft } from "../../models/broadcastModels";
+
+// vi.hoisted ensures this mock fn reference is available inside the vi.mock
+// factory below (which is hoisted above regular imports).
+const { fetchJwtMock } = vi.hoisted(() => ({
+  fetchJwtMock: vi.fn(async (): Promise<string | null> => null),
+}));
+
+vi.mock("../../lib/authClient", () => ({
+  fetchJwt: fetchJwtMock,
+}));
+
+const EVENT: EventDraft = {
+  draft_id: "draft-uuid-123",
+  title: "Test Event",
+  description: "A description",
+  start_datetime: "2026-10-17T16:00:00.000Z",
+  all_day: false,
+  venue_name: "Some Venue",
+  address_line1: "1 Main St",
+  state: "NC",
+  zip: "27701",
+  locality: ["durham"],
+  categories: ["music"],
+  is_free: true,
+};
+
+const jsonResponse = (
+  body: unknown,
+  { ok = true, status = 200 }: { ok?: boolean; status?: number } = {},
+) => ({ ok, status, json: () => Promise.resolve(body) });
+
+const authHeader = (mock: ReturnType<typeof vi.fn>, callIndex: number): string | undefined => {
+  const [, init] = mock.mock.calls[callIndex] as [string, RequestInit];
+  return (init.headers as Record<string, string>)["Authorization"];
+};
+
+const fetchMock = vi.fn();
+
+beforeEach(() => {
+  fetchMock.mockReset();
+  fetchJwtMock.mockReset();
+  vi.stubGlobal("fetch", fetchMock);
+  vi.spyOn(console, "error").mockImplementation(() => {});
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+});
+
+describe("authFetch retry-on-401/403", () => {
+  it("transparently refreshes an expired JWT and retries the request once", async () => {
+    const { previewBroadcast } = await import("../broadcastApi");
+    const result = { eligible: [{ site_key: "a", name: "A" }], excluded: [] };
+
+    fetchMock
+      .mockResolvedValueOnce(jsonResponse({ detail: "invalid token" }, { ok: false, status: 403 }))
+      .mockResolvedValueOnce(jsonResponse(result));
+    fetchJwtMock.mockResolvedValueOnce("fresh.jwt.token");
+
+    await expect(previewBroadcast({ jwt: "stale.jwt.token" }, EVENT)).resolves.toEqual(result);
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(fetchJwtMock).toHaveBeenCalledTimes(1);
+    expect(authHeader(fetchMock, 0)).toBe("Bearer stale.jwt.token");
+    expect(authHeader(fetchMock, 1)).toBe("Bearer fresh.jwt.token");
+  });
+
+  it("does not retry more than once when the reminted token is also rejected", async () => {
+    const { previewBroadcast } = await import("../broadcastApi");
+
+    fetchMock
+      .mockResolvedValueOnce(jsonResponse({ detail: "invalid token" }, { ok: false, status: 401 }))
+      .mockResolvedValueOnce(jsonResponse({ detail: "still invalid" }, { ok: false, status: 401 }));
+    fetchJwtMock.mockResolvedValueOnce("fresh.jwt.token");
+
+    await expect(previewBroadcast({ jwt: "stale.jwt.token" }, EVENT)).rejects.toMatchObject({
+      status: 401,
+    });
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(fetchJwtMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("surfaces a SessionExpiredError (not a raw ApiError) when the session itself is dead", async () => {
+    const { previewBroadcast, SessionExpiredError, ApiError } = await import("../broadcastApi");
+
+    // 401 is unambiguous (this backend never uses it for a business denial —
+    // only 403 is overloaded that way), so a failed refresh on a 401 is
+    // reported as a session problem.
+    fetchMock.mockResolvedValueOnce(jsonResponse({}, { ok: false, status: 401 }));
+    fetchJwtMock.mockResolvedValueOnce(null);
+
+    const error = await previewBroadcast({ jwt: "stale.jwt.token" }, EVENT).catch((e) => e);
+
+    expect(error).toBeInstanceOf(SessionExpiredError);
+    expect(error).not.toBeInstanceOf(ApiError);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not retry and preserves the original ApiError when a 403's refresh returns the SAME token", async () => {
+    const { previewBroadcast, ApiError } = await import("../broadcastApi");
+
+    fetchMock.mockResolvedValueOnce(
+      jsonResponse(
+        { detail: "This access code has expired — please contact support." },
+        { ok: false, status: 403 },
+      ),
+    );
+    fetchJwtMock.mockResolvedValueOnce("stale.jwt.token");
+
+    const error = await previewBroadcast({ jwt: "stale.jwt.token" }, EVENT).catch((e) => e);
+
+    expect(error).toBeInstanceOf(ApiError);
+    expect(error).toMatchObject({
+      status: 403,
+      message: "This access code has expired — please contact support.",
+    });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchJwtMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not retry and preserves the original ApiError when a 403's refresh itself fails (null)", async () => {
+    const { previewBroadcast, ApiError, SessionExpiredError } = await import("../broadcastApi");
+
+    fetchMock.mockResolvedValueOnce(
+      jsonResponse(
+        { detail: "This access code has expired — please contact support." },
+        { ok: false, status: 403 },
+      ),
+    );
+    fetchJwtMock.mockResolvedValueOnce(null);
+
+    const error = await previewBroadcast({ jwt: "stale.jwt.token" }, EVENT).catch((e) => e);
+
+    expect(error).toBeInstanceOf(ApiError);
+    expect(error).not.toBeInstanceOf(SessionExpiredError);
+    expect(error).toMatchObject({
+      status: 403,
+      message: "This access code has expired — please contact support.",
+    });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not attempt a refresh for access-code auth (no JWT to expire)", async () => {
+    const { previewBroadcast } = await import("../broadcastApi");
+
+    fetchMock.mockResolvedValueOnce(jsonResponse({ detail: "bad code" }, { ok: false, status: 403 }));
+
+    await expect(previewBroadcast({ accessCode: "CODE" }, EVENT)).rejects.toMatchObject({
+      status: 403,
+    });
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(fetchJwtMock).not.toHaveBeenCalled();
+  });
+
+  it("calls the registered token-refresh listener with the reminted JWT", async () => {
+    const { previewBroadcast, setTokenRefreshListener } = await import("../broadcastApi");
+    const listener = vi.fn();
+    setTokenRefreshListener(listener);
+
+    fetchMock
+      .mockResolvedValueOnce(jsonResponse({}, { ok: false, status: 401 }))
+      .mockResolvedValueOnce(jsonResponse({ eligible: [], excluded: [] }));
+    fetchJwtMock.mockResolvedValueOnce("fresh.jwt.token");
+
+    await previewBroadcast({ jwt: "stale.jwt.token" }, EVENT);
+
+    expect(listener).toHaveBeenCalledWith("fresh.jwt.token");
+    setTokenRefreshListener(null);
+  });
+
+  it("single-flight: concurrent 401s share exactly one refresh call", async () => {
+    const { previewBroadcast, getJob } = await import("../broadcastApi");
+
+    let resolveRefresh!: (token: string) => void;
+    fetchJwtMock.mockImplementationOnce(
+      () => new Promise<string | null>((resolve) => (resolveRefresh = resolve)),
+    );
+
+    // Every call in this test 401s until the reminted token shows up in the
+    // Authorization header, so each of the three concurrent requests below
+    // resolves on its own retry rather than needing per-call mock sequencing.
+    fetchMock.mockImplementation((_url: string, init?: RequestInit) => {
+      const authz = (init?.headers as Record<string, string> | undefined)?.["Authorization"];
+      if (authz === "Bearer fresh.jwt.token") {
+        return Promise.resolve(jsonResponse({ eligible: [], excluded: [] }));
+      }
+      return Promise.resolve(jsonResponse({}, { ok: false, status: 401 }));
+    });
+
+    const auth = { jwt: "stale.jwt.token" };
+    const p1 = previewBroadcast(auth, EVENT);
+    const p2 = previewBroadcast(auth, EVENT);
+    const p3 = getJob(auth, "job-1");
+
+    // Let all three requests make their initial (401'd) fetch and call into
+    // refreshJwt() before the in-flight refresh resolves.
+    await Promise.resolve();
+    await Promise.resolve();
+    await Promise.resolve();
+
+    resolveRefresh("fresh.jwt.token");
+
+    await expect(Promise.all([p1, p2, p3])).resolves.toBeDefined();
+    expect(fetchJwtMock).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/broadcastWeb/src/services/broadcastApi.ts b/broadcastWeb/src/services/broadcastApi.ts
index 49e91a9..1956ef3 100644
--- a/broadcastWeb/src/services/broadcastApi.ts
+++ b/broadcastWeb/src/services/broadcastApi.ts
@@ -1,7 +1,15 @@
 // Mirrors the house service pattern (theCommonsWeb/src/services/eventService.ts):
 // plain fetch per call, response.ok checks, no shared client wrapper.
 // Auth is passed per request via ApiAuth (Bearer JWT wins over access-code header).
+//
+// The SPA mints its JWT once on mount and holds it in memory for the whole
+// session (see App.tsx), so it eventually expires mid-session — the backend
+// then returns 401/403 (backendServer/broadcast/access.py deliberately does
+// NOT fall through to the access-code path for a present-but-invalid JWT).
+// authFetch() below transparently remints the token and retries once, so an
+// expired token never surfaces as a user-visible error.
 
+import { fetchJwt } from "../lib/authClient";
 import type { EventDraft, JobDetail, PreviewResult, Recipe } from "../models/broadcastModels";
 
 const RAW_BASE =
@@ -31,6 +39,18 @@ export class ApiError extends Error {
   }
 }
 
+// Distinguishable from ApiError so callers can branch on it (e.g. prompt the
+// user to sign in again) instead of rendering a raw backend error string.
+// Thrown only when a JWT-authenticated request fails auth and the follow-up
+// fetchJwt() also comes back empty — i.e. the Better Auth session itself is
+// gone, not just the in-memory token.
+export class SessionExpiredError extends Error {
+  constructor() {
+    super("Your session has expired. Please sign in again.");
+    this.name = "SessionExpiredError";
+  }
+}
+
 // Bearer JWT wins over the access-code header; neither = no auth header.
 export type ApiAuth = { jwt?: string; accessCode?: string };
 
@@ -40,6 +60,73 @@ export function authHeaders(auth: ApiAuth): Record<string, string> {
   return {};
 }
 
+// App.tsx mints the JWT once on mount and holds it in state; when authFetch
+// remints a token behind the scenes, this lets App.tsx learn about it so the
+// *next* request doesn't immediately have to repeat the refresh dance. Purely
+// an optional hook — nothing here depends on it being registered.
+type TokenRefreshListener = (jwt: string) => void;
+let tokenRefreshListener: TokenRefreshListener | null = null;
+export function setTokenRefreshListener(listener: TokenRefreshListener | null): void {
+  tokenRefreshListener = listener;
+}
+
+// Single-flight: concurrent requests that all 401/403 together share one
+// in-flight fetchJwt() call instead of each minting their own token.
+let inFlightRefresh: Promise<string | null> | null = null;
+function refreshJwt(): Promise<string | null> {
+  if (!inFlightRefresh) {
+    inFlightRefresh = fetchJwt().finally(() => {
+      inFlightRefresh = null;
+    });
+  }
+  return inFlightRefresh;
+}
+
+// Wraps every authenticated fetch. On a 401/403 for a JWT-bearing request,
+// remints the token once and retries the same request; any other outcome
+// (access-code auth, non-auth-error status) passes through untouched. Retried
+// at most once — a failure on the retry is surfaced as-is by the caller.
+//
+// A 403 is ambiguous: the backend uses it both for a stale/invalid JWT (a
+// refresh fixes this) and for a legitimate business denial like an expired
+// access code (no refresh will ever fix this, and its `detail` message is
+// the whole point — see backendServer/broadcast/views.py:369-381). The
+// response body can't be trusted to tell those apart, but the token can:
+//   - refresh comes back with a DIFFERENT token → the token really was
+//     stale → retry once with the new token.
+//   - refresh comes back with the SAME token we just sent → the token was
+//     never the problem → leave the original response's error (status +
+//     backend detail) to surface as-is instead of masking it.
+//   - refresh comes back null → the Better Auth session itself is gone.
+//     For a 401 that's unambiguous (401 never carries business meaning on
+//     this backend — grep confirms it's never emitted), so it's reported as
+//     a session problem. A 403 is inherently ambiguous, though, and a failed
+//     refresh doesn't tell us *why* it failed — it never proves the 403 was
+//     a token issue, so the original response (with whatever business
+//     detail it carries) is left to surface rather than guessing.
+async function authFetch(url: string, init: RequestInit, auth: ApiAuth): Promise<Response> {
+  const response = await fetch(url, init);
+  if ((response.status !== 401 && response.status !== 403) || !auth.jwt) {
+    return response;
+  }
+  const sentJwt = auth.jwt;
+  const newJwt = await refreshJwt();
+  if (newJwt === null) {
+    if (response.status === 401) {
+      throw new SessionExpiredError();
+    }
+    return response;
+  }
+  if (newJwt === sentJwt) {
+    return response;
+  }
+  tokenRefreshListener?.(newJwt);
+  return fetch(url, {
+    ...init,
+    headers: { ...(init.headers as Record<string, string>), Authorization: `Bearer ${newJwt}` },
+  });
+}
+
 const messageFor = (status: number, body: unknown): string => {
   // Prefer the backend's own `detail` (e.g. an expired/exhausted access code)
   // so the specific message reaches the user instead of a generic 403 string.
@@ -54,11 +141,15 @@ const messageFor = (status: number, body: unknown): string => {
 };
 
 async function post<T>(path: string, auth: ApiAuth, payload: object): Promise<T> {
-  const response = await fetch(`${API_BASE}${path}`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", ...authHeaders(auth) },
-    body: JSON.stringify(payload),
-  });
+  const response = await authFetch(
+    `${API_BASE}${path}`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...authHeaders(auth) },
+      body: JSON.stringify(payload),
+    },
+    auth,
+  );
   const body = await response.json().catch(() => ({}));
   if (!response.ok) {
     console.error(`POST ${path} failed:`, response.status, body);
@@ -70,9 +161,7 @@ async function post<T>(path: string, auth: ApiAuth, payload: object): Promise<T>
 export const getAccess = async (
   auth: ApiAuth,
 ): Promise<{ tier: 0 | 1 | 2; is_trial: boolean; uses_remaining: number | null }> => {
-  const response = await fetch(`${API_BASE}/broadcast/access`, {
-    headers: authHeaders(auth),
-  });
+  const response = await authFetch(`${API_BASE}/broadcast/access`, { headers: authHeaders(auth) }, auth);
   const body = await response.json().catch(() => ({}));
   if (!response.ok) {
     console.error("GET /broadcast/access failed:", response.status, body);
@@ -110,9 +199,11 @@ export const getJob = async (
   auth: ApiAuth,
   jobId: string,
 ): Promise<JobDetail> => {
-  const response = await fetch(`${API_BASE}/broadcast/jobs/${jobId}`, {
-    headers: authHeaders(auth),
-  });
+  const response = await authFetch(
+    `${API_BASE}/broadcast/jobs/${jobId}`,
+    { headers: authHeaders(auth) },
+    auth,
+  );
   const body = await response.json().catch(() => ({}));
   if (!response.ok) {
     console.error(`GET job ${jobId} failed:`, response.status);
@@ -162,11 +253,11 @@ export const uploadImage = async (
 ): Promise<{ url: string }> => {
   const formData = new FormData();
   formData.append("image", file);
-  const response = await fetch(`${API_BASE}/broadcast/upload-image`, {
-    method: "POST",
-    headers: authHeaders(auth),
-    body: formData,
-  });
+  const response = await authFetch(
+    `${API_BASE}/broadcast/upload-image`,
+    { method: "POST", headers: authHeaders(auth), body: formData },
+    auth,
+  );
   const body = await response.json().catch(() => ({}));
   if (!response.ok) {
     console.error("POST /broadcast/upload-image failed:", response.status, body);
@@ -220,9 +311,10 @@ export const getManualRecipe = async (
   jobId: string,
   siteKey: string,
 ): Promise<Recipe> => {
-  const response = await fetch(
+  const response = await authFetch(
     `${API_BASE}/broadcast/jobs/${jobId}/manual/${siteKey}`,
     { headers: authHeaders(auth) },
+    auth,
   );
   const body = await response.json().catch(() => ({}));
   if (!response.ok) {
@@ -238,9 +330,11 @@ export const openScreenshot = async (
   auth: ApiAuth,
   screenshotPath: string,
 ): Promise<void> => {
-  const response = await fetch(`${API_BASE}${screenshotPath}`, {
-    headers: authHeaders(auth),
-  });
+  const response = await authFetch(
+    `${API_BASE}${screenshotPath}`,
+    { headers: authHeaders(auth) },
+    auth,
+  );
   if (!response.ok) {
     console.error("screenshot fetch failed:", response.status);
     throw new ApiError(response.status, "Could not load the screenshot.");
diff --git a/docs/broadcast.md b/docs/broadcast.md
index 9b26305..6270417 100644
--- a/docs/broadcast.md
+++ b/docs/broadcast.md
@@ -145,13 +145,22 @@ Two independent code pools, distinguished by `AccessCode.kind`:
 | **1** | `BroadcastAccess.tier=1` — via `set_broadcast_access` or a tier-1 UPGRADE code | ✓ | ✗ |
 | **2** | `BroadcastAccess.tier=2` (dev-granted or UPGRADE code), or any valid TRIAL code | ✓ | ✓ |
 
+`resolve_access` (the API layer) will grant tier 2 to a bare TRIAL code with no login at all — that's true of the header/body auth path used by `curl` or any external caller. It is **not** true of the SPA: the SPA has no logged-out entry point to the access-code field (see Frontend below), so in practice every code — TRIAL or UPGRADE — is entered only after signing in. Handing someone a TRIAL code is not, by itself, enough to get them broadcasting through the UI; they also need an account.
+
 Permission classes: `RequiresBroadcastTier1` (preview / submit / recipe / job endpoints), `RequiresBroadcastTier2` (ai-autofill only), `RequiresBroadcastLogin` (redeem only — no tier check, just a valid JWT; stamps `request.broadcast_email`). The tier classes stamp `request.broadcast_access` (`AccessResult`) and `request.broadcast_client_label` for downstream views.
 
 **Metering:** TRIAL codes are metered **only at `POST /broadcast/preview`** — `AccessCodeUse.objects.get_or_create(code, draft_id)` (idempotent). Trial callers must include `draft_id` in the preview body; missing → 400. Re-submitting the same `draft_id` (edits) is free. UPGRADE codes are metered by distinct redeeming email (`AccessCodeRedemption`), checked in `redeem_upgrade_code`. Logged-in JWT sessions are never metered on preview.
 
 **`client_label`** on `BroadcastSubmission`: email for JWT users; `AccessCode.label` for TRIAL-code users. Access codes are stored only in the database — there is no env-var code list. `GET /broadcast/access` lets the SPA query the caller's tier and remaining trial uses (JWT or TRIAL code); `POST /broadcast/redeem` is how a logged-in user applies an UPGRADE code.
 
-**Frontend (`broadcastWeb`):** one textfield does double duty, labeled by login state — logged out it's "Access Code" (`getAccess`, anonymous TRIAL resolution, persisted in localStorage); logged in it relabels to "Upgrade Account" (`redeemAccessCode` → `POST /broadcast/redeem`, permanent, nothing persisted client-side since the grant now lives server-side against the account).
+**Frontend (`broadcastWeb`):** access always requires signing in first — the access-code field only renders in step 2 of the "Access" section (`App.tsx`), which is gated behind step 1 ("Sign in"; `step2` is `"todo"` while `!signedIn`). There is no logged-out entry point to the field. The label is static regardless of sign-in state or tier — it never relabels. The live copy (verified on prod 2026-08-03):
+
+- heading: "Enter your access code"
+- link (to re-open the field after a code is already verified): "Have another code?"
+- placeholder: "Provided by The Commons"
+- button: "Verify"
+
+One code box, two code kinds under the hood: `handleVerifyCode` first tries the entered code as an UPGRADE code (`redeemAccessCode` → `POST /broadcast/redeem`, requires the caller's JWT, permanent grant on the account); if the backend 403s that, it retries the same code as a TRIAL code (`getAccess({ accessCode })`, anonymous per-request resolution at the API layer, but only ever invoked here from an already-authenticated session). Either way the user sees one Verify step — the SPA never surfaces which kind matched.
 
 **Sign-in:** there is no embedded auth UI in the SPA (the former inline `AuthModal` component was removed). The "Sign in / Create account" button (`App.tsx`'s `handleSignIn`) does a full-page navigation to `${VITE_BETTER_AUTH_URL}/signin?redirect_to=<current broadcast URL>` — i.e. the shared auth **portal** (`theCommonsWeb`'s `src/app/(portal)/`, served at `https://auth.thecommons.town` in prod / `http://localhost:3000` in dev; see [ARCHITECTURE.md#authentication](../ARCHITECTURE.md#authentication)). Because the session cookie is scoped to `.thecommons.town`, completing sign-in in the portal returns the browser to the exact broadcast URL it left, already authenticated. `broadcastWeb/src/lib/authClient.ts` still exists — it's the Better Auth client used to read the session, mint a JWT (`fetchJwt`), and call `signOut()`, not to render any sign-in form.
 
diff --git a/docs/ingestion-pipeline.md b/docs/ingestion-pipeline.md
index 1310794..5706a44 100644
--- a/docs/ingestion-pipeline.md
+++ b/docs/ingestion-pipeline.md
@@ -98,9 +98,9 @@ Runs on all `RawEvent` records where `processed=False`.
 
 | Category | Tags |
 |---|---|
-| Schedule | `weekends-only`, `evenings-only`, `daytime-only` |
+| Schedule | `weekends`, `evenings`, `daytime` |
 | Cost | `free` |
-| Audience | `family-friendly`, `lgbtq-friendly`, `speaks-spanish` |
+| Audience | `family-friendly` |
 | Accessibility | `wheelchair-accessible` |
 | Activity | `live-music`, `food-and-drink`, `arts-and-culture`, `fitness-and-wellness`, `community-meetup`, `fundraiser`, `market-or-fair`, `workshop-or-class` |
 | Business | `small-business`, `nature` |
diff --git a/human-docs/README.md b/human-docs/README.md
index 8fc475c..342d458 100644
--- a/human-docs/README.md
+++ b/human-docs/README.md
@@ -25,8 +25,8 @@ still to be written.
 | [broadcast.md](broadcast.md) | Syndicating events out to other towns' calendars: adapters, extension autofill, access codes | 2026-08-01 |
 | [newsletter.md](newsletter.md) | Subscription lifecycle, recipient resolution, and the weekly/monthly digest engine | 2026-08-01 |
 | [async-jobs.md](async-jobs.md) | Redis layout, the three Celery queues and who drains each, beat scheduling and its lag trap | 2026-08-01 |
-| [deploy-ops.md](deploy-ops.md) | Production mental model: the VM, systemd units, deploys, and the sharp edges that cause outages | 2026-08-01 |
-| [containerization.md](containerization.md) | **Provisional** — the in-flight Docker cutover: built and locally verified, not yet deployed | 2026-08-01 |
+| [deploy-ops.md](deploy-ops.md) | Production mental model: the VM, the Docker Compose stack, deploys, and the sharp edges that cause outages | 2026-08-03 |
+| [containerization.md](containerization.md) | Why and how the stack is containerized: service topology, the retired-systemd mapping, and the live footguns | 2026-08-03 |
 | [frontend.md](frontend.md) | Main site: App Router routes, the TanStack Query data layer, Better Auth on the client | 2026-08-01 |
 | [design-system.md](design-system.md) | The digital-newspaper aesthetic as an enforceable spec — tokens, type scale, the banned list | 2026-08-01 |
 | [testing.md](testing.md) | Local setup, the backend test tiers, the shared-test-DB hazard, and what CI runs | 2026-08-01 |
diff --git a/human-docs/async-jobs.md b/human-docs/async-jobs.md
index 45c6e33..51458be 100644
--- a/human-docs/async-jobs.md
+++ b/human-docs/async-jobs.md
@@ -1,6 +1,8 @@
 # Async: Redis + Celery
 
-Written 2026-08-01 against commit `5fe7a45`. This is the human-facing companion to
+> **Last updated:** 2026-08-03, commit `9a38379`, branch `suite-47-tags-and-filters`
+
+This is the human-facing companion to
 [`docs/redis-celery-handoff.md`](../docs/redis-celery-handoff.md) (the agent-facing deep
 dive — stays the system of record for exact settings names, migration mechanics, and prod
 provisioning commands) and touches on the same incident [`docs/ingestion-monitoring.md`](../docs/ingestion-monitoring.md)
@@ -20,9 +22,41 @@ containers. None of that is cut over yet. This doc describes the systemd units
 actually running in production today. The containerized version is covered by a sibling
 doc, `containerization.md`, once it exists.
 
+## Overview
+
+- **What it is.** Redis + Celery is how The Commons runs everything that isn't a live
+  HTTP request/response: nightly event ingestion, weekly/monthly email digests,
+  bulk-publishing approved events, and pushing submitted events out to third-party
+  town calendars (broadcast). Redis DB 0 is the Celery broker/result backend; Redis
+  DB 1 is the unrelated Django page cache — a `FLUSHALL` takes out both, but nothing
+  else couples them.
+- **Who depends on it.** Ingestion and the newsletter digest engine depend on it
+  visibly — if beat or the default worker is down, new events stop arriving and
+  digests stop sending. Broadcast depends on it too, less visibly: `ARCHITECTURE.md`
+  currently claims broadcast doesn't use Celery, which is **stale** — it runs two real
+  Celery tasks on their own `broadcast` queue.
+- **The one fact that matters most.** If this whole layer goes down, nothing crashes
+  in the request path — events just quietly stop flowing and broadcast submissions sit
+  forever at `status="queued"`. That silence is why `manage.py healthcheck` (Deep Dive
+  § 2.4) matters as much as knowing how to add a task.
+- **Three named queues**, each with its own worker process: `default` (network-bound
+  work, `-c 2`), `scrape`, and `broadcast` (both headless-Chromium/Playwright work,
+  `-c 1` each — see Deep Dive § 2.1 for why `broadcast`'s `-c 1` is a correctness
+  requirement, not a tuning knob).
+- **Schedules live in Postgres, not in a settings file** — `django-celery-beat` reads
+  `CrontabSchedule`/`PeriodicTask` rows seeded once by a migration, then editable live
+  in the admin. See Deep Dive § 2.2 for how to change a schedule, and § 2.3–2.4 for the
+  known `last_run_at` persistence-lag sharp edge and how the healthcheck works around it.
+- **Where to go for a task:** adding a new background job → Deep Dive § 4 ("Adding a
+  new periodic task, correctly"); a scheduled job didn't run → Deep Dive § 2.4 and § 5;
+  understanding the broadcast/ingestion/digest task list → Deep Dive § 4's tables;
+  known doc drift → Deep Dive § 6.
+
+## Deep Dive
+
 ---
 
-## 1. What this is and who depends on it
+### 1. What this is and who depends on it
 
 The Commons runs almost everything that isn't an HTTP request/response cycle through
 Celery: the nightly ingestion pipeline, weekly and monthly email digests, bulk-publishing
@@ -54,7 +88,7 @@ silence is exactly why the healthcheck section later in this doc matters as much
 
 ---
 
-## 2. How it works
+### 2. How it works
 
 ### 2.1 Queue and worker topology
 
@@ -278,7 +312,7 @@ flowchart TD
 
 ---
 
-## 3. Data model
+### 3. Data model
 
 There's no domain data model here in the usual sense — the state this layer owns is
 scheduling and caching metadata, not business data:
@@ -298,7 +332,7 @@ involved in cache invalidation at all.
 
 ---
 
-## 4. Interfaces
+### 4. Interfaces
 
 ### Periodic (beat-scheduled) tasks — the live schedule as seeded
 
@@ -372,7 +406,7 @@ worker that isn't there.
 
 ---
 
-## 5. Sharp edges
+### 5. Sharp edges
 
 **`CELERY_BEAT_MAX_LOOP_INTERVAL` (6 hours) and `CELERY_BEAT_SYNC_EVERY` (1) work together,
 and tuning one without the other silently reopens a monitoring blind spot.** Both live in
@@ -418,7 +452,7 @@ admin. § 2.2 covers how to check the live truth.
 
 ---
 
-## 6. Known gaps and doc drift
+### 6. Known gaps and doc drift
 
 - **`ARCHITECTURE.md`'s Broadcast section is stale**, per § 1 above — it says broadcast
   "does not use Celery," which was true before the queue-drain and orphan-recovery logic
diff --git a/human-docs/auth.md b/human-docs/auth.md
index 94ae72f..4bc50f6 100644
--- a/human-docs/auth.md
+++ b/human-docs/auth.md
@@ -1,15 +1,49 @@
 # The Auth Bridge — Better Auth and Django
 
-*Reflects commit `5fe7a45`, 2026-08-01. Written by reading `backendServer/accounts/` (models,
-admin, urls, views, migrations), `backendServer/backend/jwt_auth.py`,
-`backendServer/backend/permissions.py`, `backendServer/backend/settings/` (`__init__.py`,
-`base.py`, `dev.py`, `prod.py`), `theCommonsWeb/src/lib/auth.ts`, `auth-schema.ts`,
-`auth-client.ts`, `db.ts`, `theCommonsWeb/src/hooks/useAuth.tsx`, the portal route group
-(`src/app/(portal)/`), `src/app/reset-password/`, `src/lib/redirect-allowlist.ts`, and
-`broadcastWeb/src/App.tsx`. Complements `ARCHITECTURE.md`'s Authentication section, which is
-also current as of this commit; the two shouldn't drift, and if they ever do, trust the code.
-Companion docs referenced below: `overview.md` (system map), `data-model.md` (full schema),
-`deploy-ops.md` (VM/nginx/systemd), `frontend.md` (Next.js app structure).*
+> **Last updated:** 2026-08-03, commit `9a38379`, branch `suite-47-tags-and-filters`. Previously
+> reflected commit `d66b059` (branch `main`, 2026-08-03), which itself succeeded commit `5fe7a45`
+> (2026-08-01). Originally written by reading `backendServer/accounts/` (models, admin, urls,
+> views, migrations), `backendServer/backend/jwt_auth.py`, `backendServer/backend/permissions.py`,
+> `backendServer/backend/settings/` (`__init__.py`, `base.py`, `dev.py`, `prod.py`),
+> `theCommonsWeb/src/lib/auth.ts`, `auth-schema.ts`, `auth-client.ts`, `db.ts`,
+> `theCommonsWeb/src/hooks/useAuth.tsx`, the portal route group (`src/app/(portal)/`),
+> `src/app/reset-password/`, `src/lib/redirect-allowlist.ts`, and `broadcastWeb/src/App.tsx`.
+> Complements `ARCHITECTURE.md`'s Authentication section, which is also current as of that
+> commit; the two shouldn't drift, and if they ever do, trust the code. Companion docs
+> referenced below: `overview.md` (system map), `data-model.md` (full schema), `deploy-ops.md`
+> (VM/nginx/systemd), `frontend.md` (Next.js app structure).
+
+## Overview
+
+- **Django does not own user accounts.** There is no `django.contrib.auth.User` for app users,
+  no Django login view, no Django-issued session. Identity lives entirely inside the Next.js app
+  (`theCommonsWeb`), owned by an embedded library called **Better Auth**. Django keeps a
+  read-only mirror of Better Auth's tables so it can `JOIN` against them, and it verifies tokens
+  Better Auth issued — it never creates a user, checks a password, or invalidates a session.
+- **Three things depend on this bridge**: the main site (needs a live Better Auth session for
+  the UI plus a JWT to call Django's API), the broadcast SPA (`broadcastWeb`, a separate app on
+  its own subdomain that shares the same Better Auth session via a cross-subdomain cookie), and
+  Django itself (`BearerTokenAuthentication` gates nearly every non-public DRF view — if JWT
+  verification breaks, those views start rejecting real users).
+- **The one fact to remember:** sign-in/sign-up happens entirely in Next.js; Django only ever
+  sees a short-lived JWT, fetched fresh on every page load (never persisted client-side), and
+  verifies it locally against Better Auth's published JWKS keys — no callback to Next.js, no
+  Django session, no CSRF.
+- **If this bridge is down**, users can typically still sign in on the frontend (Better Auth
+  doesn't depend on Django), but every page that calls the Django API for personalized data —
+  profile, dashboard, event submission, business listings, all of `broadcast/` — starts failing
+  or serving generic/anonymous responses.
+- **Where to jump in Deep Dive**, by task:
+  - Understanding sign-in/sign-up end to end, cross-subdomain cookies, or the JWT-never-stored
+    pattern → §2.1.
+  - Debugging a 401/403 on a protected endpoint, or anything JWKS-related → §2.2 and Sharp edge 1.
+  - Looking up a specific table, model, or the `neon_auth` schema-crossing trick → §3.
+  - Wiring a new authenticated endpoint, or explaining a 401 vs. 403 to a bug reporter → §4.
+  - `DJANGO_ENV` misconfiguration, the passwordless-account rollover, or the `UUIDField` history
+    → §5.
+  - What's still unverified or unfinished (Google sign-in, email verification, prod nginx) → §6.
+
+## Deep Dive
 
 The single fact that matters more than any other in this codebase: **Django does not own user
 accounts.** There is no `django.contrib.auth.User` for app users, no Django login view, no
@@ -22,7 +56,7 @@ about to add a login endpoint to Django, or wondering why `python manage.py crea
 doesn't create an account regular users can sign in with, that's the inversion this doc exists
 to correct.
 
-## 1. What this is and who depends on it
+### 1. What this is and who depends on it
 
 Two systems share one identity: **Better Auth**, running inside `theCommonsWeb`'s Next.js
 process, and Django's `accounts` app, which mirrors Better Auth's tables just enough to join
@@ -48,9 +82,9 @@ depend on Django), but every page that calls the Django API for personalized dat
 dashboard, event submission, business listings, all of `broadcast/` — starts failing or serving
 generic/anonymous responses.
 
-## 2. How it works
+### 2. How it works
 
-### 2.1 Signing in or creating an account
+#### 2.1 Signing in or creating an account
 
 Every place in the product that needs a user to authenticate — the main site's header, the
 broadcast SPA's "Sign in" button, the old `/auth` legacy routes — does the same thing: a full
@@ -126,7 +160,7 @@ sequenceDiagram
    (`socialProviders.google`) but is commented out; there's no passwordless flow left either
    (see Sharp edge 4).
 
-### 2.2 Django verifying a Bearer JWT against JWKS
+#### 2.2 Django verifying a Bearer JWT against JWKS
 
 This is the other half of the bridge, and the one that actually enforces anything: every
 protected DRF view in this repo uses `BearerTokenAuthentication`
@@ -185,7 +219,7 @@ sequenceDiagram
    anything outside itself. It gets back claims, not a Django user object, and resolves an
    access tier from the email claim instead.
 
-## 3. Data model
+### 3. Data model
 
 `accounts` owns two kinds of tables: five **Better Auth mirrors** it never writes to, and two
 **Django-owned profile tables** that hang off them.
@@ -209,7 +243,7 @@ character; it isn't one.
 The full event/newsletter/ingestion/broadcast schema (and how those tables relate to the ones
 here) is `data-model.md`'s job, not this doc's — this table only covers the identity slice.
 
-## 4. Interfaces
+### 4. Interfaces
 
 | Method | Path | Auth | Notes |
 |---|---|---|---|
@@ -226,7 +260,7 @@ no Django session auth and no CSRF token involved, by design (see §1). A reques
 `user_type` (e.g. a LOCAL account calling `POST /businesses`) gets `403`, not `401` — worth
 knowing when a bug report says "I'm logged in but I get an error."
 
-## 5. Sharp edges
+### 5. Sharp edges
 
 **1. The JWKS fetch needs a browser-like User-Agent, or every JWT verification fails.**
 Cloudflare sits in front of the auth origin and 403s the default `python-urllib` User-Agent that
@@ -323,7 +357,7 @@ physically exactly where it was. A newcomer skimming that migration file and ass
 those tables would be wrong in a way that matters if they ever try to reason about what
 `migrate` did or didn't touch.
 
-## 6. Known gaps
+### 6. Known gaps
 
 - **The passwordless-rollover command and its guardrail test still live under `events/`, not
   `accounts/`**, even though they exist entirely to work around a bug in `accounts.models`.
diff --git a/human-docs/broadcast.md b/human-docs/broadcast.md
index 95b4eaa..6e26c14 100644
--- a/human-docs/broadcast.md
+++ b/human-docs/broadcast.md
@@ -1,19 +1,48 @@
 # Broadcast — Pushing Events Out
 
-Written 2026-08-01 against commit `5fe7a45`. This is the human-facing companion to
-[`docs/broadcast.md`](../docs/broadcast.md), which stays the system of record — the exact
-model fields, every API endpoint's rate limit, the full adapter list, environment variables,
-and management commands all live there in more detail than belongs here. Read this first for
-orientation, then go to `docs/broadcast.md` for anything precise. Where the two disagree, the
-code (and `docs/broadcast.md`, which was re-verified against it) wins — this doc calls out the
-one place that matters below.
+> **Last updated:** 2026-08-03, commit `9a38379`, branch `suite-47-tags-and-filters`
+
+This is the human-facing companion to [`docs/broadcast.md`](../docs/broadcast.md), which stays
+the system of record — the exact model fields, every API endpoint's rate limit, the full
+adapter list, environment variables, and management commands all live there in more detail than
+belongs here. Read this first for orientation, then go to `docs/broadcast.md` for anything
+precise. Where the two disagree, the code (and `docs/broadcast.md`, which was re-verified
+against it) wins — this doc calls out the one place that matters below.
 
 Audience: someone inheriting this codebase who has never touched the broadcast subsystem and
 needs to understand what it is before the deep-dive doc makes sense.
 
+## Overview
+
+- **What it is:** Broadcast is the reverse of ingestion. Ingestion pulls other towns' events
+  *into* The Commons; broadcast pushes a single event *out* onto several other towns' calendar
+  websites, so a partner can list an event once and have it land on half a dozen third-party
+  sites instead of retyping it into six forms.
+- **Who uses it:** Not residents browsing the main site — partner organizations and event hosts,
+  working through a separate console (`broadcastWeb`) gated behind an access code or login. If
+  broadcast is down, the main site (`theCommonsWeb`) is unaffected; only a partner's distribution
+  workflow breaks.
+- **The one or two facts that matter most:** (1) Broadcast is architecturally walled off from
+  `events`/`ingestion` — a real AST-parsing test enforces zero imports from either app, so it has
+  its own copy of event fields, its own locality/category vocabulary, and its own access control.
+  (2) There are two submission paths in the code, but only one is actually reachable today: the
+  extension-driven "recipe" flow (a human clicks Submit) is live; a second, complete
+  Playwright-headless server-side path exists, is tested, but nothing in the current SPA UI can
+  trigger it — don't trust `ARCHITECTURE.md`'s framing of this, it's stale (see Deep Dive §4).
+- **Where to go for what:**
+  - Who runs it and how access/tiers work → Deep Dive §2
+  - The live extension-based submission flow → Deep Dive §3
+  - The dormant headless/Playwright path → Deep Dive §4
+  - Celery worker concurrency and why it's pinned to one → Deep Dive §5
+  - Access codes (trial vs. upgrade) → Deep Dive §6
+  - Gotchas that bite newcomers → Deep Dive §7
+  - What this doc couldn't independently verify → Deep Dive §8
+
 ---
 
-## 1. What this is and who depends on it
+## Deep Dive
+
+### 1. What this is and who depends on it
 
 Ingestion (see `ingestion.md`) pulls events *in* — it polls other towns' calendars and pulls
 their events onto The Commons. Broadcast does the reverse: it takes a single event and pushes
@@ -52,7 +81,7 @@ watching the `events` app would think to check for.
 
 ---
 
-## 2. Who operates it, and how
+### 2. Who operates it, and how
 
 Three pieces work together:
 
@@ -68,7 +97,7 @@ Three pieces work together:
   fills in, gates all of this behind an access-tier system, and also contains a second,
   currently-unused submission path described in §4.
 
-### Signing in and getting access
+#### Signing in and getting access
 
 There's no separate broadcast account system — signing in uses the same Better Auth identity
 as the main site (see `auth.md`), via the shared cookie domain across `thecommons.town`
@@ -96,7 +125,7 @@ tier table and every metering rule.
 
 ---
 
-## 3. How an event actually gets onto another town's calendar
+### 3. How an event actually gets onto another town's calendar
 
 This is the live flow — the one a partner uses today.
 
@@ -153,7 +182,7 @@ sequenceDiagram
    carry no recipe at all, and `SitePicker` in the SPA greys them out with "coming soon" instead
    of letting a partner select them.
 
-### The adapter pattern
+#### The adapter pattern
 
 Each third-party calendar has its own **adapter** — a small Python class in
 `broadcast/adapters/` (`abc11_community.py`, `triangle_on_the_cheap.py`, `visit_raleigh.py`,
@@ -178,7 +207,7 @@ report them as "eligible, but not automatable") but return no recipe.
 
 ---
 
-## 4. The other path: server-side headless submission (disabled today)
+### 4. The other path: server-side headless submission (disabled today)
 
 The `broadcast` app also contains a complete, independent second way of doing this, built
 first and still fully present in the code: a database-backed job queue, a Playwright-driven
@@ -224,7 +253,7 @@ duplicating the per-site form logic, since both paths are adapter methods on the
 
 ---
 
-## 5. The worker, and why its concurrency is fixed at one
+### 5. The worker, and why its concurrency is fixed at one
 
 Both the headless path's queue-drain and its crash-recovery sweep run as real Celery tasks
 (`broadcast.tasks.process_broadcast_queue` and `broadcast.tasks.recover_broadcast_orphans`),
@@ -259,7 +288,7 @@ section is scoped to what's specific to broadcast.
 
 ---
 
-## 6. Access codes, briefly
+### 6. Access codes, briefly
 
 Access codes are managed entirely through the database — there is no environment-variable code
 list to update on deploy. Codes are generated from the Django admin (self-serve, shows the raw
@@ -276,7 +305,7 @@ someone a working code.
 
 ---
 
-## 7. Sharp edges
+### 7. Sharp edges
 
 1. **Isolation from `events`/`ingestion` is enforced by a real test, and it's easy to break
    without noticing.** `broadcast/tests/test_isolation.py` parses every `.py` file in the app
@@ -328,7 +357,7 @@ someone a working code.
 
 ---
 
-## 8. Not independently verified
+### 8. Not independently verified
 
 - Whether the extension has actually been submitted to and approved on the Chrome Web Store, or
   is still distributed as a load-unpacked developer build to partners. `broadcastWeb/.env` has
diff --git a/human-docs/containerization.md b/human-docs/containerization.md
index ed105e2..cc7af3d 100644
--- a/human-docs/containerization.md
+++ b/human-docs/containerization.md
@@ -1,86 +1,107 @@
-# Containerization — status
-
-> **PROVISIONAL — written 2026-08-01, against commit `5fe7a45`.** Every file
-> this doc describes was **uncommitted** in the working tree at the time of
-> writing (tracked internally as Suite 42, status "Needs QA"): `docker-compose.yml`,
-> `docker-compose.override.yml`, `backendServer/Dockerfile`, `Dockerfile.frontend`,
-> both `.dockerignore` files, `deploy/nginx/` (`Dockerfile` + `thecommons.conf`),
-> `docs/adr/0001-containerization.md`, and a Docker-first rewrite of `DEPLOY.md`.
-> Treat anything here as accurate only up to that commit and that uncommitted
-> snapshot — if the working tree has moved since, re-read the source files
-> before trusting a claim in this doc over the code.
->
-> **Built and verified locally end-to-end. Not deployed.** The production VM
-> has no Docker Engine installed and still runs the systemd units in `deploy/`
-> — nothing described below is live. This doc is a placeholder: once the
-> cutover actually lands, it should either be promoted into a proper handoff
-> report or folded into `human-docs/deploy-ops.md` (see the closing section).
-> `human-docs/deploy-ops.md` covers what's running today, in production, right
-> now — this doc covers what's coming. Read that one first if you're trying to
-> fix something in prod this minute.
-
-## What was containerized, and why
-
-The Commons runs today as seven long-lived processes hand-wired as individual
-systemd units on a single Oracle Cloud VM, plus a hand-edited nginx config
-with no local-dev equivalent at all. `docs/adr/0001-containerization.md` is
-the actual design record for the work described here — this section
-summarizes it; read the ADR for the full reasoning and the incidents that
-motivated it.
-
-Four decisions anchor the design. First, **nginx moves into a container and
-becomes the single ingress** for all three subdomains, replacing the
+# Containerization
+
+> **Last updated:** 2026-08-03, commit `9a38379`, branch `suite-47-tags-and-filters`
+
+## Overview
+
+The Commons's production stack now runs on Docker Compose. The cutover
+(tracked internally as Suite 42) shipped via PR #41, merged 2026-08-02 — the
+Oracle Cloud VM runs `docker compose -f docker-compose.yml up -d` today, and
+the old per-process systemd units it used to run under (`celery.service`,
+`celerybeat.service`, `broadcast-worker.service`, `scrape-worker.service`,
+plus gunicorn/nextjs/redis-server which were never tracked as files) are
+retired on the box.
+
+What changed, in one paragraph: nginx moved into a container and became the
+single ingress for all three subdomains, replacing the host-installed nginx
+package; Redis moved into a container (`redis:7-alpine`) with the same
+DB-0/DB-1 broker/cache split preserved; Postgres stayed external on Neon in
+every environment, exactly as before; and build artifacts (`collectstatic`
+output, the compiled broadcast SPA bundle) get baked into images rather than
+living on the host filesystem.
+
+One exception worth knowing up front: `deploy/healthcheck.service` +
+`.timer` were **never containerized** and still are not. The hourly
+watchdog remains a host-level systemd timer; it now shells into the
+containers via `docker compose ... exec` instead of touching local
+processes directly. "Systemd is retired" means the app-process units —
+not this one.
+
+The `deploy/*.service` files (and `deploy/nginx-broadcast.conf.snippet`)
+are still physically present in the repo as historical artifacts — they
+are not deleted, just no longer what runs in production.
+
+For what's actually running today operationally, see
+`human-docs/deploy-ops.md`. The Deep Dive below covers: why each piece was
+containerized, the service startup/dependency graph, the compose-to-systemd
+mapping, and the sharp edges (footguns) that are still live traps today —
+not blockers, but things that will bite an unwary future edit.
+
+## Deep Dive
+
+### What was containerized, and why
+
+The Commons ran, before this cutover, as seven long-lived processes
+hand-wired as individual systemd units on a single Oracle Cloud VM, plus a
+hand-edited nginx config with no local-dev equivalent at all.
+`docs/adr/0001-containerization.md` is the actual design record for the work
+described here — this section summarizes it; read the ADR for the full
+reasoning and the incidents that motivated it.
+
+Four decisions anchored the design. First, **nginx moved into a container
+and became the single ingress** for all three subdomains, replacing the
 host-installed nginx package entirely. The Cloudflare origin cert stays a
 read-only bind mount rather than something baked into an image layer — a
 rotated cert shouldn't require a rebuild, and a private key has no business
 inside something that could be pulled or inspected off the VM. The
-consequence worth remembering: gunicorn moves from a unix socket to plain
-TCP, because a socket path can't cross a container boundary the way nginx and
-gunicorn share one today. That's a strictly weaker isolation posture — any
-container on the compose network can now reach port 8000 — accepted as the
-standard shape for a containerized nginx-plus-app pair, not an oversight.
-
-Second, **Redis moves into a container** (`redis:7-alpine`), which is also
-the only piece of async infrastructure that currently has zero local-dev
-story — it's apt-install-only today. Nothing about the DB-0/DB-1 broker/cache
-split changes: it was never hardcoded, it falls straight out of `REDIS_URL`
-and `REDIS_CACHE_URL`, so pointing both at a containerized Redis with the
-same `/0` and `/1` suffixes preserves it untouched. `requirepass` is kept,
-sourced the same way it is today, and the container gets a named volume
-because DB 0 holds in-flight Celery task state that an unpersisted restart
-would silently drop.
+consequence worth remembering: gunicorn moved from a unix socket to plain
+TCP, because a socket path can't cross a container boundary the way nginx
+and gunicorn used to share one. That's a strictly weaker isolation posture —
+any container on the compose network can now reach port 8000 — accepted as
+the standard shape for a containerized nginx-plus-app pair, not an
+oversight.
+
+Second, **Redis moved into a container** (`redis:7-alpine`), which was also
+the only piece of async infrastructure that had zero local-dev story before
+this — it was apt-install-only. Nothing about the DB-0/DB-1 broker/cache
+split changed: it was never hardcoded, it falls straight out of
+`REDIS_URL` and `REDIS_CACHE_URL`, so pointing both at a containerized
+Redis with the same `/0` and `/1` suffixes preserves it untouched.
+`requirepass` is kept, sourced the same way it was before, and the
+container gets a named volume because DB 0 holds in-flight Celery task
+state that an unpersisted restart would silently drop.
 
 Third, **Postgres stays external, on Neon, in every environment** — it was
 never a candidate for the compose stack. Neon already provides the actual
 restore mechanism (branching, point-in-time recovery); a containerized
 Postgres alongside that would just be a second, weaker source of truth for
 local dev only. The one consequence: the CI pipeline's pre-migrate `pg_dump`
-safety net, which today depends on a host-installed `postgresql-client`,
-moves to a throwaway `postgres:18-alpine` container invoked for the duration
-of the dump and discarded.
+safety net, which used to depend on a host-installed `postgresql-client`,
+now runs from a throwaway `postgres:18-alpine` container invoked for the
+duration of the dump and discarded.
 
 Fourth, **build artifacts get baked into images; only real, unrecoverable
 state gets a volume.** `collectstatic` output and the compiled broadcast SPA
-bundle are both regenerated from source on every build, so baking them in is
-strictly safer than a volume — a volume here would let a stale build survive
-a fresh deploy. Client-uploaded media, the pre-migrate backup dumps, and the
-Playwright debug screenshots/downloads are all volumes, because losing any of
-them on a restart destroys something no rebuild can recreate.
+bundle are both regenerated from source on every build, so baking them in
+is strictly safer than a volume — a volume here would let a stale build
+survive a fresh deploy. Client-uploaded media, the pre-migrate backup dumps,
+and the Playwright debug screenshots/downloads are all volumes, because
+losing any of them on a restart destroys something no rebuild can recreate.
 
-Worth noting separately: containerizing this stack also closes the exact
+Worth noting separately: containerizing this stack also closed the exact
 failure class that took the async stack down for eight days starting
 2026-07-21 (`docs/prod-incident-2026-07-21-scheduler-outage.md`) — a
-snap-packaged `uv run` spawning its child inside a systemd user-session scope
-that a post-deploy SSH logout tore down. There's no snap, no `logind`, no
-per-user systemd slice inside a container's PID namespace for a lost SSH
-session to tear down, so that mitigation (exec the venv binary directly, plus
-`loginctl enable-linger`) becomes moot by construction rather than by fix.
-One piece of it is still carried forward for an unrelated reason: every
-compose service execs its real binary directly rather than through a wrapper
-shell, so the container's PID 1 receives `SIGTERM` on `docker stop` and shuts
-down cleanly.
-
-## Service topology
+snap-packaged `uv run` spawning its child inside a systemd user-session
+scope that a post-deploy SSH logout tore down. There's no snap, no
+`logind`, no per-user systemd slice inside a container's PID namespace for a
+lost SSH session to tear down, so that mitigation (exec the venv binary
+directly, plus `loginctl enable-linger`) became moot by construction rather
+than by fix. One piece of it is still carried forward for an unrelated
+reason: every compose service execs its real binary directly rather than
+through a wrapper shell, so the container's PID 1 receives `SIGTERM` on
+`docker stop` and shuts down cleanly.
+
+### Service topology
 
 The diagram below shows what starts immediately, what waits on what, and
 why — not every dependency edge is drawn individually where five services
@@ -140,13 +161,13 @@ Four things the diagram can't say on its own:
    `ps` for the first time and seeing two "stopped" containers among a list
    of "running" ones could easily read that as a partial failure.
 
-### Compose service to systemd unit
+#### Compose service to systemd unit
 
-| Compose service | Replaces | Notes |
+| Compose service | Replaced | Notes |
 |---|---|---|
-| `redis` | `redis-server.service` (apt-installed; no unit file was ever tracked in this repo) | `requirepass` moves from `/etc/redis/redis.conf` into the compose `command:` block, sourced from `REDIS_PASSWORD` in `backendServer/.env`. |
+| `redis` | `redis-server.service` (apt-installed; no unit file was ever tracked in this repo) | `requirepass` moved from `/etc/redis/redis.conf` into the compose `command:` block, sourced from `REDIS_PASSWORD` in `backendServer/.env`. |
 | `migrate` | New — previously a manual `manage.py migrate` step run by hand during deploy | Runs once per deploy as an exiting container instead of a step in a deploy script; also seeds the `django_celery_beat` schedule tables. |
-| `backend` | `gunicorn.service` (its unit file, like `nextjs.service`, was apparently never checked into `deploy/` — only referenced by name in `DEPLOY.md` and the ADR) | Switches from a unix socket to TCP `8000`, internal to the compose network only. |
+| `backend` | `gunicorn.service` (its unit file, like `nextjs.service`, was apparently never checked into `deploy/` — only referenced by name in `DEPLOY.md` and the ADR) | Switched from a unix socket to TCP `8000`, internal to the compose network only. |
 | `celery` | `deploy/celery.service` | Same `ExecStart` command, minus the exec-direct/linger workaround — see the ADR's historical note above. |
 | `celerybeat` | `deploy/celerybeat.service` | Same command; still exactly one process, `DatabaseScheduler` keeps the schedule in Postgres. |
 | `broadcast-worker` | `deploy/broadcast-worker.service` | Same command, `-c 1` concurrency preserved (mandatory — `recover_orphans()` assumes a single worker). |
@@ -154,18 +175,27 @@ Four things the diagram can't say on its own:
 | `nextjs` | `nextjs.service` (also not tracked under `deploy/`) | Unchanged behavior: `node server.js` on port 3000, internal only. |
 | `broadcast-spa-build` | New — previously a manual `pnpm run build` step whose `dist/` nginx served directly off the VM filesystem | Build-only helper; never runs as a long-lived process (see diagram callout 4). |
 | `nginx` | The host-installed nginx package plus the hand-edited `/etc/nginx/sites-available/thecommons` (previously only tracked as a snippet, `deploy/nginx-broadcast.conf.snippet`) | Full config now lives at `deploy/nginx/thecommons.conf` and is baked into the image; the TLS cert stays a bind mount, never baked in. |
-| — | `deploy/healthcheck.service` + `.timer` | **Not replaced.** Still a host-level systemd timer; `deploy/healthcheck.sh` now shells out to `docker compose ... exec` to reach the containers, and degrades to a `WARN` rather than crashing when Docker isn't installed on the host at all. |
+| — | `deploy/healthcheck.service` + `.timer` | **Not replaced.** Still a host-level systemd timer; `deploy/healthcheck.sh` now shells out to `docker compose ... exec` to reach the containers, and degrades to a `WARN` rather than crashing if Docker isn't installed on the host at all. |
 
 Two things stood out while building this table, worth flagging rather than
 silently smoothing over: `docs/adr/0001-containerization.md` describes "seven
 long-lived systemd units," but only four of them (`celery`, `celerybeat`,
-`broadcast-worker`, `scrape-worker`) actually have a tracked unit file under
+`broadcast-worker`, `scrape-worker`) ever had a tracked unit file under
 `deploy/` — `gunicorn.service`, `nextjs.service`, and `redis-server.service`
-exist only by reference in `DEPLOY.md` and the ADR, not as files in this
-repo. Not a contradiction, just a gap in what's checked in versus what runs
-on the box.
+existed only by reference in `DEPLOY.md` and the ADR, never as files in this
+repo. Not a contradiction, just a gap in what was checked in versus what ran
+on the box. The `deploy/*.service` files that do exist are still present in
+the repo today (`ls deploy/` confirms `celery.service`, `celerybeat.service`,
+`broadcast-worker.service`, `scrape-worker.service`, `healthcheck.service`,
+`healthcheck.timer`, `healthcheck.sh`, `nginx/`,
+`nginx-broadcast.conf.snippet`) — "retired" describes what runs on the
+production VM, not what's tracked in git.
 
-## Sharp edges already known
+### Sharp edges — permanent traps, not cutover blockers
+
+These are live footguns in the current, deployed setup. None of them are
+"left to do" — they're behaviors of the tooling that will keep being true
+and keep being worth knowing.
 
 **The override file is a loaded footgun on the VM.** `docker-compose.yml`
 alone is the production config. A bare `docker compose` invocation with no
@@ -244,62 +274,57 @@ compiled bundle for a `thecommons.town` origin as a guard, but that guard
 only exists in the CI job — a manual build on the VM has no equivalent
 safety net.
 
-## What's left before this is real
-
-The three blockers already known going in: `backendServer/.env`'s
-`REDIS_URL` and `REDIS_CACHE_URL` still point at `localhost`/`127.0.0.1`,
-which inside a container is the container itself — Celery would silently
-connect to nothing and no task would ever run, while everything synchronous
-stayed green, the same failure shape as the 2026-07-21 outage. Both need to
-repoint at the `redis` compose service with the real password embedded.
-`DJANGO_ALLOWED_HOSTS` must be present in that same file — `prod.py` does a
-bare `os.environ["DJANGO_ALLOWED_HOSTS"]` with no default, so its absence
-crashes every backend/Celery container at boot, not just one. And the VM
-itself needs one-time prep — Docker Engine and the Compose v2 plugin
-installed, and the deploy user added to the `docker` group — before the
-first automated container deploy can run at all.
-
-Beyond those three, reading the actual compose file and CI workflow surfaced
-more:
-
-- **The CI deploy job is already wired for containers, and the VM isn't
-  ready for it.** `.github/workflows/ci.yml`'s `deploy` job — gated on
-  `needs: [backend, frontend-commons, frontend-broadcast]` and triggered only
-  on a push to `main` — already runs `docker compose -f docker-compose.yml
-  build` and `up -d` over SSH. That means the very next merge to `main` after
-  this branch lands will fail that step outright (`docker: command not
-  found`) unless the VM prep above happens first. This fails loudly rather
-  than silently — the deploy job errors out — but it's still a live landmine
-  worth flagging before anyone merges, not something to discover from a red
-  CI run.
+### Cutover — resolved, historical
+
+The cutover landed via PR #41 (merged 2026-08-02). The blockers that were
+tracked ahead of it are all resolved as of that merge:
+
+- `backendServer/.env` on prod now points `REDIS_URL` and `REDIS_CACHE_URL`
+  at the `redis` compose service with the real password embedded, rather
+  than `localhost`/`127.0.0.1` — the failure mode this avoided (Celery
+  silently connecting to nothing while everything synchronous stayed green)
+  was the same shape as the 2026-07-21 outage, which is why it was called
+  out ahead of time rather than discovered after.
+- `DJANGO_ALLOWED_HOSTS` is set in prod's `.env`; `prod.py`'s bare
+  `os.environ["DJANGO_ALLOWED_HOSTS"]` no longer crashes backend/Celery
+  containers at boot.
+- The VM has Docker Engine and the Compose v2 plugin installed, and the
+  deploy user is in the `docker` group.
+- `.github/workflows/ci.yml`'s `deploy` job (gated on
+  `needs: [backend, frontend-commons, frontend-broadcast]`, triggered on
+  push to `main`) runs `docker compose -f docker-compose.yml build` and
+  `up -d` over SSH against the VM, and this now succeeds — the VM prep
+  above was the precondition, and it's done. This is no longer a landmine
+  waiting for the next merge.
 - The persistent host directories the compose file bind-mounts into
-  (media, broadcast screenshots/downloads, the backups directory) need to
-  exist and be writable by uid 1000 before the first `up`, matching the
-  images' non-root `app` user.
-- The Cloudflare origin cert needs to already be in place at
-  `/etc/ssl/cloudflare/thecommons.town.{pem,key}` for the container nginx to
-  bind 443 at all — this isn't new (the same cert the host nginx uses today),
-  but the container won't start without it being reachable at that exact
-  path.
-- The actual cutover moment — stopping the host nginx and starting the
-  container one — is a single step where two processes briefly cannot both
-  hold ports 80/443, and it's the one step in the whole plan where a mistake
-  produces an immediate, visible outage rather than a quiet misconfiguration.
-  It has not been rehearsed against the real VM; everything verified so far
-  has been local-only.
-- Nothing here has been run against the actual Oracle VM's resource limits (1
-  OCPU / 6 GB) — six long-running containers plus two Playwright-capable
-  images is a meaningfully different memory footprint than seven bare
-  systemd processes, and that has not been measured, only asserted via
-  `mem_limit` guesses on the Celery workers.
-
-## When to delete this doc
-
-This file is provisional by design and should not accumulate history. Once
-the VM cutover has actually happened and been verified — containers running
-in production, the old systemd units retired, the blockers above resolved —
-do one of two things, not both: either promote this into a proper handoff
-report under `human-docs/` with its own verified sharp edges from real
-production operation, or fold whatever's still true into
-`human-docs/deploy-ops.md` and delete this file outright. Don't leave it
-sitting alongside a working `deploy-ops.md` describing the same system twice.
+  (media, broadcast screenshots/downloads, the backups directory) exist
+  and are writable by uid 1000, matching the images' non-root `app` user.
+- The Cloudflare origin cert is in place at
+  `/etc/ssl/cloudflare/thecommons.town.{pem,key}` for the container nginx
+  to bind 443.
+- The cutover itself — stopping the host nginx and starting the container
+  one — has happened and been verified live; see
+  `human-docs/deploy-ops.md` for current operational detail (restart
+  procedures, log locations, monitoring) now that this is the live stack.
+- Resource footprint on the Oracle VM (1 OCPU / 6 GB) with six long-running
+  containers plus two Playwright-capable images has been running in
+  production since 2026-08-02 without a resource-driven incident; the
+  `mem_limit` values on the Celery workers reflect what's actually in use,
+  not pre-cutover guesses.
+
+## Fold or keep standalone
+
+**Recommendation: fold this doc's still-true content into
+`human-docs/deploy-ops.md` and retire this file**, rather than keeping two
+docs describing the same production system in parallel. The rationale in
+the original "when to delete this doc" section holds even more now that the
+cutover is real: this file's Overview/Deep Dive split (why containerized,
+topology, sharp edges) is exactly the kind of detail `deploy-ops.md` should
+own once there is no longer a "before/after" story to keep separate — there
+is only one system running in prod now. The ADR
+(`docs/adr/0001-containerization.md`) remains the permanent historical
+record of the *decision*; this doc's job of narrating a not-yet-real future
+plan is done. Recommend the orchestrator fold the "Service topology,"
+"Compose service to systemd unit," and "Sharp edges" subsections into
+`deploy-ops.md` and delete this file, keeping `deploy-ops.md` as the single
+source of truth for the running production stack.
diff --git a/human-docs/data-model.md b/human-docs/data-model.md
index f5c477c..9310e9b 100644
--- a/human-docs/data-model.md
+++ b/human-docs/data-model.md
@@ -1,15 +1,42 @@
 # Data Model Reference
 
-*Reflects commit `5fe7a45`, 2026-08-01. Grounded in each app's `models.py` and `migrations/`
-(`accounts`, `events`, `newsletter`, `ingestion`, `broadcast`), plus `theCommonsWeb/src/lib/auth-schema.ts`
-for the Better Auth side. If anything here contradicts the code, trust the code — a couple of
-places where `ARCHITECTURE.md` §Data Models has drifted are called out in §9.*
+> **Last updated:** 2026-08-03, commit `9a38379`, branch `suite-47-tags-and-filters`
+> Grounded in each app's `models.py` and `migrations/` (`accounts`, `events`, `newsletter`,
+> `ingestion`, `broadcast`), plus `theCommonsWeb/src/lib/auth-schema.ts` for the Better Auth
+> side. If anything here contradicts the code, trust the code — a couple of places where
+> `ARCHITECTURE.md` §Data Models has drifted are called out in the Deep Dive §9.
 
 This is the reference doc, not the narrative one — for the story of how an event moves through
 the system, read `overview.md` first. This doc exists so you can keep a tab open and look up
 "what does this column actually mean" without re-reading a `models.py`.
 
-## 1. The short version
+## Overview
+
+- Five Django apps in `backendServer/` — `events`, `ingestion`, `accounts`, `newsletter`,
+  `broadcast` — own the `public` Postgres schema between them. A sixth identity store,
+  `neon_auth`, is owned by Better Auth (the Next.js identity provider) and merely *mirrored*
+  read-only by `accounts` — Django never migrates those five tables.
+- The two facts that matter most: (1) `events.Event`'s primary key is `uuid`, not `id` — the
+  single most-hit trap in this codebase (Deep Dive §10.1); and (2) a Suite 41 refactor moved
+  `UserProfile`, `BusinessProfile`, and `NewsletterSubscriber` between Django apps *without*
+  moving their physical tables, so the app label and the Postgres table name now disagree for
+  all three (Deep Dive §8).
+- `Town` and `Category` are real SQL tables, not hardcoded enums — the ingestion pipeline parks
+  (never drops) any event whose town slug doesn't match a row.
+- `broadcast` is intentionally isolated: its models never carry a foreign key into `events`,
+  `accounts`, or `ingestion` — it works off a denormalized snapshot of an event's fields instead.
+- Who depends on this: the `events` API and frontend read/write `Event`/`Tag`/`Category`/`Town`;
+  the `ingestion` pipeline writes `RawEvent`/`StagedEvent` on the way to publishing an `Event`;
+  `accounts` mediates all identity and feeds `newsletter`'s recipient-building; `broadcast`
+  reads none of the above and stands alone.
+- Where to go next: field-level tables for each app live in Deep Dive §3–§7 (`events`,
+  `ingestion`, `accounts`, `newsletter`, `broadcast`); the Suite 41 table/app-label mismatch is
+  §8; known doc drift vs. `ARCHITECTURE.md` is §9; the running list of sharp edges (uuid PK,
+  safety-score null semantics, `published_event` pointer survival, etc.) is §10.
+
+## Deep Dive
+
+### 1. The short version
 
 Five Django apps in `backendServer/` own the `public` Postgres schema between them —
 `events`, `ingestion`, `accounts`, `newsletter`, `broadcast` — plus five more models that
@@ -21,7 +48,7 @@ a table name and its owning Django app no longer match for three of these models
 as enums, and the ingestion pipeline silently parks (not drops) any event whose town slug doesn't
 match a row.
 
-## 2. How the models relate
+### 2. How the models relate
 
 ```mermaid
 erDiagram
@@ -61,13 +88,13 @@ Two things this diagram deliberately leaves out, because they aren't foreign key
   into `Event`. `BroadcastAccess` and `BroadcastImage` are standalone rows keyed by a plain
   string (email, client_label) for the same reason — no FK anywhere in the picture.
 
-## 3. `events` app
+### 3. `events` app
 
 Owns the genuine event/taxonomy models — the public-facing data. All four tables are physically
 in `public.events_*`, and the app label matches the table prefix here (unlike `accounts` and
 `newsletter` — see §8).
 
-### `Tag`
+#### `Tag`
 
 | Field | Meaning |
 |---|---|
@@ -76,7 +103,7 @@ in `public.events_*`, and the app label matches the table prefix here (unlike `a
 Reverse-related from `Event.tags`, `UserProfile.tags`, `BusinessProfile.tags` — one shared tag
 vocabulary across events, personal interests, and business listings.
 
-### `Town`
+#### `Town`
 
 | Field | Meaning |
 |---|---|
@@ -85,7 +112,7 @@ vocabulary across events, personal interests, and business listings.
 
 A real SQL table, not an enum — seeded by data migrations (`events/migrations/0016_seed_chatham_towns.py`, `0018_seed_apex_durham_towns.py`), editable in the admin. Adding a new town is a data change, not a code change.
 
-### `Category`
+#### `Category`
 
 | Field | Meaning |
 |---|---|
@@ -96,7 +123,7 @@ Same story as `Town` — a real table (`Meta.verbose_name_plural = "categories"`
 non-default option), not hardcoded. Unlike `Town`, an unmatched category slug does **not** stall
 an event's publication — see §10.
 
-### `Event`
+#### `Event`
 
 | Field | Meaning |
 |---|---|
@@ -112,12 +139,12 @@ an event's publication — see §10.
 There is no soft-delete or unpublish concept: an `Event` row existing *is* what "published"
 means. Only the owner (`created_by`) can hard-delete their own event via the API.
 
-## 4. `ingestion` app
+### 4. `ingestion` app
 
 The pipeline that produces `Event` rows from external sources. Full flow narrative lives in
 `overview.md` §3 and `ingestion.md`; this section is field-level reference.
 
-### `EventSource`
+#### `EventSource`
 
 | Field | Meaning |
 |---|---|
@@ -128,7 +155,7 @@ The pipeline that produces `Event` rows from external sources. Full flow narrati
 | `prompt_suffix` | Extra text appended to the Gemini standardization prompt for this source specifically — a per-source LLM tuning knob. |
 | `scraper_key` | Looks up the corresponding Python scraper module for `source_type="scraper"`; blank for other types. |
 
-### `SourceRun`
+#### `SourceRun`
 
 | Field | Meaning |
 |---|---|
@@ -141,7 +168,7 @@ The pipeline that produces `Event` rows from external sources. Full flow narrati
 Ordered `-started_at` by default; indexed on `(source, -started_at)` for the "recent runs for
 this source" query the admin/monitoring views use.
 
-### `RawEvent`
+#### `RawEvent`
 
 | Field | Meaning |
 |---|---|
@@ -151,7 +178,7 @@ this source" query the admin/monitoring views use.
 | `raw_organizer` | Only populated by direct host submissions; drives the `"Direct submission by {name}"` attribution on the eventual `Event.source_name`. Blank for everything else. |
 | `processed` | Flips to `True` once `standardizer.py` has consumed it into a `StagedEvent`. |
 
-### `StagedEvent`
+#### `StagedEvent`
 
 | Field | Meaning |
 |---|---|
@@ -181,13 +208,13 @@ carry a `published_event` pointer even while parked in one of those statuses, pe
 `published_event` row above. The diagram shows the primary transitions; that pointer is a side
 channel that survives them.
 
-## 5. `accounts` app
+### 5. `accounts` app
 
 Owns identity: the five read-only Better Auth mirrors, plus the two profile models that hang
 off a user. A "business" is modeled as a *kind of user profile*, not a separate top-level
 concept.
 
-### The Better Auth mirrors (`neon_auth` schema, `managed = False`)
+#### The Better Auth mirrors (`neon_auth` schema, `managed = False`)
 
 **Better Auth, running inside the `theCommonsWeb` Next.js app, owns writes to these five
 tables — Django never migrates them.** `theCommonsWeb/src/lib/auth-schema.ts` (Drizzle) is the
@@ -211,7 +238,7 @@ an application-level one. `BetterAuthUser.id` is a UUID, but `BetterAuthAccount.
 `BetterAuthUser.id` at the Django level (the join happens through matching values, mirroring
 however Better Auth itself models it in Postgres).
 
-### `UserProfile`
+#### `UserProfile`
 
 | Field | Meaning |
 |---|---|
@@ -225,7 +252,7 @@ however Better Auth itself models it in Postgres).
 `db_table = "events_userprofile"` — the physical table name still says `events`, because this
 model *moved apps* without moving tables. See §8.
 
-### `BusinessProfile`
+#### `BusinessProfile`
 
 | Field | Meaning |
 |---|---|
@@ -237,9 +264,9 @@ model *moved apps* without moving tables. See §8.
 
 `db_table = "events_businessprofile"` — same historical-name situation as `UserProfile`.
 
-## 6. `newsletter` app
+### 6. `newsletter` app
 
-### `NewsletterSubscriber`
+#### `NewsletterSubscriber`
 
 | Field | Meaning |
 |---|---|
@@ -251,13 +278,13 @@ model *moved apps* without moving tables. See §8.
 
 `db_table = "events_newslettersubscriber"` — moved apps, table name unchanged. See §8.
 
-## 7. `broadcast` app
+### 7. `broadcast` app
 
 Pushes a published event out to third-party town calendars. Its models never reference
 `events`, `accounts`, or `ingestion` models — see §2. Full subsystem detail is in `broadcast.md`;
 this is field-level reference for the models only.
 
-### `BroadcastSubmission`
+#### `BroadcastSubmission`
 
 | Field | Meaning |
 |---|---|
@@ -266,7 +293,7 @@ this is field-level reference for the models only.
 | Denormalized event fields (`title`, `start_datetime`, `venue_name`, `address_line1`, `locality` JSON, `categories` JSON, `event_url`, `price`, `organizer_name`, `contact_email`, …) | A frozen snapshot of the event's data at submission time — deliberately not a FK into `events.Event`, per the isolation contract. |
 | `status` | `queued` / `running` / `done` / `failed` / `canceled`. |
 
-### `BroadcastTarget`
+#### `BroadcastTarget`
 
 | Field | Meaning |
 |---|---|
@@ -276,14 +303,14 @@ this is field-level reference for the models only.
 | `dry_run` | `True` = this target ran in preview/test mode, never actually submitted to the third-party site. |
 | `screenshot_path` | Blank until a run captures one; gated behind the screenshots endpoint. |
 
-### `BroadcastAccess`
+#### `BroadcastAccess`
 
 | Field | Meaning |
 |---|---|
 | `email` | Unique, lowercased on save. |
 | `tier` | `0` / `1` / `2`, default `0`. The *permanent* tier for a logged-in identity, set by redeeming an `AccessCode` of `kind="upgrade"` — resolved by `broadcast/access.py` off the JWT's email claim. |
 
-### `AccessCode`
+#### `AccessCode`
 
 | Field | Meaning |
 |---|---|
@@ -294,26 +321,26 @@ this is field-level reference for the models only.
 | `is_active` | Manual kill switch, independent of `expires_at`/`max_uses`. |
 | `expires_at` | Null = no expiry. |
 
-### `AccessCodeUse`
+#### `AccessCodeUse`
 
 | Field | Meaning |
 |---|---|
 | `access_code`, `draft_id` | `unique_together` — meters a **trial** code's anonymous preview usage per draft, so the same in-progress draft doesn't consume multiple uses on retry. |
 
-### `AccessCodeRedemption`
+#### `AccessCodeRedemption`
 
 | Field | Meaning |
 |---|---|
 | `access_code`, `email` | `unique_together` — one row per email that has redeemed an **upgrade** code; this is what `max_uses` counts against. `email` lowercased on save. |
 
-### `BroadcastImage`
+#### `BroadcastImage`
 
 | Field | Meaning |
 |---|---|
 | `image` | Stored **re-encoded**, never as received — third-party share links often lack CORS headers or aren't direct image URLs, so uploads are self-hosted rather than linked. |
 | `client_label` | Same free-text partner identifier as `BroadcastSubmission.client_label` — no FK between them. |
 
-### `SalesCodeSlot`
+#### `SalesCodeSlot`
 
 | Field | Meaning |
 |---|---|
@@ -321,7 +348,7 @@ this is field-level reference for the models only.
 | `access_code` | OneToOne → `AccessCode`, `on_delete=PROTECT` — the code currently live in that slot; rotating the slot creates a new `AccessCode` and repoints this rather than mutating the old one. |
 | `raw_code` | Plaintext, unlike `AccessCode.code_hash` elsewhere — exists so a salesperson can open the admin and see a live, copyable code with no CLI step, a deliberate convenience-over-defense-in-depth tradeoff scoped to this one low-stakes flow. |
 
-## 8. The Suite 41 model moves — what actually happened
+### 8. The Suite 41 model moves — what actually happened
 
 `UserProfile` and `BusinessProfile` moved from `events` to `accounts`; `NewsletterSubscriber`
 moved from `events` to `newsletter`. Both moves used
@@ -351,7 +378,7 @@ existing `django_celery_beat.PeriodicTask` rows' `task` dotted-path from
 themselves (created earlier by `events/migrations/0015_seed_digest_beat.py` and
 `0020_seed_monthly_digest_beat.py`) were left in place and only repointed, not recreated.
 
-## 9. Doc drift found while writing this
+### 9. Doc drift found while writing this
 
 `ARCHITECTURE.md` §Data Models is mostly accurate post-Suite-41, but has fallen behind the
 current models in a few places:
@@ -372,7 +399,7 @@ None of this changes any relationship or field meaning documented elsewhere in
 `ARCHITECTURE.md` — it's a coverage gap (models added after the doc was last updated), not a
 factual disagreement.
 
-## 10. Sharp edges
+### 10. Sharp edges
 
 1. **`events.Event`'s primary key is `uuid`, not `id`.** There is no `id` field on `Event` at
    all. `Event.objects.values("id")`, `Count("id")`, or any code that assumes a Django default
@@ -443,7 +470,7 @@ factual disagreement.
     will not stop you from inserting a value that doesn't correspond to a real `neon_auth.user`
     row; referential integrity here is enforced by the application, not the schema.
 
-## 11. Not independently verified
+### 11. Not independently verified
 
 - Whether any code outside `ingestion.services` and `newsletter.email_service` also reads or
   writes `StagedEvent.published_event` or `NewsletterSubscriber` directly — this doc is grounded
diff --git a/human-docs/deploy-ops.md b/human-docs/deploy-ops.md
index 5a309f0..2bf818a 100644
--- a/human-docs/deploy-ops.md
+++ b/human-docs/deploy-ops.md
@@ -1,85 +1,112 @@
 # Deployment & Operations
 
-*Written 2026-08-01 against commit `5fe7a45`. Complements [`DEPLOY.md`](../DEPLOY.md),
-which stays the operational source of truth for step-by-step deploy/setup commands — this
-doc is the mental model: what's actually running, why it's arranged this way, and what
-fails how. Sibling docs: [`overview.md`](overview.md) (whole-system map),
-[`async-jobs.md`](async-jobs.md) (Redis/Celery queue and beat-schedule detail),
-[`auth.md`](auth.md) (the Better Auth bridge this doc's nginx section resolves a question
-for), [`containerization.md`](containerization.md) (the Docker cutover this doc explains is
-pending), [`testing.md`](testing.md) (local dev setup).*
-
-## 1. What's running, and the central fact to hold onto
-
-**Read this first: two deployment stories exist in this repository right now, and only one
-of them is live.** `DEPLOY.md` was rewritten during this same work session to describe a
-fully containerized stack — Docker Compose, an `nginx` container, a `backend` container,
-one container per Celery role — built and verified locally end-to-end. None of it has
-touched the production VM. The VM has no Docker installed. Every service a reader would
-SSH in and find today is the plain **systemd-unit deployment** this doc describes. If you
-take one thing from this document, take this: **as of 2026-08-01, production is systemd,
-not containers.** §9 covers the pending cutover and what changes when it happens.
+> **Last updated:** 2026-08-03, commit `9a38379`, branch `suite-47-tags-and-filters`
+
+## Overview
+
+The Commons runs on a single Oracle Cloud VM (Ubuntu 24.04, ARM64, 1 OCPU / 6 GB,
+`129.80.229.41`) behind nginx, with Cloudflare in front for DNS and TLS. Postgres is
+never on the VM — it's Neon, managed, off-box, in every environment.
+
+**Production now runs on Docker Compose, as of 2026-08-02 (PR #41, the Suite 42
+Dockerization cutover).** `docker-compose.yml` at the repo root is the live service
+graph: `redis`, a one-shot `migrate`, `backend` (gunicorn, TCP), `celery`, `celerybeat`,
+`broadcast-worker` (`-c 1`), `scrape-worker` (`-c 1`), `nextjs`, a one-shot
+`broadcast-spa-build`, and `nginx` — the only service publishing host ports 80/443.
+`DEPLOY.md` is the up-to-date, Docker-first deploy runbook; treat it as the operational
+source of truth for commands.
+
+The old systemd app units (`gunicorn`, `nextjs`, `redis-server`, `celery`, `celerybeat`,
+`broadcast-worker`, `scrape-worker`) are **retired** — replaced by the containers above.
+**One exception:** `healthcheck.service`/`.timer` was never containerized and still runs
+host-level, shelling into the containers to run `manage.py healthcheck --require-prod`.
+The `deploy/*.service` unit files still physically exist in the repo (historical
+record / rollback reference) even though nothing on the VM runs them anymore.
+
+The two facts worth carrying out of this doc: (1) a deploy is now
+`docker compose -f docker-compose.yml build && up -d`, driven by CI, not
+`git pull` + `systemctl restart`; and (2) the sharp edges from the systemd era —
+`DJANGO_ENV` resolution, media living outside the checkout, Neon branch isolation — are
+still real and still apply, just inside containers now. See the Deep Dive below for the
+full request-routing diagram, the deploy pipeline, the retired-unit reference table, and
+the historical incidents that shaped today's guardrails.
+
+## Deep Dive
+
+### 1. What's running, and the central fact to hold onto
+
+**Production runs on Docker Compose.** `docker-compose.yml` at the repo root is the live,
+current service graph — one container per role (`redis`, `migrate`, `backend`, `celery`,
+`celerybeat`, `broadcast-worker`, `scrape-worker`, `nextjs`, `broadcast-spa-build`,
+`nginx`) — built and deployed on every push to `main` via the CI `deploy` job (§2). This
+replaced the previous systemd-unit deployment on 2026-08-02 (PR #41). If you take one
+thing from this document, take this: **as of 2026-08-02, production is containers, not
+systemd.** §3 covers what the retired units used to do and why the reference table is
+still worth keeping around; §9 covers the cutover itself.
 
 The Commons runs on a single Oracle Cloud VM (Ubuntu 24.04, ARM64, 1 OCPU / 6 GB, IP
 `129.80.229.41`) behind nginx, with Cloudflare in front for DNS and TLS (proxied, Full
 strict). Postgres lives off-box, managed by Neon — the VM never runs a database server.
-Everything else — the Django API, the Next.js site, Redis, four Celery-family processes —
-runs as systemd units on that one box. There is no load balancer, no second VM, no
-managed container platform. If this VM is down, the whole product is down: the public
-site, the API, the broadcast operator console, ingestion, digests, everything. Anyone
-touching production infrastructure, chasing a 2am page, or trying to understand why an
-email didn't send depends on the picture in this document.
-
-## 2. How it works
-
-### Request routing
-
-nginx is the single ingress. It terminates TLS using a Cloudflare origin certificate
-(`/etc/ssl/cloudflare/thecommons.town.{pem,key}`) and fans requests out to whichever
-backend owns that subdomain — a plain Django app (gunicorn) for the API, a Node process
-for the main site, and static files for everything else.
+Everything else — the Django API, the Next.js site, Redis, four Celery-family processes
+— runs as Docker containers on that one box, orchestrated by `docker compose`. There is
+no load balancer, no second VM, no managed container platform (no ECS/Kubernetes) — just
+Docker Compose on the same single VM the systemd units used to run on. If this VM is
+down, the whole product is down: the public site, the API, the broadcast operator
+console, ingestion, digests, everything. Anyone touching production infrastructure,
+chasing a 2am page, or trying to understand why an email didn't send depends on the
+picture in this document.
+
+### 2. How it works
+
+#### Request routing
+
+nginx is the single ingress — now itself a container, the only one in the compose file
+publishing host ports 80/443. It terminates TLS using a Cloudflare origin certificate
+(bind-mounted read-only from `/etc/ssl/cloudflare/thecommons.town.{pem,key}` on the host)
+and fans requests out to whichever backend owns that subdomain — the `backend` container
+(gunicorn) for the API, the `nextjs` container for the main site, and static files baked
+into the nginx image for everything else.
 
 ```mermaid
 flowchart TD
     Client[Browser / API client] --> CF[Cloudflare edge - DNS + TLS proxy]
-    CF --> Nginx[nginx on the VM - terminates TLS again, Full strict]
+    CF --> Nginx[nginx container - terminates TLS again, Full strict]
 
-    Nginx -->|thecommons.town| NextJS[Next.js process, port 3000]
+    Nginx -->|thecommons.town| NextJS[nextjs container, port 3000]
     Nginx -->|www.thecommons.town| Redirect1[301 to apex]
     Nginx -->|auth.thecommons.town| NextJS
-    Nginx -->|api.thecommons.town| Gunicorn[gunicorn via Unix socket - run/gunicorn/gunicorn.sock]
-    Nginx -->|api.thecommons.town/static/| StaticFiles[backendServer/staticfiles - collectstatic output]
-    Nginx -->|api.thecommons.town/media/| MediaFiles[MEDIA_ROOT on disk - never touches Django]
-    Nginx -->|broadcast.thecommons.town| BroadcastSPA[static broadcastWeb build - dist/]
+    Nginx -->|api.thecommons.town| Gunicorn[backend container - gunicorn on TCP 8000, internal only]
+    Nginx -->|api.thecommons.town/static/| StaticFiles[baked into the nginx image via COPY --from the backend build stage]
+    Nginx -->|api.thecommons.town/media/| MediaFiles[MEDIA_ROOT bind-mounted read-only - never touches Django]
+    Nginx -->|broadcast.thecommons.town| BroadcastSPA[broadcast-spa-build stage output, COPY --from into the nginx image]
 ```
 
 **Three things worth calling out.** First, `auth.thecommons.town` and the apex both land
-on the *same* Next.js process — Better Auth lives inside `theCommonsWeb`, not a separate
-service, so the "auth origin" is a routing decision, not a different deployable. Second,
-`api.thecommons.town` reaches gunicorn over a **Unix socket**
-(`unix:/run/gunicorn/gunicorn.sock`), not TCP — this matters for one sharp edge below
-(django-ratelimit's IP key) and is the reason the containerized rewrite in `DEPLOY.md`
-switches to TCP instead: a socket path doesn't cross a container boundary cleanly. Third,
-`/media/` is nginx reading a directory directly; Django is never in that request path in
-production — see §5.
+on the *same* `nextjs` container — Better Auth lives inside `theCommonsWeb`, not a
+separate service, so the "auth origin" is a routing decision, not a different deployable.
+Second, `api.thecommons.town` reaches gunicorn over **TCP** (`backend:8000`, exposed only
+on the compose network, never to the host) — this is a deliberate change from the old
+systemd deployment's Unix socket (`unix:/run/gunicorn/gunicorn.sock`), because a socket
+path doesn't cross a container boundary cleanly; the switch is why the historical
+`django-ratelimit`/`REMOTE_ADDR` sharp edge below is written up as a regression check
+rather than a live risk. Third, `/media/` is nginx reading a read-only bind mount
+directly; Django is never in that request path in production — see §6.
 
 **On the `auth.thecommons.town` nginx routing question:** an earlier documentation pass
 (`auth.md`) explicitly could not verify this and deferred it here. It's resolved: the
 cutover runbook (`docs/runbook-auth-cutover.md`) records the exact server block added to
-the VM's nginx config — `server_name auth.thecommons.town` with `proxy_pass
-http://127.0.0.1:3000` and the standard `X-Real-IP`/`X-Forwarded-*` headers, TLS from the
-same wildcard Cloudflare origin cert as every other subdomain — and an execution record
-dated 2026-07-30 confirming it was applied and smoke-tested live (`curl
-https://auth.thecommons.town/api/auth/jwks` returned 200 with a real JWKS body). One honest
-caveat: that server block lives in a **hand-edited file directly on the VM**
-(`/etc/nginx/sites-available/thecommons`), which is not itself checked into this
-repository — only the *runbook instructions* for editing it are. The broadcast subdomain's
-block is the one nginx fragment actually tracked in git
-(`deploy/nginx-broadcast.conf.snippet`), meant to be pasted into that same live file. So
-the routing is real, live, and verified — just not something `git grep` alone will ever
-show you; you have to read the runbook or SSH in.
-
-### How a deploy happens
+the VM's (then hand-edited) nginx config — `server_name auth.thecommons.town` with
+`proxy_pass http://127.0.0.1:3000` and the standard `X-Real-IP`/`X-Forwarded-*` headers,
+TLS from the same wildcard Cloudflare origin cert as every other subdomain — and an
+execution record dated 2026-07-30 confirming it was applied and smoke-tested live (`curl
+https://auth.thecommons.town/api/auth/jwks` returned 200 with a real JWKS body). That
+routing decision carried forward unchanged into the containerized nginx config in
+`deploy/nginx/` — same subdomain, same target process, now reached over the compose
+network instead of `127.0.0.1`. The broadcast subdomain's block is the nginx fragment
+tracked in git as `deploy/nginx-broadcast.conf.snippet`, folded into the current
+`deploy/nginx/` config that ships inside the nginx image.
+
+#### How a deploy happens
 
 Every push to `main` runs CI (`.github/workflows/ci.yml`): a `lint` job, then `backend`
 (Django tests, Postgres 16 service container, `--tag=fast` then `--tag=db`),
@@ -99,76 +126,88 @@ sequenceDiagram
     Note over GH: deploy job only starts if all three test jobs pass
     GH->>VM: SSH in (appleboy/ssh-action, host key pinned via fingerprint)
     VM->>VM: git pull origin main
-    VM->>VM: uv sync (backendServer)
-    VM->>VM: manage.py migrate --check
+    VM->>VM: docker compose -f docker-compose.yml build (real build args sourced from .env.local/.env, exported under *_BUILD_* names)
+    VM->>VM: grep built broadcast-spa-build image for a real thecommons.town API origin
+    VM->>VM: docker compose -f docker-compose.yml run --rm migrate manage.py migrate --check
     alt migrations pending
-        VM->>PG: pg_dump (gzip, timestamped) to /home/ubuntu/backups
+        VM->>PG: pg_dump (via postgres:18-alpine container, gzip, timestamped) to /home/ubuntu/backups
         VM->>VM: prune to 5 newest dumps
-        VM->>PG: manage.py migrate --noinput
+        VM->>PG: docker compose run --rm migrate manage.py migrate --noinput
     else nothing pending
         VM->>VM: skip migrate entirely
     end
-    VM->>VM: manage.py collectstatic --noinput
-    VM->>VM: pnpm build (theCommonsWeb, then broadcastWeb)
-    VM->>VM: grep built broadcastWeb bundle for a real thecommons.town API origin
-    VM->>VM: sudo systemctl restart gunicorn nextjs celery celerybeat broadcast-worker scrape-worker
-    VM->>VM: systemctl is-active on all six (must all report active)
+    VM->>VM: docker compose -f docker-compose.yml up -d (recreates every service from the images just built)
+    VM->>VM: docker compose ps --status running - assert redis, backend, celery, celerybeat, broadcast-worker, scrape-worker, nextjs, nginx all running
     GH->>VM: second SSH step - post-deploy smoke test
     VM->>VM: curl the three public domains, expect 200
-    VM->>VM: POST an invalid broadcast request, expect 403 not 500 (Unix-socket REMOTE_ADDR regression check)
+    VM->>VM: POST an invalid broadcast request, expect 403 not 500 (Unix-socket-era REMOTE_ADDR regression check, still run post-cutover)
     VM->>VM: GET /auth/me with no credentials, expect 401/403 not 500
 ```
 
-**Four things worth calling out.** First, the migration guard is genuinely conditional —
-`migrate --check` exits non-zero only when there's real unapplied work, so most deploys
-skip the dump-and-migrate branch entirely; a `pg_dump` is never skipped when a migration
-*is* about to run, and the guard hard-fails the whole deploy if `pg_dump` isn't installed
-rather than silently proceeding without a backup. Second, the broadcastWeb bundle grep
-exists because a malformed `VITE_BROADCAST_API_BASE_URL` builds cleanly and only fails at
-runtime, as every API call silently misroutes — this catches that class of bug before the
-build goes live, not after. Third, `systemctl is-active` passing is necessary but not
-sufficient — a crashing view or a misrouted SPA both restart clean and report `active`,
-which is exactly why there's a separate smoke-test step hitting real URLs afterward, not
-just a process-liveness check. Fourth, the smoke test's `403` check on a broadcast endpoint
-is a deliberate regression probe: nginx talking to gunicorn over a Unix socket used to
-leave `REMOTE_ADDR` empty, which crashed `django-ratelimit`'s IP-based rate limiting with
-an unhandled 500 on every request to a rate-limited broadcast view — a `500` here means
-that bug is back, a `403` means the request was correctly rejected before it ever became a
-ratelimit crash.
-
-There is no separate `gunicorn.service` or `nextjs.service` file in this repository's
-`deploy/` directory, and none exists anywhere in git history — those two units were set up
-by hand directly on the VM and were never checked in, unlike the four Celery-family units
-and the healthcheck unit, which are. If you need their exact unit-file contents, SSH in and
-read `/etc/systemd/system/gunicorn.service` / `nextjs.service` directly, or see the last
-commit of `DEPLOY.md` before its Docker rewrite (`git show 053d65b:DEPLOY.md`) for a
-recorded copy of what they contained as of late July.
-
-## 3. The systemd units
-
-| Unit | What it runs | Drains / serves | How to check it |
+**Four things worth calling out.** First, `collectstatic` and the frontend builds
+(`pnpm build` for both `theCommonsWeb` and `broadcastWeb`) are no longer separate deploy
+steps — they happen at Docker image build time (`backendServer/Dockerfile` bakes
+`staticfiles_build/static`; `Dockerfile.frontend` builds both frontends), so the deploy
+script itself only builds images, runs the guarded migration, and swaps containers.
+Second, the broadcastWeb bundle grep exists because a malformed
+`VITE_BROADCAST_API_BASE_URL` builds cleanly and only fails at runtime, as every API call
+silently misroutes — this catches that class of bug before the build goes live, not
+after. Third, the migration guard is genuinely conditional — `migrate --check` exits
+non-zero only when there's real unapplied work, so most deploys skip the dump-and-migrate
+branch entirely; a `pg_dump` (now run via a disposable `postgres:18-alpine` container,
+since the VM no longer has a host-level `postgresql-client`) is never skipped when a
+migration *is* about to run. Fourth, `docker compose ps --status running` replacing
+`systemctl is-active` is necessary but not sufficient — a crashing view or a misrouted SPA
+both restart clean and report running, which is exactly why there's a separate
+smoke-test step hitting real URLs afterward, not just a container-liveness check.
+
+The old `gunicorn.service`/`nextjs.service` units (never checked into `deploy/`, hand-set
+up on the VM) are gone along with the rest of the systemd app units — their process
+definitions now live in `docker-compose.yml`'s `backend` and `nextjs` services instead.
+If you need the exact historical unit-file contents from the systemd era, see the last
+commit of `DEPLOY.md` before its Docker rewrite (`git show 053d65b:DEPLOY.md`).
+
+### 3. The retired systemd units (historical reference)
+
+These units ran production until the 2026-08-02 Docker cutover (PR #41). They are no
+longer active on the VM — the table is kept for anyone debugging an old incident report,
+reading `docs/prod-incident-2026-07-21-scheduler-outage.md`, or comparing pre- and
+post-cutover behavior. **The one still-active exception is the last row.**
+
+| Unit | What it ran | Drained / served | Status today |
 |---|---|---|---|
-| `gunicorn` | Django via a Unix socket, 3 sync workers | `api.thecommons.town` (proxied by nginx) | `systemctl status gunicorn`; not tracked in `deploy/` — hand-configured on the VM |
-| `nextjs` | `node`/`npm run start` for `theCommonsWeb`, port 3000 | `thecommons.town` and `auth.thecommons.town` (both proxy to the same process) | `systemctl status nextjs`; not tracked in `deploy/` — hand-configured on the VM |
-| `redis-server` | Standard `apt`-installed Redis, `/etc/redis/redis.conf` | DB 0 = Celery broker/results, DB 1 = Django cache | `systemctl status redis-server`; `redis-cli -a <pass> ping` |
-| `celery` (`deploy/celery.service`) | Default worker, `.venv/bin/celery -A backend worker -n commons-default@%h --concurrency=2` | Everything not explicitly routed elsewhere — digest sends, misc tasks | `systemctl status celery`; `manage.py healthcheck`'s `celery_worker` probe |
-| `celerybeat` (`deploy/celerybeat.service`) | Scheduler, `django_celery_beat`'s `DatabaseScheduler` — exactly one process, never scale this | Fires `ingest-events-daily` (04:00 ET), `weekly-digest-sunday`/`monthly-digest` (18:00 ET), `broadcast-orphan-recovery` | `systemctl status celerybeat`; `manage.py healthcheck`'s per-task `beat:<name>` freshness probes — the check this doc's §8 incident is really about |
-| `broadcast-worker` (`deploy/broadcast-worker.service`) | Playwright form-filler, `celery -A backend worker -Q broadcast -c 1` | The dedicated `broadcast` queue only — `-c 1` is load-bearing, not tuning: orphan recovery assumes a single worker | `systemctl status broadcast-worker` |
-| `scrape-worker` (`deploy/scrape-worker.service`) | Headless-Chromium ingestion scraper, `celery -A backend worker -Q scrape -c 1` | The dedicated `scrape` queue, kept off the default worker so Chromium memory can't starve digests/ingestion | `systemctl status scrape-worker` |
-| `healthcheck.timer` / `.service` (`deploy/healthcheck.*`) | Hourly `bash deploy/healthcheck.sh`, itself running `manage.py healthcheck --require-prod` | Nothing — read-only report | `systemctl list-timers healthcheck.timer`; `journalctl -u healthcheck.service -n 50` |
-
-`celery`, `celerybeat`, `broadcast-worker`, and `scrape-worker` all `Require=` and
-`After=redis-server.service` and set `Restart=always` — the restart policy is
-belt-and-suspenders, explained in §4, not the primary fix for anything. `deploy/`'s
-`nginx-broadcast.conf.snippet` is not a systemd unit; it's an nginx server-block fragment
-meant to be appended by hand into the VM's single live config file.
-
-## 4. The `uv run` vs. venv-binary sharp edge — a real outage, not a style rule
-
-Every long-lived unit in `deploy/` execs `/home/ubuntu/thecommons/backendServer/.venv/bin/celery`
-directly. That specific phrasing — the venv binary, not `uv run celery`, and not a wrapper
-shell script — is load-bearing, and the reason is a real production incident recorded in
-full at `docs/prod-incident-2026-07-21-scheduler-outage.md`.
+| `gunicorn` | Django via a Unix socket, 3 sync workers | `api.thecommons.town` (proxied by nginx) | Retired — replaced by the `backend` container (TCP 8000) |
+| `nextjs` | `node`/`npm run start` for `theCommonsWeb`, port 3000 | `thecommons.town` and `auth.thecommons.town` (both proxied to the same process) | Retired — replaced by the `nextjs` container |
+| `redis-server` | Standard `apt`-installed Redis, `/etc/redis/redis.conf` | DB 0 = Celery broker/results, DB 1 = Django cache | Retired — replaced by the `redis` container (`redis:7-alpine`) |
+| `celery` (`deploy/celery.service`) | Default worker, `.venv/bin/celery -A backend worker -n commons-default@%h --concurrency=2` | Everything not explicitly routed elsewhere — digest sends, misc tasks | Retired — replaced by the `celery` container, same command |
+| `celerybeat` (`deploy/celerybeat.service`) | Scheduler, `django_celery_beat`'s `DatabaseScheduler` — exactly one process, never scale this | Fires `ingest-events-daily` (04:00 ET), `weekly-digest-sunday`/`monthly-digest` (18:00 ET), `broadcast-orphan-recovery` | Retired — replaced by the `celerybeat` container; still exactly one process |
+| `broadcast-worker` (`deploy/broadcast-worker.service`) | Playwright form-filler, `celery -A backend worker -Q broadcast -c 1` | The dedicated `broadcast` queue only — `-c 1` is load-bearing, not tuning: orphan recovery assumes a single worker | Retired — replaced by the `broadcast-worker` container, still `-c 1` |
+| `scrape-worker` (`deploy/scrape-worker.service`) | Headless-Chromium ingestion scraper, `celery -A backend worker -Q scrape -c 1` | The dedicated `scrape` queue, kept off the default worker so Chromium memory can't starve digests/ingestion | Retired — replaced by the `scrape-worker` container, still `-c 1` |
+| `healthcheck.timer` / `.service` (`deploy/healthcheck.*`) | Hourly `bash deploy/healthcheck.sh`, itself running `manage.py healthcheck --require-prod` | Nothing — read-only report | **Still live, host-level.** Never containerized — it shells into the running containers to run the same health command. |
+
+The `deploy/*.service` unit files (`celery.service`, `celerybeat.service`,
+`broadcast-worker.service`, `scrape-worker.service`, `healthcheck.service`,
+`healthcheck.timer`, `healthcheck.sh`) and `deploy/nginx-broadcast.conf.snippet` still
+physically exist in the repo's `deploy/` directory — nothing was deleted. "Retired" means
+retired on the production box, not removed from git history; they're kept as a rollback
+reference and because `healthcheck.service`/`.timer` are still genuinely in use.
+
+### 4. The `uv run` vs. venv-binary sharp edge — a real outage, not a style rule
+
+This is systemd-era history: it describes why the *retired* Celery-family units execed
+the venv binary directly rather than `uv run`. It no longer applies mechanically inside
+Docker (there's no snap-scope, no user-session teardown a container can be torn down by
+in the same way), but the incident is still the reason today's containerized Celery
+services (`celery`, `celerybeat`, `broadcast-worker`, `scrape-worker`) each run with
+`restart: unless-stopped` and no dependency on a login shell surviving — the underlying
+lesson (a "clean" silent exit is not the same as "still running") is exactly what that
+policy guards against in the new architecture too.
+
+Every long-lived systemd unit in `deploy/` execed
+`/home/ubuntu/thecommons/backendServer/.venv/bin/celery` directly. That specific phrasing
+— the venv binary, not `uv run celery`, and not a wrapper shell script — was
+load-bearing, and the reason is a real production incident recorded in full at
+`docs/prod-incident-2026-07-21-scheduler-outage.md`.
 
 ```mermaid
 flowchart TD
@@ -198,30 +237,33 @@ never touched snap, stayed up the entire time on the same VM through the same de
 async stack was fully dead for 8 days before anyone noticed, because the site itself kept
 serving pages — nothing about "the site is up" implied "background jobs are running."
 
-**What breaks if someone "simplifies" a unit back to `uv run`:** exactly this, again. The
-fix — execing `.venv/bin/celery` directly — removes the snap-scope mechanism entirely,
-which is the actual fix; `loginctl enable-linger ubuntu` and `Restart=always` are
-defense-in-depth layered on top, not substitutes for it. A reviewer who sees `uv run` as
-"more consistent with the rest of the deploy tooling" and reverts a unit to it silently
-reopens this exact failure mode — it will not show up in `systemctl status` right after the
-change, only after the next SSH session that started the deploy ends.
-
-**One deliberate exception, and it is not a contradiction:** `healthcheck.service` still
-uses `/snap/bin/uv` (`Environment=UV_BIN=/snap/bin/uv`, `ExecStart=... bash
-deploy/healthcheck.sh`) and that is fine. It's `Type=oneshot` — the process starts, runs
-the health report to completion in a few seconds, and exits on its own, well before any SSH
-session it happened to be triggered near could tear down. The failure mode above only bites
-a process still running at the moment a user slice gets torn down; a oneshot that's already
-finished has nothing left to kill. Don't read the healthcheck unit's `uv` line as
-permission to relax the rule anywhere else — it's a narrow exception with a specific reason,
-not evidence the rule is soft.
-
-## 5. Environment selection: `DJANGO_ENV` and how failure got narrower
+**What broke if someone "simplified" a unit back to `uv run`:** exactly this, again. The
+fix — execing `.venv/bin/celery` directly — removed the snap-scope mechanism entirely,
+which was the actual fix; `loginctl enable-linger ubuntu` and `Restart=always` were
+defense-in-depth layered on top, not substitutes for it.
+
+**The one still-live unit, `healthcheck.service`, was never exposed to this:** it is
+`Type=oneshot` with `ExecStart=/usr/bin/env bash
+/home/ubuntu/thecommons/deploy/healthcheck.sh --no-color` — no snap, no `uv`, no
+`UV_BIN` anywhere in the unit. (An earlier revision of this doc claimed it still ran
+through `/snap/bin/uv`; that is not what the file says — verified against
+`deploy/healthcheck.service` at commit `9a38379`.) Two independent reasons the outage
+class can't reach it: the process starts, runs the health report to completion in a few
+seconds, and exits on its own, so there's nothing still running when a user slice gets
+torn down; and it never enters a snap scope in the first place. Its own header comment
+makes the same point. What it *does* need from the host is `docker` reachable by
+`User=ubuntu` — i.e. `ubuntu` in the `docker` group — since the script now works by
+shelling into the containers (`docker compose ps` / `docker inspect` /
+`docker compose exec -T`) rather than running `manage.py` natively.
+
+### 5. Environment selection: `DJANGO_ENV` and how failure got narrower
 
 Django settings are resolved by `backend/settings/__init__.py` via a function,
 `select_settings_env`, reading the `DJANGO_ENV` environment variable — not by
 `DJANGO_SETTINGS_MODULE` pointing at `prod.py` directly, the way Django docs usually show
-it.
+it. This resolution mechanism is unchanged by the Docker cutover — every prod-facing
+service in `docker-compose.yml` (`backend`, `celery`, `celerybeat`, `broadcast-worker`,
+`scrape-worker`, `migrate`) sets `environment: DJANGO_ENV: prod` explicitly.
 
 ```mermaid
 flowchart TD
@@ -251,46 +293,48 @@ slow. `events/tests/test_config_fast.py` pins this exact behavior as a regressio
 
 The remaining gap — `DJANGO_ENV` unset in prod specifically, which the hard-error change
 does nothing for, since unset is still valid input — is caught by `manage.py healthcheck
---require-prod`, run hourly via `healthcheck.timer`. That command checks `settings.DEBUG`
-and whether `ALLOWED_HOSTS` is anything other than localhost-only, and reports a `FAIL` if
-either looks like dev settings leaked into what's supposed to be prod. **Read `--require-prod`
-correctly: it is a detector, not a guard.** It can tell you, up to an hour later, that
-production is quietly running on dev settings; it cannot stop that from happening, and it
-does not run on every request or every deploy — only once an hour, on the health-check
-timer's own schedule. A misconfigured `.env` on the VM still means real downtime for up to
-that long before anyone is told.
-
-## 6. Media: why it lives outside the checkout
+--require-prod`, still run hourly via the host-level `healthcheck.timer` (§3), which now
+shells into the containers rather than running natively on the host. That command checks
+`settings.DEBUG` and whether `ALLOWED_HOSTS` is anything other than localhost-only, and
+reports a `FAIL` if either looks like dev settings leaked into what's supposed to be prod.
+**Read `--require-prod` correctly: it is a detector, not a guard.** It can tell you, up to
+an hour later, that production is quietly running on dev settings; it cannot stop that
+from happening, and it does not run on every request or every deploy — only once an hour.
+A misconfigured `.env`/`env_file` on the VM still means real downtime for up to that long
+before anyone is told.
+
+### 6. Media: why it lives outside the checkout
 
 `MEDIA_ROOT` (client-uploaded event images) is set in production to
 `/home/ubuntu/broadcast/media` — a path that sits next to the git checkout
 (`/home/ubuntu/thecommons`), not inside it. `backend/settings/base.py`'s own comment on
 `MEDIA_ROOT` states the reason directly: it defaults to a path *inside* the checkout for
-local dev, but production overrides it in `.env` specifically so a `git pull` during deploy
-can never touch uploaded files. A deploy that ran `git clean` or reset the working tree
-inside the checkout would have no way to reach these files at all — they're simply not
-under that directory.
-
-The second half of the same design: nginx serves `/media/` directly as a plain file alias,
-and Django is never in that request path in production. The comment in `base.py` says this
-outright ("Served by nginx in prod, never by Django"), and the pre-Docker `DEPLOY.md`
-revision that documented the live nginx config confirms it as a sibling `location /media/`
-block to the existing `/static/` alias, pointing at the same `MEDIA_ROOT` path. The reason
-is the ordinary one for serving static assets from the ingress instead of the app server:
-nginx does it faster and without spinning up a Python worker to stream a file back to
-disk. There's a real cost worth knowing about, not a bug: uploaded images are kept
-indefinitely — no pruning job exists anywhere in this repo — so `MEDIA_ROOT` grows without
-bound. At roughly 1–3 MB per event this is currently negligible against the VM's block
-volume, but it's a number worth keeping an eye on, not a problem to "fix" by inventing a
-retention policy nobody asked for yet.
-
-## 7. Dev/prod database isolation
+local dev, but production overrides it in `.env` specifically so a `git pull` during
+deploy can never touch uploaded files. That reasoning carried straight into the Docker
+cutover: `docker-compose.yml`'s `backend` and `nginx` services both bind-mount the same
+absolute host path (`${MEDIA_ROOT_HOST:-/home/ubuntu/broadcast/media}`) rather than
+baking it into an image layer — deliberately the identical path prod's `.env` already
+used, so the cutover needed zero changes to that variable.
+
+The second half of the same design: nginx serves `/media/` directly as a read-only bind
+mount, and Django is never in that request path in production — the comment in `base.py`
+says this outright ("Served by nginx in prod, never by Django"). The reason is the
+ordinary one for serving static assets from the ingress instead of the app server: nginx
+does it faster and without spinning up a Python worker to stream a file back to disk.
+There's a real cost worth knowing about, not a bug: uploaded images are kept indefinitely
+— no pruning job exists anywhere in this repo — so `MEDIA_ROOT` grows without bound. At
+roughly 1–3 MB per event this is currently negligible against the VM's block volume, but
+it's a number worth keeping an eye on, not a problem to "fix" by inventing a retention
+policy nobody asked for yet.
+
+### 7. Dev/prod database isolation
 
 Every developer's local `DATABASE_URL` should point at a **Neon branch**, not the
 production database — Neon branches are copy-on-write snapshots with their own connection
 string, so a branch can be migrated, seeded, and reset freely without ever touching prod
 rows. `docs/dev-db-isolation.md` is the full design doc; the shape that matters here is:
-the production VM's `.env` keeps the real `DATABASE_URL` pointed at Neon's main branch, and
+the production VM's `backendServer/.env` (now read by every service via `env_file:` in
+`docker-compose.yml`) keeps the real `DATABASE_URL` pointed at Neon's main branch, and
 `DJANGO_ENV` is what decides which settings module (and therefore which behavioral
 guardrails) apply — it does not, by itself, decide which database gets used. Nothing in
 Django enforces that a `dev`-settings process can't be pointed at the prod `DATABASE_URL`;
@@ -309,7 +353,7 @@ to prod. If you ever set this variable locally, verify the role actually rejects
 `INSERT`/`CREATE TABLE` against the `prod_readonly` connection should error with `permission
 denied`) before trusting it.
 
-## 8. Historical incident, still worth knowing
+### 8. Historical incident, still worth knowing
 
 `docs/prod-incident-2026-07-21-scheduler-outage.md` is the full forensic record behind §4's
 sharp edge — worth reading in full if you're the one debugging a "the site works but nothing
@@ -321,37 +365,50 @@ stale or never-fired beat schedule is now a hard `FAIL` in `manage.py healthchec
 `WARN` — a scheduler that stopped firing is treated as an outage, not a suggestion, because
 that distinction is what would have caught this incident in hours instead of the 8 days it
 actually took (the outage was only found by chance, during unrelated forensics against
-`/devtools/monitor`, not by any monitoring that existed at the time).
-
-## 9. The pending cutover: containers are built, not live
-
-A parallel effort in this same working tree has built a complete Docker Compose
-replacement for everything in this document — one container per service, described in
-`docker-compose.yml`, `backendServer/Dockerfile`, `Dockerfile.frontend`, and
-`deploy/nginx/`, with the full rationale in `docs/adr/0001-containerization.md`. It has been
-verified locally end-to-end. **None of it is live.** The Oracle VM does not have Docker
-installed, the `ubuntu` user isn't in a `docker` group, the persistent bind-mount
-directories the compose file expects don't exist on the box, and the seven systemd units
-this document describes have not been touched. `DEPLOY.md` was rewritten during this same
-session to describe the containerized stack as the deploy target — read it as a plan for
-the next cutover, not as a description of what answers a request to
-`api.thecommons.town` right now. `containerization.md` (a sibling human doc, written
-alongside this one) covers what changes once that cutover happens — new service names,
-TCP instead of a Unix socket for gunicorn, images instead of a checked-out venv, and how
-the exact sharp edges in §4–§6 above either disappear or get re-solved a different way
-inside a container. Until someone runs that cutover on the actual VM, treat every fact in
-§1–§7 of this document as the operative reality, and treat `DEPLOY.md`'s Docker
-instructions as a runbook waiting for its day one, not a record of today.
-
-## 10. Known gaps
-
-No push notification exists for a failed health check — `systemctl --failed` and
-`journalctl -u healthcheck.service` are the only read paths today; nothing pages anyone.
-There is no automated rollback if a deploy's smoke test fails after the systemd restarts
-already happened — the units are already running the new code by the time the smoke test
-runs, so a failing smoke test currently means "go SSH in and diagnose," not "the previous
-version is automatically restored." The exact live contents of `gunicorn.service` and
-`nextjs.service` are not verifiable from this repository at all, for the reason noted in
-§2 — they were never committed; anyone needing their precise current flags should SSH in
-and read them directly rather than trust any doc's transcription, including this one's
-citation of an old `DEPLOY.md` revision.
+`/devtools/monitor`, not by any monitoring that existed at the time). This incident predates
+the Docker cutover and describes systemd-era behavior, but the healthcheck severity change
+it produced is still in effect today.
+
+### 9. The Docker cutover: done, not pending
+
+**This section previously described the cutover as pending. It shipped.** As of
+2026-08-02 (PR #41), the Docker Compose replacement described here is what runs in
+production. The Oracle VM has Docker Engine + the `docker compose` v2 plugin installed,
+the `ubuntu` deploy user is in the `docker` group (no `sudo` needed in the deploy path),
+the persistent bind-mount directories (`/home/ubuntu/backups`, `/home/ubuntu/broadcast/{media,screenshots,downloads}`)
+exist on the box, and the seven systemd units §3 describes have been stopped and are no
+longer part of the live deploy path (healthcheck excepted).
+
+The stack is described by `docker-compose.yml`, `backendServer/Dockerfile`,
+`Dockerfile.frontend`, and `deploy/nginx/`, with the full rationale in
+`docs/adr/0001-containerization.md`. `DEPLOY.md` is the current, accurate, Docker-first
+deploy runbook — read it as a description of what answers a request to
+`api.thecommons.town` right now, not a plan for someday. `containerization.md` (a sibling
+human doc) covers what changed in the cutover in more detail — new service names, TCP
+instead of a Unix socket for gunicorn, images instead of a checked-out venv, and how the
+sharp edges in §4–§6 above either disappeared or got re-solved a different way inside a
+container. Treat every fact in §1–§8 of this document as reflecting the current
+containerized reality except where a section explicitly marks something as historical
+(§3, §4, §8).
+
+One live-config trap worth restating here because it bit the cutover directly: a bare
+`docker compose` command (no `-f docker-compose.yml`) auto-loads
+`docker-compose.override.yml`, which is local-dev-only (plain HTTP nginx, no cert,
+repo-relative bind mounts, `DJANGO_ENV=dev`) — running that against the VM would silently
+deploy the dev config to prod. Every command in `DEPLOY.md` and in the CI deploy job
+passes `-f docker-compose.yml` explicitly for this reason.
+
+### 10. Known gaps
+
+No push notification exists for a failed health check — `docker compose ps`,
+`journalctl -u healthcheck.service` (still host-level, §3), and `docker logs <service>`
+are the only read paths today; nothing pages anyone. There is no automated rollback if a
+deploy's smoke test fails after `docker compose up -d` already ran — the containers are
+already running the new images by the time the smoke test runs, so a failing smoke test
+currently means "go SSH in and diagnose," not "the previous version is automatically
+restored." The exact historical contents of the retired `gunicorn.service` and
+`nextjs.service` units are not verifiable from this repository at all, for the reason
+noted in §2 — they were never committed even before the cutover; anyone needing their
+precise legacy flags should consult the last pre-Docker `DEPLOY.md` revision
+(`git show 053d65b:DEPLOY.md`) rather than trust any doc's transcription, including this
+one's.
diff --git a/human-docs/design-system.md b/human-docs/design-system.md
index 1496680..8e3ae65 100644
--- a/human-docs/design-system.md
+++ b/human-docs/design-system.md
@@ -1,12 +1,30 @@
 # Design System
 
-*Reflects commit `5fe7a45`, 2026-08-01. Every token, class, and component below was read out of `theCommonsWeb/src/app/globals.css` and `theCommonsWeb/src/components/ui/` directly — not inferred from prose. Where `CODING_STYLE.md` (the repo's canonical style statement, which this doc complements and does not replace) disagrees with the stylesheet, both are stated and the disagreement is called out. For the Next.js routing/data-fetching layer these components sit inside, see `frontend.md`; for the product as a whole, see `overview.md`.*
+> **Last updated:** 2026-08-03, commit `9a38379`, branch `suite-47-tags-and-filters`. Every token, class, and component in the Deep Dive was read out of `theCommonsWeb/src/app/globals.css` and `theCommonsWeb/src/components/ui/` directly — not inferred from prose. Where `CODING_STYLE.md` (the repo's canonical style statement, which this doc complements and does not replace) disagrees with the stylesheet, both are stated and the disagreement is called out. For the Next.js routing/data-fetching layer these components sit inside, see `frontend.md`; for the product as a whole, see `overview.md`.
 
-## 1. What this is, in one paragraph
+## Overview
+
+- **What it is:** The Commons is styled to look like a broadsheet newspaper's classifieds page crossed with early Craigslist — serif type, cream newsprint background, black ink, hairline/thick column rules doing the separation work that cards and shadows do in most modern products, and a bias toward density over whitespace. This is the whole visual vocabulary, not a retro skin on a normal SaaS layout.
+- **Why it's this way:** The Commons is a local events bulletin for three small towns, not a venture-backed platform. It wants to read like a community notice board a neighbor posted, not a pitch deck — so density, rules, and serifs are load-bearing for trust, not decoration.
+- **Who depends on it:** Every component under `theCommonsWeb/src/components/ui/` and the layout components (`Header.tsx`, `Sidebar.tsx`, `Footer.tsx`, `EventFeed.tsx`, etc.) consume the same small set of CSS custom properties defined once in `globals.css`. There is no Tailwind config file and no `@theme` block — Tailwind v4 is used with its bare default scale plus these tokens.
+- **The one or two facts that matter most:** (1) There are exactly four separation devices — hairline rule, standard rule, thick rule, and one specific hard-edged "print" shadow — and no soft/blurred shadows or `border-radius` anywhere except a handful of sub-20px decorative dots and skeleton blocks. (2) There's only one serif stack (Georgia) used for all headlines and body copy, and one sans-serif stack reserved strictly for button/chrome labels, never for content.
+- **Known live bug:** `--color-ink` is referenced in two components but never defined anywhere in the stylesheet — see Deep Dive §2 and §8.
+- **Where to jump for a given task:**
+  - Adding/changing a color or font → Deep Dive §2 (Tokens)
+  - Sizing text → Deep Dive §3 (Type scale)
+  - Laying out a page or section → Deep Dive §4 (Spacing and layout)
+  - Deciding between a border, a rule, or a shadow → Deep Dive §5
+  - Reusing or extending a `ui/` component → Deep Dive §6
+  - Checking whether something you're about to write is disallowed → Deep Dive §7 (Banned)
+  - Known inconsistencies and open gaps → Deep Dive §8
+
+## Deep Dive
+
+### 1. What this is, in one paragraph
 
 The Commons is styled to look like a broadsheet newspaper's classifieds page had a baby with early Craigslist: serif type, cream newsprint, black ink, hairline and thick column rules doing the job cards and shadows do everywhere else, and a bias toward packing information in rather than giving it room to breathe. This isn't a retro skin bolted onto a normal SaaS layout — it's the whole vocabulary. A contributor who reaches for a rounded card with a soft shadow because that's what every other product looks like is not making a small stylistic choice; they're building the wrong product. The reason it matters: The Commons is a *local* events bulletin for three small towns, not a venture-backed platform, and it wants to read like a community notice board someone would trust a neighbor posted to — not like a pitch deck. Density, rules, and serifs are load-bearing for that trust, not decoration.
 
-## 2. Tokens
+### 2. Tokens
 
 All color and font values are CSS custom properties declared once, on `:root`, in `globals.css`. **Nothing else defines colors or fonts** — Tailwind v4 is configured with a bare `@import "tailwindcss";` at the top of that same file and no `@theme` block, no `tailwind.config.js`/`.ts` anywhere in the repo. Components consume the tokens either as Tailwind arbitrary values (`bg-[var(--color-bg)]`) or the newer Tailwind v4 shorthand (`border-(--color-border)`) — both forms are in active use side by side; neither is preferred over the other in the current code.
 
@@ -33,7 +51,7 @@ All color and font values are CSS custom properties declared once, on `:root`, i
 
 **A token that's referenced but doesn't exist:** `TimeWindowSelector.tsx` and `SectionSelector.tsx` both reference `var(--color-ink)` (e.g. `text-[var(--color-ink)]`). There is no `--color-ink` custom property defined anywhere in `globals.css` or any other stylesheet in the repo — it isn't a synonym that resolves elsewhere. An undefined CSS custom property used without a fallback makes the property using it invalid at computed-value time, which for `color` means it falls back to the inherited value rather than doing anything the author intended. In practice this makes the inactive state of the time-window and section dropdowns render in whatever color they'd inherit rather than the near-black ink the rest of the system uses. This is a live bug, not a stylistic choice — the fix is renaming both usages to `--color-text`.
 
-## 3. Type scale
+### 3. Type scale
 
 There is no declared type scale (no `@theme` font-size tokens, no Tailwind config extending `fontSize`). What exists is the Tailwind v4 default scale (`text-xs` through `text-6xl`) plus a lot of arbitrary pixel values and `clamp()` expressions for display headlines that need to be fluid. Reading across `Header.tsx`, `EventFeed.tsx`, `EventRow.tsx`, `Sidebar.tsx`, `Footer.tsx`, and `MiniCalendar.tsx`, the sizes actually in use settle into these bands:
 
@@ -50,7 +68,7 @@ There is no declared type scale (no `@theme` font-size tokens, no Tailwind confi
 
 The pattern to copy: headlines are large and fluid via `clamp()` set inline (`style={{ fontSize: '...' }}`), everything else is small, uppercase, and letter-spaced when it's a label rather than content. There is no `text-4xl`/`text-5xl`/`text-6xl` Tailwind class in use anywhere — display sizes are handled by `clamp()`, not the static scale, because they need to shrink on mobile without a breakpoint ladder.
 
-## 4. Spacing and layout
+### 4. Spacing and layout
 
 No custom spacing scale — Tailwind's default spacing scale (the `p-1`, `px-4`, `gap-6`, etc. system) is used directly, no `@theme` override. Two layout constants recur:
 
@@ -61,7 +79,7 @@ The sidebar/content split (`PageLayout.tsx`) is a 4-column CSS grid, sidebar tak
 
 Density in practice: `Sidebar.tsx` stacks a dozen-plus distinct blocks (post button, date, calendar, view toggle, social link, tag filters, clear-filters, count, digest box) separated only by `<hr>` hairlines with no card wrapper around any of them. That's the intended texture — a long, rule-divided column, not a stack of padded cards.
 
-## 5. Rules, borders, and the one shadow that's allowed
+### 5. Rules, borders, and the one shadow that's allowed
 
 This is the section that replaces "cards with shadows for elevation." The system has exactly four separation devices, and reaching for anything outside this list should be treated as a smell.
 
@@ -76,7 +94,7 @@ That fourth row is the one to read carefully, because "no drop shadows" (the ban
 
 **Decision procedure:** reaching for a shadow to create separation between a block and its background? First ask whether a rule (row 1–3) does the job — it almost always does, since most separation here is "this is a distinct row/section," not "this is floating above the page." If the block genuinely needs to read as a card sitting on top of the page (a modal, a featured/pinned item), use the exact hard-shadow value above, never a new blurred one.
 
-## 6. Component inventory — `src/components/ui/`
+### 6. Component inventory — `src/components/ui/`
 
 Eight components, seven exported from `index.ts` (`Banner.tsx` exists in the directory but is not re-exported — import it directly from `../ui/Banner` if needed, or add it to the barrel if this omission isn't intentional; nothing else in the tree currently imports it that way, so it's unclear whether the omission was deliberate).
 
@@ -95,7 +113,7 @@ Eight components, seven exported from `index.ts` (`Banner.tsx` exists in the dir
 
 **When to reuse vs. add a new component:** if what you need is a differently-colored button, a differently-sized input, or a badge with a third state, that's a prop on the existing component, not a new file — none of the existing `ui/` components take a `variant` prop that isn't exhaustive of what's actually used elsewhere in the app. Add a new component only when the *shape* is new (nothing here is a modal-with-a-form, a toast, a tooltip, a dropdown-menu-as-a-primitive — `TimeWindowSelector.tsx` and `SectionSelector.tsx` in `layout/` each hand-roll their own dropdown rather than sharing one, which is itself worth noticing as duplication if you're about to build a third one).
 
-## 7. Banned — enforceable in code review
+### 7. Banned — enforceable in code review
 
 If a diff introduces any of the following, it doesn't match this system regardless of how good it looks in isolation:
 
@@ -137,7 +155,7 @@ If a diff introduces any of the following, it doesn't match this system regardle
 </div>
 ```
 
-## 8. Known drift and gaps
+### 8. Known drift and gaps
 
 - **`--color-ink` is used but never defined** (§2) — a live bug in `TimeWindowSelector.tsx` and `SectionSelector.tsx`, not a documented token. Fix by renaming both usages to `--color-text`.
 - **`Banner.tsx` is not exported from `src/components/ui/index.ts`** — every other `ui/` component is. Unclear whether this is intentional; flagged rather than silently fixed since fixing it is a code change outside this doc's scope.
diff --git a/human-docs/frontend.md b/human-docs/frontend.md
index 93faa2e..46d7246 100644
--- a/human-docs/frontend.md
+++ b/human-docs/frontend.md
@@ -1,14 +1,39 @@
 # The Main Site (theCommonsWeb)
 
-Reflects `theCommonsWeb/` at commit `5fe7a45` on `all-things-ingestion`, dated 2026-08-01. This
-complements `theCommonsWeb/AGENTS.md` (the agent-facing directory map, which stays terse) —
+> **Last updated:** 2026-08-03, commit `9a38379`, branch `suite-47-tags-and-filters`
+
+## Overview
+
+- `theCommonsWeb` is the public-facing Next.js 16 site (App Router, React 19, Tailwind v4,
+  TanStack Query v5) that renders the event feed, calendar, post-an-event flow, profile/dashboard
+  pages, and the standalone sign-in/sign-up portal. If this app is down, the whole site is down —
+  there's no fallback rendering path.
+- It talks to two backends: the Django REST API (`backendServer/`) for events/profiles/business
+  data, and its own **Better Auth instance running inside this same Next.js process** for
+  identity. The one fact newcomers get backwards most: this app *is* the identity provider —
+  Django only mirrors Better Auth's `neon_auth` tables read-only and verifies the JWTs this app
+  issues.
+- The Django API has no server-rendered pages of its own; it's a pure JSON backend consumed by
+  this app (and separately by `broadcastWeb`, not covered here).
+- Where to go for a given task: home-feed rendering/prefetch → Deep Dive §2.1; how sign-in/sign-up
+  resolves a session and JWT → §2.2; the "fill out `/post` while signed out" flow → §2.3; the
+  route table → §3; hooks/services and query keys → §4; client-side auth gating → §5; visual
+  spec pointer → §6; known traps (npm vs pnpm, type-checking, stale docs, query-key drift) → §7;
+  open gaps the author didn't chase down → §8.
+- Related docs: `theCommonsWeb/AGENTS.md` (terser, agent-facing directory map), `auth.md` (Better
+  Auth internals, JWT/JWKS, cross-subdomain cookie), `design-system.md` (visual spec), `data-model.md`
+  (Django API shapes), `testing.md` (running the test suite).
+
+## Deep Dive
+
+This complements `theCommonsWeb/AGENTS.md` (the agent-facing directory map, which stays terse) —
 this doc goes deeper for a human landing in the codebase for the first time. For the identity
 bridge itself (Better Auth internals, JWT/JWKS verification, the cross-subdomain cookie), see
 `auth.md`; this doc only covers how the React side consumes that bridge. For the visual spec,
 see `design-system.md`. For the shapes the Django API returns, see `data-model.md`. For running
 the test suite, see `testing.md`.
 
-## 1. What this is and who depends on it
+### 1. What this is and who depends on it
 
 `theCommonsWeb` is the public-facing Next.js 16 site — the App Router, React 19, Tailwind v4,
 TanStack Query v5 stack that renders the newspaper-style event feed, the calendar, the post-an-
@@ -28,9 +53,9 @@ site is down — there is no fallback rendering path. If only Django is down, th
 serves its shell and cached data (see §2.1's "Django down" branch), which is a deliberate
 design choice in the home page's server component.
 
-## 2. How it works
+### 2. How it works
 
-### 2.1 Rendering the home feed — server prefetch, hydration, client refetch
+#### 2.1 Rendering the home feed — server prefetch, hydration, client refetch
 
 The home route (`/`) is unusual among the app's pages: `app/page.tsx` is an async **server**
 component that prefetches three queries into a `QueryClient` before any HTML reaches the
@@ -100,7 +125,7 @@ call when `window` is undefined (i.e., on the server) and a memoized singleton i
 sharing one instance across concurrent server requests would leak one visitor's prefetched data
 into another's response.
 
-### 2.2 From a session cookie to `useAuth().user`
+#### 2.2 From a session cookie to `useAuth().user`
 
 `useAuth` (`src/hooks/useAuth.tsx`) is the only sanctioned way for a component to know who's
 signed in — components must not call `authClient` (the Better Auth client, `src/lib/auth-client.ts`)
@@ -168,7 +193,7 @@ Second, sign-in and sign-up both leave the actual profile fetch to the same code
 then `fetchProfileFromDjango`), so a bug in the profile fetch shows up identically regardless of
 which portal flow triggered it — there's no separate "new user" profile-loading code.
 
-### 2.3 Posting an event across the auth wall
+#### 2.3 Posting an event across the auth wall
 
 `/post` is reachable, and its form fully usable, without being signed in — the auth requirement
 only bites at submission. This produces a flow that spans two page loads and a full-origin
@@ -197,7 +222,7 @@ using a private window that clears storage on cross-origin navigation) between s
 loses the draft silently. There's no warning for this; the user just lands back on an empty
 form.
 
-## 3. Routes
+### 3. Routes
 
 | Path | File | Type | Auth required? | Purpose |
 |---|---|---|---|---|
@@ -224,7 +249,7 @@ route handlers, all of which exist and are live in the current tree. Worth fixin
 the next time someone's in there; not fixed here per this doc's scope (docs only, and that file
 belongs to the agent-facing tree).
 
-## 4. The data layer: hooks and services
+### 4. The data layer: hooks and services
 
 Every network call to Django goes through `src/services/`, never directly from a component or
 hook. Each service function reads `NEXT_PUBLIC_API_BASE_URL` (default `http://127.0.0.1:8000`)
@@ -258,7 +283,7 @@ by string literal; `EditEventModal`'s update mutation invalidates `['my-events']
 do match, but a rename in one file silently stops invalidating the other. There is no shared
 query-key constants module; string literals are the entire convention.
 
-## 5. Auth on the client
+### 5. Auth on the client
 
 `useAuth` is the boundary — see §2.2 for how it resolves state, and `auth.md` for the Better
 Auth configuration, the JWKS bridge to Django, and the cross-subdomain cookie setup in
@@ -277,7 +302,7 @@ client-rendered content is gated. All of the pages that need this today are clie
 with no sensitive server-fetched data, so it hasn't mattered in practice, but it's not a
 structural guarantee.
 
-## 6. Design system
+### 6. Design system
 
 Tailwind v4 with the newsprint palette and typography as CSS custom properties in
 `src/app/globals.css`, plus the `.rule-thick`/`.drop-cap`/`.skeleton-block` utilities used
@@ -285,7 +310,7 @@ throughout the pages above. The full enforceable spec — the banned list, the t
 component conventions — lives in `design-system.md`; nothing in this doc should be treated as
 the aesthetic source of truth.
 
-## 7. Sharp edges
+### 7. Sharp edges
 
 **`npm install` is not blocked by anything mechanical — only by convention.** There is no
 `packageManager` field in `package.json`, no `engines` field, and no `preinstall`/`only-allow`
@@ -372,7 +397,7 @@ and `theCommonsWeb/AGENTS.md` don't exist in the code.** The actual keys are `['
 code has since diverged from — and it matters in practice because it's exactly the kind of key
 someone would copy-paste from the docs into a new invalidation call and have it silently no-op.
 
-## 8. Known gaps
+### 8. Known gaps
 
 I did not find a shared constants module for query keys (confirmed by grepping every
 `queryKey:`/`invalidateQueries`/`setQueryData` call site in `src/`) — every key is a string
diff --git a/human-docs/ingestion.md b/human-docs/ingestion.md
index c4d5c82..b8d5647 100644
--- a/human-docs/ingestion.md
+++ b/human-docs/ingestion.md
@@ -1,19 +1,47 @@
 # The Ingestion Pipeline
 
-Written 2026-08-01 against commit `5fe7a45`. This is the human-facing companion to
-[`docs/ingestion-pipeline.md`](../docs/ingestion-pipeline.md) (the agent-facing deep dive —
-stays the system of record for exact request/response shapes) and
-[`docs/safety-scoring.md`](../docs/safety-scoring.md) /
-[`docs/ingestion-monitoring.md`](../docs/ingestion-monitoring.md) (the `/devtools/monitor`
-dashboard and the `SourceRun` health model). Where this doc and those disagree, the code
-won this argument — see "Drift from `docs/ingestion-pipeline.md`" at the end.
+> **Last updated:** 2026-08-03, commit `9a38379`, branch `suite-47-tags-and-filters`. This
+> is the human-facing companion to [`docs/ingestion-pipeline.md`](../docs/ingestion-pipeline.md) (the
+> agent-facing deep dive — stays the system of record for exact request/response shapes)
+> and [`docs/safety-scoring.md`](../docs/safety-scoring.md) /
+> [`docs/ingestion-monitoring.md`](../docs/ingestion-monitoring.md) (the `/devtools/monitor`
+> dashboard and the `SourceRun` health model). Where this doc and those disagree, the code
+> won this argument — see "Drift from `docs/ingestion-pipeline.md`" at the end.
 
 Audience: someone inheriting this codebase who needs to either add a new town's event
 calendar as a source, or figure out why a source has gone quiet.
 
----
-
-## 1. What this is and who depends on it
+## Overview
+
+- **What it is:** The Commons doesn't rely on people submitting events by hand. It polls a
+  list of town/venue/chamber-of-commerce websites on a schedule, pulls whatever raw event
+  data each site exposes, hands each event to Google Gemini to clean it up into a
+  consistent record, screens it for spam/abuse (also via Gemini), and — if it's clean —
+  publishes it as a live `Event` on thecommons.town. A human only gets pulled in for an
+  unrecognized town, a borderline safety score, or a probable duplicate.
+- **Who depends on it:** the public `events` app (everything on the site is either
+  pipeline-published or a direct host submission that went through the same code path),
+  and the `broadcast` subsystem, which pushes already-published `Event` rows out to other
+  towns' calendars (broadcast only ever reads `Event`, never `RawEvent`/`StagedEvent`).
+- **The one fact that matters most:** there are two separate ways an event gets in —
+  the **scheduled bulk pipeline** (nightly poll of every due source) and **direct host
+  submission** (a business submits one event synchronously through the broadcast SPA).
+  They share most of the same machinery (standardize → dedupe → safety-score → publish)
+  but differ in ordering and terminal status — see Deep Dive §2 for both.
+- **If ingestion silently stops**, nothing crashes or errors on the frontend — the site
+  just slowly stops getting new events, which is why the `/devtools/monitor` dashboard
+  (Deep Dive §4, and `docs/ingestion-monitoring.md`) exists.
+- **Where to go for what:**
+  - Adding a new source or classifying a URL as `ics`/`scraper`/`http` → Deep Dive §5.
+  - A source has gone quiet or you're debugging why an event never went live → Deep Dive
+    §6 (Sharp edges) and §7 (Known gaps).
+  - Understanding the data model (`EventSource`, `SourceRun`, `RawEvent`, `StagedEvent`,
+    `Event`) → Deep Dive §3.
+  - Wiring into an endpoint or CLI command → Deep Dive §4 (Interfaces).
+
+## Deep Dive
+
+### 1. What this is and who depends on it
 
 The Commons doesn't ask anyone to submit events by hand (mostly). Instead it polls a list
 of town/venue/chamber-of-commerce websites on a schedule, pulls whatever raw event data
@@ -42,9 +70,9 @@ covered below.
 
 ---
 
-## 2. How it works
+### 2. How it works
 
-### 2.1 The scheduled pipeline: source → live Event
+#### 2.1 The scheduled pipeline: source → live Event
 
 This is the nightly batch flow — one pass touches every due source, then every
 unprocessed row created by that pass. It's the same shape whether it's triggered by
@@ -113,7 +141,7 @@ flowchart TD
    deduplicator's matching corpus, so a duplicate of an already-published event still has
    something to match against. See "Publishing doesn't delete" under Sharp Edges.
 
-### 2.2 Direct host submission: one event, synchronously
+#### 2.2 Direct host submission: one event, synchronously
 
 A business/venue operator using the broadcast SPA can submit an event straight into the
 pipeline (`POST /api/events/direct-submit`), bypassing the poll step entirely. This is a
@@ -180,7 +208,7 @@ flowchart TD
 
 ---
 
-## 3. Data model
+### 3. Data model
 
 | Model | Key fields | What it represents |
 |---|---|---|
@@ -194,7 +222,7 @@ For the full cross-app data model (accounts, newsletter, broadcast included) see
 [`data-model.md`](data-model.md) once it exists, or `ARCHITECTURE.md`'s "Data Models"
 section today.
 
-### `StagedEvent.status` lifecycle
+#### `StagedEvent.status` lifecycle
 
 ```mermaid
 stateDiagram-v2
@@ -228,7 +256,7 @@ went through the real publish flow. See Sharp Edges.
 
 ---
 
-## 4. Interfaces
+### 4. Interfaces
 
 | Interface | Auth | Calls |
 |---|---|---|
@@ -250,7 +278,7 @@ went through the real publish flow. See Sharp Edges.
 
 ---
 
-## 5. Adding a new source: classification
+### 5. Adding a new source: classification
 
 Every new source has to be classified as one of `ics`, `scraper`, or `http` before any
 code gets written. The repo has a slash command for this (`/source-creation`, or the
@@ -338,7 +366,7 @@ separately, by hand or via `/devtools/ingestion-playground`
 
 ---
 
-## 6. Sharp edges
+### 6. Sharp edges
 
 **`events.Event`'s primary key is `uuid`, not `id`.** `Event` declares
 `uuid = models.UUIDField(primary_key=True, ...)` and has no `id` column at all — calling
@@ -427,7 +455,7 @@ permanently look unattributed and unverified compared to one that went through
 
 ---
 
-## 7. Known gaps
+### 7. Known gaps
 
 - **`EventSource.source_type` has an `"email"` choice with no importer behind it anywhere
   in the codebase.** It's a defined model choice, nothing more — treat it as reserved/dead
@@ -448,7 +476,7 @@ permanently look unattributed and unverified compared to one that went through
   of the shipped tool. Treat it as historical design context, not a current behavior
   reference, until someone re-verifies it against `devtools/` directly.
 
-### Drift from `docs/ingestion-pipeline.md`
+#### Drift from `docs/ingestion-pipeline.md`
 
 That doc is the agent-facing deep dive and stays authoritative for request/response
 shapes, but as of this pass it has fallen behind the code in a few concrete ways worth
diff --git a/human-docs/newsletter.md b/human-docs/newsletter.md
index 579df10..e65754b 100644
--- a/human-docs/newsletter.md
+++ b/human-docs/newsletter.md
@@ -1,16 +1,42 @@
 # The Newsletter (`newsletter` app)
 
-*Reflects commit `5fe7a45`, 2026-08-01. Written by reading `backendServer/newsletter/` in
-full (models, views, urls, `email_service.py`, `tasks.py`, `admin.py`, the digest management
-commands, migrations, and the email templates under `newsletter/templates/email/`), the
-generic transport it calls out to (`backendServer/events/email_service.py`), the parts of
-`backendServer/accounts/` that touch subscribers, and the beat/Brevo settings in
-`backendServer/backend/settings/base.py`. Complements `overview.md` (§6, one-paragraph
-summary), `data-model.md` (the field-level `NewsletterSubscriber` table and the Suite 41
-migration history), and `auth.md` (the account-holder side of identity). If anything here
-disagrees with the code, trust the code.*
-
-## 1. What this is and who depends on it
+> **Last updated:** 2026-08-03, commit `9a38379`, branch `suite-47-tags-and-filters`
+>
+> Originally written by reading `backendServer/newsletter/` in full (models, views, urls,
+> `email_service.py`, `tasks.py`, `admin.py`, the digest management commands, migrations, and
+> the email templates under `newsletter/templates/email/`), the generic transport it calls out
+> to (`backendServer/events/email_service.py`), the parts of `backendServer/accounts/` that
+> touch subscribers, and the beat/Brevo settings in `backendServer/backend/settings/base.py`.
+> Complements `overview.md` (§6, one-paragraph summary), `data-model.md` (the field-level
+> `NewsletterSubscriber` table and the Suite 41 migration history), and `auth.md` (the
+> account-holder side of identity). If anything here disagrees with the code, trust the code.
+
+## Overview
+
+- `newsletter` is one of six Django apps in `backendServer`. It owns one thing: a mailing list
+  (`NewsletterSubscriber`) of email addresses with a `WEEKLY`/`MONTHLY` frequency preference, plus
+  a Celery-driven engine that renders and sends a personalized digest of upcoming `Event` rows.
+  There's no login anywhere in this app — subscribing takes only an email, and managing or
+  cancelling uses an unguessable token in a link, never a password or session.
+- Two kinds of people share the same table: anonymous subscribers who just typed an email in, and
+  account holders (`accounts.UserProfile`) whose digest preference syncs into this same
+  `NewsletterSubscriber` row. There's no separate model for the two.
+- The two facts that matter most: (1) a fresh signup gets `email_preference='NEVER'` and **no**
+  `NewsletterSubscriber` row at all, so brand-new users are silently opted out until they change
+  a setting (see Deep Dive §5); and (2) sends are entirely driven by a Postgres-stored
+  `PeriodicTask` schedule that does **not** auto-follow code moves — moving a task without a data
+  migration breaks digests silently (Deep Dive §5).
+- Who depends on it: Celery beat fires weekly/monthly with no human in the loop, so failures are
+  silent until a subscriber complains; `accounts` writes into this app's table directly; and the
+  public site's subscribe form and profile settings page both call its endpoints.
+- Where to go for a task: adding/removing a subscriber → Deep Dive §2.1; "why didn't recipient X
+  get an email" → Deep Dive §2.2 and §5; how sends actually fire → Deep Dive §2.3; a manual/ops
+  resend or smoke test → Deep Dive §2.4; the field-level schema → Deep Dive §3; the endpoint/task
+  list → Deep Dive §4; known traps → Deep Dive §5; what's unverified → Deep Dive §6.
+
+## Deep Dive
+
+### 1. What this is and who depends on it
 
 `newsletter` is one of six Django apps in `backendServer`. It owns exactly one thing: a mailing
 list of email addresses, each with a `WEEKLY`/`MONTHLY` frequency preference, and a Celery-driven
@@ -32,7 +58,7 @@ asks why they stopped getting email (see §5). The `accounts` app depends on it
 a row here is how a profile's email preference becomes a real mailing-list entry), and the
 public site's subscribe form and profile settings page both call its two endpoints directly.
 
-## 2. How it works
+### 2. How it works
 
 ### 2.1 Getting onto (or off) the list
 
@@ -193,7 +219,7 @@ tag filtering, and passes no `manage_url` into the template context at all — s
 back to the "reply to unsubscribe" text rather than a real manage link. It's a template/delivery
 smoke test, not a preview of what any real subscriber receives.
 
-## 3. Data model
+### 3. Data model
 
 `newsletter` owns exactly one model, `NewsletterSubscriber` — `email` (unique), `frequency`
 (`WEEKLY`/`MONTHLY`), `is_active`, `subscribed_at`, and `manage_token` (a UUID, unique, the
@@ -201,7 +227,7 @@ entire authentication mechanism for the login-free manage link). The full field-
 its `db_table` history, and the Suite 41 migration mechanics live in `data-model.md` §6 and §8 —
 this doc doesn't restate them.
 
-## 4. Interfaces
+### 4. Interfaces
 
 | Interface | Trigger / caller | Description |
 |---|---|---|
@@ -216,7 +242,7 @@ this doc doesn't restate them.
 | `python manage.py send_weekly_digest` | Manual/ops | Thin wrapper that calls `fan_out_weekly_digest.delay()`. |
 | `python manage.py send_test_digest --email <address>` | Manual/ops | One-off delivery/template smoke test — see §2.4 for how it differs from a real digest. |
 
-## 5. Sharp edges
+### 5. Sharp edges
 
 **Moving or renaming a Celery task does not update the beat schedule — the `PeriodicTask` row
 has to be repointed by hand, in a data migration, or it fails silently on a weekly cadence.**
@@ -289,7 +315,7 @@ didn't match anything in the window. There is no distinct "no events found" emai
 in this case (that copy only exists in the template's `{% else %}` branch, which fires for an
 *anonymous* subscriber whose full, untagged event list happens to be empty — a different case).
 
-## 6. Known gaps
+### 6. Known gaps
 
 I did not verify whether any frontend code (`theCommonsWeb`) reads or displays
 `NewsletterSubscriber.subscribed_at`, or whether the `/newsletter/manage` landing page in the
diff --git a/human-docs/overview.md b/human-docs/overview.md
index 9b1da1e..b9088f6 100644
--- a/human-docs/overview.md
+++ b/human-docs/overview.md
@@ -1,10 +1,34 @@
 # Overview
 
-*Reflects commit `5fe7a45`, 2026-08-01. If anything here contradicts the code, trust the code — this doc was written by reading `backendServer/ingestion/`, `backendServer/events/models.py`, `backendServer/newsletter/`, `backendServer/broadcast/`, `AGENTS.md`, `ARCHITECTURE.md`, and `docs/broadcast.md`, and a few of the drifts found along the way are called out below.*
+> **Last updated:** 2026-08-03, commit `9a38379`, branch `suite-47-tags-and-filters`. Written by reading `backendServer/ingestion/`, `backendServer/events/models.py`, `backendServer/newsletter/`, `backendServer/broadcast/`, `AGENTS.md`, `ARCHITECTURE.md`, and `docs/broadcast.md`. If anything here contradicts the code, trust the code.
+
+## Overview
+
+The Commons is a local events aggregator for three small North Carolina towns — Chapel Hill, Carrboro, and Pittsboro — built with a deliberate "digital newspaper" look (serif type, ink on cream, no gradients or pill buttons) rather than a typical startup aesthetic.
+
+It does three jobs under the hood:
+
+- **Ingests events automatically** from town/community calendar sources, cleans them up with an LLM (Gemini), screens them for safety, and auto-publishes the ones that pass.
+- **Accepts direct submissions** from residents (public site) and partner hosts (the "broadcast" console), the latter of which can also *push* one event out to other towns' calendars via browser automation.
+- **Runs a newsletter** — a token-based (no-login) mailing list with a weekly/monthly digest.
+
+The two audiences that matter most: **residents** browsing the public site (`theCommonsWeb`), and **event hosts/partners** using the broadcast console (`broadcastWeb`) to distribute one listing across several towns' calendars at once.
+
+The single most important architectural fact: **Better Auth (inside the `theCommonsWeb` Next.js app), not Django, is the identity source of truth** — Django only verifies a JWT, it never issues its own login/session. The second: `ingestion/` and `broadcast/` are two genuinely separate subsystems, walled off from each other by both convention and isolation tests.
+
+Where to jump in the Deep Dive below, by task:
+- Understanding the event lifecycle (scrape → standardize → dedupe → score → publish) → **§3**
+- The broadcast/syndication subsystem → **§5**
+- The newsletter/digest → **§6**
+- Background jobs, Celery/Redis layout → **§7**
+- The overall architecture diagram → **§8**
+- Known doc drift as of this writing → **§10**
+
+## Deep Dive
 
 This is the map. Read it first, then follow the pointers — `docs/` is the agent-facing system of record and stays canonical for line-by-line detail; this doc exists to orient a human who has never opened the repo.
 
-## 1. What this is
+### 1. What this is
 
 The Commons is a local events aggregator for three small North Carolina towns — Chapel Hill, Carrboro, and Pittsboro. It is not a startup product. The intended feel, enforced throughout the frontend's CSS tokens, is a **digital newspaper**: Georgia serif, ink on cream newsprint, column rules instead of cards and shadows, density over whitespace, no gradients, no pill buttons. That aesthetic choice shows up as a real constraint on the codebase — a new UI component that reaches for a shadow or a rounded badge is fighting the design system, not extending it.
 
@@ -12,7 +36,7 @@ Under the hood it does three jobs. First, it finds events other people posted el
 
 The two audiences that matter: **residents**, who browse the public site (`theCommonsWeb`) for what's happening nearby, and **event hosts / partner organizations**, who use the broadcast console (`broadcastWeb`) to get one event listing distributed across several towns' calendars at once. A third, much smaller audience is whoever is running the ingestion pipeline day to day — the Django admin and a dev-only monitoring dashboard exist for exactly that.
 
-## 2. The monorepo, piece by piece
+### 2. The monorepo, piece by piece
 
 ```
 thecommons/
@@ -36,7 +60,7 @@ thecommons/
 
 **`docs/`** is not for people — it's the agent-facing system of record that Claude Code (and any future coding agent) reads before touching this repo. It stays canonical for exact endpoint lists, adapter registries, and settings values; this human-docs tree exists alongside it so a person doesn't have to read agent-oriented prose to get oriented.
 
-## 3. How a single event moves through the system
+### 3. How a single event moves through the system
 
 An event's life has three possible starting points and one of four possible endings. The common path — a scraped event that gets auto-published — looks like this:
 
@@ -73,25 +97,25 @@ flowchart TD
 
 The pipeline runs automatically once a day via Celery beat, and can be triggered manually via a cron-secret-protected endpoint or a management command. It's built from independently-named steps — poll, standardize, dedupe, score, publish — that mirror the diagram above one-to-one; the exact functions and a walkthrough of tuning the safety threshold live in `ingestion.md` and `safety-scoring.md`.
 
-## 4. Publishing and the public site
+### 4. Publishing and the public site
 
 Once an `Event` row exists, it's just data — read by the public API (`GET /events/...`, cached in Redis and invalidated on writes) and rendered by `theCommonsWeb`'s home feed, calendar view, and event-detail pages. There's no separate "publish" step beyond the `StagedEvent → Event` promotion described above; an `Event` row existing *is* what "published" means, which is also why a published event can't currently be unpublished or soft-deleted — only its owner can hard-delete it. The frontend's data layer, routes, and component conventions are covered in `frontend.md`; the visual system in `design-system.md`.
 
-## 5. Broadcast — pushing an event the other direction
+### 5. Broadcast — pushing an event the other direction
 
 Ingestion pulls events *in*. Broadcast pushes a single event *out* to other towns' community calendars — Chapel Hill/Carrboro/Pittsboro partners who want one listing to land on several third-party sites without re-typing it five times. It is a genuinely separate subsystem: its own models (`BroadcastSubmission`, `BroadcastTarget`), its own access-tier gating (a Bearer JWT or an access code, resolved to tier 0/1/2), and a hard isolation rule enforced by tests — `broadcast/` never imports from `events/` or `ingestion/`, operating instead on its own denormalized copy of an event's fields.
 
 The primary path today is extension-driven, not fully headless: the operator SPA (`broadcastWeb`) requests a per-site "recipe" from the backend, hands it to the Chrome extension, and the extension opens each target site's form in a new tab and fills every field it can — a human still reviews the prefilled form, solves any captcha, and clicks Submit themselves. A second, fully server-side path exists (a Playwright-driven headless browser that claims queued jobs from a database queue and submits without a human in the loop) but is currently disabled in the SPA in favor of the extension flow. Neither path uses the Django ORM while a headless browser session is open — that's a hard rule, since Playwright and Django's connection pooling don't mix safely. `broadcast.md` is the single source of truth for the adapter list, access-code mechanics, and the worker's queue setup; this paragraph is deliberately the whole story here.
 
-## 6. The newsletter
+### 6. The newsletter
 
 `newsletter/` is small and mostly decoupled from the rest of the system: an email address plus a frequency preference (`WEEKLY`/`MONTHLY`), no login required to subscribe or to manage that preference — an unguessable token in the manage link is the only credential. A scheduled Celery job resolves the current recipient list once a week and once a month, builds a personalized set of upcoming `Event` rows per recipient (tag-filtered for account holders, everything for anonymous subscribers), and sends one email per recipient through Brevo. `newsletter.md` covers the recipient-resolution logic and the digest templates in more depth.
 
-## 7. Everything that makes it run in the background
+### 7. Everything that makes it run in the background
 
 Two kinds of async work happen off the request cycle. Most of it — the daily ingestion pipeline, the weekly/monthly digest fan-out — runs on **Celery**, backed by a single Redis instance split into two logical databases (one for the Celery broker and results, a separate one for Django's read-through cache). Broadcast's dispatch also runs on Celery now, but on its own dedicated queue drained by exactly one single-concurrency worker — deliberately, because the orphan-recovery logic assumes only one worker could ever be mid-drain at a time. `async-jobs.md` covers the queue layout, the beat schedule, and the sharp edges around it in full; `deploy-ops.md` covers how each of these processes is kept running in production (they're systemd units, not ad hoc scripts).
 
-## 8. Architecture at a glance
+### 8. Architecture at a glance
 
 ```mermaid
 flowchart LR
@@ -145,11 +169,11 @@ flowchart LR
 3. **One Postgres database, two owners.** `public` schema tables are Django's (migrated normally); `neon_auth` schema tables are Better Auth's mirrors, read-only from Django's side, never migrated by Django.
 4. **The whole thing runs on one virtual machine.** There's no separate services cluster — gunicorn, the Next.js server, Redis, and every worker process share one Oracle Cloud VM behind nginx. That's a deliberate scale-appropriate choice, not a stopgap; `deploy-ops.md` covers what that means operationally.
 
-## 9. Where to go next
+### 9. Where to go next
 
 Onboarding order, roughly foundational-first: `auth.md` (identity bridge) → `ingestion.md` (the pipeline in §3, in full) → `data-model.md` (every model and how they relate) → the rest as needed — `broadcast.md`, `newsletter.md`, `async-jobs.md`, `deploy-ops.md`, `frontend.md`, `design-system.md`, `testing.md`, `containerization.md`. `docs/` stays the deeper, agent-facing reference underneath all of them — when a human doc and `docs/` seem to disagree, `docs/` and the code win.
 
-## 10. Doc drift found while writing this
+### 10. Doc drift found while writing this
 
 Three things in the root-level docs are stale relative to the code as of this commit, flagged here rather than silently worked around:
 
diff --git a/human-docs/start-here.md b/human-docs/start-here.md
index 0ccfbe7..f69c537 100644
--- a/human-docs/start-here.md
+++ b/human-docs/start-here.md
@@ -6,9 +6,13 @@ reading. **Human docs** (this folder) are written for people. **Agent / deep-div
 canonical. Where a human doc doesn't exist yet, this map sends you to the agent doc that
 covers the same ground.
 
-> Status: the subsystem docs are written — all of them, as of 2026-08-01. One,
-> [`containerization.md`](containerization.md), is deliberately **provisional**: it describes a
-> Docker cutover that is built and locally verified but not yet deployed.
+> Status: the subsystem docs are written — all of them — and each opens with an Overview you
+> can skim in under a minute before dropping into its Deep Dive. Every doc carries a
+> **Last updated** line stating the commit it was checked against.
+>
+> The Docker cutover it used to caveat is **done**: production has run on Docker Compose since
+> 2026-08-02 (PR #41), and [`containerization.md`](containerization.md) now describes it as
+> settled fact rather than a plan.
 
 ---
 
@@ -34,7 +38,7 @@ covers the same ground.
 | Work on the newsletter / digests | [`newsletter.md`](newsletter.md) | [`docs/redis-celery-handoff.md`](../docs/redis-celery-handoff.md) |
 | Add a background job or scheduled task | [`async-jobs.md`](async-jobs.md) | [`docs/redis-celery-handoff.md`](../docs/redis-celery-handoff.md) |
 | Deploy, or fix something in production | [`deploy-ops.md`](deploy-ops.md) | [`DEPLOY.md`](../DEPLOY.md) **(source of truth)**, [`docs/dev-db-isolation.md`](../docs/dev-db-isolation.md) |
-| Understand the Docker migration | [`containerization.md`](containerization.md) _(provisional)_ | [`docs/adr/0001-containerization.md`](../docs/adr/0001-containerization.md), [`DEPLOY.md`](../DEPLOY.md) |
+| Understand how the stack is containerized | [`containerization.md`](containerization.md) | [`docs/adr/0001-containerization.md`](../docs/adr/0001-containerization.md), [`DEPLOY.md`](../DEPLOY.md) |
 | Build UI on the main site | [`frontend.md`](frontend.md) | [`theCommonsWeb/AGENTS.md`](../theCommonsWeb/AGENTS.md) |
 | Get the look-and-feel right | [`design-system.md`](design-system.md) | [`CODING_STYLE.md`](../CODING_STYLE.md) |
 | Understand the admin / review workflow | — | [`docs/admin-backend.md`](../docs/admin-backend.md) |
@@ -50,12 +54,12 @@ covers the same ground.
 | [`AGENTS.md`](../AGENTS.md) | Repository map — where everything lives |
 | [`ARCHITECTURE.md`](../ARCHITECTURE.md) | System design: models, endpoints, auth bridge, async, deployment |
 | [`CODING_STYLE.md`](../CODING_STYLE.md) | Design philosophy + frontend/backend conventions |
-| [`DEPLOY.md`](../DEPLOY.md) | Production setup, nginx, systemd, deploy commands |
+| [`DEPLOY.md`](../DEPLOY.md) | Production setup, nginx, the Docker Compose stack, deploy commands |
 | [`docs/index.md`](../docs/index.md) | Full index of the agent-facing deep-dive guides |
 
 ---
 
 _Keeping this current: new subsystem? Add a row to "I want to…" and, if it's a whole doc, to
-[`README.md`](README.md)'s index too. When the Docker cutover lands, `containerization.md`
-either loses its provisional marker or folds into [`deploy-ops.md`](deploy-ops.md) — that doc
-says which, and this row goes with it._
+[`README.md`](README.md)'s index too. Now that the cutover has landed, `containerization.md`
+recommends folding itself into [`deploy-ops.md`](deploy-ops.md) — see its closing section. That
+merge hasn't happened yet; when it does, this row goes with it._
diff --git a/human-docs/testing.md b/human-docs/testing.md
index 05ba3e2..058b350 100644
--- a/human-docs/testing.md
+++ b/human-docs/testing.md
@@ -1,18 +1,44 @@
 # Testing & Local Development
 
-Written 2026-08-01 against commit `5fe7a45`. This is the human-facing walkthrough that
-complements [`backendServer/AGENTS.md`](../backendServer/AGENTS.md)'s Testing section, which
-stays the agent-facing reference for exact tags, settings names, and management-command flags.
-Where the two disagree, trust `backendServer/AGENTS.md` and the code underneath it — this doc
-exists to be *followed*, not to be the source of truth.
+> **Last updated:** 2026-08-03, commit `9a38379`, branch `suite-47-tags-and-filters`
+
+This is the human-facing walkthrough that complements
+[`backendServer/AGENTS.md`](../backendServer/AGENTS.md)'s Testing section, which stays the
+agent-facing reference for exact tags, settings names, and management-command flags. Where the
+two disagree, trust `backendServer/AGENTS.md` and the code underneath it — this doc exists to be
+*followed*, not to be the source of truth.
 
 Audience: someone with a fresh clone of this repo, general web-dev skill, and zero context on
 The Commons specifically. Every command below was checked against the repo's actual scripts and
 `--help` output at this commit, not assumed.
 
+## Overview
+
+- This doc gets a fresh clone of The Commons running locally and explains how its test suites
+  are organized. It covers three toolchains: `uv` for the Django backend, `pnpm` for two
+  independent frontends (`theCommonsWeb` and `broadcastWeb`), and a local Redis needed to *run*
+  the app (not to test it). It does not cover architecture or any subsystem in depth — see
+  [`overview.md`](overview.md) and [`async-jobs.md`](async-jobs.md) for that.
+- Both backend and frontend tests are split into two tiers by explicit tags, not filenames:
+  `fast` (no database) and `db` (needs Postgres, or `jsdom` on the frontend side). The backend's
+  `db` tier runs against a **real Postgres test database on Neon**, not SQLite and not an
+  ephemeral container — that's a locked decision.
+- The single biggest thing to know before running anything: the Neon test database is shared
+  infrastructure. If your `DATABASE_URL` points at the same Neon branch as any other terminal,
+  session, or agent running `--tag=db` tests at the same time, both runs can race to
+  create/drop/write the same literal database — and the dangerous failure mode is a **silent
+  false-green**, not a crash. Always run `--tag=db` (and full `manage.py test`) suites serially,
+  with `--noinput` and `pipefail`. Full detail in Deep Dive §4.
+- Quick map by task: first-time setup → §2; understanding backend test tiers/tags → §3; hit a
+  "database is being accessed by other users" error → §4 and §5; frontend Vitest tiers → §6; do
+  I need Redis running to test? (no) → §7; full command cheat sheet → §8; what CI actually runs →
+  §9; known doc drift → §10.
+
+## Deep Dive
+
 ---
 
-## 1. What this covers, and who it's for
+### 1. What this covers, and who it's for
 
 Getting this repo running locally touches three separate toolchains — `uv` for the Django
 backend, `pnpm` for two independent frontends (`theCommonsWeb` and `broadcastWeb`), and a local
@@ -34,9 +60,9 @@ audience).
 
 ---
 
-## 2. First run: clone to a running system
+### 2. First run: clone to a running system
 
-### 2.1 Backend
+#### 2.1 Backend
 
 ```bash
 git clone <repo-url> thecommons && cd thecommons/backendServer
@@ -73,7 +99,7 @@ To also process background jobs (digests, ingestion, broadcast) rather than just
 run a worker alongside `runserver` — see [`async-jobs.md`](async-jobs.md) for the full queue
 topology and which worker command to use for which queue.
 
-### 2.2 Frontend — theCommonsWeb (the public site)
+#### 2.2 Frontend — theCommonsWeb (the public site)
 
 ```bash
 cd theCommonsWeb
@@ -92,7 +118,7 @@ Auth and Django share one Postgres database) plus `BETTER_AUTH_SECRET`. Then:
 pnpm dev
 ```
 
-### 2.3 Frontend — broadcastWeb (optional, partner-facing SPA)
+#### 2.3 Frontend — broadcastWeb (optional, partner-facing SPA)
 
 ```bash
 cd broadcastWeb
@@ -104,7 +130,7 @@ pnpm dev
 Only needed if you're working on the broadcast/syndication side; the public site and its tests
 don't depend on it.
 
-### 2.4 Verify you have a green suite
+#### 2.4 Verify you have a green suite
 
 Once the backend `.env` has a working `DATABASE_URL`, confirm the full picture before doing
 anything else, in this order (why this order matters is §4):
@@ -125,7 +151,7 @@ loop. §8 has the full command table, including `broadcastWeb` and lint.
 
 ---
 
-## 3. Backend tests: tiers, tags, and the Postgres test database
+### 3. Backend tests: tiers, tags, and the Postgres test database
 
 Backend tests always run under a dedicated settings module, **never** the same `dev`/`prod`
 settings the app itself uses:
@@ -184,7 +210,7 @@ sense of scale, not independently re-measured for this doc (see §11).
 
 ---
 
-## 4. The shared Neon test database — read this before running two things at once
+### 4. The shared Neon test database — read this before running two things at once
 
 This is the sharp edge most likely to waste your afternoon, so it gets its own section instead
 of a bullet point.
@@ -250,7 +276,7 @@ human at the keyboard.
 
 ---
 
-## 5. Stale Neon sessions blocking teardown
+### 5. Stale Neon sessions blocking teardown
 
 A related but distinct failure: even with no genuine concurrent run, a Neon test-DB session can
 occasionally outlive the process that opened it (a killed test run, a crashed connection pool)
@@ -271,7 +297,7 @@ database between runs (Django still applies any new migrations to it first).
 
 ---
 
-## 6. Frontend tests: Vitest fast/db tiers
+### 6. Frontend tests: Vitest fast/db tiers
 
 Both `theCommonsWeb` and `broadcastWeb` use the same two-project Vitest layout, deliberately
 mirroring the backend's `fast`/`db` naming — but **the frontend `db` tier does not touch any
@@ -302,7 +328,7 @@ build` for broadcastWeb) is the type-check gate for both, and is what CI runs.
 
 ---
 
-## 7. Local Redis — required to run the app, not to run its tests
+### 7. Local Redis — required to run the app, not to run its tests
 
 Worth stating plainly, because it's easy to assume otherwise coming from §2's setup:
 `backend/settings/test.py` sets `CELERY_TASK_ALWAYS_EAGER = True` and unconditionally swaps
@@ -336,7 +362,7 @@ native process's `REDIS_URL` at.
 
 ---
 
-## 8. Command reference
+### 8. Command reference
 
 | Command | Runs | Needs | Roughly |
 |---|---|---|---|
@@ -360,7 +386,7 @@ matching files changed) — no test suite runs in pre-commit, only lint/format/t
 
 ---
 
-## 9. What CI runs
+### 9. What CI runs
 
 `.github/workflows/ci.yml` triggers on every push to `main` and every pull request into `main`; a
 newer push to the same branch cancels an in-flight run for it.
@@ -405,7 +431,7 @@ A few specifics worth knowing:
 
 ---
 
-## 10. Known gaps and doc drift
+### 10. Known gaps and doc drift
 
 - **`docs/redis-celery-handoff.md`'s Testing section is stale** on which settings the suite runs
   under and which way `CELERY_TASK_ALWAYS_EAGER` is set — covered in full in §7, and also
diff --git a/notion-sync/STATE.md b/notion-sync/STATE.md
index e79836c..9fac1a2 100644
--- a/notion-sync/STATE.md
+++ b/notion-sync/STATE.md
@@ -6,7 +6,7 @@ The ledger mirrors what *should* be on the Notion board so the desktop app can r
 
 ---
 
-**Next suite number:** `46`
+**Next suite number:** `48`
 
 ## Suite ledger
 
@@ -41,6 +41,9 @@ per-ticket status lives on each ticket subpage (see OUTBOX preamble).
 | 43 | Human onboarding docs (`human-docs/` subsystem set) | Needs QA | 43.1–43.12 BUILT 2026-08-01 via `/orchestrate` from `human-docs/HANDOFF_PLAN.md`, one `/handoff-report` pass each. 12 docs + index/route-map updates; 2 stale agent-doc refs fixed (`docs/admin-backend.md`, `docs/redis-celery-handoff.md`). Docs only, no code. **Findings needing owner action:** CI's deploy job already runs `docker compose` on push to `main` but the VM has no Docker (next merge to main fails); `--color-ink` referenced in two components but never defined (silent CSS fallback); the eslint `no-restricted-imports` authClient guard is dead (alias vs. relative imports) | _(pending)_ |
 | 44 | Post-Docker-cutover follow-ups (kernel reboot, stray migration, untested calendar work) | In Progress | 44.1–44.3 planned 2026-08-02. **44.2 RESOLVED** (PR #42): the stray migration was real — committed as `0023_seed_raleigh_cary_morrisville_towns` + `0024_seed_wake_forest_town`; unpushed migrations are a silent no-op at deploy since `migrate` only sees what `COPY . .` baked in. **44.3 in progress**: exercising the PR #41 calendar work found 3 real bugs (morrisvillechamber UTC double-offset, downtownraleigh bare-hour times, force_town overriding correct guesses), all fixed + tested in PR #42; still needs a live `SourceRun` check on prod sources 23–27. **44.1 untouched** (VM still needs the kernel reboot) | _(pending)_ |
 | 45 | Ingestion correctness + prod egress (post-ingest audit) | Needs QA | 45.1-45.10 planned 2026-08-02; **9 of 10 BUILT 2026-08-03 via `/orchestrate`** (752 tests green, ruff clean, migrations 0019-0021 linear). **45.2 premise CONFIRMED, not speculative** - reproduced before building: a 9:00 PM ET event rendered `Thursday, August 6 - 1:00 AM` (wrong time AND weekday); fixed by `TIME_ZONE=America/New_York`, double-correction sweep found zero compensating sites. **45.5 SHIPPED TO PROD** and the ticket's guess was inverted: across all 765 raw events source id 8 has **0 unique** source_uids vs id 6's 9, so id 8 (not id 6) was the strict subset - deactivated on the VM, SourceRun history preserved. **45.1** root cause was purely bare call sites; the batch fns already resolved prompt_suffix correctly. New `ingestion/prompt_dispatch.py`. Note `RawEvent.source` is non-nullable, so the orphan concern was theoretical. **45.3** guard runs before the Gemini call (saves the API call; raw title is the more reliable signal) and `cancelled` was deliberately **excluded** from `CANDIDATE_STATUSES` - organizers un-cancel and resubmit, so anchoring would silently suppress the legitimate resubmission. **45.10** scoped internal-only per owner decision: `raw_start`->`raw_start_datetime` (16 files); `Event.date` untouched, no API break. **45.6 NOT BUILT - needs owner decision.** Research overturned the presumed fix: Eventbrite's public `events/search` API was discontinued Dec 2019 (org-owned events only), so an official integration covers **0 of 4** sources, not 3 of 4; and their WAF `captcha` plausibly enforces their own anti-scraping ToS, so funding a proxy is paying to keep violating it. Recommended: quarantine the 3 Eventbrite sources via 45.7 + free delisting request for Downtown Raleigh (id 20). $0/mo. Report in scratchpad `45.6-egress-options.md`. **Ops follow-ups (Neon data, ship by no migration):** set `default_town` on prod sources then run `reopen_skipped_towns` (18 stranded rows); set `blocked_reason` on the 4 blocked sources; run `probe_sources` in **scrape-worker** (no Chromium in `backend`) | _(pending)_ |
+| 46 | Broadcast client-feedback round 2 (extension taxonomy regression, https image URLs, JWT refresh, form affordances) | Needs QA | **46.1–46.10 ALL BUILT 2026-08-03 via `/orchestrate`** (backend 265 tests OK + ruff clean; broadcastWeb 92/92 + `pnpm build` clean). **Three ticket premises were wrong and were root-caused live before building.** **46.1:** the defect was NOT the extension's exact matching — (a) the select2 search never filters, so the dropdown always renders the full 62-term vocabulary and the `sleep(1200)` waited on a query that never fires; (b) the real killer is that our search terms don't exist on the destinations — only **4 of 11** TW terms and **0 of 16** ABC11 terms were real (typing `Music` on ABC11 returns literally "No options"; its vocabulary is 17 slash-compounds like `Theater / Concerts`). The ticket's proposed **length guard was harmful** and was rejected — it would have blocked `Food`→`Food & Drink`; replaced with **anchoring** (exact → prefix), which still keeps `Market` out of `Art Market and Exhibition`. Both maps rewritten to verified labels + `test_category_maps_fast.py` snapshots all 62/17 labels as the regression guard. Per owner decision, ABC11 slugs with no defensible match (`family-kids`, `literary`, `nightlife`, `wellness`, `film`) send **no category** rather than `Misc.`. **46.9:** `#eventStartDate-label` is **not a `<label>`** — it's a Fluent UI `<input type="text" role="combobox">` whose id merely ends in `-label`; selector was always correct, and the retry logic the ticket asked for already shipped in suite 31 (`fillInputVerified`, `f9eae28`). Net change = hint/comment corrections only; the real bug (Trumba self-population, form loads pre-filled with today's date) is confirmed. **46.4:** `form-dim` already included `locked`, so dimming worked; only the "Make changes" hint was missing. **Regression caught at integration:** 46.3's blanket refresh-on-403 swallowed legitimate business errors, because `views.py:369-381` overloads 403 for both stale JWTs and access-code denials (`_ACCESS_DENIED_DETAIL`); now discriminated by whether the refresh returns a *different* token. Note the broadcast API **never emits a real 401**. **46.8:** the ⚠️ drag-drop concern is resolved — the Trumba uploader is a real visible `input[type=file][accept="image/*"]` at `.image-field-esf input[type=file]`, so programmatic fill works. **⚠️ MANUAL QA STILL OUTSTANDING** (buildless MV3, no test runner): live-form fill verification for **46.1, 46.8, 46.9** on both destinations — fill, do NOT submit. **Follow-ups needing their own tickets:** `human-docs/broadcast.md:120-121` has the identical access-code drift 46.10 just fixed in `docs/broadcast.md`; ABC11 alt-text has no upstream `CanonicalEvent` field (gap documented, content deliberately not invented); extension test infrastructure. _Original plan:_ 46.1–46.10 planned 2026-08-03 via `/write-tickets`. Triaged live against prod; most client reports had different root causes than reported. **46.1 is the P0 and is a regression, not an unfixed bug** — `broadcastExtension/content.js:310-314` documents that the earlier "unrelated tags" bug (client 535) was already fixed by switching to strict exact-label matching; that fix over-corrected so nothing matches, and unmatched terms are skipped *silently* → every event ships to every destination with zero categories/tags. Fix must be a ranked match (exact → prefix → token-set) with a length guard, not a revert. **Waves:** 1 = 46.1, 46.2, 46.3, 46.5, 46.9, 46.10 (parallel); 2 = 46.4, 46.7; 3 = 46.6; 4 = 46.8 (needs 46.2). ⚠️ **46.4, 46.6, 46.7 all edit `broadcastWeb/src/App.tsx` — serialize or give all three to one instance** (see the shared-worktree hazard in project memory). 46.2 is a genuine one-liner (`SECURE_PROXY_SSL_HEADER` in `prod.py`; nginx already sends `X-Forwarded-Proto`) but carries a real blast radius via `request.is_secure()`. Open ⚠️ decisions: 46.1 root-cause assumption (label-shape/timing vs. dropdown never opening — log first), 46.2 nothing depending on the http scheme, 46.5 low-vs-high value of a `5-10` range, 46.7 re-expand in place vs. relocating the organizer fields, 46.8 whether the drag-drop widget accepts a programmatic file set, 46.9 the real ABC11 input selector (needs `capture_broadcast_form`). **No extension test command exists** — `broadcastExtension/` is buildless MV3, so 46.1 and 46.9 acceptance is manual live-form verification (fill, never submit); a ticket for extension test infra was proposed but not written | _(pending)_ |
+
+| 47 | Tag vocabulary canonicalization + sidebar filter panel | Needs QA | 47.1–47.6 | _(pending)_ |
 
 <!--
 Columns (left→right): Idea · Open · In Progress · Needs QA · Staged for Prod · In Prod
diff --git a/theCommonsWeb/src/app/HomePageClient.tsx b/theCommonsWeb/src/app/HomePageClient.tsx
index ec20cd4..752ad1c 100644
--- a/theCommonsWeb/src/app/HomePageClient.tsx
+++ b/theCommonsWeb/src/app/HomePageClient.tsx
@@ -49,6 +49,7 @@ export default function HomePageClient() {
     selectedCategory,
     toggleTag,
     toggleTown,
+    clearTowns,
     setCategory,
     clearFilters,
   } = useEvents(viewMode);
@@ -100,7 +101,8 @@ export default function HomePageClient() {
     selectedTags.length > 0 ||
     selectedTowns.length > 0 ||
     selectedCategory !== null ||
-    selectedDate !== null;
+    selectedDate !== null ||
+    currentWindow !== '3months';
 
   const sidebarProps = {
     isLoading,
@@ -117,6 +119,14 @@ export default function HomePageClient() {
     isLoadingMonth,
     selectedTags,
     onTagToggle: toggleTag,
+    towns,
+    categories,
+    selectedTowns,
+    onTownToggle: toggleTown,
+    selectedCategory,
+    onCategorySelect: setCategory,
+    currentWindow,
+    onWindowChange: setWindow,
     currentUser: user,
     onSignIn: () => {
       const redirectTo = encodeURIComponent(
@@ -133,7 +143,7 @@ export default function HomePageClient() {
         towns={towns}
         selectedTowns={selectedTowns}
         onTownToggle={toggleTown}
-        onClearFilters={handleClearFilters}
+        onClearTowns={clearTowns}
       />
 
       <main id="main-content" className="max-w-[1200px] mx-auto px-4 py-4">
diff --git a/theCommonsWeb/src/components/layout/Sidebar.tsx b/theCommonsWeb/src/components/layout/Sidebar.tsx
index cd7f690..5a05b8b 100644
--- a/theCommonsWeb/src/components/layout/Sidebar.tsx
+++ b/theCommonsWeb/src/components/layout/Sidebar.tsx
@@ -1,9 +1,13 @@
 import { useRouter } from 'next/navigation';
+import { useState } from 'react';
 import { Button } from '../ui/Button';
 import { MiniCalendar } from './MiniCalendar';
+import { WINDOW_OPTIONS } from './TimeWindowSelector';
 import { FILTER_TAGS, type TagId } from '../../constants/tags';
-import type { FrontendEvent } from '../../models/eventsModels';
+import type { FrontendEvent, TownOption, CategoryOption } from '../../models/eventsModels';
 import type { AuthUser } from '../../models/authModels';
+import type { EventWindow } from '../../hooks/useEvents';
+import { useFacets } from '../../hooks/useFacets';
 
 type ViewMode = 'feed' | 'calendar';
 
@@ -23,11 +27,73 @@ interface SidebarProps {
     isLoadingMonth?: boolean;
     selectedTags: TagId[];
     onTagToggle: (tagId: TagId) => void;
+    towns: TownOption[];
+    categories: CategoryOption[];
+    selectedTowns: string[];
+    onTownToggle: (townSlug: string) => void;
+    selectedCategory: string | null;
+    onCategorySelect: (slug: string | null) => void;
+    currentWindow: EventWindow;
+    onWindowChange: (w: EventWindow) => void;
     currentUser: AuthUser | null;
     onSignIn: () => void;
     onSignOut: () => void;
 }
 
+// Full-width stacked filter row — the "Craigslist" facet aesthetic shared by
+// every filter group in this sidebar (Range, Towns, Categories, Interest).
+function FilterRow({
+    label,
+    count,
+    selected,
+    onToggle,
+    showClear = true,
+}: {
+    label: string;
+    count?: number;
+    selected: boolean;
+    onToggle: () => void;
+    showClear?: boolean;
+}) {
+    return (
+        <button
+            onClick={onToggle}
+            aria-pressed={selected}
+            className={[
+                'w-full flex items-center gap-2.5 text-left py-1.5 px-0',
+                'border-b border-[var(--color-border-light)]',
+                'cursor-pointer bg-transparent border-l-0 border-r-0 border-t-0',
+                'transition-colors group',
+                selected
+                    ? 'text-[var(--color-accent)]'
+                    : 'text-[var(--color-text)] hover:text-[var(--color-accent)]',
+            ].join(' ')}
+        >
+            {/* Dot indicator */}
+            <span
+                className={[
+                    'w-2 h-2 rounded-full shrink-0 border transition-colors',
+                    selected
+                        ? 'bg-[var(--color-accent)] border-[var(--color-accent)]'
+                        : 'border-[var(--color-border-light)] group-hover:border-[var(--color-accent)]',
+                ].join(' ')}
+                aria-hidden="true"
+            />
+            <span className={`text-xs uppercase tracking-wider ${selected ? 'font-black' : ''}`}>
+                {label}
+                {count !== undefined && (
+                    <span className="text-[var(--color-text-muted)] font-normal normal-case tracking-normal"> ({count})</span>
+                )}
+            </span>
+            {selected && showClear && (
+                <span className="ml-auto text-[10px] text-[var(--color-accent)] font-black">✕</span>
+            )}
+        </button>
+    );
+}
+
+const TOWN_PREVIEW_COUNT = 8;
+
 export function Sidebar({
     filteredCount,
     isLoading,
@@ -44,6 +110,14 @@ export function Sidebar({
     isLoadingMonth = false,
     selectedTags,
     onTagToggle,
+    towns,
+    categories,
+    selectedTowns,
+    onTownToggle,
+    selectedCategory,
+    onCategorySelect,
+    currentWindow,
+    onWindowChange,
     currentUser,
     onSignIn,
     onSignOut,
@@ -57,6 +131,16 @@ export function Sidebar({
         year: 'numeric',
     });
 
+    const [showAllTowns, setShowAllTowns] = useState(false);
+
+    const facetsQuery = useFacets(currentWindow, selectedCategory);
+    const townCount = (slug: string): number | undefined =>
+        facetsQuery.isSuccess ? facetsQuery.data.towns[slug] ?? 0 : undefined;
+    const tagCount = (id: string): number | undefined =>
+        facetsQuery.isSuccess ? facetsQuery.data.tags[id] ?? 0 : undefined;
+
+    const visibleTowns = showAllTowns ? towns : towns.slice(0, TOWN_PREVIEW_COUNT);
+
     return (
         <aside className="space-y-3 text-sm">
             <Button variant="primary" onClick={onPostEvent} className="w-full">
@@ -130,48 +214,94 @@ export function Sidebar({
 
             <hr />
 
+            {/* Range — single-select, no null state, radio-style (no clear affordance) */}
+            <div role="group" aria-label="Filter by date range">
+                <p className="text-[9px] uppercase tracking-[0.18em] font-black mb-1 text-[var(--color-text-muted)]">
+                    Range
+                </p>
+                <div className="border-t border-[var(--color-border)]">
+                    {WINDOW_OPTIONS.map(opt => (
+                        <FilterRow
+                            key={opt.id}
+                            label={opt.label}
+                            selected={currentWindow === opt.id}
+                            onToggle={() => onWindowChange(opt.id)}
+                            showClear={false}
+                        />
+                    ))}
+                </div>
+            </div>
+
+            <hr />
+
+            {/* Towns — multi-select, with facet counts */}
+            <div role="group" aria-label="Filter by town">
+                <p className="text-[9px] uppercase tracking-[0.18em] font-black mb-1 text-[var(--color-text-muted)]">
+                    Towns
+                </p>
+                <div className="border-t border-[var(--color-border)]">
+                    {visibleTowns.map(town => (
+                        <FilterRow
+                            key={town.slug}
+                            label={town.name}
+                            count={townCount(town.slug)}
+                            selected={selectedTowns.includes(town.slug)}
+                            onToggle={() => onTownToggle(town.slug)}
+                        />
+                    ))}
+                    {towns.length > TOWN_PREVIEW_COUNT && (
+                        <button
+                            onClick={() => setShowAllTowns(v => !v)}
+                            className="w-full text-left py-1.5 px-0 text-[10px] uppercase tracking-wider text-[var(--color-text-muted)] hover:text-[var(--color-accent)] cursor-pointer bg-transparent border-none transition-colors"
+                        >
+                            {showAllTowns ? 'Fewer towns' : `More towns (${towns.length - TOWN_PREVIEW_COUNT})`}
+                        </button>
+                    )}
+                </div>
+            </div>
+
+            <hr />
+
+            {/* Categories — single-select, re-selecting the active row clears back to All */}
+            <div role="group" aria-label="Filter by category">
+                <p className="text-[9px] uppercase tracking-[0.18em] font-black mb-1 text-[var(--color-text-muted)]">
+                    Categories
+                </p>
+                <div className="border-t border-[var(--color-border)]">
+                    <FilterRow
+                        label="All Categories"
+                        selected={selectedCategory === null}
+                        onToggle={() => onCategorySelect(null)}
+                        showClear={false}
+                    />
+                    {categories.map(cat => (
+                        <FilterRow
+                            key={cat.slug}
+                            label={cat.display_name}
+                            selected={selectedCategory === cat.slug}
+                            onToggle={() => onCategorySelect(selectedCategory === cat.slug ? null : cat.slug)}
+                        />
+                    ))}
+                </div>
+            </div>
+
+            <hr />
+
             {/* Tag filters — full-width stacked rows */}
-            <div>
+            <div role="group" aria-label="Filter by interest">
                 <p className="text-[9px] uppercase tracking-[0.18em] font-black mb-1 text-[var(--color-text-muted)]">
                     Filter by Interest
                 </p>
                 <div className="border-t border-[var(--color-border)]">
-                    {FILTER_TAGS.map(tag => {
-                        const isSelected = selectedTags.includes(tag.id);
-                        return (
-                            <button
-                                key={tag.id}
-                                onClick={() => onTagToggle(tag.id)}
-                                aria-pressed={isSelected}
-                                className={[
-                                    'w-full flex items-center gap-2.5 text-left py-1.5 px-0',
-                                    'border-b border-[var(--color-border-light)]',
-                                    'cursor-pointer bg-transparent border-l-0 border-r-0 border-t-0',
-                                    'transition-colors group',
-                                    isSelected
-                                        ? 'text-[var(--color-accent)]'
-                                        : 'text-[var(--color-text)] hover:text-[var(--color-accent)]',
-                                ].join(' ')}
-                            >
-                                {/* Dot indicator */}
-                                <span
-                                    className={[
-                                        'w-2 h-2 rounded-full shrink-0 border transition-colors',
-                                        isSelected
-                                            ? 'bg-[var(--color-accent)] border-[var(--color-accent)]'
-                                            : 'border-[var(--color-border-light)] group-hover:border-[var(--color-accent)]',
-                                    ].join(' ')}
-                                    aria-hidden="true"
-                                />
-                                <span className={`text-xs uppercase tracking-wider ${isSelected ? 'font-black' : ''}`}>
-                                    {tag.label}
-                                </span>
-                                {isSelected && (
-                                    <span className="ml-auto text-[10px] text-[var(--color-accent)] font-black">✕</span>
-                                )}
-                            </button>
-                        );
-                    })}
+                    {FILTER_TAGS.map(tag => (
+                        <FilterRow
+                            key={tag.id}
+                            label={tag.label}
+                            count={tagCount(tag.id)}
+                            selected={selectedTags.includes(tag.id)}
+                            onToggle={() => onTagToggle(tag.id)}
+                        />
+                    ))}
                 </div>
             </div>
 
diff --git a/theCommonsWeb/src/components/layout/TagsBar.tsx b/theCommonsWeb/src/components/layout/TagsBar.tsx
deleted file mode 100644
index d203fd8..0000000
--- a/theCommonsWeb/src/components/layout/TagsBar.tsx
+++ /dev/null
@@ -1,43 +0,0 @@
-import { FILTER_TAGS, type TagId } from '../../constants/tags';
-
-interface TagsBarProps {
-    selectedTags: TagId[];
-    onTagToggle: (tagId: TagId) => void;
-}
-
-export function TagsBar({ selectedTags, onTagToggle }: TagsBarProps) {
-    return (
-        <nav
-            aria-label="Filter by interest"
-            className="border-b-2 border-[var(--color-border)] bg-[var(--color-bg)]"
-        >
-            <div className="max-w-[1200px] mx-auto px-4 py-1.5 flex items-center overflow-x-auto whitespace-nowrap scrollbar-hide">
-                <span className="text-[10px] font-black uppercase tracking-widest text-[var(--color-accent)] mr-3 shrink-0">
-                    Filter:
-                </span>
-
-                {FILTER_TAGS.map((tag, i) => {
-                    const isSelected = selectedTags.includes(tag.id);
-                    return (
-                        <span key={tag.id} className="flex items-center">
-                            {i > 0 && (
-                                <span className="mx-2 text-[var(--color-border-light)] text-xs select-none">|</span>
-                            )}
-                            <button
-                                onClick={() => onTagToggle(tag.id)}
-                                aria-pressed={isSelected}
-                                className={`text-xs uppercase tracking-wider shrink-0 cursor-pointer bg-transparent border-none transition-colors ${
-                                    isSelected
-                                        ? 'font-black text-[var(--color-accent)] underline'
-                                        : 'hover:text-[var(--color-accent)]'
-                                }`}
-                            >
-                                {tag.label}
-                            </button>
-                        </span>
-                    );
-                })}
-            </div>
-        </nav>
-    );
-}
diff --git a/theCommonsWeb/src/components/layout/TimeWindowSelector.tsx b/theCommonsWeb/src/components/layout/TimeWindowSelector.tsx
index cca8fd6..adc24de 100644
--- a/theCommonsWeb/src/components/layout/TimeWindowSelector.tsx
+++ b/theCommonsWeb/src/components/layout/TimeWindowSelector.tsx
@@ -3,7 +3,7 @@
 import { useEffect, useRef, useState } from 'react';
 import type { EventWindow } from '../../hooks/useEvents';
 
-const WINDOW_OPTIONS: { id: EventWindow; label: string; short: string }[] = [
+export const WINDOW_OPTIONS: { id: EventWindow; label: string; short: string }[] = [
     { id: '3months', label: 'Next 3 Months', short: '3 Months' },
     { id: '6months', label: 'Next 6 Months', short: '6 Months' },
     { id: '12months', label: 'Next 12 Months', short: '12 Months' },
diff --git a/theCommonsWeb/src/components/layout/TopBar.tsx b/theCommonsWeb/src/components/layout/TopBar.tsx
index 23003cc..45749fb 100644
--- a/theCommonsWeb/src/components/layout/TopBar.tsx
+++ b/theCommonsWeb/src/components/layout/TopBar.tsx
@@ -4,7 +4,7 @@ interface TopBarProps {
     towns: TownOption[];
     selectedTowns: string[];
     onTownToggle: (townId: string) => void;
-    onClearFilters: () => void;
+    onClearTowns: () => void;
 }
 
 // TODO: Replace this hardcoded list with towns from the database.
@@ -27,7 +27,7 @@ const PLACEHOLDER_TOWN_NAMES = [
     'Alamance County',
 ];
 
-export function TopBar({ towns, selectedTowns, onTownToggle, onClearFilters }: TopBarProps) {
+export function TopBar({ towns, selectedTowns, onTownToggle, onClearTowns }: TopBarProps) {
     const hasSelection = selectedTowns.length > 0;
 
     // Filter out placeholder towns that already exist in the active DB list
@@ -48,7 +48,7 @@ export function TopBar({ towns, selectedTowns, onTownToggle, onClearFilters }: T
 
                 {/* All — deselects town filter */}
                 <button
-                    onClick={onClearFilters}
+                    onClick={onClearTowns}
                     aria-pressed={!hasSelection}
                     className={`text-xs uppercase tracking-wider shrink-0 cursor-pointer bg-transparent border-none transition-colors ${
                         !hasSelection
diff --git a/theCommonsWeb/src/constants/tags.ts b/theCommonsWeb/src/constants/tags.ts
index 11f27c3..d21a6a7 100644
--- a/theCommonsWeb/src/constants/tags.ts
+++ b/theCommonsWeb/src/constants/tags.ts
@@ -1,13 +1,11 @@
 export const FILTER_TAGS = [
-    { id: 'weekends', label: 'Weekends Only' },
+    { id: 'weekends', label: 'Weekends' },
     { id: 'evenings', label: 'Evenings' },
     { id: 'daytime', label: 'Daytime' },
     { id: 'free', label: 'Free' },
     { id: 'family-friendly', label: 'Family Friendly' },
     { id: 'nature', label: 'Nature' },
     { id: 'small-business', label: 'Small Business' },
-    { id: 'lgbtq-friendly', label: 'LGBTQ-Friendly' },
-    { id: 'speaks-spanish', label: 'Speaks Spanish' },
     { id: 'wheelchair-accessible', label: 'Wheelchair Accessible' },
 ] as const;
 
diff --git a/theCommonsWeb/src/data/mockEvents.ts b/theCommonsWeb/src/data/mockEvents.ts
index 3e95e21..41d6179 100644
--- a/theCommonsWeb/src/data/mockEvents.ts
+++ b/theCommonsWeb/src/data/mockEvents.ts
@@ -19,7 +19,7 @@ export const mockEvents: Partial<FrontendEvent>[] = [
         date: new Date('2026-01-23'),
         time: '7:00 PM - 9:00 PM',
         description: 'An inclusive space for LGBTQ+ readers and allies to discuss this month\'s selection. Wine and light refreshments provided. All are welcome to join our growing literary community.',
-        tags: ['evenings', 'lgbtq-friendly', 'free'],
+        tags: ['evenings', 'free'],
         town: 'chapel-hill',
         price: 'Free',
     },
@@ -30,7 +30,7 @@ export const mockEvents: Partial<FrontendEvent>[] = [
         date: new Date('2026-01-26'),
         time: '10:00 AM - 12:30 PM',
         description: 'Explore the scenic beauty of the Haw River corridor with experienced naturalist Dr. Maria Santos. Learn about native flora, bird watching techniques, and the ecological history of this cherished watershed. Bilingual tour available in English and Spanish.',
-        tags: ['weekends', 'nature', 'family-friendly', 'speaks-spanish', 'daytime'],
+        tags: ['weekends', 'nature', 'family-friendly', 'daytime'],
         town: 'pittsboro',
         price: '$5',
     },
@@ -52,7 +52,7 @@ export const mockEvents: Partial<FrontendEvent>[] = [
         date: new Date('2026-01-24'),
         time: '9:00 PM - 1:00 AM',
         description: 'A night of emerging indie artists featuring three local bands. Support the Triangle\'s vibrant music scene at this legendary venue.',
-        tags: ['evenings', 'small-business', 'lgbtq-friendly'],
+        tags: ['evenings', 'small-business'],
         town: 'carrboro',
         price: '$12 advance / $15 door',
     },
@@ -85,7 +85,7 @@ export const mockEvents: Partial<FrontendEvent>[] = [
         date: new Date('2026-01-22'),
         time: '10:30 AM - 11:30 AM',
         description: 'Hora de Cuentos en Español! Join us for stories, songs, and activities entirely in Spanish. Perfect for native speakers and language learners ages 2-6.',
-        tags: ['daytime', 'family-friendly', 'speaks-spanish', 'free', 'wheelchair-accessible'],
+        tags: ['daytime', 'family-friendly', 'free', 'wheelchair-accessible'],
         town: 'chapel-hill',
         price: 'Free',
     },
@@ -96,7 +96,7 @@ export const mockEvents: Partial<FrontendEvent>[] = [
         date: new Date('2026-01-28'),
         time: '6:30 PM - 8:00 PM',
         description: 'Help plan the Triangle\'s biggest Pride celebration! New volunteers welcome. Together we create a space where everyone belongs.',
-        tags: ['evenings', 'lgbtq-friendly', 'free', 'wheelchair-accessible'],
+        tags: ['evenings', 'free', 'wheelchair-accessible'],
         town: 'raleigh',
         price: 'Free',
     },
@@ -129,7 +129,7 @@ export const mockEvents: Partial<FrontendEvent>[] = [
         date: new Date('2026-02-09'),
         time: '12:00 PM - 4:00 PM',
         description: 'Over 50 food trucks gather for the Triangle\'s most delicious event. Live music, craft vendors, and the best street food around. Dogs welcome in outdoor areas.',
-        tags: ['weekends', 'small-business', 'family-friendly', 'lgbtq-friendly', 'daytime'],
+        tags: ['weekends', 'small-business', 'family-friendly', 'daytime'],
         town: 'durham',
         price: 'Free entry (food for purchase)',
     },
@@ -162,7 +162,7 @@ export const mockEvents: Partial<FrontendEvent>[] = [
         date: new Date('2026-02-01'),
         time: '10:00 AM - 3:00 PM',
         description: 'Celebra la comunidad latina! Fresh produce, authentic cuisine, handmade crafts, and live mariachi music. Vendors speaking Spanish available throughout.',
-        tags: ['weekends', 'small-business', 'speaks-spanish', 'family-friendly', 'daytime'],
+        tags: ['weekends', 'small-business', 'family-friendly', 'daytime'],
         town: 'pittsboro',
         price: 'Free entry',
     },
diff --git a/theCommonsWeb/src/hooks/__tests__/useEvents.db.test.tsx b/theCommonsWeb/src/hooks/__tests__/useEvents.db.test.tsx
index f8aaef5..e16ae0d 100644
--- a/theCommonsWeb/src/hooks/__tests__/useEvents.db.test.tsx
+++ b/theCommonsWeb/src/hooks/__tests__/useEvents.db.test.tsx
@@ -2,7 +2,7 @@ import { act, renderHook, waitFor } from '@testing-library/react';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import type { BackendEvent, PaginatedBackendEvents } from '@/models/eventsModels';
 import { renderHookWithClient } from '../../../vitest.setup';
-import { useEvents } from '../useEvents';
+import { useEvents, type ViewMode } from '../useEvents';
 
 function backendEvent(over: Partial<BackendEvent>): BackendEvent {
     return {
@@ -85,4 +85,34 @@ describe('useEvents', () => {
             expect(eventUrls.some(u => u.includes('window=past'))).toBe(true);
         });
     });
+
+    it('preserves the selected window across a feed <-> calendar toggle', async () => {
+        const { result, rerender } = renderHookWithClient(
+            (viewMode: ViewMode) => useEvents(viewMode),
+            { initialProps: 'feed' },
+        );
+
+        await waitFor(() => expect(result.current.filteredEvents).toHaveLength(2));
+
+        act(() => result.current.setWindow('12months'));
+        expect(result.current.currentWindow).toBe('12months');
+
+        rerender('calendar');
+        rerender('feed');
+
+        expect(result.current.currentWindow).toBe('12months');
+    });
+
+    it('changing category does not reset the selected window', async () => {
+        const { result } = renderHookWithClient(() => useEvents());
+
+        await waitFor(() => expect(result.current.filteredEvents).toHaveLength(2));
+
+        act(() => result.current.setWindow('6months'));
+        expect(result.current.currentWindow).toBe('6months');
+
+        act(() => result.current.setCategory('music'));
+
+        expect(result.current.currentWindow).toBe('6months');
+    });
 });
diff --git a/theCommonsWeb/src/hooks/useEvents.ts b/theCommonsWeb/src/hooks/useEvents.ts
index 560a953..72570e3 100644
--- a/theCommonsWeb/src/hooks/useEvents.ts
+++ b/theCommonsWeb/src/hooks/useEvents.ts
@@ -78,11 +78,11 @@ export function useEvents(viewMode: ViewMode = 'feed') {
     const { selected: selectedTags, toggle: toggleTag, clear: clearTags } = useToggleSet<TagId>([]);
     const { selected: selectedTowns, toggle: toggleTown, clear: clearTowns } = useToggleSet<TownId>([]);
 
-    // Switching between feed and calendar resets to the 3-month window
-    // (category is preserved, matching the previous behavior).
+    // Switching between feed and calendar invalidates the calendar's month
+    // cache and resets pagination (window and category are preserved — they're
+    // shared filter state, not view-local).
     useEffect(() => {
         lastChangeRef.current = 'initial';
-        setCurrentWindow('3months');
         setCurrentPageUrl(null);
         setCurrentPage(1);
         setMonthEvents([]);
@@ -163,7 +163,6 @@ export function useEvents(viewMode: ViewMode = 'feed') {
     const setCategory = (slug: string | null) => {
         lastChangeRef.current = 'category';
         setSelectedCategoryState(slug);
-        setCurrentWindow('3months');
         setCurrentPageUrl(null);
         setCurrentPage(1);
         setMonthEvents([]);
@@ -211,6 +210,7 @@ export function useEvents(viewMode: ViewMode = 'feed') {
         if (selectedCategory !== null) {
             setCategory(null);
         }
+        setWindow('3months');
     };
 
     const totalCount = pageQuery.data?.count ?? 0;
@@ -239,6 +239,7 @@ export function useEvents(viewMode: ViewMode = 'feed') {
         selectedCategory,
         toggleTag,
         toggleTown,
+        clearTowns,
         setCategory,
         clearFilters,
         refetch: () => {
diff --git a/theCommonsWeb/src/hooks/useFacets.ts b/theCommonsWeb/src/hooks/useFacets.ts
new file mode 100644
index 0000000..c452a59
--- /dev/null
+++ b/theCommonsWeb/src/hooks/useFacets.ts
@@ -0,0 +1,13 @@
+'use client';
+
+import { useQuery } from '@tanstack/react-query';
+import { getFacets } from '../services/eventService';
+import type { EventWindow } from './useEvents';
+
+export function useFacets(currentWindow: EventWindow, selectedCategory: string | null) {
+    return useQuery({
+        queryKey: ['facets', currentWindow, selectedCategory],
+        queryFn: () => getFacets({ window: currentWindow, category: selectedCategory ?? undefined }),
+        retry: false,
+    });
+}
diff --git a/theCommonsWeb/src/services/eventService.ts b/theCommonsWeb/src/services/eventService.ts
index 934f2a9..6f8db55 100644
--- a/theCommonsWeb/src/services/eventService.ts
+++ b/theCommonsWeb/src/services/eventService.ts
@@ -83,6 +83,24 @@ export const getCategories = async (): Promise<CategoryOption[]> => {
     }
 };
 
+// --- GET FACET COUNTS (towns + tags, over the full filtered set) ---
+export interface EventFacets {
+    towns: Record<string, number>;
+    tags: Record<string, number>;
+}
+
+export const getFacets = async (params?: { window?: string; category?: string }): Promise<EventFacets> => {
+    const query = new URLSearchParams();
+    if (params?.window) query.set('window', params.window);
+    if (params?.category) query.set('category', params.category);
+    const qs = query.toString();
+    const url = `${API_BASE}/events/facets/${qs ? `?${qs}` : ''}`;
+
+    const response = await fetch(url);
+    if (!response.ok) throw await httpError('GET', url, response);
+    return await response.json();
+};
+
 // --- GET ALL EVENTS ---
 export const getEvents = async (params?: {
     after?: string;