diff --git a/.claude/agents/code-reviewer.md b/.claude/agents/code-reviewer.md
index 0a40ebe0..8b6548ee 100644
--- a/.claude/agents/code-reviewer.md
+++ b/.claude/agents/code-reviewer.md
@@ -14,7 +14,11 @@ Senior reviewer for NeoBoard. Check staged/unstaged changes against rules, then
 1. Run `git diff` and `git diff --cached` to get all changes.
 2. Read each changed file to understand full context.
 3. Check against the rules below.
-4. After code review, run `cd app && npm test` and `cd component && npm test` to verify tests pass.
+4. After code review, run tests:
+   - `cd app && npm test` (unit)
+   - `cd component && npm test` (unit)
+   - **`cd app && npx playwright test`** (E2E — ALWAYS, per memory rule; not optional)
+   - Run `cd connection && npm test` if connection/ changed (needs Docker).
 5. Check external review feedback:
    - CodeRabbit: `gh pr view --comments | grep -A10 'coderabbitai'`
    - SonarCloud: `gh pr checks` — verify quality gate passes
diff --git a/.claude/agents/test-runner.md b/.claude/agents/test-runner.md
index 62bcbcb6..dba9a598 100644
--- a/.claude/agents/test-runner.md
+++ b/.claude/agents/test-runner.md
@@ -9,11 +9,11 @@ You are a test runner agent for the NeoBoard monorepo.
 ## Steps
 
 1. Run `git diff --name-only HEAD` and `git diff --cached --name-only` to detect changed files.
-2. Check that Docker is running.
+2. Check Docker state: `docker ps --format '{{.Names}}: {{.Status}}'`. If E2E will run, first destroy all containers (memory rule: "Destroy Docker before E2E") then `docker compose up -d` and wait for healthchecks.
 3. Determine which packages are affected:
-   - Files under `app/` → run `cd app && npm test` and `cd app && npx playwright test` (only if Docker is available)
+   - Files under `app/` → run `cd app && npm test` and **ALWAYS `cd app && npx playwright test`** (E2E is not optional; if Docker is unavailable, fail loudly — don't silently skip)
    - Files under `component/` → run `cd component && npm test`
-   - Files under `connection/` → run `cd connection && npm test` (only if Docker is available)
+   - Files under `connection/` → run `cd connection && npm test` (requires Docker; fail loudly if absent)
 4. If no changes detected, ask which package to test or run all.
 5. Run the relevant test suites.
 
diff --git a/.claude/agents/user-sim-creator.md b/.claude/agents/user-sim-creator.md
index 52c87da6..c4f89fb5 100644
--- a/.claude/agents/user-sim-creator.md
+++ b/.claude/agents/user-sim-creator.md
@@ -33,7 +33,7 @@ npx @playwright/cli resize 1280 720
 
 ## Your Session
 
-Login as creator: `bob@example.com` / `password123`
+Login as creator: `creator@neoboard.local` / `creator123` (seeded by `neoboard demo` once #921 ships; if absent, sign up via `/signup` then assign role=creator as admin in a setup step)
 
 ### Task 1: First Impressions
 
diff --git a/.claude/agents/ux-crawler.md b/.claude/agents/ux-crawler.md
index 4c3af093..9c91befd 100644
--- a/.claude/agents/ux-crawler.md
+++ b/.claude/agents/ux-crawler.md
@@ -53,7 +53,7 @@ Test with these personas in order. Close and reopen the browser between personas
 
 ### Persona 2: Creator (standard user)
 
-- Login: `bob@example.com` / `password123`
+- Login: `creator@neoboard.local` / `creator123` (seeded by `neoboard demo`; if absent, sign up via `/signup` then assign role=creator as admin in a setup step)
 - Tests: Dashboard CRUD, widget editing, query execution
 
 ### Persona 3: Unauthorized (no session)
diff --git a/.claude/skills/code/SKILL.md b/.claude/skills/code/SKILL.md
index f436cf6f..9e566ecd 100644
--- a/.claude/skills/code/SKILL.md
+++ b/.claude/skills/code/SKILL.md
@@ -42,6 +42,13 @@ Do NOT write implementation before the test. Do NOT skip this for "small" change
 cd app && npx next lint --fix
 npm run build
 cd app && npm test
+cd app && npx playwright test          # ALWAYS run E2E — not optional
 ```
 
+## Branching
+
+- Default base: `dev`
+- **Exception**: when a `release/X.Y` branch is active (see [memory](../../../.claude/projects/-Users-alfredorubin-Desktop-public/memory/project_release_1_1_active.md) or check `git branch -r | grep 'origin/release/'`), branch from and PR into the active release branch instead of `dev`.
+- Verify base with: `git ls-remote --heads origin 'release/*' | head -1`
+
 $ARGUMENTS = task description or issue number.
diff --git a/.claude/skills/deploy/SKILL.md b/.claude/skills/deploy/SKILL.md
new file mode 100644
index 00000000..dadee172
--- /dev/null
+++ b/.claude/skills/deploy/SKILL.md
@@ -0,0 +1,265 @@
+---
+name: deploy
+description: Production-deployment audit — fresh stand-up, secrets, backup/restore, migrations, observability. Capture gaps as GitHub issues; do NOT fix in place.
+model: sonnet
+user-invokable: true
+allowed-tools: Read, Write, Bash(docker *), Bash(docker-compose *), Bash(npm *), Bash(npx *), Bash(curl *), Bash(gh *), Bash(git *), Bash(cat *), Bash(ls *), Bash(find *), Bash(grep *), Bash(head *), Bash(tail *), Bash(jq *), Bash(node *), Bash(openssl *), Bash(psql *), Bash(pg_dump *), Bash(pg_isready *), Bash(sleep *), Bash(echo *), Bash(mkdir *), Bash(cp *), Bash(mv *), Bash(rm *)
+---
+
+# Deploy — Production Readiness Audit
+
+**Goal**: someone clones the repo, follows the docs, deploys to production, and doesn't lose data or get pwned.
+
+**Operating principle**: this skill is a **read-and-record** audit. Don't fix in place. File every gap as a GitHub issue on `alfredo1996/neoboard` with concrete repro steps and proposed fix. Fixes happen in their own PRs per the [one-PR-per-issue rule](../../../.claude/projects/-Users-alfredorubin-Desktop-public/memory/feedback_pr_per_issue.md).
+
+If $ARGUMENTS contains an umbrella issue number (e.g. `/deploy 895`), link every filed issue to that umbrella in the body and as a comment.
+
+## Destructive-step approval gate (MANDATORY)
+
+This skill includes operations that destroy or rewrite real state: container/volume teardown, DB restore drills, secret rotation, migration runs. **Before running ANY command tagged `⚠️ DESTRUCTIVE` below, you MUST**:
+
+1. Stop and use `AskUserQuestion` to confirm with the user. Show them the exact command, what it will destroy, and what state it leaves the system in if you abort.
+2. If the user declines, **skip the entire sub-section** that command belongs to and add a note to the final report ("Section X.Y not exercised — user declined destructive step.")
+3. Never chain destructive steps without re-asking between them.
+
+Read-only inspection (`docker ps`, `cat`, `grep`, `curl`, `gh issue create`) does NOT require approval — only the gated ⚠️ commands.
+
+## Pre-conditions
+
+- Clean Docker state (stop + rm all containers — memory rule "destroy Docker before E2E" applies; same here for a true cold start)
+- A scratch directory outside the repo for backup/restore drills (e.g. `/tmp/neoboard-deploy-audit-<date>/`)
+- Network access to the repo and to docker hub
+
+## Phase 1 — Cold-start audit (~30 min)
+
+Verify the prod compose stack actually starts from zero.
+
+⚠️ **DESTRUCTIVE — requires approval gate before running**. This tears down every container and volume on the machine.
+
+```bash
+# Confirm with user FIRST. Then:
+docker stop $(docker ps -aq) 2>/dev/null || true
+docker rm $(docker ps -aq) 2>/dev/null || true
+docker volume ls -q | xargs -r docker volume rm 2>/dev/null || true
+```
+
+Read-only inspection (always safe):
+
+```bash
+# Inspect the prod compose files (two exist: prod.yml + prod-full.yml)
+ls docker/docker-compose.prod*.yml
+cat docker/docker-compose.prod.yml
+cat docker/docker-compose.prod-full.yml
+```
+
+**Capture as issues**:
+
+- Required env vars that the compose file expects but `app/.env.example` doesn't list
+- Services with no healthchecks
+- Services missing resource limits (CPU/memory)
+- Volumes without explicit backup paths documented
+- Hard-coded `localhost` / dev-only values in a "prod" file
+- Image tags pinned to `:latest` (should be specific version)
+
+⚠️ **DESTRUCTIVE — requires approval gate before running**. This starts a real prod stack; subsequent steps depend on it.
+
+```bash
+# Confirm with user FIRST. Then:
+# Try to stand up using ONLY the documented procedure (no shortcuts)
+# Start from docs/src/content/docs/getting-started/ — whatever the docs say to do
+# If docs are missing, that itself is a finding.
+
+cd docker
+docker compose -f docker-compose.prod.yml --env-file ../app/.env.local.audit up -d
+sleep 30
+docker compose -f docker-compose.prod.yml ps
+docker compose -f docker-compose.prod.yml logs --tail 50 app  # or whatever the app service is named
+```
+
+**Capture as issues**:
+
+- Stack fails to start with a fresh `.env`
+- App starts but immediately errors (DB connection, missing migrations, etc.)
+- "ready" signal is silent (per [feedback_cli_ready_signal](../../../.claude/projects/-Users-alfredorubin-Desktop-public/memory/feedback_cli_ready_signal.md))
+- Healthcheck endpoint doesn't return 200 within reasonable time
+- Log noise (warnings, missing-env spam)
+
+## Phase 2 — Deployment checklist walk-through (~20 min)
+
+Walk every checkbox in `docs/src/content/docs/administration/deployment-checklist.mdx` against current code reality.
+
+```bash
+cat docs/src/content/docs/administration/deployment-checklist.mdx
+```
+
+For every checkbox, verify the **code actually requires what the docs say**:
+
+- For each env var listed: is it actually read by the code? (`grep -rn "process.env.VAR_NAME" app/src`)
+- For each "required" var: is it enforced at startup? (check `app/src/lib/env-config.ts`)
+- For each "recommended" infra setting: does the code actually use it?
+
+**Capture as issues**:
+
+- Env vars listed in checklist but never referenced in code (stale doc)
+- Env vars required by code but missing from checklist (incomplete doc)
+- "Required" vars marked as optional in code's env-config (mismatch — see #907)
+- Resource limits / network policies the docs prescribe but code never validates
+
+## Phase 3 — Operational drills (~45 min)
+
+The procedures in admin docs must actually work. Run them.
+
+### 3a. Secret rotation
+
+⚠️ **DESTRUCTIVE — requires approval gate**. Rotating `ENCRYPTION_KEY` against a live DB rewrites encrypted credentials. If the rotation procedure is broken, ALL stored connection credentials can become unrecoverable. Do this against a scratch DB created specifically for the drill, not anything you care about.
+
+```bash
+# Confirm with user FIRST, including which DB this targets. Then:
+# Rotate ENCRYPTION_KEY following docs/src/content/docs/administration/*
+# Verify: existing encrypted credentials decrypt with the old key, re-encrypt with new
+# Verify: docs warn that mid-flight rotation requires a re-encryption step
+```
+
+**Capture as issues**:
+
+- Docs don't have a rotation procedure for a given secret
+- Procedure exists but fails when followed
+- Rotation invalidates user-facing state silently (e.g. all API keys die without warning — see #907 acceptance criteria)
+
+### 3b. Backup / restore
+
+Read-only first:
+
+```bash
+cat docs/src/content/docs/administration/backup-restore.mdx
+```
+
+⚠️ **DESTRUCTIVE — requires approval gate**. `down -v` destroys the DB volume. If the drill is run against the wrong stack, real data is lost. Run only against the audit-scratch stack, never a live one.
+
+```bash
+# Confirm with user FIRST, showing which compose file and which volume. Then:
+# Drill: take a backup, destroy the DB, restore, verify nothing lost
+pg_dump -h localhost -U neoboard neoboard > /tmp/neoboard-deploy-audit/backup.sql
+docker compose -f docker/docker-compose.prod.yml down -v   # destroys DB volume
+docker compose -f docker/docker-compose.prod.yml up -d postgres
+sleep 10
+psql -h localhost -U neoboard -d neoboard < /tmp/neoboard-deploy-audit/backup.sql
+# Verify: bring app back up, log in, dashboards present, connections present
+```
+
+**Capture as issues**:
+
+- Backup procedure missing a step (e.g. doesn't capture migration version table)
+- Restore fails on a fresh DB (e.g. extension dependencies, FK ordering)
+- Encrypted credential blob doesn't round-trip (lost ENCRYPTION_KEY ↔ new install)
+- No documented retention/rotation strategy
+
+### 3c. Migration upgrade path
+
+Read-only first:
+
+```bash
+# Check forward-only enforcement
+cat app/src/lib/db/migrate.ts | head -60
+ls app/src/lib/db/migrations/
+```
+
+⚠️ **DESTRUCTIVE — requires approval gate**. Running migrations against a DB modifies schema. Use the audit-scratch DB, not anything you care about.
+
+```bash
+# Confirm with user FIRST. Then:
+# Drill: start with an older migration set, run npm run db:migrate, verify advisory lock + idempotency
+```
+
+**Capture as issues**:
+
+- Migration runner missing the advisory lock (memory rule: "Advisory lock prevents concurrent runs")
+- `--skip-migrations` flag missing or undocumented
+- No version-skip test path (can a v0.5 → v1.1 install succeed?)
+- Rollback story undocumented (forward-only is fine, but operators need to know that)
+
+## Phase 4 — Observability (~15 min)
+
+Verify operators can actually monitor a deployed instance.
+
+```bash
+# Health endpoint
+curl -s http://localhost:3000/api/health | jq
+cat app/src/app/api/health/route.ts
+
+# Logs — what does production output look like?
+docker logs <app-container> --tail 100
+# Is there structured JSON? Levels? Request IDs?
+
+# Monitoring doc
+cat docs/src/content/docs/administration/monitoring.mdx
+```
+
+**Capture as issues**:
+
+- `/api/health` returns 200 even when DB is down (false healthy)
+- Health response doesn't include version / migration status / connector status
+- Logs are unstructured / lack request IDs
+- monitoring.mdx references metrics/dashboards that don't exist
+- No `/metrics` endpoint (Prometheus expectation)
+- No example Grafana dashboard / Datadog template / etc.
+
+## Phase 5 — TLS / reverse proxy / multi-tenancy (~15 min)
+
+```bash
+# What does the app expect from the reverse proxy?
+grep -rn "X-Forwarded-Proto\|X-Forwarded-For\|trustProxy\|FORCE_HTTPS" app/src
+
+# SaaS vs on-prem — memory rule: env vars only, never code branches
+grep -rnE "process\.env\.(SAAS|ON_PREM|DEPLOYMENT_MODE)" app/src
+```
+
+**Capture as issues**:
+
+- `FORCE_HTTPS` documented but not actually wired up
+- No example reverse-proxy configs (nginx/Caddy/Traefik) in docs
+- Code branches on deployment mode (violates memory rule)
+- Tenant isolation not verifiable end-to-end (per Phase 7 of the polish plan — query safety)
+
+## Phase 6 — Compile findings
+
+Output a numbered list:
+
+```
+## Deployment audit findings (YYYY-MM-DD)
+
+### Phase 1 — Cold start
+- [ ] #NNN — <title>
+...
+
+### Phase 2 — Checklist
+...
+
+### Phase 3 — Drills
+...
+
+### Phase 4 — Observability
+...
+
+### Phase 5 — TLS/proxy/multi-tenancy
+...
+```
+
+File each as a GH issue using the [issue skill](../issue/skill.md):
+
+- Labels: type + `pkg:app` + `area:devex` or `area:release` + (often) `documentation`
+- Title prefix `[P0]` for ship blockers (stack won't start, data loss possible), `[P1]` for serious correctness gaps, `[P2]` for QoL / completeness
+- Body must include exact repro from the audit + proposed fix shape
+- Link to the umbrella issue passed in $ARGUMENTS if any
+
+## Post-audit
+
+- Print the count: "Audit complete: N issues filed across 5 phases. M P0, X P1, Y P2."
+- Append a summary comment to the umbrella issue
+- Do NOT proceed to fixes in this skill — fixes happen in their own PRs
+
+## When NOT to use this skill
+
+- Mid-development; not a code-correctness audit (use `code-reviewer` + `harden`)
+- For a single feature deploy story (this is whole-system)
+- When the prod compose is known broken (fix first, audit second)
diff --git a/.claude/skills/github-workflow/SKILL.md b/.claude/skills/github-workflow/SKILL.md
index a978e5f6..6595a519 100644
--- a/.claude/skills/github-workflow/SKILL.md
+++ b/.claude/skills/github-workflow/SKILL.md
@@ -1,13 +1,24 @@
 ---
-name: github
+name: github-workflow
 description: GitHub conventions, labels, branching for NeoBoard.
 model: haiku
 ---
 
-# Branch: feat/, fix/, chore/, docs/, refactor/, security/
+# Branches
 
-# Commits: type(scope): description
+- Prefixes: `feat/`, `fix/`, `chore/`, `docs/`, `refactor/`, `security/`
+- Default base: `dev`. **Exception**: when a `release/X.Y` branch is active, branch from + PR to it instead.
 
-# Scopes: app, component, connection, auth, encryption, migration, api, widget, chart
+# Commits
 
-# Labels: type (bug/enhancement/security/...) + package (pkg:app/pkg:component/pkg:connection) + area
+`type(scope): description`
+
+- Types: feat, fix, chore, docs, refactor, security, perf, test
+- Scopes: app, component, connection, cli, auth, encryption, migration, api, widget, chart
+
+# Labels (apply type + package + area)
+
+- **Type**: bug, enhancement, security, documentation, performance, urgent, breaking-change, refactor, tech-debt, chore, question
+- **Package**: pkg:app, pkg:component, pkg:connection, pkg:cli
+- **Area**: area:auth, area:connectors, area:widgets, area:charts, area:query-exec, area:dashboard, area:api, area:a11y, area:params, area:table, area:design, area:devex, area:typography, area:motion, area:ci, area:release
+- **Special**: enterprise, release-blocker, blocked, backlog, good first issue, claude, dependencies
diff --git a/.claude/skills/issue/SKILL.md b/.claude/skills/issue/SKILL.md
index a065fa13..24252ce9 100644
--- a/.claude/skills/issue/SKILL.md
+++ b/.claude/skills/issue/SKILL.md
@@ -15,7 +15,7 @@ Scopes: app, component, connection, auth, encryption, migration, api, widget, ch
 
 Labels — always apply type + package + area:
 
-- Type: bug, enhancement, security, documentation, performance, urgent
-- Package: pkg:app, pkg:component, pkg:connection
-- Area: area:auth, area:connectors, area:widgets, area:charts, area:query-exec, area:dashboard, area:api
-- Special: enterprise, breaking-change, good-first-issue
+- **Type**: bug, enhancement, security, documentation, performance, urgent, breaking-change, refactor, tech-debt, chore, question
+- **Package**: pkg:app, pkg:component, pkg:connection, pkg:cli
+- **Area**: area:auth, area:connectors, area:widgets, area:charts, area:query-exec, area:dashboard, area:api, area:a11y, area:params, area:table, area:design, area:devex, area:typography, area:motion, area:ci, area:release
+- **Special**: enterprise, release-blocker, blocked, backlog, good first issue, claude, dependencies
diff --git a/.claude/skills/next/SKILL.md b/.claude/skills/next/SKILL.md
index 36ba5410..8139b540 100644
--- a/.claude/skills/next/SKILL.md
+++ b/.claude/skills/next/SKILL.md
@@ -29,12 +29,19 @@ If $ARGUMENTS is a number, use that issue instead of picking.
 
 ```bash
 gh issue edit <number> --add-assignee @me
-git checkout dev && git pull origin dev
+
+# Detect the active base branch: release/X.Y if one exists, else dev
+BASE=$(git ls-remote --heads origin 'release/*' 2>/dev/null | awk -F/ '{print $NF}' | sort -V | tail -1)
+BASE="${BASE:-dev}"
+git fetch origin "$BASE" && git checkout "$BASE" && git pull origin "$BASE"
 git checkout -b <type>/<short-description>
+echo "Branched from: $BASE (target this base in your PR)"
 ```
 
 Branch prefix from labels: bug → fix/, enhancement → feat/, security → security/, docs → docs/.
 
+PR base = same `$BASE` detected above (release/X.Y when active, else dev).
+
 ## Step 3 — Run /drill
 
 Before implementing, run `/drill <number>` to gather requirements, edge cases, and acceptance criteria. This is mandatory per CLAUDE.md.
diff --git a/CLAUDE.md b/CLAUDE.md
index ca8e9f57..de77e2c8 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -96,7 +96,7 @@ Playwright E2E with **server-side coverage collection** (`collectServer: true` i
 - **Exception**: when a `release/X.Y` branch is active, branch from and target it instead of `dev`.
 - PRs target `dev` (integration) before merging to `main`.
 - Do not push if tests are failing.
-- PRs need labels: type + package + area. See `/github` skill.
+- PRs need labels: type + package + area. See `/github-workflow` skill.
 - After finishing: PR targeting `dev`, correct milestone/labels, link issue via `Closes #N`.
 
 **PR reviews:**
@@ -184,7 +184,7 @@ Agents work together in a pipeline. Each stage gates the next:
 1. **`project-architect`** — Plans features (impact analysis, risk, task breakdown)
 2. **`/code` skill** — Implements the plan
 3. **`test-runner`** + **`lint-fix`** — Verify code compiles, lints, tests pass
-4. **`code-reviewer`** — Reviews code for security, architecture, quality. Runs tests.
+4. **`code-reviewer`** — Reviews code for security, architecture, quality. Runs unit + E2E tests.
 5. **`feature-reviewer`** — Opens the browser (Playwright CLI), tests the feature UX + functionality
 6. **`ux-crawler`** — Full app regression: simulates admin/creator/reader across all user stories
 
diff --git a/app/e2e/dashboard-portability.spec.ts b/app/e2e/dashboard-portability.spec.ts
index 9438077b..7f3d7336 100644
--- a/app/e2e/dashboard-portability.spec.ts
+++ b/app/e2e/dashboard-portability.spec.ts
@@ -108,7 +108,11 @@ test.describe("Dashboard import", () => {
       await expect(importBtn).toBeEnabled({ timeout: 5_000 });
       await importBtn.click();
 
-      // Should redirect to the imported dashboard
+      // Post-success view replaces the form (no auto-redirect). Click
+      // "View dashboard" to navigate to the imported one.
+      await page
+        .getByRole("button", { name: "View dashboard" })
+        .click({ timeout: 15_000 });
       await page.waitForURL(/\/[\w-]+$/, { timeout: 15_000 });
 
       // The dashboard should render content
@@ -162,15 +166,21 @@ test.describe("NeoDash legacy import", () => {
     await expect(dialog.getByText("E2E NeoDash Import Test")).toBeVisible();
     await expect(dialog.getByText("8 widgets")).toBeVisible();
 
-    // No connection mapping should appear (NeoDash skips it)
-    await expect(dialog.getByText("Map each connection")).not.toBeVisible();
+    // NeoDash imports now synthesize a single Neo4j placeholder that needs
+    // to be mapped or skipped. Skip it here — this test asserts chart-type
+    // conversion, not connection wiring (widgets render whether or not they
+    // have a real connection).
+    await dialog.locator('label:has-text("Skip")').first().click();
 
-    // Import button should be enabled immediately
+    // Import button should be enabled once the only placeholder is skipped
     const importBtn = dialog.getByRole("button", { name: "Import" }).last();
     await expect(importBtn).toBeEnabled({ timeout: 5_000 });
     await importBtn.click();
 
-    // Should redirect to the imported dashboard
+    // Post-success view replaces the form — click "View dashboard"
+    await page
+      .getByRole("button", { name: "View dashboard" })
+      .click({ timeout: 15_000 });
     await page.waitForURL(/\/[\w-]+$/, { timeout: 15_000 });
 
     // Verify 6 widget cards rendered — includes gantt and graph3d→graph
@@ -234,6 +244,10 @@ test.describe("NeoDash legacy import", () => {
         timeout: 5_000,
       });
 
+      // Skip the synthesized Neo4j placeholder — this test cares about the
+      // fallback chart-type behavior, not the connection wiring.
+      await dialog.locator('label:has-text("Skip")').first().click();
+
       const importBtn = dialog.getByRole("button", { name: "Import" }).last();
       await expect(importBtn).toBeEnabled();
       await importBtn.click();
@@ -242,6 +256,9 @@ test.describe("NeoDash legacy import", () => {
       // Assert the widget card renders (proves import succeeded and the fallback
       // chart type didn't blow up). We don't look for "JSON Viewer" text because
       // the chart type label isn't always rendered as visible text on the card.
+      await page
+        .getByRole("button", { name: "View dashboard" })
+        .click({ timeout: 15_000 });
       await page.waitForURL(/\/[\w-]+$/, { timeout: 15_000 });
       await expect(
         page.locator("[data-testid='widget-card']").first(),
diff --git a/app/e2e/dashboard-states.spec.ts b/app/e2e/dashboard-states.spec.ts
index d7afba87..11a94fbf 100644
--- a/app/e2e/dashboard-states.spec.ts
+++ b/app/e2e/dashboard-states.spec.ts
@@ -58,6 +58,63 @@ test.describe("Dashboard viewer — uncovered states", () => {
     await page.waitForURL(/\/[\w-]+$/, { timeout: 10_000 });
     await expect(page.getByText("Movie Analytics")).toBeVisible();
   });
+
+  test("does NOT show 'Dashboard updated by' banner after a self-save + revisit (#904)", async ({
+    page,
+  }) => {
+    // Create a fresh dashboard
+    await page.getByRole("button", { name: /New Dashboard/i }).click();
+    const dialog = page.getByRole("dialog");
+    await dialog
+      .locator("#dashboard-name")
+      .fill(`Self-Save Test ${Date.now()}`);
+    await Promise.all([
+      page.waitForResponse(
+        (r) =>
+          r.url().endsWith("/api/dashboards") &&
+          r.request().method() === "POST" &&
+          r.status() === 201,
+        { timeout: 10_000 },
+      ),
+      dialog.getByRole("button", { name: "Create" }).click(),
+    ]);
+    await page.waitForURL(/\/edit/, { timeout: 15_000 });
+
+    // Capture the dashboard id for later assertions / cleanup.
+    const editUrl = page.url();
+    const dashboardId = editUrl.split("/").slice(-2, -1)[0];
+
+    // Save — bumps version 1 → 2 server-side. With #904's fix, the hook's
+    // onSuccess writes the new version to sessionStorage so the subsequent
+    // view-mode load sees a fresh baseline and doesn't fire the banner.
+    await Promise.all([
+      page.waitForResponse(
+        (r) =>
+          /\/api\/dashboards\/[\w-]+$/.test(r.url()) &&
+          r.request().method() === "PUT" &&
+          r.status() === 200,
+        { timeout: 10_000 },
+      ),
+      page.getByRole("button", { name: "Save" }).click(),
+    ]);
+
+    // Leave edit → view mode (the route where the version-bump effect runs)
+    await page.getByRole("button", { name: /Back/ }).click();
+    // Back goes to /<id>, not /dashboards
+    await page.waitForURL(/\/[\w-]+$/, { timeout: 10_000 });
+
+    // Wait briefly for the version-bump effect to settle. Banner would
+    // appear in the same paint if the bug were present.
+    await page.waitForTimeout(500);
+
+    // Critical assertion: NO "Dashboard updated by" banner
+    await expect(page.getByText(/Dashboard updated by/i)).toHaveCount(0);
+
+    // Clean up to avoid polluting other tests
+    if (dashboardId) {
+      await page.request.delete(`/api/dashboards/${dashboardId}`);
+    }
+  });
 });
 
 test.describe("Dashboard editor — uncovered states", () => {
diff --git a/app/e2e/import-validation.spec.ts b/app/e2e/import-validation.spec.ts
index 4c00f674..fd37055b 100644
--- a/app/e2e/import-validation.spec.ts
+++ b/app/e2e/import-validation.spec.ts
@@ -152,7 +152,10 @@ test.describe("Dashboard import validation", () => {
     await expect(importBtn).toBeEnabled({ timeout: 5_000 });
     await importBtn.click();
 
-    // Should redirect to the imported dashboard
+    // Post-success view replaces the form — click "View dashboard"
+    await page
+      .getByRole("button", { name: "View dashboard" })
+      .click({ timeout: 15_000 });
     await page.waitForURL(/\/[\w-]+$/, { timeout: 15_000 });
 
     // Dashboard should render with the imported widgets
diff --git a/app/e2e/sso-gating.spec.ts b/app/e2e/sso-gating.spec.ts
new file mode 100644
index 00000000..fd209691
--- /dev/null
+++ b/app/e2e/sso-gating.spec.ts
@@ -0,0 +1,81 @@
+import { test, expect, ALICE } from "./fixtures";
+
+/**
+ * Verifies SSO gating on community edition (the default global-setup state —
+ * NEOBOARD_EDITION is not set).
+ *
+ * The inverse (enterprise mode exposing the SSO management UI) is tracked
+ * in #933 — it requires a second Next.js server with NEOBOARD_EDITION=enterprise,
+ * which is a substantial global-setup overhaul.
+ */
+test.describe("SSO gating — community edition", () => {
+  test.beforeEach(async ({ authPage, sidebarPage }) => {
+    await authPage.login(ALICE.email, ALICE.password);
+    await sidebarPage.navigateTo("Settings");
+  });
+
+  test("Authentication tab is NOT visible in settings nav", async ({
+    page,
+  }) => {
+    await expect(page.getByRole("button", { name: "Profile" })).toBeVisible();
+    await expect(page.getByRole("button", { name: "API Keys" })).toBeVisible();
+    await expect(
+      page.getByRole("button", { name: "Authentication" }),
+    ).toHaveCount(0);
+  });
+
+  test("/settings/authentication shows Enterprise-required empty state", async ({
+    page,
+  }) => {
+    await page.goto("/settings/authentication");
+    // The empty state component renders the feature title and description
+    await expect(page.getByText(/Single Sign-On/i)).toBeVisible({
+      timeout: 10_000,
+    });
+    await expect(page.getByText(/Enterprise feature/i)).toBeVisible();
+    await expect(
+      page.getByRole("link", { name: /Learn about Enterprise/i }),
+    ).toBeVisible();
+    // Critical: the SSO management UI is NOT rendered
+    await expect(
+      page.getByRole("button", { name: /Add Provider/i }),
+    ).toHaveCount(0);
+  });
+
+  test("/api/sso-providers returns 402 ENTERPRISE_REQUIRED", async ({
+    page,
+  }) => {
+    // Use page.request so this rides the authenticated session set up in
+    // beforeEach + the page's connection pool (avoids the global request
+    // context occasionally racing with server startup → ECONNRESET on first
+    // call). The route gates on requireFeature("sso") before auth checks,
+    // so this 402 is independent of the session identity.
+    const res = await page.request.get("/api/sso-providers");
+    expect(res.status()).toBe(402);
+    const body = await res.json();
+    expect(body.error?.code).toBe("ENTERPRISE_REQUIRED");
+  });
+});
+
+test.describe("SSO gating — login page (community)", () => {
+  test("login page renders no SSO buttons", async ({ page }) => {
+    await page.goto("/login");
+    // Standard email/password form is present
+    await expect(page.getByLabel(/email/i)).toBeVisible();
+    await expect(page.getByLabel(/password/i)).toBeVisible();
+    // No "Sign in with X" SSO buttons (no providers configured + edition gates)
+    await expect(
+      page.getByRole("button", { name: /Sign in with/i }),
+    ).toHaveCount(0);
+  });
+
+  test("/api/auth/sso-providers returns empty array (no auth required)", async ({
+    request,
+  }) => {
+    const res = await request.get("/api/auth/sso-providers");
+    expect(res.status()).toBe(200);
+    const body = await res.json();
+    expect(body.data).toEqual([]);
+    expect(body.meta?.enforceSso).toBe(false);
+  });
+});
diff --git a/app/src/__tests__/instrumentation.test.ts b/app/src/__tests__/instrumentation.test.ts
index 799d6700..7c2252c3 100644
--- a/app/src/__tests__/instrumentation.test.ts
+++ b/app/src/__tests__/instrumentation.test.ts
@@ -124,6 +124,7 @@ describe("register — env validation", () => {
     encryption: process.env.ENCRYPTION_KEY,
     secret: process.env.NEXTAUTH_SECRET,
     dburl: process.env.DATABASE_URL,
+    hmac: process.env.API_KEY_HMAC_SECRET,
   };
 
   const restore = (key: string, value: string | undefined) => {
@@ -137,6 +138,7 @@ describe("register — env validation", () => {
     restore("ENCRYPTION_KEY", saved.encryption);
     restore("NEXTAUTH_SECRET", saved.secret);
     restore("DATABASE_URL", saved.dburl);
+    restore("API_KEY_HMAC_SECRET", saved.hmac);
   });
 
   it("calls process.exit(1) when required vars are missing", async () => {
@@ -146,6 +148,7 @@ describe("register — env validation", () => {
     delete process.env.ENCRYPTION_KEY;
     delete process.env.NEXTAUTH_SECRET;
     delete process.env.DATABASE_URL;
+    delete process.env.API_KEY_HMAC_SECRET;
 
     const exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
       // Throw to short-circuit register() so the subsequent code (logger
@@ -176,6 +179,7 @@ describe("register — env validation", () => {
     delete process.env.ENCRYPTION_KEY;
     delete process.env.NEXTAUTH_SECRET;
     delete process.env.DATABASE_URL;
+    delete process.env.API_KEY_HMAC_SECRET;
 
     const exitSpy = vi
       .spyOn(process, "exit")
@@ -193,6 +197,7 @@ describe("register — env validation", () => {
     process.env.DATABASE_URL = "postgres://x:y@z/db";
     process.env.ENCRYPTION_KEY = "0".repeat(64);
     process.env.NEXTAUTH_SECRET = "a".repeat(32);
+    process.env.API_KEY_HMAC_SECRET = "b".repeat(64);
     delete process.env.BOOTSTRAP_ADMIN_EMAIL;
     delete process.env.BOOTSTRAP_ADMIN_PASSWORD;
 
diff --git a/app/src/app/(dashboard)/page.tsx b/app/src/app/(dashboard)/page.tsx
index 8b55d2fb..70d734b9 100644
--- a/app/src/app/(dashboard)/page.tsx
+++ b/app/src/app/(dashboard)/page.tsx
@@ -38,6 +38,7 @@ import {
   CardTitle,
   CardDescription,
   CardFooter,
+  Checkbox,
   Dialog,
   DialogContent,
   DialogHeader,
@@ -113,6 +114,17 @@ interface ImportDashboardDialogProps {
   readonly onOpenChange: (open: boolean) => void;
 }
 
+/**
+ * Synthesized placeholder key used for NeoDash imports. Must match the
+ * server's NEODASH_PLACEHOLDER_KEY in app/src/app/api/dashboards/import/route.ts.
+ */
+const NEODASH_PLACEHOLDER_KEY = "neodash-default";
+
+interface ImportSuccessState {
+  id: string;
+  notes: string[];
+}
+
 function ImportDashboardDialog({
   open,
   onOpenChange,
@@ -121,7 +133,13 @@ function ImportDashboardDialog({
   const fileInputRef = useRef<HTMLInputElement>(null);
   const [parsed, setParsed] = useState<ParsedImport | null>(null);
   const [mapping, setMapping] = useState<Record<string, string>>({});
+  const [skipped, setSkipped] = useState<Set<string>>(new Set());
   const [fileError, setFileError] = useState<string | null>(null);
+  // Post-import state: dialog replaces the form with a notes summary and
+  // View / Stay buttons. Cleared on reset / dialog close.
+  const [successState, setSuccessState] = useState<ImportSuccessState | null>(
+    null,
+  );
 
   const { data: availableConnections = [] } = useConnections();
   const importDashboard = useImportDashboard();
@@ -129,7 +147,9 @@ function ImportDashboardDialog({
   function reset() {
     setParsed(null);
     setMapping({});
+    setSkipped(new Set());
     setFileError(null);
+    setSuccessState(null);
     if (fileInputRef.current) fileInputRef.current.value = "";
   }
 
@@ -138,10 +158,25 @@ function ImportDashboardDialog({
     onOpenChange(isOpen);
   }
 
+  function toggleSkip(key: string) {
+    setSkipped((prev) => {
+      const next = new Set(prev);
+      if (next.has(key)) {
+        next.delete(key);
+      } else {
+        next.add(key);
+        // Clear any selection — skipping clears the mapping value
+        setMapping((m) => ({ ...m, [key]: "" }));
+      }
+      return next;
+    });
+  }
+
   async function handleFile(e: React.ChangeEvent<HTMLInputElement>) {
     setFileError(null);
     setParsed(null);
     setMapping({});
+    setSkipped(new Set());
     const file = e.target.files?.[0];
     if (!file) return;
 
@@ -150,19 +185,33 @@ function ImportDashboardDialog({
       const json = JSON.parse(text);
 
       if (isNeoDashFormat(json)) {
-        // NeoDash — no connection mapping needed
+        // NeoDash — synthesize a single placeholder for the whole dashboard.
+        // NeoDash always pointed at one global Neo4j; surface that as one
+        // required mapping in the UI.
         const widgetCount =
           (json.pages as Array<{ reports?: unknown[] }>)?.reduce(
             (sum: number, p) => sum + (p.reports?.length ?? 0),
             0,
           ) ?? 0;
+        const title =
+          (json as { title?: string }).title ?? "Imported Dashboard";
+        // Placeholder name intentionally avoids repeating the dashboard title
+        // — the title is already shown above in the parsed-preview box, and
+        // duplicating it caused strict-mode locator collisions in E2E tests
+        // (the same text would resolve to 2 elements in the dialog).
+        const synthesized: Record<string, ConnectionInfo> = {
+          [NEODASH_PLACEHOLDER_KEY]: {
+            name: "Neo4j connection",
+            type: "neo4j",
+          },
+        };
+        setMapping({ [NEODASH_PLACEHOLDER_KEY]: "" });
         setParsed({
           payload: json,
-          dashboardName:
-            (json as { title?: string }).title ?? "Imported Dashboard",
+          dashboardName: title,
           widgetCount: widgetCount,
           isNeoDash: true,
-          connections: {},
+          connections: synthesized,
         });
       } else if (json.formatVersion === 1) {
         // NeoBoard export
@@ -205,9 +254,10 @@ function ImportDashboardDialog({
       const result = await importDashboard.mutateAsync({
         payload: parsed.payload,
         connectionMapping: mapping,
+        skippedConnections: Array.from(skipped),
       });
-      handleOpenChange(false);
-      router.push(`/${result.id}`);
+      // Don't redirect — replace the form with notes + View/Stay buttons.
+      setSuccessState({ id: result.id, notes: result.notes ?? [] });
     } catch (error) {
       setFileError(
         error instanceof Error ? error.message : "Failed to import dashboard.",
@@ -215,10 +265,62 @@ function ImportDashboardDialog({
     }
   }
 
-  const hasConnections =
-    parsed && !parsed.isNeoDash && Object.keys(parsed.connections).length > 0;
+  const hasConnections = parsed && Object.keys(parsed.connections).length > 0;
   const allMapped =
-    !hasConnections || Object.values(mapping).every((v) => v !== "");
+    !hasConnections ||
+    Object.entries(mapping).every(([key, v]) => skipped.has(key) || v !== "");
+
+  // Post-success view: replace the form with notes + View/Stay buttons.
+  if (successState) {
+    return (
+      <Dialog open={open} onOpenChange={handleOpenChange}>
+        <DialogContent className="sm:max-w-lg">
+          <DialogHeader>
+            <DialogTitle>Dashboard imported</DialogTitle>
+          </DialogHeader>
+          <div className="py-4 space-y-4">
+            <div className="rounded-md border p-3 bg-muted/40">
+              <p className="text-sm font-medium truncate">
+                {parsed?.dashboardName ?? "Imported dashboard"}
+              </p>
+              <p className="text-xs text-muted-foreground">
+                Imported successfully.
+              </p>
+            </div>
+            {successState.notes.length > 0 && (
+              <div className="space-y-2">
+                <p className="text-sm font-medium">Import notes</p>
+                <ul className="list-disc pl-5 space-y-1 max-h-60 overflow-y-auto text-sm text-muted-foreground">
+                  {successState.notes.map((note, i) => (
+                    <li key={i}>{note}</li>
+                  ))}
+                </ul>
+              </div>
+            )}
+          </div>
+          <DialogFooter>
+            <Button
+              type="button"
+              variant="outline"
+              onClick={() => handleOpenChange(false)}
+            >
+              Stay here
+            </Button>
+            <Button
+              type="button"
+              onClick={() => {
+                const id = successState.id;
+                handleOpenChange(false);
+                router.push(`/${id}`);
+              }}
+            >
+              View dashboard
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    );
+  }
 
   return (
     <Dialog open={open} onOpenChange={handleOpenChange}>
@@ -262,48 +364,81 @@ function ImportDashboardDialog({
             {hasConnections && (
               <div className="space-y-3">
                 <p className="text-sm text-muted-foreground">
-                  Map each connection placeholder to a local connection:
+                  Map each connection placeholder to a local connection, or
+                  check &ldquo;Skip&rdquo; to import without one (widgets will
+                  need a connection assigned before they can load data).
                 </p>
                 {Object.entries(parsed.connections).map(([key, info]) => {
                   const compatible = availableConnections.filter(
                     (c) => c.type === info.type,
                   );
+                  const isSkipped = skipped.has(key);
+                  const hasNoCompatible = compatible.length === 0;
                   return (
                     <div
                       key={key}
-                      className="grid grid-cols-2 gap-2 items-center"
+                      className="rounded-md border p-3 space-y-2 bg-card"
                     >
-                      <div className="min-w-0">
-                        <p className="text-sm font-medium truncate">
-                          {info.name}
-                        </p>
-                        <p className="text-xs text-muted-foreground">
-                          {info.type}
-                        </p>
+                      <div className="flex items-start justify-between gap-2">
+                        <div className="min-w-0 flex-1">
+                          <p className="text-sm font-medium truncate">
+                            {info.name}
+                          </p>
+                          <p className="text-xs text-muted-foreground">
+                            {info.type}
+                          </p>
+                        </div>
+                        <label className="flex items-center gap-1.5 text-xs text-muted-foreground cursor-pointer shrink-0">
+                          <Checkbox
+                            checked={isSkipped}
+                            onCheckedChange={() => toggleSkip(key)}
+                          />
+                          Skip
+                        </label>
                       </div>
-                      <Select
-                        value={mapping[key] ?? ""}
-                        onValueChange={(val) =>
-                          setMapping((prev) => ({ ...prev, [key]: val }))
-                        }
-                      >
-                        <SelectTrigger>
-                          <SelectValue placeholder="Select connection" />
-                        </SelectTrigger>
-                        <SelectContent>
-                          {compatible.length === 0 ? (
-                            <SelectItem value="__none__" disabled>
-                              No {info.type} connections
-                            </SelectItem>
-                          ) : (
-                            compatible.map((c) => (
-                              <SelectItem key={c.id} value={c.id}>
-                                {c.name}
-                              </SelectItem>
-                            ))
+                      {!isSkipped && (
+                        <>
+                          <Select
+                            value={mapping[key] ?? ""}
+                            onValueChange={(val) =>
+                              setMapping((prev) => ({ ...prev, [key]: val }))
+                            }
+                            disabled={hasNoCompatible}
+                          >
+                            <SelectTrigger>
+                              <SelectValue placeholder="Select connection" />
+                            </SelectTrigger>
+                            <SelectContent>
+                              {hasNoCompatible ? (
+                                <SelectItem value="__none__" disabled>
+                                  No {info.type} connections
+                                </SelectItem>
+                              ) : (
+                                compatible.map((c) => (
+                                  <SelectItem key={c.id} value={c.id}>
+                                    {c.name}
+                                  </SelectItem>
+                                ))
+                              )}
+                            </SelectContent>
+                          </Select>
+                          {hasNoCompatible && (
+                            <p className="text-xs text-muted-foreground">
+                              No compatible {info.type} connections in your
+                              tenant.{" "}
+                              <a
+                                href="/connections"
+                                target="_blank"
+                                rel="noopener noreferrer"
+                                className="text-primary underline-offset-4 hover:underline"
+                              >
+                                Create one
+                              </a>{" "}
+                              or check &ldquo;Skip&rdquo; to import without.
+                            </p>
                           )}
-                        </SelectContent>
-                      </Select>
+                        </>
+                      )}
                     </div>
                   );
                 })}
diff --git a/app/src/app/(dashboard)/settings/authentication/__tests__/page.test.tsx b/app/src/app/(dashboard)/settings/authentication/__tests__/page.test.tsx
index 434f5e8a..75b8cae4 100644
--- a/app/src/app/(dashboard)/settings/authentication/__tests__/page.test.tsx
+++ b/app/src/app/(dashboard)/settings/authentication/__tests__/page.test.tsx
@@ -25,6 +25,31 @@ vi.mock("@/hooks/use-sso-providers", () => ({
   }),
 }));
 
+// FeatureGate: default to rendering children (feature enabled). Override
+// `mockSsoEnabled = false` to test the disabled path.
+let mockSsoEnabled: boolean | undefined = true;
+vi.mock("@/components/feature-gate", () => ({
+  FeatureGate: ({
+    children,
+    fallback,
+  }: {
+    feature: string;
+    children: React.ReactNode;
+    fallback?: React.ReactNode;
+  }) => {
+    if (mockSsoEnabled === true) return <>{children}</>;
+    return <>{fallback ?? null}</>;
+  },
+}));
+
+vi.mock("@/components/enterprise-required-empty-state", () => ({
+  EnterpriseRequiredEmptyState: ({ feature }: { feature: string }) => (
+    <div data-testid="enterprise-required" data-feature={feature}>
+      Enterprise feature required: {feature}
+    </div>
+  ),
+}));
+
 vi.mock("next/navigation", () => ({
   useRouter: () => ({ push: vi.fn() }),
   usePathname: () => "/settings/authentication",
@@ -181,6 +206,23 @@ vi.mock("@neoboard/components", () => ({
 describe("AuthenticationPage", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    mockSsoEnabled = true;
+  });
+
+  it("renders enterprise-required empty state on community edition", async () => {
+    mockSsoEnabled = false;
+    mockUseSsoProviders.mockReturnValue({ data: undefined, isLoading: false });
+
+    const { default: Page } = await import("../page");
+    render(<Page />);
+
+    expect(screen.getByTestId("enterprise-required")).toBeInTheDocument();
+    expect(screen.getByTestId("enterprise-required")).toHaveAttribute(
+      "data-feature",
+      "sso",
+    );
+    // The community page must NOT render the SSO management UI
+    expect(screen.queryByText("Add SSO Provider")).not.toBeInTheDocument();
   });
 
   it("shows loading spinner when fetching", async () => {
diff --git a/app/src/app/(dashboard)/settings/authentication/page.tsx b/app/src/app/(dashboard)/settings/authentication/page.tsx
index 7ff08336..2b823ef6 100644
--- a/app/src/app/(dashboard)/settings/authentication/page.tsx
+++ b/app/src/app/(dashboard)/settings/authentication/page.tsx
@@ -40,6 +40,8 @@ import type {
   SsoProviderListItem,
   CreateSsoProviderInput,
 } from "@/hooks/use-sso-providers";
+import { FeatureGate } from "@/components/feature-gate";
+import { EnterpriseRequiredEmptyState } from "@/components/enterprise-required-empty-state";
 
 // ---------------------------------------------------------------------------
 // Add Provider Dialog
@@ -388,6 +390,21 @@ function ProviderRow({
 // ---------------------------------------------------------------------------
 
 export default function AuthenticationPage() {
+  return (
+    <FeatureGate
+      feature="sso"
+      fallback={
+        <div className="p-6">
+          <EnterpriseRequiredEmptyState feature="sso" />
+        </div>
+      }
+    >
+      <AuthenticationPageContent />
+    </FeatureGate>
+  );
+}
+
+function AuthenticationPageContent() {
   const [createOpen, setCreateOpen] = useState(false);
   const { data: providers = [], isLoading } = useSsoProviders();
   const deleteMutation = useDeleteSsoProvider();
diff --git a/app/src/app/(dashboard)/settings/layout.tsx b/app/src/app/(dashboard)/settings/layout.tsx
index a2d8dd3f..6d473ac0 100644
--- a/app/src/app/(dashboard)/settings/layout.tsx
+++ b/app/src/app/(dashboard)/settings/layout.tsx
@@ -2,11 +2,25 @@
 
 import { useRouter, usePathname } from "next/navigation";
 import { User, KeyRound, Shield } from "lucide-react";
+import { useFeature, type FeatureId } from "@/hooks/use-features";
 
-const tabs = [
+interface Tab {
+  href: string;
+  label: string;
+  icon: typeof User;
+  /** When set, the tab is only rendered if this feature is enabled. */
+  requiresFeature?: FeatureId;
+}
+
+const tabs: Tab[] = [
   { href: "/settings/profile", label: "Profile", icon: User },
   { href: "/settings/api-keys", label: "API Keys", icon: KeyRound },
-  { href: "/settings/authentication", label: "Authentication", icon: Shield },
+  {
+    href: "/settings/authentication",
+    label: "Authentication",
+    icon: Shield,
+    requiresFeature: "sso",
+  },
 ];
 
 export default function SettingsLayout({
@@ -16,12 +30,23 @@ export default function SettingsLayout({
 }) {
   const router = useRouter();
   const pathname = usePathname();
+  // Subscribe to features once at layout level; useFeature returns undefined
+  // during the initial load — we hide gated tabs in that window to avoid a
+  // flicker of enterprise UI on community installs.
+  const ssoEnabled = useFeature("sso");
+
+  const visibleTabs = tabs.filter((t) => {
+    if (!t.requiresFeature) return true;
+    if (t.requiresFeature === "sso") return ssoEnabled === true;
+    // Unknown feature gate: hide by default (safer than leak).
+    return false;
+  });
 
   return (
     <div className="flex flex-col">
       <nav className="border-b px-6">
         <div className="flex gap-4">
-          {tabs.map(({ href, label, icon: Icon }) => {
+          {visibleTabs.map(({ href, label, icon: Icon }) => {
             const active = pathname === href;
             return (
               <button
diff --git a/app/src/app/api/auth/sso-providers/__tests__/route.test.ts b/app/src/app/api/auth/sso-providers/__tests__/route.test.ts
index 1c0645a2..53972dd8 100644
--- a/app/src/app/api/auth/sso-providers/__tests__/route.test.ts
+++ b/app/src/app/api/auth/sso-providers/__tests__/route.test.ts
@@ -26,6 +26,9 @@ describe("GET /api/auth/sso-providers", () => {
     vi.clearAllMocks();
     vi.doMock("@/lib/db", () => ({ db: mockDb }));
     vi.doMock("next/server", () => nextResponseMockFactory());
+    // Default tests assume enterprise (so DB path runs); community tests
+    // override before importing the route.
+    vi.stubEnv("NEOBOARD_EDITION", "enterprise");
     const mod = await import("../route");
     GET = mod.GET;
   });
@@ -61,4 +64,40 @@ describe("GET /api/auth/sso-providers", () => {
     const res = await GET();
     expect(res.status).toBe(200);
   });
+
+  it("returns empty array on community edition even when DB has rows", async () => {
+    vi.stubEnv("NEOBOARD_EDITION", "");
+    vi.resetModules();
+    vi.doMock("@/lib/db", () => ({ db: mockDb }));
+    vi.doMock("next/server", () => nextResponseMockFactory());
+    // Stub: even if DB has rows, community should not query/return them
+    mockDb.select.mockReturnValue(
+      makeSelectChain([
+        { id: "sso-1", name: "Stale Provider", enforceSso: false },
+      ]),
+    );
+    const mod = await import("../route");
+    const res = await mod.GET();
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.data).toEqual([]);
+    expect(body.meta?.enforceSso).toBe(false);
+    // Critical: community must not even hit the DB (defense in depth)
+    expect(mockDb.select).not.toHaveBeenCalled();
+  });
+
+  it("returns rows on enterprise edition", async () => {
+    vi.stubEnv("NEOBOARD_EDITION", "enterprise");
+    vi.resetModules();
+    vi.doMock("@/lib/db", () => ({ db: mockDb }));
+    vi.doMock("next/server", () => nextResponseMockFactory());
+    mockDb.select.mockReturnValue(
+      makeSelectChain([{ id: "sso-1", name: "Okta", enforceSso: false }]),
+    );
+    const mod = await import("../route");
+    const res = await mod.GET();
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.data).toEqual([{ id: "sso-1", name: "Okta" }]);
+  });
 });
diff --git a/app/src/app/api/auth/sso-providers/route.ts b/app/src/app/api/auth/sso-providers/route.ts
index 1a9a5bde..a3b8b4be 100644
--- a/app/src/app/api/auth/sso-providers/route.ts
+++ b/app/src/app/api/auth/sso-providers/route.ts
@@ -4,15 +4,24 @@ import { ssoProviders } from "@/lib/db/schema";
 import { loadEnvSsoProvider } from "@/lib/auth/sso/env-provider";
 import { apiSuccess } from "@/lib/api/api-response";
 import { handleRouteError } from "@/lib/api/api-utils";
+import { hasFeature } from "@/lib/features/registry";
 
 /**
  * Public endpoint — returns only id + name of enabled SSO providers.
  * Merges the env-based provider (if configured) with DB-based providers.
  * Used by the login page to render SSO buttons.
  * No auth required (falls under /api/auth/ public prefix).
+ *
+ * Defense in depth: on community edition this short-circuits to an empty
+ * response even if the sso_provider table has rows (e.g. legacy data from
+ * an earlier enterprise install). The sign-in flow relies on enterprise
+ * code anyway, so listing them on community would be a dead-end.
  */
 export async function GET() {
   try {
+    if (!hasFeature("sso")) {
+      return apiSuccess([], 200, { enforceSso: false });
+    }
     const tenantId = process.env.TENANT_ID ?? "default";
 
     const rows = await db
diff --git a/app/src/app/api/dashboards/import/__tests__/route.test.ts b/app/src/app/api/dashboards/import/__tests__/route.test.ts
index 9cc71f91..de6064ae 100644
--- a/app/src/app/api/dashboards/import/__tests__/route.test.ts
+++ b/app/src/app/api/dashboards/import/__tests__/route.test.ts
@@ -1,5 +1,8 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { makeSelectChain, makeInsertChain } from "@/__tests__/helpers/drizzle-mocks";
+import {
+  makeSelectChain,
+  makeInsertChain,
+} from "@/__tests__/helpers/drizzle-mocks";
 import { makeRequest } from "@/__tests__/helpers/request-helpers";
 import { nextResponseMockFactory } from "@/__tests__/helpers/next-mocks";
 
@@ -8,7 +11,12 @@ import { nextResponseMockFactory } from "@/__tests__/helpers/next-mocks";
 // ---------------------------------------------------------------------------
 
 const mockRequireSession = vi.fn<
-  () => Promise<{ userId: string; role: string; canWrite: boolean; tenantId: string }>
+  () => Promise<{
+    userId: string;
+    role: string;
+    canWrite: boolean;
+    tenantId: string;
+  }>
 >();
 
 const mockDb = {
@@ -38,7 +46,12 @@ vi.mock("@/lib/auth/errors", () => ({ UnauthorizedError, ForbiddenError }));
 // Helpers
 // ---------------------------------------------------------------------------
 
-const SESSION = { userId: "user-1", role: "creator", canWrite: true, tenantId: "tenant-1" };
+const SESSION = {
+  userId: "user-1",
+  role: "creator",
+  canWrite: true,
+  tenantId: "tenant-1",
+};
 
 const VALID_PAYLOAD = {
   formatVersion: 1,
@@ -54,7 +67,12 @@ const VALID_PAYLOAD = {
         id: "p1",
         title: "Page 1",
         widgets: [
-          { id: "w1", chartType: "bar", connectionId: "conn_0", query: "MATCH (n) RETURN n" },
+          {
+            id: "w1",
+            chartType: "bar",
+            connectionId: "conn_0",
+            query: "MATCH (n) RETURN n",
+          },
         ],
         gridLayout: [{ i: "w1", x: 0, y: 0, w: 6, h: 4 }],
       },
@@ -103,13 +121,21 @@ describe("POST /api/dashboards/import", () => {
 
   it("returns 401 when unauthenticated", async () => {
     mockRequireSession.mockRejectedValue(new UnauthorizedError());
-    const res = await POST(makeRequest({ payload: VALID_PAYLOAD, connectionMapping: {} }));
+    const res = await POST(
+      makeRequest({ payload: VALID_PAYLOAD, connectionMapping: {} }),
+    );
     expect(res.status).toBe(401);
   });
 
   it("returns 403 for reader role", async () => {
-    mockRequireSession.mockResolvedValue({ ...SESSION, role: "reader", canWrite: false });
-    const res = await POST(makeRequest({ payload: VALID_PAYLOAD, connectionMapping: {} }));
+    mockRequireSession.mockResolvedValue({
+      ...SESSION,
+      role: "reader",
+      canWrite: false,
+    });
+    const res = await POST(
+      makeRequest({ payload: VALID_PAYLOAD, connectionMapping: {} }),
+    );
     expect(res.status).toBe(403);
   });
 
@@ -117,14 +143,18 @@ describe("POST /api/dashboards/import", () => {
     mockRequireSession.mockResolvedValue(SESSION);
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     const { formatVersion: _fv, ...noVersion } = VALID_PAYLOAD;
-    const res = await POST(makeRequest({ payload: noVersion, connectionMapping: {} }));
+    const res = await POST(
+      makeRequest({ payload: noVersion, connectionMapping: {} }),
+    );
     expect(res.status).toBe(400);
   });
 
-  it("imports a valid NeoBoard export and returns 201", async () => {
+  it("imports a valid NeoBoard export and returns 201 with notes array", async () => {
     mockRequireSession.mockResolvedValue(SESSION);
     // Connection ownership check returns 1 allowed connection
-    mockDb.select.mockReturnValueOnce(makeSelectChain([{ id: "real-conn-id" }]));
+    mockDb.select.mockReturnValueOnce(
+      makeSelectChain([{ id: "real-conn-id" }]),
+    );
     // No existing dashboard with same name
     mockDb.select.mockReturnValueOnce(makeSelectChain([]));
     const created = {
@@ -138,27 +168,129 @@ describe("POST /api/dashboards/import", () => {
     mockDb.insert.mockReturnValue(makeInsertChain([created]));
 
     const res = await POST(
-      makeRequest({ payload: VALID_PAYLOAD, connectionMapping: { conn_0: "real-conn-id" } })
+      makeRequest({
+        payload: VALID_PAYLOAD,
+        connectionMapping: { conn_0: "real-conn-id" },
+      }),
     );
     expect(res.status).toBe(201);
     const body = await res.json();
     expect(body.data).toMatchObject({ id: "new-dash" });
+    // Notes envelope is always present (additive contract change)
+    expect(Array.isArray(body.data.notes)).toBe(true);
+    // Happy-path NeoBoard import has no notes (mapping fully applied)
+    expect(body.data.notes).toEqual([]);
   });
 
-  it("auto-converts NeoDash format and returns 201", async () => {
+  it("auto-converts NeoDash format and returns 201 with mapped connection", async () => {
     mockRequireSession.mockResolvedValue(SESSION);
+    // Connection ownership check passes for the mapped connection
+    mockDb.select.mockReturnValueOnce(
+      makeSelectChain([{ id: "neo4j-conn-id" }]),
+    );
     mockDb.select.mockReturnValueOnce(makeSelectChain([]));
-    const created = { id: "nd-dash", name: "NeoDash Dashboard", userId: "user-1", tenantId: "tenant-1", createdAt: new Date(), updatedAt: new Date() };
+    const created = {
+      id: "nd-dash",
+      name: "NeoDash Dashboard",
+      userId: "user-1",
+      tenantId: "tenant-1",
+      layoutJson: null,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
     mockDb.insert.mockReturnValue(makeInsertChain([created]));
 
-    const res = await POST(makeRequest({ payload: NEODASH_PAYLOAD, connectionMapping: {} }));
+    const res = await POST(
+      makeRequest({
+        payload: NEODASH_PAYLOAD,
+        connectionMapping: { "neodash-default": "neo4j-conn-id" },
+      }),
+    );
     expect(res.status).toBe(201);
+    const body = await res.json();
+    expect(body.data.id).toBe("nd-dash");
+    expect(Array.isArray(body.data.notes)).toBe(true);
+  });
+
+  it("NeoDash import with skipped placeholder includes a warning note", async () => {
+    mockRequireSession.mockResolvedValue(SESSION);
+    mockDb.select.mockReturnValueOnce(makeSelectChain([]));
+    const created = {
+      id: "nd-dash",
+      name: "NeoDash Dashboard",
+      userId: "user-1",
+      tenantId: "tenant-1",
+      layoutJson: null,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+    mockDb.insert.mockReturnValue(makeInsertChain([created]));
+
+    const res = await POST(
+      makeRequest({
+        payload: NEODASH_PAYLOAD,
+        connectionMapping: {},
+        skippedConnections: ["neodash-default"],
+      }),
+    );
+    expect(res.status).toBe(201);
+    const body = await res.json();
+    expect(body.data.notes.some((n: string) => /skipped/i.test(n))).toBe(true);
+  });
+
+  it("NeoBoard import with skipped connection produces an unmapped-widget note", async () => {
+    mockRequireSession.mockResolvedValue(SESSION);
+    // No mapped connections to validate
+    mockDb.select.mockReturnValueOnce(makeSelectChain([]));
+    const created = {
+      id: "skip-dash",
+      name: "Imported Dashboard",
+      userId: "user-1",
+      tenantId: "tenant-1",
+      layoutJson: null,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    };
+    mockDb.insert.mockReturnValue(makeInsertChain([created]));
+
+    const res = await POST(
+      makeRequest({
+        payload: VALID_PAYLOAD,
+        connectionMapping: {},
+        skippedConnections: ["conn_0"],
+      }),
+    );
+    expect(res.status).toBe(201);
+    const body = await res.json();
+    expect(
+      body.data.notes.some((n: string) =>
+        /imported without a connection/i.test(n),
+      ),
+    ).toBe(true);
+  });
+
+  it("rejects cross-tenant mapping (connection ownership check fails)", async () => {
+    mockRequireSession.mockResolvedValue(SESSION);
+    // Ownership/tenant check returns nothing — mapped id is foreign
+    mockDb.select.mockReturnValueOnce(makeSelectChain([]));
+
+    const res = await POST(
+      makeRequest({
+        payload: VALID_PAYLOAD,
+        connectionMapping: { conn_0: "foreign-conn-id" },
+      }),
+    );
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.error.message).toMatch(/invalid connection mapping/i);
   });
 
   it("appends (imported) to name when dashboard with same name already exists", async () => {
     mockRequireSession.mockResolvedValue(SESSION);
     // Connection ownership check returns 1 allowed connection
-    mockDb.select.mockReturnValueOnce(makeSelectChain([{ id: "real-conn-id" }]));
+    mockDb.select.mockReturnValueOnce(
+      makeSelectChain([{ id: "real-conn-id" }]),
+    );
     // Existing dashboard found
     mockDb.select.mockReturnValueOnce(makeSelectChain([{ id: "existing" }]));
     const created = {
@@ -172,7 +304,10 @@ describe("POST /api/dashboards/import", () => {
     mockDb.insert.mockReturnValue(makeInsertChain([created]));
 
     const res = await POST(
-      makeRequest({ payload: VALID_PAYLOAD, connectionMapping: { conn_0: "real-conn-id" } })
+      makeRequest({
+        payload: VALID_PAYLOAD,
+        connectionMapping: { conn_0: "real-conn-id" },
+      }),
     );
     expect(res.status).toBe(201);
     const body = await res.json();
diff --git a/app/src/app/api/dashboards/import/route.ts b/app/src/app/api/dashboards/import/route.ts
index 3478a55f..8bb932e0 100644
--- a/app/src/app/api/dashboards/import/route.ts
+++ b/app/src/app/api/dashboards/import/route.ts
@@ -9,7 +9,7 @@ import {
 } from "@/lib/dashboard/dashboard-import";
 import {
   isNeoDashFormat,
-  convertNeoDash,
+  convertNeoDashWithNotes,
 } from "@/lib/dashboard/neodash-converter";
 import type { DashboardLayoutV2 } from "@/lib/db/schema";
 import { forbidden, badRequest, handleRouteError } from "@/lib/api/api-utils";
@@ -18,8 +18,20 @@ import { apiSuccess } from "@/lib/api/api-response";
 const importRequestSchema = z.object({
   payload: z.unknown(),
   connectionMapping: z.record(z.string()).default({}),
+  // Connection keys the user explicitly chose to skip. Widgets referencing
+  // a skipped key will have connectionId="" and a note is added so the user
+  // knows what they need to fix manually.
+  skippedConnections: z.array(z.string()).default([]),
 });
 
+// Synthesized placeholder used for NeoDash imports. NeoDash dashboards always
+// pointed at one global Neo4j; we surface that as a single required mapping.
+const NEODASH_PLACEHOLDER_KEY = "neodash-default";
+
+function pluralWidgets(count: number): string {
+  return count === 1 ? "1 widget" : count + " widgets";
+}
+
 export async function POST(request: Request) {
   try {
     const { userId, tenantId, canWrite } = await requireSession();
@@ -34,12 +46,29 @@ export async function POST(request: Request) {
         parsedBody.error.errors[0]?.message ?? "Invalid request body",
       );
     }
-    const { payload, connectionMapping } = parsedBody.data;
+    const { payload, connectionMapping, skippedConnections } = parsedBody.data;
+
+    const importNotes: string[] = [];
+    const skipSet = new Set(skippedConnections);
 
-    // Auto-detect and convert NeoDash format
+    // Detect format + convert to NeoBoard envelope
     let exportData;
+    let isNeoDash = false;
     if (isNeoDashFormat(payload)) {
-      exportData = convertNeoDash(payload);
+      isNeoDash = true;
+      const placeholderTarget = connectionMapping[NEODASH_PLACEHOLDER_KEY];
+      const isSkipped = skipSet.has(NEODASH_PLACEHOLDER_KEY);
+      const defaultConnectionId =
+        placeholderTarget && !isSkipped ? placeholderTarget : "";
+      const conv = convertNeoDashWithNotes(payload, defaultConnectionId);
+      exportData = conv.export;
+      importNotes.push(...conv.notes);
+      if (isSkipped) {
+        importNotes.push(
+          "Connection was skipped — all widgets imported without a connection. " +
+            "Assign one in the widget editor before they will load data.",
+        );
+      }
     } else {
       const parsed = neoboardExportSchema.safeParse(payload);
       if (!parsed.success) {
@@ -48,9 +77,14 @@ export async function POST(request: Request) {
       exportData = parsed.data;
     }
 
-    // Validate that all mapped connection IDs belong to the caller
+    // Validate mapping targets belong to the caller's tenant + user.
+    // Skipped-key mappings are ignored.
     const mappedIds = [
-      ...new Set(Object.values(connectionMapping).filter(Boolean)),
+      ...new Set(
+        Object.entries(connectionMapping)
+          .filter(([key, value]) => !!value && !skipSet.has(key))
+          .map(([, value]) => value),
+      ),
     ];
     if (mappedIds.length > 0) {
       const allowed = await db
@@ -60,6 +94,7 @@ export async function POST(request: Request) {
           and(
             inArray(connections.id, mappedIds),
             eq(connections.userId, userId),
+            eq(connections.tenantId, tenantId),
           ),
         );
       if (allowed.length !== mappedIds.length) {
@@ -67,22 +102,55 @@ export async function POST(request: Request) {
       }
     }
 
-    // Apply connection mapping to layout
-    const mappedLayout = applyConnectionMapping(
-      exportData.layout as DashboardLayoutV2,
-      connectionMapping,
+    // Apply mapping. For NeoDash, widgets already carry the resolved
+    // connectionId from the converter (via defaultConnectionId). For NeoBoard,
+    // the mapping rewrites widget connectionId from source-key → target id;
+    // skipped keys result in connectionId="".
+    const effectiveMapping: Record<string, string> = {};
+    for (const [key, target] of Object.entries(connectionMapping)) {
+      if (skipSet.has(key)) {
+        effectiveMapping[key] = "";
+      } else if (target) {
+        effectiveMapping[key] = target;
+      }
+    }
+    for (const key of skipSet) {
+      if (!(key in effectiveMapping)) {
+        effectiveMapping[key] = "";
+      }
+    }
+
+    const mappedLayout = isNeoDash
+      ? (exportData.layout as DashboardLayoutV2)
+      : applyConnectionMapping(
+          exportData.layout as DashboardLayoutV2,
+          effectiveMapping,
+        );
+
+    // Count widgets without a connection so the user knows what to fix.
+    const unmappedWidgetCount = mappedLayout.pages.reduce(
+      (sum, page) =>
+        sum +
+        page.widgets.filter((w) => !w.connectionId || w.connectionId === "")
+          .length,
+      0,
     );
+    if (!isNeoDash && unmappedWidgetCount > 0) {
+      importNotes.push(
+        pluralWidgets(unmappedWidgetCount) +
+          " imported without a connection — assign one in the widget editor before they will load data.",
+      );
+    }
 
-    // Determine final name — append "(imported)" only if name already exists
+    // Append "(imported)" only if the name already exists in this tenant.
     let name = exportData.dashboard.name;
     const [existing] = await db
       .select({ id: dashboards.id })
       .from(dashboards)
       .where(and(eq(dashboards.name, name), eq(dashboards.tenantId, tenantId)))
       .limit(1);
-
     if (existing) {
-      name = `${name} (imported)`;
+      name = name + " (imported)";
     }
 
     const [created] = await db
@@ -98,7 +166,7 @@ export async function POST(request: Request) {
       })
       .returning();
 
-    return apiSuccess(created, 201);
+    return apiSuccess({ ...created, notes: importNotes }, 201);
   } catch (e) {
     return handleRouteError(e);
   }
diff --git a/app/src/app/api/sso-providers/__tests__/route.test.ts b/app/src/app/api/sso-providers/__tests__/route.test.ts
index 0a4e270d..a2b7ef3d 100644
--- a/app/src/app/api/sso-providers/__tests__/route.test.ts
+++ b/app/src/app/api/sso-providers/__tests__/route.test.ts
@@ -87,7 +87,7 @@ describe("GET /api/sso-providers", () => {
     GET = mod.GET;
   });
 
-  it("returns 403 when NEOBOARD_EDITION is not enterprise", async () => {
+  it("returns 402 ENTERPRISE_REQUIRED when NEOBOARD_EDITION is not enterprise", async () => {
     vi.stubEnv("NEOBOARD_EDITION", "");
     // Re-import to pick up the env change
     vi.resetModules();
@@ -102,9 +102,10 @@ describe("GET /api/sso-providers", () => {
     }));
     const mod = await import("../route");
     const res = await mod.GET();
-    expect(res.status).toBe(403);
+    expect(res.status).toBe(402);
     const body = await res.json();
-    expect(body.error.message).toMatch(/enterprise/i);
+    expect(body.error.code).toBe("ENTERPRISE_REQUIRED");
+    expect(body.error.message).toMatch(/sso|enterprise/i);
   });
 
   it("returns 401 when unauthenticated", async () => {
@@ -175,10 +176,33 @@ describe("POST /api/sso-providers", () => {
     vi.doMock("@/lib/crypto/crypto", () => ({ encrypt: mockEncrypt }));
     vi.doMock("next/server", () => nextResponseMockFactory());
     vi.mock("@/lib/auth/errors", () => ({ UnauthorizedError, ForbiddenError }));
+    // Pin enterprise so these tests are deterministic; community-mode is
+    // exercised by the dedicated 402 contract tests below.
+    vi.stubEnv("NEOBOARD_EDITION", "enterprise");
     const mod = await import("../route");
     POST = mod.POST;
   });
 
+  it("returns 402 ENTERPRISE_REQUIRED on community edition", async () => {
+    vi.stubEnv("NEOBOARD_EDITION", "");
+    vi.resetModules();
+    vi.doMock("@/lib/auth/session", () => ({
+      requireAdmin: mockRequireAdmin,
+    }));
+    vi.doMock("@/lib/db", () => ({ db: mockDb }));
+    vi.doMock("@/lib/crypto/crypto", () => ({ encrypt: mockEncrypt }));
+    vi.doMock("next/server", () => nextResponseMockFactory());
+    vi.doMock("@/lib/auth/sso/provider-cache", () => ({
+      invalidateProviderCache: mockInvalidateCache,
+    }));
+    const mod = await import("../route");
+    const res = await mod.POST(makeRequest(validProvider));
+    expect(res.status).toBe(402);
+    const body = await res.json();
+    expect(body.error.code).toBe("ENTERPRISE_REQUIRED");
+    expect(body.error.message).toMatch(/sso|enterprise/i);
+  });
+
   it("returns 401 when unauthenticated", async () => {
     mockRequireAdmin.mockRejectedValue(new UnauthorizedError());
     const res = await POST(makeRequest(validProvider));
@@ -394,6 +418,27 @@ describe("DELETE /api/sso-providers", () => {
     DELETE = mod.DELETE;
   });
 
+  it("returns 402 ENTERPRISE_REQUIRED on community edition", async () => {
+    vi.stubEnv("NEOBOARD_EDITION", "");
+    vi.resetModules();
+    vi.doMock("@/lib/auth/session", () => ({
+      requireAdmin: mockRequireAdmin,
+    }));
+    vi.doMock("@/lib/db", () => ({ db: mockDb }));
+    vi.doMock("@/lib/crypto/crypto", () => ({ encrypt: mockEncrypt }));
+    vi.doMock("next/server", () => nextResponseMockFactory());
+    vi.doMock("@/lib/auth/sso/provider-cache", () => ({
+      invalidateProviderCache: mockInvalidateCache,
+    }));
+    const mod = await import("../route");
+    const res = await mod.DELETE(
+      makeRequest(null, "http://localhost/api/sso-providers?id=sso-1"),
+    );
+    expect(res.status).toBe(402);
+    const body = await res.json();
+    expect(body.error.code).toBe("ENTERPRISE_REQUIRED");
+  });
+
   it("returns 401 when unauthenticated", async () => {
     mockRequireAdmin.mockRejectedValue(new UnauthorizedError());
     const res = await DELETE(
@@ -452,10 +497,31 @@ describe("PATCH /api/sso-providers", () => {
     vi.doMock("@/lib/auth/sso/provider-cache", () => ({
       invalidateProviderCache: mockInvalidateCache,
     }));
+    // Pin enterprise so admin-path tests are deterministic.
+    vi.stubEnv("NEOBOARD_EDITION", "enterprise");
     const mod = await import("../route");
     PATCH = mod.PATCH;
   });
 
+  it("returns 402 ENTERPRISE_REQUIRED on community edition", async () => {
+    vi.stubEnv("NEOBOARD_EDITION", "");
+    vi.resetModules();
+    vi.doMock("@/lib/auth/session", () => ({
+      requireAdmin: mockRequireAdmin,
+    }));
+    vi.doMock("@/lib/db", () => ({ db: mockDb }));
+    vi.doMock("@/lib/crypto/crypto", () => ({ encrypt: mockEncrypt }));
+    vi.doMock("next/server", () => nextResponseMockFactory());
+    vi.doMock("@/lib/auth/sso/provider-cache", () => ({
+      invalidateProviderCache: mockInvalidateCache,
+    }));
+    const mod = await import("../route");
+    const res = await mod.PATCH(makeRequest({ id: "sso-1", name: "X" }));
+    expect(res.status).toBe(402);
+    const body = await res.json();
+    expect(body.error.code).toBe("ENTERPRISE_REQUIRED");
+  });
+
   it("returns 403 for non-admin", async () => {
     mockRequireAdmin.mockRejectedValue(new ForbiddenError());
     const res = await PATCH(makeRequest({ id: "sso-1", name: "Updated" }));
diff --git a/app/src/app/api/sso-providers/route.ts b/app/src/app/api/sso-providers/route.ts
index b223926e..1981accf 100644
--- a/app/src/app/api/sso-providers/route.ts
+++ b/app/src/app/api/sso-providers/route.ts
@@ -4,20 +4,13 @@ import { db } from "@/lib/db";
 import { ssoProviders } from "@/lib/db/schema";
 import { requireAdmin } from "@/lib/auth/session";
 import { encrypt } from "@/lib/crypto/crypto";
-import { validateBody, handleRouteError, forbidden } from "@/lib/api/api-utils";
+import { validateBody, handleRouteError } from "@/lib/api/api-utils";
 import { apiSuccess, apiError } from "@/lib/api/api-response";
 import { invalidateProviderCache } from "@/lib/auth/sso/provider-cache";
+import { requireFeature } from "@/lib/features/require-feature";
 
 const MAX_PROVIDERS_PER_TENANT = 5;
 
-/** SSO management requires NEOBOARD_EDITION=enterprise. */
-function requireEnterprise() {
-  if (process.env.NEOBOARD_EDITION !== "enterprise") {
-    return forbidden("SSO requires NEOBOARD_EDITION=enterprise");
-  }
-  return null;
-}
-
 const claimMappingSchema = z.object({
   claimKey: z.string().min(1),
   adminValue: z.string().optional(),
@@ -54,9 +47,8 @@ const updateProviderSchema = z.object({
 });
 
 export async function GET() {
-  const gate = requireEnterprise();
-  if (gate) return gate;
   try {
+    requireFeature("sso");
     const { tenantId } = await requireAdmin();
 
     const rows = await db
@@ -85,9 +77,8 @@ export async function GET() {
 }
 
 export async function POST(request: Request) {
-  const gate = requireEnterprise();
-  if (gate) return gate;
   try {
+    requireFeature("sso");
     const { tenantId } = await requireAdmin();
 
     const body = await request.json();
@@ -174,9 +165,8 @@ export async function POST(request: Request) {
 }
 
 export async function DELETE(request: Request) {
-  const gate = requireEnterprise();
-  if (gate) return gate;
   try {
+    requireFeature("sso");
     const { tenantId } = await requireAdmin();
 
     const url = new URL(request.url);
@@ -203,9 +193,8 @@ export async function DELETE(request: Request) {
 }
 
 export async function PATCH(request: Request) {
-  const gate = requireEnterprise();
-  if (gate) return gate;
   try {
+    requireFeature("sso");
     const { tenantId } = await requireAdmin();
 
     const body = await request.json();
diff --git a/app/src/components/__tests__/feature-gate.test.tsx b/app/src/components/__tests__/feature-gate.test.tsx
new file mode 100644
index 00000000..e2f67511
--- /dev/null
+++ b/app/src/components/__tests__/feature-gate.test.tsx
@@ -0,0 +1,83 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen } from "@testing-library/react";
+import React from "react";
+
+const mockUseFeature = vi.fn();
+
+vi.mock("@/hooks/use-features", () => ({
+  useFeature: (id: string) => mockUseFeature(id),
+}));
+
+const { FeatureGate } = await import("../feature-gate");
+
+describe("FeatureGate", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("renders children when the feature is enabled", () => {
+    mockUseFeature.mockReturnValue(true);
+    render(
+      <FeatureGate feature="sso">
+        <div>child content</div>
+      </FeatureGate>,
+    );
+    expect(screen.getByText("child content")).toBeInTheDocument();
+  });
+
+  it("renders the fallback when the feature is disabled", () => {
+    mockUseFeature.mockReturnValue(false);
+    render(
+      <FeatureGate feature="sso" fallback={<div>upgrade pls</div>}>
+        <div>child content</div>
+      </FeatureGate>,
+    );
+    expect(screen.queryByText("child content")).not.toBeInTheDocument();
+    expect(screen.getByText("upgrade pls")).toBeInTheDocument();
+  });
+
+  it("renders nothing when disabled with no fallback", () => {
+    mockUseFeature.mockReturnValue(false);
+    const { container } = render(
+      <FeatureGate feature="sso">
+        <div>child content</div>
+      </FeatureGate>,
+    );
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it("renders fallback during initial load (default hideOnLoading=true)", () => {
+    mockUseFeature.mockReturnValue(undefined);
+    render(
+      <FeatureGate feature="sso" fallback={<div>loading-or-disabled</div>}>
+        <div>child content</div>
+      </FeatureGate>,
+    );
+    expect(screen.queryByText("child content")).not.toBeInTheDocument();
+    expect(screen.getByText("loading-or-disabled")).toBeInTheDocument();
+  });
+
+  it("renders nothing during initial load when hideOnLoading=false", () => {
+    mockUseFeature.mockReturnValue(undefined);
+    const { container } = render(
+      <FeatureGate
+        feature="sso"
+        fallback={<div>upgrade pls</div>}
+        hideOnLoading={false}
+      >
+        <div>child content</div>
+      </FeatureGate>,
+    );
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it("passes the feature id to useFeature", () => {
+    mockUseFeature.mockReturnValue(true);
+    render(
+      <FeatureGate feature="custom-roles">
+        <div>x</div>
+      </FeatureGate>,
+    );
+    expect(mockUseFeature).toHaveBeenCalledWith("custom-roles");
+  });
+});
diff --git a/app/src/components/enterprise-required-empty-state.tsx b/app/src/components/enterprise-required-empty-state.tsx
new file mode 100644
index 00000000..038cf84e
--- /dev/null
+++ b/app/src/components/enterprise-required-empty-state.tsx
@@ -0,0 +1,99 @@
+"use client";
+
+import { Lock } from "lucide-react";
+import { EmptyState, Button } from "@neoboard/components";
+import type { FeatureId } from "@/hooks/use-features";
+
+interface EnterpriseRequiredEmptyStateProps {
+  readonly feature: FeatureId;
+  /** Override the auto-generated title (defaults to the feature label). */
+  readonly title?: string;
+  /** Override the auto-generated description. */
+  readonly description?: string;
+  /** Override the upgrade link target. */
+  readonly upgradeUrl?: string;
+}
+
+/**
+ * Reusable empty state shown when an admin lands on a page that's gated
+ * behind an enterprise feature. Used by FeatureGate's `fallback` prop on
+ * pages that should still be reachable on community (for upsell), as
+ * opposed to those that should be hidden entirely from navigation.
+ */
+const FEATURE_LABELS: Record<
+  FeatureId,
+  { title: string; description: string }
+> = {
+  sso: {
+    title: "Single Sign-On",
+    description:
+      "Configure OIDC providers to let your team sign in with their existing identity provider (Okta, Azure AD, Google Workspace, Keycloak, etc.).",
+  },
+  "custom-roles": {
+    title: "Custom Roles",
+    description:
+      "Define roles beyond admin/creator/reader with fine-grained permissions.",
+  },
+  "user-groups": {
+    title: "User Groups",
+    description: "Organise users into groups and assign permissions by group.",
+  },
+  "connector-labels": {
+    title: "Connector Labels",
+    description: "Tag and filter database connections with custom labels.",
+  },
+  "connector-alias": {
+    title: "Connector Alias",
+    description:
+      "Define environment-specific aliases for the same logical connector.",
+  },
+  "environment-selector": {
+    title: "Environment Selector",
+    description:
+      "Switch dashboards between staging / production data sources without rebuilding.",
+  },
+  "bulk-import": {
+    title: "Bulk Import",
+    description: "Import dashboards, users, and connections from CSV or JSON.",
+  },
+  "dashboard-sharing-links": {
+    title: "Dashboard Sharing Links",
+    description: "Generate signed, expiring share links for external viewers.",
+  },
+  impersonation: {
+    title: "User Impersonation",
+    description: "Sign in as another user for support and troubleshooting.",
+  },
+  "session-management": {
+    title: "Session Management",
+    description: "View and revoke active sessions across your tenant.",
+  },
+  "ast-completion": {
+    title: "AST-Based Query Completion",
+    description:
+      "Smarter Cypher/SQL completion powered by schema-aware AST parsing.",
+  },
+};
+
+export function EnterpriseRequiredEmptyState({
+  feature,
+  title,
+  description,
+  upgradeUrl = "https://neoboard.app/enterprise",
+}: EnterpriseRequiredEmptyStateProps) {
+  const defaults = FEATURE_LABELS[feature];
+  return (
+    <EmptyState
+      icon={<Lock className="h-8 w-8 text-muted-foreground" />}
+      title={title ?? `${defaults.title} is an Enterprise feature`}
+      description={description ?? defaults.description}
+      action={
+        <Button asChild>
+          <a href={upgradeUrl} target="_blank" rel="noopener noreferrer">
+            Learn about Enterprise
+          </a>
+        </Button>
+      }
+    />
+  );
+}
diff --git a/app/src/components/feature-gate.tsx b/app/src/components/feature-gate.tsx
new file mode 100644
index 00000000..3f198e84
--- /dev/null
+++ b/app/src/components/feature-gate.tsx
@@ -0,0 +1,48 @@
+"use client";
+
+import type { ReactNode } from "react";
+import { useFeature, type FeatureId } from "@/hooks/use-features";
+
+interface FeatureGateProps {
+  readonly feature: FeatureId;
+  /** Rendered when the feature is enabled. */
+  readonly children: ReactNode;
+  /** Rendered when the feature is NOT enabled or still loading. Defaults to nothing. */
+  readonly fallback?: ReactNode;
+  /**
+   * When true, render the fallback during the initial load (recommended for
+   * UI that would flash an enterprise-only surface before the features list
+   * loads). Default: true.
+   */
+  readonly hideOnLoading?: boolean;
+}
+
+/**
+ * Declarative client-side enterprise feature gate.
+ *
+ * - Reads from `useFeature(feature)` (TanStack Query, 5-min cache)
+ * - Renders `children` only when the feature is enabled
+ * - Renders `fallback` (default: nothing) when disabled OR still loading
+ *
+ * For server-side gating, use `requireFeature(feature)` in API route handlers.
+ *
+ * @example
+ * <FeatureGate feature="sso" fallback={<EnterpriseRequiredEmptyState feature="sso" />}>
+ *   <SsoProviderManagement />
+ * </FeatureGate>
+ */
+export function FeatureGate({
+  feature,
+  children,
+  fallback = null,
+  hideOnLoading = true,
+}: FeatureGateProps) {
+  const enabled = useFeature(feature);
+  if (enabled === undefined) {
+    return <>{hideOnLoading ? fallback : null}</>;
+  }
+  if (!enabled) {
+    return <>{fallback}</>;
+  }
+  return <>{children}</>;
+}
diff --git a/app/src/hooks/__tests__/use-dashboards.test.ts b/app/src/hooks/__tests__/use-dashboards.test.ts
index 8da02bb6..911ffe51 100644
--- a/app/src/hooks/__tests__/use-dashboards.test.ts
+++ b/app/src/hooks/__tests__/use-dashboards.test.ts
@@ -12,6 +12,7 @@ const {
   useDashboards,
   useDashboard,
   useCreateDashboard,
+  useUpdateDashboard,
   useDeleteDashboard,
   useDuplicateDashboard,
   useImportDashboard,
@@ -166,6 +167,94 @@ describe("use-dashboards", () => {
     });
   });
 
+  // ── useUpdateDashboard ──────────────────────────────────────────────
+  describe("useUpdateDashboard mutationFn + onSuccess", () => {
+    it("PUTs to /api/dashboards/:id with body + expectedVersion", async () => {
+      const input = {
+        id: "d-abc",
+        name: "Renamed",
+        expectedVersion: 7,
+      };
+      const updated = { id: "d-abc", name: "Renamed", version: 8 };
+      vi.spyOn(globalThis, "fetch").mockResolvedValueOnce(
+        mockResponse(updated),
+      );
+      const config = useUpdateDashboard() as unknown as {
+        mutationFn: (i: typeof input) => Promise<unknown>;
+      };
+      const result = await config.mutationFn(input);
+      expect(result).toEqual(updated);
+      expect(globalThis.fetch).toHaveBeenCalledWith(
+        "/api/dashboards/d-abc",
+        expect.objectContaining({ method: "PUT" }),
+      );
+    });
+
+    // Helper: stub both `window` (for the gate) and the bare `sessionStorage`
+    // global (which the hook calls directly, matching the codebase's usage in
+    // `[id]/page.tsx`). Node test env doesn't provide either.
+    function withMockSessionStorage(
+      run: (setItem: ReturnType<typeof vi.fn>) => void,
+    ) {
+      const setItem = vi.fn();
+      vi.stubGlobal("window", {
+        sessionStorage: { setItem, getItem: vi.fn(), removeItem: vi.fn() },
+      });
+      vi.stubGlobal("sessionStorage", {
+        setItem,
+        getItem: vi.fn(),
+        removeItem: vi.fn(),
+      });
+      try {
+        run(setItem);
+      } finally {
+        vi.unstubAllGlobals();
+      }
+    }
+
+    it("onSuccess writes new version to sessionStorage", () => {
+      withMockSessionStorage((setItem) => {
+        const config = useUpdateDashboard() as unknown as {
+          onSuccess: (
+            result: { version: number },
+            variables: { id: string },
+          ) => void;
+        };
+        config.onSuccess({ version: 42 }, { id: "d-xyz" });
+        expect(setItem).toHaveBeenCalledWith("__nb_dash_ver_d-xyz", "42");
+      });
+    });
+
+    it("onSuccess skips sessionStorage write when result has no version", () => {
+      withMockSessionStorage((setItem) => {
+        const config = useUpdateDashboard() as unknown as {
+          onSuccess: (
+            result: { version?: number },
+            variables: { id: string },
+          ) => void;
+        };
+        config.onSuccess({}, { id: "d-no-version" });
+        expect(setItem).not.toHaveBeenCalled();
+      });
+    });
+
+    it("onSuccess skips sessionStorage write when version is not a number", () => {
+      withMockSessionStorage((setItem) => {
+        const config = useUpdateDashboard() as unknown as {
+          onSuccess: (
+            result: { version: unknown },
+            variables: { id: string },
+          ) => void;
+        };
+        config.onSuccess(
+          { version: "8" as unknown as number },
+          { id: "d-bad" },
+        );
+        expect(setItem).not.toHaveBeenCalled();
+      });
+    });
+  });
+
   // ── useDeleteDashboard ──────────────────────────────────────────────
   describe("useDeleteDashboard mutationFn", () => {
     it("DELETEs the dashboard by id", async () => {
diff --git a/app/src/hooks/__tests__/use-features.test.ts b/app/src/hooks/__tests__/use-features.test.ts
new file mode 100644
index 00000000..7e8c4487
--- /dev/null
+++ b/app/src/hooks/__tests__/use-features.test.ts
@@ -0,0 +1,89 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+// Mock React Query — we test the fetch logic, not React wiring
+vi.mock("@tanstack/react-query", () => ({
+  useQuery: vi.fn((config: Record<string, unknown>) => config),
+}));
+
+const { useFeatures, useFeature } = await import("../use-features");
+
+function mockResponse(body: unknown, status = 200): Response {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    json: () => Promise.resolve(body),
+  } as Response;
+}
+
+describe("useFeatures", () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("calls /api/features and unwraps the envelope", async () => {
+    const payload = {
+      edition: "enterprise",
+      features: ["sso", "custom-roles"],
+    };
+    vi.spyOn(globalThis, "fetch").mockResolvedValueOnce(
+      mockResponse({ data: payload, error: null, meta: null }),
+    );
+    const config = useFeatures() as unknown as {
+      queryFn: () => Promise<unknown>;
+      queryKey: unknown[];
+      staleTime: number;
+    };
+    const result = await config.queryFn();
+    expect(result).toEqual(payload);
+    expect(globalThis.fetch).toHaveBeenCalledWith("/api/features");
+  });
+
+  it("uses queryKey ['features'] and 5-minute staleTime", () => {
+    const config = useFeatures() as unknown as {
+      queryKey: unknown[];
+      staleTime: number;
+    };
+    expect(config.queryKey).toEqual(["features"]);
+    expect(config.staleTime).toBe(5 * 60 * 1000);
+  });
+});
+
+describe("useFeature", () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("returns undefined while features are loading", async () => {
+    const reactQuery = await import("@tanstack/react-query");
+    vi.mocked(reactQuery.useQuery).mockReturnValueOnce({
+      data: undefined,
+    } as ReturnType<typeof reactQuery.useQuery>);
+    expect(useFeature("sso")).toBeUndefined();
+  });
+
+  it("returns true when the feature is in the list", async () => {
+    const reactQuery = await import("@tanstack/react-query");
+    vi.mocked(reactQuery.useQuery).mockReturnValueOnce({
+      data: { edition: "enterprise", features: ["sso", "user-groups"] },
+    } as ReturnType<typeof reactQuery.useQuery>);
+    expect(useFeature("sso")).toBe(true);
+  });
+
+  it("returns false when the feature is not in the list", async () => {
+    const reactQuery = await import("@tanstack/react-query");
+    vi.mocked(reactQuery.useQuery).mockReturnValueOnce({
+      data: { edition: "community", features: [] },
+    } as ReturnType<typeof reactQuery.useQuery>);
+    expect(useFeature("sso")).toBe(false);
+  });
+
+  it("returns false on community edition for every gated feature", async () => {
+    const reactQuery = await import("@tanstack/react-query");
+    vi.mocked(reactQuery.useQuery).mockReturnValue({
+      data: { edition: "community", features: [] },
+    } as ReturnType<typeof reactQuery.useQuery>);
+    expect(useFeature("sso")).toBe(false);
+    expect(useFeature("custom-roles")).toBe(false);
+    expect(useFeature("bulk-import")).toBe(false);
+  });
+});
diff --git a/app/src/hooks/use-dashboards.ts b/app/src/hooks/use-dashboards.ts
index 5060eb93..1111fdef 100644
--- a/app/src/hooks/use-dashboards.ts
+++ b/app/src/hooks/use-dashboards.ts
@@ -8,6 +8,21 @@ import type { DashboardLayout, DashboardLayoutV2 } from "@/lib/db/schema";
 export interface ImportDashboardInput {
   payload: unknown;
   connectionMapping: Record<string, string>;
+  /**
+   * Connection placeholder keys the user explicitly chose to skip. Widgets
+   * referencing a skipped key are imported with `connectionId=""` and surfaced
+   * in the response notes.
+   */
+  skippedConnections?: string[];
+}
+
+/**
+ * Import response shape. Existing callers that only read `id` continue to
+ * work; new callers can render the notes list (mapping summary, chart-type
+ * downgrades, skipped connections, etc.).
+ */
+export interface ImportDashboardResult extends DashboardDetail {
+  notes: string[];
 }
 
 export interface WidgetPreviewItem {
@@ -131,7 +146,28 @@ export function useUpdateDashboard() {
       }
       return unwrapResponse(res);
     },
-    onSuccess: (_, variables) => {
+    onSuccess: (result, variables) => {
+      // Update the version-bump baseline in sessionStorage BEFORE invalidating
+      // the cache. The dashboard detail page (`[id]/page.tsx`) compares the
+      // refetched server version to this stored value to decide whether to
+      // show the "Dashboard updated by X" banner. Without this, a successful
+      // self-save would always trigger that banner on the user's own next
+      // visit (the refetch sees version N+1, sessionStorage still says N →
+      // banner fires with the user's own name).
+      //
+      // TanStack Query guarantees onSuccess runs before invalidateQueries'
+      // refetch lands, so the sessionStorage write is in place by the time
+      // the detail page's effect reads it.
+      if (typeof window !== "undefined") {
+        const newVersion = (result as { version?: unknown } | undefined)
+          ?.version;
+        if (typeof newVersion === "number") {
+          sessionStorage.setItem(
+            `__nb_dash_ver_${variables.id}`,
+            String(newVersion),
+          );
+        }
+      }
       queryClient.invalidateQueries({
         queryKey: ["dashboards", variables.id],
       });
@@ -207,7 +243,7 @@ export function useImportDashboard() {
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify(body),
       });
-      return unwrapResponse<DashboardDetail>(res);
+      return unwrapResponse<ImportDashboardResult>(res);
     },
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ["dashboards"] });
diff --git a/app/src/hooks/use-features.ts b/app/src/hooks/use-features.ts
new file mode 100644
index 00000000..c9dbb6ca
--- /dev/null
+++ b/app/src/hooks/use-features.ts
@@ -0,0 +1,57 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import { unwrapResponse } from "@/lib/api/api-client";
+
+export type Edition = "community" | "enterprise";
+
+export type FeatureId =
+  | "sso"
+  | "custom-roles"
+  | "user-groups"
+  | "connector-labels"
+  | "connector-alias"
+  | "environment-selector"
+  | "bulk-import"
+  | "dashboard-sharing-links"
+  | "impersonation"
+  | "session-management"
+  | "ast-completion";
+
+export interface FeaturesResponse {
+  edition: Edition;
+  features: FeatureId[];
+}
+
+/**
+ * Reads the current edition + enabled feature list from `/api/features`.
+ *
+ * Backed by TanStack Query with a 5-minute staleTime. Edition is an
+ * honour-based env flag (`NEOBOARD_EDITION`) — operators flip it server-
+ * side, restart, and the next request reflects the new value. A 5-minute
+ * client cache is acceptable for this cadence; if you need an immediate
+ * reaction to a flip, invalidate the `["features"]` query.
+ */
+export function useFeatures() {
+  return useQuery<FeaturesResponse>({
+    queryKey: ["features"],
+    queryFn: async () => {
+      const res = await fetch("/api/features");
+      return unwrapResponse<FeaturesResponse>(res);
+    },
+    staleTime: 5 * 60 * 1000,
+  });
+}
+
+/**
+ * Convenience: `useFeature("sso")` returns `true | false | undefined`.
+ *
+ * `undefined` means the features list hasn't loaded yet — callers
+ * should treat it the same as "feature absent" for gating UX (don't
+ * flash enterprise UI during the initial load).
+ */
+export function useFeature(id: FeatureId): boolean | undefined {
+  const { data } = useFeatures();
+  if (!data) return undefined;
+  return data.features.includes(id);
+}
diff --git a/app/src/instrumentation.ts b/app/src/instrumentation.ts
index e9668b8a..ff632f64 100644
--- a/app/src/instrumentation.ts
+++ b/app/src/instrumentation.ts
@@ -66,6 +66,23 @@ export async function register() {
     );
   }
 
+  // Dev-only: warn about seeded connections that reference unreachable hosts.
+  // Fire-and-forget; startup never waits on DNS. Common cause: seed ran inside
+  // the docker-app container (where NEO4J_HOST/PG_HOST resolved to container
+  // names) and the dev server later runs on the host where those names don't
+  // resolve. #899
+  if (process.env.NODE_ENV === "development") {
+    void (async () => {
+      try {
+        const { verifyConnectionHosts } =
+          await import("@/lib/dev/verify-connection-hosts");
+        await verifyConnectionHosts();
+      } catch {
+        // Never let the check crash startup.
+      }
+    })();
+  }
+
   // Bootstrap the first admin user when the database is empty.
   const email = process.env.BOOTSTRAP_ADMIN_EMAIL;
   const password = process.env.BOOTSTRAP_ADMIN_PASSWORD;
diff --git a/app/src/lib/__tests__/dashboard/neodash-converter.test.ts b/app/src/lib/__tests__/dashboard/neodash-converter.test.ts
index f73598a1..ac969b89 100644
--- a/app/src/lib/__tests__/dashboard/neodash-converter.test.ts
+++ b/app/src/lib/__tests__/dashboard/neodash-converter.test.ts
@@ -199,7 +199,9 @@ describe("convertNeoDash", () => {
         query: "MATCH (n) WHERE n.name = $neodash_userName RETURN n",
       }),
     );
-    expect(result.layout.pages[0].widgets[0].query).toBe(
+    // Referencing $param_userName triggers a Filters page being prepended
+    // (auto-generated parameter-select for the undefined param). Original at index 1.
+    expect(result.layout.pages[1].widgets[0].query).toBe(
       "MATCH (n) WHERE n.name = $param_userName RETURN n",
     );
   });
@@ -438,7 +440,8 @@ describe("convertNeoDash", () => {
           "MATCH (n) WHERE n.name = $neodash_name AND n.age > $neodash_minAge RETURN n",
       }),
     );
-    expect(result.layout.pages[0].widgets[0].query).toBe(
+    // Two referenced params → Filters page prepended; original page at index 1.
+    expect(result.layout.pages[1].widgets[0].query).toBe(
       "MATCH (n) WHERE n.name = $param_name AND n.age > $param_minAge RETURN n",
     );
   });
diff --git a/app/src/lib/__tests__/env-config.test.ts b/app/src/lib/__tests__/env-config.test.ts
index 47d447eb..81fa3cf4 100644
--- a/app/src/lib/__tests__/env-config.test.ts
+++ b/app/src/lib/__tests__/env-config.test.ts
@@ -10,6 +10,7 @@ describe("validateEnvConfig", () => {
     process.env.ENCRYPTION_KEY = "a".repeat(64);
     process.env.NEXTAUTH_SECRET = "b".repeat(32);
     process.env.NEXTAUTH_URL = "http://localhost:3000";
+    process.env.API_KEY_HMAC_SECRET = "c".repeat(64);
   });
 
   afterEach(() => {
@@ -104,6 +105,24 @@ describe("validateEnvConfig", () => {
     expect(result.status).toBe("ok");
   });
 
+  it("returns error when API_KEY_HMAC_SECRET is missing", async () => {
+    delete process.env.API_KEY_HMAC_SECRET;
+    const result = await loadAndValidate();
+    expect(result.status).toBe("error");
+    expect(result.errors).toContainEqual(
+      expect.objectContaining({ key: "API_KEY_HMAC_SECRET", level: "error" }),
+    );
+  });
+
+  it("returns error when API_KEY_HMAC_SECRET is too short", async () => {
+    process.env.API_KEY_HMAC_SECRET = "short";
+    const result = await loadAndValidate();
+    expect(result.status).toBe("error");
+    expect(result.errors).toContainEqual(
+      expect.objectContaining({ key: "API_KEY_HMAC_SECRET", level: "error" }),
+    );
+  });
+
   it("returns error when NEXTAUTH_SECRET is too short", async () => {
     process.env.NEXTAUTH_SECRET = "short";
     const result = await loadAndValidate();
diff --git a/app/src/lib/dashboard/__tests__/neodash-converter.test.ts b/app/src/lib/dashboard/__tests__/neodash-converter.test.ts
new file mode 100644
index 00000000..b712695f
--- /dev/null
+++ b/app/src/lib/dashboard/__tests__/neodash-converter.test.ts
@@ -0,0 +1,420 @@
+import { describe, it, expect } from "vitest";
+import {
+  isNeoDashFormat,
+  convertNeoDashWithNotes,
+  inferParameterType,
+  extractParamReferences,
+} from "@/lib/dashboard/neodash-converter";
+
+// ---------------------------------------------------------------------------
+// Fixture builders
+// ---------------------------------------------------------------------------
+
+function makeReport(
+  overrides: Partial<{
+    id: string;
+    title: string;
+    type: string;
+    query: string;
+    settings: Record<string, unknown>;
+  }> = {},
+) {
+  return {
+    id: overrides.id ?? "r1",
+    title: overrides.title ?? "Report",
+    type: overrides.type ?? "table",
+    query: overrides.query ?? "MATCH (n) RETURN n",
+    x: 0,
+    y: 0,
+    width: 6,
+    height: 4,
+    settings: overrides.settings ?? {},
+    parameters: {},
+  };
+}
+
+function makeNeoDash(
+  reports: ReturnType<typeof makeReport>[],
+  settings?: { parameters?: Record<string, unknown> },
+) {
+  return {
+    title: "Test Dashboard",
+    version: "2.4",
+    pages: [
+      {
+        title: "Page 1",
+        reports,
+      },
+    ],
+    ...(settings ? { settings } : {}),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// isNeoDashFormat
+// ---------------------------------------------------------------------------
+
+describe("isNeoDashFormat", () => {
+  it("recognizes a NeoDash v2.x dashboard", () => {
+    expect(isNeoDashFormat(makeNeoDash([makeReport()]))).toBe(true);
+  });
+
+  it("rejects null / undefined / non-objects", () => {
+    expect(isNeoDashFormat(null)).toBe(false);
+    expect(isNeoDashFormat(undefined)).toBe(false);
+    expect(isNeoDashFormat("string")).toBe(false);
+    expect(isNeoDashFormat(42)).toBe(false);
+  });
+
+  it("rejects arrays", () => {
+    expect(isNeoDashFormat([])).toBe(false);
+  });
+
+  it("rejects objects without pages", () => {
+    expect(isNeoDashFormat({ title: "x" })).toBe(false);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// inferParameterType
+// ---------------------------------------------------------------------------
+
+describe("inferParameterType", () => {
+  it("returns multi-select for arrays", () => {
+    expect(inferParameterType([])).toBe("multi-select");
+    expect(inferParameterType(["a", "b"])).toBe("multi-select");
+  });
+
+  it("returns number-range for finite numbers", () => {
+    expect(inferParameterType(0)).toBe("number-range");
+    expect(inferParameterType(42)).toBe("number-range");
+    expect(inferParameterType(3.14)).toBe("number-range");
+  });
+
+  it("does not return number-range for NaN / Infinity", () => {
+    expect(inferParameterType(Number.NaN)).toBe("select");
+    expect(inferParameterType(Number.POSITIVE_INFINITY)).toBe("select");
+  });
+
+  it("returns text for empty string", () => {
+    expect(inferParameterType("")).toBe("text");
+  });
+
+  it("returns select for non-empty strings (NeoDash's most common case)", () => {
+    expect(inferParameterType("foo")).toBe("select");
+    expect(inferParameterType("Y")).toBe("select");
+    expect(inferParameterType("N")).toBe("select");
+  });
+
+  it("returns select for null / undefined / objects", () => {
+    expect(inferParameterType(null)).toBe("select");
+    expect(inferParameterType(undefined)).toBe("select");
+    expect(inferParameterType({})).toBe("select");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// extractParamReferences
+// ---------------------------------------------------------------------------
+
+describe("extractParamReferences", () => {
+  it("extracts $param_xxx names from queries", () => {
+    const refs = extractParamReferences([
+      "MATCH (n) WHERE n.name = $param_userName RETURN n",
+      "MATCH (m) WHERE m.year > $param_year RETURN m",
+    ]);
+    expect([...refs].sort()).toEqual(["userName", "year"]);
+  });
+
+  it("returns unique names when referenced multiple times", () => {
+    const refs = extractParamReferences(["$param_x + $param_x + $param_y"]);
+    expect([...refs].sort()).toEqual(["x", "y"]);
+  });
+
+  it("ignores $paramX without underscore", () => {
+    const refs = extractParamReferences(["$paramFoo"]);
+    expect(refs.size).toBe(0);
+  });
+
+  it("ignores bare param_xxx without leading $", () => {
+    const refs = extractParamReferences(["param_foo"]);
+    expect(refs.size).toBe(0);
+  });
+
+  it("skips empty / undefined queries", () => {
+    const refs = extractParamReferences(["", "$param_x"]);
+    expect([...refs]).toEqual(["x"]);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// convertNeoDashWithNotes — markdown content
+// ---------------------------------------------------------------------------
+
+describe("convertNeoDashWithNotes — markdown widgets", () => {
+  it("moves text report.query into settings.content and clears widget.query", () => {
+    const nd = makeNeoDash([
+      makeReport({
+        type: "text",
+        title: "Welcome",
+        query: "## Hello\n\nMarkdown content here.",
+      }),
+    ]);
+
+    const { export: exp, notes } = convertNeoDashWithNotes(nd);
+    const widget = exp.layout.pages[0].widgets[0];
+
+    expect(widget.chartType).toBe("markdown");
+    expect(widget.query).toBe("");
+    expect((widget.settings as Record<string, unknown>).content).toBe(
+      "## Hello\n\nMarkdown content here.",
+    );
+    expect(notes).toContain('Imported markdown content for "Welcome"');
+  });
+
+  it("handles 'markdown' type the same as 'text'", () => {
+    const nd = makeNeoDash([
+      makeReport({
+        type: "markdown",
+        title: "Notes",
+        query: "**bold**",
+      }),
+    ]);
+
+    const { export: exp } = convertNeoDashWithNotes(nd);
+    const widget = exp.layout.pages[0].widgets[0];
+    expect(widget.chartType).toBe("markdown");
+    expect(widget.query).toBe("");
+    expect((widget.settings as Record<string, unknown>).content).toBe(
+      "**bold**",
+    );
+  });
+
+  it("does not add a markdown note when report.query is empty", () => {
+    const nd = makeNeoDash([
+      makeReport({ type: "text", title: "Empty MD", query: "" }),
+    ]);
+    const { notes } = convertNeoDashWithNotes(nd);
+    expect(notes.some((n) => n.includes("Imported markdown content"))).toBe(
+      false,
+    );
+  });
+
+  it("leaves non-markdown widgets' query in place (no settings.content)", () => {
+    const nd = makeNeoDash([
+      makeReport({
+        type: "bar",
+        title: "Bar",
+        query: "MATCH (n) RETURN n.year, count(*)",
+      }),
+    ]);
+    const widget =
+      convertNeoDashWithNotes(nd).export.layout.pages[0].widgets[0];
+    expect(widget.query).toBe("MATCH (n) RETURN n.year, count(*)");
+    expect(
+      (widget.settings as Record<string, unknown>).content,
+    ).toBeUndefined();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// convertNeoDashWithNotes — parameter widgets
+// ---------------------------------------------------------------------------
+
+describe("convertNeoDashWithNotes — parameter widgets", () => {
+  it("creates a parameter-select widget for each referenced + defined param", () => {
+    const nd = makeNeoDash(
+      [
+        makeReport({
+          query: "MATCH (n) WHERE n.year = $neodash_year RETURN n",
+        }),
+      ],
+      { parameters: { neodash_year: 2024 } },
+    );
+
+    const { export: exp, notes } = convertNeoDashWithNotes(nd);
+    expect(exp.layout.pages).toHaveLength(2); // Filters + original
+    expect(exp.layout.pages[0].title).toBe("Filters");
+    const filterWidget = exp.layout.pages[0].widgets[0];
+    expect(filterWidget.chartType).toBe("parameter-select");
+    const s = filterWidget.settings as Record<string, unknown>;
+    expect(s.parameterName).toBe("year");
+    expect(s.parameterType).toBe("number-range");
+    expect(s.defaultValue).toBe(2024);
+    expect(notes.some((n) => n.includes("$param_year"))).toBe(true);
+
+    // Verify the original widget's query was rewritten from $neodash_year
+    // → $param_year (CR finding: the test asserted filter creation but not
+    // the parallel query-syntax conversion).
+    const originalWidget = exp.layout.pages[1].widgets[0];
+    expect(originalWidget.query).toContain("$param_year");
+    expect(originalWidget.query).not.toContain("$neodash_year");
+  });
+
+  it("skips parameters that are defined but never referenced", () => {
+    const nd = makeNeoDash([makeReport({ query: "MATCH (n) RETURN n" })], {
+      parameters: { neodash_unused: "x", neodash_other: 5 },
+    });
+
+    const { export: exp, notes } = convertNeoDashWithNotes(nd);
+    expect(exp.layout.pages).toHaveLength(1); // No Filters page
+    expect(notes.filter((n) => n.includes("never referenced"))).toHaveLength(2);
+  });
+
+  it("creates parameter-select for referenced-but-undefined params with a warning note", () => {
+    // Use realistic NeoDash syntax — convertParamSyntax rewrites it to $param_,
+    // and the extractor sees the rewritten form (CR finding: tests should
+    // exercise the conversion path, not bypass it).
+    const nd = makeNeoDash([
+      makeReport({
+        query: "MATCH (n) WHERE n.name = $neodash_undeclared RETURN n",
+      }),
+    ]);
+
+    const { export: exp, notes } = convertNeoDashWithNotes(nd);
+    expect(exp.layout.pages).toHaveLength(2);
+    const filterWidget = exp.layout.pages[0].widgets[0];
+    expect(
+      (filterWidget.settings as Record<string, unknown>).parameterName,
+    ).toBe("undeclared");
+    expect(
+      (filterWidget.settings as Record<string, unknown>).defaultValue,
+    ).toBeUndefined();
+    expect(notes.some((n) => n.includes("not defined in NeoDash"))).toBe(true);
+  });
+
+  it("infers types correctly per default value", () => {
+    // Use real NeoDash $neodash_ syntax so the conversion path is exercised
+    // (CR finding: pre-converted $param_ bypasses convertParamSyntax).
+    const nd = makeNeoDash(
+      [
+        makeReport({
+          query:
+            "$neodash_str $neodash_emp $neodash_arr $neodash_num $neodash_yn",
+        }),
+      ],
+      {
+        parameters: {
+          neodash_str: "value",
+          neodash_emp: "",
+          neodash_arr: ["a"],
+          neodash_num: 10,
+          neodash_yn: "Y",
+        },
+      },
+    );
+
+    const { export: exp } = convertNeoDashWithNotes(nd);
+    const byName = Object.fromEntries(
+      exp.layout.pages[0].widgets.map((w) => [
+        (w.settings as Record<string, unknown>).parameterName as string,
+        (w.settings as Record<string, unknown>).parameterType as string,
+      ]),
+    );
+    expect(byName.str).toBe("select");
+    expect(byName.emp).toBe("text");
+    expect(byName.arr).toBe("multi-select");
+    expect(byName.num).toBe("number-range");
+    expect(byName.yn).toBe("select");
+  });
+
+  it("strips the 'neodash_' prefix from parameter names", () => {
+    const nd = makeNeoDash([makeReport({ query: "$neodash_userId" })], {
+      parameters: { neodash_userId: "alice" },
+    });
+
+    const { export: exp } = convertNeoDashWithNotes(nd);
+    expect(
+      (exp.layout.pages[0].widgets[0].settings as Record<string, unknown>)
+        .parameterName,
+    ).toBe("userId");
+  });
+
+  it("does not create a Filters page when no params are referenced", () => {
+    const nd = makeNeoDash([makeReport({ query: "MATCH (n) RETURN n" })]);
+    const { export: exp } = convertNeoDashWithNotes(nd);
+    expect(exp.layout.pages).toHaveLength(1);
+    expect(exp.layout.pages[0].title).toBe("Page 1");
+  });
+
+  it("tiles param widgets 4-per-row at w=3 h=2", () => {
+    const params: Record<string, unknown> = {};
+    const queryParts: string[] = [];
+    for (let i = 0; i < 6; i++) {
+      params[`neodash_p${i}`] = `v${i}`;
+      queryParts.push(`$neodash_p${i}`);
+    }
+    const nd = makeNeoDash([makeReport({ query: queryParts.join(" ") })], {
+      parameters: params,
+    });
+
+    const { export: exp } = convertNeoDashWithNotes(nd);
+    const filtersGrid = exp.layout.pages[0].gridLayout;
+    expect(filtersGrid).toHaveLength(6);
+    // Row 0: 4 widgets at y=0, x=0/3/6/9
+    expect(filtersGrid.slice(0, 4).map((g) => g.y)).toEqual([0, 0, 0, 0]);
+    expect(filtersGrid.slice(0, 4).map((g) => g.x)).toEqual([0, 3, 6, 9]);
+    // Row 1: 2 widgets at y=2, x=0/3
+    expect(filtersGrid.slice(4, 6).map((g) => g.y)).toEqual([2, 2]);
+    expect(filtersGrid.slice(4, 6).map((g) => g.x)).toEqual([0, 3]);
+    // Every widget at w=3 h=2
+    expect(filtersGrid.every((g) => g.w === 3 && g.h === 2)).toBe(true);
+  });
+
+  it("number-range pre-populates rangeMin=min(default, 0) and rangeMax=max(default, 100)", () => {
+    const nd = makeNeoDash(
+      [
+        makeReport({
+          query: "$neodash_small $neodash_big $neodash_neg",
+        }),
+      ],
+      { parameters: { neodash_small: 5, neodash_big: 500, neodash_neg: -10 } },
+    );
+
+    const { export: exp } = convertNeoDashWithNotes(nd);
+    const byName = Object.fromEntries(
+      exp.layout.pages[0].widgets.map((w) => [
+        (w.settings as Record<string, unknown>).parameterName as string,
+        w.settings as Record<string, unknown>,
+      ]),
+    );
+    expect(byName.small.rangeMin).toBe(0);
+    expect(byName.small.rangeMax).toBe(100); // max(5, 100)
+    expect(byName.big.rangeMin).toBe(0);
+    expect(byName.big.rangeMax).toBe(500);
+    // CR caught: negative defaults need rangeMin to widen below 0
+    expect(byName.neg.rangeMin).toBe(-10);
+    expect(byName.neg.rangeMax).toBe(100);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// convertNeoDashWithNotes — connectionId default
+// ---------------------------------------------------------------------------
+
+describe("convertNeoDashWithNotes — defaultConnectionId", () => {
+  it("stamps the provided id on every widget", () => {
+    const nd = makeNeoDash([makeReport({ id: "a" }), makeReport({ id: "b" })]);
+    const { export: exp } = convertNeoDashWithNotes(nd, "conn-123");
+    for (const w of exp.layout.pages[0].widgets) {
+      expect(w.connectionId).toBe("conn-123");
+    }
+  });
+
+  it("falls back to empty string when omitted", () => {
+    const nd = makeNeoDash([makeReport()]);
+    const { export: exp } = convertNeoDashWithNotes(nd);
+    expect(exp.layout.pages[0].widgets[0].connectionId).toBe("");
+  });
+
+  it("filter widgets always have connectionId='' (no connection needed)", () => {
+    const nd = makeNeoDash([makeReport({ query: "$param_x" })], {
+      parameters: { neodash_x: "v" },
+    });
+    const { export: exp } = convertNeoDashWithNotes(nd, "conn-123");
+    // Original page widgets get the stamped connection
+    expect(exp.layout.pages[1].widgets[0].connectionId).toBe("conn-123");
+    // Filter widgets are parameter-select, no query, no connection
+    expect(exp.layout.pages[0].widgets[0].connectionId).toBe("");
+  });
+});
diff --git a/app/src/lib/dashboard/neodash-converter.ts b/app/src/lib/dashboard/neodash-converter.ts
index 7893fd59..9e621703 100644
--- a/app/src/lib/dashboard/neodash-converter.ts
+++ b/app/src/lib/dashboard/neodash-converter.ts
@@ -204,6 +204,51 @@ interface NeoDashJson {
   description?: string;
   version?: string;
   pages: NeoDashPage[];
+  /**
+   * NeoDash stores dashboard-wide parameters here. NeoBoard models
+   * parameters as outputs of explicit parameter-select widgets, so the
+   * converter auto-generates one widget per *referenced* parameter
+   * (unreferenced ones are dropped with a note).
+   */
+  settings?: {
+    parameters?: Record<string, unknown>;
+    [key: string]: unknown;
+  };
+}
+
+/**
+ * Inferred parameter-select `parameterType` from a NeoDash default value.
+ *
+ * NeoDash didn't track the parameter type — the value shape is the only
+ * hint we have. The user can change the type in the widget editor.
+ */
+type ParameterSelectType = "select" | "text" | "multi-select" | "number-range";
+
+export function inferParameterType(value: unknown): ParameterSelectType {
+  if (Array.isArray(value)) return "multi-select";
+  if (typeof value === "number" && Number.isFinite(value))
+    return "number-range";
+  if (typeof value === "string" && value === "") return "text";
+  // "Y" / "N" / arbitrary string / null / undefined / object — default to select
+  return "select";
+}
+
+/**
+ * Extract every `$param_<name>` reference from a list of widget queries.
+ * Returns the set of unique parameter names (without the `$param_` prefix).
+ *
+ * Run AFTER convertParamSyntax has rewritten `$neodash_*` → `$param_*`.
+ */
+export function extractParamReferences(queries: string[]): Set<string> {
+  const names = new Set<string>();
+  const re = /\$param_(\w+)/g;
+  for (const q of queries) {
+    if (!q) continue;
+    for (const match of q.matchAll(re)) {
+      names.add(match[1]);
+    }
+  }
+  return names;
 }
 
 export interface ConversionResult {
@@ -226,11 +271,27 @@ export function isNeoDashFormat(json: unknown): boolean {
   });
 }
 
-export function convertNeoDash(json: unknown): NeoboardExport {
-  return convertNeoDashWithNotes(json).export;
+/**
+ * Convert a NeoDash dashboard JSON to NeoBoard's export envelope.
+ *
+ * Pass `defaultConnectionId` to assign every widget to that connection.
+ * Omit to retain the legacy empty-string behavior (caller must fix up the
+ * connection later, or the dashboard will render with broken widgets).
+ *
+ * The single-connection model matches NeoDash's actual semantics — a NeoDash
+ * dashboard always pointed at one global Neo4j instance.
+ */
+export function convertNeoDash(
+  json: unknown,
+  defaultConnectionId = "",
+): NeoboardExport {
+  return convertNeoDashWithNotes(json, defaultConnectionId).export;
 }
 
-export function convertNeoDashWithNotes(json: unknown): ConversionResult {
+export function convertNeoDashWithNotes(
+  json: unknown,
+  defaultConnectionId = "",
+): ConversionResult {
   const nd = json as NeoDashJson;
   const notes: string[] = [];
 
@@ -274,11 +335,19 @@ export function convertNeoDashWithNotes(json: unknown): ConversionResult {
       const refreshSettings = convertRefreshRate(reportSettings);
       const paramDefaults = convertParameterDefaults(reportSettings);
 
+      // Markdown widget content lives in `settings.content`, not `query`.
+      // NeoDash stored markdown body in `report.query`; route it correctly
+      // and leave the widget's query empty (markdown is content-only).
+      const isMarkdown = chartType === "markdown";
+      if (isMarkdown && report.query) {
+        notes.push('Imported markdown content for "' + report.title + '"');
+      }
+
       widgets.push({
         id: widgetId,
         chartType,
-        connectionId: "",
-        query: convertParamSyntax(report.query ?? ""),
+        connectionId: defaultConnectionId,
+        query: isMarkdown ? "" : convertParamSyntax(report.query ?? ""),
         params: report.parameters ?? {},
         settings: {
           ...reportSettings,
@@ -286,6 +355,8 @@ export function convertNeoDashWithNotes(json: unknown): ConversionResult {
           ...(report.title ? { title: report.title } : {}),
           // Set area mode for NeoDash "area" chart type
           ...(originalType === "area" ? { chartOptions: { area: true } } : {}),
+          // Markdown: content moved out of report.query
+          ...(isMarkdown ? { content: report.query ?? "" } : {}),
           // Mapped settings
           ...(clickAction ? { clickAction } : {}),
           ...(stylingConfig ? { stylingConfig } : {}),
@@ -311,6 +382,16 @@ export function convertNeoDashWithNotes(json: unknown): ConversionResult {
     };
   });
 
+  // Auto-generate parameter-select widgets for every $param_* referenced
+  // in widget queries. NeoDash's dashboard-wide params don't map to a
+  // NeoBoard concept directly; the closest is a parameter-select widget
+  // that produces the value when rendered. Prepend them as a "Filters"
+  // page so they're visible before the data pages.
+  const filtersPage = buildFiltersPage(nd.settings?.parameters, pages, notes);
+  if (filtersPage) {
+    pages.unshift(filtersPage);
+  }
+
   const layout: DashboardLayoutV2 = {
     version: 2,
     pages,
@@ -330,3 +411,130 @@ export function convertNeoDashWithNotes(json: unknown): ConversionResult {
     notes,
   };
 }
+
+/**
+ * Build the auto-generated "Filters" page from NeoDash's dashboard-wide
+ * parameters. Returns null when no widgets would be created (no params
+ * referenced in any query, or no params at all).
+ *
+ * Walks two sets:
+ *   1. Defined in `nd.settings.parameters` → create widget if referenced;
+ *      skip with note otherwise
+ *   2. Referenced in queries but not defined → create with no default + warn
+ */
+function buildFiltersPage(
+  ndParams: Record<string, unknown> | undefined,
+  pages: { widgets: DashboardWidget[] }[],
+  notes: string[],
+): {
+  id: string;
+  title: string;
+  widgets: DashboardWidget[];
+  gridLayout: GridLayoutItem[];
+} | null {
+  const params = ndParams ?? {};
+  const referenced = extractParamReferences(
+    pages.flatMap((p) => p.widgets.map((w) => w.query ?? "")),
+  );
+  const definedNames = new Set(Object.keys(params));
+  const widgets: DashboardWidget[] = [];
+  const gridLayout: GridLayoutItem[] = [];
+
+  // 1. Iterate defined params: create if referenced, drop if not.
+  for (const rawName of Object.keys(params)) {
+    const value = params[rawName];
+    const paramName = rawName.startsWith("neodash_")
+      ? rawName.slice("neodash_".length)
+      : rawName;
+
+    if (!referenced.has(paramName)) {
+      notes.push(
+        "Parameter $param_" +
+          paramName +
+          " was defined in NeoDash but never referenced in any query — skipped",
+      );
+      continue;
+    }
+
+    const paramType = inferParameterType(value);
+    addFilterWidget(widgets, gridLayout, paramName, paramType, value);
+    notes.push(
+      "Created parameter-select widget for $param_" +
+        paramName +
+        " (type: " +
+        paramType +
+        ")",
+    );
+  }
+
+  // 2. Referenced but never defined: create with no default + warn.
+  for (const paramName of referenced) {
+    if (
+      definedNames.has(paramName) ||
+      definedNames.has("neodash_" + paramName)
+    ) {
+      continue;
+    }
+    addFilterWidget(widgets, gridLayout, paramName, "select", undefined);
+    notes.push(
+      "Created parameter-select widget for $param_" +
+        paramName +
+        " with no default (referenced in query but not defined in NeoDash settings)",
+    );
+  }
+
+  if (widgets.length === 0) return null;
+  return {
+    id: crypto.randomUUID(),
+    title: "Filters",
+    widgets,
+    gridLayout,
+  };
+}
+
+/**
+ * Tile a new parameter-select widget into the Filters page grid.
+ * Layout: 4 widgets per row at w=3, h=2 (Filters page is 12 cols wide).
+ */
+function addFilterWidget(
+  widgets: DashboardWidget[],
+  gridLayout: GridLayoutItem[],
+  parameterName: string,
+  parameterType: ParameterSelectType,
+  defaultValue: unknown,
+): void {
+  const id = crypto.randomUUID();
+  const index = widgets.length;
+  const x = (index % 4) * 3;
+  const y = Math.floor(index / 4) * 2;
+
+  const settings: Record<string, unknown> = {
+    title: parameterName,
+    parameterName,
+    parameterType,
+  };
+  // Pre-populate the default when we know it. We don't try to reverse-engineer
+  // the seed query for select-typed params from a hard-coded default; the user
+  // can wire the seed query in the editor.
+  if (defaultValue !== undefined) {
+    settings.defaultValue = defaultValue;
+  }
+  if (parameterType === "number-range" && typeof defaultValue === "number") {
+    // rangeMin/rangeMax must include defaultValue. CodeRabbit caught the
+    // negative-default bug: a default of -5 with rangeMin=0 would be outside
+    // the range. min(default, 0) keeps the floor at 0 for non-negative
+    // defaults (common case) while widening for negatives.
+    settings.rangeMin = Math.min(defaultValue, 0);
+    settings.rangeMax = Math.max(defaultValue, 100);
+  }
+
+  widgets.push({
+    id,
+    chartType: "parameter-select",
+    connectionId: "",
+    query: "",
+    params: {},
+    settings,
+  });
+  gridLayout.push({ i: id, x, y, w: 3, h: 2 });
+}
diff --git a/app/src/lib/dev/__tests__/verify-connection-hosts.test.ts b/app/src/lib/dev/__tests__/verify-connection-hosts.test.ts
new file mode 100644
index 00000000..f819c307
--- /dev/null
+++ b/app/src/lib/dev/__tests__/verify-connection-hosts.test.ts
@@ -0,0 +1,140 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import {
+  extractHostname,
+  verifyConnectionHostsImpl,
+} from "../verify-connection-hosts";
+
+// ---------------------------------------------------------------------------
+// extractHostname
+// ---------------------------------------------------------------------------
+
+describe("extractHostname", () => {
+  it("extracts host from bolt:// URI", () => {
+    expect(extractHostname("bolt://neoboard-neo4j:7687")).toBe(
+      "neoboard-neo4j",
+    );
+  });
+
+  it("extracts host from postgresql:// URI", () => {
+    expect(extractHostname("postgresql://user@localhost:5432/db")).toBe(
+      "localhost",
+    );
+  });
+
+  it("handles bare hostname without port", () => {
+    expect(extractHostname("bolt://example.com")).toBe("example.com");
+  });
+
+  it("returns null on malformed URI", () => {
+    expect(extractHostname("not a url")).toBe(null);
+    expect(extractHostname("")).toBe(null);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// verifyConnectionHostsImpl
+// ---------------------------------------------------------------------------
+
+describe("verifyConnectionHostsImpl", () => {
+  let warn: ReturnType<typeof vi.fn<(message: string) => void>>;
+  beforeEach(() => {
+    warn = vi.fn<(message: string) => void>();
+  });
+
+  it("does nothing when there are no seeded connections", async () => {
+    const result = await verifyConnectionHostsImpl({
+      fetchConnections: async () => [],
+      resolve: vi.fn(),
+      warn,
+    });
+    expect(result).toEqual([]);
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it("does not warn when every host resolves", async () => {
+    const result = await verifyConnectionHostsImpl({
+      fetchConnections: async () => [
+        { name: "Neo4j", type: "neo4j", uri: "bolt://localhost:7687" },
+        { name: "PG", type: "postgresql", uri: "postgresql://localhost:5432" },
+      ],
+      resolve: vi.fn().mockResolvedValue({ address: "127.0.0.1" }),
+      warn,
+    });
+    expect(result).toEqual([]);
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it("warns once per batch listing every unresolvable connection", async () => {
+    const result = await verifyConnectionHostsImpl({
+      fetchConnections: async () => [
+        { name: "Neo4j", type: "neo4j", uri: "bolt://neoboard-neo4j:7687" },
+        { name: "PG", type: "postgresql", uri: "postgresql://localhost:5432" },
+        {
+          name: "PG2",
+          type: "postgresql",
+          uri: "postgresql://neoboard-postgres:5432",
+        },
+      ],
+      resolve: vi.fn().mockImplementation((host: string) => {
+        if (host === "localhost")
+          return Promise.resolve({ address: "127.0.0.1" });
+        return Promise.reject(new Error("ENOTFOUND"));
+      }),
+      warn,
+    });
+    expect(result).toHaveLength(2);
+    expect(result.map((c) => c.name).sort()).toEqual(["Neo4j", "PG2"]);
+    expect(warn).toHaveBeenCalledTimes(1);
+    const msg = warn.mock.calls[0][0] as string;
+    expect(msg).toContain("2 seeded connection(s)");
+    expect(msg).toContain('"Neo4j"');
+    expect(msg).toContain('"PG2"');
+    expect(msg).toContain("host=neoboard-neo4j");
+    expect(msg).toContain("host=neoboard-postgres");
+    expect(msg).not.toContain('"PG"'); // resolvable, not listed
+    expect(msg).toMatch(/seed-demo\.mjs/);
+  });
+
+  it("never logs credentials embedded in connection URIs", async () => {
+    await verifyConnectionHostsImpl({
+      fetchConnections: async () => [
+        {
+          name: "PG",
+          type: "postgresql",
+          uri: "postgresql://admin:supersecret@unreachable-host:5432/db",
+        },
+      ],
+      resolve: vi.fn().mockRejectedValue(new Error("ENOTFOUND")),
+      warn,
+    });
+    expect(warn).toHaveBeenCalledTimes(1);
+    const msg = warn.mock.calls[0][0] as string;
+    expect(msg).toContain("host=unreachable-host");
+    expect(msg).not.toContain("admin");
+    expect(msg).not.toContain("supersecret");
+  });
+
+  it("skips entries with malformed URIs (extractHostname returns null)", async () => {
+    const result = await verifyConnectionHostsImpl({
+      fetchConnections: async () => [
+        { name: "Bad", type: "neo4j", uri: "garbage" },
+      ],
+      resolve: vi.fn(),
+      warn,
+    });
+    expect(result).toEqual([]);
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it("returns silently when fetchConnections throws (e.g. DB unreachable)", async () => {
+    const result = await verifyConnectionHostsImpl({
+      fetchConnections: async () => {
+        throw new Error("DB connection failed");
+      },
+      resolve: vi.fn(),
+      warn,
+    });
+    expect(result).toEqual([]);
+    expect(warn).not.toHaveBeenCalled();
+  });
+});
diff --git a/app/src/lib/dev/verify-connection-hosts.ts b/app/src/lib/dev/verify-connection-hosts.ts
new file mode 100644
index 00000000..551b827e
--- /dev/null
+++ b/app/src/lib/dev/verify-connection-hosts.ts
@@ -0,0 +1,153 @@
+/**
+ * Dev-only sanity check: warn at startup when seeded connection URIs point
+ * at unresolvable hosts.
+ *
+ * **Why**: a seed-baked URI like `bolt://neoboard-neo4j:7687` works inside
+ * the docker-app container's network but not when you later run `npm run dev`
+ * on the host. Without this check, the user discovers the problem only when
+ * they open the dashboards UI and every widget errors. Better to surface it
+ * at startup with a one-line fix.
+ *
+ * Fires only in `NODE_ENV === "development"`. Fire-and-forget — startup
+ * does not wait on this.
+ *
+ * #899
+ */
+import { lookup as dnsLookupCallback } from "node:dns";
+import { promisify } from "node:util";
+
+const dnsLookup = promisify(dnsLookupCallback);
+
+const PROMPT_HINT =
+  "Re-seed from host with: set -a && source app/.env.local && set +a && node scripts/seed-demo.mjs";
+
+interface SeededConnection {
+  name: string;
+  type: string;
+  uri: string;
+}
+
+interface VerifyDeps {
+  /** Fetch seeded connections. Injectable for tests. */
+  fetchConnections: () => Promise<SeededConnection[]>;
+  /** Hostname resolver. Injectable for tests. */
+  resolve: (host: string) => Promise<unknown>;
+  /** Sink for warnings. Injectable for tests. */
+  warn: (message: string) => void;
+}
+
+/**
+ * Extract the hostname from a URI like `bolt://host:7687` or
+ * `postgresql://user@host:5432/db`. Returns null on malformed URIs.
+ */
+export function extractHostname(uri: string): string | null {
+  try {
+    return new URL(uri).hostname || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Core checker — pure aside from the injected deps.
+ *
+ * Returns the list of unresolvable connections so callers can act / test.
+ */
+export async function verifyConnectionHostsImpl(
+  deps: VerifyDeps,
+): Promise<SeededConnection[]> {
+  let connections: SeededConnection[];
+  try {
+    connections = await deps.fetchConnections();
+  } catch {
+    // DB unreachable, table empty, etc — nothing to verify.
+    return [];
+  }
+  if (connections.length === 0) return [];
+
+  const unresolvable: SeededConnection[] = [];
+  await Promise.all(
+    connections.map(async (c) => {
+      const host = extractHostname(c.uri);
+      if (!host) return;
+      try {
+        await deps.resolve(host);
+      } catch {
+        unresolvable.push(c);
+      }
+    }),
+  );
+
+  if (unresolvable.length > 0) {
+    deps.warn(
+      "⚠ " +
+        unresolvable.length +
+        " seeded connection(s) reference unreachable hosts:\n" +
+        unresolvable
+          .map((c) => {
+            // Log host only — decrypted URIs may carry `user:password@host`
+            // and we must never write credentials to logs.
+            const host = extractHostname(c.uri) ?? "<invalid-uri>";
+            return `   - "${c.name}" (${c.type}): host=${host}`;
+          })
+          .join("\n") +
+        "\n   Fix: " +
+        PROMPT_HINT,
+    );
+  }
+  return unresolvable;
+}
+
+/**
+ * Default entry-point used by instrumentation. Resolves the real db +
+ * crypto deps and runs the check. Guards `NODE_ENV === "development"`
+ * itself so the caller doesn't have to.
+ *
+ * Fire-and-forget.
+ */
+export async function verifyConnectionHosts(): Promise<void> {
+  if (process.env.NODE_ENV !== "development") return;
+  try {
+    const [{ db }, schema, crypto, { eq }] = await Promise.all([
+      import("@/lib/db"),
+      import("@/lib/db/schema"),
+      import("@/lib/crypto/crypto"),
+      import("drizzle-orm"),
+    ]);
+    const tenantId = process.env.TENANT_ID ?? "default";
+    await verifyConnectionHostsImpl({
+      fetchConnections: async () => {
+        // Every DB query must include tenant scoping, even diagnostics.
+        const rows = await db
+          .select({
+            name: schema.connections.name,
+            type: schema.connections.type,
+            configEncrypted: schema.connections.configEncrypted,
+          })
+          .from(schema.connections)
+          .where(eq(schema.connections.tenantId, tenantId));
+        const out: SeededConnection[] = [];
+        for (const r of rows) {
+          try {
+            const config = crypto.decryptJson(r.configEncrypted) as {
+              uri?: string;
+            };
+            if (config.uri) {
+              out.push({ name: r.name, type: r.type, uri: config.uri });
+            }
+          } catch {
+            // Skip rows we can't decrypt — env-key mismatch, corrupted blob, etc.
+          }
+        }
+        return out;
+      },
+      resolve: (host) => dnsLookup(host),
+      // Use console.warn (browser-safe + plays nicely with `next dev` output).
+      warn: (msg) => {
+        console.warn(msg);
+      },
+    });
+  } catch {
+    // Never crash startup on a verification failure.
+  }
+}
diff --git a/app/src/lib/env-config.ts b/app/src/lib/env-config.ts
index 4b3fa984..300e06bc 100644
--- a/app/src/lib/env-config.ts
+++ b/app/src/lib/env-config.ts
@@ -50,6 +50,18 @@ const ENV_VARS: EnvVar[] = [
         : "Must be at least 32 characters. Generate with: openssl rand -hex 32",
   },
   { key: "NEXTAUTH_URL", required: false },
+  {
+    // Required: API keys are a community feature available to every install
+    // (no enterprise gate on /api/keys or /settings/api-keys). Without this
+    // secret, the route throws at create time — users discover the problem
+    // only when they click "Create API Key". Fail fast at startup instead.
+    key: "API_KEY_HMAC_SECRET",
+    required: true,
+    validate: (v) =>
+      HEX_64.test(v) || v.length >= 32
+        ? null
+        : "Must be a 64-character hex string (32 bytes) or at least 32 chars. Generate with: openssl rand -hex 32",
+  },
 
   // ── Optional: Auth ──
   { key: "TENANT_ID", required: false },
@@ -58,7 +70,6 @@ const ENV_VARS: EnvVar[] = [
   { key: "ADMIN_BOOTSTRAP_TOKEN", required: false },
   { key: "BOOTSTRAP_ADMIN_EMAIL", required: false },
   { key: "BOOTSTRAP_ADMIN_PASSWORD", required: false },
-  { key: "API_KEY_HMAC_SECRET", required: false },
 
   // ── Optional: Security ──
   { key: "FORCE_HTTPS", required: false },
diff --git a/app/src/lib/plugin/__tests__/safe-parse-settings.test.ts b/app/src/lib/plugin/__tests__/safe-parse-settings.test.ts
new file mode 100644
index 00000000..54940625
--- /dev/null
+++ b/app/src/lib/plugin/__tests__/safe-parse-settings.test.ts
@@ -0,0 +1,108 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { z } from "zod";
+import { safeParseSettings } from "../safe-parse-settings";
+
+// Spy on console.warn — helper is browser-safe (no pino) so logging goes
+// to console with a structured payload.
+const mockWarn = vi.fn();
+const originalWarn = console.warn;
+
+describe("safeParseSettings", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    console.warn = mockWarn;
+  });
+
+  afterEach(() => {
+    console.warn = originalWarn;
+  });
+
+  it("returns the parsed data when validation succeeds", () => {
+    const schema = z.object({
+      title: z.string().default("Untitled"),
+      enabled: z.boolean().default(false),
+    });
+    const result = safeParseSettings(
+      schema,
+      { title: "Real", enabled: true },
+      "test-plugin",
+    );
+    expect(result).toEqual({ title: "Real", enabled: true });
+    expect(mockWarn).not.toHaveBeenCalled();
+  });
+
+  it("returns schema defaults when validation fails", () => {
+    const schema = z.object({
+      layout: z.enum(["force", "circular"]).default("force"),
+    });
+    const result = safeParseSettings(
+      schema,
+      { layout: "hierarchical" },
+      "graph",
+    );
+    expect(result.layout).toBe("force");
+  });
+
+  it("logs a structured warning on validation failure", () => {
+    const schema = z.object({
+      layout: z.enum(["force", "circular"]).default("force"),
+    });
+    safeParseSettings(schema, { layout: "weirdLayout" }, "graph");
+    expect(mockWarn).toHaveBeenCalledTimes(1);
+    const [message, payload] = mockWarn.mock.calls[0];
+    expect(message).toMatch(/reverted to defaults/i);
+    expect(payload.pluginId).toBe("graph");
+    expect(payload.issues).toBeInstanceOf(Array);
+    expect(payload.issues[0].path).toEqual(["layout"]);
+  });
+
+  it("does not log when validation succeeds", () => {
+    const schema = z.object({ x: z.number().default(0) });
+    safeParseSettings(schema, { x: 5 }, "test");
+    expect(mockWarn).not.toHaveBeenCalled();
+  });
+
+  it("handles undefined / null raw values via empty-object defaults", () => {
+    const schema = z.object({
+      label: z.string().default("hello"),
+    });
+    expect(safeParseSettings(schema, undefined, "test").label).toBe("hello");
+    expect(safeParseSettings(schema, null, "test").label).toBe("hello");
+  });
+
+  it("preserves passthrough fields when schema uses .passthrough()", () => {
+    const schema = z.object({ known: z.string().optional() }).passthrough();
+    const result = safeParseSettings(
+      schema,
+      { known: "yes", extra: 42 },
+      "test",
+    );
+    expect(result).toEqual({ known: "yes", extra: 42 });
+  });
+
+  it("propagates errors when even the defaults path throws (broken schema)", () => {
+    // Schema with NO defaults; parsing {} fails with "required" — surfaces the
+    // schema-itself-is-broken case to the error boundary.
+    const schema = z.object({ required: z.string() });
+    expect(() =>
+      safeParseSettings(schema, { badValue: 123 }, "broken-plugin"),
+    ).toThrow();
+  });
+
+  it("applies field-level defaults when raw is missing fields", () => {
+    const schema = z.object({
+      a: z.string().default("A"),
+      b: z.number().default(7),
+    });
+    const result = safeParseSettings(schema, {}, "test");
+    expect(result).toEqual({ a: "A", b: 7 });
+    expect(mockWarn).not.toHaveBeenCalled();
+  });
+
+  it("includes pluginId in the log payload for traceability", () => {
+    const schema = z.object({ layout: z.enum(["a", "b"]).default("a") });
+    safeParseSettings(schema, { layout: "c" }, "my-special-plugin");
+    expect(mockWarn).toHaveBeenCalledTimes(1);
+    expect(mockWarn.mock.calls[0][1].pluginId).toBe("my-special-plugin");
+  });
+});
diff --git a/app/src/lib/plugin/safe-parse-settings.ts b/app/src/lib/plugin/safe-parse-settings.ts
new file mode 100644
index 00000000..c9a0d220
--- /dev/null
+++ b/app/src/lib/plugin/safe-parse-settings.ts
@@ -0,0 +1,54 @@
+import type { ZodTypeAny, z } from "zod";
+
+/**
+ * Plugin-namespaced warning emitter. We intentionally do NOT use the
+ * pino-based `@/lib/logger` here: plugin components render client-side
+ * and bundling pino into the browser fails (it imports `node:crypto`).
+ * Schema fallbacks happen during render → operators see them via the
+ * browser console (and the surrounding server logs when the page reloads).
+ * Structured shape preserves searchability.
+ */
+function emitWarning(pluginId: string, issues: unknown): void {
+  console.warn("[plugin] Settings failed validation; reverted to defaults", {
+    pluginId,
+    issues,
+  });
+}
+
+/**
+ * Parse plugin settings with Zod, falling back to schema defaults on
+ * validation failure. Never throws on user-provided data.
+ *
+ * **Why**: a single stale or unknown enum value in a saved widget config
+ * would otherwise crash the plugin component (`schema.parse(raw)` throws
+ * → React renders an error boundary → the widget is blank). This is bad
+ * UX: a v1.0 dashboard that referenced a layout value later renamed in
+ * v1.1 would blank out for everyone until the user manually re-saved.
+ *
+ * Behavior on validation failure:
+ *  1. Emit a structured warn-level log entry (operators can spot drift)
+ *  2. Return the result of `schema.parse({})` — which yields the schema's
+ *     defaults across the board
+ *  3. If even that throws, propagate — that means the schema *itself* is
+ *     broken (not the user's data), which deserves an error boundary
+ *
+ * @param schema    the plugin's Zod settings schema
+ * @param raw       the unknown value passed by the widget renderer
+ * @param pluginId  the chart type registered with the plugin (e.g. "graph",
+ *                  "bar") — included in the log entry so operators know
+ *                  which plugin had stale data
+ */
+export function safeParseSettings<T extends ZodTypeAny>(
+  schema: T,
+  raw: unknown,
+  pluginId: string,
+): z.infer<T> {
+  const result = schema.safeParse(raw);
+  if (result.success) return result.data;
+
+  emitWarning(pluginId, result.error.issues);
+
+  // Defaults pass: if THIS throws, the schema itself is bad — surface to the
+  // error boundary. We deliberately don't double-catch here.
+  return schema.parse({});
+}
diff --git a/app/src/plugins/__tests__/safe-parse-adoption.test.tsx b/app/src/plugins/__tests__/safe-parse-adoption.test.tsx
new file mode 100644
index 00000000..010fa1c2
--- /dev/null
+++ b/app/src/plugins/__tests__/safe-parse-adoption.test.tsx
@@ -0,0 +1,137 @@
+/**
+ * Smoke test: every plugin component invokes safeParseSettings via the
+ * helper and renders without throwing on garbage settings.
+ *
+ * Each plugin component runs `safeParseSettings(...)` at the top, BEFORE any
+ * hooks or chart rendering. Running the component once with junk settings is
+ * the cheapest way to cover the migrated line in each of the 20 plugin
+ * components — which keeps SonarCloud's new_coverage gate happy without
+ * writing one full render test per plugin.
+ *
+ * Heavy chart deps are stubbed by a single Proxy mock for `@neoboard/components`
+ * that returns null-rendering stubs for ANY accessed export.
+ */
+import React from "react";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { render } from "@testing-library/react";
+
+// Stub @neoboard/components — null-rendering components + minimal helpers.
+// Listed names cover both the 20 plugin components AND their downstream
+// imports (e.g. table-renderer imports parseColorThresholds).
+vi.mock("@neoboard/components", () => {
+  const Stub = ({ children }: { children?: React.ReactNode } = {}) =>
+    React.createElement(React.Fragment, null, children ?? null);
+  return {
+    // Components rendered by plugin components or their downstream consumers
+    Skeleton: Stub,
+    IframeWidget: Stub,
+    JsonViewer: Stub,
+    MarkdownWidget: Stub,
+    EmptyState: Stub,
+    // Helpers
+    getChartOptions: () => [],
+    parseColorThresholds: () => [],
+  };
+});
+
+// Stub @/components heavy children that use TanStack Query / DOM apis
+vi.mock("@/components/table-renderer", () => ({
+  TableRenderer: () => null,
+}));
+
+vi.mock("@/components/form-widget-renderer", () => ({
+  FormWidgetRenderer: () => null,
+}));
+
+// Stub next/dynamic — return a null-rendering component synchronously so
+// plugin components that lazy-load chart bodies don't suspend.
+vi.mock("next/dynamic", () => ({
+  default: () => () => null,
+}));
+
+// Stub the graph exploration wrapper used by the graph plugin
+vi.mock("@/components/graph-exploration-wrapper", () => ({
+  GraphExplorationWrapper: () => null,
+}));
+
+// Import plugins AFTER mocks are set up
+const { barPlugin } = await import("../bar");
+const { choroplethPlugin } = await import("../choropleth");
+const { circlePackingPlugin } = await import("../circle-packing");
+const { formPlugin } = await import("../form");
+const { ganttPlugin } = await import("../gantt");
+const { gaugePlugin } = await import("../gauge");
+const { graphPlugin } = await import("../graph");
+const { iframePlugin } = await import("../iframe");
+const { jsonPlugin } = await import("../json");
+const { linePlugin } = await import("../line");
+const { mapPlugin } = await import("../map");
+const { markdownPlugin } = await import("../markdown");
+const { parameterSelectPlugin } = await import("../parameter-select");
+const { piePlugin } = await import("../pie");
+const { radarPlugin } = await import("../radar");
+const { sankeyPlugin } = await import("../sankey");
+const { singleValuePlugin } = await import("../single-value");
+const { sunburstPlugin } = await import("../sunburst");
+const { tablePlugin } = await import("../table");
+const { treemapPlugin } = await import("../treemap");
+
+const ALL_PLUGINS = [
+  barPlugin,
+  choroplethPlugin,
+  circlePackingPlugin,
+  formPlugin,
+  ganttPlugin,
+  gaugePlugin,
+  graphPlugin,
+  iframePlugin,
+  jsonPlugin,
+  linePlugin,
+  mapPlugin,
+  markdownPlugin,
+  parameterSelectPlugin,
+  piePlugin,
+  radarPlugin,
+  sankeyPlugin,
+  singleValuePlugin,
+  sunburstPlugin,
+  tablePlugin,
+  treemapPlugin,
+];
+
+const GARBAGE_PROPS = {
+  data: null,
+  // Intentionally violates every plugin's schema — exercises the safeParse
+  // fallback path on every plugin.
+  settings: { __completely_invalid__: 12345, layout: "weirdLayout" },
+  stylingRules: [],
+  paramValues: {},
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+} as any;
+
+describe("safeParseSettings adoption across all 20 plugins", () => {
+  let warnSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+  });
+
+  for (const plugin of ALL_PLUGINS) {
+    it(`${plugin.type}: component renders with garbage settings without throwing`, () => {
+      const Component = plugin.component;
+      expect(() =>
+        render(React.createElement(Component, GARBAGE_PROPS)),
+      ).not.toThrow();
+    });
+  }
+
+  it("covers all 20 plugins (sanity check on the array)", () => {
+    expect(ALL_PLUGINS).toHaveLength(20);
+    const types = new Set(ALL_PLUGINS.map((p) => p.type));
+    expect(types.size).toBe(20); // unique
+  });
+});
diff --git a/app/src/plugins/bar/component.tsx b/app/src/plugins/bar/component.tsx
index ce12e499..c5d2193a 100644
--- a/app/src/plugins/bar/component.tsx
+++ b/app/src/plugins/bar/component.tsx
@@ -12,6 +12,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToBarData, validateBarData } from "./transform";
 import { useEChartsClick, type PluginProps } from "../utils";
 import { barSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 const BarChart = dynamic(
   () => import("@neoboard/components").then((m) => ({ default: m.BarChart })),
@@ -26,7 +27,7 @@ function BarPluginComponent({
   paramValues,
 }: PluginProps) {
   const onClick = useEChartsClick(onChartClick, data);
-  const settings = barSettingsSchema.parse(raw);
+  const settings = safeParseSettings(barSettingsSchema, raw, "bar");
 
   return (
     <BarChart
diff --git a/app/src/plugins/choropleth/component.tsx b/app/src/plugins/choropleth/component.tsx
index 7ffacdf6..bac5a7b3 100644
--- a/app/src/plugins/choropleth/component.tsx
+++ b/app/src/plugins/choropleth/component.tsx
@@ -11,6 +11,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToChoroplethData } from "./transform";
 import { useEChartsClick, type PluginProps } from "../utils";
 import { choroplethSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 const ChoroplethChart = dynamic(
   () =>
@@ -26,7 +27,11 @@ function ChoroplethPluginComponent({
   onChartClick,
 }: PluginProps) {
   const onClick = useEChartsClick(onChartClick, data);
-  const settings = choroplethSettingsSchema.parse(raw);
+  const settings = safeParseSettings(
+    choroplethSettingsSchema,
+    raw,
+    "choropleth",
+  );
   return (
     <ChoroplethChart
       data={(data as ChoroplethDataItem[]) ?? []}
diff --git a/app/src/plugins/circle-packing/component.tsx b/app/src/plugins/circle-packing/component.tsx
index 521135fb..0ec2d2b3 100644
--- a/app/src/plugins/circle-packing/component.tsx
+++ b/app/src/plugins/circle-packing/component.tsx
@@ -12,6 +12,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToHierarchicalData } from "../sunburst/transform";
 import { useEChartsClick, type PluginProps } from "../utils";
 import { circlePackingSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 const CirclePackingChart = dynamic(
   () =>
@@ -29,7 +30,11 @@ function CirclePackingPluginComponent({
   onChartClick,
 }: PluginProps) {
   const onClick = useEChartsClick(onChartClick, data);
-  const settings = circlePackingSettingsSchema.parse(raw);
+  const settings = safeParseSettings(
+    circlePackingSettingsSchema,
+    raw,
+    "circle-packing",
+  );
   return (
     <CirclePackingChart
       data={(data as CirclePackingDataItem[]) ?? []}
diff --git a/app/src/plugins/form/component.tsx b/app/src/plugins/form/component.tsx
index 7d0e6c9e..eca47c39 100644
--- a/app/src/plugins/form/component.tsx
+++ b/app/src/plugins/form/component.tsx
@@ -10,13 +10,14 @@ import { FormWidgetRenderer } from "@/components/form-widget-renderer";
 import { defineChartPlugin } from "../registry";
 import { type PluginProps } from "../utils";
 import { formSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 function FormPluginComponent({
   settings: raw,
   connectionId,
   query,
 }: PluginProps) {
-  const settings = formSettingsSchema.parse(raw);
+  const settings = safeParseSettings(formSettingsSchema, raw, "form");
   return (
     <FormWidgetRenderer
       connectionId={connectionId ?? ""}
diff --git a/app/src/plugins/gantt/component.tsx b/app/src/plugins/gantt/component.tsx
index 3b15cc42..da883309 100644
--- a/app/src/plugins/gantt/component.tsx
+++ b/app/src/plugins/gantt/component.tsx
@@ -12,6 +12,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToGanttData } from "./transform";
 import { useEChartsClick, type PluginProps } from "../utils";
 import { ganttSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 const GanttChart = dynamic(
   () => import("@neoboard/components").then((m) => ({ default: m.GanttChart })),
@@ -26,7 +27,7 @@ function GanttPluginComponent({
   onChartClick,
 }: PluginProps) {
   const onClick = useEChartsClick(onChartClick, data);
-  const settings = ganttSettingsSchema.parse(raw);
+  const settings = safeParseSettings(ganttSettingsSchema, raw, "gantt");
   return (
     <GanttChart
       data={(data as GanttDataItem[]) ?? []}
diff --git a/app/src/plugins/gauge/component.tsx b/app/src/plugins/gauge/component.tsx
index adcc0f10..04538eb4 100644
--- a/app/src/plugins/gauge/component.tsx
+++ b/app/src/plugins/gauge/component.tsx
@@ -12,6 +12,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToGaugeData } from "./transform";
 import { useEChartsClick, type PluginProps } from "../utils";
 import { gaugeSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 const GaugeChart = dynamic(
   () => import("@neoboard/components").then((m) => ({ default: m.GaugeChart })),
@@ -26,7 +27,7 @@ function GaugePluginComponent({
   onChartClick,
 }: PluginProps) {
   const onClick = useEChartsClick(onChartClick, data);
-  const settings = gaugeSettingsSchema.parse(raw);
+  const settings = safeParseSettings(gaugeSettingsSchema, raw, "gauge");
   return (
     <GaugeChart
       data={(data as GaugeDataPoint[]) ?? []}
diff --git a/app/src/plugins/graph/component.tsx b/app/src/plugins/graph/component.tsx
index 138a8105..f97cdf87 100644
--- a/app/src/plugins/graph/component.tsx
+++ b/app/src/plugins/graph/component.tsx
@@ -15,6 +15,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToGraphData, validateGraphData } from "./transform";
 import { type PluginProps } from "../utils";
 import { graphSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 // NVL (WebGL) is heavy — lazy load so it's only bundled when a graph widget renders.
 const GraphChart = dynamic(
@@ -33,7 +34,7 @@ function GraphPluginComponent({
   resultId,
   autoFit,
 }: PluginProps) {
-  const settings = graphSettingsSchema.parse(raw);
+  const settings = safeParseSettings(graphSettingsSchema, raw, "graph");
   const graphData = (data ?? { nodes: [], edges: [] }) as {
     nodes: GraphNode[];
     edges: GraphEdge[];
diff --git a/app/src/plugins/graph/settings.ts b/app/src/plugins/graph/settings.ts
index 7a1b2447..d370abf9 100644
--- a/app/src/plugins/graph/settings.ts
+++ b/app/src/plugins/graph/settings.ts
@@ -5,7 +5,7 @@ import { z } from "zod";
 
 export const graphSettingsSchema = z
   .object({
-    layout: z.enum(["force", "circular"]).default("force"),
+    layout: z.enum(["force", "circular", "hierarchical"]).default("force"),
     showLabels: z.boolean().default(true),
   })
   .passthrough();
diff --git a/app/src/plugins/iframe/component.tsx b/app/src/plugins/iframe/component.tsx
index 61219937..20fd3d3f 100644
--- a/app/src/plugins/iframe/component.tsx
+++ b/app/src/plugins/iframe/component.tsx
@@ -8,9 +8,10 @@ import { IframeWidget, getChartOptions } from "@neoboard/components";
 import { defineChartPlugin } from "../registry";
 import { type PluginProps } from "../utils";
 import { iframeSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 function IframePluginComponent({ settings: raw }: PluginProps) {
-  const settings = iframeSettingsSchema.parse(raw);
+  const settings = safeParseSettings(iframeSettingsSchema, raw, "iframe");
   return (
     <IframeWidget
       url={settings.url}
diff --git a/app/src/plugins/json/component.tsx b/app/src/plugins/json/component.tsx
index ff590178..37fd4c53 100644
--- a/app/src/plugins/json/component.tsx
+++ b/app/src/plugins/json/component.tsx
@@ -10,9 +10,10 @@ import { defineChartPlugin } from "../registry";
 import { transformToJsonData } from "./transform";
 import { type PluginProps } from "../utils";
 import { jsonSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 function JsonPluginComponent({ data, settings: raw }: PluginProps) {
-  const settings = jsonSettingsSchema.parse(raw);
+  const settings = safeParseSettings(jsonSettingsSchema, raw, "json");
   return (
     <div className="h-full overflow-auto">
       <JsonViewer data={data} initialExpanded={settings.initialExpanded} />
diff --git a/app/src/plugins/line/component.tsx b/app/src/plugins/line/component.tsx
index 071b7e0d..c927f853 100644
--- a/app/src/plugins/line/component.tsx
+++ b/app/src/plugins/line/component.tsx
@@ -12,6 +12,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToLineData, validateLineData } from "./transform";
 import { useEChartsClick, type PluginProps } from "../utils";
 import { lineSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 const LineChart = dynamic(
   () => import("@neoboard/components").then((m) => ({ default: m.LineChart })),
@@ -26,7 +27,7 @@ function LinePluginComponent({
   onChartClick,
 }: PluginProps) {
   const onClick = useEChartsClick(onChartClick, data);
-  const settings = lineSettingsSchema.parse(raw);
+  const settings = safeParseSettings(lineSettingsSchema, raw, "line");
   // Parse comma-separated rightAxisSeries string into string array
   const rightAxisSeries = settings.rightAxisSeries
     ? settings.rightAxisSeries
diff --git a/app/src/plugins/map/component.tsx b/app/src/plugins/map/component.tsx
index f1f157f7..1dfb7e9c 100644
--- a/app/src/plugins/map/component.tsx
+++ b/app/src/plugins/map/component.tsx
@@ -12,6 +12,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToMapData, validateMapData } from "./transform";
 import { type PluginProps } from "../utils";
 import { mapSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 // Leaflet relies on window/document — must be loaded client-side only.
 const MapChart = dynamic(
@@ -34,7 +35,7 @@ function MapPluginComponent({
   onChartClick,
 }: PluginProps) {
   const markers = (data ?? []) as MapMarker[];
-  const settings = mapSettingsSchema.parse(raw);
+  const settings = safeParseSettings(mapSettingsSchema, raw, "map");
   return (
     <MapChart
       markers={markers}
diff --git a/app/src/plugins/markdown/component.tsx b/app/src/plugins/markdown/component.tsx
index f36e8ee0..46d11e56 100644
--- a/app/src/plugins/markdown/component.tsx
+++ b/app/src/plugins/markdown/component.tsx
@@ -10,6 +10,7 @@ import { MarkdownWidget, getChartOptions } from "@neoboard/components";
 import { defineChartPlugin } from "../registry";
 import { type PluginProps } from "../utils";
 import { markdownSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 /**
  * Component adapter — extracts the `content` field from settings and
@@ -17,7 +18,7 @@ import { markdownSettingsSchema } from "./settings";
  * settings object to the component as `settings` prop.
  */
 function MarkdownPluginComponent({ settings: raw }: PluginProps) {
-  const settings = markdownSettingsSchema.parse(raw);
+  const settings = safeParseSettings(markdownSettingsSchema, raw, "markdown");
   return <MarkdownWidget content={settings.content} />;
 }
 
diff --git a/app/src/plugins/parameter-select/component.tsx b/app/src/plugins/parameter-select/component.tsx
index f4bc9121..7718f4cd 100644
--- a/app/src/plugins/parameter-select/component.tsx
+++ b/app/src/plugins/parameter-select/component.tsx
@@ -14,13 +14,18 @@ import { defineChartPlugin } from "../registry";
 import { transformToSelectData } from "./transform";
 import { type PluginProps } from "../utils";
 import { parameterSelectSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 function ParameterSelectPluginComponent({
   settings: raw,
   connectionId,
   widgetId,
 }: PluginProps) {
-  const settings = parameterSelectSettingsSchema.parse(raw);
+  const settings = safeParseSettings(
+    parameterSelectSettingsSchema,
+    raw,
+    "parameter-select",
+  );
   if (!settings.parameterName) {
     return (
       <EmptyState
diff --git a/app/src/plugins/pie/component.tsx b/app/src/plugins/pie/component.tsx
index ad8f0006..bea3bd80 100644
--- a/app/src/plugins/pie/component.tsx
+++ b/app/src/plugins/pie/component.tsx
@@ -12,6 +12,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToPieData, validatePieData } from "./transform";
 import { useEChartsClick, type PluginProps } from "../utils";
 import { pieSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 const PieChart = dynamic(
   () => import("@neoboard/components").then((m) => ({ default: m.PieChart })),
@@ -26,7 +27,7 @@ function PiePluginComponent({
   onChartClick,
 }: PluginProps) {
   const onClick = useEChartsClick(onChartClick, data);
-  const settings = pieSettingsSchema.parse(raw);
+  const settings = safeParseSettings(pieSettingsSchema, raw, "pie");
   return (
     <PieChart
       data={(data as PieChartDataPoint[]) ?? []}
diff --git a/app/src/plugins/radar/component.tsx b/app/src/plugins/radar/component.tsx
index a2263dae..d1c22987 100644
--- a/app/src/plugins/radar/component.tsx
+++ b/app/src/plugins/radar/component.tsx
@@ -12,6 +12,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToRadarData } from "./transform";
 import { type PluginProps } from "../utils";
 import { radarSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 const RadarChart = dynamic(
   () => import("@neoboard/components").then((m) => ({ default: m.RadarChart })),
@@ -28,7 +29,7 @@ function RadarPluginComponent({
     indicators: [],
     series: [],
   };
-  const settings = radarSettingsSchema.parse(raw);
+  const settings = safeParseSettings(radarSettingsSchema, raw, "radar");
   return (
     <RadarChart
       data={radarData}
diff --git a/app/src/plugins/sankey/component.tsx b/app/src/plugins/sankey/component.tsx
index 998e7abc..e448a32f 100644
--- a/app/src/plugins/sankey/component.tsx
+++ b/app/src/plugins/sankey/component.tsx
@@ -12,6 +12,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToSankeyData } from "./transform";
 import { useEChartsClick, type PluginProps } from "../utils";
 import { sankeySettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 const SankeyChart = dynamic(
   () =>
@@ -27,7 +28,7 @@ function SankeyPluginComponent({
   onChartClick,
 }: PluginProps) {
   const onClick = useEChartsClick(onChartClick, data);
-  const settings = sankeySettingsSchema.parse(raw);
+  const settings = safeParseSettings(sankeySettingsSchema, raw, "sankey");
   const sankeyData = (data as SankeyChartData) ?? { nodes: [], links: [] };
   return (
     <SankeyChart
diff --git a/app/src/plugins/single-value/component.tsx b/app/src/plugins/single-value/component.tsx
index 9034697b..386b2e5e 100644
--- a/app/src/plugins/single-value/component.tsx
+++ b/app/src/plugins/single-value/component.tsx
@@ -14,6 +14,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToValueData, validateValueData } from "./transform";
 import { type PluginProps } from "../utils";
 import { singleValueSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 const SingleValueChart = dynamic(
   () =>
@@ -29,10 +30,11 @@ function SingleValuePluginComponent({
   stylingRules,
   paramValues,
 }: PluginProps) {
-  const parsed = singleValueSettingsSchema.safeParse(raw);
-  const settings = parsed.success
-    ? parsed.data
-    : singleValueSettingsSchema.parse({});
+  const settings = safeParseSettings(
+    singleValueSettingsSchema,
+    raw,
+    "single-value",
+  );
   const rawData = data ?? 0;
   const val =
     typeof rawData === "number" || typeof rawData === "string"
diff --git a/app/src/plugins/sunburst/component.tsx b/app/src/plugins/sunburst/component.tsx
index 0bc602ad..1496c3bf 100644
--- a/app/src/plugins/sunburst/component.tsx
+++ b/app/src/plugins/sunburst/component.tsx
@@ -12,6 +12,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToHierarchicalData } from "./transform";
 import { useEChartsClick, type PluginProps } from "../utils";
 import { sunburstSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 const SunburstChart = dynamic(
   () =>
@@ -27,7 +28,7 @@ function SunburstPluginComponent({
   onChartClick,
 }: PluginProps) {
   const onClick = useEChartsClick(onChartClick, data);
-  const settings = sunburstSettingsSchema.parse(raw);
+  const settings = safeParseSettings(sunburstSettingsSchema, raw, "sunburst");
   return (
     <SunburstChart
       data={(data as SunburstDataItem[]) ?? []}
diff --git a/app/src/plugins/table/component.tsx b/app/src/plugins/table/component.tsx
index 76d7c6b4..d28c6677 100644
--- a/app/src/plugins/table/component.tsx
+++ b/app/src/plugins/table/component.tsx
@@ -13,6 +13,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToTableData } from "./transform";
 import { type PluginProps } from "../utils";
 import { tableSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 function TablePluginComponent({
   data,
@@ -23,7 +24,7 @@ function TablePluginComponent({
   clickableColumns,
   onChartClick,
 }: PluginProps) {
-  const settings = tableSettingsSchema.parse(raw);
+  const settings = safeParseSettings(tableSettingsSchema, raw, "table");
   return (
     <TableRenderer
       data={data}
diff --git a/app/src/plugins/treemap/component.tsx b/app/src/plugins/treemap/component.tsx
index 12cbd369..947bf023 100644
--- a/app/src/plugins/treemap/component.tsx
+++ b/app/src/plugins/treemap/component.tsx
@@ -12,6 +12,7 @@ import { defineChartPlugin } from "../registry";
 import { transformToHierarchicalData } from "./transform";
 import { useEChartsClick, type PluginProps } from "../utils";
 import { treemapSettingsSchema } from "./settings";
+import { safeParseSettings } from "@/lib/plugin/safe-parse-settings";
 
 const TreemapChart = dynamic(
   () =>
@@ -27,7 +28,7 @@ function TreemapPluginComponent({
   onChartClick,
 }: PluginProps) {
   const onClick = useEChartsClick(onChartClick, data);
-  const settings = treemapSettingsSchema.parse(raw);
+  const settings = safeParseSettings(treemapSettingsSchema, raw, "treemap");
   return (
     <TreemapChart
       data={(data as TreemapDataItem[]) ?? []}
diff --git a/cli/src/__tests__/commands/env.test.ts b/cli/src/__tests__/commands/env.test.ts
index 0c4a71e7..ae5c4439 100644
--- a/cli/src/__tests__/commands/env.test.ts
+++ b/cli/src/__tests__/commands/env.test.ts
@@ -58,7 +58,11 @@ describe("validateEnv", () => {
   it("passes when all required vars present", () => {
     mockExistsSync.mockReturnValue(true);
     mockReadFileSync.mockReturnValue(
-      "DATABASE_URL=postgres://...\nENCRYPTION_KEY=abc\nNEXTAUTH_SECRET=def\nNEXTAUTH_URL=http://localhost:3000\n",
+      "DATABASE_URL=postgres://...\n" +
+        "ENCRYPTION_KEY=abc\n" +
+        "NEXTAUTH_SECRET=def\n" +
+        "NEXTAUTH_URL=http://localhost:3000\n" +
+        "API_KEY_HMAC_SECRET=ghi\n",
     );
     const result = validateEnv();
     expect(result.ok).toBe(true);
@@ -72,12 +76,15 @@ describe("validateEnv", () => {
     expect(result.ok).toBe(false);
     expect(result.missing).toContain("ENCRYPTION_KEY");
     expect(result.missing).toContain("NEXTAUTH_SECRET");
+    // API_KEY_HMAC_SECRET became required in #907 — every install needs it
+    // for the community API-keys feature.
+    expect(result.missing).toContain("API_KEY_HMAC_SECRET");
   });
 
   it("ignores comments and blank lines", () => {
     mockExistsSync.mockReturnValue(true);
     mockReadFileSync.mockReturnValue(
-      "# comment\n\nDATABASE_URL=x\nENCRYPTION_KEY=x\nNEXTAUTH_SECRET=x\nNEXTAUTH_URL=x\n",
+      "# comment\n\nDATABASE_URL=x\nENCRYPTION_KEY=x\nNEXTAUTH_SECRET=x\nNEXTAUTH_URL=x\nAPI_KEY_HMAC_SECRET=x\n",
     );
     expect(validateEnv().ok).toBe(true);
   });
@@ -93,6 +100,9 @@ describe("generateEnvFile", () => {
     expect(content).toContain("ENCRYPTION_KEY=");
     expect(content).toContain("NEXTAUTH_SECRET=");
     expect(content).toContain("ADMIN_BOOTSTRAP_TOKEN=");
+    // #907: HMAC secret is auto-generated alongside the other secrets so a
+    // fresh install can use the community API-keys feature out of the box.
+    expect(content).toContain("API_KEY_HMAC_SECRET=");
   });
 
   it("skips when file exists and no regenerate flag", () => {
diff --git a/cli/src/commands/env.ts b/cli/src/commands/env.ts
index 1e6b3e72..f2ebeee9 100644
--- a/cli/src/commands/env.ts
+++ b/cli/src/commands/env.ts
@@ -1,18 +1,16 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { paths, readProjectConfig, getMode } from "../lib/config.js";
-import {
-  info,
-  success,
-  error as logError,
-  banner,
-} from "../lib/output.js";
+import { info, success, error as logError, banner } from "../lib/output.js";
 
 const REQUIRED_VARS = [
   "DATABASE_URL",
   "ENCRYPTION_KEY",
   "NEXTAUTH_SECRET",
   "NEXTAUTH_URL",
+  // API_KEY_HMAC_SECRET is required for the community API-keys feature; the
+  // server fails at startup without it. Auto-generated alongside other secrets.
+  "API_KEY_HMAC_SECRET",
 ];
 
 function generateSecret(): string {
@@ -54,6 +52,10 @@ export function generateEnvFile(opts?: { regenerate?: boolean }): void {
   const encryptionKey = generateSecret();
   const nextauthSecret = generateSecret();
   const bootstrapToken = generateSecret();
+  // API_KEY_HMAC_SECRET — required by the community API-keys feature. Server
+  // fails at startup without it. Generated alongside the other secrets so a
+  // fresh `neoboard setup` produces a fully-working install.
+  const apiKeyHmacSecret = generateSecret();
 
   const lines = [
     `DATABASE_URL=${dbUrl}`,
@@ -61,6 +63,7 @@ export function generateEnvFile(opts?: { regenerate?: boolean }): void {
     `NEXTAUTH_SECRET=${nextauthSecret}`,
     `NEXTAUTH_URL=http://localhost:${config.ports.app}`,
     `ADMIN_BOOTSTRAP_TOKEN=${bootstrapToken}`,
+    `API_KEY_HMAC_SECRET=${apiKeyHmacSecret}`,
     "",
   ];
 
diff --git a/scripts/seed-demo.mjs b/scripts/seed-demo.mjs
index feb90b3e..9a3bb78c 100644
--- a/scripts/seed-demo.mjs
+++ b/scripts/seed-demo.mjs
@@ -220,9 +220,18 @@ async function main() {
     }
 
     // 2. Create connectors (idempotent by name)
-    // Connection URIs default to localhost (dev). Override via env for Docker.
-    const neo4jHost = process.env.NEO4J_HOST ?? "localhost";
-    const pgHost = process.env.PG_HOST ?? "localhost";
+    // Connection URIs are always seeded with `localhost`. Docker compose
+    // publishes Postgres/Neo4j ports to the host, so both the host dev
+    // server and any container-app reach them the same way. Previously this
+    // honored NEO4J_HOST/PG_HOST env vars; when the seed ran inside the
+    // docker-app container those env vars baked container hostnames
+    // (`neoboard-neo4j`, `neoboard-postgres`) into the encrypted config,
+    // which then broke any `npm run dev` on the host (#898).
+    //
+    // To target non-localhost connections, edit them in the Connections UI
+    // after seeding.
+    const neo4jHost = "localhost";
+    const pgHost = "localhost";
     const neo4jConfig = {
       uri: `bolt://${neo4jHost}:7687`,
       username: "neo4j",