diff --git a/docs/superpowers/plans/2026-07-28-phase1-foundation.md b/docs/superpowers/plans/2026-07-28-phase1-foundation.md
new file mode 100644
index 0000000..f39b727
--- /dev/null
+++ b/docs/superpowers/plans/2026-07-28-phase1-foundation.md
@@ -0,0 +1,3092 @@
+# Phase 1 (Foundation) Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Ship a deployed, authenticated, multi-tenant Next.js app — registration, email verification, login, password reset, tenant-scoped sessions, a base UI shell, and a live Railway staging deploy with a fail-loud `/health` endpoint — matching `todo.md`'s Phase 1 checklist and the approved spec at `docs/superpowers/specs/2026-07-28-phase1-foundation-design.md`.
+
+**Architecture:** Single Next.js 15 App Router app (TypeScript) deployed as one Railway service. Prisma/PostgreSQL holds `Business`/`User`/`Membership` (many-to-many via join table) plus the Auth.js adapter tables. Redis/BullMQ is wired and proven with a smoke-test job (no real jobs yet — Phase 3). A single `getSessionContext()` helper is the only path any route uses to resolve tenant scope, and centralized Zod schemas validate every boundary.
+
+**Tech Stack:** Next.js 15 (App Router) + TypeScript + Tailwind + shadcn/ui, Prisma + PostgreSQL, Redis + BullMQ, Auth.js v5 (`next-auth@beta` + `@auth/prisma-adapter`) with database sessions, Resend (auth emails only), Zod, Vitest + React Testing Library + Playwright, pino + Sentry, pnpm, Railway.
+
+## Global Constraints
+
+- Every tenant-scoped table carries `businessId`; every query is scoped from the authenticated session server-side, never a client-supplied ID. (AGENTS.md)
+- Session cookies: httpOnly, secure, sameSite. CSRF protection on all state-changing routes. (AGENTS.md, todo.md)
+- Validate at every boundary: Zod on every API route/form handler, server-side, before DB/queue/provider calls. (AGENTS.md)
+- Fail loud: provider errors logged with context, never swallowed. (AGENTS.md)
+- Migrations are additive-first; no destructive changes without a documented follow-up. (AGENTS.md)
+- Package manager is pnpm; scripts are `dev`, `build`, `start`, `test`, `lint`, `typecheck`, `test:e2e` (already defined in `package.json` from Phase 0 — this plan replaces their placeholder bodies with real tool invocations).
+- Node >= 20 (CI runner uses Node 22 per `.github/workflows/ci.yml`).
+- No feature beyond Phase 1's scope: no Twilio/Stripe/Google Calendar wiring, no Customer/Appointment models, no reminder jobs. (todo.md Phase 1 scope; AGENTS.md "don't build out-of-scope features")
+- Auth.js v5's Credentials-style custom login CANNOT use `session.strategy: "jwt"` alongside a registered `Credentials` provider without triggering `UnsupportedStrategy` if strategy is forced to `"jwt"` — and cannot use the adapter's implicit "database" strategy through NextAuth's own `signIn()` for Credentials at all (NextAuth hard-requires JWT for any registered Credentials provider). This plan resolves that by never registering a Credentials provider with NextAuth (`providers: []`), and instead the app's own `/app/(public)/login` Server Action creates the `Session` row directly via Prisma and sets the `authjs.session-token` cookie itself. `auth()`, `signOut()`, and the Prisma adapter continue to come from NextAuth. This was verified against current Auth.js docs (Context7 `/websites/authjs_dev`) during planning — flagged here per AGENTS.md "flag drift, don't guess" since it deviates from a naive reading of the spec's "Auth.js Credentials provider" phrasing while fully preserving the spec's actual requirement (revocable DB-backed sessions with `activeBusinessId`).
+
+---
+
+## File Structure
+
+```
+prisma/
+  schema.prisma                      # Business, User, Membership, Role enum, Auth.js adapter tables + activeBusinessId
+lib/
+  prisma.ts                          # Prisma client singleton
+  redis.ts                           # ioredis client singleton
+  auth.ts                            # NextAuth config: adapter, session.strategy="database", providers=[]
+  session.ts                         # createDatabaseSession, getSessionContext, SESSION_COOKIE_NAME
+  password.ts                        # hashPassword, verifyPassword (argon2)
+  csrf.ts                            # assertSameOrigin(req) — Origin/Sec-Fetch-Site check
+  logger.ts                          # pino instance
+  sentry.ts                          # Sentry init helper (server-only capture wrapper)
+  resend.ts                          # Resend client (lazy) + sendVerificationEmail/sendPasswordResetEmail + __capturedEmails (CAPTURE_EMAILS-gated dev capture)
+  queue.ts                           # BullMQ Queue instance + smoke-test job definition
+  validation/
+    auth.schema.ts                   # registerSchema, loginSchema, requestPasswordResetSchema, resetPasswordSchema
+    parse.ts                         # parseBody(schema, formDataOrJson) -> {success, data} | {success:false, issues}
+app/
+  (public)/
+    layout.tsx                       # public shell (header, no sidebar)
+    page.tsx                         # marketing placeholder homepage
+    login/
+      page.tsx
+      actions.ts                     # loginAction (Server Action) — creates DB session directly
+    signup/
+      page.tsx
+      actions.ts                     # registerAction (Server Action)
+    verify-email/
+      page.tsx                       # handles ?token=... verification link
+    reset-password/
+      page.tsx                       # request-reset form (no token) and reset form (?token=...) in one page
+      actions.ts                     # requestPasswordResetAction, resetPasswordAction
+  (app)/
+    layout.tsx                       # authed shell: sidebar placeholder + verify-email banner slot
+    dashboard/
+      page.tsx                       # empty dashboard placeholder at /dashboard (NOT / — see note)
+  api/
+    health/
+      route.ts                       # GET /health — DB + Redis check, fail-loud 503
+    auth/
+      [...nextauth]/
+        route.ts                     # NextAuth GET/POST handlers (adapter plumbing, signOut)
+    logout/
+      route.ts                       # POST — same-origin-checked, deletes Session row + clears cookie
+    __dev/
+      last-email/
+        route.ts                     # dev/test-only — returns last captured email link; 404 unless CAPTURE_EMAILS=1
+  layout.tsx                         # root layout (Tailwind globals, fonts)
+  globals.css
+components/
+  ui/                                 # shadcn/ui generated components (button, input, card, form, alert)
+  verify-email-banner.tsx
+tests/
+  unit/
+    password.test.ts
+    session.test.ts
+    validation.auth.test.ts
+    csrf.test.ts
+  component/
+    login-form.test.tsx
+    signup-form.test.tsx
+    reset-password-form.test.tsx
+  e2e/
+    auth-flows.spec.ts
+railway.toml                          # healthcheckPath = /health
+playwright.config.ts                  # E2E config (webServer runs build+start with CAPTURE_EMAILS=1, MOCK_EMAIL_SEND=1)
+.env.example                          # already exists (Phase 0) — no new vars needed, all already listed
+```
+
+**Route-group note:** Next.js route groups `(public)`/`(app)` do not affect the URL path, so both `app/(public)/page.tsx` and `app/(app)/page.tsx` would resolve to `/` and conflict (build error). The dashboard therefore lives at `/dashboard` (`app/(app)/dashboard/page.tsx`); the marketing homepage owns `/` (`app/(public)/page.tsx`). Task 1 creates a temporary root `app/page.tsx` placeholder so the app builds before route groups exist; Task 13 deletes it when it creates `app/(public)/page.tsx` (having both at `/` is a conflict, so the delete and the create must land together).
+
+**Interfaces contract (so later tasks match earlier ones exactly):**
+- `lib/prisma.ts` exports `prisma: PrismaClient` (default singleton pattern, `globalThis` cache).
+- `lib/redis.ts` exports `redis: Redis` (ioredis instance) and `REDIS_URL` read from env.
+- `lib/password.ts` exports `hashPassword(plain: string): Promise<string>` and `verifyPassword(plain: string, hash: string): Promise<boolean>`.
+- `lib/session.ts` exports:
+  - `SESSION_COOKIE_NAME: string` (`"authjs.session-token"` dev / `"__Secure-authjs.session-token"` prod, resolved by a helper `getSessionCookieName(): string`)
+  - `createDatabaseSession(userId: string, activeBusinessId: string): Promise<{ sessionToken: string; expires: Date }>`
+  - `getSessionContext(): Promise<{ userId: string; businessId: string; role: Role } | null>` — reads the cookie, loads the `Session` row + joined `Membership`, returns `null` if missing/expired/membership revoked. Never throws for the "no session" case; throws only on unexpected DB failure (fail-loud via Sentry).
+  - `deleteDatabaseSession(sessionToken: string): Promise<void>`
+- `lib/csrf.ts` exports `assertSameOrigin(headers: Headers): void` — throws `CsrfError` (custom class) if `Origin`/`Sec-Fetch-Site` don't match `APP_URL`.
+- `lib/validation/parse.ts` exports `parseBody<T>(schema: ZodSchema<T>, data: unknown): { success: true; data: T } | { success: false; issues: ZodIssue[] }`.
+- `lib/validation/auth.schema.ts` exports `registerSchema`, `loginSchema`, `requestPasswordResetSchema`, `resetPasswordSchema` (all `z.object(...)`).
+- `lib/resend.ts` exports `sendVerificationEmail(to: string, token: string): Promise<void>`, `sendPasswordResetEmail(to: string, token: string): Promise<void>`, and `__capturedEmails: { to: string; link: string }[]` (populated only when `CAPTURE_EMAILS=1`; the send is skipped entirely when `MOCK_EMAIL_SEND=1`). The Resend client is constructed lazily so the module loads even without `RESEND_API_KEY`.
+- `lib/queue.ts` exports `smokeQueue: Queue` and `SMOKE_JOB_NAME: string`.
+- `lib/logger.ts` exports default `logger` (pino instance).
+- `lib/sentry.ts` exports `captureServerError(err: unknown, context?: Record<string, unknown>): void`.
+
+---
+
+## Task 1: Next.js scaffold + Tailwind + shadcn/ui + base layout
+
+Hand-write the scaffold. Phase 0 already created `package.json`, `.gitignore`, `.github/`, `docs/`; running `create-next-app .` into a non-empty directory is unreliable — it can refuse to run or clobber Phase 0's `packageManager`/`engines` fields unpredictably. We control versions explicitly instead. Tailwind v3 (not v4) is used deliberately: it's the most battle-tested pairing with shadcn/ui and matches the `tailwind.config.ts` + CSS-variable theme pattern used below.
+
+**Files:**
+- Create: `next.config.ts`, `tsconfig.json`, `eslint.config.mjs`, `postcss.config.mjs`, `tailwind.config.ts`, `components.json`, `lib/utils.ts`, `app/layout.tsx`, `app/globals.css`, `app/page.tsx` (temporary homepage placeholder — replaced by `app/(public)/page.tsx` and deleted in Task 13)
+- Modify: `package.json` (real scripts + dependencies — preserve `name`/`private`/`license`/`packageManager`/`engines` from Phase 0)
+- Test: none (scaffolding task; verified by `pnpm build` succeeding)
+
+**Interfaces:**
+- Consumes: nothing (first task)
+- Produces: a running Next.js app shell that later tasks add routes/components into. `app/layout.tsx` is the root layout wrapping all routes; `app/page.tsx` is a throwaway so the app builds before route groups exist.
+
+- [ ] **Step 1: Install runtime + dev dependencies**
+
+Run:
+```bash
+pnpm add next@^15 react react-dom
+pnpm add -D typescript @types/node @types/react @types/react-dom \
+  eslint eslint-config-next @eslint/eslintrc \
+  tailwindcss@3 postcss autoprefixer tailwindcss-animate \
+  class-variance-authority clsx tailwind-merge lucide-react
+```
+
+- [ ] **Step 2: Replace package.json scripts (preserve Phase 0 metadata)**
+
+Edit `package.json` — keep `name`, `private`, `license`, `packageManager`, `engines` exactly as Phase 0 set them; set scripts:
+```json
+"scripts": {
+  "dev": "next dev",
+  "build": "next build",
+  "start": "next start",
+  "test": "vitest run",
+  "lint": "eslint .",
+  "typecheck": "tsc --noEmit",
+  "test:e2e": "playwright test"
+}
+```
+(`dependencies`/`devDependencies` are written by pnpm in Step 1 — do not hand-edit them.)
+
+- [ ] **Step 3: Write config files**
+
+Create `tsconfig.json`:
+```json
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "plugins": [{ "name": "next" }],
+    "paths": { "@/*": ["./*"] }
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}
+```
+
+Create `next.config.ts`:
+```typescript
+import type { NextConfig } from "next";
+
+const nextConfig: NextConfig = {};
+
+export default nextConfig;
+```
+(Task 6 wraps this export with `withSentryConfig`.)
+
+Create `eslint.config.mjs` (Next 15 flat config):
+```javascript
+import { FlatCompat } from "@eslint/eslintrc";
+
+const compat = new FlatCompat({ baseDirectory: import.meta.dirname });
+
+export default [...compat.extends("next/core-web-vitals", "next/typescript")];
+```
+
+Create `postcss.config.mjs`:
+```javascript
+const config = {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+};
+export default config;
+```
+
+Create `tailwind.config.ts`:
+```typescript
+import type { Config } from "tailwindcss";
+import animate from "tailwindcss-animate";
+
+const config: Config = {
+  content: ["./app/**/*.{ts,tsx}", "./components/**/*.{ts,tsx}"],
+  theme: {
+    extend: {
+      colors: {
+        border: "hsl(var(--border))",
+        input: "hsl(var(--input))",
+        ring: "hsl(var(--ring))",
+        background: "hsl(var(--background))",
+        foreground: "hsl(var(--foreground))",
+        primary: { DEFAULT: "hsl(var(--primary))", foreground: "hsl(var(--primary-foreground))" },
+        secondary: { DEFAULT: "hsl(var(--secondary))", foreground: "hsl(var(--secondary-foreground))" },
+        muted: { DEFAULT: "hsl(var(--muted))", foreground: "hsl(var(--muted-foreground))" },
+        accent: { DEFAULT: "hsl(var(--accent))", foreground: "hsl(var(--accent-foreground))" },
+        destructive: { DEFAULT: "hsl(var(--destructive))", foreground: "hsl(var(--destructive-foreground))" },
+        card: { DEFAULT: "hsl(var(--card))", foreground: "hsl(var(--card-foreground))" },
+      },
+      borderRadius: {
+        lg: "var(--radius)",
+        md: "calc(var(--radius) - 2px)",
+        sm: "calc(var(--radius) - 4px)",
+      },
+    },
+  },
+  plugins: [animate],
+};
+
+export default config;
+```
+
+Create `components.json` (shadcn config; lets `shadcn add` write into `components/ui/`):
+```json
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "default",
+  "rsc": true,
+  "tsx": true,
+  "tailwind": {
+    "config": "tailwind.config.ts",
+    "css": "app/globals.css",
+    "baseColor": "neutral",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "aliases": {
+    "components": "@/components",
+    "utils": "@/lib/utils",
+    "ui": "@/components/ui"
+  }
+}
+```
+
+Create `lib/utils.ts`:
+```typescript
+import { clsx, type ClassValue } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs));
+}
+```
+
+Create `app/globals.css` — Tailwind v3 directives plus the shadcn "neutral" base-color CSS variables. Use the canonical shadcn v3 globals.css: `@tailwind base; @tailwind components; @tailwind utilities;` then `:root { --background: 0 0% 100%; --foreground: 240 10% 3.9%; ... }` and `.dark { ... }` (the full neutral variable set), then:
+```css
+@layer base {
+  * { @apply border-border; }
+  body { @apply bg-background text-foreground; }
+}
+```
+Copy the exact `:root`/`.dark` variable blocks from the shadcn "neutral" theme reference so `hsl(var(--*))` tokens resolve.
+
+Create `app/layout.tsx` (root layout — the only layout in this task):
+```tsx
+import type { Metadata } from "next";
+import "./globals.css";
+
+export const metadata: Metadata = {
+  title: "CustomerETA",
+  description: "Automated appointment reminders for service businesses.",
+};
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}
+```
+
+Create `app/page.tsx` (temporary homepage so the app builds before route groups exist; Task 13 deletes this and creates `app/(public)/page.tsx` in the same commit to avoid a `/` route conflict):
+```tsx
+export default function Home() {
+  return <main className="p-8">CustomerETA</main>;
+}
+```
+
+- [ ] **Step 4: Add shadcn/ui components**
+
+`components.json` already exists, so `shadcn add` writes into `components/ui/`. Run:
+```bash
+pnpm dlx shadcn@latest add button input card label
+```
+(Only the components the auth forms use. shadcn `Form`/`Alert` are intentionally NOT added — the Phase 1 forms use plain `<form>` + `<Input>`/`<Label>`/`<Button>`, and the verify-email banner is hand-written, so pulling `react-hook-form`-based `Form` or `Alert` now would add unused deps.)
+
+- [ ] **Step 5: Install and verify build**
+
+Run: `pnpm install && pnpm build`
+Expected: build succeeds, `.next/` directory created.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: scaffold Next.js + Tailwind v3 + shadcn/ui (hand-written, no create-next-app)"
+```
+
+---
+
+## Task 2: Prisma schema — Business, User, Membership, Auth.js adapter tables
+
+**Files:**
+- Create: `prisma/schema.prisma`, `lib/prisma.ts`
+- Modify: `.env.example` (add `DATABASE_URL` comment noting Prisma requires it — already present from Phase 0, verify format matches `postgresql://` and includes `?schema=public`)
+- Test: `tests/unit/prisma-client.test.ts`
+
+**Interfaces:**
+- Consumes: nothing new
+- Produces: `prisma: PrismaClient` singleton from `lib/prisma.ts`, and the generated Prisma Client types (`Business`, `User`, `Membership`, `Role`, `Session`, `Account`, `VerificationToken`) used by every later task.
+
+- [ ] **Step 1: Install Prisma**
+
+Run: `pnpm add -D prisma && pnpm add @prisma/client && pnpm dlx prisma init --datasource-provider postgresql`
+
+- [ ] **Step 2: Write the schema**
+
+Create `prisma/schema.prisma`:
+
+```prisma
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "postgresql"
+  url      = env("DATABASE_URL")
+}
+
+model Business {
+  id          String       @id @default(cuid())
+  name        String
+  timezone    String
+  memberships Membership[]
+  createdAt   DateTime     @default(now())
+  updatedAt   DateTime     @updatedAt
+}
+
+model User {
+  id            String       @id @default(cuid())
+  email         String       @unique
+  emailVerified DateTime?
+  passwordHash  String
+  memberships   Membership[]
+  sessions      Session[]
+  accounts      Account[]
+  createdAt     DateTime     @default(now())
+  updatedAt     DateTime     @updatedAt
+}
+
+model Membership {
+  id         String   @id @default(cuid())
+  userId     String
+  businessId String
+  role       Role     @default(OWNER)
+  user       User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  business   Business @relation(fields: [businessId], references: [id], onDelete: Cascade)
+  createdAt  DateTime @default(now())
+
+  @@unique([userId, businessId])
+}
+
+enum Role {
+  OWNER
+}
+
+model Account {
+  id                String  @id @default(cuid())
+  userId            String
+  type              String
+  provider          String
+  providerAccountId String
+  refresh_token     String? @db.Text
+  access_token      String? @db.Text
+  expires_at        Int?
+  token_type        String?
+  scope             String?
+  id_token          String? @db.Text
+  session_state     String?
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([provider, providerAccountId])
+}
+
+model Session {
+  id               String   @id @default(cuid())
+  sessionToken     String   @unique
+  userId           String
+  activeBusinessId String?
+  expires          DateTime
+  user             User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+}
+
+model VerificationToken {
+  identifier String
+  token      String
+  expires    DateTime
+
+  @@unique([identifier, token])
+}
+
+model PasswordResetToken {
+  id        String   @id @default(cuid())
+  userId    String
+  tokenHash String   @unique
+  expires   DateTime
+  usedAt    DateTime?
+  createdAt DateTime @default(now())
+}
+```
+
+Note: `PasswordResetToken` is a custom table (not part of the Auth.js adapter) since Auth.js's `VerificationToken` model is reused by the adapter for email-verification-link flows and mixing password-reset tokens into it risks identifier collisions. Keeping them separate is explicit and simpler to reason about.
+
+- [ ] **Step 3: Create the Prisma client singleton**
+
+Create `lib/prisma.ts`:
+
+```typescript
+import { PrismaClient } from "@prisma/client";
+
+const globalForPrisma = globalThis as unknown as { prisma?: PrismaClient };
+
+export const prisma = globalForPrisma.prisma ?? new PrismaClient();
+
+if (process.env.NODE_ENV !== "production") {
+  globalForPrisma.prisma = prisma;
+}
+```
+
+- [ ] **Step 4: Generate client and run first migration**
+
+Requires a reachable `DATABASE_URL`. For local dev, start Postgres via Docker:
+```bash
+docker run -d --name customereta-pg -e POSTGRES_PASSWORD=postgres -e POSTGRES_DB=customereta -p 5432:5432 postgres:16
+```
+Set `.env.local`:
+```
+DATABASE_URL="postgresql://postgres:postgres@localhost:5432/customereta?schema=public"
+```
+Run:
+```bash
+pnpm dlx prisma migrate dev --name init
+```
+Expected: migration created under `prisma/migrations/`, applied successfully, Prisma Client generated.
+
+- [ ] **Step 5: Write and run a smoke test**
+
+Create `tests/unit/prisma-client.test.ts`:
+
+```typescript
+import { describe, it, expect, afterAll } from "vitest";
+import { prisma } from "@/lib/prisma";
+
+describe("prisma client", () => {
+  it("connects and can create+delete a Business", async () => {
+    const business = await prisma.business.create({
+      data: { name: "Test Co", timezone: "America/Chicago" },
+    });
+    expect(business.id).toBeDefined();
+    await prisma.business.delete({ where: { id: business.id } });
+  });
+
+  afterAll(async () => {
+    await prisma.$disconnect();
+  });
+});
+```
+
+This is written now but only runnable once Task 5 (Vitest setup) lands — leave it in place; Task 5 makes `pnpm test` pick it up.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: Prisma schema (Business, User, Membership, Auth.js adapter tables)"
+```
+
+---
+
+## Task 3: Password hashing utility
+
+**Files:**
+- Create: `lib/password.ts`
+- Test: `tests/unit/password.test.ts`
+
+**Interfaces:**
+- Consumes: nothing
+- Produces: `hashPassword(plain: string): Promise<string>`, `verifyPassword(plain: string, hash: string): Promise<boolean>` — used by Task 7 (register) and Task 8 (login).
+
+- [ ] **Step 1: Install argon2**
+
+Run: `pnpm add argon2`
+
+- [ ] **Step 2: Write the failing test**
+
+Create `tests/unit/password.test.ts`:
+
+```typescript
+import { describe, it, expect } from "vitest";
+import { hashPassword, verifyPassword } from "@/lib/password";
+
+describe("password hashing", () => {
+  it("hashes a password and verifies it correctly", async () => {
+    const hash = await hashPassword("correct horse battery staple");
+    expect(hash).not.toBe("correct horse battery staple");
+    expect(await verifyPassword("correct horse battery staple", hash)).toBe(true);
+  });
+
+  it("rejects an incorrect password", async () => {
+    const hash = await hashPassword("correct horse battery staple");
+    expect(await verifyPassword("wrong password", hash)).toBe(false);
+  });
+});
+```
+
+(This test can't run until Task 5 sets up Vitest — write it now, it runs then.)
+
+- [ ] **Step 3: Implement**
+
+Create `lib/password.ts`:
+
+```typescript
+import * as argon2 from "argon2";
+
+export async function hashPassword(plain: string): Promise<string> {
+  return argon2.hash(plain);
+}
+
+export async function verifyPassword(plain: string, hash: string): Promise<boolean> {
+  try {
+    return await argon2.verify(hash, plain);
+  } catch {
+    return false;
+  }
+}
+```
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: password hashing utility (argon2)"
+```
+
+---
+
+## Task 4: Centralized Zod validation pattern
+
+**Files:**
+- Create: `lib/validation/parse.ts`, `lib/validation/auth.schema.ts`
+- Test: `tests/unit/validation.auth.test.ts`
+
+**Interfaces:**
+- Consumes: nothing
+- Produces: `parseBody<T>(schema, data)`, `registerSchema`, `loginSchema`, `requestPasswordResetSchema`, `resetPasswordSchema` — consumed by every auth Server Action in Tasks 7, 8, 10.
+
+- [ ] **Step 1: Install Zod**
+
+Run: `pnpm add zod`
+
+- [ ] **Step 2: Write the failing test**
+
+Create `tests/unit/validation.auth.test.ts`:
+
+```typescript
+import { describe, it, expect } from "vitest";
+import { registerSchema, loginSchema } from "@/lib/validation/auth.schema";
+import { parseBody } from "@/lib/validation/parse";
+
+describe("auth validation schemas", () => {
+  it("accepts a valid register payload", () => {
+    const result = parseBody(registerSchema, {
+      email: "owner@example.com",
+      password: "correct horse battery staple",
+      businessName: "Acme HVAC",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects an invalid email", () => {
+    const result = parseBody(registerSchema, {
+      email: "not-an-email",
+      password: "correct horse battery staple",
+      businessName: "Acme HVAC",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects a short password", () => {
+    const result = parseBody(registerSchema, {
+      email: "owner@example.com",
+      password: "short",
+      businessName: "Acme HVAC",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects a missing business name", () => {
+    const result = parseBody(registerSchema, {
+      email: "owner@example.com",
+      password: "correct horse battery staple",
+      businessName: "",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("accepts a valid login payload", () => {
+    const result = parseBody(loginSchema, {
+      email: "owner@example.com",
+      password: "anything",
+    });
+    expect(result.success).toBe(true);
+  });
+});
+```
+
+- [ ] **Step 3: Implement parseBody**
+
+Create `lib/validation/parse.ts`:
+
+```typescript
+import type { ZodSchema, ZodIssue } from "zod";
+
+export type ParseResult<T> =
+  | { success: true; data: T }
+  | { success: false; issues: ZodIssue[] };
+
+export function parseBody<T>(schema: ZodSchema<T>, data: unknown): ParseResult<T> {
+  const result = schema.safeParse(data);
+  if (!result.success) {
+    return { success: false, issues: result.error.issues };
+  }
+  return { success: true, data: result.data };
+}
+```
+
+- [ ] **Step 4: Implement auth schemas**
+
+Create `lib/validation/auth.schema.ts`:
+
+```typescript
+import { z } from "zod";
+
+export const registerSchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(12, "Password must be at least 12 characters"),
+  businessName: z.string().min(1, "Business name is required"),
+});
+
+export const loginSchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(1),
+});
+
+export const requestPasswordResetSchema = z.object({
+  email: z.string().email(),
+});
+
+export const resetPasswordSchema = z.object({
+  token: z.string().min(1),
+  password: z.string().min(12, "Password must be at least 12 characters"),
+});
+```
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: centralized Zod validation pattern for auth"
+```
+
+---
+
+## Task 5: Vitest + React Testing Library setup (proves the harness runs)
+
+**Files:**
+- Create: `vitest.config.ts`, `vitest.setup.ts`, `tests/unit/harness.test.ts`
+- Modify: `package.json` (devDependencies)
+- Test: `tests/unit/harness.test.ts` (the proof test itself)
+
+**Interfaces:**
+- Consumes: nothing
+- Produces: a working `pnpm test` that picks up every `tests/**/*.test.ts(x)` file, including the ones already written in Tasks 2–4.
+
+- [ ] **Step 1: Install Vitest + RTL**
+
+Run:
+```bash
+pnpm add -D vitest @vitejs/plugin-react vite-tsconfig-paths jsdom @testing-library/react @testing-library/jest-dom @testing-library/user-event
+```
+
+- [ ] **Step 2: Configure Vitest**
+
+Create `vitest.config.ts`:
+
+```typescript
+import { defineConfig } from "vitest/config";
+import react from "@vitejs/plugin-react";
+import tsconfigPaths from "vite-tsconfig-paths";
+
+export default defineConfig({
+  plugins: [react(), tsconfigPaths()],
+  test: {
+    environment: "jsdom",
+    setupFiles: ["./vitest.setup.ts"],
+    include: ["tests/unit/**/*.test.ts", "tests/component/**/*.test.tsx"],
+  },
+});
+```
+
+Create `vitest.setup.ts`:
+
+```typescript
+import "@testing-library/jest-dom/vitest";
+```
+
+- [ ] **Step 3: Write the harness proof test**
+
+Create `tests/unit/harness.test.ts`:
+
+```typescript
+import { describe, it, expect } from "vitest";
+
+describe("test harness", () => {
+  it("runs", () => {
+    expect(1 + 1).toBe(2);
+  });
+});
+```
+
+- [ ] **Step 4: Run the full unit suite**
+
+Run: `pnpm test`
+Expected: PASS for `harness.test.ts`, `password.test.ts`, `validation.auth.test.ts`. `prisma-client.test.ts` requires a reachable `DATABASE_URL` — expected PASS if the Task 2 Docker Postgres is still running, otherwise expected to fail with a connection error (acceptable at this point; CI wires a real Postgres service in Task 14).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: Vitest + React Testing Library harness"
+```
+
+---
+
+## Task 6: pino logging + Sentry error capture
+
+**Files:**
+- Create: `lib/logger.ts`, `lib/sentry.ts`
+- Modify: `next.config.ts` (Sentry wrapper, only if using `@sentry/nextjs`'s config wizard output — otherwise plain init)
+- Test: `tests/unit/sentry.test.ts`
+
+**Interfaces:**
+- Consumes: nothing
+- Produces: `logger` (default export from `lib/logger.ts`), `captureServerError(err, context?)` from `lib/sentry.ts` — used by every route/action from Task 7 onward for fail-loud error handling.
+
+- [ ] **Step 1: Install pino and Sentry**
+
+Run: `pnpm add pino @sentry/nextjs`
+
+- [ ] **Step 2: Create the logger**
+
+Create `lib/logger.ts`:
+
+```typescript
+import pino from "pino";
+
+const logger = pino({
+  level: process.env.LOG_LEVEL ?? "info",
+  base: undefined,
+});
+
+export default logger;
+```
+
+- [ ] **Step 3: Write the failing test for captureServerError**
+
+Create `tests/unit/sentry.test.ts`:
+
+```typescript
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@sentry/nextjs", () => ({
+  captureException: vi.fn(),
+}));
+
+import * as Sentry from "@sentry/nextjs";
+import { captureServerError } from "@/lib/sentry";
+
+describe("captureServerError", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("forwards the error and context to Sentry.captureException", () => {
+    const err = new Error("boom");
+    captureServerError(err, { route: "/api/health" });
+    expect(Sentry.captureException).toHaveBeenCalledWith(err, {
+      extra: { route: "/api/health" },
+    });
+  });
+
+  it("works with no context", () => {
+    const err = new Error("boom");
+    captureServerError(err);
+    expect(Sentry.captureException).toHaveBeenCalledWith(err, { extra: {} });
+  });
+});
+```
+
+- [ ] **Step 4: Run test to verify it fails**
+
+Run: `pnpm test -- sentry.test`
+Expected: FAIL — `lib/sentry.ts` does not exist yet.
+
+- [ ] **Step 5: Implement**
+
+Create `lib/sentry.ts`:
+
+```typescript
+import * as Sentry from "@sentry/nextjs";
+
+export function captureServerError(err: unknown, context: Record<string, unknown> = {}): void {
+  Sentry.captureException(err, { extra: context });
+}
+```
+
+Add Sentry init — create `sentry.server.config.ts` at project root:
+
+```typescript
+import * as Sentry from "@sentry/nextjs";
+
+Sentry.init({
+  dsn: process.env.SENTRY_DSN,
+  tracesSampleRate: 0.1,
+  enabled: process.env.NODE_ENV === "production",
+});
+```
+
+Wrap `next.config.ts` export with `withSentryConfig` per `@sentry/nextjs`'s standard integration (only affects build-time source map upload; app behavior unchanged):
+
+```typescript
+import { withSentryConfig } from "@sentry/nextjs";
+import type { NextConfig } from "next";
+
+const nextConfig: NextConfig = {};
+
+export default withSentryConfig(nextConfig, {
+  silent: true,
+  org: process.env.SENTRY_ORG,
+  project: process.env.SENTRY_PROJECT,
+});
+```
+
+- [ ] **Step 6: Run test to verify it passes**
+
+Run: `pnpm test -- sentry.test`
+Expected: PASS
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: pino logging + Sentry error capture"
+```
+
+---
+
+## Task 7: CSRF origin-check helper
+
+**Files:**
+- Create: `lib/csrf.ts`
+- Test: `tests/unit/csrf.test.ts`
+
+**Interfaces:**
+- Consumes: nothing
+- Produces: `assertSameOrigin(headers: Headers): void` (throws `CsrfError`) and `CsrfError` class — used by every custom mutation route (Tasks 8, 10, and the logout route).
+
+- [ ] **Step 1: Write the failing test**
+
+Create `tests/unit/csrf.test.ts`:
+
+```typescript
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { assertSameOrigin, CsrfError } from "@/lib/csrf";
+
+describe("assertSameOrigin", () => {
+  const OLD_ENV = process.env.APP_URL;
+
+  beforeEach(() => {
+    process.env.APP_URL = "https://app.customereta.com";
+  });
+
+  afterEach(() => {
+    process.env.APP_URL = OLD_ENV;
+  });
+
+  it("passes when Origin matches APP_URL", () => {
+    const headers = new Headers({ origin: "https://app.customereta.com" });
+    expect(() => assertSameOrigin(headers)).not.toThrow();
+  });
+
+  it("throws when Origin does not match APP_URL", () => {
+    const headers = new Headers({ origin: "https://evil.example.com" });
+    expect(() => assertSameOrigin(headers)).toThrow(CsrfError);
+  });
+
+  it("throws when Origin header is missing", () => {
+    const headers = new Headers();
+    expect(() => assertSameOrigin(headers)).toThrow(CsrfError);
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `pnpm test -- csrf.test`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement**
+
+Create `lib/csrf.ts`:
+
+```typescript
+export class CsrfError extends Error {
+  constructor(message = "CSRF check failed: origin mismatch") {
+    super(message);
+    this.name = "CsrfError";
+  }
+}
+
+export function assertSameOrigin(headers: Headers): void {
+  const origin = headers.get("origin");
+  const appUrl = process.env.APP_URL;
+
+  if (!appUrl) {
+    throw new CsrfError("APP_URL is not configured");
+  }
+  if (!origin || new URL(origin).origin !== new URL(appUrl).origin) {
+    throw new CsrfError();
+  }
+}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `pnpm test -- csrf.test`
+Expected: PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: CSRF same-origin check helper"
+```
+
+---
+
+## Task 8: Resend client + auth email senders
+
+**Files:**
+- Create: `lib/resend.ts`
+- Test: `tests/unit/resend.test.ts`
+
+**Interfaces:**
+- Consumes: nothing
+- Produces: `sendVerificationEmail(to: string, token: string): Promise<void>`, `sendPasswordResetEmail(to: string, token: string): Promise<void>` — used by Task 9 (register) and Task 11 (password reset).
+
+- [ ] **Step 1: Install Resend**
+
+Run: `pnpm add resend`
+
+- [ ] **Step 2: Write the failing test**
+
+Create `tests/unit/resend.test.ts`:
+
+```typescript
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+const sendMock = vi.fn().mockResolvedValue({ data: { id: "test" }, error: null });
+
+vi.mock("resend", () => ({
+  Resend: vi.fn().mockImplementation(() => ({
+    emails: { send: sendMock },
+  })),
+}));
+
+import { sendVerificationEmail, sendPasswordResetEmail } from "@/lib/resend";
+
+describe("auth email senders", () => {
+  beforeEach(() => {
+    sendMock.mockClear();
+    process.env.RESEND_FROM_EMAIL = "no-reply@customereta.com";
+    process.env.APP_URL = "https://app.customereta.com";
+  });
+
+  it("sends a verification email with a link containing the token", async () => {
+    await sendVerificationEmail("owner@example.com", "tok123");
+    expect(sendMock).toHaveBeenCalledTimes(1);
+    const call = sendMock.mock.calls[0][0];
+    expect(call.to).toBe("owner@example.com");
+    expect(call.html).toContain("tok123");
+  });
+
+  it("sends a password reset email with a link containing the token", async () => {
+    await sendPasswordResetEmail("owner@example.com", "tok456");
+    expect(sendMock).toHaveBeenCalledTimes(1);
+    const call = sendMock.mock.calls[0][0];
+    expect(call.to).toBe("owner@example.com");
+    expect(call.html).toContain("tok456");
+  });
+});
+```
+
+- [ ] **Step 3: Run test to verify it fails**
+
+Run: `pnpm test -- resend.test`
+Expected: FAIL — module not found.
+
+- [ ] **Step 4: Implement**
+
+Create `lib/resend.ts`:
+
+```typescript
+import { Resend } from "resend";
+
+// Populated only when CAPTURE_EMAILS=1 (dev/test). Read by the dev-only
+// /api/__dev/last-email route so E2E (which runs against a production build)
+// can retrieve the verification/reset link without a real inbox.
+export const __capturedEmails: { to: string; link: string }[] = [];
+
+// Construct lazily so the module loads even when RESEND_API_KEY is unset
+// (e.g. build time, or MOCK_EMAIL_SEND=1 E2E runs).
+function getClient(): Resend {
+  return new Resend(process.env.RESEND_API_KEY ?? "");
+}
+
+export async function sendVerificationEmail(to: string, token: string): Promise<void> {
+  const link = `${process.env.APP_URL}/verify-email?token=${encodeURIComponent(token)}`;
+  if (process.env.CAPTURE_EMAILS === "1") __capturedEmails.push({ to, link });
+  if (process.env.MOCK_EMAIL_SEND === "1") return;
+  await getClient().emails.send({
+    from: process.env.RESEND_FROM_EMAIL as string,
+    to,
+    subject: "Verify your CustomerETA email",
+    html: `<p>Click to verify your email: <a href="${link}">${link}</a></p>`,
+  });
+}
+
+export async function sendPasswordResetEmail(to: string, token: string): Promise<void> {
+  const link = `${process.env.APP_URL}/reset-password?token=${encodeURIComponent(token)}`;
+  if (process.env.CAPTURE_EMAILS === "1") __capturedEmails.push({ to, link });
+  if (process.env.MOCK_EMAIL_SEND === "1") return;
+  await getClient().emails.send({
+    from: process.env.RESEND_FROM_EMAIL as string,
+    to,
+    subject: "Reset your CustomerETA password",
+    html: `<p>Click to reset your password: <a href="${link}">${link}</a></p>`,
+  });
+}
+```
+
+The capture/mock gating lives in the resend client from the start (not patched in later): `CAPTURE_EMAILS=1` records the link for E2E; `MOCK_EMAIL_SEND=1` skips the real Resend call entirely so E2E can run without a configured Resend sending domain. Production sets neither — real emails are sent via Resend. The Task 8 unit test below mocks the `resend` module, so it exercises the `getClient().emails.send` path with `MOCK_EMAIL_SEND` unset.
+
+- [ ] **Step 5: Run test to verify it passes**
+
+Run: `pnpm test -- resend.test`
+Expected: PASS
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: Resend client for auth emails (verify, reset)"
+```
+
+---
+
+## Task 9: Auth.js config (adapter only, no Credentials provider) + session helpers
+
+**Files:**
+- Create: `lib/auth.ts`, `lib/session.ts`, `app/api/auth/[...nextauth]/route.ts`
+- Test: `tests/unit/session.test.ts`
+
+**Interfaces:**
+- Consumes: `prisma` (Task 2), `logger`/`captureServerError` (Task 6)
+- Produces: `auth()`, `signOut()` (from `lib/auth.ts`, re-exported NextAuth functions), `createDatabaseSession(userId, activeBusinessId)`, `getSessionContext()`, `deleteDatabaseSession(sessionToken)`, `getSessionCookieName()` from `lib/session.ts` — consumed by Tasks 10 (login), 12 (logout), and every future authed route.
+
+- [ ] **Step 1: Install Auth.js**
+
+Run: `pnpm add next-auth@beta @auth/prisma-adapter`
+
+- [ ] **Step 2: Write the failing test for getSessionContext**
+
+Create `tests/unit/session.test.ts`:
+
+```typescript
+import { describe, it, expect, beforeEach, afterAll, vi } from "vitest";
+import { prisma } from "@/lib/prisma";
+import { createDatabaseSession, getSessionContext, deleteDatabaseSession } from "@/lib/session";
+
+vi.mock("next/headers", () => ({
+  cookies: vi.fn(),
+}));
+
+import { cookies } from "next/headers";
+
+describe("session scoping", () => {
+  let userId: string;
+  let businessId: string;
+  let otherBusinessId: string;
+
+  beforeEach(async () => {
+    const business = await prisma.business.create({
+      data: { name: "Acme HVAC", timezone: "America/Chicago" },
+    });
+    businessId = business.id;
+
+    const otherBusiness = await prisma.business.create({
+      data: { name: "Other Co", timezone: "America/New_York" },
+    });
+    otherBusinessId = otherBusiness.id;
+
+    const user = await prisma.user.create({
+      data: { email: `test-${Date.now()}@example.com`, passwordHash: "hash" },
+    });
+    userId = user.id;
+
+    await prisma.membership.create({
+      data: { userId, businessId, role: "OWNER" },
+    });
+  });
+
+  afterAll(async () => {
+    await prisma.$disconnect();
+  });
+
+  it("resolves session context for a valid session + membership", async () => {
+    const { sessionToken } = await createDatabaseSession(userId, businessId);
+    vi.mocked(cookies).mockResolvedValue({
+      get: () => ({ value: sessionToken }),
+    } as any);
+
+    const ctx = await getSessionContext();
+    expect(ctx).not.toBeNull();
+    expect(ctx?.userId).toBe(userId);
+    expect(ctx?.businessId).toBe(businessId);
+    expect(ctx?.role).toBe("OWNER");
+  });
+
+  it("returns null when no session cookie is present", async () => {
+    vi.mocked(cookies).mockResolvedValue({
+      get: () => undefined,
+    } as any);
+
+    const ctx = await getSessionContext();
+    expect(ctx).toBeNull();
+  });
+
+  it("returns null when the session's activeBusinessId has no matching membership (revoked/mismatched)", async () => {
+    const { sessionToken } = await createDatabaseSession(userId, otherBusinessId);
+    vi.mocked(cookies).mockResolvedValue({
+      get: () => ({ value: sessionToken }),
+    } as any);
+
+    const ctx = await getSessionContext();
+    expect(ctx).toBeNull();
+  });
+
+  it("returns null and cleans up an expired session", async () => {
+    const { sessionToken } = await createDatabaseSession(userId, businessId);
+    await prisma.session.update({
+      where: { sessionToken },
+      data: { expires: new Date(Date.now() - 1000) },
+    });
+    vi.mocked(cookies).mockResolvedValue({
+      get: () => ({ value: sessionToken }),
+    } as any);
+
+    const ctx = await getSessionContext();
+    expect(ctx).toBeNull();
+    const stillThere = await prisma.session.findUnique({ where: { sessionToken } });
+    expect(stillThere).toBeNull();
+  });
+
+  it("deleteDatabaseSession removes the session row", async () => {
+    const { sessionToken } = await createDatabaseSession(userId, businessId);
+    await deleteDatabaseSession(sessionToken);
+    const found = await prisma.session.findUnique({ where: { sessionToken } });
+    expect(found).toBeNull();
+  });
+});
+```
+
+- [ ] **Step 3: Run test to verify it fails**
+
+Run: `pnpm test -- session.test`
+Expected: FAIL — `lib/session.ts` does not exist.
+
+- [ ] **Step 4: Implement lib/auth.ts**
+
+Create `lib/auth.ts`:
+
+```typescript
+import NextAuth from "next-auth";
+import { PrismaAdapter } from "@auth/prisma-adapter";
+import { prisma } from "@/lib/prisma";
+
+export const { auth, signOut, handlers } = NextAuth({
+  adapter: PrismaAdapter(prisma),
+  session: { strategy: "database" },
+  providers: [],
+});
+```
+
+- [ ] **Step 5: Implement lib/session.ts**
+
+Create `lib/session.ts`:
+
+```typescript
+import { randomBytes } from "crypto";
+import { cookies } from "next/headers";
+import { prisma } from "@/lib/prisma";
+import { captureServerError } from "@/lib/sentry";
+import type { Role } from "@prisma/client";
+
+const SESSION_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+
+export function getSessionCookieName(): string {
+  return process.env.NODE_ENV === "production"
+    ? "__Secure-authjs.session-token"
+    : "authjs.session-token";
+}
+
+export async function createDatabaseSession(
+  userId: string,
+  activeBusinessId: string
+): Promise<{ sessionToken: string; expires: Date }> {
+  const sessionToken = randomBytes(32).toString("hex");
+  const expires = new Date(Date.now() + SESSION_MAX_AGE_MS);
+
+  await prisma.session.create({
+    data: { sessionToken, userId, activeBusinessId, expires },
+  });
+
+  return { sessionToken, expires };
+}
+
+export async function deleteDatabaseSession(sessionToken: string): Promise<void> {
+  await prisma.session.deleteMany({ where: { sessionToken } });
+}
+
+export interface SessionContext {
+  userId: string;
+  businessId: string;
+  role: Role;
+}
+
+export async function getSessionContext(): Promise<SessionContext | null> {
+  const cookieStore = await cookies();
+  const cookie = cookieStore.get(getSessionCookieName());
+  if (!cookie?.value) return null;
+
+  try {
+    const session = await prisma.session.findUnique({
+      where: { sessionToken: cookie.value },
+    });
+
+    if (!session || !session.activeBusinessId) return null;
+
+    if (session.expires < new Date()) {
+      await deleteDatabaseSession(cookie.value);
+      return null;
+    }
+
+    const membership = await prisma.membership.findUnique({
+      where: {
+        userId_businessId: {
+          userId: session.userId,
+          businessId: session.activeBusinessId,
+        },
+      },
+    });
+
+    if (!membership) return null;
+
+    return {
+      userId: session.userId,
+      businessId: session.activeBusinessId,
+      role: membership.role,
+    };
+  } catch (err) {
+    captureServerError(err, { where: "getSessionContext" });
+    throw err;
+  }
+}
+```
+
+- [ ] **Step 6: Create the NextAuth route handler**
+
+Create `app/api/auth/[...nextauth]/route.ts`:
+
+```typescript
+import { handlers } from "@/lib/auth";
+
+export const { GET, POST } = handlers;
+```
+
+- [ ] **Step 7: Run test to verify it passes**
+
+Run: `pnpm test -- session.test`
+Expected: PASS (requires the Task 2 Postgres to be reachable)
+
+- [ ] **Step 8: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: Auth.js adapter config + getSessionContext tenant-scoping helper"
+```
+
+---
+
+## Task 10: Registration flow (Server Action) + email verification page
+
+**Files:**
+- Create: `app/(public)/signup/page.tsx`, `app/(public)/signup/actions.ts`, `app/(public)/verify-email/page.tsx`
+- Test: `tests/unit/register-action.test.ts`, `tests/e2e/auth-flows.spec.ts` (signup + verify portion, extended in Task 11/13)
+
+**Interfaces:**
+- Consumes: `registerSchema`/`parseBody` (Task 4), `hashPassword` (Task 3), `sendVerificationEmail` (Task 8), `prisma` (Task 2), `captureServerError`/`logger` (Task 6)
+- Produces: `registerAction(formData: FormData): Promise<{ error?: string }>` — used by `signup/page.tsx`'s form and tested directly.
+
+- [ ] **Step 1: Write the failing unit test**
+
+Create `tests/unit/register-action.test.ts`:
+
+```typescript
+import { describe, it, expect, afterAll, vi } from "vitest";
+import { prisma } from "@/lib/prisma";
+
+vi.mock("@/lib/resend", () => ({
+  sendVerificationEmail: vi.fn().mockResolvedValue(undefined),
+}));
+
+import { registerAction } from "@/app/(public)/signup/actions";
+import { sendVerificationEmail } from "@/lib/resend";
+
+describe("registerAction", () => {
+  afterAll(async () => {
+    await prisma.$disconnect();
+  });
+
+  it("creates a User, a Business, and an OWNER Membership in one transaction", async () => {
+    const email = `owner-${Date.now()}@example.com`;
+    const formData = new FormData();
+    formData.set("email", email);
+    formData.set("password", "correct horse battery staple");
+    formData.set("businessName", "Acme HVAC");
+
+    const result = await registerAction(formData);
+    expect(result.error).toBeUndefined();
+
+    const user = await prisma.user.findUnique({
+      where: { email },
+      include: { memberships: { include: { business: true } } },
+    });
+    expect(user).not.toBeNull();
+    expect(user?.emailVerified).toBeNull();
+    expect(user?.memberships).toHaveLength(1);
+    expect(user?.memberships[0].role).toBe("OWNER");
+    expect(user?.memberships[0].business.name).toBe("Acme HVAC");
+    expect(sendVerificationEmail).toHaveBeenCalledWith(email, expect.any(String));
+  });
+
+  it("rejects a duplicate email without leaking which field failed to a generic error", async () => {
+    const email = `dup-${Date.now()}@example.com`;
+    const formData = new FormData();
+    formData.set("email", email);
+    formData.set("password", "correct horse battery staple");
+    formData.set("businessName", "Acme HVAC");
+    await registerAction(formData);
+
+    const secondAttempt = new FormData();
+    secondAttempt.set("email", email);
+    secondAttempt.set("password", "another password value");
+    secondAttempt.set("businessName", "Acme HVAC 2");
+    const result = await registerAction(secondAttempt);
+    expect(result.error).toBeDefined();
+  });
+
+  it("rejects an invalid payload via Zod before touching the database", async () => {
+    const formData = new FormData();
+    formData.set("email", "not-an-email");
+    formData.set("password", "short");
+    formData.set("businessName", "");
+
+    const result = await registerAction(formData);
+    expect(result.error).toBeDefined();
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `pnpm test -- register-action.test`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement the register Server Action**
+
+Create `app/(public)/signup/actions.ts`:
+
+```typescript
+"use server";
+
+import { randomBytes } from "crypto";
+import { prisma } from "@/lib/prisma";
+import { hashPassword } from "@/lib/password";
+import { parseBody } from "@/lib/validation/parse";
+import { registerSchema } from "@/lib/validation/auth.schema";
+import { sendVerificationEmail } from "@/lib/resend";
+import { captureServerError } from "@/lib/sentry";
+import logger from "@/lib/logger";
+
+export async function registerAction(formData: FormData): Promise<{ error?: string }> {
+  const parsed = parseBody(registerSchema, {
+    email: formData.get("email"),
+    password: formData.get("password"),
+    businessName: formData.get("businessName"),
+  });
+
+  if (!parsed.success) {
+    return { error: parsed.issues[0]?.message ?? "Invalid input" };
+  }
+
+  const { email, password, businessName } = parsed.data;
+
+  const existing = await prisma.user.findUnique({ where: { email } });
+  if (existing) {
+    return { error: "Unable to create account with these details" };
+  }
+
+  const passwordHash = await hashPassword(password);
+  const verificationToken = randomBytes(32).toString("hex");
+
+  try {
+    await prisma.$transaction(async (tx) => {
+      const user = await tx.user.create({
+        data: { email, passwordHash },
+      });
+      const business = await tx.business.create({
+        data: { name: businessName, timezone: "America/Chicago" },
+      });
+      await tx.membership.create({
+        data: { userId: user.id, businessId: business.id, role: "OWNER" },
+      });
+      await tx.verificationToken.create({
+        data: {
+          identifier: email,
+          token: verificationToken,
+          expires: new Date(Date.now() + 24 * 60 * 60 * 1000),
+        },
+      });
+    });
+
+    await sendVerificationEmail(email, verificationToken);
+    logger.info({ email }, "user registered");
+    return {};
+  } catch (err) {
+    captureServerError(err, { where: "registerAction", email });
+    return { error: "Unable to create account. Please try again." };
+  }
+}
+```
+
+Note: `timezone: "America/Chicago"` is a hardcoded placeholder default for Phase 1 — a business-timezone picker is out of scope here (no UI for it was specified) and will be revisited when Phase 2's Customer/Appointment timezone handling is designed. This is a deliberate, documented simplification, not a silent gap.
+
+- [ ] **Step 4: Implement the signup page**
+
+Create `app/(public)/signup/page.tsx`:
+
+```tsx
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import { registerAction } from "./actions";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+
+export default function SignupPage() {
+  const router = useRouter();
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState(false);
+
+  async function handleSubmit(formData: FormData) {
+    setPending(true);
+    setError(null);
+    const result = await registerAction(formData);
+    setPending(false);
+    if (result.error) {
+      setError(result.error);
+      return;
+    }
+    router.push("/verify-email");
+  }
+
+  return (
+    <form action={handleSubmit} className="mx-auto max-w-sm space-y-4 py-16">
+      <h1 className="text-2xl font-semibold">Create your account</h1>
+      <div className="space-y-2">
+        <Label htmlFor="businessName">Business name</Label>
+        <Input id="businessName" name="businessName" required />
+      </div>
+      <div className="space-y-2">
+        <Label htmlFor="email">Email</Label>
+        <Input id="email" name="email" type="email" required />
+      </div>
+      <div className="space-y-2">
+        <Label htmlFor="password">Password</Label>
+        <Input id="password" name="password" type="password" minLength={12} required />
+      </div>
+      {error && <p className="text-sm text-red-600">{error}</p>}
+      <Button type="submit" disabled={pending} className="w-full">
+        {pending ? "Creating account…" : "Create account"}
+      </Button>
+    </form>
+  );
+}
+```
+
+- [ ] **Step 5: Implement the verify-email page**
+
+Create `app/(public)/verify-email/page.tsx`:
+
+```tsx
+import { prisma } from "@/lib/prisma";
+import { redirect } from "next/navigation";
+
+export default async function VerifyEmailPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ token?: string }>;
+}) {
+  const { token } = await searchParams;
+
+  if (!token) {
+    return (
+      <div className="mx-auto max-w-sm space-y-4 py-16 text-center">
+        <h1 className="text-2xl font-semibold">Check your email</h1>
+        <p className="text-sm text-muted-foreground">
+          We sent you a verification link. Click it to activate your account.
+        </p>
+      </div>
+    );
+  }
+
+  const record = await prisma.verificationToken.findFirst({
+    where: { token, expires: { gt: new Date() } },
+  });
+
+  if (!record) {
+    return (
+      <div className="mx-auto max-w-sm space-y-4 py-16 text-center">
+        <h1 className="text-2xl font-semibold">Link expired</h1>
+        <p className="text-sm text-muted-foreground">
+          This verification link is invalid or has expired.
+        </p>
+      </div>
+    );
+  }
+
+  await prisma.$transaction([
+    prisma.user.update({
+      where: { email: record.identifier },
+      data: { emailVerified: new Date() },
+    }),
+    prisma.verificationToken.delete({
+      where: { identifier_token: { identifier: record.identifier, token: record.token } },
+    }),
+  ]);
+
+  redirect("/login?verified=1");
+}
+```
+
+- [ ] **Step 6: Run test to verify it passes**
+
+Run: `pnpm test -- register-action.test`
+Expected: PASS
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: registration flow + email verification"
+```
+
+---
+
+## Task 11: Login flow (custom Server Action creating DB session) + logout route
+
+**Files:**
+- Create: `app/(public)/login/page.tsx`, `app/(public)/login/actions.ts`, `app/api/logout/route.ts`
+- Test: `tests/unit/login-action.test.ts`
+
+**Interfaces:**
+- Consumes: `loginSchema`/`parseBody` (Task 4), `verifyPassword` (Task 3), `createDatabaseSession`/`getSessionCookieName`/`deleteDatabaseSession` (Task 9), `assertSameOrigin` (Task 7)
+- Produces: `loginAction(formData: FormData): Promise<{ error?: string }>` — sets the session cookie as a side effect via `next/headers`'s `cookies()`.
+
+- [ ] **Step 1: Write the failing unit test**
+
+Create `tests/unit/login-action.test.ts`:
+
+```typescript
+import { describe, it, expect, afterAll, vi } from "vitest";
+import { prisma } from "@/lib/prisma";
+import { hashPassword } from "@/lib/password";
+
+const setCookieMock = vi.fn();
+vi.mock("next/headers", () => ({
+  cookies: vi.fn().mockResolvedValue({ set: setCookieMock }),
+}));
+
+import { loginAction } from "@/app/(public)/login/actions";
+
+describe("loginAction", () => {
+  afterAll(async () => {
+    await prisma.$disconnect();
+  });
+
+  it("creates a database session and sets the session cookie for a verified user", async () => {
+    const email = `login-${Date.now()}@example.com`;
+    const passwordHash = await hashPassword("correct horse battery staple");
+    const business = await prisma.business.create({
+      data: { name: "Acme HVAC", timezone: "America/Chicago" },
+    });
+    const user = await prisma.user.create({
+      data: { email, passwordHash, emailVerified: new Date() },
+    });
+    await prisma.membership.create({
+      data: { userId: user.id, businessId: business.id, role: "OWNER" },
+    });
+
+    const formData = new FormData();
+    formData.set("email", email);
+    formData.set("password", "correct horse battery staple");
+
+    const result = await loginAction(formData);
+    expect(result.error).toBeUndefined();
+    expect(setCookieMock).toHaveBeenCalledTimes(1);
+
+    const session = await prisma.session.findFirst({ where: { userId: user.id } });
+    expect(session).not.toBeNull();
+    expect(session?.activeBusinessId).toBe(business.id);
+  });
+
+  it("rejects an incorrect password without revealing whether the email exists", async () => {
+    const email = `login-wrong-${Date.now()}@example.com`;
+    const passwordHash = await hashPassword("correct horse battery staple");
+    await prisma.user.create({ data: { email, passwordHash, emailVerified: new Date() } });
+
+    const formData = new FormData();
+    formData.set("email", email);
+    formData.set("password", "totally wrong password");
+
+    const result = await loginAction(formData);
+    expect(result.error).toBe("Invalid email or password");
+  });
+
+  it("rejects login for an email that does not exist with the same generic message", async () => {
+    const formData = new FormData();
+    formData.set("email", "nobody@example.com");
+    formData.set("password", "whatever password");
+
+    const result = await loginAction(formData);
+    expect(result.error).toBe("Invalid email or password");
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `pnpm test -- login-action.test`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement the login Server Action**
+
+Create `app/(public)/login/actions.ts`:
+
+```typescript
+"use server";
+
+import { cookies } from "next/headers";
+import { prisma } from "@/lib/prisma";
+import { verifyPassword } from "@/lib/password";
+import { parseBody } from "@/lib/validation/parse";
+import { loginSchema } from "@/lib/validation/auth.schema";
+import { createDatabaseSession, getSessionCookieName } from "@/lib/session";
+import { captureServerError } from "@/lib/sentry";
+import logger from "@/lib/logger";
+
+const GENERIC_ERROR = "Invalid email or password";
+
+export async function loginAction(formData: FormData): Promise<{ error?: string }> {
+  const parsed = parseBody(loginSchema, {
+    email: formData.get("email"),
+    password: formData.get("password"),
+  });
+
+  if (!parsed.success) {
+    return { error: GENERIC_ERROR };
+  }
+
+  const { email, password } = parsed.data;
+
+  try {
+    const user = await prisma.user.findUnique({
+      where: { email },
+      include: { memberships: true },
+    });
+
+    if (!user) {
+      return { error: GENERIC_ERROR };
+    }
+
+    const valid = await verifyPassword(password, user.passwordHash);
+    if (!valid) {
+      return { error: GENERIC_ERROR };
+    }
+
+    const firstMembership = user.memberships[0];
+    if (!firstMembership) {
+      return { error: "No business is associated with this account" };
+    }
+
+    const { sessionToken, expires } = await createDatabaseSession(
+      user.id,
+      firstMembership.businessId
+    );
+
+    const cookieStore = await cookies();
+    cookieStore.set(getSessionCookieName(), sessionToken, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      expires,
+      path: "/",
+    });
+
+    logger.info({ userId: user.id }, "user logged in");
+    return {};
+  } catch (err) {
+    captureServerError(err, { where: "loginAction", email });
+    return { error: "Something went wrong. Please try again." };
+  }
+}
+```
+
+- [ ] **Step 4: Implement the login page**
+
+Create `app/(public)/login/page.tsx`:
+
+```tsx
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import { loginAction } from "./actions";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+
+export default function LoginPage() {
+  const router = useRouter();
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState(false);
+
+  async function handleSubmit(formData: FormData) {
+    setPending(true);
+    setError(null);
+    const result = await loginAction(formData);
+    setPending(false);
+    if (result.error) {
+      setError(result.error);
+      return;
+    }
+    router.push("/dashboard");
+  }
+
+  return (
+    <form action={handleSubmit} className="mx-auto max-w-sm space-y-4 py-16">
+      <h1 className="text-2xl font-semibold">Log in</h1>
+      <div className="space-y-2">
+        <Label htmlFor="email">Email</Label>
+        <Input id="email" name="email" type="email" required />
+      </div>
+      <div className="space-y-2">
+        <Label htmlFor="password">Password</Label>
+        <Input id="password" name="password" type="password" required />
+      </div>
+      {error && <p className="text-sm text-red-600">{error}</p>}
+      <Button type="submit" disabled={pending} className="w-full">
+        {pending ? "Logging in…" : "Log in"}
+      </Button>
+    </form>
+  );
+}
+```
+
+- [ ] **Step 5: Implement the logout route**
+
+Create `app/api/logout/route.ts`:
+
+```typescript
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import { assertSameOrigin, CsrfError } from "@/lib/csrf";
+import { deleteDatabaseSession, getSessionCookieName } from "@/lib/session";
+
+export async function POST(request: Request): Promise<NextResponse> {
+  try {
+    assertSameOrigin(request.headers);
+  } catch (err) {
+    if (err instanceof CsrfError) {
+      return NextResponse.json({ error: err.message }, { status: 403 });
+    }
+    throw err;
+  }
+
+  const cookieStore = await cookies();
+  const cookieName = getSessionCookieName();
+  const sessionToken = cookieStore.get(cookieName)?.value;
+
+  if (sessionToken) {
+    await deleteDatabaseSession(sessionToken);
+  }
+
+  cookieStore.delete(cookieName);
+  return NextResponse.json({ success: true });
+}
+```
+
+- [ ] **Step 6: Run test to verify it passes**
+
+Run: `pnpm test -- login-action.test`
+Expected: PASS
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: login flow with direct DB session creation + logout route"
+```
+
+---
+
+## Task 12: Password reset flow
+
+**Files:**
+- Create: `app/(public)/reset-password/page.tsx`, `app/(public)/reset-password/actions.ts`
+- Test: `tests/unit/reset-password-action.test.ts`
+
+**Interfaces:**
+- Consumes: `requestPasswordResetSchema`/`resetPasswordSchema`/`parseBody` (Task 4), `sendPasswordResetEmail` (Task 8), `hashPassword` (Task 3), `prisma` (Task 2)
+- Produces: `requestPasswordResetAction(formData): Promise<{ message: string }>`, `resetPasswordAction(formData): Promise<{ error?: string }>`.
+
+- [ ] **Step 1: Write the failing unit test**
+
+Create `tests/unit/reset-password-action.test.ts`:
+
+```typescript
+import { describe, it, expect, afterAll, vi } from "vitest";
+import { createHash, randomBytes } from "crypto";
+import { prisma } from "@/lib/prisma";
+import { hashPassword, verifyPassword } from "@/lib/password";
+
+vi.mock("@/lib/resend", () => ({
+  sendPasswordResetEmail: vi.fn().mockResolvedValue(undefined),
+}));
+
+import {
+  requestPasswordResetAction,
+  resetPasswordAction,
+} from "@/app/(public)/reset-password/actions";
+import { sendPasswordResetEmail } from "@/lib/resend";
+
+describe("password reset flow", () => {
+  afterAll(async () => {
+    await prisma.$disconnect();
+  });
+
+  it("creates a single-use token and emails it on request", async () => {
+    const email = `reset-${Date.now()}@example.com`;
+    await prisma.user.create({
+      data: { email, passwordHash: await hashPassword("original password value") },
+    });
+
+    const formData = new FormData();
+    formData.set("email", email);
+    await requestPasswordResetAction(formData);
+
+    expect(sendPasswordResetEmail).toHaveBeenCalledWith(email, expect.any(String));
+  });
+
+  it("does not reveal whether an email exists", async () => {
+    const formData = new FormData();
+    formData.set("email", "nobody-here@example.com");
+    const result = await requestPasswordResetAction(formData);
+    expect(result.message).toMatch(/if an account exists/i);
+  });
+
+  it("resets the password with a valid token and invalidates it after use", async () => {
+    const email = `reset2-${Date.now()}@example.com`;
+    const user = await prisma.user.create({
+      data: { email, passwordHash: await hashPassword("original password value") },
+    });
+
+    const rawToken = randomBytes(32).toString("hex");
+    const tokenHash = createHash("sha256").update(rawToken).digest("hex");
+    await prisma.passwordResetToken.create({
+      data: {
+        userId: user.id,
+        tokenHash,
+        expires: new Date(Date.now() + 60 * 60 * 1000),
+      },
+    });
+
+    const formData = new FormData();
+    formData.set("token", rawToken);
+    formData.set("password", "brand new password value");
+    const result = await resetPasswordAction(formData);
+    expect(result.error).toBeUndefined();
+
+    const updated = await prisma.user.findUnique({ where: { id: user.id } });
+    expect(await verifyPassword("brand new password value", updated!.passwordHash)).toBe(true);
+
+    const secondAttempt = new FormData();
+    secondAttempt.set("token", rawToken);
+    secondAttempt.set("password", "another password value");
+    const secondResult = await resetPasswordAction(secondAttempt);
+    expect(secondResult.error).toBeDefined();
+  });
+
+  it("rejects an expired token", async () => {
+    const email = `reset3-${Date.now()}@example.com`;
+    const user = await prisma.user.create({
+      data: { email, passwordHash: await hashPassword("original password value") },
+    });
+    const rawToken = randomBytes(32).toString("hex");
+    const tokenHash = createHash("sha256").update(rawToken).digest("hex");
+    await prisma.passwordResetToken.create({
+      data: {
+        userId: user.id,
+        tokenHash,
+        expires: new Date(Date.now() - 1000),
+      },
+    });
+
+    const formData = new FormData();
+    formData.set("token", rawToken);
+    formData.set("password", "yet another password");
+    const result = await resetPasswordAction(formData);
+    expect(result.error).toBeDefined();
+  });
+
+  it("invalidates all existing sessions for the user on successful reset", async () => {
+    const email = `reset4-${Date.now()}@example.com`;
+    const user = await prisma.user.create({
+      data: { email, passwordHash: await hashPassword("original password value") },
+    });
+    await prisma.session.create({
+      data: {
+        sessionToken: randomBytes(16).toString("hex"),
+        userId: user.id,
+        expires: new Date(Date.now() + 1000 * 60 * 60),
+      },
+    });
+
+    const rawToken = randomBytes(32).toString("hex");
+    const tokenHash = createHash("sha256").update(rawToken).digest("hex");
+    await prisma.passwordResetToken.create({
+      data: { userId: user.id, tokenHash, expires: new Date(Date.now() + 60 * 60 * 1000) },
+    });
+
+    const formData = new FormData();
+    formData.set("token", rawToken);
+    formData.set("password", "final password value here");
+    await resetPasswordAction(formData);
+
+    const remainingSessions = await prisma.session.findMany({ where: { userId: user.id } });
+    expect(remainingSessions).toHaveLength(0);
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `pnpm test -- reset-password-action.test`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement the actions**
+
+Create `app/(public)/reset-password/actions.ts`:
+
+```typescript
+"use server";
+
+import { createHash, randomBytes } from "crypto";
+import { prisma } from "@/lib/prisma";
+import { hashPassword } from "@/lib/password";
+import { parseBody } from "@/lib/validation/parse";
+import { requestPasswordResetSchema, resetPasswordSchema } from "@/lib/validation/auth.schema";
+import { sendPasswordResetEmail } from "@/lib/resend";
+import { captureServerError } from "@/lib/sentry";
+import logger from "@/lib/logger";
+
+const GENERIC_MESSAGE = "If an account exists for that email, a reset link has been sent.";
+
+export async function requestPasswordResetAction(
+  formData: FormData
+): Promise<{ message: string }> {
+  const parsed = parseBody(requestPasswordResetSchema, { email: formData.get("email") });
+  if (!parsed.success) {
+    return { message: GENERIC_MESSAGE };
+  }
+
+  const user = await prisma.user.findUnique({ where: { email: parsed.data.email } });
+  if (!user) {
+    return { message: GENERIC_MESSAGE };
+  }
+
+  const rawToken = randomBytes(32).toString("hex");
+  const tokenHash = createHash("sha256").update(rawToken).digest("hex");
+
+  try {
+    await prisma.passwordResetToken.create({
+      data: {
+        userId: user.id,
+        tokenHash,
+        expires: new Date(Date.now() + 60 * 60 * 1000),
+      },
+    });
+    await sendPasswordResetEmail(user.email, rawToken);
+  } catch (err) {
+    captureServerError(err, { where: "requestPasswordResetAction", userId: user.id });
+  }
+
+  return { message: GENERIC_MESSAGE };
+}
+
+export async function resetPasswordAction(formData: FormData): Promise<{ error?: string }> {
+  const parsed = parseBody(resetPasswordSchema, {
+    token: formData.get("token"),
+    password: formData.get("password"),
+  });
+  if (!parsed.success) {
+    return { error: parsed.issues[0]?.message ?? "Invalid input" };
+  }
+
+  const { token, password } = parsed.data;
+  const tokenHash = createHash("sha256").update(token).digest("hex");
+
+  const record = await prisma.passwordResetToken.findUnique({ where: { tokenHash } });
+  if (!record || record.usedAt || record.expires < new Date()) {
+    return { error: "This reset link is invalid or has expired." };
+  }
+
+  const passwordHash = await hashPassword(password);
+
+  try {
+    await prisma.$transaction([
+      prisma.user.update({ where: { id: record.userId }, data: { passwordHash } }),
+      prisma.passwordResetToken.update({
+        where: { tokenHash },
+        data: { usedAt: new Date() },
+      }),
+      prisma.session.deleteMany({ where: { userId: record.userId } }),
+    ]);
+    logger.info({ userId: record.userId }, "password reset completed");
+    return {};
+  } catch (err) {
+    captureServerError(err, { where: "resetPasswordAction", userId: record.userId });
+    return { error: "Something went wrong. Please try again." };
+  }
+}
+```
+
+- [ ] **Step 4: Implement the reset-password page**
+
+Create `app/(public)/reset-password/page.tsx`:
+
+```tsx
+"use client";
+
+import { useState } from "react";
+import { useSearchParams, useRouter } from "next/navigation";
+import { requestPasswordResetAction, resetPasswordAction } from "./actions";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+
+export default function ResetPasswordPage() {
+  const searchParams = useSearchParams();
+  const token = searchParams.get("token");
+  const router = useRouter();
+  const [message, setMessage] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState(false);
+
+  if (!token) {
+    async function handleRequest(formData: FormData) {
+      setPending(true);
+      const result = await requestPasswordResetAction(formData);
+      setPending(false);
+      setMessage(result.message);
+    }
+
+    return (
+      <form action={handleRequest} className="mx-auto max-w-sm space-y-4 py-16">
+        <h1 className="text-2xl font-semibold">Reset your password</h1>
+        <div className="space-y-2">
+          <Label htmlFor="email">Email</Label>
+          <Input id="email" name="email" type="email" required />
+        </div>
+        {message && <p className="text-sm text-muted-foreground">{message}</p>}
+        <Button type="submit" disabled={pending} className="w-full">
+          {pending ? "Sending…" : "Send reset link"}
+        </Button>
+      </form>
+    );
+  }
+
+  async function handleReset(formData: FormData) {
+    setPending(true);
+    setError(null);
+    formData.set("token", token as string);
+    const result = await resetPasswordAction(formData);
+    setPending(false);
+    if (result.error) {
+      setError(result.error);
+      return;
+    }
+    router.push("/login?reset=1");
+  }
+
+  return (
+    <form action={handleReset} className="mx-auto max-w-sm space-y-4 py-16">
+      <h1 className="text-2xl font-semibold">Choose a new password</h1>
+      <div className="space-y-2">
+        <Label htmlFor="password">New password</Label>
+        <Input id="password" name="password" type="password" minLength={12} required />
+      </div>
+      {error && <p className="text-sm text-red-600">{error}</p>}
+      <Button type="submit" disabled={pending} className="w-full">
+        {pending ? "Resetting…" : "Reset password"}
+      </Button>
+    </form>
+  );
+}
+```
+
+- [ ] **Step 5: Run test to verify it passes**
+
+Run: `pnpm test -- reset-password-action.test`
+Expected: PASS
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: password reset flow with single-use tokens and session invalidation"
+```
+
+---
+
+## Task 13: UI shell — (app) authed layout, verify-email banner, dashboard placeholder
+
+**Files:**
+- Create: `app/(app)/layout.tsx`, `app/(app)/dashboard/page.tsx`, `components/verify-email-banner.tsx`
+- Delete: `app/page.tsx` (Task 1's temporary homepage — must be deleted in this same commit; both `app/page.tsx` and `app/(public)/page.tsx` resolve to `/` and would conflict)
+- Test: `tests/component/verify-email-banner.test.tsx`
+
+**Interfaces:**
+- Consumes: `getSessionContext` (Task 9), `prisma` (Task 2) for reading `emailVerified`
+- Produces: the `(app)` route group used by every future authed page (Phase 2+).
+
+- [ ] **Step 1: Write the failing component test**
+
+Create `tests/component/verify-email-banner.test.tsx`:
+
+```tsx
+import { describe, it, expect } from "vitest";
+import { render, screen } from "@testing-library/react";
+import { VerifyEmailBanner } from "@/components/verify-email-banner";
+
+describe("VerifyEmailBanner", () => {
+  it("renders a warning when the email is not verified", () => {
+    render(<VerifyEmailBanner verified={false} />);
+    expect(screen.getByText(/verify your email/i)).toBeInTheDocument();
+  });
+
+  it("renders nothing when the email is verified", () => {
+    const { container } = render(<VerifyEmailBanner verified={true} />);
+    expect(container).toBeEmptyDOMElement();
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `pnpm test -- verify-email-banner.test`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement the banner component**
+
+Create `components/verify-email-banner.tsx`:
+
+```tsx
+export function VerifyEmailBanner({ verified }: { verified: boolean }) {
+  if (verified) return null;
+
+  return (
+    <div className="border-b border-yellow-300 bg-yellow-50 px-4 py-2 text-sm text-yellow-900">
+      Please verify your email to unlock full access. Check your inbox for the verification link.
+    </div>
+  );
+}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `pnpm test -- verify-email-banner.test`
+Expected: PASS
+
+- [ ] **Step 5: Implement the authed layout**
+
+Create `app/(app)/layout.tsx`:
+
+```tsx
+import { redirect } from "next/navigation";
+import { getSessionContext } from "@/lib/session";
+import { prisma } from "@/lib/prisma";
+import { VerifyEmailBanner } from "@/components/verify-email-banner";
+
+export default async function AppLayout({ children }: { children: React.ReactNode }) {
+  const ctx = await getSessionContext();
+  if (!ctx) {
+    redirect("/login");
+  }
+
+  const user = await prisma.user.findUnique({ where: { id: ctx.userId } });
+
+  return (
+    <div className="min-h-screen">
+      <VerifyEmailBanner verified={!!user?.emailVerified} />
+      <div className="flex">
+        <aside className="w-56 border-r p-4">
+          <p className="font-semibold">CustomerETA</p>
+        </aside>
+        <main className="flex-1 p-6">{children}</main>
+      </div>
+    </div>
+  );
+}
+```
+
+- [ ] **Step 6: Implement the dashboard placeholder**
+
+Create `app/(app)/dashboard/page.tsx` (lives at `/dashboard`, not `/` — see the route-group note above):
+
+```tsx
+export default function DashboardPage() {
+  return (
+    <div>
+      <h1 className="text-2xl font-semibold">Dashboard</h1>
+      <p className="text-muted-foreground">Nothing here yet — Phase 2 adds customers and appointments.</p>
+    </div>
+  );
+}
+```
+
+- [ ] **Step 7: Implement the public layout and marketing placeholder**
+
+Create `app/(public)/layout.tsx`:
+
+```tsx
+import Link from "next/link";
+
+export default function PublicLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <div className="min-h-screen">
+      <header className="flex items-center justify-between border-b p-4">
+        <Link href="/" className="font-semibold">CustomerETA</Link>
+        <nav className="space-x-4 text-sm">
+          <Link href="/login">Log in</Link>
+          <Link href="/signup">Sign up</Link>
+        </nav>
+      </header>
+      {children}
+    </div>
+  );
+}
+```
+
+Create `app/(public)/page.tsx`:
+
+```tsx
+export default function HomePage() {
+  return (
+    <div className="mx-auto max-w-2xl px-4 py-24 text-center">
+      <h1 className="text-4xl font-bold">Connect your schedule and automatically keep customers informed through text and email.</h1>
+    </div>
+  );
+}
+```
+
+**Delete `app/page.tsx`** (Task 1's placeholder) now — `git rm app/page.tsx`. With both `app/page.tsx` and `app/(public)/page.tsx` present, Next.js errors at build time on the duplicate `/` route, so this delete must land in the same commit as the `(public)/page.tsx` create.
+
+- [ ] **Step 8: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: UI shell (public + authed route groups, verify-email banner)"
+```
+
+---
+
+## Task 14: Redis + BullMQ smoke-test job
+
+**Files:**
+- Create: `lib/redis.ts`, `lib/queue.ts`
+- Test: `tests/unit/queue.test.ts`
+
+**Interfaces:**
+- Consumes: `REDIS_URL` env var
+- Produces: `redis: Redis`, `smokeQueue: Queue`, `SMOKE_JOB_NAME` — proves the queue infra works; Phase 3 adds real notification queues alongside this pattern.
+
+- [ ] **Step 1: Install BullMQ + ioredis**
+
+Run: `pnpm add bullmq ioredis`
+
+- [ ] **Step 2: Write the failing test**
+
+Create `tests/unit/queue.test.ts`:
+
+```typescript
+import { describe, it, expect, afterAll } from "vitest";
+import { Worker } from "bullmq";
+import { redis } from "@/lib/redis";
+import { smokeQueue, SMOKE_JOB_NAME } from "@/lib/queue";
+
+describe("BullMQ smoke test", () => {
+  afterAll(async () => {
+    await smokeQueue.close();
+    await redis.quit();
+  });
+
+  it("enqueues and processes a smoke-test job", async () => {
+    const worker = new Worker(
+      smokeQueue.name,
+      async (job) => {
+        return { received: job.data };
+      },
+      { connection: redis.duplicate() }
+    );
+
+    const job = await smokeQueue.add(SMOKE_JOB_NAME, { ping: "pong" }, {
+      jobId: "smoke-test:phase1",
+    });
+
+    const result = await job.waitUntilFinished(
+      new (await import("bullmq")).QueueEvents(smokeQueue.name, { connection: redis.duplicate() })
+    );
+
+    expect(result).toEqual({ received: { ping: "pong" } });
+    await worker.close();
+  }, 15000);
+});
+```
+
+- [ ] **Step 3: Run test to verify it fails**
+
+Run: `pnpm test -- queue.test`
+Expected: FAIL — modules not found. Requires Redis reachable locally:
+```bash
+docker run -d --name customereta-redis -p 6379:6379 redis:7
+```
+Set `.env.local`: `REDIS_URL="redis://localhost:6379"`
+
+- [ ] **Step 4: Implement lib/redis.ts**
+
+Create `lib/redis.ts`:
+
+```typescript
+import Redis from "ioredis";
+
+const globalForRedis = globalThis as unknown as { redis?: Redis };
+
+export const redis =
+  globalForRedis.redis ?? new Redis(process.env.REDIS_URL as string, {
+    maxRetriesPerRequest: null,
+  });
+
+if (process.env.NODE_ENV !== "production") {
+  globalForRedis.redis = redis;
+}
+```
+
+- [ ] **Step 5: Implement lib/queue.ts**
+
+Create `lib/queue.ts`:
+
+```typescript
+import { Queue } from "bullmq";
+import { redis } from "@/lib/redis";
+
+export const SMOKE_JOB_NAME = "smoke-test";
+
+export const smokeQueue = new Queue("phase1-smoke", {
+  connection: redis.duplicate(),
+});
+```
+
+- [ ] **Step 6: Run test to verify it passes**
+
+Run: `pnpm test -- queue.test`
+Expected: PASS
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: Redis + BullMQ wiring with smoke-test job"
+```
+
+---
+
+## Task 15: /health endpoint
+
+**Files:**
+- Create: `app/api/health/route.ts`
+- Test: `tests/unit/health-route.test.ts`
+
+**Interfaces:**
+- Consumes: `prisma` (Task 2), `redis` (Task 14)
+- Produces: `GET /health` — 200 with `{status: "ok", checks: {...}}` if both DB and Redis are reachable, 503 with which check failed otherwise. Railway's healthcheck (Task 17) points here.
+
+- [ ] **Step 1: Write the failing test**
+
+Create `tests/unit/health-route.test.ts`:
+
+```typescript
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { prisma } from "@/lib/prisma";
+import { redis } from "@/lib/redis";
+import { GET } from "@/app/api/health/route";
+
+describe("GET /health", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("returns 200 when DB and Redis are both reachable", async () => {
+    const response = await GET();
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.status).toBe("ok");
+  });
+
+  it("returns 503 when the database check fails", async () => {
+    vi.spyOn(prisma, "$queryRaw").mockRejectedValueOnce(new Error("db down"));
+    const response = await GET();
+    expect(response.status).toBe(503);
+    const body = await response.json();
+    expect(body.checks.database).toBe(false);
+  });
+
+  it("returns 503 when the redis check fails", async () => {
+    vi.spyOn(redis, "ping").mockRejectedValueOnce(new Error("redis down"));
+    const response = await GET();
+    expect(response.status).toBe(503);
+    const body = await response.json();
+    expect(body.checks.redis).toBe(false);
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `pnpm test -- health-route.test`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement**
+
+Create `app/api/health/route.ts`:
+
+```typescript
+import { NextResponse } from "next/server";
+import { prisma } from "@/lib/prisma";
+import { redis } from "@/lib/redis";
+import { captureServerError } from "@/lib/sentry";
+
+export async function GET(): Promise<NextResponse> {
+  const checks = { database: false, redis: false };
+
+  try {
+    await prisma.$queryRaw`SELECT 1`;
+    checks.database = true;
+  } catch (err) {
+    captureServerError(err, { where: "health:database" });
+  }
+
+  try {
+    await redis.ping();
+    checks.redis = true;
+  } catch (err) {
+    captureServerError(err, { where: "health:redis" });
+  }
+
+  const healthy = checks.database && checks.redis;
+
+  return NextResponse.json(
+    { status: healthy ? "ok" : "unhealthy", checks },
+    { status: healthy ? 200 : 503 }
+  );
+}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `pnpm test -- health-route.test`
+Expected: PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: /health endpoint (DB + Redis, fail-loud 503)"
+```
+
+---
+
+## Task 16: Component tests for signup/login/reset-password forms
+
+**Files:**
+- Create: `tests/component/login-form.test.tsx`, `tests/component/signup-form.test.tsx`, `tests/component/reset-password-form.test.tsx`
+
+**Interfaces:**
+- Consumes: `LoginPage` (Task 11), `SignupPage` (Task 10), `ResetPasswordPage` (Task 12)
+- Produces: nothing new — closes out the "component" leg of the spec's testing plan.
+
+- [ ] **Step 1: Write and run the login form test**
+
+Create `tests/component/login-form.test.tsx`:
+
+```tsx
+import { describe, it, expect, vi } from "vitest";
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: vi.fn(), refresh: vi.fn() }),
+}));
+
+vi.mock("@/app/(public)/login/actions", () => ({
+  loginAction: vi.fn().mockResolvedValue({ error: "Invalid email or password" }),
+}));
+
+import LoginPage from "@/app/(public)/login/page";
+
+describe("LoginPage", () => {
+  it("shows a validation-style error returned from the action", async () => {
+    render(<LoginPage />);
+    const user = userEvent.setup();
+
+    await user.type(screen.getByLabelText(/email/i), "owner@example.com");
+    await user.type(screen.getByLabelText(/password/i), "wrong password");
+    await user.click(screen.getByRole("button", { name: /log in/i }));
+
+    expect(await screen.findByText(/invalid email or password/i)).toBeInTheDocument();
+  });
+});
+```
+
+Run: `pnpm test -- login-form.test`
+Expected: PASS
+
+- [ ] **Step 2: Write and run the signup form test**
+
+Create `tests/component/signup-form.test.tsx`:
+
+```tsx
+import { describe, it, expect, vi } from "vitest";
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: vi.fn() }),
+}));
+
+vi.mock("@/app/(public)/signup/actions", () => ({
+  registerAction: vi.fn().mockResolvedValue({ error: "Unable to create account with these details" }),
+}));
+
+import SignupPage from "@/app/(public)/signup/page";
+
+describe("SignupPage", () => {
+  it("shows an error returned from the action", async () => {
+    render(<SignupPage />);
+    const user = userEvent.setup();
+
+    await user.type(screen.getByLabelText(/business name/i), "Acme HVAC");
+    await user.type(screen.getByLabelText(/email/i), "dup@example.com");
+    await user.type(screen.getByLabelText(/password/i), "correct horse battery staple");
+    await user.click(screen.getByRole("button", { name: /create account/i }));
+
+    expect(await screen.findByText(/unable to create account/i)).toBeInTheDocument();
+  });
+});
+```
+
+Run: `pnpm test -- signup-form.test`
+Expected: PASS
+
+- [ ] **Step 3: Write and run the reset-password form test**
+
+Create `tests/component/reset-password-form.test.tsx`:
+
+```tsx
+import { describe, it, expect, vi } from "vitest";
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+
+vi.mock("next/navigation", () => ({
+  useSearchParams: () => new URLSearchParams(),
+  useRouter: () => ({ push: vi.fn() }),
+}));
+
+vi.mock("@/app/(public)/reset-password/actions", () => ({
+  requestPasswordResetAction: vi
+    .fn()
+    .mockResolvedValue({ message: "If an account exists for that email, a reset link has been sent." }),
+  resetPasswordAction: vi.fn(),
+}));
+
+import ResetPasswordPage from "@/app/(public)/reset-password/page";
+
+describe("ResetPasswordPage (request mode)", () => {
+  it("shows the generic confirmation message after requesting a reset", async () => {
+    render(<ResetPasswordPage />);
+    const user = userEvent.setup();
+
+    await user.type(screen.getByLabelText(/email/i), "owner@example.com");
+    await user.click(screen.getByRole("button", { name: /send reset link/i }));
+
+    expect(await screen.findByText(/if an account exists/i)).toBeInTheDocument();
+  });
+});
+```
+
+Run: `pnpm test -- reset-password-form.test`
+Expected: PASS
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: component tests for auth forms"
+```
+
+---
+
+## Task 17: Playwright E2E setup + auth flow test
+
+**Files:**
+- Create: `playwright.config.ts`, `tests/e2e/auth-flows.spec.ts`, `app/api/__dev/last-email/route.ts`
+- Modify: none (`lib/resend.ts` already ships with `__capturedEmails`/`CAPTURE_EMAILS`/`MOCK_EMAIL_SEND` gating from Task 8)
+
+**Interfaces:**
+- Consumes: the full auth stack from Tasks 10–12, plus a running server
+- Produces: `pnpm test:e2e` — the spec's required E2E coverage (signup → verify → login → authed shell; wrong password rejected; password-reset round trip).
+
+- [ ] **Step 1: Install Playwright**
+
+Run: `pnpm dlx playwright install --with-deps chromium && pnpm add -D @playwright/test`
+
+- [ ] **Step 2: Configure Playwright**
+
+Create `playwright.config.ts`. The webServer runs a production build (`pnpm build && pnpm start`, `NODE_ENV=production`) — which is exactly why `lib/resend.ts`'s capture gate is `CAPTURE_EMAILS=1` (an explicit flag) rather than `NODE_ENV !== "production"`: a NODE_ENV-based gate would disable capture under the production build Playwright uses. `MOCK_EMAIL_SEND=1` skips the real Resend call so E2E runs without a configured Resend sending domain; `DATABASE_URL`/`REDIS_URL` are read from the shell environment that launches `pnpm test:e2e`.
+
+```typescript
+import { defineConfig } from "@playwright/test";
+
+export default defineConfig({
+  testDir: "./tests/e2e",
+  fullyParallel: false,
+  retries: 0,
+  use: {
+    baseURL: process.env.APP_URL ?? "http://localhost:3000",
+    trace: "retain-on-failure",
+  },
+  webServer: {
+    command: "pnpm build && pnpm start",
+    url: "http://localhost:3000",
+    reuseExistingServer: !process.env.CI,
+    timeout: 120_000,
+    env: {
+      CAPTURE_EMAILS: "1",
+      MOCK_EMAIL_SEND: "1",
+      APP_URL: "http://localhost:3000",
+      AUTH_SECRET: process.env.AUTH_SECRET ?? "e2e-test-secret-not-for-production",
+      RESEND_FROM_EMAIL: "no-reply@customereta.com",
+    },
+  },
+});
+```
+
+- [ ] **Step 3: Add the dev/test-only last-email route**
+
+Playwright runs against a real server process, not in-process, so it can't read the in-memory `__capturedEmails` array directly. Expose a tiny route that returns the last captured link for a given recipient. It 404s unless `CAPTURE_EMAILS=1`, so it is inert in production (production never sets that flag). Create `app/api/__dev/last-email/route.ts`:
+
+```typescript
+import { NextResponse } from "next/server";
+import { __capturedEmails } from "@/lib/resend";
+
+export async function GET(request: Request): Promise<NextResponse> {
+  if (process.env.CAPTURE_EMAILS !== "1") {
+    return NextResponse.json({ error: "not found" }, { status: 404 });
+  }
+  const url = new URL(request.url);
+  const to = url.searchParams.get("to");
+  const match = [...__capturedEmails].reverse().find((e) => e.to === to);
+  return NextResponse.json({ link: match?.link ?? null });
+}
+```
+
+This is dev/test-only tooling, not a shipped user surface. With `MOCK_EMAIL_SEND=1` the real Resend API is never called during E2E; in production neither flag is set, so the route 404s and real emails send normally.
+
+- [ ] **Step 4: Write the E2E spec**
+
+Create `tests/e2e/auth-flows.spec.ts`:
+
+```typescript
+import { test, expect } from "@playwright/test";
+
+function uniqueEmail(prefix: string) {
+  return `${prefix}-${Date.now()}@example.com`;
+}
+
+test("signup -> verify email -> login -> authed shell", async ({ page, request }) => {
+  const email = uniqueEmail("e2e-signup");
+
+  await page.goto("/signup");
+  await page.getByLabel(/business name/i).fill("Acme HVAC");
+  await page.getByLabel(/email/i).fill(email);
+  await page.getByLabel(/password/i).fill("correct horse battery staple");
+  await page.getByRole("button", { name: /create account/i }).click();
+
+  await expect(page).toHaveURL(/verify-email/);
+
+  const emailResponse = await request.get(`/api/__dev/last-email?to=${encodeURIComponent(email)}`);
+  const { link } = await emailResponse.json();
+  expect(link).toBeTruthy();
+
+  await page.goto(link);
+  await expect(page).toHaveURL(/login\?verified=1/);
+
+  await page.getByLabel(/email/i).fill(email);
+  await page.getByLabel(/^password/i).fill("correct horse battery staple");
+  await page.getByRole("button", { name: /log in/i }).click();
+
+  await expect(page).toHaveURL(/\/dashboard/);
+  await expect(page.getByText(/dashboard/i)).toBeVisible();
+});
+
+test("login rejects an incorrect password", async ({ page }) => {
+  await page.goto("/login");
+  await page.getByLabel(/email/i).fill("nobody@example.com");
+  await page.getByLabel(/^password/i).fill("wrong password value");
+  await page.getByRole("button", { name: /log in/i }).click();
+
+  await expect(page.getByText(/invalid email or password/i)).toBeVisible();
+});
+
+test("password reset round trip", async ({ page, request }) => {
+  const email = uniqueEmail("e2e-reset");
+
+  await page.goto("/signup");
+  await page.getByLabel(/business name/i).fill("Acme HVAC");
+  await page.getByLabel(/email/i).fill(email);
+  await page.getByLabel(/password/i).fill("original password value");
+  await page.getByRole("button", { name: /create account/i }).click();
+
+  await page.goto("/reset-password");
+  await page.getByLabel(/email/i).fill(email);
+  await page.getByRole("button", { name: /send reset link/i }).click();
+  await expect(page.getByText(/if an account exists/i)).toBeVisible();
+
+  const emailResponse = await request.get(`/api/__dev/last-email?to=${encodeURIComponent(email)}`);
+  const { link } = await emailResponse.json();
+  expect(link).toBeTruthy();
+
+  await page.goto(link);
+  await page.getByLabel(/new password/i).fill("brand new password value");
+  await page.getByRole("button", { name: /reset password/i }).click();
+
+  await expect(page).toHaveURL(/login\?reset=1/);
+
+  await page.getByLabel(/email/i).fill(email);
+  await page.getByLabel(/^password/i).fill("brand new password value");
+  await page.getByRole("button", { name: /log in/i }).click();
+
+  await expect(page).toHaveURL(/\/dashboard/);
+});
+```
+
+- [ ] **Step 5: Run the E2E suite**
+
+Requires `DATABASE_URL` and `REDIS_URL` set in the shell environment (pointed at the Task 2/14 Postgres and Redis), plus `AUTH_SECRET` (any non-empty string for local). `APP_URL`, `CAPTURE_EMAILS`, and `MOCK_EMAIL_SEND` are set by the playwright.config webServer env, so no real Resend credentials are needed for E2E — `MOCK_EMAIL_SEND=1` skips the Resend call and `CAPTURE_EMAILS=1` records the link for the dev route to return.
+
+Run: `pnpm test:e2e`
+Expected: 3 passed.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: Playwright E2E setup + auth flow coverage"
+```
+
+---
+
+## Task 18: CI update — wire real lint/typecheck/test/test:e2e, add Postgres+Redis services
+
+**Files:**
+- Modify: `.github/workflows/ci.yml`
+
+**Interfaces:**
+- Consumes: nothing
+- Produces: a CI pipeline that actually runs the Phase 1 test suite (Phase 0 shipped placeholder scripts; this task makes CI enforce real lint/typecheck/unit tests against real Postgres/Redis service containers).
+
+- [ ] **Step 1: Update the workflow**
+
+Modify `.github/workflows/ci.yml` to add service containers and env vars:
+
+```yaml
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: customereta
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis:7
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/customereta?schema=public
+      REDIS_URL: redis://localhost:6379
+      AUTH_SECRET: ci-test-secret-not-for-production-use-only
+      APP_URL: http://localhost:3000
+      RESEND_API_KEY: re_ci_test_placeholder
+      RESEND_FROM_EMAIL: no-reply@customereta.com
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Generate Prisma client
+        run: pnpm dlx prisma generate
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Run migrations
+        run: pnpm dlx prisma migrate deploy
+
+      - name: Unit + component tests
+        run: pnpm test
+```
+
+Note: `test:e2e` (Playwright) is intentionally NOT added to this job — it needs a built app server and Chromium browser binaries, which is a heavier, separate concern (Resend is no longer a blocker since E2E runs with `MOCK_EMAIL_SEND=1`). Add E2E to CI as a follow-up if the team wants E2E gating PRs; for Phase 1 it's run locally/manually per the plan (todo.md doesn't require E2E in CI for Phase 1, only "Add Playwright; add a first unit test to prove the harness runs in CI").
+
+- [ ] **Step 2: Verify locally that the migrate deploy command works against a fresh DB**
+
+Run:
+```bash
+DATABASE_URL="postgresql://postgres:postgres@localhost:5432/customereta_ci_test?schema=public" pnpm dlx prisma migrate deploy
+```
+(Create the throwaway DB first via `docker exec` `createdb` if needed, or reuse the Task 2 container with a new database name.) Expected: migrations apply cleanly with no interactive prompts.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add -A
+git commit -m "Phase 1: wire CI to run real lint/typecheck/tests against Postgres+Redis services"
+```
+
+---
+
+## Task 19: Railway provisioning + first staging deploy
+
+**Files:**
+- Create: `railway.toml`
+- Modify: none (env vars set via Railway MCP/dashboard, not committed)
+
+**Interfaces:**
+- Consumes: the fully working app from Tasks 1–18
+- Produces: a live Railway staging deployment with `/health` green — closes Phase 1's Definition of Done.
+
+- [ ] **Step 1: Create railway.toml**
+
+Create `railway.toml`:
+
+```toml
+[build]
+builder = "NIXPACKS"
+
+[deploy]
+healthcheckPath = "/health"
+healthcheckTimeout = 30
+restartPolicyType = "ON_FAILURE"
+restartPolicyMaxRetries = 3
+```
+
+- [ ] **Step 2: Provision Railway project via the Railway MCP**
+
+Use the `railway:use-railway` skill/MCP tools (already authenticated per the user's Phase 1 decision) to:
+1. Create (or select) the `CustomerETA` Railway project.
+2. Add a Postgres plugin/service.
+3. Add a Redis plugin/service.
+4. Add an app service pointed at this GitHub repo (`apercallc/CustomerETA`), branch `main`.
+5. Create a `staging` environment mirroring the above (separate Postgres/Redis instances, same app service config).
+
+- [ ] **Step 3: Set environment variables on the staging environment**
+
+Via Railway MCP/dashboard, set on the `staging` environment:
+- `DATABASE_URL` — Railway's Postgres reference variable (auto-injected when the plugin is linked)
+- `REDIS_URL` — Railway's Redis reference variable (auto-injected)
+- `AUTH_SECRET` — generate: `openssl rand -base64 32`
+- `APP_URL` — the staging service's public Railway domain (e.g. `https://customereta-staging.up.railway.app`)
+- `RESEND_API_KEY`, `RESEND_FROM_EMAIL` — real Resend sandbox/test credentials
+- `SENTRY_DSN` — real staging Sentry project DSN
+- `NODE_ENV=production`
+
+Do NOT set `TWILIO_*`, `STRIPE_*`, `GOOGLE_*`, `MICROSOFT_*` — unused until later phases, per the spec's explicit out-of-scope note.
+
+- [ ] **Step 4: Trigger first deploy**
+
+Via Railway MCP, trigger a deploy of the `staging` environment from the current `main` branch HEAD (after Tasks 1–18 are merged — see the plan's execution note below).
+
+- [ ] **Step 5: Run the staging migration**
+
+Via Railway MCP's run-command capability (or a Railway CLI one-off), run:
+```bash
+pnpm dlx prisma migrate deploy
+```
+against the staging `DATABASE_URL`.
+
+- [ ] **Step 6: Verify /health on staging**
+
+Run: `curl -i https://<staging-domain>/health`
+Expected: `HTTP/1.1 200 OK`, body `{"status":"ok","checks":{"database":true,"redis":true}}`.
+
+- [ ] **Step 7: Manual smoke check of the auth flow on staging**
+
+Visit `https://<staging-domain>/signup`, register a throwaway account, confirm the verification email arrives (real Resend send — staging sets neither `CAPTURE_EMAILS` nor `MOCK_EMAIL_SEND`, so the dev capture route 404s and the actual email is delivered), click through, log in, confirm the dashboard placeholder renders at `/dashboard`.
+
+- [ ] **Step 8: Commit railway.toml**
+
+```bash
+git add railway.toml
+git commit -m "Phase 1: Railway staging deploy configuration"
+```
+
+---
+
+## Task 20: Mark Phase 1 boxes done in todo.md
+
+**Files:**
+- Modify: `todo.md`
+
+**Interfaces:**
+- Consumes: nothing
+- Produces: an accurate `todo.md` reflecting Phase 1 completion, per the user's standing instruction ("Mark the task done in todo.md only after tests pass").
+
+- [ ] **Step 1: Check off every Phase 1 box**
+
+In `todo.md`, change every `- [ ]` under `## Phase 1 — Foundation` to `- [x]`, matching the completed tasks above one-to-one:
+- Scaffold Next.js → Task 1
+- Prisma + PostgreSQL → Task 2
+- Redis + BullMQ → Task 14
+- Auth.js registration/login/verification/reset → Tasks 9–12
+- Data model (multi-tenant) → Task 2
+- Session cookies + CSRF → Tasks 7, 9, 11
+- Zod → Task 4
+- Vitest/RTL/Playwright → Tasks 5, 16, 17
+- pino + Sentry → Task 6
+- /health → Task 15
+- Base UI shell → Task 13
+- Railway provisioning + first deploy → Task 19
+- Tests (auth flows, session scoping, Zod boundary validation) → Tasks 9–12, 16, 17
+
+- [ ] **Step 2: Verify the Phase 1 Definition of Done against the running app**
+
+Confirm each line of the "Definition of Done (per phase)" section at the bottom of `todo.md` against what was actually built: goal met and verifiable (staging URL works), unit tests pass in CI (Task 18), no tenant-isolation regressions (Task 9's `getSessionContext` tests cover this explicitly), deploys cleanly to Railway staging with `/health` green (Task 19), and note any deviation — specifically the documented Credentials/database-session workaround from the Global Constraints section above.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add todo.md
+git commit -m "Phase 1: mark Foundation tasks done in todo.md"
+```
+
+---
+
+## Execution Note
+
+Per the project's standing workflow (commit per task or logical chunk, PR + green CI required on `main` due to branch protection), each task above should land as its own PR against `main` rather than a direct push, consistent with the Phase 0 precedent (`git checkout -b phase-1/task-N-<name>`, push, `gh pr create`, wait for green `ci`, squash-merge). Task 19 (Railway deploy) should only run after Tasks 1–18 are merged to `main`, since Railway deploys from `main`.