ci: add ci type to release configuration and update documentation

- Introduced `ci` type in `.releaserc.json` for patch releases.
- Updated conventional commits documentation to reflect the new `ci` type and its implications for versioning.
- Clarified the role of `ci` in the context of patch releases in the releasing guide.

Co-authored-by: Cursor <[email protected]>

.cursor/rules/conventional-commits.mdc

@@ -53,7 +53,7 @@ powershell -NoProfile -File scripts/commit/staged-context.ps1
 | `refactor` | реструктуризация **без** новой возможности и **без** исправления бага | — |
 | `docs` | только документация | — |
 | `test` | тесты | — |
-| `ci` | CI/CD (`.gitea/`, workflows) | — |
+| `ci` | CI/CD (`.gitea/`, workflows); правки, из‑за которых нужны новые образы | patch |
 | `chore` | обслуживание, deps, `.cursor/` | — |
 
 ### Выбор type: semver, а не «красивые слова»

.cursor/rules/engineering.mdc

@@ -15,7 +15,7 @@ alwaysApply: true
 
 **ARCH-01** | MUST | Новая persistence-логика — метод `store.Backend` + реализации в `repository` и `store.Memory`; SQL не в `httpapi`.
 *Rationale:* единая абстракция данных.
-*Проверка:* grep SQL в `internal/httpapi` — отсутствие; review.
+*Проверка:* CI `scripts/lint-httpapi.sh`; grep SQL в `internal/httpapi` — отсутствие.
 
 **ARCH-02** | MUST | HTTP-маршруты только в `internal/httpapi`; регистрация через `http.ServeMux` с паттернами `METHOD /v1/...`.
 *Rationale:* один слой REST.
@@ -75,7 +75,7 @@ alwaysApply: true
 
 **STYLE-05** | MUST | HTTP-ошибки — `writeProblem` / `writeJSON` (`application/problem+json` для 4xx/5xx).
 *Rationale:* RFC 9457, OpenAPI.
-*Проверка:* `problem.go`.
+*Проверка:* `problem.go`; CI `scripts/lint-httpapi.sh` (5xx и 4xx store/cdn/csv).
 
 **STYLE-06** | MUST | JSON полей HTTP DTO согласованы с `docs/openapi.yaml`.
 *Rationale:* контракт API.
@@ -123,7 +123,7 @@ alwaysApply: true
 **TEST-03** | MUST | Новые BIRD-сценарии в `internal/birdfmt/testdata/scenarios/*/bird.conf` + `bird -p`.
 *Проверка:* CI job `bird2`.
 
-**TEST-04** | MUST | Изменения `web/` — локально `npm run check` и `npm run lint` (CI web пока не в scope).
+**TEST-04** | MUST | Изменения `web/` — локально `npm run check` и `npm run lint`; CI job `web` в `.gitea/workflows/ci.yaml`.
 *Проверка:* локальные команды.
 
 **TEST-05** | MUST | Изменения OpenAPI — `npx @redocly/cli lint docs/openapi.yaml`.
@@ -234,7 +234,9 @@ npx @redocly/cli lint docs/openapi.yaml
 # birdfmt: go test ./internal/birdfmt/... -count=1
 ```
 
-**Рекомендуется (частично внедрено):** CI job `web` (Gitea); `scripts/lint-httpapi.sh` в job `go`; `.golangci.yml` (локально); pre-commit gofmt/prettier.
+**CI (Gitea):** job `web` (check + lint); job `go`: `go vet`, `scripts/lint-httpapi.sh` (ARCH-01, ERR-01), `scripts/check-migrations-pair.sh` (DEP-03), `golangci-lint`, `go test -race`, build `cmd/*`.
+
+**Рекомендуется локально:** `.golangci.yml`; `.pre-commit-config.yaml` (gofmt + prettier web).
 
 **Только code review:** слои SQL; роли; idempotency; OpenAPI bodies; secrets в compose.
 

.gitea/README.md

@@ -12,7 +12,7 @@ Workflow: [workflows/ci.yaml](workflows/ci.yaml).
 
 ## CI (quality gates)
 
-Job **changes** вычисляет флаги по путям в diff. Изменение `.gitea/workflows/*` поднимает полный прогон.
+Job **changes** вычисляет флаги по путям в diff. Полный прогон (все узлы openapi / web / go / bird2 в графе): `.gitea/workflows/*`, `scripts/*`, `.golangci.yml`, `.pre-commit-config.yaml`, корневой `package.json` / `.releaserc.json`. Отдельно: `migrations/*`, `docs/openapi.yaml` → `go` / `openapi` и т.д. (см. `ci.yaml`).
 
 На **pull request** — **commitlint** (Conventional Commits).
 

.gitea/workflows/ci.yaml

@@ -8,10 +8,9 @@ on:
 
 jobs:
   # ---------------------------------------------------------------------------
-  # Гранулярная детекция изменений по модулям.
-  # Каждый флаг соответствует группе файлов; downstream-джобы запускаются
-  # только когда их группа затронута.  Изменение CI-конфигурации (.gitea/workflows/*)
-  # поднимает все флаги, чтобы гарантировать полный прогон.
+  # Детекция изменений по модулям (флаги → downstream-джобы в графе CI).
+  # Полный прогон (все флаги true): .gitea/workflows/*, scripts/*, .golangci.yml,
+  # .pre-commit-config.yaml — чтобы при правках CI/CD пересобирались все узлы.
   # ---------------------------------------------------------------------------
   changes:
     runs-on: ubuntu-latest
@@ -40,6 +39,23 @@ jobs:
           docker_web=false
           docker_bird=false
 
+          # Все флаги true → openapi, web, go, bird2 (и release на main) в графе CI.
+          set_all_flags_true() {
+            openapi=true
+            go=true
+            web=true
+            bird_conf=true
+            docker_go=true
+            docker_web=true
+            docker_bird=true
+          }
+
+          write_outputs() {
+            for v in openapi go web bird_conf docker_go docker_web docker_bird; do
+              eval "echo \"\$v=\$$v\"" >> "$GITHUB_OUTPUT"
+            done
+          }
+
           if [ "${{ github.event_name }}" = "pull_request" ]; then
             base="${{ github.event.pull_request.base.sha }}"
             head="${{ github.event.pull_request.head.sha }}"
@@ -52,61 +68,84 @@ jobs:
             elif git rev-parse --verify HEAD~1 >/dev/null 2>&1; then
               FILES="$(git diff --name-only HEAD~1 HEAD)"
             else
-              openapi=true; go=true; web=true; bird_conf=true
-              docker_go=true; docker_web=true; docker_bird=true
-              for v in openapi go web bird_conf docker_go docker_web docker_bird; do
-                echo "$v=true" >> "$GITHUB_OUTPUT"
-              done
-              echo "No parent commit — full pipeline"
+              set_all_flags_true
+              write_outputs
+              echo "No parent commit — full pipeline (all modules)"
               exit 0
             fi
           fi
 
           if [ -z "$(printf '%s' "$FILES" | tr -d '[:space:]')" ]; then
-            go=true; web=true
-            for v in openapi go web bird_conf docker_go docker_web docker_bird; do
-              eval "echo \"\$v=\$$v\"" >> "$GITHUB_OUTPUT"
-            done
-            echo "Empty diff — safe fallback: go=true web=true"
+            set_all_flags_true
+            write_outputs
+            echo "Empty diff — full pipeline fallback"
             exit 0
           fi
 
-          ci_changed=false
+          full_pipeline=false
 
           while IFS= read -r f || [ -n "${f:-}" ]; do
             [ -z "${f:-}" ] && continue
             case "$f" in
-              .gitea/workflows/*)                          ci_changed=true ;;
-              docs/openapi.yaml|redocly.yaml)              openapi=true ;;
-              web/README.md)                               ;; # doc-only
-              web/*)                                       web=true ;;
-              deploy/bird/*)                               bird_conf=true ;;
-              deploy/docker/bird/*)                        docker_bird=true; docker_go=true ;;
-              deploy/docker/gobinary/*)                    docker_go=true ;;
-              deploy/docker/docker-bake.hcl)               docker_go=true; docker_web=true ;;
-              deploy/docker/evobgp-agent/*)                docker_go=true ;;
-              deploy/docker/evobgp-web/*)                  docker_web=true ;;
-              deploy/docker/bird2/*)                       docker_bird=true ;;
-              go.mod|go.sum|go.work)                       go=true ;;
-              *.go)                                        go=true ;;
-              cmd/*|internal/*)                            go=true ;;
+              # CI/CD инфраструктура — все узлы quality gates
+              .gitea/workflows/*|.golangci.yml|.pre-commit-config.yaml|scripts/*)
+                full_pipeline=true
+                ;;
+              docs/openapi.yaml|redocly.yaml)
+                openapi=true
+                ;;
+              docs/api.md|docs/access.md)
+                openapi=true
+                go=true
+                ;;
+              web/README.md|web/components.json)
+                ;;
+              web/*)
+                web=true
+                ;;
+              deploy/bird/*)
+                bird_conf=true
+                go=true
+                ;;
+              deploy/compose/*|deploy/docker/*)
+                docker_go=true
+                docker_web=true
+                docker_bird=true
+                go=true
+                ;;
+              go.mod|go.sum|go.work)
+                go=true
+                ;;
+              migrations/*)
+                go=true
+                ;;
+              cmd/*|internal/*|*.go)
+                go=true
+                bird_conf=true
+                ;;
+              docs/*)
+                go=true
+                ;;
+              package.json|package-lock.json|.releaserc.json)
+                full_pipeline=true
+                ;;
+              *)
+                go=true
+                ;;
             esac
           done <<< "$FILES"
 
-          if $ci_changed; then
-            go=true; web=true; bird_conf=true
-            docker_go=true; docker_web=true; docker_bird=true
+          if $full_pipeline; then
+            set_all_flags_true
           fi
 
-          for v in openapi go web bird_conf docker_go docker_web docker_bird; do
-            eval "echo \"\$v=\$$v\"" >> "$GITHUB_OUTPUT"
-          done
+          write_outputs
 
           echo "Changed files (first 30):"
           printf '%s\n' "$FILES" | head -n 30
           echo "--- flags ---"
           echo "openapi=$openapi go=$go web=$web bird_conf=$bird_conf"
-          echo "docker_go=$docker_go docker_web=$docker_web docker_bird=$docker_bird ci=$ci_changed"
+          echo "docker_go=$docker_go docker_web=$docker_web docker_bird=$docker_bird full_pipeline=$full_pipeline"
 
   # ---------------------------------------------------------------------------
   openapi:
@@ -157,6 +196,14 @@ jobs:
         run: go vet ./...
       - name: Lint httpapi (ERR-01 / ARCH-01)
         run: sh scripts/lint-httpapi.sh
+      - name: Check migration pairs (DEP-03)
+        run: sh scripts/check-migrations-pair.sh
+      # go.mod: go 1.24 — бинарник golangci-lint < v1.64.2 (сборка на Go 1.23) не запускается.
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v6
+        with:
+          version: v1.64.8
+          install-mode: goinstall
       - name: Test
         run: go test ./... -race -count=1
       - name: Build all commands

.golangci.yml

@@ -2,6 +2,7 @@ run:
   timeout: 5m
 
 linters:
+  disable-all: true
   enable:
     - gofmt
     - govet

.pre-commit-config.yaml

@@ -0,0 +1,19 @@
+# Local hooks (optional): install with `pre-commit install`
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+  - repo: https://github.com/dnephin/pre-commit-golang
+    rev: v0.5.1
+    hooks:
+      - id: go-fmt
+  - repo: local
+    hooks:
+      - id: prettier-web
+        name: prettier (web)
+        entry: bash -c 'cd web && npx prettier --check .'
+        language: system
+        files: ^web/
+        pass_filenames: false

.releaserc.json

@@ -10,6 +10,7 @@
           { "type": "feat", "release": "minor" },
           { "type": "fix", "release": "patch" },
           { "type": "perf", "release": "patch" },
+          { "type": "ci", "release": "patch" },
           { "breaking": true, "release": "major" }
         ]
       }

deploy/compose/docker-compose.yaml

@@ -96,7 +96,7 @@ services:
       <<: *env-ref
       EVOBGP_HTTP_ADDR: ":8080"
       EVOBGP_SEED_DEMO: "1"
-      # Local reference only: allows Bearer dev for scheduler HTTP client (EVOBGP_SCHEDULER_BEARER).
+      # DEV ONLY — не для production. Bearer dev + слабые demo-секреты (см. docs/access.md).
       EVOBGP_DEV_INSECURE: "1"
       EVOBGP_BIRDC_SOCKET: /run/bird/bird.ctl
       EVOBGP_BIRDC_INTERVAL: 30s

deploy/compose/stack.microvps-full.yaml

@@ -135,6 +135,7 @@ services:
       EVOBGP_BIRDC_INTERVAL: 30s
       EVOBGP_BIRD_ACTIVE_DIR: /etc/bird
       EVOBGP_BIRD_STAGING_DIR: /tmp/evobgp-bird-staging
+      # DEV ONLY — не для production (см. docs/access.md).
       EVOBGP_DEV_INSECURE: "1"
     volumes:
       - bird_etc:/etc/bird

docs/access.md

@@ -37,7 +37,12 @@ opkey|01ARZ3NDEKTSV4RRFFQ69G5FAV|operator,nodekey|01ARZ3NDEKTSV4RRFFQ69G5FAV|nod
 
 Если установлено `EVOBGP_DEV_INSECURE=1` и в store доступен демо-tenant (`DemoIDs`), то запрос с заголовком **`Authorization: Bearer dev`** получает контекст **`operator`** для этого tenant.
 
-**Запрещено** в продакшене: любой, кто знает заголовок, получает полные права оператора на демо-данные.
+**Запрещено** в продакшене: любой, кто знает заголовок, получает полные права оператора на демо-данные. В reference Compose (`deploy/compose/docker-compose.yaml`) флаг включён только для локальной разработки.
+
+### Синхронные «тяжёлые» GET (control plane)
+
+- `POST /v1/modules/{module_id}/cdn-sources/preview` — загрузка CDN в том же HTTP-запросе (лимит тела ~8 MiB, см. OpenAPI).
+- `GET /v1/bird/status` (если маршрут включён в деплое) — опрос локального `birdc`, таймаут сервера ~12 с.
 
 ### Детерминированный ключ подписи бандлов (тесты)
 

docs/openapi.yaml

@@ -67,7 +67,9 @@ components:
       required: false
       schema:
         $ref: "#/components/schemas/ResourceId"
-      description: Явный tenant (только супер-роли). Без заголовка tenant определяется по ключу.
+      description: >
+        Явный tenant (только супер-роли). Без заголовка tenant определяется по API-ключу.
+        **Реализация v1:** заголовок в Go handlers не обрабатывается; tenant только из Bearer-токена (см. docs/access.md).
     IdempotencyKey:
       name: Idempotency-Key
       in: header
@@ -1811,7 +1813,9 @@ paths:
       tags: [Modules]
       summary: Предпросмотр префиксов из CDN-источника
       description: >
-        Загружает URL, парсит как plaintext или json и возвращает список извлечённых префиксов (до 100 записей).
+        Синхронный запрос: conditional GET к URL (до 8 MiB тела ответа), парсинг plaintext или JSON,
+        возврат до 100 префиксов в `items` (полный счётчик в `total`). Выполняется в HTTP worker;
+        при таймауте клиента используйте короткий URL или меньший payload.
       operationId: previewCdnSource
       requestBody:
         required: true

docs/releasing.md

@@ -7,9 +7,11 @@ EvoBGP использует [Conventional Commits](https://www.conventionalcommi
 | Тип коммита | Bump |
 |-------------|------|
 | `feat` | minor (1.0.0 → 1.1.0) |
-| `fix`, `perf` | patch (1.0.0 → 1.0.1) |
+| `fix`, `perf`, `ci` | patch (1.5.1 → 1.5.2) |
 | `feat!`, `fix!` или `BREAKING CHANGE:` в теле | major (1.0.0 → 2.0.0) |
-| `docs`, `chore`, `ci`, `test`, `refactor` | без релиза |
+| `docs`, `chore`, `test`, `refactor` | без релиза |
+
+Отдельного суффикса `1.x.y.fix` в semver нет: «fix» в Conventional Commits означает **patch** (третья цифра). Для починки пайплайна без смены продукта — `fix(ci):` или `ci:` (оба дают patch после настройки `.releaserc.json`).
 
 Первый релиз при отсутствии git-тегов — **1.0.0**, если есть releasable-коммиты.
 

internal/asnresolve/ripestat.go

@@ -42,7 +42,7 @@ func AnnouncedPrefixes(ctx context.Context, hc *http.Client, asn int64) ([]netip
 	if err != nil {
 		return nil, fmt.Errorf("ripestat fetch AS%d: %w", asn, err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	body, err := io.ReadAll(io.LimitReader(resp.Body, 32<<20))
 	if err != nil {
 		return nil, err
@@ -52,8 +52,8 @@ func AnnouncedPrefixes(ctx context.Context, hc *http.Client, asn int64) ([]netip
 	}
 
 	var wrap struct {
-		Status  string `json:"status"`
-		Data    struct {
+		Status string `json:"status"`
+		Data   struct {
 			Prefixes []struct {
 				Prefix string `json:"prefix"`
 			} `json:"prefixes"`
@@ -104,7 +104,7 @@ func ASHolderName(ctx context.Context, hc *http.Client, asn int64) (string, erro
 	if err != nil {
 		return "", fmt.Errorf("ripestat as-overview AS%d: %w", asn, err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
 	if err != nil {
 		return "", err

internal/birdfmt/bgp.go

@@ -60,10 +60,10 @@ func RenderBGPTemplates(opts BGPTemplatesOptions) (string, error) {
 
 // BGPPeerFromTemplateOptions describes protocol bgp NAME from TEMPLATE { … }.
 type BGPPeerFromTemplateOptions struct {
-	ProtocolName  string
-	TemplateName  string
-	NeighborIP    string
-	NeighborASN   uint32
+	ProtocolName string
+	TemplateName string
+	NeighborIP   string
+	NeighborASN  uint32
 	// If set, emits "local … as …" before neighbor (overrides template local/ASN for this peer).
 	OverrideLocalIP  string
 	OverrideLocalASN uint32

internal/bundle/pack.go

@@ -17,12 +17,12 @@ import (
 
 // Manifest describes bundle contents for evobgp-node verification.
 type Manifest struct {
-	RevisionID  string      `json:"revision_id"`
-	SpeakerID   string      `json:"speaker_id,omitempty"`
-	CreatedAt   time.Time   `json:"created_at"`
-	Files       []FileEntry `json:"files"`
-	Algorithm   string      `json:"signature_algorithm"`
-	PublicKeyB64 string     `json:"public_key_base64"`
+	RevisionID   string      `json:"revision_id"`
+	SpeakerID    string      `json:"speaker_id,omitempty"`
+	CreatedAt    time.Time   `json:"created_at"`
+	Files        []FileEntry `json:"files"`
+	Algorithm    string      `json:"signature_algorithm"`
+	PublicKeyB64 string      `json:"public_key_base64"`
 }
 
 // FileEntry is one file inside the bundle archive.

internal/bundle/verify.go

@@ -27,7 +27,7 @@ func VerifyGzippedTar(bundle []byte, pub ed25519.PublicKey) (*VerifiedContents,
 	if err != nil {
 		return nil, err
 	}
-	defer gr.Close()
+	defer func() { _ = gr.Close() }()
 
 	var manifestRaw []byte
 	var sig []byte

internal/httpapi/list_params.go

@@ -3,6 +3,8 @@ package httpapi
 import (
 	"net/http"
 	"strconv"
+
+	"evobgp/internal/store"
 )
 
 func parseListLimit(r *http.Request) int {
@@ -22,3 +24,15 @@ func strPtrOrNull(s string) any {
 	}
 	return s
 }
+
+// writePaginatedListJSON returns a cursor/limit page as OpenAPI list envelopes (items, next_cursor, has_more).
+func writePaginatedListJSON[T any](w http.ResponseWriter, r *http.Request, all []T, toItem func(T) map[string]any) {
+	page, next, more := store.PaginateOffset(all, r.URL.Query().Get("cursor"), parseListLimit(r))
+	items := make([]map[string]any, 0, len(page))
+	for _, x := range page {
+		items = append(items, toItem(x))
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"items": items, "next_cursor": strPtrOrNull(next), "has_more": more,
+	})
+}

internal/httpapi/problem.go

@@ -9,15 +9,19 @@ import (
 const (
 	internalErrorDetail = "an internal error occurred"
 	badGatewayDetail    = "upstream request failed"
+	notFoundDetail      = "resource not found"
+	invalidInputDetail  = "invalid request data"
+	cdnExtractDetail    = "could not extract prefixes from source"
+	csvInvalidRowDetail = "invalid row in csv file"
 )
 
 // Problem is RFC 9457 application/problem+json.
 type Problem struct {
-	Type     string         `json:"type,omitempty"`
-	Title    string         `json:"title"`
-	Status   int            `json:"status"`
-	Detail   string         `json:"detail,omitempty"`
-	Instance string         `json:"instance,omitempty"`
+	Type     string `json:"type,omitempty"`
+	Title    string `json:"title"`
+	Status   int    `json:"status"`
+	Detail   string `json:"detail,omitempty"`
+	Instance string `json:"instance,omitempty"`
 }
 
 func writeProblem(w http.ResponseWriter, status int, title, detail string) {

internal/httpapi/routes.go

@@ -84,12 +84,15 @@ func (s *Server) handleReady(w http.ResponseWriter, r *http.Request) {
 	checks := map[string]string{"store": "ok", "jobs": "memory"}
 	ctx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
 	defer cancel()
-	if s.pgPool != nil {
-		if err := s.pgPool.Ping(ctx); err != nil {
+	if err := s.store.Ping(ctx); err != nil {
+		checks["store"] = "unavailable"
+		if s.pgPool != nil {
 			checks["postgres"] = "unavailable"
-			writeJSON(w, http.StatusServiceUnavailable, map[string]any{"status": "not_ready", "checks": checks})
-			return
 		}
+		writeJSON(w, http.StatusServiceUnavailable, map[string]any{"status": "not_ready", "checks": checks})
+		return
+	}
+	if s.pgPool != nil {
 		checks["postgres"] = "ok"
 	} else {
 		checks["store_backend"] = "memory"

internal/httpapi/routes_crud.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log"
 	"net/http"
 	"strconv"
 	"strings"
@@ -172,12 +173,15 @@ func (s *Server) handleDeleteModule(w http.ResponseWriter, r *http.Request) {
 }
 
 func writeStoreErr(w http.ResponseWriter, err error) {
+	if err != nil {
+		log.Printf("httpapi: store: %v", err)
+	}
 	if err == store.ErrNotFound || err == store.ErrTenantScope {
-		writeProblem(w, http.StatusNotFound, "Not Found", err.Error())
+		writeProblem(w, http.StatusNotFound, "Not Found", notFoundDetail)
 		return
 	}
 	if err == store.ErrInvalidInput {
-		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", err.Error())
+		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", invalidInputDetail)
 		return
 	}
 	writeInternalError(w, "store", err)
@@ -193,11 +197,7 @@ func (s *Server) handleListCDNSources(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
-	items := make([]map[string]any, 0, len(list))
-	for _, x := range list {
-		items = append(items, cdnSourceJSON(x))
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"items": items, "next_cursor": nil, "has_more": false})
+	writePaginatedListJSON(w, r, list, cdnSourceJSON)
 }
 
 func cdnSourceJSON(x *store.CDNSource) map[string]any {
@@ -258,7 +258,7 @@ func (s *Server) handlePreviewCDNSource(w http.ResponseWriter, r *http.Request)
 		writeBadGateway(w, "cdn preview fetch", err)
 		return
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode != http.StatusOK {
 		_, _ = io.Copy(io.Discard, resp.Body)
 		writeBadGateway(w, "cdn preview fetch", fmt.Errorf("upstream status: %s", resp.Status))
@@ -271,7 +271,8 @@ func (s *Server) handlePreviewCDNSource(w http.ResponseWriter, r *http.Request)
 	}
 	pfxs, err := pipeline.ExtractCIDRs(string(raw), body.SourceKind, body.PrefixPath)
 	if err != nil {
-		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", err.Error())
+		log.Printf("httpapi: cdn preview extract: %v", err)
+		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", cdnExtractDetail)
 		return
 	}
 	items := make([]string, 0, len(pfxs))
@@ -354,11 +355,7 @@ func (s *Server) handleListAS(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
-	items := make([]map[string]any, 0, len(list))
-	for _, x := range list {
-		items = append(items, asEntryJSON(x))
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"items": items})
+	writePaginatedListJSON(w, r, list, asEntryJSON)
 }
 
 func asEntryJSON(x *store.ASEntry) map[string]any {
@@ -450,11 +447,7 @@ func (s *Server) handleListDomain(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
-	items := make([]map[string]any, 0, len(list))
-	for _, x := range list {
-		items = append(items, domainEntryJSON(x))
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"items": items})
+	writePaginatedListJSON(w, r, list, domainEntryJSON)
 }
 
 func domainEntryJSON(x *store.DomainEntry) map[string]any {
@@ -531,11 +524,7 @@ func (s *Server) handleListIPRange(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
-	items := make([]map[string]any, 0, len(list))
-	for _, x := range list {
-		items = append(items, ipRangeJSON(x))
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"items": items})
+	writePaginatedListJSON(w, r, list, ipRangeJSON)
 }
 
 func ipRangeJSON(x *store.IPRangeEntry) map[string]any {
@@ -702,8 +691,8 @@ func (s *Server) handleImportModuleEntriesCSV(w http.ResponseWriter, r *http.Req
 			return
 		}
 		if strings.Contains(err.Error(), "importer: line") {
-			detail := strings.TrimPrefix(err.Error(), "importer: ")
-			writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", detail)
+			log.Printf("httpapi: csv import: %v", err)
+			writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", csvInvalidRowDetail)
 			return
 		}
 		if strings.Contains(err.Error(), "importer: csv import/export") {

internal/httpapi/routes_crud_csv_test.go

@@ -34,7 +34,7 @@ func TestModuleEntriesCSVImportExportIPRanges(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer respList.Body.Close()
+	defer func() { _ = respList.Body.Close() }()
 	if respList.StatusCode != http.StatusOK {
 		b, _ := io.ReadAll(respList.Body)
 		t.Fatalf("communities status %d: %s", respList.StatusCode, b)
@@ -59,7 +59,7 @@ func TestModuleEntriesCSVImportExportIPRanges(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer respImport.Body.Close()
+	defer func() { _ = respImport.Body.Close() }()
 	if respImport.StatusCode != http.StatusOK {
 		b, _ := io.ReadAll(respImport.Body)
 		t.Fatalf("import status %d: %s", respImport.StatusCode, b)
@@ -80,7 +80,7 @@ func TestModuleEntriesCSVImportExportIPRanges(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer respExport.Body.Close()
+	defer func() { _ = respExport.Body.Close() }()
 	if respExport.StatusCode != http.StatusOK {
 		b, _ := io.ReadAll(respExport.Body)
 		t.Fatalf("export status %d: %s", respExport.StatusCode, b)

internal/httpapi/routes_crud_list_test.go

@@ -0,0 +1,87 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestNestedModuleListPagination(t *testing.T) {
+	srv, err := New(Options{InsecureDev: true, SeedDemo: true, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+	tenant, _, modIP, _, _ := srv.Store().DemoIDs()
+	srv.apiKeys = parseAPIKeysSpec("edkey|" + tenant + "|editor")
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+	client := ts.Client()
+	base := ts.URL
+	mid := modIP
+
+	for i := 0; i < 3; i++ {
+		body := strings.NewReader(fmt.Sprintf(`{"prefix":"10.%d.0.0/24"}`, 200+i))
+		req, _ := http.NewRequest(http.MethodPost, base+"/v1/modules/"+mid+"/ip-range-entries", body)
+		req.Header.Set("Authorization", "Bearer edkey")
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, _ = io.Copy(io.Discard, resp.Body)
+		_ = resp.Body.Close()
+		if resp.StatusCode != http.StatusCreated {
+			t.Fatalf("create entry %d: status %d", i, resp.StatusCode)
+		}
+	}
+
+	req, _ := http.NewRequest(http.MethodGet, base+"/v1/modules/"+mid+"/ip-range-entries?limit=2", nil)
+	req.Header.Set("Authorization", "Bearer edkey")
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("list status %d: %s", resp.StatusCode, b)
+	}
+	var page1 struct {
+		Items      []map[string]any `json:"items"`
+		NextCursor *string          `json:"next_cursor"`
+		HasMore    bool             `json:"has_more"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&page1); err != nil {
+		t.Fatal(err)
+	}
+	if len(page1.Items) != 2 {
+		t.Fatalf("page1 items: got %d want 2", len(page1.Items))
+	}
+	if !page1.HasMore || page1.NextCursor == nil || *page1.NextCursor == "" {
+		t.Fatalf("page1: has_more=%v next_cursor=%v", page1.HasMore, page1.NextCursor)
+	}
+
+	req2, _ := http.NewRequest(http.MethodGet, base+"/v1/modules/"+mid+"/ip-range-entries?limit=2&cursor="+*page1.NextCursor, nil)
+	req2.Header.Set("Authorization", "Bearer edkey")
+	resp2, err := client.Do(req2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp2.Body.Close() }()
+	var page2 struct {
+		Items   []map[string]any `json:"items"`
+		HasMore bool             `json:"has_more"`
+	}
+	if err := json.NewDecoder(resp2.Body).Decode(&page2); err != nil {
+		t.Fatal(err)
+	}
+	if len(page1.Items)+len(page2.Items) < 3 {
+		t.Fatalf("expected at least 3 entries across pages, got %d+%d", len(page1.Items), len(page2.Items))
+	}
+}

internal/httpapi/server.go

@@ -32,10 +32,10 @@ type Server struct {
 type Options struct {
 	APIKeys string
 	// DatabaseURL enables PostgreSQL-backed store (migrations applied on connect).
-	DatabaseURL string
-	InsecureDev bool
-	SeedDemo    bool
-	BundleSeedHex string
+	DatabaseURL        string
+	InsecureDev        bool
+	SeedDemo           bool
+	BundleSeedHex      string
 	CORSAllowedOrigins string
 }
 

internal/httpapi/server_test.go

@@ -51,7 +51,7 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		defer resp.Body.Close()
+		defer func() { _ = resp.Body.Close() }()
 		if resp.StatusCode != http.StatusOK {
 			b, _ := io.ReadAll(resp.Body)
 			t.Fatalf("status %d: %s", resp.StatusCode, b)
@@ -76,7 +76,7 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		defer resp.Body.Close()
+		defer func() { _ = resp.Body.Close() }()
 		if resp.StatusCode != http.StatusAccepted {
 			b, _ := io.ReadAll(resp.Body)
 			t.Fatalf("status %d: %s", resp.StatusCode, b)
@@ -97,7 +97,7 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		defer resp.Body.Close()
+		defer func() { _ = resp.Body.Close() }()
 		if resp.StatusCode != http.StatusAccepted {
 			b, _ := io.ReadAll(resp.Body)
 			t.Fatalf("status %d: %s", resp.StatusCode, b)
@@ -118,7 +118,7 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		defer resp.Body.Close()
+		defer func() { _ = resp.Body.Close() }()
 		if resp.StatusCode != http.StatusOK {
 			b, _ := io.ReadAll(resp.Body)
 			t.Fatalf("status %d: %s", resp.StatusCode, b)
@@ -132,7 +132,7 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		defer resp.Body.Close()
+		defer func() { _ = resp.Body.Close() }()
 		if resp.StatusCode != http.StatusOK {
 			b, _ := io.ReadAll(resp.Body)
 			t.Fatalf("status %d: %s", resp.StatusCode, b)
@@ -162,7 +162,7 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 				t.Fatal(err)
 			}
 			b, _ := io.ReadAll(resp.Body)
-			resp.Body.Close()
+			_ = resp.Body.Close()
 			if resp.StatusCode != http.StatusOK {
 				t.Fatalf("%s status %d: %s", path, resp.StatusCode, b)
 			}
@@ -185,7 +185,7 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		defer resp.Body.Close()
+		defer func() { _ = resp.Body.Close() }()
 		if resp.StatusCode != http.StatusOK {
 			b, _ := io.ReadAll(resp.Body)
 			t.Fatalf("status %d: %s", resp.StatusCode, b)
@@ -215,7 +215,7 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		defer resp.Body.Close()
+		defer func() { _ = resp.Body.Close() }()
 		if resp.StatusCode != http.StatusOK {
 			b, _ := io.ReadAll(resp.Body)
 			t.Fatalf("status %d: %s", resp.StatusCode, b)
@@ -255,7 +255,7 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		defer resp.Body.Close()
+		defer func() { _ = resp.Body.Close() }()
 		if resp.StatusCode != http.StatusForbidden {
 			b, _ := io.ReadAll(resp.Body)
 			t.Fatalf("status %d want 403: %s", resp.StatusCode, b)
@@ -269,7 +269,7 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		defer resp.Body.Close()
+		defer func() { _ = resp.Body.Close() }()
 		if resp.StatusCode != http.StatusAccepted {
 			b, _ := io.ReadAll(resp.Body)
 			t.Fatalf("status %d: %s", resp.StatusCode, b)
@@ -289,7 +289,7 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		defer resp.Body.Close()
+		defer func() { _ = resp.Body.Close() }()
 		if resp.StatusCode != http.StatusAccepted {
 			b, _ := io.ReadAll(resp.Body)
 			t.Fatalf("status %d: %s", resp.StatusCode, b)
@@ -314,7 +314,7 @@ func TestAPIRefreshApplyJobsBundle(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		defer resp.Body.Close()
+		defer func() { _ = resp.Body.Close() }()
 		if resp.StatusCode != http.StatusOK {
 			b, _ := io.ReadAll(resp.Body)
 			t.Fatalf("status %d: %s", resp.StatusCode, b)
@@ -341,7 +341,7 @@ func waitJob(t *testing.T, client *http.Client, base, token, jobID string) {
 			t.Fatal(err)
 		}
 		b, _ := io.ReadAll(resp.Body)
-		resp.Body.Close()
+		_ = resp.Body.Close()
 		var body struct {
 			Status string `json:"status"`
 		}
@@ -405,7 +405,7 @@ func TestVersionEndpoints(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			defer resp.Body.Close()
+			defer func() { _ = resp.Body.Close() }()
 			if resp.StatusCode != http.StatusOK {
 				b, _ := io.ReadAll(resp.Body)
 				t.Fatalf("status %d: %s", resp.StatusCode, b)

internal/nodecli/commands.go

@@ -66,7 +66,7 @@ func fetchLatestRevision(base, token, speaker string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode != http.StatusOK {
 		b, _ := io.ReadAll(resp.Body)
 		return "", fmt.Errorf("latest revision: %s: %s", resp.Status, strings.TrimSpace(string(b)))
@@ -94,7 +94,7 @@ func fetchBundle(base, token, speaker, revision string) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode != http.StatusOK {
 		b, _ := io.ReadAll(resp.Body)
 		return nil, fmt.Errorf("bundle: %s: %s", resp.Status, strings.TrimSpace(string(b)))

internal/nodecli/nodecli.go

@@ -27,7 +27,7 @@ func Run(args []string) int {
 
 // Usage prints CLI help to w.
 func Usage(w interface{ Write([]byte) (int, error) }) {
-	fmt.Fprintf(w, `Usage:
+	_, _ = fmt.Fprintf(w, `Usage:
   evobgp-node pull-bundle   -base-url URL -token TOKEN -speaker-id ID [-revision-id ID] [-o path]
   evobgp-node verify-bundle -f bundle.tar.gz (-pubkey-base64 B64 | -pubkey-hex HEX)
   evobgp-node apply-bundle  -f bundle.tar.gz -extract-dir DIR (-pubkey-base64 B64 | -pubkey-hex HEX)

internal/pipeline/cdn_snapshot.go

@@ -126,7 +126,7 @@ func applyCDNSourceHTTPResult(ctx context.Context, st store.Backend, hc *http.Cl
 			return nil, fmt.Errorf("cdn url %s: 304 without cached prefixes", u)
 		}
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	if resp.StatusCode != http.StatusOK {
 		_, _ = io.Copy(io.Discard, resp.Body)

internal/pipeline/materialize_regression_test.go

@@ -46,4 +46,3 @@ func TestBuildPreviewFragments_SamePrefixDifferentCommunity(t *testing.T) {
 		t.Fatalf("expected deterministic static preview text, got first:\n%s\nsecond:\n%s", staticV4, staticV4Second)
 	}
 }
-

internal/pipeline/parse.go

@@ -39,7 +39,7 @@ func ParseCIDRLines(body string) []netip.Prefix {
 	return out
 }
 
-// ExtractCIDRs parses CIDRs from either plaintext lines or JSON payload.
+// ExtractCIDRs parses CIDR prefixes from plaintext lines or a JSON payload (see sourceKind and prefixPath).
 // For sourceKind="json", prefixPath supports dotted traversal, with [] for arrays:
 // e.g. "prefixes[]", "data.items[].cidr".
 func ExtractCIDRs(body, sourceKind, prefixPath string) ([]netip.Prefix, error) {

internal/pipeline/refresh.go

@@ -306,7 +306,7 @@ func resolveDomainWithDOHMessage(ctx context.Context, hc *http.Client, baseURL,
 	if err != nil {
 		return nil, err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode != http.StatusOK {
 		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1024))
 		return nil, fmt.Errorf("doh dns-message status %s: %s", resp.Status, strings.TrimSpace(string(body)))
@@ -378,7 +378,7 @@ func resolveDomainWithDOHJSON(ctx context.Context, hc *http.Client, baseURL, hos
 	if err != nil {
 		return nil, err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode != http.StatusOK {
 		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1024))
 		return nil, fmt.Errorf("doh status %s: %s", resp.Status, strings.TrimSpace(string(body)))
@@ -725,15 +725,15 @@ func dedupeSortedPrefixLines(rows []store.PrefixRow) []prefixHashLine {
 }
 
 func writePrefixLinesHash(h interface{ Write([]byte) (int, error) }, tenantID string, lines []prefixHashLine) {
-	h.Write([]byte(strings.TrimSpace(tenantID)))
-	h.Write([]byte{0})
+	_, _ = h.Write([]byte(strings.TrimSpace(tenantID)))
+	_, _ = h.Write([]byte{0})
 	for _, l := range lines {
-		h.Write([]byte(l.p))
-		h.Write([]byte{1})
-		h.Write([]byte(l.c))
-		h.Write([]byte{1})
-		h.Write([]byte(l.s))
-		h.Write([]byte{0})
+		_, _ = h.Write([]byte(l.p))
+		_, _ = h.Write([]byte{1})
+		_, _ = h.Write([]byte(l.c))
+		_, _ = h.Write([]byte{1})
+		_, _ = h.Write([]byte(l.s))
+		_, _ = h.Write([]byte{0})
 	}
 }
 

internal/repository/backend_test.go

@@ -0,0 +1,70 @@
+package repository
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"evobgp/internal/db"
+	"evobgp/internal/store"
+)
+
+func TestPostgresImplementsBackend(t *testing.T) {
+	var _ store.Backend = (*Postgres)(nil)
+}
+
+func TestPostgresPingIntegration(t *testing.T) {
+	dsn := os.Getenv("EVOBGP_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("EVOBGP_TEST_DATABASE_URL not set")
+	}
+	ctx := context.Background()
+	pool, err := db.OpenPostgresPool(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer pool.Close()
+	pg, err := NewPostgres(ctx, pool, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := pg.Ping(ctx); err != nil {
+		t.Fatalf("ping: %v", err)
+	}
+}
+
+func TestPostgresModuleCRUDIntegration(t *testing.T) {
+	dsn := os.Getenv("EVOBGP_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("EVOBGP_TEST_DATABASE_URL not set")
+	}
+	ctx := context.Background()
+	pool, err := db.OpenPostgresPool(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer pool.Close()
+	pg, err := NewPostgres(ctx, pool, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tenant := "01TESTTENANT00000000000001"
+	mod, err := pg.CreateModule(tenant, &store.Module{
+		Name:    "audit-test",
+		Type:    "IP_RANGES",
+		Enabled: true,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := pg.GetModule(tenant, mod.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Name != "audit-test" {
+		t.Fatalf("name: got %q", got.Name)
+	}
+	if err := pg.SoftDeleteModule(tenant, mod.ID); err != nil {
+		t.Fatal(err)
+	}
+}

internal/repository/postgres.go

@@ -28,7 +28,7 @@ func agentDebugNDJSON3214(hypothesisID, location, message string, data map[strin
 	if err != nil {
 		return
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 	var ms runtime.MemStats
 	runtime.ReadMemStats(&ms)
 	payload := map[string]any{
@@ -71,6 +71,11 @@ func (p *Postgres) DemoIDs() (tenant, moduleCDN, moduleIP, revision, speaker str
 	return p.demoTenant, p.demoCDN, p.demoIP, p.demoRev, p.demoSpk
 }
 
+// Ping checks PostgreSQL connectivity.
+func (p *Postgres) Ping(ctx context.Context) error {
+	return p.pool.Ping(ctx)
+}
+
 func (p *Postgres) MaterializedPrefixStats() (max int, sum int) {
 	ctx := context.Background()
 	// Агрегация в БД — не тащим все строки config_revision в память.

internal/scheduler/run.go

@@ -121,7 +121,7 @@ func postTenantRefresh(ctx context.Context, deps *Deps, moduleIDs []string, idem
 	if err != nil {
 		return err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode == http.StatusNoContent || resp.StatusCode == http.StatusAccepted {
 		return nil
 	}

internal/store/backend.go

@@ -1,6 +1,9 @@
 package store
 
-import "time"
+import (
+	"context"
+	"time"
+)
 
 // Backend is the persistence abstraction for the control plane (memory, PostgreSQL, SQLite).
 type Backend interface {
@@ -90,6 +93,9 @@ type Backend interface {
 	// ASNPrefixCache stores RIPEstat announced-prefixes per ASN (global TTL cache).
 	GetASNPrefixCache(asn int64) (*ASNPrefixCacheEntry, bool, error)
 	SetASNPrefixCache(asn int64, holder string, prefixes []string) error
+
+	// Ping verifies backend connectivity (no-op for in-memory).
+	Ping(ctx context.Context) error
 }
 
 // ASNPrefixCacheEntry is a cached RIPEstat response for one ASN.

internal/store/memory.go

@@ -1,6 +1,7 @@
 package store
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"sort"
@@ -32,13 +33,13 @@ type Memory struct {
 
 	peers map[string]*BGPPeer
 
-	dohProfiles map[string]*DohProfile
-	communities map[string]*Community
-	cdnSources  map[string]*CDNSource
-	asEntries   map[string]*ASEntry
-	domainEnt   map[string]*DomainEntry
-	ipRanges    map[string]*IPRangeEntry
-	settings    map[string]map[string]any // tenantID -> key -> JSON-compatible value
+	dohProfiles     map[string]*DohProfile
+	communities     map[string]*Community
+	cdnSources      map[string]*CDNSource
+	asEntries       map[string]*ASEntry
+	domainEnt       map[string]*DomainEntry
+	ipRanges        map[string]*IPRangeEntry
+	settings        map[string]map[string]any // tenantID -> key -> JSON-compatible value
 	revPrefixes     map[string][]PrefixRow
 	moduleSnapshots map[string]*moduleSnapshotRec
 	asnPrefixCache  map[int64]*ASNPrefixCacheEntry
@@ -291,6 +292,12 @@ func (m *Memory) DemoIDs() (tenant, moduleCDN, moduleIP, revision, speaker strin
 	return m.demoTenantID, m.demoModuleCDN, m.demoModuleIP, m.demoRevisionID, m.demoSpeakerID
 }
 
+// Ping is a no-op for the in-memory backend.
+func (m *Memory) Ping(ctx context.Context) error {
+	_ = ctx
+	return nil
+}
+
 // ListTenantIDs returns tenant ids sorted lexicographically.
 func (m *Memory) ListTenantIDs() ([]string, error) {
 	m.mu.RLock()

internal/store/peer_neighbor_test.go

@@ -19,9 +19,9 @@ func TestEffectivePeerEnabledOnCreate(t *testing.T) {
 
 func TestParsePeerNeighbor(t *testing.T) {
 	tests := []struct {
-		in      string
-		want    string
-		wantOK  bool
+		in     string
+		want   string
+		wantOK bool
 	}{
 		{"192.168.0.2", "192.168.0.2", true},
 		{"192.168.0.2/32", "192.168.0.2", true},

scripts/check-migrations-pair.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env sh
+# DEP-03: postgres and sqlite migration sets must have matching numbered pairs.
+set -eu
+
+ROOT="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+PG="$ROOT/migrations/postgres"
+SQL="$ROOT/migrations/sqlite"
+
+list_nums() {
+  dir="$1"
+  ls "$dir" 2>/dev/null | sed -n 's/^\([0-9]\{6\}\)_.*\.up\.sql$/\1/p' | sort -u
+}
+
+migration_only_in() {
+  # Prints numbers present in $1 but not in $2 (space-separated lists).
+  haystack="$2 "
+  for n in $1; do
+    case "$haystack" in
+      *" $n "*) ;;
+      *) echo "$n" ;;
+    esac
+  done
+}
+
+pg_nums="$(list_nums "$PG")"
+sql_nums="$(list_nums "$SQL")"
+
+if [ "$pg_nums" != "$sql_nums" ]; then
+  echo "check-migrations-pair: postgres and sqlite migration numbers differ" >&2
+  only_pg="$(migration_only_in "$pg_nums" "$sql_nums")"
+  only_sql="$(migration_only_in "$sql_nums" "$pg_nums")"
+  if [ -n "$only_pg" ]; then
+    echo "postgres only:" >&2
+    for n in $only_pg; do
+      echo "  $n" >&2
+    done
+  fi
+  if [ -n "$only_sql" ]; then
+    echo "sqlite only:" >&2
+    for n in $only_sql; do
+      echo "  $n" >&2
+    done
+  fi
+  exit 1
+fi
+
+for n in $pg_nums; do
+  pg_up=""
+  sql_up=""
+  for f in "$PG"/${n}_*.up.sql; do
+    if [ -f "$f" ]; then
+      pg_up="$f"
+      break
+    fi
+  done
+  for f in "$SQL"/${n}_*.up.sql; do
+    if [ -f "$f" ]; then
+      sql_up="$f"
+      break
+    fi
+  done
+  if [ -z "$pg_up" ] || [ -z "$sql_up" ]; then
+    echo "check-migrations-pair: missing .up.sql for $n" >&2
+    exit 1
+  fi
+  pg_base="$(basename "$pg_up" .up.sql)"
+  sql_base="$(basename "$sql_up" .up.sql)"
+  if [ "$pg_base" != "$sql_base" ]; then
+    echo "check-migrations-pair: name mismatch for $n: $pg_base vs $sql_base" >&2
+    exit 1
+  fi
+done
+
+echo "check-migrations-pair: ok ($PG and $SQL)"

scripts/lint-httpapi.sh

@@ -16,6 +16,14 @@ if grep -rE 'writeProblem\(w, http\.StatusBadGateway.*err\.Error\(\)' "$HTTPAPI"
   FAIL=1
 fi
 
+echo "==> ERR-01: no err.Error() in 4xx writeProblem (store/cdn/csv)"
+if grep -rE 'writeProblem\(w, http\.Status(NotFound|UnprocessableEntity|BadRequest).*, err\.Error\(\)' "$HTTPAPI" 2>/dev/null; then
+  FAIL=1
+fi
+if grep -rE 'writeStoreErr.*err\.Error|writeProblem.*Unprocessable.*err\.Error' "$HTTPAPI" 2>/dev/null; then
+  FAIL=1
+fi
+
 echo "==> ARCH-01: no SQL/pgx queries in httpapi"
 if grep -rE 'pool\.(Query|Exec|QueryRow)|SELECT |INSERT INTO |UPDATE .* SET |DELETE FROM ' "$HTTPAPI" 2>/dev/null; then
   FAIL=1

web/package-lock.json

@@ -14,7 +14,8 @@
 				"svelte-sonner": "^1.1.0",
 				"tailwind-merge": "^3.5.0",
 				"tailwind-variants": "^3.2.2",
-				"tw-animate-css": "^1.4.0"
+				"tw-animate-css": "^1.4.0",
+				"zod": "^4.4.3"
 			},
 			"devDependencies": {
 				"@internationalized/date": "^3.12.0",
@@ -3137,9 +3138,7 @@
 			"version": "4.4.3",
 			"resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
 			"integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
-			"dev": true,
 			"license": "MIT",
-			"optional": true,
 			"funding": {
 				"url": "https://github.com/sponsors/colinhacks"
 			}

web/package.json

@@ -39,6 +39,7 @@
 		"svelte-sonner": "^1.1.0",
 		"tailwind-merge": "^3.5.0",
 		"tailwind-variants": "^3.2.2",
-		"tw-animate-css": "^1.4.0"
+		"tw-animate-css": "^1.4.0",
+		"zod": "^4.4.3"
 	}
 }

web/src/lib/components/overview/OverviewRecentJobsCard.svelte

@@ -0,0 +1,94 @@
+<script lang="ts">
+	import { resolve } from '$app/paths';
+	import type { JobRow } from '$lib/api/types.js';
+	import { formatDateTime } from '$lib/modules/display.js';
+	import { jobKindTitle } from '$lib/operations/job-kind-label.js';
+	import { jobStatusRu, jobStatusBadgeVariant } from '$lib/ui-labels.js';
+	import { Badge } from '$lib/ui/core/badge/index.js';
+	import { Button } from '$lib/ui/core/button/index.js';
+	import {
+		Card,
+		CardContent,
+		CardHeader,
+		CardTitle,
+		CardDescription
+	} from '$lib/ui/core/card/index.js';
+	import AppDataTable from '$lib/ui/patterns/data-table/app-data-table.svelte';
+	import ArrowRight from '@lucide/svelte/icons/arrow-right';
+	import ExternalLink from '@lucide/svelte/icons/external-link';
+
+	type Props = {
+		items: JobRow[];
+		moduleNameById: ReadonlyMap<string, string>;
+		loading?: boolean;
+		initialLoading?: boolean;
+		error?: string | null;
+	};
+
+	let {
+		items,
+		moduleNameById,
+		loading = false,
+		initialLoading = false,
+		error = null
+	}: Props = $props();
+
+	const columns = [
+		{ id: 'kind', label: 'Вид', sortable: true, sortValue: (j: JobRow) => j.kind },
+		{
+			id: 'status',
+			label: 'Статус',
+			sortable: true,
+			sortValue: (j: JobRow) => j.status
+		},
+		{
+			id: 'created',
+			label: 'Создана',
+			sortable: true,
+			sortValue: (j: JobRow) => j.created_at ?? ''
+		},
+		{ id: 'actions', label: '', class: 'w-10' }
+	] as const;
+</script>
+
+<Card>
+	<CardHeader
+		class="flex flex-col gap-3 border-b py-3 sm:flex-row sm:items-center sm:justify-between"
+	>
+		<div class="min-w-0 flex-1">
+			<CardTitle class="text-base">Последние задачи</CardTitle>
+			<CardDescription>Фоновые задачи ingest, refresh и apply</CardDescription>
+		</div>
+		<Button variant="outline" size="sm" href={resolve('/operations?tab=jobs')}>
+			Все
+			<ArrowRight class="size-3.5" />
+		</Button>
+	</CardHeader>
+	<CardContent class="p-4 pt-0">
+		<AppDataTable
+			columns={[...columns]}
+			rows={items}
+			rowKey={(j) => j.job_id}
+			loading={initialLoading || loading}
+			{error}
+			emptyTitle="Нет задач"
+			emptyDescription="Задачи появятся после refresh или деплоя."
+		>
+			{#snippet cell({ row: j, column })}
+				{#if column.id === 'kind'}
+					<span class="font-medium">{jobKindTitle(j, moduleNameById)}</span>
+				{:else if column.id === 'status'}
+					<Badge variant={jobStatusBadgeVariant(j.status)}>{jobStatusRu(j.status)}</Badge>
+				{:else if column.id === 'created'}
+					<span class="text-xs whitespace-nowrap text-muted-foreground">
+						{formatDateTime(j.created_at)}
+					</span>
+				{:else if column.id === 'actions'}
+					<Button variant="ghost" size="icon-sm" href={resolve('/operations?tab=jobs')}>
+						<ExternalLink class="size-3.5" />
+					</Button>
+				{/if}
+			{/snippet}
+		</AppDataTable>
+	</CardContent>
+</Card>

web/src/lib/components/overview/OverviewRecentRevisionsCard.svelte

@@ -0,0 +1,89 @@
+<script lang="ts">
+	import { resolve } from '$app/paths';
+	import type { RevisionRow } from '$lib/api/types.js';
+	import { formatDateTime } from '$lib/modules/display.js';
+	import { Button } from '$lib/ui/core/button/index.js';
+	import {
+		Card,
+		CardContent,
+		CardHeader,
+		CardTitle,
+		CardDescription
+	} from '$lib/ui/core/card/index.js';
+	import AppDataTable from '$lib/ui/patterns/data-table/app-data-table.svelte';
+	import ArrowRight from '@lucide/svelte/icons/arrow-right';
+	import ExternalLink from '@lucide/svelte/icons/external-link';
+
+	type Props = {
+		items: RevisionRow[];
+		loading?: boolean;
+		initialLoading?: boolean;
+		error?: string | null;
+	};
+
+	let { items, loading = false, initialLoading = false, error = null }: Props = $props();
+
+	const columns = [
+		{
+			id: 'id',
+			label: 'ID',
+			sortable: true,
+			sortValue: (rev: RevisionRow) => rev.id
+		},
+		{
+			id: 'created',
+			label: 'Создана',
+			sortable: true,
+			sortValue: (rev: RevisionRow) => rev.created_at ?? ''
+		},
+		{
+			id: 'prefixes',
+			label: 'Префиксов',
+			sortable: true,
+			sortValue: (rev: RevisionRow) => rev.materialized_prefix_count ?? 0
+		},
+		{ id: 'actions', label: '', class: 'w-10' }
+	] as const;
+</script>
+
+<Card>
+	<CardHeader
+		class="flex flex-col gap-3 border-b py-3 sm:flex-row sm:items-center sm:justify-between"
+	>
+		<div class="min-w-0 flex-1">
+			<CardTitle class="text-base">Последние ревизии</CardTitle>
+			<CardDescription>Снимки конфигурации BIRD после обновления модулей</CardDescription>
+		</div>
+		<Button variant="outline" size="sm" href={resolve('/operations')}>
+			Все
+			<ArrowRight class="size-3.5" />
+		</Button>
+	</CardHeader>
+	<CardContent class="p-4 pt-0">
+		<AppDataTable
+			columns={[...columns]}
+			rows={items}
+			rowKey={(rev) => rev.id}
+			loading={initialLoading || loading}
+			{error}
+			emptyTitle="Нет ревизий"
+			emptyDescription="Ревизии появятся после обновления модулей."
+		>
+			{#snippet cell({ row: rev, column })}
+				{#if column.id === 'id'}
+					<span class="font-mono text-xs">{rev.id.slice(0, 8)}…</span>
+				{:else if column.id === 'created'}
+					<span class="text-sm whitespace-nowrap text-muted-foreground">
+						{formatDateTime(rev.created_at)}
+					</span>
+				{:else if column.id === 'prefixes'}
+					<span class="tabular-nums">{rev.materialized_prefix_count}</span>
+				{:else if column.id === 'actions'}
+					<Button variant="ghost" size="icon-sm" href={resolve('/operations')}>
+						<ExternalLink class="size-3.5" />
+					</Button>
+				{/if}
+			{/snippet}
+		</AppDataTable>
+	</CardContent>
+</Card>

web/src/lib/settings/settings-known.schema.ts

@@ -0,0 +1,79 @@
+import { z } from 'zod';
+
+function isValidIPv4(value: string): boolean {
+	const parts = value.split('.');
+	if (parts.length !== 4) return false;
+	for (const part of parts) {
+		if (!/^\d{1,3}$/.test(part)) return false;
+		if (part.length > 1 && part.startsWith('0')) return false;
+		const n = Number(part);
+		if (!Number.isInteger(n) || n < 0 || n > 255) return false;
+	}
+	return true;
+}
+
+function isValidIPv6(value: string): boolean {
+	if (!/^[0-9A-Fa-f:.]+$/.test(value)) return false;
+	if ((value.match(/::/g) ?? []).length > 1) return false;
+	const hasCompression = value.includes('::');
+	const [leftRaw, rightRaw = ''] = value.split('::');
+	const left = leftRaw === '' ? [] : leftRaw.split(':');
+	const right = rightRaw === '' ? [] : rightRaw.split(':');
+	if (left.some((part) => part === '') || right.some((part) => part === '')) return false;
+	let segments = [...left, ...right];
+	let ipv4TailSegments = 0;
+	const lastSegment = segments.at(-1);
+	if (lastSegment && lastSegment.includes('.')) {
+		if (!isValidIPv4(lastSegment)) return false;
+		segments = segments.slice(0, -1);
+		ipv4TailSegments = 2;
+	}
+	for (const segment of segments) {
+		if (!/^[0-9A-Fa-f]{1,4}$/.test(segment)) return false;
+	}
+	const totalSegments = segments.length + ipv4TailSegments;
+	if (hasCompression) return totalSegments < 8;
+	return totalSegments === 8;
+}
+
+const optionalIPv4 = (label: string) =>
+	z.string().refine((v) => v.trim() === '' || isValidIPv4(v.trim()), {
+		message: `Введите корректный IPv4 адрес (${label})`
+	});
+
+const optionalIPv6 = (label: string) =>
+	z.string().refine((v) => v.trim() === '' || isValidIPv6(v.trim()), {
+		message: `Введите корректный IPv6 адрес (${label})`
+	});
+
+export const settingsKnownSchema = z.object({
+	bird_router_id: optionalIPv4('router id'),
+	bird_local_ipv4: optionalIPv4('local IPv4'),
+	bird_local_ipv6: optionalIPv6('local IPv6'),
+	bird_local_asn: z.string().refine((v) => v.trim() === '' || /^[1-9]\d*$/.test(v.trim()), {
+		message: 'ASN должен быть целым числом больше 0'
+	}),
+	bird_bgp_source_ipv4: optionalIPv4('BGP source IPv4'),
+	bird_bgp_source_ipv6: optionalIPv6('BGP source IPv6'),
+	revision_retention_minutes: z.string().refine(
+		(v) => {
+			const s = v.trim();
+			if (s === '') return true;
+			const ttl = Number(s);
+			return /^\d+$/.test(s) && Number.isInteger(ttl) && ttl >= 15 && ttl <= 43200;
+		},
+		{ message: 'TTL ревизий должен быть целым числом от 15 до 43200 минут' }
+	)
+});
+
+export type SettingsKnownForm = z.infer<typeof settingsKnownSchema>;
+
+export const emptySettingsKnownForm = (): SettingsKnownForm => ({
+	bird_router_id: '',
+	bird_local_ipv4: '',
+	bird_local_ipv6: '',
+	bird_local_asn: '',
+	bird_bgp_source_ipv4: '',
+	bird_bgp_source_ipv6: '',
+	revision_retention_minutes: ''
+});

web/src/lib/ui/patterns/kpi/kpi-metrics-grid.svelte

@@ -0,0 +1,112 @@
+<script lang="ts">
+	import type { Component } from 'svelte';
+	import { Badge } from '$lib/ui/core/badge/index.js';
+	import { Button } from '$lib/ui/core/button/index.js';
+	import {
+		Card,
+		CardContent,
+		CardHeader,
+		CardTitle,
+		CardDescription
+	} from '$lib/ui/core/card/index.js';
+	import CardSkeleton from '$lib/ui/patterns/feedback/card-skeleton.svelte';
+	import { cn } from '$lib/utils.js';
+	import ArrowRight from '@lucide/svelte/icons/arrow-right';
+
+	export type KpiAccent = {
+		border: string;
+		bg: string;
+		iconBg: string;
+		iconText: string;
+	};
+
+	export type KpiCardItem = {
+		id: string;
+		label: string;
+		value: string;
+		description: string;
+		icon: Component;
+		accent: KpiAccent;
+		badge: string;
+		badgeClass?: string;
+		badgeVariant?: 'default' | 'secondary' | 'destructive' | 'outline';
+		valueClass?: string;
+		error?: string | null;
+		href?: string;
+	};
+
+	type Props = {
+		cards: KpiCardItem[];
+		loading?: boolean;
+		skeletonCount?: number;
+		class?: string;
+	};
+
+	let { cards, loading = false, skeletonCount = 3, class: className }: Props = $props();
+</script>
+
+<div class={cn('grid gap-4', className)}>
+	{#if loading}
+		{#each Array(skeletonCount) as _, i (i)}
+			<CardSkeleton />
+		{/each}
+	{:else}
+		{#each cards as card (card.id)}
+			{@const Icon = card.icon}
+			{@const a = card.accent}
+			<Card
+				class={cn(
+					'overflow-hidden border-l-4 shadow-sm',
+					card.href ? 'transition-colors hover:border-primary/35' : '',
+					a.border,
+					a.bg
+				)}
+			>
+				<CardHeader class="pb-2">
+					{#if card.href}
+						<div class="flex items-center justify-between gap-2">
+							<CardDescription class="flex min-w-0 items-center gap-2">
+								<span
+									class={cn(
+										'flex size-9 shrink-0 items-center justify-center rounded-lg',
+										a.iconBg
+									)}
+									aria-hidden="true"
+								>
+									<Icon class={cn('size-4', a.iconText)} />
+								</span>
+								<span class="truncate">{card.label}</span>
+							</CardDescription>
+							<Button variant="ghost" size="icon-sm" href={card.href}>
+								<ArrowRight class="size-3.5" aria-hidden="true" />
+							</Button>
+						</div>
+					{:else}
+						<CardDescription class="flex min-w-0 items-center gap-2">
+							<span
+								class={cn('flex size-9 shrink-0 items-center justify-center rounded-lg', a.iconBg)}
+								aria-hidden="true"
+							>
+								<Icon class={cn('size-4', a.iconText)} />
+							</span>
+							<span class="truncate">{card.label}</span>
+						</CardDescription>
+					{/if}
+					<CardTitle class={cn('font-bold tabular-nums', card.valueClass ?? 'text-3xl')}
+						>{card.value}</CardTitle
+					>
+				</CardHeader>
+				<CardContent class="space-y-2">
+					<Badge variant={card.badgeVariant ?? 'outline'} class={card.badgeClass}
+						>{card.badge}</Badge
+					>
+					{#if card.error}
+						<p class="text-xs text-destructive">{card.error}</p>
+					{:else}
+						<p class="text-xs text-muted-foreground">{card.description}</p>
+					{/if}
+				</CardContent>
+			</Card>
+		{/each}
+	{/if}
+</div>

web/src/routes/+page.svelte

@@ -1,25 +1,37 @@
 <script lang="ts">
 	import { onMount } from 'svelte';
-	import { apiJSON, apiFetch, apiPageAll } from '$lib/api/client.js';
+	import { resolve } from '$app/paths';
+	import { apiJSON, apiFetch } from '$lib/api/client.js';
 	import type {
+		ModuleRow,
 		ModulesResponse,
+		RevisionRow,
 		RevisionsResponse,
+		PeerRow,
 		PeersResponse,
+		SpeakerRow,
 		SpeakersResponse,
+		JobRow,
 		JobsResponse
 	} from '$lib/api/types.js';
-	import { Badge } from '$lib/components/ui/badge/index.js';
-	import { Button } from '$lib/components/ui/button/index.js';
+	import { Badge } from '$lib/ui/core/badge/index.js';
+	import { Button } from '$lib/ui/core/button/index.js';
 	import {
 		Card,
 		CardContent,
 		CardHeader,
 		CardTitle,
 		CardDescription
-	} from '$lib/components/ui/card/index.js';
+	} from '$lib/ui/core/card/index.js';
+	import { Alert, AlertDescription, AlertTitle } from '$lib/ui/core/alert/index.js';
+	import { Skeleton } from '$lib/ui/core/skeleton/index.js';
+	import CardSkeleton from '$lib/ui/patterns/feedback/card-skeleton.svelte';
+	import KpiMetricsGrid from '$lib/ui/patterns/kpi/kpi-metrics-grid.svelte';
+	import PageHeader from '$lib/ui/app/page-header/page-header.svelte';
+	import { notifyApiError } from '$lib/ui/app/toast.js';
+	import OverviewRecentJobsCard from '$lib/components/overview/OverviewRecentJobsCard.svelte';
+	import OverviewRecentRevisionsCard from '$lib/components/overview/OverviewRecentRevisionsCard.svelte';
 	import { cn } from '$lib/utils.js';
-	// eslint-disable-next-line @typescript-eslint/no-explicit-any
-	const resolve = (path: string) => path as any;
 	import CheckCircle from '@lucide/svelte/icons/check-circle';
 	import XCircle from '@lucide/svelte/icons/x-circle';
 	import Boxes from '@lucide/svelte/icons/boxes';
@@ -27,51 +39,34 @@
 	import Radio from '@lucide/svelte/icons/radio';
 	import Activity from '@lucide/svelte/icons/activity';
 	import Clock from '@lucide/svelte/icons/clock';
-	import ArrowRight from '@lucide/svelte/icons/arrow-right';
 	import LayoutDashboard from '@lucide/svelte/icons/layout-dashboard';
-	import PageHeader from '$lib/ui/app/page-header/page-header.svelte';
+	import Info from '@lucide/svelte/icons/info';
+	import RefreshCw from '@lucide/svelte/icons/refresh-cw';
+	import Plus from '@lucide/svelte/icons/plus';
+	import Tags from '@lucide/svelte/icons/tags';
+	import Share2 from '@lucide/svelte/icons/share-2';
+	import Play from '@lucide/svelte/icons/play';
+	import Gauge from '@lucide/svelte/icons/gauge';
 
 	let healthy = $state<boolean | null>(null);
-	let modules = $state(0);
-	let revisions = $state(0);
-	let peers = $state(0);
-	let speakers = $state(0);
+	let moduleItems = $state<ModuleRow[]>([]);
+	let modulesHasMore = $state(false);
+	let revisionItems = $state<RevisionRow[]>([]);
+	let revisionsHasMore = $state(false);
+	let peerItems = $state<PeerRow[]>([]);
+	let peersHasMore = $state(false);
+	let speakerItems = $state<SpeakerRow[]>([]);
+	let speakersHasMore = $state(false);
+	let jobItems = $state<JobRow[]>([]);
+	let recentJobs = $state<JobRow[]>([]);
+	let recentRevisions = $state<RevisionRow[]>([]);
 	let runningJobs = $state(0);
-	let loading = $state(true);
+	let initialLoading = $state(true);
+	let refreshing = $state(false);
+	let loadError = $state<string | null>(null);
+	let lastUpdated = $state<Date | null>(null);
 
-	async function countAll(path: string): Promise<number> {
-		const items = await apiPageAll<unknown>(path, 500);
-		return items.length;
-	}
-
-	onMount(async () => {
-		loading = true;
-		try {
-			const h = await apiFetch('/v1/health');
-			healthy = h.ok;
-		} catch {
-			healthy = false;
-		}
-		try {
-			const [mCount, rCount, pCount, sCount, j] = await Promise.all([
-				countAll('/v1/modules'),
-				countAll('/v1/revisions'),
-				countAll('/v1/peers'),
-				countAll('/v1/speakers'),
-				apiJSON<JobsResponse>('/v1/jobs?limit=100')
-			]);
-			modules = mCount;
-			revisions = rCount;
-			peers = pCount;
-			speakers = sCount;
-			runningJobs = (j.items ?? []).filter(
-				(i) => i.status === 'running' || i.status === 'queued'
-			).length;
-		} catch {
-			/* ignore */
-		}
-		loading = false;
-	});
+	const moduleNameById = $derived(new Map(moduleItems.map((m) => [m.id, m.name])));
 
 	const statAccents = [
 		{
@@ -106,123 +101,205 @@
 		}
 	] as const;
 
-	const stats = $derived([
+	function countBadge(count: number, hasMore: boolean, suffix: string) {
+		if (hasMore) return '200+';
+		return suffix;
+	}
+
+	const kpiCards = $derived.by(() => [
 		{
+			id: 'modules',
 			label: 'Модули',
-			value: modules,
-			href: '/modules',
+			value: initialLoading ? '—' : String(moduleItems.length),
+			href: '/modules' as const,
 			icon: Boxes,
 			description: 'AS, CDN, домены, IP',
-			accent: statAccents[0]
+			accent: statAccents[0],
+			badge: countBadge(moduleItems.length, modulesHasMore, 'в системе')
 		},
 		{
+			id: 'peers',
 			label: 'Пиры',
-			value: peers,
-			href: '/network',
+			value: initialLoading ? '—' : String(peerItems.length),
+			href: '/network' as const,
 			icon: GitBranch,
 			description: 'BGP-соседи',
-			accent: statAccents[1]
+			accent: statAccents[1],
+			badge: countBadge(peerItems.length, peersHasMore, 'peers')
 		},
 		{
+			id: 'speakers',
 			label: 'Спикеры',
-			value: speakers,
-			href: '/network',
+			value: initialLoading ? '—' : String(speakerItems.length),
+			href: '/network' as const,
 			icon: Radio,
 			description: 'BIRD-агенты',
-			accent: statAccents[2]
+			accent: statAccents[2],
+			badge: countBadge(speakerItems.length, speakersHasMore, 'agents')
 		},
 		{
+			id: 'revisions',
 			label: 'Ревизии',
-			value: revisions,
-			href: '/operations',
+			value: initialLoading ? '—' : String(revisionItems.length),
+			href: '/operations' as const,
 			icon: Activity,
 			description: 'История конфигураций',
-			accent: statAccents[3]
+			accent: statAccents[3],
+			badge: countBadge(revisionItems.length, revisionsHasMore, 'configs')
 		},
 		{
+			id: 'jobs',
 			label: 'Активных задач',
-			value: runningJobs,
-			href: '/operations',
+			value: initialLoading ? '—' : String(runningJobs),
+			href: '/operations?tab=jobs' as const,
 			icon: Clock,
-			description: 'Выполняются сейчас',
-			accent: statAccents[4]
+			description: 'queued и running в выборке',
+			accent: statAccents[4],
+			badge: 'running'
 		}
 	]);
+
+	async function load() {
+		if (!initialLoading) refreshing = true;
+		loadError = null;
+		try {
+			const [h, m, p, s, r, j] = await Promise.all([
+				apiFetch('/v1/health'),
+				apiJSON<ModulesResponse>('/v1/modules?limit=200'),
+				apiJSON<PeersResponse>('/v1/peers?limit=200'),
+				apiJSON<SpeakersResponse>('/v1/speakers?limit=200'),
+				apiJSON<RevisionsResponse>('/v1/revisions?limit=200'),
+				apiJSON<JobsResponse>('/v1/jobs?limit=20')
+			]);
+
+			healthy = h.ok;
+			moduleItems = m.items ?? [];
+			modulesHasMore = m.has_more;
+			peerItems = p.items ?? [];
+			peersHasMore = p.has_more;
+			speakerItems = s.items ?? [];
+			speakersHasMore = s.has_more;
+			revisionItems = r.items ?? [];
+			revisionsHasMore = r.has_more;
+			jobItems = j.items ?? [];
+			recentJobs = jobItems.slice(0, 10);
+			recentRevisions = revisionItems.slice(0, 10);
+			runningJobs = jobItems.filter((i) => i.status === 'running' || i.status === 'queued').length;
+			lastUpdated = new Date();
+		} catch (e) {
+			healthy = false;
+			loadError = e instanceof Error ? e.message : String(e);
+			notifyApiError(e);
+		} finally {
+			initialLoading = false;
+			refreshing = false;
+		}
+	}
+
+	onMount(load);
 </script>
 
 <div class="flex flex-col gap-6">
 	<PageHeader
 		title="Обзор"
-		description="Состояние панели управления EvoBGP."
+		description={lastUpdated
+			? `Состояние панели управления EvoBGP. Обновлено: ${lastUpdated.toLocaleTimeString('ru-RU')}`
+			: 'Состояние панели управления EvoBGP.'}
 		icon={LayoutDashboard}
 		iconClass="bg-primary/10 text-primary"
+	>
+		{#snippet actions()}
+			<Button variant="outline" size="sm" onclick={load} disabled={refreshing}>
+				<RefreshCw class={refreshing ? 'animate-spin' : ''} />
+				Обновить
+			</Button>
+		{/snippet}
+	</PageHeader>
+
+	<Alert class="border-info/30 bg-info/5">
+		<Info class="text-info" />
+		<AlertTitle>Панель управления EvoBGP</AlertTitle>
+		<AlertDescription>
+			Сводка по модулям, сети и фоновым задачам. Настройка префиксов — на странице
+			<Button variant="link" class="h-auto p-0" href={resolve('/modules')}>Модули</Button>, деплой и
+			ревизии —
+			<Button variant="link" class="h-auto p-0" href={resolve('/operations')}>Операции</Button>,
+			здоровье системы —
+			<Button variant="link" class="h-auto p-0" href={resolve('/monitoring')}>Мониторинг</Button>.
+		</AlertDescription>
+	</Alert>
+
+	{#if healthy === null}
+		<Alert>
+			<Skeleton class="size-5 rounded-full" />
+			<AlertTitle>Проверка API…</AlertTitle>
+			<AlertDescription>Запрос к <code class="text-xs">/v1/health</code></AlertDescription>
+		</Alert>
+	{:else if healthy}
+		<Alert class="border-success/30 bg-success/5">
+			<CheckCircle class="text-success" />
+			<AlertTitle>API работает</AlertTitle>
+			<AlertDescription>Сервер отвечает на запросы health-check.</AlertDescription>
+		</Alert>
+	{:else}
+		<Alert variant="destructive" class="border-destructive/30 bg-destructive/5">
+			<XCircle class="text-destructive" />
+			<AlertTitle>API недоступен</AlertTitle>
+			<AlertDescription>
+				Не удалось получить ответ от сервера. Проверьте подключение и статус API.
+			</AlertDescription>
+		</Alert>
+	{/if}
+
+	<KpiMetricsGrid
+		cards={kpiCards}
+		loading={initialLoading}
+		skeletonCount={5}
+		class="sm:grid-cols-2 lg:grid-cols-3"
 	/>
 
-	<!-- Health -->
-	<Card>
-		<CardContent class="flex items-center gap-3 py-4">
-			{#if healthy === null}
-				<div class="size-3 animate-pulse rounded-full bg-muted"></div>
-				<span class="text-sm text-muted-foreground">Проверка…</span>
-			{:else if healthy}
-				<CheckCircle class="size-5 text-green-500" />
-				<span class="font-medium text-green-700 dark:text-green-400">API работает</span>
-			{:else}
-				<XCircle class="size-5 text-red-500" />
-				<span class="font-medium text-red-700 dark:text-red-400">API недоступен</span>
-			{/if}
-		</CardContent>
-	</Card>
-
-	<!-- Stats grid -->
-	<div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
-		{#each stats as stat (stat.label)}
-			{@const Icon = stat.icon}
-			{@const a = stat.accent}
-			<Card
-				class={cn(
-					'overflow-hidden border-l-4 shadow-sm transition-colors hover:border-primary/35',
-					a.border,
-					a.bg
-				)}
-			>
-				<CardHeader class="pb-2">
-					<div class="flex items-center justify-between gap-2">
-						<CardDescription class="flex min-w-0 items-center gap-2">
-							<span
-								class={cn('flex size-9 shrink-0 items-center justify-center rounded-lg', a.iconBg)}
-								aria-hidden="true"
-							>
-								<Icon class={cn('size-4', a.iconText)} />
-							</span>
-							<span class="truncate">{stat.label}</span>
-						</CardDescription>
-						<Button variant="ghost" size="icon-sm" href={resolve(stat.href)}>
-							<ArrowRight class="size-3.5" aria-hidden="true" />
-						</Button>
-					</div>
-					<CardTitle class="text-3xl font-bold tabular-nums">
-						{loading ? '—' : stat.value}
-					</CardTitle>
-				</CardHeader>
-				<CardContent>
-					<p class="text-xs text-muted-foreground">{stat.description}</p>
-				</CardContent>
-			</Card>
-		{/each}
+	<div class="grid gap-4 lg:grid-cols-2">
+		<OverviewRecentJobsCard
+			items={recentJobs}
+			{moduleNameById}
+			loading={refreshing}
+			{initialLoading}
+			error={loadError}
+		/>
+		<OverviewRecentRevisionsCard
+			items={recentRevisions}
+			loading={refreshing}
+			{initialLoading}
+			error={loadError}
+		/>
 	</div>
 
-	<!-- Quick links -->
 	<Card>
-		<CardHeader>
+		<CardHeader class="border-b py-3">
 			<CardTitle class="text-base">Быстрые действия</CardTitle>
+			<CardDescription>Частые переходы к настройке и деплою</CardDescription>
 		</CardHeader>
-		<CardContent class="flex flex-wrap gap-2">
-			<Button variant="outline" size="sm" href={resolve('/modules')}>Создать модуль</Button>
-			<Button variant="outline" size="sm" href={resolve('/directories')}>Добавить community</Button>
-			<Button variant="outline" size="sm" href={resolve('/network')}>Добавить пира</Button>
-			<Button variant="outline" size="sm" href={resolve('/operations')}>Деплой (Apply)</Button>
-			<Button variant="outline" size="sm" href={resolve('/monitoring')}>Мониторинг</Button>
+		<CardContent class="flex flex-wrap gap-2 p-4 pt-4">
+			<Button variant="outline" size="sm" href={resolve('/modules')}>
+				<Plus class="size-4" />
+				Создать модуль
+			</Button>
+			<Button variant="outline" size="sm" href={resolve('/directories')}>
+				<Tags class="size-4" />
+				Добавить community
+			</Button>
+			<Button variant="outline" size="sm" href={resolve('/network')}>
+				<Share2 class="size-4" />
+				Добавить пира
+			</Button>
+			<Button variant="outline" size="sm" href={resolve('/operations')}>
+				<Play class="size-4" />
+				Деплой (Apply)
+			</Button>
+			<Button variant="outline" size="sm" href={resolve('/monitoring')}>
+				<Gauge class="size-4" />
+				Мониторинг
+			</Button>
 		</CardContent>
 	</Card>
 </div>

web/src/routes/directories/+page.svelte

@@ -20,6 +20,7 @@
 	import { Alert, AlertDescription, AlertTitle } from '$lib/ui/core/alert/index.js';
 	import { Tabs, TabsContent, TabsList, TabsTrigger } from '$lib/ui/core/tabs/index.js';
 	import CardSkeleton from '$lib/ui/patterns/feedback/card-skeleton.svelte';
+	import KpiMetricsGrid from '$lib/ui/patterns/kpi/kpi-metrics-grid.svelte';
 	import PageHeader from '$lib/ui/app/page-header/page-header.svelte';
 	import { notifyApiError } from '$lib/ui/app/toast.js';
 	import DirectoriesCommunitiesCard from '$lib/components/directories/DirectoriesCommunitiesCard.svelte';
@@ -169,53 +170,12 @@
 		</AlertDescription>
 	</Alert>
 
-	<div class="grid gap-4 sm:grid-cols-3">
-		{#if initialLoading}
-			{#each Array(3) as _, i (i)}
-				<CardSkeleton />
-			{/each}
-		{:else}
-			{#each kpiCards as card (card.id)}
-				{@const Icon = card.icon}
-				{@const a = card.accent}
-				<Card
-					class={cn(
-						'overflow-hidden border-l-4 shadow-sm transition-colors',
-						a.border,
-						a.bg,
-						card.href ? 'hover:border-primary/35' : ''
-					)}
-				>
-					<CardHeader class="pb-2">
-						<div class="flex items-center justify-between gap-2">
-							<CardDescription class="flex min-w-0 items-center gap-2">
-								<span
-									class={cn(
-										'flex size-9 shrink-0 items-center justify-center rounded-lg',
-										a.iconBg
-									)}
-									aria-hidden="true"
-								>
-									<Icon class={cn('size-4', a.iconText)} />
-								</span>
-								<span class="truncate">{card.label}</span>
-							</CardDescription>
-							{#if card.href}
-								<Button variant="ghost" size="icon-sm" href={resolve(card.href)}>
-									<ArrowRight class="size-3.5" aria-hidden="true" />
-								</Button>
-							{/if}
-						</div>
-						<CardTitle class="text-3xl font-bold tabular-nums">{card.value}</CardTitle>
-					</CardHeader>
-					<CardContent class="space-y-2">
-						<Badge variant="outline">{card.badge}</Badge>
-						<p class="text-xs text-muted-foreground">{card.description}</p>
-					</CardContent>
-				</Card>
-			{/each}
-		{/if}
-	</div>
+	<KpiMetricsGrid
+		cards={kpiCards}
+		loading={initialLoading}
+		skeletonCount={3}
+		class="sm:grid-cols-3"
+	/>
 
 	<Tabs value="communities">
 		<TabsList>

web/src/routes/modules/+page.svelte

@@ -22,6 +22,7 @@
 	import { Checkbox } from '$lib/ui/core/checkbox/index.js';
 	import AppDataTable from '$lib/ui/patterns/data-table/app-data-table.svelte';
 	import CardSkeleton from '$lib/ui/patterns/feedback/card-skeleton.svelte';
+	import KpiMetricsGrid from '$lib/ui/patterns/kpi/kpi-metrics-grid.svelte';
 	import PageHeader from '$lib/ui/app/page-header/page-header.svelte';
 	import { confirm } from '$lib/ui/patterns/confirm/confirm-state.svelte.js';
 	import { notify, notifyApiError } from '$lib/ui/app/toast.js';
@@ -217,36 +218,12 @@
 		</AlertDescription>
 	</Alert>
 
-	<div class="grid gap-4 sm:grid-cols-3">
-		{#if initialLoading}
-			{#each Array(3) as _, i (i)}
-				<CardSkeleton />
-			{/each}
-		{:else}
-			{#each kpiCards as card (card.id)}
-				{@const Icon = card.icon}
-				{@const a = card.accent}
-				<Card class={cn('overflow-hidden border-l-4 shadow-sm', a.border, a.bg)}>
-					<CardHeader class="pb-2">
-						<CardDescription class="flex min-w-0 items-center gap-2">
-							<span
-								class={cn('flex size-9 shrink-0 items-center justify-center rounded-lg', a.iconBg)}
-								aria-hidden="true"
-							>
-								<Icon class={cn('size-4', a.iconText)} />
-							</span>
-							<span class="truncate">{card.label}</span>
-						</CardDescription>
-						<CardTitle class="text-3xl font-bold tabular-nums">{card.value}</CardTitle>
-					</CardHeader>
-					<CardContent class="space-y-2">
-						<Badge variant="outline">{card.badge}</Badge>
-						<p class="text-xs text-muted-foreground">{card.description}</p>
-					</CardContent>
-				</Card>
-			{/each}
-		{/if}
-	</div>
+	<KpiMetricsGrid
+		cards={kpiCards}
+		loading={initialLoading}
+		skeletonCount={3}
+		class="sm:grid-cols-3"
+	/>
 
 	<Card>
 		<CardHeader class="flex flex-wrap items-center justify-between gap-2 border-b py-3">

web/src/routes/monitoring/+page.svelte

@@ -46,6 +46,7 @@
 		TableRow
 	} from '$lib/ui/core/table/index.js';
 	import CardSkeleton from '$lib/ui/patterns/feedback/card-skeleton.svelte';
+	import KpiMetricsGrid from '$lib/ui/patterns/kpi/kpi-metrics-grid.svelte';
 	import ScrollPreBlock from '$lib/components/app/scroll-pre-block.svelte';
 	import PageHeader from '$lib/ui/app/page-header/page-header.svelte';
 	import { cn } from '$lib/utils.js';
@@ -223,6 +224,7 @@
 			badge: version ? 'Загружена' : '—',
 			badgeVariant: version ? ('outline' as const) : ('secondary' as const),
 			badgeClass: undefined,
+			valueClass: 'font-mono text-xl',
 			error: versionError,
 			href: undefined
 		}
@@ -342,66 +344,12 @@
 		{/if}
 	{/if}
 
-	<div class="grid gap-4 sm:grid-cols-2 xl:grid-cols-4">
-		{#if initialLoading}
-			{#each Array(4) as _, i (i)}
-				<CardSkeleton />
-			{/each}
-		{:else}
-			{#each kpiCards as card (card.id)}
-				{@const Icon = card.icon}
-				{@const a = card.accent}
-				<Card
-					class={cn(
-						'overflow-hidden border-l-4 shadow-sm transition-colors',
-						a.border,
-						a.bg,
-						card.href ? 'hover:border-primary/35' : ''
-					)}
-				>
-					<CardHeader class="pb-2">
-						<div class="flex items-center justify-between gap-2">
-							<CardDescription class="flex min-w-0 items-center gap-2">
-								<span
-									class={cn(
-										'flex size-9 shrink-0 items-center justify-center rounded-lg',
-										a.iconBg
-									)}
-									aria-hidden="true"
-								>
-									<Icon class={cn('size-4', a.iconText)} />
-								</span>
-								<span class="truncate">{card.label}</span>
-							</CardDescription>
-							{#if card.href}
-								<Button variant="ghost" size="icon-sm" href={resolve(card.href)}>
-									<ArrowRight class="size-3.5" aria-hidden="true" />
-								</Button>
-							{/if}
-						</div>
-						<CardTitle
-							class={cn(
-								'font-bold tabular-nums',
-								card.id === 'version' ? 'font-mono text-xl' : 'text-3xl'
-							)}
-						>
-							{card.value}
-						</CardTitle>
-					</CardHeader>
-					<CardContent class="space-y-2">
-						<div class="flex items-center justify-between gap-2">
-							<Badge variant={card.badgeVariant} class={card.badgeClass}>{card.badge}</Badge>
-						</div>
-						{#if card.error}
-							<p class="text-xs text-destructive">{card.error}</p>
-						{:else}
-							<p class="text-xs text-muted-foreground">{card.description}</p>
-						{/if}
-					</CardContent>
-				</Card>
-			{/each}
-		{/if}
-	</div>
+	<KpiMetricsGrid
+		cards={kpiCards}
+		loading={initialLoading}
+		skeletonCount={4}
+		class="sm:grid-cols-2 xl:grid-cols-4"
+	/>
 
 	<div class="grid gap-4 lg:grid-cols-2">
 		{#if initialLoading}

web/src/routes/network/+page.svelte

@@ -15,6 +15,7 @@
 	import { Alert, AlertDescription, AlertTitle } from '$lib/ui/core/alert/index.js';
 	import { Tabs, TabsContent, TabsList, TabsTrigger } from '$lib/ui/core/tabs/index.js';
 	import CardSkeleton from '$lib/ui/patterns/feedback/card-skeleton.svelte';
+	import KpiMetricsGrid from '$lib/ui/patterns/kpi/kpi-metrics-grid.svelte';
 	import PageHeader from '$lib/ui/app/page-header/page-header.svelte';
 	import { notifyApiError } from '$lib/ui/app/toast.js';
 	import NetworkPeersCard from '$lib/components/network/NetworkPeersCard.svelte';
@@ -179,36 +180,12 @@
 		</AlertDescription>
 	</Alert>
 
-	<div class="grid gap-4 sm:grid-cols-3">
-		{#if initialLoading}
-			{#each Array(3) as _, i (i)}
-				<CardSkeleton />
-			{/each}
-		{:else}
-			{#each kpiCards as card (card.id)}
-				{@const Icon = card.icon}
-				{@const a = card.accent}
-				<Card class={cn('overflow-hidden border-l-4 shadow-sm', a.border, a.bg)}>
-					<CardHeader class="pb-2">
-						<CardDescription class="flex min-w-0 items-center gap-2">
-							<span
-								class={cn('flex size-9 shrink-0 items-center justify-center rounded-lg', a.iconBg)}
-								aria-hidden="true"
-							>
-								<Icon class={cn('size-4', a.iconText)} />
-							</span>
-							<span class="truncate">{card.label}</span>
-						</CardDescription>
-						<CardTitle class="text-3xl font-bold tabular-nums">{card.value}</CardTitle>
-					</CardHeader>
-					<CardContent class="space-y-2">
-						<Badge variant="outline" class={card.badgeClass}>{card.badge}</Badge>
-						<p class="text-xs text-muted-foreground">{card.description}</p>
-					</CardContent>
-				</Card>
-			{/each}
-		{/if}
-	</div>
+	<KpiMetricsGrid
+		cards={kpiCards}
+		loading={initialLoading}
+		skeletonCount={3}
+		class="sm:grid-cols-3"
+	/>
 
 	<Tabs value="peers">
 		<TabsList>

web/src/routes/operations/+page.svelte

@@ -60,6 +60,7 @@
 	} from '$lib/components/operations/types.js';
 	import ScrollPreBlock from '$lib/components/app/scroll-pre-block.svelte';
 	import CardSkeleton from '$lib/ui/patterns/feedback/card-skeleton.svelte';
+	import KpiMetricsGrid from '$lib/ui/patterns/kpi/kpi-metrics-grid.svelte';
 	import { confirm } from '$lib/ui/patterns/confirm/confirm-state.svelte.js';
 	import PageHeader from '$lib/ui/app/page-header/page-header.svelte';
 	import { notify, notifyApiError } from '$lib/ui/app/toast.js';
@@ -891,53 +892,12 @@
 		</AlertDescription>
 	</Alert>
 
-	<div class="grid gap-4 sm:grid-cols-3">
-		{#if initialLoading}
-			{#each Array(3) as _, i (i)}
-				<CardSkeleton />
-			{/each}
-		{:else}
-			{#each kpiCards as card (card.id)}
-				{@const Icon = card.icon}
-				{@const a = card.accent}
-				<Card
-					class={cn(
-						'overflow-hidden border-l-4 shadow-sm transition-colors',
-						a.border,
-						a.bg,
-						card.href ? 'hover:border-primary/35' : ''
-					)}
-				>
-					<CardHeader class="pb-2">
-						<div class="flex items-center justify-between gap-2">
-							<CardDescription class="flex min-w-0 items-center gap-2">
-								<span
-									class={cn(
-										'flex size-9 shrink-0 items-center justify-center rounded-lg',
-										a.iconBg
-									)}
-									aria-hidden="true"
-								>
-									<Icon class={cn('size-4', a.iconText)} />
-								</span>
-								<span class="truncate">{card.label}</span>
-							</CardDescription>
-							{#if card.href}
-								<Button variant="ghost" size="icon-sm" href={resolve(card.href)}>
-									<ArrowRight class="size-3.5" aria-hidden="true" />
-								</Button>
-							{/if}
-						</div>
-						<CardTitle class="text-3xl font-bold tabular-nums">{card.value}</CardTitle>
-					</CardHeader>
-					<CardContent class="space-y-2">
-						<Badge variant="outline" class={card.badgeClass}>{card.badge}</Badge>
-						<p class="text-xs text-muted-foreground">{card.description}</p>
-					</CardContent>
-				</Card>
-			{/each}
-		{/if}
-	</div>
+	<KpiMetricsGrid
+		cards={kpiCards}
+		loading={initialLoading}
+		skeletonCount={3}
+		class="sm:grid-cols-3"
+	/>
 
 	<OperationsQuickActions
 		{applying}

web/src/routes/schedule/+page.svelte

@@ -23,6 +23,7 @@
 	import { Tabs, TabsContent, TabsList, TabsTrigger } from '$lib/ui/core/tabs/index.js';
 	import AppDataTable from '$lib/ui/patterns/data-table/app-data-table.svelte';
 	import CardSkeleton from '$lib/ui/patterns/feedback/card-skeleton.svelte';
+	import KpiMetricsGrid from '$lib/ui/patterns/kpi/kpi-metrics-grid.svelte';
 	import PageHeader from '$lib/ui/app/page-header/page-header.svelte';
 	import { notify, notifyApiError } from '$lib/ui/app/toast.js';
 	import { cn } from '$lib/utils.js';
@@ -234,53 +235,12 @@
 		</AlertDescription>
 	</Alert>
 
-	<div class="grid gap-4 sm:grid-cols-3">
-		{#if initialLoading}
-			{#each Array(3) as _, i (i)}
-				<CardSkeleton />
-			{/each}
-		{:else}
-			{#each kpiCards as card (card.id)}
-				{@const Icon = card.icon}
-				{@const a = card.accent}
-				<Card
-					class={cn(
-						'overflow-hidden border-l-4 shadow-sm transition-colors',
-						a.border,
-						a.bg,
-						card.href ? 'hover:border-primary/35' : ''
-					)}
-				>
-					<CardHeader class="pb-2">
-						<div class="flex items-center justify-between gap-2">
-							<CardDescription class="flex min-w-0 items-center gap-2">
-								<span
-									class={cn(
-										'flex size-9 shrink-0 items-center justify-center rounded-lg',
-										a.iconBg
-									)}
-									aria-hidden="true"
-								>
-									<Icon class={cn('size-4', a.iconText)} />
-								</span>
-								<span class="truncate">{card.label}</span>
-							</CardDescription>
-							{#if card.href}
-								<Button variant="ghost" size="icon-sm" href={resolve(card.href)}>
-									<ArrowRight class="size-3.5" aria-hidden="true" />
-								</Button>
-							{/if}
-						</div>
-						<CardTitle class="text-3xl font-bold tabular-nums">{card.value}</CardTitle>
-					</CardHeader>
-					<CardContent class="space-y-2">
-						<Badge variant="outline" class={card.badgeClass}>{card.badge}</Badge>
-						<p class="text-xs text-muted-foreground">{card.description}</p>
-					</CardContent>
-				</Card>
-			{/each}
-		{/if}
-	</div>
+	<KpiMetricsGrid
+		cards={kpiCards}
+		loading={initialLoading}
+		skeletonCount={3}
+		class="sm:grid-cols-3"
+	/>
 
 	<Card>
 		<CardHeader>

web/src/routes/settings/+page.svelte

@@ -1,14 +1,22 @@
 <script lang="ts">
 	import { browser } from '$app/environment';
 	import { onMount } from 'svelte';
+	import { defaults, superForm } from 'sveltekit-superforms';
+	import { zod4 } from 'sveltekit-superforms/adapters';
 	import { TOKEN_STORAGE_KEY } from '$lib/api/client.js';
 	import { apiJSON, apiMutate } from '$lib/api/client.js';
 	import type { AppSettings } from '$lib/api/types.js';
-	import { Button } from '$lib/components/ui/button/index.js';
-	import { Card, CardContent, CardHeader, CardDescription } from '$lib/components/ui/card/index.js';
-	import { Input } from '$lib/components/ui/input/index.js';
-	import { Label } from '$lib/components/ui/label/index.js';
-	import { toast } from 'svelte-sonner';
+	import {
+		emptySettingsKnownForm,
+		settingsKnownSchema,
+		type SettingsKnownForm
+	} from '$lib/settings/settings-known.schema.js';
+	import { Button } from '$lib/ui/core/button/index.js';
+	import { Card, CardContent, CardHeader, CardDescription } from '$lib/ui/core/card/index.js';
+	import { Input } from '$lib/ui/core/input/index.js';
+	import { Label } from '$lib/ui/core/label/index.js';
+	import FormField from '$lib/ui/patterns/form/form-field.svelte';
+	import { notify, notifyApiError } from '$lib/ui/app/toast.js';
 	import Save from '@lucide/svelte/icons/save';
 	import Plus from '@lucide/svelte/icons/plus';
 	import SettingsIcon from '@lucide/svelte/icons/settings';
@@ -19,26 +27,10 @@
 	let apiSettings = $state<AppSettings | null>(null);
 	let loadingSettings = $state(false);
 	let savingSettings = $state(false);
-	let knownFields = $state({
-		bird_router_id: '',
-		bird_local_ipv4: '',
-		bird_local_ipv6: '',
-		bird_local_asn: '',
-		bird_bgp_source_ipv4: '',
-		bird_bgp_source_ipv6: '',
-		revision_retention_minutes: ''
-	});
 	let additionalSettings = $state<Array<{ id: number; key: string; value: string }>>([]);
 	let additionalIdCounter = $state(1);
 
-	type KnownFieldKey =
-		| 'bird_router_id'
-		| 'bird_local_ipv4'
-		| 'bird_local_ipv6'
-		| 'bird_local_asn'
-		| 'bird_bgp_source_ipv4'
-		| 'bird_bgp_source_ipv6'
-		| 'revision_retention_minutes';
+	type KnownFieldKey = keyof SettingsKnownForm;
 
 	type SettingsSection = 'token' | 'bird' | 'revisions' | 'additional';
 
@@ -52,6 +44,15 @@
 		'revision_retention_minutes'
 	];
 
+	const { form, errors, reset, validateForm } = superForm(
+		defaults(emptySettingsKnownForm(), zod4(settingsKnownSchema)),
+		{
+			validators: zod4(settingsKnownSchema),
+			SPA: true,
+			dataType: 'json'
+		}
+	);
+
 	let activeSection = $state<SettingsSection>('token');
 
 	const sectionItems: Array<{ id: SettingsSection; label: string; description: string }> = [
@@ -61,98 +62,7 @@
 		{ id: 'additional', label: 'Дополнительно', description: 'Ключ-значение' }
 	];
 
-	function isValidIPv4(value: string): boolean {
-		const parts = value.split('.');
-		if (parts.length !== 4) return false;
-		for (const part of parts) {
-			if (!/^\d{1,3}$/.test(part)) return false;
-			if (part.length > 1 && part.startsWith('0')) return false;
-			const n = Number(part);
-			if (!Number.isInteger(n) || n < 0 || n > 255) return false;
-		}
-		return true;
-	}
-
-	function isValidIPv6(value: string): boolean {
-		if (!/^[0-9A-Fa-f:.]+$/.test(value)) return false;
-		if ((value.match(/::/g) ?? []).length > 1) return false;
-
-		const hasCompression = value.includes('::');
-		const [leftRaw, rightRaw = ''] = value.split('::');
-		const left = leftRaw === '' ? [] : leftRaw.split(':');
-		const right = rightRaw === '' ? [] : rightRaw.split(':');
-
-		if (left.some((part) => part === '') || right.some((part) => part === '')) return false;
-
-		let segments = [...left, ...right];
-		let ipv4TailSegments = 0;
-		const lastSegment = segments.at(-1);
-		if (lastSegment && lastSegment.includes('.')) {
-			if (!isValidIPv4(lastSegment)) return false;
-			segments = segments.slice(0, -1);
-			ipv4TailSegments = 2;
-		}
-
-		for (const segment of segments) {
-			if (!/^[0-9A-Fa-f]{1,4}$/.test(segment)) return false;
-		}
-
-		const totalSegments = segments.length + ipv4TailSegments;
-		if (hasCompression) return totalSegments < 8;
-		return totalSegments === 8;
-	}
-
-	function isPositiveInt(value: string): boolean {
-		return /^[1-9]\d*$/.test(value);
-	}
-
-	let knownFieldErrors = $derived.by(() => {
-		const errors: Record<KnownFieldKey, string> = {
-			bird_router_id: '',
-			bird_local_ipv4: '',
-			bird_local_ipv6: '',
-			bird_local_asn: '',
-			bird_bgp_source_ipv4: '',
-			bird_bgp_source_ipv6: '',
-			revision_retention_minutes: ''
-		};
-
-		const routerId = String(knownFields.bird_router_id ?? '').trim();
-		if (routerId && !isValidIPv4(routerId)) errors.bird_router_id = 'Введите корректный IPv4 адрес';
-
-		const localV4 = String(knownFields.bird_local_ipv4 ?? '').trim();
-		if (localV4 && !isValidIPv4(localV4)) errors.bird_local_ipv4 = 'Введите корректный IPv4 адрес';
-
-		const localV6 = String(knownFields.bird_local_ipv6 ?? '').trim();
-		if (localV6 && !isValidIPv6(localV6)) errors.bird_local_ipv6 = 'Введите корректный IPv6 адрес';
-
-		const asn = String(knownFields.bird_local_asn ?? '').trim();
-		if (asn && !isPositiveInt(asn)) errors.bird_local_asn = 'ASN должен быть целым числом больше 0';
-
-		const bgpV4 = String(knownFields.bird_bgp_source_ipv4 ?? '').trim();
-		if (bgpV4 && !isValidIPv4(bgpV4)) errors.bird_bgp_source_ipv4 = 'Введите корректный IPv4 адрес';
-
-		const bgpV6 = String(knownFields.bird_bgp_source_ipv6 ?? '').trim();
-		if (bgpV6 && !isValidIPv6(bgpV6)) errors.bird_bgp_source_ipv6 = 'Введите корректный IPv6 адрес';
-
-		const revisionRetentionMinutes = String(knownFields.revision_retention_minutes ?? '').trim();
-		if (revisionRetentionMinutes) {
-			const ttl = Number(revisionRetentionMinutes);
-			if (
-				!/^\d+$/.test(revisionRetentionMinutes) ||
-				!Number.isInteger(ttl) ||
-				ttl < 15 ||
-				ttl > 43200
-			) {
-				errors.revision_retention_minutes =
-					'TTL ревизий должен быть целым числом от 15 до 43200 минут';
-			}
-		}
-
-		return errors;
-	});
-
-	let hasValidationErrors = $derived(knownFieldKeys.some((key) => Boolean(knownFieldErrors[key])));
+	let hasValidationErrors = $derived(knownFieldKeys.some((key) => Boolean($errors[key]?.length)));
 
 	function addAdditionalSetting() {
 		additionalSettings.push({ id: additionalIdCounter++, key: '', value: '' });
@@ -191,7 +101,7 @@
 			}
 		}
 
-		knownFields = parsedKnown;
+		reset({ data: parsedKnown });
 		additionalSettings = parsedAdditional;
 	}
 
@@ -200,7 +110,7 @@
 		const t = token.trim();
 		if (t) localStorage.setItem(TOKEN_STORAGE_KEY, t);
 		else localStorage.removeItem(TOKEN_STORAGE_KEY);
-		toast.success('Токен сохранён');
+		notify.success('Токен сохранён');
 	}
 
 	async function loadApiSettings() {
@@ -210,7 +120,7 @@
 			apiSettings = s;
 			resetFormFromApi(s);
 		} catch (e) {
-			toast.error(e instanceof Error ? e.message : String(e));
+			notifyApiError(e);
 		} finally {
 			loadingSettings = false;
 		}
@@ -220,8 +130,8 @@
 		if (loadingSettings || savingSettings || hasValidationErrors) return false;
 
 		const hasKnownValues = knownFieldKeys.some((key) => {
-			const value = String(knownFields[key] ?? '').trim();
-			return value !== '' && !knownFieldErrors[key];
+			const value = String($form[key] ?? '').trim();
+			return value !== '' && !$errors[key]?.length;
 		});
 		const hasAdditionalValues = additionalSettings.some((entry) => entry.key.trim() !== '');
 
@@ -229,15 +139,20 @@
 	});
 
 	async function saveApiSettings() {
+		const validation = await validateForm({ update: true });
+		if (!validation.valid) {
+			notify.error('Исправьте ошибки в полях настроек');
+			return;
+		}
 		if (!canSaveSettings) {
-			toast.error('Нечего сохранять или есть ошибки в полях');
+			notify.error('Нечего сохранять или есть ошибки в полях');
 			return;
 		}
 
 		const payload: Record<string, string | number> = {};
 		for (const key of knownFieldKeys) {
-			const value = String(knownFields[key] ?? '').trim();
-			if (!value || knownFieldErrors[key]) continue;
+			const value = String($form[key] ?? '').trim();
+			if (!value || $errors[key]?.length) continue;
 			if (key === 'bird_local_asn' || key === 'revision_retention_minutes')
 				payload[key] = Number(value);
 			else payload[key] = value;
@@ -251,10 +166,10 @@
 		savingSettings = true;
 		try {
 			await apiMutate('/v1/settings', 'PATCH', payload);
-			toast.success('Настройки сохранены');
+			notify.success('Настройки сохранены');
 			await loadApiSettings();
 		} catch (e) {
-			toast.error(e instanceof Error ? e.message : String(e));
+			notifyApiError(e);
 		} finally {
 			savingSettings = false;
 		}
@@ -335,106 +250,99 @@
 								<div class="space-y-3">
 									<h2 class="text-base font-semibold">Параметры BIRD</h2>
 
-									<div class="space-y-2">
-										<Label for="bird-router-id">Router ID (bird_router_id)</Label>
+									<FormField
+										id="bird-router-id"
+										label="Router ID (bird_router_id)"
+										error={$errors.bird_router_id?.[0]}
+									>
 										<Input
 											id="bird-router-id"
-											bind:value={knownFields.bird_router_id}
+											bind:value={$form.bird_router_id}
 											placeholder="203.0.113.1"
 										/>
-										{#if knownFieldErrors.bird_router_id}
-											<p class="text-sm text-red-600">{knownFieldErrors.bird_router_id}</p>
-										{/if}
-									</div>
+									</FormField>
 
-									<div class="space-y-2">
-										<Label for="bird-local-ipv4">Локальный IPv4 (bird_local_ipv4)</Label>
+									<FormField
+										id="bird-local-ipv4"
+										label="Локальный IPv4 (bird_local_ipv4)"
+										error={$errors.bird_local_ipv4?.[0]}
+									>
 										<Input
 											id="bird-local-ipv4"
-											bind:value={knownFields.bird_local_ipv4}
+											bind:value={$form.bird_local_ipv4}
 											placeholder="198.51.100.10"
 										/>
-										{#if knownFieldErrors.bird_local_ipv4}
-											<p class="text-sm text-red-600">{knownFieldErrors.bird_local_ipv4}</p>
-										{/if}
-									</div>
+									</FormField>
 
-									<div class="space-y-2">
-										<Label for="bird-local-ipv6">Локальный IPv6 (bird_local_ipv6)</Label>
+									<FormField
+										id="bird-local-ipv6"
+										label="Локальный IPv6 (bird_local_ipv6)"
+										error={$errors.bird_local_ipv6?.[0]}
+									>
 										<Input
 											id="bird-local-ipv6"
-											bind:value={knownFields.bird_local_ipv6}
+											bind:value={$form.bird_local_ipv6}
 											placeholder="2001:db8::10"
 										/>
-										{#if knownFieldErrors.bird_local_ipv6}
-											<p class="text-sm text-red-600">{knownFieldErrors.bird_local_ipv6}</p>
-										{/if}
-									</div>
+									</FormField>
 
-									<div class="space-y-2">
-										<Label for="bird-local-asn">Локальный ASN (bird_local_asn)</Label>
+									<FormField
+										id="bird-local-asn"
+										label="Локальный ASN (bird_local_asn)"
+										error={$errors.bird_local_asn?.[0]}
+									>
 										<Input
 											id="bird-local-asn"
 											type="number"
 											min="1"
-											bind:value={knownFields.bird_local_asn}
+											bind:value={$form.bird_local_asn}
 											placeholder="65001"
 										/>
-										{#if knownFieldErrors.bird_local_asn}
-											<p class="text-sm text-red-600">{knownFieldErrors.bird_local_asn}</p>
-										{/if}
-									</div>
+									</FormField>
 
-									<div class="space-y-2">
-										<Label for="bird-bgp-source-ipv4">BGP source IPv4 (bird_bgp_source_ipv4)</Label>
+									<FormField
+										id="bird-bgp-source-ipv4"
+										label="BGP source IPv4 (bird_bgp_source_ipv4)"
+										error={$errors.bird_bgp_source_ipv4?.[0]}
+									>
 										<Input
 											id="bird-bgp-source-ipv4"
-											bind:value={knownFields.bird_bgp_source_ipv4}
+											bind:value={$form.bird_bgp_source_ipv4}
 											placeholder="198.51.100.11"
 										/>
-										{#if knownFieldErrors.bird_bgp_source_ipv4}
-											<p class="text-sm text-red-600">{knownFieldErrors.bird_bgp_source_ipv4}</p>
-										{/if}
-									</div>
+									</FormField>
 
-									<div class="space-y-2">
-										<Label for="bird-bgp-source-ipv6">BGP source IPv6 (bird_bgp_source_ipv6)</Label>
+									<FormField
+										id="bird-bgp-source-ipv6"
+										label="BGP source IPv6 (bird_bgp_source_ipv6)"
+										error={$errors.bird_bgp_source_ipv6?.[0]}
+									>
 										<Input
 											id="bird-bgp-source-ipv6"
-											bind:value={knownFields.bird_bgp_source_ipv6}
+											bind:value={$form.bird_bgp_source_ipv6}
 											placeholder="2001:db8::11"
 										/>
-										{#if knownFieldErrors.bird_bgp_source_ipv6}
-											<p class="text-sm text-red-600">{knownFieldErrors.bird_bgp_source_ipv6}</p>
-										{/if}
-									</div>
+									</FormField>
 								</div>
 							{:else if activeSection === 'revisions'}
 								<div class="space-y-3">
 									<h2 class="text-base font-semibold">Управление ревизиями</h2>
 
-									<div class="space-y-2">
-										<Label for="revision-retention-minutes">
-											Время жизни ревизий, мин (revision_retention_minutes)
-										</Label>
+									<FormField
+										id="revision-retention-minutes"
+										label="Время жизни ревизий, мин (revision_retention_minutes)"
+										error={$errors.revision_retention_minutes?.[0]}
+										description="Старые ревизии удаляются автоматически. Последняя раскатанная ревизия не удаляется."
+									>
 										<Input
 											id="revision-retention-minutes"
 											type="number"
 											min="15"
 											max="43200"
-											bind:value={knownFields.revision_retention_minutes}
+											bind:value={$form.revision_retention_minutes}
 											placeholder="43200"
 										/>
-										{#if knownFieldErrors.revision_retention_minutes}
-											<p class="text-sm text-red-600">
-												{knownFieldErrors.revision_retention_minutes}
-											</p>
-										{/if}
-										<p class="text-sm text-muted-foreground">
-											Старые ревизии удаляются автоматически. Последняя раскатанная ревизия не
-											удаляется.
-										</p>
-									</div>
+									</FormField>
 								</div>
 							{:else if activeSection === 'additional'}
 								<div class="space-y-3">