diff --git a/.dependency-cruiser.cjs b/.dependency-cruiser.cjs
index 7e81ab178e0..8a0c8a72b32 100644
--- a/.dependency-cruiser.cjs
+++ b/.dependency-cruiser.cjs
@@ -141,6 +141,45 @@ module.exports = {
       to: { path: '^@tryghost/admin($|/)|^apps/admin/' },
     },
     // ============================================================
+    // apps/admin — domains cross into each other only via api.ts
+    // ============================================================
+    {
+      name: 'admin-domains-cross-via-api-only',
+      comment:
+        "A domain folder in apps/admin/src may import a different domain only through that domain's public surface (its api.ts). Deep imports couple domains to each other's internals. In-app imports use the @/ alias, which the cruiser sees as an unresolved @/-prefixed specifier; both that shape and resolved relative paths are matched. Test files are exempt.",
+      severity: 'error',
+      from: {
+        path: '^apps/admin/src/(members|settings|analytics|posts|tags|comments|automations|onboarding|whats-new)/',
+        pathNot: ['\\.test\\.(ts|tsx)$'],
+      },
+      to: {
+        path: '^(?:@/|apps/admin/src/)(?:members|settings|analytics|posts|tags|comments|automations|onboarding|whats-new)($|/)',
+        pathNot: [
+          '^(?:@/|apps/admin/src/)$1($|/)',
+          '^(?:@/|apps/admin/src/)(?:members|settings|analytics|posts|tags|comments|automations|onboarding|whats-new)/api(\\.ts)?$',
+        ],
+      },
+    },
+    // ============================================================
+    // apps/admin — the shell and layout import domains only via api.ts
+    // ============================================================
+    {
+      name: 'admin-shell-into-domains-via-api-only',
+      comment:
+        'The admin shell (top-level files in apps/admin/src plus its non-domain support folders) may import a domain only through its api.ts. Same matching notes as admin-domains-cross-via-api-only. Test files are exempt.',
+      severity: 'error',
+      from: {
+        path: '^apps/admin/src/(?:(?:layout|hooks|providers|ember-bridge|utils|schemas)/.+|[^/]+\\.(?:ts|tsx))$',
+        pathNot: ['\\.test\\.(ts|tsx)$'],
+      },
+      to: {
+        path: '^(?:@/|apps/admin/src/)(?:members|settings|analytics|posts|tags|comments|automations|onboarding|whats-new)($|/)',
+        pathNot: [
+          '^(?:@/|apps/admin/src/)(?:members|settings|analytics|posts|tags|comments|automations|onboarding|whats-new)/api(\\.ts)?$',
+        ],
+      },
+    },
+    // ============================================================
     // apps/admin — shared/ must stay domain-free
     // ============================================================
     {
diff --git a/apps/admin-x-framework/src/api/member-custom-fields.ts b/apps/admin-x-framework/src/api/member-custom-fields.ts
index 36a68ba9480..22741bb9107 100644
--- a/apps/admin-x-framework/src/api/member-custom-fields.ts
+++ b/apps/admin-x-framework/src/api/member-custom-fields.ts
@@ -191,31 +191,63 @@ const isPartRecord = (value: unknown): value is Record<string, unknown> =>
   typeof value === 'object' && value !== null && !Array.isArray(value);
 
 /**
- * How each composite type reads as one line. Written per type rather than walked from
- * `subFieldsOf`, because where a part sits in the sentence is a fact about how the value
- * reads, not one the value schema can supply — an address fuses state and postal code the
- * way people write them. A part added upstream stays out of the line until someone decides
- * where it belongs.
+ * Parts that read as one run rather than as separate items — "NY 00001", not "NY, 00001".
  *
- * Total over the field types, the way the presentation catalog above is: a type added
- * upstream fails to compile here until someone has decided how its value reads, rather
- * than reaching every surface as a blank cell. A scalar declares `undefined`, which is
- * how "its value is already a line" is said.
+ * This is the whole of what a composite's one-line form needs stated. Everything else
+ * comes from the value schema's declaration order, so a part added to a type upstream
+ * appears in the line on its own, without anyone knowing to come here. That was the point:
+ * the previous version wrote each type's line out by hand, and a part left out of it was
+ * collected, stored, exported and filtered on while being invisible in every summary —
+ * a silent omission, which is the worst way for this to fail.
+ *
+ * Typed against the parts each type declares, so renaming or removing one upstream fails
+ * the build here. Deliberately not exhaustive: a part nobody mentions is one that reads
+ * perfectly well on its own, and requiring an entry for each would put the omission
+ * problem straight back.
  */
-const compositeValueFormatters: {
-  [T in FieldType]: [PartsOf<T>] extends [never]
-    ? undefined
-    : (value: Record<string, unknown>) => string;
-} = {
-  short_text: undefined,
-  long_text: undefined,
-  address: (value) => {
-    const { line1, line2, city, state, postal_code: postalCode, country } = value;
-    const statePostal = [state, postalCode].filter(Boolean).join(' ');
-    return [line1, line2, city, statePostal, country].filter(Boolean).join(', ');
-  },
+export type CompositePartRuns = { [T in FieldType]?: ReadonlyArray<readonly PartsOf<T>[]> };
+
+const fusedParts: CompositePartRuns = {
+  address: [['state', 'postal_code']],
 };
 
+/**
+ * A composite type's parts grouped into the runs its line is built from: declaration
+ * order, with anything fused above kept together.
+ *
+ * A fused pair that is not adjacent in declaration order simply reads as two runs, so
+ * reordering a type upstream costs a comma rather than a wrong sentence.
+ */
+function partRunsFor(type: FieldType): string[][] {
+  const parts: string[] | null = subFieldsOf(type);
+  if (!parts) {
+    return [];
+  }
+
+  const runOf = new Map<string, number>();
+  ((fusedParts[type] ?? []) as ReadonlyArray<readonly string[]>).forEach((group, index) => {
+    group.forEach((part) => runOf.set(part, index));
+  });
+
+  const runs: string[][] = [];
+  let openRun: number | undefined;
+  for (const part of parts) {
+    const run = runOf.get(part);
+    if (run !== undefined && run === openRun) {
+      runs[runs.length - 1].push(part);
+      continue;
+    }
+    runs.push([part]);
+    openRun = run;
+  }
+  return runs;
+}
+
+// Resolved once: the catalog is static, and this is read for every row of a member list.
+const partRuns = Object.fromEntries(
+  FIELD_TYPE_IDS.map((type) => [type, partRunsFor(type)]),
+) as Record<FieldType, string[][]>;
+
 /**
  * A member's value for one field as a single readable line: the string itself for a
  * scalar, and for a composite its parts joined the way that type reads — e.g.
@@ -228,13 +260,25 @@ const compositeValueFormatters: {
  * table cell than in a detail row.
  */
 export const formatMemberCustomFieldValue = (type: FieldType, value: unknown): string => {
-  const formatComposite = compositeValueFormatters[type];
+  // Null for a scalar, and for a type this build has never heard of — both of which read
+  // as text or as nothing.
+  if (subFieldsOf(type) === null) {
+    return typeof value === 'string' ? value : '';
+  }
 
-  if (formatComposite) {
-    return isPartRecord(value) ? formatComposite(value) : '';
+  if (!isPartRecord(value)) {
+    return '';
   }
 
-  return typeof value === 'string' ? value : '';
+  return (partRuns[type] ?? [])
+    .map((run) =>
+      run
+        .map((part) => value[part])
+        .filter((part): part is string => typeof part === 'string' && part !== '')
+        .join(' '),
+    )
+    .filter(Boolean)
+    .join(', ');
 };
 
 export interface MemberCustomFieldsResponseType {
diff --git a/apps/admin-x-framework/test/unit/api/member-custom-fields.test.ts b/apps/admin-x-framework/test/unit/api/member-custom-fields.test.ts
index 4c1a21db578..bdc22cd0c0f 100644
--- a/apps/admin-x-framework/test/unit/api/member-custom-fields.test.ts
+++ b/apps/admin-x-framework/test/unit/api/member-custom-fields.test.ts
@@ -1,4 +1,5 @@
 import {
+  type CompositePartRuns,
   type FieldTypePresentation,
   type MemberCustomField,
   formatMemberCustomFieldValue,
@@ -41,7 +42,27 @@ const scalarWithParts: FieldTypePresentation<'short_text'> = {
   subFields: { line1: 'a' },
 };
 
-export { labelled, missingPart, unknownPart, unlabelled, scalarWithParts };
+// A run is how the one-line form is told which parts read together. It names parts rather
+// than listing them all, so a part *added* upstream needs no entry — but a part renamed or
+// removed upstream has to be caught, or the run would silently stop fusing anything.
+const fusedRun: CompositePartRuns = { address: [['state', 'postal_code']] };
+
+// @ts-expect-error a run naming a part its value schema does not declare
+const unknownFusedPart: CompositePartRuns = { address: [['state', 'postcode']] };
+
+// @ts-expect-error a scalar type has no parts to run together
+const scalarWithRun: CompositePartRuns = { short_text: [['line1']] };
+
+export {
+  labelled,
+  missingPart,
+  unknownPart,
+  unlabelled,
+  scalarWithParts,
+  fusedRun,
+  unknownFusedPart,
+  scalarWithRun,
+};
 
 const field = (overrides: Partial<MemberCustomField>): MemberCustomField => ({
   key: 'nickname',
@@ -122,7 +143,9 @@ describe('member custom fields api helpers', () => {
         field({ key: 'address_home', name: 'Address (Home)', type: 'address' }),
       ]);
 
-      expect(columns[2]).toEqual({
+      // Found rather than indexed: what this is about is the label, not the position
+      // of a part in the address.
+      expect(columns.find((column) => column.partLabel === 'City')).toEqual({
         label: 'Address (Home) (City)',
         fieldName: 'Address (Home)',
         partLabel: 'City',
@@ -194,6 +217,24 @@ describe('member custom fields api helpers', () => {
       ).toBe('1 Main St, 12 apt B, New York, NY 00001, US');
     });
 
+    // The property this is built for. A part added to a type upstream has to appear in
+    // the line on its own, because the alternative is a value that is collected, stored,
+    // exported and filtered on while being invisible in every summary. Asserted through
+    // the catalog rather than against a hardcoded list, so it keeps holding as the
+    // catalog grows.
+    it('includes every part a type declares, in the order it declares them', () => {
+      const parts = memberCustomFieldParts('address')!;
+      const value = Object.fromEntries(parts.map(({ key }) => [key, key]));
+
+      const line = formatMemberCustomFieldValue('address', value);
+
+      for (const { key } of parts) {
+        expect(line, `${key} is missing from the line`).toContain(key);
+      }
+      // Separators aside, the parts read in the order the value schema declares them.
+      expect(line.split(/,\s|\s/)).toEqual(parts.map(({ key }) => key));
+    });
+
     it('pairs state and postal code, and drops missing parts cleanly', () => {
       expect(
         formatMemberCustomFieldValue('address', {
diff --git a/apps/admin/src/automations/api.ts b/apps/admin/src/automations/api.ts
new file mode 100644
index 00000000000..9af4f376dcd
--- /dev/null
+++ b/apps/admin/src/automations/api.ts
@@ -0,0 +1,9 @@
+/**
+ * Public surface of the automations domain, consumed by the admin shell
+ * (apps/admin/src/routes.tsx). Everything else in this domain is internal.
+ */
+
+// Lazy entries, not component re-exports: the shell mounts these behind
+// `lazy:`, so static re-exports would pull the chunks into the shell bundle.
+export const lazyAutomationsScreen = () => import('./automations');
+export const lazyAutomationEditorScreen = () => import('./editor');
diff --git a/apps/admin/src/comments/api.ts b/apps/admin/src/comments/api.ts
new file mode 100644
index 00000000000..8666a926c8b
--- /dev/null
+++ b/apps/admin/src/comments/api.ts
@@ -0,0 +1,8 @@
+/**
+ * Public surface of the comments domain, consumed by the admin shell
+ * (apps/admin/src/routes.tsx). Everything else in this domain is internal.
+ */
+
+// Lazy entry, not a component re-export: the shell mounts it behind `lazy:`,
+// so a static re-export would pull the chunk into the shell bundle.
+export const lazyCommentsScreen = () => import('./comments');
diff --git a/apps/admin/src/comments/components/comment-likes-modal.tsx b/apps/admin/src/comments/components/comment-likes-modal.tsx
index 77836f7605e..645f083339a 100644
--- a/apps/admin/src/comments/components/comment-likes-modal.tsx
+++ b/apps/admin/src/comments/components/comment-likes-modal.tsx
@@ -18,7 +18,7 @@ import {
   useBrowseCommentLikes,
 } from '@tryghost/admin-x-framework/api/comments';
 import { LucideIcon, formatNumber, formatTimestamp } from '@tryghost/shade/utils';
-import { formatMemberName, memberAvatarProps } from '@/members/member-format';
+import { formatMemberName, memberAvatarProps } from '@/members/api';
 
 type DefaultTab = 'likes' | 'dislikes';
 
diff --git a/apps/admin/src/comments/components/comment-reports-modal.tsx b/apps/admin/src/comments/components/comment-reports-modal.tsx
index d63fc37b8fc..ee8e4b0b1fe 100644
--- a/apps/admin/src/comments/components/comment-reports-modal.tsx
+++ b/apps/admin/src/comments/components/comment-reports-modal.tsx
@@ -10,7 +10,7 @@ import {
 } from '@tryghost/shade/components';
 import { type Comment, useBrowseCommentReports } from '@tryghost/admin-x-framework/api/comments';
 import { LucideIcon, formatTimestamp } from '@tryghost/shade/utils';
-import { formatMemberName, memberAvatarProps } from '@/members/member-format';
+import { formatMemberName, memberAvatarProps } from '@/members/api';
 
 interface CommentReportsModalProps {
   comment: Comment;
diff --git a/apps/admin/src/comments/components/comment-thread-list.tsx b/apps/admin/src/comments/components/comment-thread-list.tsx
index 07cede98cf2..06cefa86dba 100644
--- a/apps/admin/src/comments/components/comment-thread-list.tsx
+++ b/apps/admin/src/comments/components/comment-thread-list.tsx
@@ -11,7 +11,7 @@ import { CommentHeader } from './comment-header';
 import { CommentMenu } from './comment-menu';
 import { CommentMetrics } from './comment-metrics';
 import { buildThreadLink } from './thread-link';
-import { memberAvatarProps } from '@/members/member-format';
+import { memberAvatarProps } from '@/members/api';
 import { Link, useSearchParams } from '@tryghost/admin-x-framework';
 import { LucideIcon, cn } from '@tryghost/shade/utils';
 
diff --git a/apps/admin/src/comments/components/comments-list.tsx b/apps/admin/src/comments/components/comments-list.tsx
index 3c64c75a9a2..cb3bd01b72e 100644
--- a/apps/admin/src/comments/components/comments-list.tsx
+++ b/apps/admin/src/comments/components/comments-list.tsx
@@ -11,7 +11,7 @@ import { CommentHeader } from './comment-header';
 import { CommentMenu } from './comment-menu';
 import { CommentMetrics } from './comment-metrics';
 import { buildThreadLink } from './thread-link';
-import { memberAvatarProps } from '@/members/member-format';
+import { memberAvatarProps } from '@/members/api';
 import { Link, useSearchParams } from '@tryghost/admin-x-framework';
 import {
   LoadMoreButton,
diff --git a/apps/admin/src/gift-link-modal-host.tsx b/apps/admin/src/gift-link-modal-host.tsx
index 494994d5286..680e3d51863 100644
--- a/apps/admin/src/gift-link-modal-host.tsx
+++ b/apps/admin/src/gift-link-modal-host.tsx
@@ -1,11 +1,12 @@
 import { Suspense, lazy, useEffect, useState } from 'react';
 import { EmberFallback, subscribeOpenGiftLinkModal } from './ember-bridge';
 import type { OpenGiftLinkModalEvent } from './ember-bridge';
+import { lazyGiftLinkModal } from './posts/api';
 
 // The gift-link modal is React-owned but triggered from the Ember posts/pages
 // list. It's only needed once someone opens it, so lazy-load it rather than
 // pulling the posts bundle into every list view.
-const GiftLinkModal = lazy(() => import('./posts/analytics/modals/gift-link-modal'));
+const GiftLinkModal = lazy(lazyGiftLinkModal);
 
 /**
  * Bridges the Ember posts/pages context menu to the React gift-link modal.
diff --git a/apps/admin/src/home-redirect.tsx b/apps/admin/src/home-redirect.tsx
index 1b793a7ada2..95d8067372d 100644
--- a/apps/admin/src/home-redirect.tsx
+++ b/apps/admin/src/home-redirect.tsx
@@ -6,7 +6,7 @@ import {
   isContributorUser,
   isOwnerUser,
 } from '@tryghost/admin-x-framework/api/users';
-import { useOnboarding } from '@/onboarding/hooks/use-onboarding';
+import { useOnboarding } from '@/onboarding/api';
 
 // Hosted signup lands on `/?firstStart=true`; the checklist only starts for
 // owners but every firstStart visit continues to the onboarding route.
diff --git a/apps/admin/src/layout/app-sidebar/app-sidebar-footer.tsx b/apps/admin/src/layout/app-sidebar/app-sidebar-footer.tsx
index 1e55698a48e..324d6f760e1 100644
--- a/apps/admin/src/layout/app-sidebar/app-sidebar-footer.tsx
+++ b/apps/admin/src/layout/app-sidebar/app-sidebar-footer.tsx
@@ -6,7 +6,7 @@ import {
   SidebarMenu,
   SidebarMenuItem,
 } from '@tryghost/shade/components';
-import WhatsNewDialog from '@/whats-new/components/whats-new-dialog';
+import { WhatsNewDialog } from '@/whats-new/api';
 import { UserMenu } from './user-menu';
 import { useSidebarBannerState } from './hooks/use-sidebar-banner-state';
 
diff --git a/apps/admin/src/layout/app-sidebar/hooks/use-sidebar-banner-state.tsx b/apps/admin/src/layout/app-sidebar/hooks/use-sidebar-banner-state.tsx
index 0bb6f64bc61..6271a618115 100644
--- a/apps/admin/src/layout/app-sidebar/hooks/use-sidebar-banner-state.tsx
+++ b/apps/admin/src/layout/app-sidebar/hooks/use-sidebar-banner-state.tsx
@@ -3,7 +3,7 @@ import type { ReactNode } from 'react';
 import ThemeErrorsBanner from '@/layout/app-sidebar/theme-errors-banner';
 import UpgradeBanner from '@/layout/app-sidebar/upgrade-banner';
 import { useAdminSidebarVisibility } from '@/layout/sidebar-visibility';
-import WhatsNewBanner from '@/whats-new/components/whats-new-banner';
+import { WhatsNewBanner } from '@/whats-new/api';
 
 import { useUpgradeStatus } from './use-upgrade-status';
 import { useWhatsNewStatus } from './use-whats-new-status';
diff --git a/apps/admin/src/layout/app-sidebar/hooks/use-whats-new-status.ts b/apps/admin/src/layout/app-sidebar/hooks/use-whats-new-status.ts
index ac41731a68d..12bf1883aba 100644
--- a/apps/admin/src/layout/app-sidebar/hooks/use-whats-new-status.ts
+++ b/apps/admin/src/layout/app-sidebar/hooks/use-whats-new-status.ts
@@ -1,5 +1,4 @@
-import { useChangelog } from '@/whats-new/hooks/use-changelog';
-import { useWhatsNew } from '@/whats-new/hooks/use-whats-new';
+import { useChangelog, useWhatsNew } from '@/whats-new/api';
 
 export interface WhatsNewStatus {
   showWhatsNewBanner: boolean;
diff --git a/apps/admin/src/layout/app-sidebar/shared-views.ts b/apps/admin/src/layout/app-sidebar/shared-views.ts
index 252c9fb7ced..5a5a557c926 100644
--- a/apps/admin/src/layout/app-sidebar/shared-views.ts
+++ b/apps/admin/src/layout/app-sidebar/shared-views.ts
@@ -1,8 +1,8 @@
 import { useMemo } from 'react';
-import { parseAllSharedViewsJSON } from '@/members/shared-views';
+import { parseAllSharedViewsJSON } from '@/members/api';
 import { getSettingValue, useBrowseSettings } from '@tryghost/admin-x-framework/api/settings';
 
-export type { SharedView } from '@/members/shared-views';
+export type { SharedView } from '@/members/api';
 
 export function getColorHex(color: string): string {
   const colorMap: Record<string, string> = {
diff --git a/apps/admin/src/layout/app-sidebar/user-menu.tsx b/apps/admin/src/layout/app-sidebar/user-menu.tsx
index c97ca60e6ed..5ca9307ec8c 100644
--- a/apps/admin/src/layout/app-sidebar/user-menu.tsx
+++ b/apps/admin/src/layout/app-sidebar/user-menu.tsx
@@ -19,7 +19,7 @@ import { getGhostPaths } from '@tryghost/admin-x-framework/helpers';
 import { toast } from 'sonner';
 import { type ThemeMode } from '@/hooks/use-theme';
 import { useThemeContext } from '@/providers/theme-context';
-import { useWhatsNew } from '@/whats-new/hooks/use-whats-new';
+import { useWhatsNew } from '@/whats-new/api';
 import { useUpgradeStatus } from './hooks/use-upgrade-status';
 import { useBrowseSite } from '@tryghost/admin-x-framework/api/site';
 import { UserMenuItem } from './user-menu-item';
diff --git a/apps/admin/src/members/api.ts b/apps/admin/src/members/api.ts
new file mode 100644
index 00000000000..4c51991e835
--- /dev/null
+++ b/apps/admin/src/members/api.ts
@@ -0,0 +1,9 @@
+/**
+ * Public surface of the members domain, consumed by the admin shell
+ * (apps/admin/src/routes.tsx), the layout, and other domains. Everything
+ * else in this domain is internal.
+ */
+export { membersRouteChildren } from './routes';
+export { buildMembersUrl } from './member-route';
+export { formatMemberName, getMemberInitials, memberAvatarProps } from './member-format';
+export { type SharedView, parseAllSharedViewsJSON } from './shared-views';
diff --git a/apps/admin/src/members/routes.tsx b/apps/admin/src/members/routes.tsx
new file mode 100644
index 00000000000..1d38f5ca2f9
--- /dev/null
+++ b/apps/admin/src/members/routes.tsx
@@ -0,0 +1,22 @@
+import { type RouteObject, lazyComponent } from '@tryghost/admin-x-framework';
+
+// The child routes under `/members`. The shell (apps/admin/src/routes.tsx)
+// mounts these under the `/members` route node, which carries the access
+// handle. `lazy:` is preserved for per-view code-splitting.
+export const membersRouteChildren: RouteObject[] = [
+  {
+    index: true,
+    lazy: lazyComponent(() => import('./members')),
+  },
+  {
+    path: 'import',
+    lazy: lazyComponent(() => import('./members')),
+  },
+  {
+    // Covers both edit (`:member_id`) and create (the sentinel `new`)
+    // — real member ids are 24-char hex ObjectIds, so they can't
+    // collide with the literal "new".
+    path: ':member_id',
+    lazy: lazyComponent(() => import('./detail/member-detail')),
+  },
+];
diff --git a/apps/admin/src/onboarding/api.ts b/apps/admin/src/onboarding/api.ts
new file mode 100644
index 00000000000..09e616ba2a8
--- /dev/null
+++ b/apps/admin/src/onboarding/api.ts
@@ -0,0 +1,11 @@
+/**
+ * Public surface of the onboarding domain, consumed by the admin shell
+ * (apps/admin/src/routes.tsx and the home redirect). Everything else in this
+ * domain is internal.
+ */
+export { OnboardingRedirect } from './onboarding-redirect';
+export { useOnboarding } from './hooks/use-onboarding';
+
+// Lazy entry, not a component re-export: the shell mounts it behind `lazy:`,
+// so a static re-export would pull the chunk into the shell bundle.
+export const lazyOnboardingScreen = () => import('./onboarding-route');
diff --git a/apps/admin/src/posts/analytics/growth/growth.tsx b/apps/admin/src/posts/analytics/growth/growth.tsx
index ca6ee3ffda9..1d71c3b0457 100644
--- a/apps/admin/src/posts/analytics/growth/growth.tsx
+++ b/apps/admin/src/posts/analytics/growth/growth.tsx
@@ -19,7 +19,7 @@ import {
   SkeletonTable,
 } from '@tryghost/shade/components';
 import { LucideIcon, formatNumber } from '@tryghost/shade/utils';
-import { buildMembersUrl } from '@/members/member-route';
+import { buildMembersUrl } from '@/members/api';
 import { centsToDollars } from '@/shared/analytics/chart-helpers';
 import { useAnalyticsData } from '@/shared/analytics/use-analytics-data';
 import { useNavigate, useParams } from '@tryghost/admin-x-framework';
diff --git a/apps/admin/src/posts/analytics/newsletter/components/feedback.tsx b/apps/admin/src/posts/analytics/newsletter/components/feedback.tsx
index 01b4f8a7c5d..54ec6a714e5 100644
--- a/apps/admin/src/posts/analytics/newsletter/components/feedback.tsx
+++ b/apps/admin/src/posts/analytics/newsletter/components/feedback.tsx
@@ -26,7 +26,7 @@ import {
   stringToHslColor,
   useSimplePagination,
 } from '@tryghost/shade/utils';
-import { formatMemberName, getMemberInitials } from '@/members/member-format';
+import { formatMemberName, getMemberInitials } from '@/members/api';
 import { useNavigate, useParams } from '@tryghost/admin-x-framework';
 import { usePostFeedback } from '@/posts/analytics/hooks/use-post-feedback';
 import { useState } from 'react';
diff --git a/apps/admin/src/posts/analytics/newsletter/newsletter.tsx b/apps/admin/src/posts/analytics/newsletter/newsletter.tsx
index 906f0e0e3ae..d98ee70bd4b 100644
--- a/apps/admin/src/posts/analytics/newsletter/newsletter.tsx
+++ b/apps/admin/src/posts/analytics/newsletter/newsletter.tsx
@@ -45,7 +45,7 @@ import {
   type NewsletterRadialChartData,
 } from './components/newsletter-radial-chart';
 import { type Post, usePostAnalytics } from '@/posts/analytics/providers/post-analytics-context';
-import { buildMembersUrl } from '@/members/member-route';
+import { buildMembersUrl } from '@/members/api';
 import { getLinkById } from '@/posts/analytics/utils/link-helpers';
 import { hasBeenEmailed, useNavigate } from '@tryghost/admin-x-framework';
 import { toast } from 'sonner';
diff --git a/apps/admin/src/posts/analytics/routes.tsx b/apps/admin/src/posts/analytics/routes.tsx
new file mode 100644
index 00000000000..4a58be3de85
--- /dev/null
+++ b/apps/admin/src/posts/analytics/routes.tsx
@@ -0,0 +1,29 @@
+import { type RouteObject, lazyComponent } from '@tryghost/admin-x-framework';
+
+// The `/posts/analytics/:postId` subtree. The shell (apps/admin/src/routes.tsx)
+// mounts a node with `lazy: lazyPostAnalyticsRoot` and these children; the root
+// lazy composes the provider around the screen so neither chunk loads before
+// the route is visited. `lazy:` is preserved for per-view code-splitting.
+export const lazyPostAnalyticsRoot = async () => {
+  const [{ default: PostAnalyticsProvider }, { default: PostAnalytics }] = await Promise.all([
+    import('./providers/post-analytics-provider'),
+    import('./post-analytics'),
+  ]);
+  return {
+    element: (
+      <PostAnalyticsProvider>
+        <PostAnalytics />
+      </PostAnalyticsProvider>
+    ),
+  };
+};
+
+export const postAnalyticsRouteChildren: RouteObject[] = [
+  { path: '', lazy: lazyComponent(() => import('./overview/overview')) },
+  { path: 'web', lazy: lazyComponent(() => import('./web/web')) },
+  { path: 'growth', lazy: lazyComponent(() => import('./growth/growth')) },
+  {
+    path: 'newsletter',
+    lazy: lazyComponent(() => import('./newsletter/newsletter')),
+  },
+];
diff --git a/apps/admin/src/posts/api.ts b/apps/admin/src/posts/api.ts
new file mode 100644
index 00000000000..2654323fc6f
--- /dev/null
+++ b/apps/admin/src/posts/api.ts
@@ -0,0 +1,10 @@
+/**
+ * Public surface of the posts domain, consumed by the admin shell
+ * (apps/admin/src/routes.tsx and the gift-link modal host). Everything else
+ * in this domain is internal.
+ */
+export { lazyPostAnalyticsRoot, postAnalyticsRouteChildren } from './analytics/routes';
+
+// Lazy entry, not a component re-export: the shell's host loads the modal on
+// demand, so a static re-export would pull the chunk into the shell bundle.
+export const lazyGiftLinkModal = () => import('./analytics/modals/gift-link-modal');
diff --git a/apps/admin/src/route-access-guard.tsx b/apps/admin/src/route-access-guard.tsx
index 9141b56df00..c6a78c53594 100644
--- a/apps/admin/src/route-access-guard.tsx
+++ b/apps/admin/src/route-access-guard.tsx
@@ -1,13 +1,6 @@
 import { Navigate, Outlet, useLocation, useMatches } from '@tryghost/admin-x-framework';
 import { useCurrentUser } from '@tryghost/admin-x-framework/api/current-user';
-
-type CurrentUser = NonNullable<ReturnType<typeof useCurrentUser>['data']>;
-
-export type AccessRule = (user: CurrentUser, location: { pathname: string }) => boolean;
-
-export interface AccessRouteHandle {
-  requiresAccess?: AccessRule;
-}
+import type { AccessRouteHandle, AccessRule } from './route-access';
 
 /**
  * Guard component that keeps staff users out of routes their role can't use.
diff --git a/apps/admin/src/route-access.ts b/apps/admin/src/route-access.ts
new file mode 100644
index 00000000000..62dce5f2771
--- /dev/null
+++ b/apps/admin/src/route-access.ts
@@ -0,0 +1,11 @@
+import type { useCurrentUser } from '@tryghost/admin-x-framework/api/current-user';
+
+type CurrentUser = NonNullable<ReturnType<typeof useCurrentUser>['data']>;
+
+// Route-access contract shared by the shell and the domains: domains type
+// their access predicates against this module, not the guard component.
+export type AccessRule = (user: CurrentUser, location: { pathname: string }) => boolean;
+
+export interface AccessRouteHandle {
+  requiresAccess?: AccessRule;
+}
diff --git a/apps/admin/src/routes.tsx b/apps/admin/src/routes.tsx
index 2f2890495cd..dd33a78b1cf 100644
--- a/apps/admin/src/routes.tsx
+++ b/apps/admin/src/routes.tsx
@@ -20,17 +20,22 @@ import HomeRedirect from './home-redirect';
 import { EmberListWithGiftLinks } from './gift-link-modal-host';
 import { TagDetailGate } from './tag-detail-gate';
 import { useFlagGatedRouteOwner } from './use-flag-gated-route-owner';
-import { OnboardingRedirect } from './onboarding/onboarding-redirect';
-import { type AccessRouteHandle, RouteAccessGuard } from './route-access-guard';
-import { canAccessSettingsRoute } from './settings/settings-access';
-import { settingsRouteChildren } from './settings/routes';
+import { type AccessRouteHandle } from './route-access';
+import { RouteAccessGuard } from './route-access-guard';
+import { lazyAutomationEditorScreen, lazyAutomationsScreen } from './automations/api';
+import { lazyCommentsScreen } from './comments/api';
+import { membersRouteChildren } from './members/api';
+import { OnboardingRedirect, lazyOnboardingScreen } from './onboarding/api';
+import { lazyPostAnalyticsRoot, postAnalyticsRouteChildren } from './posts/api';
+import { canAccessSettingsRoute, lazySettingsScreen, settingsRouteChildren } from './settings/api';
+import { lazyTagsScreen } from './tags/api';
 import {
   canManageAutomations,
   canManageMembers,
   canManageTags,
 } from '@tryghost/admin-x-framework/api/users';
 
-import { NotFound } from './not-found';
+import { NotFound } from './shared/not-found';
 
 // Routes handled by the Ember admin app. React delegates these to Ember via
 // EmberFallback. When migrating a route to React, remove its entry from here.
@@ -57,28 +62,6 @@ const emberFallbackRoutes: RouteObject[] = EMBER_ROUTES.map((path) => ({
   handle: emberFallbackHandle,
 }));
 
-const membersRoute: RouteObject = {
-  path: '/members',
-  handle: { requiresAccess: canManageMembers } satisfies AccessRouteHandle,
-  children: [
-    {
-      index: true,
-      lazy: lazyComponent(() => import('./members/members')),
-    },
-    {
-      path: 'import',
-      lazy: lazyComponent(() => import('./members/members')),
-    },
-    {
-      // Covers both edit (`:member_id`) and create (the sentinel `new`)
-      // — real member ids are 24-char hex ObjectIds, so they can't
-      // collide with the literal "new".
-      path: ':member_id',
-      lazy: lazyComponent(() => import('./members/detail/member-detail')),
-    },
-  ],
-};
-
 const appRoutes: RouteObject[] = [
   {
     // Role-based landing dispatch, including the hosted-signup
@@ -95,17 +78,17 @@ const appRoutes: RouteObject[] = [
   {
     path: '/tags',
     handle: { requiresAccess: canManageTags } satisfies AccessRouteHandle,
-    lazy: lazyComponent(() => import('./tags/tags')),
+    lazy: lazyComponent(lazyTagsScreen),
   },
   {
     path: '/comments',
     handle: { requiresAccess: canManageMembers } satisfies AccessRouteHandle,
-    lazy: lazyComponent(() => import('./comments/comments')),
+    lazy: lazyComponent(lazyCommentsScreen),
   },
   {
     path: '/automations',
     handle: { requiresAccess: canManageAutomations } satisfies AccessRouteHandle,
-    lazy: lazyComponent(() => import('./automations/automations')),
+    lazy: lazyComponent(lazyAutomationsScreen),
   },
   {
     // The automation editor hides the admin sidebar for a focused,
@@ -115,7 +98,7 @@ const appRoutes: RouteObject[] = [
       hideAdminSidebar: true,
       requiresAccess: canManageAutomations,
     } satisfies AdminRouteHandle & AccessRouteHandle,
-    lazy: lazyComponent(() => import('./automations/editor')),
+    lazy: lazyComponent(lazyAutomationEditorScreen),
   },
   {
     // Covers both edit (`:tagSlug`) and create (the sentinel `new`) —
@@ -128,31 +111,15 @@ const appRoutes: RouteObject[] = [
     Component: TagDetailGate,
     handle: { requiresAccess: canManageTags } satisfies AccessRouteHandle,
   },
-  membersRoute,
+  {
+    path: '/members',
+    handle: { requiresAccess: canManageMembers } satisfies AccessRouteHandle,
+    children: membersRouteChildren,
+  },
   {
     path: '/posts/analytics/:postId',
-    lazy: async () => {
-      const [{ default: PostAnalyticsProvider }, { default: PostAnalytics }] = await Promise.all([
-        import('./posts/analytics/providers/post-analytics-provider'),
-        import('./posts/analytics/post-analytics'),
-      ]);
-      return {
-        element: (
-          <PostAnalyticsProvider>
-            <PostAnalytics />
-          </PostAnalyticsProvider>
-        ),
-      };
-    },
-    children: [
-      { path: '', lazy: lazyComponent(() => import('./posts/analytics/overview/overview')) },
-      { path: 'web', lazy: lazyComponent(() => import('./posts/analytics/web/web')) },
-      { path: 'growth', lazy: lazyComponent(() => import('./posts/analytics/growth/growth')) },
-      {
-        path: 'newsletter',
-        lazy: lazyComponent(() => import('./posts/analytics/newsletter/newsletter')),
-      },
-    ],
+    lazy: lazyPostAnalyticsRoot,
+    children: postAnalyticsRouteChildren,
   },
   {
     // Analytics routes folded directly into the shell table. The
@@ -171,7 +138,7 @@ const appRoutes: RouteObject[] = [
   },
   {
     path: 'setup/onboarding',
-    lazy: lazyComponent(() => import('./onboarding/onboarding-route')),
+    lazy: lazyComponent(lazyOnboardingScreen),
   },
   {
     path: `network`,
@@ -195,7 +162,7 @@ const appRoutes: RouteObject[] = [
     // hideAdminSidebar lives on the handle, not the lazy module, so the shell
     // hides at first paint instead of waiting on the settings chunk.
     path: `settings`,
-    lazy: lazyComponent(() => import('./settings/settings')),
+    lazy: lazyComponent(lazySettingsScreen),
     children: settingsRouteChildren,
     handle: {
       allowInForceUpgrade: true,
diff --git a/apps/admin/src/settings/advanced/history-modal.tsx b/apps/admin/src/settings/advanced/history-modal.tsx
index 3697bb1d7d5..3937b44db05 100644
--- a/apps/admin/src/settings/advanced/history-modal.tsx
+++ b/apps/admin/src/settings/advanced/history-modal.tsx
@@ -26,7 +26,7 @@ import {
   inputSurface,
 } from '@tryghost/shade/components';
 import { ChevronDown, History, Pen, Plus, Trash2, X } from 'lucide-react';
-import { memberAvatarProps } from '@/members/member-format';
+import { memberAvatarProps } from '@/members/api';
 import { Inline, Stack } from '@tryghost/shade/primitives';
 import { useParams } from '@tryghost/admin-x-framework';
 import { useSettingsNavigation } from '@/settings/hooks/use-settings-navigation';
diff --git a/apps/admin/src/settings/advanced/integrations.tsx b/apps/admin/src/settings/advanced/integrations.tsx
index 2f19d36e089..998df9b135c 100644
--- a/apps/admin/src/settings/advanced/integrations.tsx
+++ b/apps/admin/src/settings/advanced/integrations.tsx
@@ -1,4 +1,4 @@
-import BrandIcon from '@/settings/components/icons/brand-icon';
+import BrandIcon from '@/shared/brand-icon/brand-icon';
 import IntegrationsSettingsImg from '@/settings/assets/images/integrations-settings.png';
 import React, { useState } from 'react';
 import TopLevelGroup from '@/settings/components/top-level-group';
diff --git a/apps/admin/src/settings/advanced/integrations/first-promoter-modal.tsx b/apps/admin/src/settings/advanced/integrations/first-promoter-modal.tsx
index e7be59189af..9bd0fcc9073 100644
--- a/apps/admin/src/settings/advanced/integrations/first-promoter-modal.tsx
+++ b/apps/admin/src/settings/advanced/integrations/first-promoter-modal.tsx
@@ -1,4 +1,4 @@
-import BrandIcon from '@/settings/components/icons/brand-icon';
+import BrandIcon from '@/shared/brand-icon/brand-icon';
 import IntegrationHeader from './integration-header';
 import {
   Field,
diff --git a/apps/admin/src/settings/advanced/integrations/pintura-modal.tsx b/apps/admin/src/settings/advanced/integrations/pintura-modal.tsx
index a3514e64e5c..0e080599367 100644
--- a/apps/admin/src/settings/advanced/integrations/pintura-modal.tsx
+++ b/apps/admin/src/settings/advanced/integrations/pintura-modal.tsx
@@ -1,4 +1,4 @@
-import BrandIcon from '@/settings/components/icons/brand-icon';
+import BrandIcon from '@/shared/brand-icon/brand-icon';
 import IntegrationHeader from './integration-header';
 import pinturaScreenshot from '@/settings/assets/images/pintura-screenshot.png';
 import {
diff --git a/apps/admin/src/settings/advanced/integrations/slack-modal.tsx b/apps/admin/src/settings/advanced/integrations/slack-modal.tsx
index 99aa314e23e..549c4b10bb8 100644
--- a/apps/admin/src/settings/advanced/integrations/slack-modal.tsx
+++ b/apps/admin/src/settings/advanced/integrations/slack-modal.tsx
@@ -1,4 +1,4 @@
-import BrandIcon from '@/settings/components/icons/brand-icon';
+import BrandIcon from '@/shared/brand-icon/brand-icon';
 import IntegrationHeader from './integration-header';
 import useSettingGroup from '@/settings/hooks/use-setting-group';
 import validator from 'validator';
diff --git a/apps/admin/src/settings/advanced/integrations/transistor-modal.tsx b/apps/admin/src/settings/advanced/integrations/transistor-modal.tsx
index 2b1035866f4..f1519ac335b 100644
--- a/apps/admin/src/settings/advanced/integrations/transistor-modal.tsx
+++ b/apps/admin/src/settings/advanced/integrations/transistor-modal.tsx
@@ -1,6 +1,6 @@
 import APIKeys from './api-keys';
 import BookmarkThumb from '@/settings/assets/images/integrations/ghost-transistor.png';
-import BrandIcon from '@/settings/components/icons/brand-icon';
+import BrandIcon from '@/shared/brand-icon/brand-icon';
 import IntegrationHeader from './integration-header';
 import {
   Field,
diff --git a/apps/admin/src/settings/advanced/integrations/unsplash-modal.tsx b/apps/admin/src/settings/advanced/integrations/unsplash-modal.tsx
index af7551276e2..6f5846b6439 100644
--- a/apps/admin/src/settings/advanced/integrations/unsplash-modal.tsx
+++ b/apps/admin/src/settings/advanced/integrations/unsplash-modal.tsx
@@ -1,4 +1,4 @@
-import BrandIcon from '@/settings/components/icons/brand-icon';
+import BrandIcon from '@/shared/brand-icon/brand-icon';
 import IntegrationHeader from './integration-header';
 import {
   Field,
diff --git a/apps/admin/src/settings/advanced/integrations/zapier-modal.tsx b/apps/admin/src/settings/advanced/integrations/zapier-modal.tsx
index 3b18dc91914..393a5a83f03 100644
--- a/apps/admin/src/settings/advanced/integrations/zapier-modal.tsx
+++ b/apps/admin/src/settings/advanced/integrations/zapier-modal.tsx
@@ -1,5 +1,5 @@
 import APIKeys from './api-keys';
-import BrandIcon from '@/settings/components/icons/brand-icon';
+import BrandIcon from '@/shared/brand-icon/brand-icon';
 import IntegrationHeader from './integration-header';
 import ZapierLogo from '@/settings/assets/images/zapier-logo.svg';
 import {
diff --git a/apps/admin/src/settings/advanced/migration-tools/content-import/mapping.test.ts b/apps/admin/src/settings/advanced/migration-tools/content-import/mapping.test.ts
index a3b2dcecccb..69ad2dd7396 100644
--- a/apps/admin/src/settings/advanced/migration-tools/content-import/mapping.test.ts
+++ b/apps/admin/src/settings/advanced/migration-tools/content-import/mapping.test.ts
@@ -15,12 +15,24 @@ describe('ContentFieldMapping', () => {
     expect(mapping.toJSON()).toEqual({ 'First title': '', 'Second title': 'title' });
   });
 
+  it('reads and clears individual mappings', () => {
+    const mapping = ContentFieldMapping.detect(['title', 'Other']);
+
+    expect(mapping.get('title')).toBe('title');
+    expect(mapping.get('Other')).toBeNull();
+    expect(mapping.update('title', null).get('title')).toBeNull();
+  });
+
   it('detects exact field-name headers', () => {
     const mapping = ContentFieldMapping.detect([
       'title',
       'html',
       'markdown',
       'published_at',
+      'comment_id',
+      'authors',
+      'author_emails',
+      'tags',
       'Something else',
     ]);
 
@@ -29,6 +41,10 @@ describe('ContentFieldMapping', () => {
       html: 'html',
       markdown: 'markdown',
       published_at: 'published_at',
+      comment_id: 'comment_id',
+      authors: 'authors',
+      author_emails: 'author_emails',
+      tags: 'tags',
       'Something else': '',
     });
   });
@@ -51,6 +67,7 @@ describe('ContentFieldMapping', () => {
     expect(CONTENT_FIELD_GROUPS.map((group) => group.label)).toEqual([
       'Content',
       'Publishing',
+      'Authors & tags',
       'Images',
       'SEO',
       'Social',
@@ -69,6 +86,9 @@ describe('ContentFieldMapping', () => {
       'created_at',
       'updated_at',
       'published_at',
+      'authors',
+      'author_emails',
+      'tags',
       'feature_image',
       'feature_image_alt',
       'feature_image_caption',
@@ -82,22 +102,14 @@ describe('ContentFieldMapping', () => {
       'twitter_image',
       'twitter_title',
       'twitter_description',
+      'comment_id',
       'custom_template',
       'codeinjection_head',
       'codeinjection_foot',
       'frontmatter',
     ]);
     expect(CONTENT_FIELD_MAPPINGS.map((field) => field.value)).not.toEqual(
-      expect.arrayContaining([
-        'authors',
-        'tags',
-        'comment_id',
-        'newsletter_id',
-        'email',
-        'tiers',
-        'id',
-        'lexical',
-      ]),
+      expect.arrayContaining(['newsletter_id', 'email', 'tiers', 'id', 'lexical']),
     );
   });
 });
diff --git a/apps/admin/src/settings/advanced/migration-tools/content-import/mapping.ts b/apps/admin/src/settings/advanced/migration-tools/content-import/mapping.ts
index 2917bf05d93..092e5fa8c0d 100644
--- a/apps/admin/src/settings/advanced/migration-tools/content-import/mapping.ts
+++ b/apps/admin/src/settings/advanced/migration-tools/content-import/mapping.ts
@@ -32,6 +32,14 @@ export const CONTENT_FIELD_GROUPS: readonly ContentFieldGroup[] = [
       { label: 'Published at', value: 'published_at', required: false },
     ],
   },
+  {
+    label: 'Authors & tags',
+    fields: [
+      { label: 'Authors', value: 'authors', required: false },
+      { label: 'Author emails', value: 'author_emails', required: false },
+      { label: 'Tags', value: 'tags', required: false },
+    ],
+  },
   {
     label: 'Images',
     fields: [
@@ -67,6 +75,7 @@ export const CONTENT_FIELD_GROUPS: readonly ContentFieldGroup[] = [
   {
     label: 'Advanced',
     fields: [
+      { label: 'Source ID', value: 'comment_id', required: false },
       { label: 'Custom template', value: 'custom_template', required: false },
       { label: 'Code injection head', value: 'codeinjection_head', required: false },
       { label: 'Code injection foot', value: 'codeinjection_foot', required: false },
diff --git a/apps/admin/src/settings/advanced/migration-tools/migration-tools-import.tsx b/apps/admin/src/settings/advanced/migration-tools/migration-tools-import.tsx
index 86e23501877..c2f13a63bdc 100644
--- a/apps/admin/src/settings/advanced/migration-tools/migration-tools-import.tsx
+++ b/apps/admin/src/settings/advanced/migration-tools/migration-tools-import.tsx
@@ -1,4 +1,4 @@
-import BrandIcon from '@/settings/components/icons/brand-icon';
+import BrandIcon from '@/shared/brand-icon/brand-icon';
 import React, { useState } from 'react';
 import UniversalImportModal from './universal-import-modal';
 import { Button } from '@tryghost/shade/components';
diff --git a/apps/admin/src/settings/advanced/migration-tools/universal-import-modal.test.tsx b/apps/admin/src/settings/advanced/migration-tools/universal-import-modal.test.tsx
index 3ee66a3c286..6b2b520b3db 100644
--- a/apps/admin/src/settings/advanced/migration-tools/universal-import-modal.test.tsx
+++ b/apps/admin/src/settings/advanced/migration-tools/universal-import-modal.test.tsx
@@ -212,6 +212,52 @@ describe('UniversalImportModal', () => {
     );
   });
 
+  it('maps author names, author emails, and tags from the grouped picker', async () => {
+    mockUseFeatureFlag.mockReturnValue(true);
+    showModal();
+
+    const file = new File(
+      [
+        'title,Bylines,Emails,Topics\nHello,"Alice, Bob","alice@example.com, bob@example.com","News, Features"',
+      ],
+      'posts.csv',
+      { type: 'text/csv' },
+    );
+    await dropFile(file);
+
+    fireEvent.click(await screen.findByRole('combobox', { name: /Field for Bylines/ }));
+    expect(screen.getByText('Authors & tags')).toBeInTheDocument();
+    fireEvent.change(screen.getByPlaceholderText('Search post fields...'), {
+      target: { value: 'Authors' },
+    });
+    fireEvent.click(screen.getByText('Authors'));
+
+    fireEvent.click(screen.getByRole('combobox', { name: /Field for Emails/ }));
+    fireEvent.change(screen.getByPlaceholderText('Search post fields...'), {
+      target: { value: 'Author emails' },
+    });
+    fireEvent.click(screen.getByText('Author emails'));
+
+    fireEvent.click(screen.getByRole('combobox', { name: /Field for Topics/ }));
+    fireEvent.change(screen.getByPlaceholderText('Search post fields...'), {
+      target: { value: 'Tags' },
+    });
+    fireEvent.click(screen.getByText('Tags'));
+    fireEvent.click(screen.getByRole('button', { name: 'Import' }));
+
+    await waitFor(() =>
+      expect(mockImportContentCSV).toHaveBeenCalledWith({
+        file,
+        mapping: {
+          title: 'title',
+          Bylines: 'authors',
+          Emails: 'author_emails',
+          Topics: 'tags',
+        },
+      }),
+    );
+  });
+
   it('still sends JSON files to the db import when csvContentImporter is enabled', async () => {
     mockUseFeatureFlag.mockReturnValue(true);
     showModal();
diff --git a/apps/admin/src/settings/api.ts b/apps/admin/src/settings/api.ts
new file mode 100644
index 00000000000..31d281c8cb5
--- /dev/null
+++ b/apps/admin/src/settings/api.ts
@@ -0,0 +1,10 @@
+/**
+ * Public surface of the settings domain, consumed by the admin shell
+ * (apps/admin/src/routes.tsx). Everything else in this domain is internal.
+ */
+export { settingsRouteChildren } from './routes';
+export { canAccessSettingsRoute } from './settings-access';
+
+// Lazy entry, not a component re-export: the shell mounts it behind `lazy:`,
+// so a static re-export would pull the chunk into the shell bundle.
+export const lazySettingsScreen = () => import('./settings');
diff --git a/apps/admin/src/settings/general/users.tsx b/apps/admin/src/settings/general/users.tsx
index cc69d289a7a..57c8155a978 100644
--- a/apps/admin/src/settings/general/users.tsx
+++ b/apps/admin/src/settings/general/users.tsx
@@ -33,7 +33,7 @@ import {
 } from '@tryghost/admin-x-framework/api/invites';
 import { UserRoundX } from 'lucide-react';
 import { formatNumber } from '@tryghost/shade/utils';
-import { memberAvatarProps } from '@/members/member-format';
+import { memberAvatarProps } from '@/members/api';
 import { getSettingValue, useEditSettings } from '@tryghost/admin-x-framework/api/settings';
 import { toast } from 'sonner';
 import { useGlobalData } from '@/settings/providers/global-data-context';
diff --git a/apps/admin/src/settings/growth/explore/testimonials-modal.tsx b/apps/admin/src/settings/growth/explore/testimonials-modal.tsx
index 29c45e05ed7..f403eb8ce3e 100644
--- a/apps/admin/src/settings/growth/explore/testimonials-modal.tsx
+++ b/apps/admin/src/settings/growth/explore/testimonials-modal.tsx
@@ -17,7 +17,7 @@ import {
 } from '@tryghost/shade/components';
 import { Button, LoadingIndicator } from '@tryghost/shade/components';
 import { SettingsModal } from '@tryghost/shade/patterns';
-import { memberAvatarProps } from '@/members/member-format';
+import { memberAvatarProps } from '@/members/api';
 import { getSettingValues } from '@tryghost/admin-x-framework/api/settings';
 import { toast } from 'sonner';
 import { useForm, useHandleError } from '@tryghost/admin-x-framework/hooks';
diff --git a/apps/admin/src/settings/growth/offers/offer-success.tsx b/apps/admin/src/settings/growth/offers/offer-success.tsx
index 236670414d9..0d5e00d3d24 100644
--- a/apps/admin/src/settings/growth/offers/offer-success.tsx
+++ b/apps/admin/src/settings/growth/offers/offer-success.tsx
@@ -1,4 +1,4 @@
-import BrandIcon from '@/settings/components/icons/brand-icon';
+import BrandIcon from '@/shared/brand-icon/brand-icon';
 import SettingsBreadcrumbs from '@/settings/components/settings-breadcrumbs';
 import { Button, Input } from '@tryghost/shade/components';
 import { LucideIcon } from '@tryghost/shade/utils';
diff --git a/apps/admin/src/settings/membership/access.acceptance.test.tsx b/apps/admin/src/settings/membership/access.acceptance.test.tsx
index 4a310383b24..63eb3c19ff3 100644
--- a/apps/admin/src/settings/membership/access.acceptance.test.tsx
+++ b/apps/admin/src/settings/membership/access.acceptance.test.tsx
@@ -234,8 +234,13 @@ describe('Access settings', () => {
 
     await choose('default-post-access-select', 'Specific tiers');
     await settingsScreen.access().getByTestId('tiers-select').click();
-    await settingsScreen.selectOption(basic.name).click();
-    await settingsScreen.selectOption(premium.name).click();
+    const basicOption = settingsScreen.tierOption(basic.name);
+    await expect.element(basicOption).toBeVisible();
+    await basicOption.click();
+
+    const premiumOption = settingsScreen.tierOption(premium.name);
+    await expect.element(premiumOption).toBeVisible();
+    await premiumOption.click();
     await settingsScreen.access().getByRole('button', { name: 'Save' }).click();
 
     await expect
diff --git a/apps/admin/src/settings/membership/portal/look-and-feel.tsx b/apps/admin/src/settings/membership/portal/look-and-feel.tsx
index 118651b655e..b234bc991cd 100644
--- a/apps/admin/src/settings/membership/portal/look-and-feel.tsx
+++ b/apps/admin/src/settings/membership/portal/look-and-feel.tsx
@@ -1,4 +1,4 @@
-import BrandIcon, { type BrandIconName } from '@/settings/components/icons/brand-icon';
+import BrandIcon, { type BrandIconName } from '@/shared/brand-icon/brand-icon';
 import React, { useState } from 'react';
 import { APIError } from '@tryghost/admin-x-framework/errors';
 import {
diff --git a/apps/admin/src/settings/settings-access.ts b/apps/admin/src/settings/settings-access.ts
index f77bb833dde..40371f55e3f 100644
--- a/apps/admin/src/settings/settings-access.ts
+++ b/apps/admin/src/settings/settings-access.ts
@@ -1,6 +1,6 @@
 import { canAccessSettings } from '@tryghost/admin-x-framework/api/users';
 import { getStaffProfileSlug } from '@/settings/providers/routing/staff-profile-paths';
-import type { AccessRule } from '@/route-access-guard';
+import type { AccessRule } from '@/route-access';
 
 const SETTINGS_PREFIX = /^\/settings\/?/;
 
diff --git a/apps/admin/src/settings/settings.screen.ts b/apps/admin/src/settings/settings.screen.ts
index 2a612a48f41..67d48d87acd 100644
--- a/apps/admin/src/settings/settings.screen.ts
+++ b/apps/admin/src/settings/settings.screen.ts
@@ -50,6 +50,8 @@ export const settingsScreen = {
     page.getByRole('option', {
       name: new RegExp(`^${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?:\\s|$)`),
     }),
+  tierOption: (name: string) =>
+    page.getByRole('listbox').getByRole('option', { name, exact: true }),
   errorToast: toast,
   successToast: toast,
   inviteUserModal: () => page.getByTestId(sel.inviteUserModal),
diff --git a/apps/admin/src/settings/assets/images/brand-icons/beehiiv.svg b/apps/admin/src/shared/brand-icon/assets/beehiiv.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/beehiiv.svg
rename to apps/admin/src/shared/brand-icon/assets/beehiiv.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/facebook.svg b/apps/admin/src/shared/brand-icon/assets/facebook.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/facebook.svg
rename to apps/admin/src/shared/brand-icon/assets/facebook.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/firstpromoter.svg b/apps/admin/src/shared/brand-icon/assets/firstpromoter.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/firstpromoter.svg
rename to apps/admin/src/shared/brand-icon/assets/firstpromoter.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/linkedin.svg b/apps/admin/src/shared/brand-icon/assets/linkedin.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/linkedin.svg
rename to apps/admin/src/shared/brand-icon/assets/linkedin.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/mailchimp.svg b/apps/admin/src/shared/brand-icon/assets/mailchimp.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/mailchimp.svg
rename to apps/admin/src/shared/brand-icon/assets/mailchimp.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/medium.svg b/apps/admin/src/shared/brand-icon/assets/medium.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/medium.svg
rename to apps/admin/src/shared/brand-icon/assets/medium.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/pintura.svg b/apps/admin/src/shared/brand-icon/assets/pintura.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/pintura.svg
rename to apps/admin/src/shared/brand-icon/assets/pintura.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/portal-icon-1.svg b/apps/admin/src/shared/brand-icon/assets/portal-icon-1.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/portal-icon-1.svg
rename to apps/admin/src/shared/brand-icon/assets/portal-icon-1.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/portal-icon-2.svg b/apps/admin/src/shared/brand-icon/assets/portal-icon-2.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/portal-icon-2.svg
rename to apps/admin/src/shared/brand-icon/assets/portal-icon-2.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/portal-icon-3.svg b/apps/admin/src/shared/brand-icon/assets/portal-icon-3.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/portal-icon-3.svg
rename to apps/admin/src/shared/brand-icon/assets/portal-icon-3.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/portal-icon-4.svg b/apps/admin/src/shared/brand-icon/assets/portal-icon-4.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/portal-icon-4.svg
rename to apps/admin/src/shared/brand-icon/assets/portal-icon-4.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/portal-icon-5.svg b/apps/admin/src/shared/brand-icon/assets/portal-icon-5.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/portal-icon-5.svg
rename to apps/admin/src/shared/brand-icon/assets/portal-icon-5.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/slack.svg b/apps/admin/src/shared/brand-icon/assets/slack.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/slack.svg
rename to apps/admin/src/shared/brand-icon/assets/slack.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/squarespace.svg b/apps/admin/src/shared/brand-icon/assets/squarespace.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/squarespace.svg
rename to apps/admin/src/shared/brand-icon/assets/squarespace.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/substack.svg b/apps/admin/src/shared/brand-icon/assets/substack.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/substack.svg
rename to apps/admin/src/shared/brand-icon/assets/substack.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/transistor.svg b/apps/admin/src/shared/brand-icon/assets/transistor.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/transistor.svg
rename to apps/admin/src/shared/brand-icon/assets/transistor.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/twitter-x.svg b/apps/admin/src/shared/brand-icon/assets/twitter-x.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/twitter-x.svg
rename to apps/admin/src/shared/brand-icon/assets/twitter-x.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/unsplash.svg b/apps/admin/src/shared/brand-icon/assets/unsplash.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/unsplash.svg
rename to apps/admin/src/shared/brand-icon/assets/unsplash.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/wordpress.svg b/apps/admin/src/shared/brand-icon/assets/wordpress.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/wordpress.svg
rename to apps/admin/src/shared/brand-icon/assets/wordpress.svg
diff --git a/apps/admin/src/settings/assets/images/brand-icons/zapier.svg b/apps/admin/src/shared/brand-icon/assets/zapier.svg
similarity index 100%
rename from apps/admin/src/settings/assets/images/brand-icons/zapier.svg
rename to apps/admin/src/shared/brand-icon/assets/zapier.svg
diff --git a/apps/admin/src/settings/components/icons/brand-icon.tsx b/apps/admin/src/shared/brand-icon/brand-icon.tsx
similarity index 54%
rename from apps/admin/src/settings/components/icons/brand-icon.tsx
rename to apps/admin/src/shared/brand-icon/brand-icon.tsx
index 5be835b2e41..b1d3309d4e4 100644
--- a/apps/admin/src/settings/components/icons/brand-icon.tsx
+++ b/apps/admin/src/shared/brand-icon/brand-icon.tsx
@@ -1,24 +1,24 @@
-import Beehiiv from '@/settings/assets/images/brand-icons/beehiiv.svg';
-import Facebook from '@/settings/assets/images/brand-icons/facebook.svg';
-import FirstPromoter from '@/settings/assets/images/brand-icons/firstpromoter.svg';
-import Linkedin from '@/settings/assets/images/brand-icons/linkedin.svg';
-import Mailchimp from '@/settings/assets/images/brand-icons/mailchimp.svg';
-import Medium from '@/settings/assets/images/brand-icons/medium.svg';
-import Pintura from '@/settings/assets/images/brand-icons/pintura.svg';
-import PortalIcon1 from '@/settings/assets/images/brand-icons/portal-icon-1.svg';
-import PortalIcon2 from '@/settings/assets/images/brand-icons/portal-icon-2.svg';
-import PortalIcon3 from '@/settings/assets/images/brand-icons/portal-icon-3.svg';
-import PortalIcon4 from '@/settings/assets/images/brand-icons/portal-icon-4.svg';
-import PortalIcon5 from '@/settings/assets/images/brand-icons/portal-icon-5.svg';
+import Beehiiv from './assets/beehiiv.svg';
+import Facebook from './assets/facebook.svg';
+import FirstPromoter from './assets/firstpromoter.svg';
+import Linkedin from './assets/linkedin.svg';
+import Mailchimp from './assets/mailchimp.svg';
+import Medium from './assets/medium.svg';
+import Pintura from './assets/pintura.svg';
+import PortalIcon1 from './assets/portal-icon-1.svg';
+import PortalIcon2 from './assets/portal-icon-2.svg';
+import PortalIcon3 from './assets/portal-icon-3.svg';
+import PortalIcon4 from './assets/portal-icon-4.svg';
+import PortalIcon5 from './assets/portal-icon-5.svg';
 import React from 'react';
-import Slack from '@/settings/assets/images/brand-icons/slack.svg';
-import Squarespace from '@/settings/assets/images/brand-icons/squarespace.svg';
-import Substack from '@/settings/assets/images/brand-icons/substack.svg';
-import Transistor from '@/settings/assets/images/brand-icons/transistor.svg';
-import TwitterX from '@/settings/assets/images/brand-icons/twitter-x.svg';
-import Unsplash from '@/settings/assets/images/brand-icons/unsplash.svg';
-import Wordpress from '@/settings/assets/images/brand-icons/wordpress.svg';
-import Zapier from '@/settings/assets/images/brand-icons/zapier.svg';
+import Slack from './assets/slack.svg';
+import Squarespace from './assets/squarespace.svg';
+import Substack from './assets/substack.svg';
+import Transistor from './assets/transistor.svg';
+import TwitterX from './assets/twitter-x.svg';
+import Unsplash from './assets/unsplash.svg';
+import Wordpress from './assets/wordpress.svg';
+import Zapier from './assets/zapier.svg';
 import clsx from 'clsx';
 
 const icons = {
diff --git a/apps/admin/src/not-found.tsx b/apps/admin/src/shared/not-found.tsx
similarity index 100%
rename from apps/admin/src/not-found.tsx
rename to apps/admin/src/shared/not-found.tsx
diff --git a/apps/admin/src/tag-detail-gate.tsx b/apps/admin/src/tag-detail-gate.tsx
index 331dd77ae1d..08ae806362c 100644
--- a/apps/admin/src/tag-detail-gate.tsx
+++ b/apps/admin/src/tag-detail-gate.tsx
@@ -1,5 +1,6 @@
 import { FlagGatedRoute } from './flag-gated-route';
 import { lazy } from 'react';
+import { lazyTagDetailScreen } from './tags/api';
 
 /**
  * Serves `/tags/:tagSlug` — covering both edit (`:tagSlug`) and create (the
@@ -7,7 +8,7 @@ import { lazy } from 'react';
  * `tagDetailsReact` Labs flag is on, and from Ember otherwise. The gating
  * semantics (loading, error, and flag branching) live in FlagGatedRoute.
  */
-const TagDetailReact = lazy(() => import('./tags/detail/tag-detail'));
+const TagDetailReact = lazy(lazyTagDetailScreen);
 
 export function TagDetailGate() {
   return <FlagGatedRoute component={TagDetailReact} flag="tagDetailsReact" />;
diff --git a/apps/admin/src/tags/api.ts b/apps/admin/src/tags/api.ts
new file mode 100644
index 00000000000..fd349cf0707
--- /dev/null
+++ b/apps/admin/src/tags/api.ts
@@ -0,0 +1,11 @@
+/**
+ * Public surface of the tags domain, consumed by the admin shell
+ * (apps/admin/src/routes.tsx and the tag detail gate). Everything else in
+ * this domain is internal.
+ */
+
+// Lazy entries, not component re-exports: the shell mounts these behind
+// `lazy:`/`lazy()`, so static re-exports would pull the chunks into the
+// shell bundle.
+export const lazyTagsScreen = () => import('./tags');
+export const lazyTagDetailScreen = () => import('./detail/tag-detail');
diff --git a/apps/admin/src/tags/detail/tag-detail.tsx b/apps/admin/src/tags/detail/tag-detail.tsx
index 15d04e7ab06..8d82ad27be1 100644
--- a/apps/admin/src/tags/detail/tag-detail.tsx
+++ b/apps/admin/src/tags/detail/tag-detail.tsx
@@ -24,7 +24,7 @@ import { DetailPage } from '@tryghost/shade/page-templates';
 import { DirtyConfirmDialog, PageHeader } from '@tryghost/shade/patterns';
 import { Link, useHandleError, useNavigate, useParams } from '@tryghost/admin-x-framework';
 import { LucideIcon } from '@tryghost/shade/utils';
-import { NotFound } from '@/not-found';
+import { NotFound } from '@/shared/not-found';
 import {
   buildTagSavePayload,
   generateSlugFromName,
diff --git a/apps/admin/src/tags/detail/tag-image-field.tsx b/apps/admin/src/tags/detail/tag-image-field.tsx
index e9283880079..cabc28f1672 100644
--- a/apps/admin/src/tags/detail/tag-image-field.tsx
+++ b/apps/admin/src/tags/detail/tag-image-field.tsx
@@ -15,7 +15,7 @@ import { createPortal } from 'react-dom';
 import { getImageUrl, useUploadImage } from '@tryghost/admin-x-framework/api/images';
 import { useFramework } from '@tryghost/admin-x-framework';
 import { usePinturaEditor } from '@/hooks/use-pintura-editor';
-import BrandIcon from '@/settings/components/icons/brand-icon';
+import BrandIcon from '@/shared/brand-icon/brand-icon';
 import {
   JSONError,
   RequestEntityTooLargeError,
diff --git a/apps/admin/src/whats-new/api.ts b/apps/admin/src/whats-new/api.ts
new file mode 100644
index 00000000000..9f0f4fcffb4
--- /dev/null
+++ b/apps/admin/src/whats-new/api.ts
@@ -0,0 +1,8 @@
+/**
+ * Public surface of the whats-new domain, consumed by the admin layout
+ * (apps/admin/src/layout). Everything else in this domain is internal.
+ */
+export { default as WhatsNewBanner } from './components/whats-new-banner';
+export { default as WhatsNewDialog } from './components/whats-new-dialog';
+export { useChangelog } from './hooks/use-changelog';
+export { useWhatsNew } from './hooks/use-whats-new';
diff --git a/apps/portal/src/components/frame.styles.js b/apps/portal/src/components/frame.styles.js
index f393edda0c2..584f7530147 100644
--- a/apps/portal/src/components/frame.styles.js
+++ b/apps/portal/src/components/frame.styles.js
@@ -25,7 +25,7 @@ import { TipsAndDonationsSuccessStyle } from './pages/support-success';
 import { GiftRedemptionStyles } from './pages/gift-redemption-page';
 import { BetaGiftRedemptionStyles } from './pages/beta-gift-redemption-page';
 import { GiftPageStyles } from './pages/gift-page';
-import { BetaGiftPageStyles } from './pages/beta-gift-page';
+import { BetaGiftPageStyles } from './pages/beta-gift-page.styles';
 import { GiftSuccessStyle } from './pages/gift-success-page';
 import { BetaGiftSuccessStyle } from './pages/beta-gift-success-page';
 import { TipsAndDonationsErrorStyle } from './pages/support-error';
diff --git a/apps/portal/src/components/pages/beta-gift-page.jsx b/apps/portal/src/components/pages/beta-gift-page.styles.js
similarity index 55%
rename from apps/portal/src/components/pages/beta-gift-page.jsx
rename to apps/portal/src/components/pages/beta-gift-page.styles.js
index 375626f6a68..28696ff6d12 100644
--- a/apps/portal/src/components/pages/beta-gift-page.jsx
+++ b/apps/portal/src/components/pages/beta-gift-page.styles.js
@@ -1,32 +1,5 @@
-import { useContext, useEffect, useRef, useState } from 'react';
-import AppContext from '../../app-context';
-import CloseButton from '../common/close-button';
-import DatePicker from '../common/date-picker';
-import SiteTitleBackButton from '../common/site-title-back-button';
-import ActionButton from '../common/action-button';
-import GiftCard from '../common/gift-card';
-import GiftEmailPreview from '../common/gift-email-preview';
-import InputField from '../common/input-field';
-import LoadingPage from './loading-page';
-import CheckmarkIcon from '../../images/icons/checkmark.svg?react';
 import giftCardNoiseUrl from '../../images/gift-card-noise.webp';
 import giftCardOrbUrl from '../../images/gift-card-orb.webp';
-import { isCookiesDisabled } from '../../utils/helpers';
-import { addCalendarDays, getDateInputValue } from '../../utils/date-time';
-import {
-  getActiveGiftDuration,
-  getAvailableGiftDurations,
-  getGiftPrice,
-  getGiftProducts,
-} from '../../utils/gift-subscriptions';
-import {
-  getGiftDurationAttributiveLabel,
-  getGiftDurationLabel,
-} from '../../utils/gift-redemption-notification';
-import { ValidateInputForm } from '../../utils/form';
-import { t } from '../../utils/i18n';
-import useCardTilt from '../../utils/use-card-tilt';
-import { formatGiftValue } from './gift-page';
 
 export const BetaGiftPageStyles = `
 @property --shine-angle {
@@ -1331,681 +1304,3 @@ html[dir="rtl"] .gh-portal-content.gift .gh-portal-btn-site-title-back {
     }
 }
 `;
-
-function GiftDurationSwitch({ offeredDurations, activeDuration, setSelectedDuration }) {
-  if (offeredDurations.length < 2) {
-    return null;
-  }
-
-  return (
-    <div
-      className="gh-portal-gift-duration-switch"
-      role="radiogroup"
-      aria-label={t('Gift duration')}
-    >
-      {offeredDurations.map((months) => {
-        const isActive = months === activeDuration;
-        return (
-          <button
-            key={months}
-            type="button"
-            role="radio"
-            aria-checked={isActive}
-            data-test-button={`switch-duration-${months}`}
-            className={'gh-portal-btn' + (isActive ? ' active' : '')}
-            onClick={() => setSelectedDuration(months)}
-          >
-            {getGiftDurationLabel({ cadence: 'month', duration: months })}
-          </button>
-        );
-      })}
-    </div>
-  );
-}
-
-const GIFT_EMAIL_MAX_LENGTH = 191;
-const GIFT_NAME_MAX_LENGTH = 191;
-const GIFT_MESSAGE_MAX_LENGTH = 250;
-// Mirrors GIFT_MAX_SCHEDULE_DAYS in ghost/core's gifts constants — change
-// them together.
-const GIFT_MAX_SCHEDULE_DAYS = 365;
-
-function getTierPriceLabel(product, months) {
-  return formatGiftValue(getGiftPrice(product, months));
-}
-
-const BetaGiftPage = () => {
-  const { site, member, brandColor, action, doAction, lastPage } = useContext(AppContext);
-  const [step, setStep] = useState('plan');
-  const [selectedDuration, setSelectedDuration] = useState(null);
-  const [selectedProductId, setSelectedProductId] = useState(null);
-  const [email, setEmail] = useState('');
-  const [recipientEmail, setRecipientEmail] = useState('');
-  const [recipientName, setRecipientName] = useState('');
-  const [buyerName, setBuyerName] = useState(member?.name || '');
-  const [giftMessage, setGiftMessage] = useState('');
-  const [deliveryMethod, setDeliveryMethod] = useState('email');
-  // null means untouched: the effective date then tracks "today" in the
-  // site's timezone on every render, so an untouched form still means
-  // "send now" after the page sits open across site-midnight.
-  const [deliveryDate, setDeliveryDate] = useState(null);
-  const [errors, setErrors] = useState({});
-  const { cardRef, containerProps: cardTiltProps } = useCardTilt();
-
-  // Prefill the "from" name once the logged-in member loads, without
-  // clobbering anything the buyer has already typed
-  useEffect(() => {
-    setBuyerName((current) => current || member?.name || '');
-  }, [member?.name]);
-
-  // Anchors us to the popup's real (iframe) document for scroll control.
-  const contentRef = useRef(null);
-
-  // Moving between the plan and delivery steps swaps a full screen of content,
-  // so reset the popup scroll to the top — otherwise the buyer can land partway
-  // down the next step. Portal renders inside a react-frame-component iframe, so
-  // the global `document` here is the parent; reach the popup via the rendered
-  // node's own document instead. Depending on the embed the actual scroller is
-  // the wrapper (live portal) or the container, so reset both — and any other
-  // scrollable ancestor — since only the one that overflows will move. Deferred
-  // a frame so it runs after the browser's scroll anchoring.
-  useEffect(() => {
-    const raf = requestAnimationFrame(() => {
-      const node = contentRef.current;
-      const doc = node?.ownerDocument;
-      if (!doc) {
-        return;
-      }
-      const view = doc.defaultView;
-      doc.querySelectorAll('.gh-portal-popup-wrapper, .gh-portal-popup-container').forEach((el) => {
-        el.scrollTop = 0;
-      });
-      // Fallback: walk ancestors and reset whichever one actually scrolls.
-      for (let el = node.parentElement; el; el = el.parentElement) {
-        const overflowY = view?.getComputedStyle(el).overflowY;
-        if ((overflowY === 'auto' || overflowY === 'scroll') && el.scrollHeight > el.clientHeight) {
-          el.scrollTop = 0;
-        }
-      }
-    });
-    return () => cancelAnimationFrame(raf);
-  }, [step]);
-
-  if (!site) {
-    return <LoadingPage />;
-  }
-
-  const { portal_default_plan: portalDefaultPlan } = site;
-  const offeredDurations = getAvailableGiftDurations({ site });
-  const activeDuration = getActiveGiftDuration({
-    availableDurations: offeredDurations,
-    portalDefaultPlan,
-    selectedDuration,
-  });
-  const products = getGiftProducts({ site, duration: activeDuration });
-
-  const siteIcon = site.icon;
-  const siteTitle = site.title || '';
-  if (products.length === 0) {
-    return (
-      <>
-        <div className="gh-portal-content gift">
-          <CloseButton />
-          <div className="gh-portal-gift-checkout">
-            <div className="gh-portal-gift-checkout-left">
-              <div className="gh-portal-gift-checkout-bg" aria-hidden="true" />
-              <div className="gh-portal-gift-checkout-inner">
-                <header className="gh-portal-gift-checkout-header">
-                  <h1 className="gh-portal-main-title">{t('Gift a membership')}</h1>
-                  <p className="gh-portal-gift-checkout-subtitle">
-                    {t('Gift subscriptions are not available right now.')}
-                  </p>
-                </header>
-              </div>
-            </div>
-            <div className="gh-portal-gift-checkout-right" aria-hidden="true" />
-          </div>
-        </div>
-      </>
-    );
-  }
-
-  const activeProduct = products.find((p) => p.id === selectedProductId) || products[0];
-  const isSingleTier = products.length === 1;
-  const emailDuration =
-    activeDuration === 12
-      ? { cadence: 'year', duration: 1 }
-      : { cadence: 'month', duration: activeDuration };
-  // This use sits in front of a noun ("6 month membership"), so this is the
-  // attributive form. The picker and the gift card face use the standalone
-  // one ("6 months").
-  const activeDurationLabel = getGiftDurationAttributiveLabel(emailDuration);
-  const isPurchasing = action === 'checkoutGift:running';
-  const hasErrors =
-    step === 'plan'
-      ? !!(errors.email || errors.buyerName)
-      : !!(errors.recipientEmail || errors.deliveryDate);
-  const isDisabled = isCookiesDisabled() || isPurchasing || hasErrors;
-  const isLoggedIn = !!member;
-  const showBuyerName = !(member?.name || '').trim();
-  const showBuyerEmail = !isLoggedIn;
-  // On the delivery step the email being composed is the more useful thing to
-  // show than the gift card — it's what the recipient actually opens. The card
-  // stays for the plan step and for "I'll share it myself", where no email is
-  // sent and the card is what the buyer passes on.
-  const showEmailPreview = step === 'delivery' && deliveryMethod === 'email';
-  const minDeliveryDate = getDateInputValue(new Date(), site.timezone);
-  const maxDeliveryDate = addCalendarDays(minDeliveryDate, GIFT_MAX_SCHEDULE_DAYS);
-  const effectiveDeliveryDate = deliveryDate ?? minDeliveryDate;
-
-  const emailField = {
-    type: 'email',
-    value: email,
-    placeholder: t('jamie@example.com'),
-    label: t('Your email'),
-    name: 'email',
-    required: true,
-    maxLength: GIFT_EMAIL_MAX_LENGTH,
-    errorMessage: errors.email || '',
-  };
-
-  const recipientEmailField = {
-    type: 'email',
-    value: recipientEmail,
-    placeholder: t('taylor@example.com'),
-    label: t("Recipient's email"),
-    name: 'recipientEmail',
-    required: false,
-    maxLength: GIFT_EMAIL_MAX_LENGTH,
-    errorMessage: errors.recipientEmail || '',
-  };
-
-  const buyerNameField = {
-    type: 'text',
-    value: buyerName,
-    placeholder: t('Jamie Larson'),
-    label: t('Your name'),
-    name: 'buyerName',
-    required: false,
-    maxLength: GIFT_NAME_MAX_LENGTH,
-    errorMessage: errors.buyerName || '',
-  };
-
-  const recipientNameField = {
-    type: 'text',
-    value: recipientName,
-    placeholder: t('Taylor Reid'),
-    label: t("Recipient's name"),
-    name: 'recipientName',
-    required: false,
-    maxLength: GIFT_NAME_MAX_LENGTH,
-    errorMessage: '',
-  };
-
-  const handleEmailChange = (event) => {
-    setErrors((currentErrors) => ({
-      ...currentErrors,
-      email: '',
-    }));
-    setEmail(event.target.value);
-  };
-
-  const handleRecipientEmailChange = (event) => {
-    setErrors((currentErrors) => ({
-      ...currentErrors,
-      recipientEmail: '',
-      deliveryDate: '',
-    }));
-    setRecipientEmail(event.target.value);
-  };
-
-  const handleDeliveryMethodChange = (method) => {
-    setErrors((currentErrors) => ({
-      ...currentErrors,
-      recipientEmail: '',
-      deliveryDate: '',
-    }));
-    setDeliveryMethod(method);
-  };
-
-  const handleDeliveryDateChange = (nextDate) => {
-    setErrors((currentErrors) => ({
-      ...currentErrors,
-      deliveryDate: '',
-    }));
-    // Store today as null so "send now" keeps tracking the site day across
-    // midnight; a typed past date stays put for validation to call out.
-    setDeliveryDate(nextDate === minDeliveryDate ? null : nextDate);
-  };
-
-  const handleContinueToDelivery = (e) => {
-    e.preventDefault();
-    if (!isLoggedIn) {
-      const formErrors = ValidateInputForm({ fields: [{ ...emailField, value: email.trim() }] });
-      const formHasErrors = Object.values(formErrors).some((errorMessage) => !!errorMessage);
-
-      setErrors(formErrors);
-
-      if (formHasErrors) {
-        return;
-      }
-    }
-    setStep('delivery');
-  };
-
-  const handleBackToPlan = () => {
-    setErrors({});
-    setStep('plan');
-  };
-
-  const handlePurchase = (e) => {
-    e.preventDefault();
-
-    if (isPurchasing) {
-      return;
-    }
-
-    const customerEmail = email.trim();
-    const trimmedRecipientEmail = recipientEmail.trim();
-    const trimmedRecipientName = recipientName.trim();
-    const trimmedBuyerName = buyerName.trim();
-    const trimmedGiftMessage = giftMessage.trim();
-    const isEmailDelivery = deliveryMethod === 'email';
-    const isScheduled = isEmailDelivery && effectiveDeliveryDate > minDeliveryDate;
-
-    const fieldsToValidate = [];
-    if (!isLoggedIn) {
-      fieldsToValidate.push({ ...emailField, value: customerEmail });
-    }
-    if (isEmailDelivery && trimmedRecipientEmail) {
-      fieldsToValidate.push({ ...recipientEmailField, value: trimmedRecipientEmail });
-    }
-
-    const formErrors = ValidateInputForm({ fields: fieldsToValidate });
-
-    if (isEmailDelivery && !trimmedBuyerName) {
-      formErrors.buyerName = t('Enter your name');
-    }
-
-    // No confirm-email field: the buyer gets a confirmation copy, which
-    // covers the (unlikely) mistyped-recipient case.
-    if (isEmailDelivery && !trimmedRecipientEmail) {
-      formErrors.recipientEmail = t("Enter the recipient's email address");
-    }
-
-    if (isEmailDelivery) {
-      if (!effectiveDeliveryDate) {
-        formErrors.deliveryDate = t('Choose a delivery date');
-      } else if (effectiveDeliveryDate < minDeliveryDate) {
-        formErrors.deliveryDate = t('Choose a date from today onwards');
-      } else if (effectiveDeliveryDate > maxDeliveryDate) {
-        formErrors.deliveryDate = t('Choose a date within the next year');
-      }
-    }
-
-    const formHasErrors = Object.values(formErrors).some((errorMessage) => !!errorMessage);
-
-    setErrors(formErrors);
-
-    if (formHasErrors) {
-      if (formErrors.buyerName) {
-        setStep('plan');
-      }
-      return;
-    }
-
-    doAction('checkoutGift', {
-      tierId: activeProduct.id,
-      duration: activeDuration,
-      ...(!isLoggedIn ? { email: customerEmail } : {}),
-      deliveryMethod,
-      ...(isEmailDelivery ? { recipientEmail: trimmedRecipientEmail } : {}),
-      ...(isEmailDelivery && trimmedRecipientName ? { recipientName: trimmedRecipientName } : {}),
-      ...(trimmedBuyerName ? { buyerName: trimmedBuyerName } : {}),
-      ...(isEmailDelivery && trimmedGiftMessage ? { personalMessage: trimmedGiftMessage } : {}),
-      ...(isScheduled ? { deliveryDate: effectiveDeliveryDate } : {}),
-    });
-  };
-
-  return (
-    <>
-      <div className="gh-portal-content gift" ref={contentRef}>
-        <CloseButton />
-        <div className="gh-portal-gift-checkout">
-          <div className="gh-portal-gift-checkout-left" data-step={step}>
-            <div className="gh-portal-gift-checkout-bg" aria-hidden="true" />
-            {/* One back button in the corner for both jobs, as the
-                            other Portal modals do it: on the delivery step it
-                            steps back to the plan, on the plan step it leaves
-                            the gift page — but only when there's somewhere to
-                            go back to. It lives inside the left column so that
-                            when the layout stacks it stays with the form rather
-                            than landing on the brand panel above. */}
-            {(step === 'delivery' || lastPage) && (
-              <SiteTitleBackButton
-                onBack={() => (step === 'delivery' ? handleBackToPlan() : doAction('back'))}
-              />
-            )}
-            <div className="gh-portal-gift-checkout-inner">
-              {/* Only the plan step is titled. The delivery step's
-                                fields are self-describing, and the back button
-                                already says where you are. */}
-              {step === 'plan' && (
-                <header className="gh-portal-gift-checkout-header">
-                  <h1 className="gh-portal-main-title">{t('Gift a membership')}</h1>
-                  <p className="gh-portal-gift-checkout-subtitle">
-                    {t('Share a full membership to {siteTitle} with a friend or colleague', {
-                      siteTitle,
-                    })}
-                  </p>
-                </header>
-              )}
-
-              {step === 'plan' && (showBuyerName || showBuyerEmail) && (
-                <div className="gh-portal-gift-checkout-section">
-                  {showBuyerName && (
-                    <InputField
-                      {...buyerNameField}
-                      onChange={(event) => {
-                        setErrors((currentErrors) => ({ ...currentErrors, buyerName: '' }));
-                        setBuyerName(event.target.value);
-                      }}
-                    />
-                  )}
-                  {showBuyerEmail && <InputField {...emailField} onChange={handleEmailChange} />}
-                </div>
-              )}
-
-              {step === 'plan' && (
-                <div className="gh-portal-gift-checkout-section">
-                  <div className="gh-portal-gift-checkout-label">
-                    {isSingleTier ? t('Membership details') : t('Tier')}
-                  </div>
-                  {offeredDurations.length > 1 ? (
-                    <GiftDurationSwitch
-                      offeredDurations={offeredDurations}
-                      activeDuration={activeDuration}
-                      setSelectedDuration={setSelectedDuration}
-                    />
-                  ) : (
-                    <div
-                      className="gh-portal-gift-checkout-single-duration"
-                      data-test-single-duration
-                    >
-                      {t('{duration} membership', { duration: activeDurationLabel })}
-                    </div>
-                  )}
-                </div>
-              )}
-
-              {step === 'plan' && (
-                <div className="gh-portal-gift-checkout-section">
-                  <div
-                    className={'gh-portal-gift-checkout-tiers' + (isSingleTier ? ' single' : '')}
-                    role={isSingleTier ? undefined : 'radiogroup'}
-                    aria-label={isSingleTier ? undefined : t('Choose a tier')}
-                  >
-                    {products.map((product) => {
-                      const isSelected = product.id === activeProduct.id;
-                      const benefits = product.benefits || [];
-                      return (
-                        <div
-                          key={product.id}
-                          className={
-                            'gh-portal-gift-checkout-tier-item' +
-                            (isSelected && !isSingleTier ? ' selected' : '')
-                          }
-                        >
-                          <button
-                            type="button"
-                            role={isSingleTier ? undefined : 'radio'}
-                            aria-checked={isSingleTier ? undefined : isSelected}
-                            className="gh-portal-gift-checkout-tier"
-                            onClick={() => setSelectedProductId(product.id)}
-                            data-test-tier={product.name}
-                          >
-                            {!isSingleTier && (
-                              <span
-                                className="gh-portal-gift-checkout-tier-radio"
-                                aria-hidden="true"
-                              />
-                            )}
-                            <div className="gh-portal-gift-checkout-tier-content">
-                              <div className="gh-portal-gift-checkout-tier-heading">
-                                <span className="gh-portal-gift-checkout-tier-name">
-                                  {product.name}
-                                </span>
-                                <span className="gh-portal-gift-checkout-tier-price">
-                                  {getTierPriceLabel(product, activeDuration)}
-                                </span>
-                              </div>
-                              {product.description && (
-                                <p className="gh-portal-gift-checkout-tier-description">
-                                  {product.description}
-                                </p>
-                              )}
-                            </div>
-                          </button>
-                          {benefits.length > 0 && (
-                            <div
-                              className="gh-portal-gift-checkout-tier-benefits"
-                              data-open={isSelected}
-                              aria-hidden={!isSelected}
-                            >
-                              <div className="gh-portal-gift-checkout-tier-benefits-inner">
-                                <div className="gh-portal-gift-checkout-benefits">
-                                  {benefits.map((benefit, idx) => {
-                                    const key = benefit?.id || `benefit-${idx}`;
-                                    return (
-                                      <div className="gh-portal-gift-checkout-benefit" key={key}>
-                                        <CheckmarkIcon aria-hidden="true" focusable="false" />
-                                        <span>{benefit.name}</span>
-                                      </div>
-                                    );
-                                  })}
-                                </div>
-                              </div>
-                            </div>
-                          )}
-                        </div>
-                      );
-                    })}
-                  </div>
-                </div>
-              )}
-
-              {step === 'delivery' && (
-                <>
-                  <div className="gh-portal-gift-checkout-section">
-                    {/* Same voice and spacing as every other field label on the
-                                        form — the toggle is just this label's input. */}
-                    <div className="gh-portal-gift-checkout-label">
-                      {t('How would you like to share this gift?')}
-                    </div>
-                    <div
-                      className="gh-portal-gift-duration-switch"
-                      role="radiogroup"
-                      aria-label={t('Delivery method')}
-                    >
-                      <button
-                        type="button"
-                        role="radio"
-                        aria-checked={deliveryMethod === 'email'}
-                        data-test-button="delivery-method-email"
-                        className={'gh-portal-btn' + (deliveryMethod === 'email' ? ' active' : '')}
-                        onClick={() => handleDeliveryMethodChange('email')}
-                      >
-                        {t('Email it to them')}
-                      </button>
-                      <button
-                        type="button"
-                        role="radio"
-                        aria-checked={deliveryMethod === 'link'}
-                        data-test-button="delivery-method-link"
-                        className={'gh-portal-btn' + (deliveryMethod === 'link' ? ' active' : '')}
-                        onClick={() => handleDeliveryMethodChange('link')}
-                      >
-                        {t("I'll share it myself")}
-                      </button>
-                    </div>
-                  </div>
-
-                  <div
-                    aria-hidden={deliveryMethod !== 'email'}
-                    className="gh-portal-gift-checkout-reveal"
-                    data-open={deliveryMethod === 'email'}
-                  >
-                    <div className="gh-portal-gift-checkout-reveal-inner">
-                      <div className="gh-portal-gift-checkout-section">
-                        <InputField
-                          {...recipientNameField}
-                          onChange={(event) => setRecipientName(event.target.value)}
-                        />
-                        <InputField
-                          {...recipientEmailField}
-                          onChange={handleRecipientEmailChange}
-                        />
-                        {/* Part of the recipient's details rather than a
-                                            section of its own, so it takes InputField's
-                                            label markup to sit flush with the fields above. */}
-                        <div className="gh-portal-input-labelcontainer">
-                          <label className="gh-portal-input-label" htmlFor="gift-message">
-                            {t('Optional message')}
-                          </label>
-                        </div>
-                        <textarea
-                          id="gift-message"
-                          data-test-input="gift-message"
-                          className="gh-portal-input gh-portal-gift-checkout-textarea"
-                          placeholder={t('Add a short note to go with your gift')}
-                          maxLength={GIFT_MESSAGE_MAX_LENGTH}
-                          value={giftMessage}
-                          onChange={(event) => setGiftMessage(event.target.value)}
-                        />
-                        <div
-                          aria-hidden={giftMessage.length === 0}
-                          className="gh-portal-gift-checkout-reveal"
-                          data-open={giftMessage.length > 0}
-                        >
-                          <div className="gh-portal-gift-checkout-reveal-inner">
-                            <p className="gh-portal-gift-checkout-message-count">
-                              {giftMessage.length}/{GIFT_MESSAGE_MAX_LENGTH}
-                            </p>
-                          </div>
-                        </div>
-                        <div className="gh-portal-gift-checkout-delivery-date">
-                          <div className="gh-portal-input-labelcontainer">
-                            <label className="gh-portal-input-label" htmlFor="gift-delivery-date">
-                              {t('Delivery date')}
-                            </label>
-                          </div>
-                          <DatePicker
-                            ariaLabel={t('Delivery date')}
-                            hasError={!!errors.deliveryDate}
-                            id="gift-delivery-date"
-                            max={maxDeliveryDate}
-                            min={minDeliveryDate}
-                            minLabel={t('Now')}
-                            value={effectiveDeliveryDate}
-                            onChange={handleDeliveryDateChange}
-                          />
-                          {errors.deliveryDate && (
-                            <p className="gh-portal-gift-checkout-delivery-error">
-                              {errors.deliveryDate}
-                            </p>
-                          )}
-                        </div>
-                      </div>
-                    </div>
-                  </div>
-                </>
-              )}
-
-              <div className="gh-portal-gift-checkout-cta-wrapper">
-                {step === 'plan' ? (
-                  <ActionButton
-                    dataTestId="gift-continue"
-                    label={t('Continue to delivery details')}
-                    onClick={handleContinueToDelivery}
-                    disabled={isDisabled}
-                    brandColor={brandColor}
-                    classes="gh-portal-gift-checkout-cta"
-                    style={{ width: '100%' }}
-                  />
-                ) : (
-                  <ActionButton
-                    dataTestId="purchase-gift"
-                    label={t('Continue to payment')}
-                    onClick={handlePurchase}
-                    disabled={isDisabled}
-                    isRunning={isPurchasing}
-                    brandColor={brandColor}
-                    classes="gh-portal-gift-checkout-cta"
-                    style={{ width: '100%' }}
-                  />
-                )}
-              </div>
-            </div>
-          </div>
-
-          <div className="gh-portal-gift-checkout-right" {...cardTiltProps}>
-            <div className="gh-portal-gift-checkout-right-panel">
-              {/* Both representations stay mounted and share a single
-                                grid cell, so switching between them cross-dissolves
-                                instead of unmounting one and popping the other in.
-                                The outgoing side recedes and blurs slightly while
-                                the incoming side advances — the blur bridges the
-                                visual gap between two quite different pictures. */}
-              <div className="gh-portal-gift-checkout-stage">
-                <div
-                  aria-hidden={showEmailPreview}
-                  className="gh-portal-gift-checkout-stage-item card"
-                  data-active={!showEmailPreview}
-                >
-                  <div className="gh-portal-gift-checkout-card-stack">
-                    <GiftCard
-                      cardRef={cardRef}
-                      duration={getGiftDurationLabel({
-                        cadence: 'month',
-                        duration: activeDuration,
-                      })}
-                      tierName={activeProduct.name}
-                      fromName={buyerName.trim()}
-                      giftValue={getTierPriceLabel(activeProduct, activeDuration)}
-                      siteIcon={siteIcon}
-                      siteTitle={siteTitle}
-                    />
-                  </div>
-                </div>
-                <div
-                  aria-hidden={!showEmailPreview}
-                  className="gh-portal-gift-checkout-stage-item email"
-                  data-active={showEmailPreview}
-                >
-                  <div className="gh-portal-gift-checkout-email-stack">
-                    <GiftEmailPreview
-                      benefits={activeProduct.benefits || []}
-                      buyerName={buyerName}
-                      cadence={emailDuration.cadence}
-                      duration={emailDuration.duration}
-                      deliveryDate={effectiveDeliveryDate}
-                      isScheduled={effectiveDeliveryDate > minDeliveryDate}
-                      giftMessage={giftMessage}
-                      recipientEmail={recipientEmail}
-                      recipientName={recipientName}
-                      siteIcon={siteIcon}
-                      siteTitle={siteTitle}
-                      tierName={activeProduct.name}
-                    />
-                  </div>
-                </div>
-              </div>
-            </div>
-          </div>
-        </div>
-      </div>
-    </>
-  );
-};
-
-export default BetaGiftPage;
diff --git a/apps/portal/src/components/pages/beta-gift-page.tsx b/apps/portal/src/components/pages/beta-gift-page.tsx
new file mode 100644
index 00000000000..131e42e4788
--- /dev/null
+++ b/apps/portal/src/components/pages/beta-gift-page.tsx
@@ -0,0 +1,441 @@
+import { useContext, useEffect, useRef, useState } from 'react';
+import AppContext from '../../app-context';
+import ActionButton from '../common/action-button';
+import CloseButton from '../common/close-button';
+import SiteTitleBackButton from '../common/site-title-back-button';
+import LoadingPage from './loading-page';
+import { isCookiesDisabled } from '../../utils/helpers';
+import { addCalendarDays, getDateInputValue } from '../../utils/date-time';
+import {
+  type GiftDuration,
+  type GiftProduct,
+  type Site,
+  getActiveGiftDuration,
+  getAvailableGiftDurations,
+  getGiftPrice,
+  getGiftProducts,
+} from '../../utils/gift-subscriptions';
+import { getGiftDurationAttributiveLabel } from '../../utils/gift-redemption-notification';
+import { ValidateInputForm } from '../../utils/form';
+import { t } from '../../utils/i18n';
+import useCardTilt from '../../utils/use-card-tilt';
+import { formatGiftValue } from './gift-page';
+import GiftDeliveryStep from './beta-gift/delivery-step';
+import GiftPlanStep from './beta-gift/plan-step';
+import GiftPreviewPanel from './beta-gift/preview-panel';
+import type {
+  GiftDeliveryMethod,
+  GiftCadenceDuration,
+  GiftFormErrors,
+  GiftInputField,
+  GiftStep,
+} from './beta-gift/types';
+
+const validateInputForm = ValidateInputForm as unknown as (data: {
+  fields: GiftInputField[];
+}) => GiftFormErrors;
+
+const GIFT_EMAIL_MAX_LENGTH = 191;
+const GIFT_NAME_MAX_LENGTH = 191;
+const GIFT_MESSAGE_MAX_LENGTH = 250;
+// Mirrors GIFT_MAX_SCHEDULE_DAYS in ghost/core's gifts constants — change them together.
+const GIFT_MAX_SCHEDULE_DAYS = 365;
+
+interface GiftPageMember {
+  name?: string;
+}
+
+interface GiftPageContext {
+  action: string;
+  brandColor: string | undefined;
+  doAction: (action: string, data?: Record<string, unknown>) => void;
+  lastPage: string | null;
+  member: GiftPageMember | null;
+  site: Site | null;
+}
+
+function getTierPriceLabel(product: GiftProduct, months: GiftDuration) {
+  return formatGiftValue(getGiftPrice(product, months));
+}
+
+const BetaGiftPage = () => {
+  const { site, member, brandColor, action, doAction, lastPage } = useContext(
+    AppContext,
+  ) as GiftPageContext;
+  const [step, setStep] = useState<GiftStep>('plan');
+  const [selectedDuration, setSelectedDuration] = useState<GiftDuration | null>(null);
+  const [selectedProductId, setSelectedProductId] = useState<string | null>(null);
+  const [email, setEmail] = useState('');
+  const [recipientEmail, setRecipientEmail] = useState('');
+  const [recipientName, setRecipientName] = useState('');
+  const [buyerName, setBuyerName] = useState(member?.name || '');
+  const [giftMessage, setGiftMessage] = useState('');
+  const [deliveryMethod, setDeliveryMethod] = useState<GiftDeliveryMethod>('email');
+  // null means untouched: the effective date then tracks "today" in the site's timezone on every
+  // render, so an untouched form still means "send now" after the page sits open across midnight.
+  const [deliveryDate, setDeliveryDate] = useState<string | null>(null);
+  const [errors, setErrors] = useState<GiftFormErrors>({});
+  const { cardRef, containerProps: cardTiltProps } = useCardTilt();
+
+  // Prefill the "from" name once the logged-in member loads, without clobbering anything the buyer
+  // has already typed.
+  useEffect(() => {
+    setBuyerName((current) => current || member?.name || '');
+  }, [member?.name]);
+
+  // Anchors us to the popup's real (iframe) document for scroll control.
+  const contentRef = useRef<HTMLDivElement>(null);
+
+  // Moving between the plan and delivery steps swaps a full screen of content, so reset the popup
+  // scroll to the top. Portal renders inside a react-frame-component iframe, so the global document
+  // here is the parent; reach the popup via the rendered node's own document instead.
+  useEffect(() => {
+    const raf = requestAnimationFrame(() => {
+      const node = contentRef.current;
+      const doc = node?.ownerDocument;
+      if (!doc) {
+        return;
+      }
+      const view = doc.defaultView;
+      doc
+        .querySelectorAll<HTMLElement>('.gh-portal-popup-wrapper, .gh-portal-popup-container')
+        .forEach((element) => {
+          element.scrollTop = 0;
+        });
+      // Fallback: walk ancestors and reset whichever one actually scrolls.
+      for (let element = node.parentElement; element; element = element.parentElement) {
+        const overflowY = view?.getComputedStyle(element).overflowY;
+        if (
+          (overflowY === 'auto' || overflowY === 'scroll') &&
+          element.scrollHeight > element.clientHeight
+        ) {
+          element.scrollTop = 0;
+        }
+      }
+    });
+    return () => cancelAnimationFrame(raf);
+  }, [step]);
+
+  if (!site) {
+    return <LoadingPage />;
+  }
+
+  const { portal_default_plan: portalDefaultPlan } = site;
+  const offeredDurations = getAvailableGiftDurations({ site });
+  const activeDuration = getActiveGiftDuration({
+    availableDurations: offeredDurations,
+    portalDefaultPlan: portalDefaultPlan ?? null,
+    selectedDuration,
+  });
+  const products = activeDuration ? getGiftProducts({ site, duration: activeDuration }) : [];
+
+  const siteIcon = site.icon;
+  const siteTitle = site.title || '';
+  if (!activeDuration || products.length === 0) {
+    return (
+      <div className="gh-portal-content gift">
+        <CloseButton />
+        <div className="gh-portal-gift-checkout">
+          <div className="gh-portal-gift-checkout-left">
+            <div aria-hidden="true" className="gh-portal-gift-checkout-bg" />
+            <div className="gh-portal-gift-checkout-inner">
+              <header className="gh-portal-gift-checkout-header">
+                <h1 className="gh-portal-main-title">{t('Gift a membership')}</h1>
+                <p className="gh-portal-gift-checkout-subtitle">
+                  {t('Gift subscriptions are not available right now.')}
+                </p>
+              </header>
+            </div>
+          </div>
+          <div aria-hidden="true" className="gh-portal-gift-checkout-right" />
+        </div>
+      </div>
+    );
+  }
+
+  const activeProduct = products.find((product) => product.id === selectedProductId) || products[0];
+  if (!activeProduct) {
+    return null;
+  }
+
+  const isSingleTier = products.length === 1;
+  const emailDuration: GiftCadenceDuration =
+    activeDuration === 12
+      ? { cadence: 'year', duration: 1 }
+      : { cadence: 'month', duration: activeDuration };
+  // This use sits in front of a noun ("6 month membership"), so this is the attributive form. The
+  // picker and the gift card face use the standalone one ("6 months").
+  const activeDurationLabel = getGiftDurationAttributiveLabel(emailDuration);
+  const isPurchasing = action === 'checkoutGift:running';
+  const hasErrors =
+    step === 'plan'
+      ? !!(errors.email || errors.buyerName)
+      : !!(errors.recipientEmail || errors.deliveryDate);
+  const isDisabled = isCookiesDisabled() || isPurchasing || hasErrors;
+  const isLoggedIn = !!member;
+  const showBuyerName = !(member?.name || '').trim();
+  const showBuyerEmail = !isLoggedIn;
+  // On the delivery step the email being composed is the more useful thing to show than the gift
+  // card. The card stays for the plan step and for "I'll share it myself".
+  const showEmailPreview = step === 'delivery' && deliveryMethod === 'email';
+  const minDeliveryDate = getDateInputValue(new Date(), site.timezone);
+  const maxDeliveryDate = addCalendarDays(minDeliveryDate, GIFT_MAX_SCHEDULE_DAYS);
+  const effectiveDeliveryDate = deliveryDate ?? minDeliveryDate;
+
+  const emailField: GiftInputField = {
+    type: 'email',
+    value: email,
+    placeholder: t('jamie@example.com'),
+    label: t('Your email'),
+    name: 'email',
+    required: true,
+    maxLength: GIFT_EMAIL_MAX_LENGTH,
+    errorMessage: errors.email || '',
+  };
+
+  const recipientEmailField: GiftInputField = {
+    type: 'email',
+    value: recipientEmail,
+    placeholder: t('taylor@example.com'),
+    label: t("Recipient's email"),
+    name: 'recipientEmail',
+    required: false,
+    maxLength: GIFT_EMAIL_MAX_LENGTH,
+    errorMessage: errors.recipientEmail || '',
+  };
+
+  const buyerNameField: GiftInputField = {
+    type: 'text',
+    value: buyerName,
+    placeholder: t('Jamie Larson'),
+    label: t('Your name'),
+    name: 'buyerName',
+    required: false,
+    maxLength: GIFT_NAME_MAX_LENGTH,
+    errorMessage: errors.buyerName || '',
+  };
+
+  const recipientNameField: GiftInputField = {
+    type: 'text',
+    value: recipientName,
+    placeholder: t('Taylor Reid'),
+    label: t("Recipient's name"),
+    name: 'recipientName',
+    required: false,
+    maxLength: GIFT_NAME_MAX_LENGTH,
+    errorMessage: '',
+  };
+
+  const handleEmailChange = (value: string) => {
+    setErrors((currentErrors) => ({ ...currentErrors, email: '' }));
+    setEmail(value);
+  };
+
+  const handleBuyerNameChange = (value: string) => {
+    setErrors((currentErrors) => ({ ...currentErrors, buyerName: '' }));
+    setBuyerName(value);
+  };
+
+  const handleRecipientEmailChange = (value: string) => {
+    setErrors((currentErrors) => ({
+      ...currentErrors,
+      recipientEmail: '',
+      deliveryDate: '',
+    }));
+    setRecipientEmail(value);
+  };
+
+  const handleDeliveryMethodChange = (method: GiftDeliveryMethod) => {
+    setErrors((currentErrors) => ({
+      ...currentErrors,
+      recipientEmail: '',
+      deliveryDate: '',
+    }));
+    setDeliveryMethod(method);
+  };
+
+  const handleDeliveryDateChange = (nextDate: string) => {
+    setErrors((currentErrors) => ({ ...currentErrors, deliveryDate: '' }));
+    // Store today as null so "send now" keeps tracking the site day across midnight; a typed past
+    // date stays put for validation to call out.
+    setDeliveryDate(nextDate === minDeliveryDate ? null : nextDate);
+  };
+
+  const handleContinueToDelivery = () => {
+    if (!isLoggedIn) {
+      const formErrors = validateInputForm({
+        fields: [{ ...emailField, value: email.trim() }],
+      });
+      const formHasErrors = Object.values(formErrors).some((errorMessage) => !!errorMessage);
+
+      setErrors(formErrors);
+
+      if (formHasErrors) {
+        return;
+      }
+    }
+    setStep('delivery');
+  };
+
+  const handleBackToPlan = () => {
+    setErrors({});
+    setStep('plan');
+  };
+
+  const handlePurchase = () => {
+    if (isPurchasing) {
+      return;
+    }
+
+    const customerEmail = email.trim();
+    const trimmedRecipientEmail = recipientEmail.trim();
+    const trimmedRecipientName = recipientName.trim();
+    const trimmedBuyerName = buyerName.trim();
+    const trimmedGiftMessage = giftMessage.trim();
+    const isEmailDelivery = deliveryMethod === 'email';
+    const isScheduled = isEmailDelivery && effectiveDeliveryDate > minDeliveryDate;
+
+    const fieldsToValidate: GiftInputField[] = [];
+    if (!isLoggedIn) {
+      fieldsToValidate.push({ ...emailField, value: customerEmail });
+    }
+    if (isEmailDelivery && trimmedRecipientEmail) {
+      fieldsToValidate.push({ ...recipientEmailField, value: trimmedRecipientEmail });
+    }
+
+    const formErrors = validateInputForm({ fields: fieldsToValidate });
+
+    if (isEmailDelivery && !trimmedBuyerName) {
+      formErrors.buyerName = t('Enter your name');
+    }
+
+    // No confirm-email field: the buyer gets a confirmation copy, which covers the unlikely
+    // mistyped-recipient case.
+    if (isEmailDelivery && !trimmedRecipientEmail) {
+      formErrors.recipientEmail = t("Enter the recipient's email address");
+    }
+
+    if (isEmailDelivery) {
+      if (!effectiveDeliveryDate) {
+        formErrors.deliveryDate = t('Choose a delivery date');
+      } else if (effectiveDeliveryDate < minDeliveryDate) {
+        formErrors.deliveryDate = t('Choose a date from today onwards');
+      } else if (effectiveDeliveryDate > maxDeliveryDate) {
+        formErrors.deliveryDate = t('Choose a date within the next year');
+      }
+    }
+
+    const formHasErrors = Object.values(formErrors).some((errorMessage) => !!errorMessage);
+
+    setErrors(formErrors);
+
+    if (formHasErrors) {
+      if (formErrors.buyerName) {
+        setStep('plan');
+      }
+      return;
+    }
+
+    doAction('checkoutGift', {
+      tierId: activeProduct.id,
+      duration: activeDuration,
+      ...(!isLoggedIn ? { email: customerEmail } : {}),
+      deliveryMethod,
+      ...(isEmailDelivery ? { recipientEmail: trimmedRecipientEmail } : {}),
+      ...(isEmailDelivery && trimmedRecipientName ? { recipientName: trimmedRecipientName } : {}),
+      ...(trimmedBuyerName ? { buyerName: trimmedBuyerName } : {}),
+      ...(isEmailDelivery && trimmedGiftMessage ? { personalMessage: trimmedGiftMessage } : {}),
+      ...(isScheduled ? { deliveryDate: effectiveDeliveryDate } : {}),
+    });
+  };
+
+  return (
+    <div ref={contentRef} className="gh-portal-content gift">
+      <CloseButton />
+      <div className="gh-portal-gift-checkout">
+        <div className="gh-portal-gift-checkout-left" data-step={step}>
+          <div aria-hidden="true" className="gh-portal-gift-checkout-bg" />
+          {/* One back button in the corner for both jobs, as the other Portal modals do it. */}
+          {(step === 'delivery' || lastPage) && (
+            <SiteTitleBackButton
+              onBack={() => (step === 'delivery' ? handleBackToPlan() : doAction('back'))}
+            />
+          )}
+          <div className="gh-portal-gift-checkout-inner">
+            {step === 'plan' ? (
+              <GiftPlanStep
+                activeDuration={activeDuration}
+                activeDurationLabel={activeDurationLabel}
+                activeProduct={activeProduct}
+                buyerEmailField={emailField}
+                buyerNameField={buyerNameField}
+                isSingleTier={isSingleTier}
+                offeredDurations={offeredDurations}
+                products={products}
+                showBuyerEmail={showBuyerEmail}
+                showBuyerName={showBuyerName}
+                siteTitle={siteTitle}
+                tierPriceLabel={getTierPriceLabel}
+                onBuyerEmailChange={handleEmailChange}
+                onBuyerNameChange={handleBuyerNameChange}
+                onSelectDuration={setSelectedDuration}
+                onSelectProduct={setSelectedProductId}
+              />
+            ) : (
+              <GiftDeliveryStep
+                deliveryDateError={errors.deliveryDate || ''}
+                deliveryMethod={deliveryMethod}
+                effectiveDeliveryDate={effectiveDeliveryDate}
+                giftMessage={giftMessage}
+                maxDeliveryDate={maxDeliveryDate}
+                maxMessageLength={GIFT_MESSAGE_MAX_LENGTH}
+                minDeliveryDate={minDeliveryDate}
+                recipientEmailField={recipientEmailField}
+                recipientNameField={recipientNameField}
+                onChangeDeliveryDate={handleDeliveryDateChange}
+                onChangeDeliveryMethod={handleDeliveryMethodChange}
+                onChangeGiftMessage={setGiftMessage}
+                onChangeRecipientEmail={handleRecipientEmailChange}
+                onChangeRecipientName={setRecipientName}
+              />
+            )}
+            <div className="gh-portal-gift-checkout-cta-wrapper">
+              <ActionButton
+                brandColor={brandColor}
+                classes="gh-portal-gift-checkout-cta"
+                dataTestId={step === 'plan' ? 'gift-continue' : 'purchase-gift'}
+                disabled={isDisabled}
+                isRunning={step === 'delivery' && isPurchasing}
+                label={
+                  step === 'plan' ? t('Continue to delivery details') : t('Continue to payment')
+                }
+                style={{ width: '100%' }}
+                onClick={step === 'plan' ? handleContinueToDelivery : handlePurchase}
+              />
+            </div>
+          </div>
+        </div>
+
+        <GiftPreviewPanel
+          activeDuration={activeDuration}
+          activeProduct={activeProduct}
+          buyerName={buyerName}
+          cardRef={cardRef}
+          cardTiltProps={cardTiltProps}
+          effectiveDeliveryDate={effectiveDeliveryDate}
+          emailDuration={emailDuration}
+          giftMessage={giftMessage}
+          giftValue={getTierPriceLabel(activeProduct, activeDuration)}
+          minDeliveryDate={minDeliveryDate}
+          recipientEmail={recipientEmail}
+          recipientName={recipientName}
+          showEmailPreview={showEmailPreview}
+          siteIcon={siteIcon}
+          siteTitle={siteTitle}
+        />
+      </div>
+    </div>
+  );
+};
+
+export default BetaGiftPage;
diff --git a/apps/portal/src/components/pages/beta-gift/delivery-step.tsx b/apps/portal/src/components/pages/beta-gift/delivery-step.tsx
new file mode 100644
index 00000000000..b20e8a6147c
--- /dev/null
+++ b/apps/portal/src/components/pages/beta-gift/delivery-step.tsx
@@ -0,0 +1,167 @@
+import type { ChangeEvent } from 'react';
+import DatePicker from '../../common/date-picker';
+import InputField from '../../common/input-field';
+import { t } from '../../../utils/i18n';
+import type { GiftDeliveryMethod, GiftInputField } from './types';
+
+interface TypedDatePickerProps {
+  ariaLabel: string;
+  hasError: boolean;
+  id: string;
+  max: string;
+  min: string;
+  minLabel: string;
+  onChange: (value: string) => void;
+  value: string;
+}
+
+type TypedInputFieldProps = GiftInputField & {
+  onChange: (event: ChangeEvent<HTMLInputElement>) => void;
+};
+
+const TypedDatePicker = DatePicker as unknown as (props: TypedDatePickerProps) => JSX.Element;
+const TypedInputField = InputField as unknown as (props: TypedInputFieldProps) => JSX.Element;
+
+interface GiftDeliveryStepProps {
+  deliveryDateError: string;
+  deliveryMethod: GiftDeliveryMethod;
+  effectiveDeliveryDate: string;
+  giftMessage: string;
+  maxDeliveryDate: string;
+  maxMessageLength: number;
+  minDeliveryDate: string;
+  onChangeDeliveryDate: (value: string) => void;
+  onChangeDeliveryMethod: (method: GiftDeliveryMethod) => void;
+  onChangeGiftMessage: (value: string) => void;
+  onChangeRecipientEmail: (value: string) => void;
+  onChangeRecipientName: (value: string) => void;
+  recipientEmailField: GiftInputField;
+  recipientNameField: GiftInputField;
+}
+
+function GiftDeliveryStep({
+  deliveryDateError,
+  deliveryMethod,
+  effectiveDeliveryDate,
+  giftMessage,
+  maxDeliveryDate,
+  maxMessageLength,
+  minDeliveryDate,
+  onChangeDeliveryDate,
+  onChangeDeliveryMethod,
+  onChangeGiftMessage,
+  onChangeRecipientEmail,
+  onChangeRecipientName,
+  recipientEmailField,
+  recipientNameField,
+}: GiftDeliveryStepProps) {
+  return (
+    <>
+      <div className="gh-portal-gift-checkout-section">
+        {/* Same voice and spacing as every other field label on the form — the toggle is just
+        this label's input. */}
+        <div className="gh-portal-gift-checkout-label">
+          {t('How would you like to share this gift?')}
+        </div>
+        <div
+          aria-label={t('Delivery method')}
+          className="gh-portal-gift-duration-switch"
+          role="radiogroup"
+        >
+          <button
+            aria-checked={deliveryMethod === 'email'}
+            className={'gh-portal-btn' + (deliveryMethod === 'email' ? ' active' : '')}
+            data-test-button="delivery-method-email"
+            role="radio"
+            type="button"
+            onClick={() => onChangeDeliveryMethod('email')}
+          >
+            {t('Email it to them')}
+          </button>
+          <button
+            aria-checked={deliveryMethod === 'link'}
+            className={'gh-portal-btn' + (deliveryMethod === 'link' ? ' active' : '')}
+            data-test-button="delivery-method-link"
+            role="radio"
+            type="button"
+            onClick={() => onChangeDeliveryMethod('link')}
+          >
+            {t("I'll share it myself")}
+          </button>
+        </div>
+      </div>
+
+      <div
+        aria-hidden={deliveryMethod !== 'email'}
+        className="gh-portal-gift-checkout-reveal"
+        data-open={deliveryMethod === 'email'}
+      >
+        <div className="gh-portal-gift-checkout-reveal-inner">
+          <div className="gh-portal-gift-checkout-section">
+            <TypedInputField
+              {...recipientNameField}
+              onChange={(event: ChangeEvent<HTMLInputElement>) =>
+                onChangeRecipientName(event.target.value)
+              }
+            />
+            <TypedInputField
+              {...recipientEmailField}
+              onChange={(event: ChangeEvent<HTMLInputElement>) =>
+                onChangeRecipientEmail(event.target.value)
+              }
+            />
+            {/* Part of the recipient's details rather than a section of its own, so it takes
+            InputField's label markup to sit flush with the fields above. */}
+            <div className="gh-portal-input-labelcontainer">
+              <label className="gh-portal-input-label" htmlFor="gift-message">
+                {t('Optional message')}
+              </label>
+            </div>
+            <textarea
+              className="gh-portal-input gh-portal-gift-checkout-textarea"
+              data-test-input="gift-message"
+              id="gift-message"
+              maxLength={maxMessageLength}
+              placeholder={t('Add a short note to go with your gift')}
+              value={giftMessage}
+              onChange={(event) => onChangeGiftMessage(event.target.value)}
+            />
+            <div
+              aria-hidden={giftMessage.length === 0}
+              className="gh-portal-gift-checkout-reveal"
+              data-open={giftMessage.length > 0}
+            >
+              <div className="gh-portal-gift-checkout-reveal-inner">
+                <p className="gh-portal-gift-checkout-message-count">
+                  {giftMessage.length}/{maxMessageLength}
+                </p>
+              </div>
+            </div>
+            <div className="gh-portal-gift-checkout-delivery-date">
+              <div className="gh-portal-input-labelcontainer">
+                <label className="gh-portal-input-label" htmlFor="gift-delivery-date">
+                  {t('Delivery date')}
+                </label>
+              </div>
+              <TypedDatePicker
+                ariaLabel={t('Delivery date')}
+                hasError={!!deliveryDateError}
+                id="gift-delivery-date"
+                max={maxDeliveryDate}
+                min={minDeliveryDate}
+                minLabel={t('Now')}
+                value={effectiveDeliveryDate}
+                onChange={onChangeDeliveryDate}
+              />
+              {deliveryDateError && (
+                <p className="gh-portal-gift-checkout-delivery-error">{deliveryDateError}</p>
+              )}
+            </div>
+          </div>
+        </div>
+      </div>
+    </>
+  );
+}
+
+export default GiftDeliveryStep;
diff --git a/apps/portal/src/components/pages/beta-gift/plan-step.tsx b/apps/portal/src/components/pages/beta-gift/plan-step.tsx
new file mode 100644
index 00000000000..c25cbe5007b
--- /dev/null
+++ b/apps/portal/src/components/pages/beta-gift/plan-step.tsx
@@ -0,0 +1,213 @@
+import type { ChangeEvent } from 'react';
+import InputField from '../../common/input-field';
+import CheckmarkIcon from '../../../images/icons/checkmark.svg?react';
+import { getGiftDurationLabel } from '../../../utils/gift-redemption-notification';
+import { t } from '../../../utils/i18n';
+import type { GiftDuration, GiftInputField, GiftProduct } from './types';
+
+type TypedInputFieldProps = GiftInputField & {
+  onChange: (event: ChangeEvent<HTMLInputElement>) => void;
+};
+
+const TypedInputField = InputField as unknown as (props: TypedInputFieldProps) => JSX.Element;
+
+interface GiftDurationSwitchProps {
+  activeDuration: GiftDuration;
+  offeredDurations: GiftDuration[];
+  onSelectDuration: (duration: GiftDuration) => void;
+}
+
+function GiftDurationSwitch({
+  activeDuration,
+  offeredDurations,
+  onSelectDuration,
+}: GiftDurationSwitchProps) {
+  if (offeredDurations.length < 2) {
+    return null;
+  }
+
+  return (
+    <div
+      aria-label={t('Gift duration')}
+      className="gh-portal-gift-duration-switch"
+      role="radiogroup"
+    >
+      {offeredDurations.map((months) => {
+        const isActive = months === activeDuration;
+        return (
+          <button
+            key={months}
+            aria-checked={isActive}
+            className={'gh-portal-btn' + (isActive ? ' active' : '')}
+            data-test-button={`switch-duration-${months}`}
+            role="radio"
+            type="button"
+            onClick={() => onSelectDuration(months)}
+          >
+            {getGiftDurationLabel({ cadence: 'month', duration: months })}
+          </button>
+        );
+      })}
+    </div>
+  );
+}
+
+interface GiftPlanStepProps {
+  activeDuration: GiftDuration;
+  activeDurationLabel: string;
+  activeProduct: GiftProduct;
+  buyerEmailField: GiftInputField;
+  buyerNameField: GiftInputField;
+  isSingleTier: boolean;
+  offeredDurations: GiftDuration[];
+  onBuyerEmailChange: (value: string) => void;
+  onBuyerNameChange: (value: string) => void;
+  onSelectDuration: (duration: GiftDuration) => void;
+  onSelectProduct: (productId: string) => void;
+  products: GiftProduct[];
+  showBuyerEmail: boolean;
+  showBuyerName: boolean;
+  siteTitle: string;
+  tierPriceLabel: (product: GiftProduct, duration: GiftDuration) => string;
+}
+
+function GiftPlanStep({
+  activeDuration,
+  activeDurationLabel,
+  activeProduct,
+  buyerEmailField,
+  buyerNameField,
+  isSingleTier,
+  offeredDurations,
+  onBuyerEmailChange,
+  onBuyerNameChange,
+  onSelectDuration,
+  onSelectProduct,
+  products,
+  showBuyerEmail,
+  showBuyerName,
+  siteTitle,
+  tierPriceLabel,
+}: GiftPlanStepProps) {
+  return (
+    <>
+      <header className="gh-portal-gift-checkout-header">
+        <h1 className="gh-portal-main-title">{t('Gift a membership')}</h1>
+        <p className="gh-portal-gift-checkout-subtitle">
+          {t('Share a full membership to {siteTitle} with a friend or colleague', {
+            siteTitle,
+          })}
+        </p>
+      </header>
+
+      {(showBuyerName || showBuyerEmail) && (
+        <div className="gh-portal-gift-checkout-section">
+          {showBuyerName && (
+            <TypedInputField
+              {...buyerNameField}
+              onChange={(event: ChangeEvent<HTMLInputElement>) =>
+                onBuyerNameChange(event.target.value)
+              }
+            />
+          )}
+          {showBuyerEmail && (
+            <TypedInputField
+              {...buyerEmailField}
+              onChange={(event: ChangeEvent<HTMLInputElement>) =>
+                onBuyerEmailChange(event.target.value)
+              }
+            />
+          )}
+        </div>
+      )}
+
+      <div className="gh-portal-gift-checkout-section">
+        <div className="gh-portal-gift-checkout-label">
+          {isSingleTier ? t('Membership details') : t('Tier')}
+        </div>
+        {offeredDurations.length > 1 ? (
+          <GiftDurationSwitch
+            activeDuration={activeDuration}
+            offeredDurations={offeredDurations}
+            onSelectDuration={onSelectDuration}
+          />
+        ) : (
+          <div className="gh-portal-gift-checkout-single-duration" data-test-single-duration>
+            {t('{duration} membership', { duration: activeDurationLabel })}
+          </div>
+        )}
+      </div>
+
+      <div className="gh-portal-gift-checkout-section">
+        <div
+          aria-label={isSingleTier ? undefined : t('Choose a tier')}
+          className={'gh-portal-gift-checkout-tiers' + (isSingleTier ? ' single' : '')}
+          role={isSingleTier ? undefined : 'radiogroup'}
+        >
+          {products.map((product) => {
+            const isSelected = product.id === activeProduct.id;
+            const benefits = product.benefits || [];
+            return (
+              <div
+                key={product.id}
+                className={
+                  'gh-portal-gift-checkout-tier-item' +
+                  (isSelected && !isSingleTier ? ' selected' : '')
+                }
+              >
+                <button
+                  aria-checked={isSingleTier ? undefined : isSelected}
+                  className="gh-portal-gift-checkout-tier"
+                  data-test-tier={product.name}
+                  role={isSingleTier ? undefined : 'radio'}
+                  type="button"
+                  onClick={() => onSelectProduct(product.id)}
+                >
+                  {!isSingleTier && (
+                    <span aria-hidden="true" className="gh-portal-gift-checkout-tier-radio" />
+                  )}
+                  <div className="gh-portal-gift-checkout-tier-content">
+                    <div className="gh-portal-gift-checkout-tier-heading">
+                      <span className="gh-portal-gift-checkout-tier-name">{product.name}</span>
+                      <span className="gh-portal-gift-checkout-tier-price">
+                        {tierPriceLabel(product, activeDuration)}
+                      </span>
+                    </div>
+                    {product.description && (
+                      <p className="gh-portal-gift-checkout-tier-description">
+                        {product.description}
+                      </p>
+                    )}
+                  </div>
+                </button>
+                {benefits.length > 0 && (
+                  <div
+                    aria-hidden={!isSelected}
+                    className="gh-portal-gift-checkout-tier-benefits"
+                    data-open={isSelected}
+                  >
+                    <div className="gh-portal-gift-checkout-tier-benefits-inner">
+                      <div className="gh-portal-gift-checkout-benefits">
+                        {benefits.map((benefit, idx) => {
+                          const key = benefit.id || `benefit-${idx}`;
+                          return (
+                            <div key={key} className="gh-portal-gift-checkout-benefit">
+                              <CheckmarkIcon aria-hidden="true" focusable="false" />
+                              <span>{benefit.name}</span>
+                            </div>
+                          );
+                        })}
+                      </div>
+                    </div>
+                  </div>
+                )}
+              </div>
+            );
+          })}
+        </div>
+      </div>
+    </>
+  );
+}
+
+export default GiftPlanStep;
diff --git a/apps/portal/src/components/pages/beta-gift/preview-panel.tsx b/apps/portal/src/components/pages/beta-gift/preview-panel.tsx
new file mode 100644
index 00000000000..1b18859bf4b
--- /dev/null
+++ b/apps/portal/src/components/pages/beta-gift/preview-panel.tsx
@@ -0,0 +1,123 @@
+import type { HTMLAttributes, RefObject } from 'react';
+import GiftCard from '../../common/gift-card';
+import GiftEmailPreview from '../../common/gift-email-preview';
+import { getGiftDurationLabel } from '../../../utils/gift-redemption-notification';
+import type { GiftCadenceDuration, GiftDuration, GiftProduct } from './types';
+
+interface TypedGiftCardProps {
+  cardRef: RefObject<HTMLDivElement>;
+  duration: string;
+  fromName: string;
+  giftValue: string;
+  siteIcon: string | undefined;
+  siteTitle: string;
+  tierName: string;
+}
+
+type TypedGiftEmailPreviewProps = GiftCadenceDuration & {
+  benefits: NonNullable<GiftProduct['benefits']>;
+  buyerName: string;
+  deliveryDate: string;
+  giftMessage: string;
+  isScheduled: boolean;
+  recipientEmail: string;
+  recipientName: string;
+  siteIcon: string | undefined;
+  siteTitle: string;
+  tierName: string;
+};
+
+const TypedGiftCard = GiftCard as unknown as (props: TypedGiftCardProps) => JSX.Element;
+const TypedGiftEmailPreview = GiftEmailPreview as unknown as (
+  props: TypedGiftEmailPreviewProps,
+) => JSX.Element;
+
+interface GiftPreviewPanelProps {
+  activeDuration: GiftDuration;
+  activeProduct: GiftProduct;
+  buyerName: string;
+  cardRef: RefObject<HTMLDivElement>;
+  cardTiltProps: HTMLAttributes<HTMLDivElement>;
+  effectiveDeliveryDate: string;
+  emailDuration: GiftCadenceDuration;
+  giftMessage: string;
+  giftValue: string;
+  minDeliveryDate: string;
+  recipientEmail: string;
+  recipientName: string;
+  showEmailPreview: boolean;
+  siteIcon: string | undefined;
+  siteTitle: string;
+}
+
+function GiftPreviewPanel({
+  activeDuration,
+  activeProduct,
+  buyerName,
+  cardRef,
+  cardTiltProps,
+  effectiveDeliveryDate,
+  emailDuration,
+  giftMessage,
+  giftValue,
+  minDeliveryDate,
+  recipientEmail,
+  recipientName,
+  showEmailPreview,
+  siteIcon,
+  siteTitle,
+}: GiftPreviewPanelProps) {
+  return (
+    <div className="gh-portal-gift-checkout-right" {...cardTiltProps}>
+      <div className="gh-portal-gift-checkout-right-panel">
+        {/* Both representations stay mounted and share a single grid cell, so switching between
+        them cross-dissolves instead of unmounting one and popping the other in. */}
+        <div className="gh-portal-gift-checkout-stage">
+          <div
+            aria-hidden={showEmailPreview}
+            className="gh-portal-gift-checkout-stage-item card"
+            data-active={!showEmailPreview}
+          >
+            <div className="gh-portal-gift-checkout-card-stack">
+              <TypedGiftCard
+                cardRef={cardRef}
+                duration={getGiftDurationLabel({
+                  cadence: 'month',
+                  duration: activeDuration,
+                })}
+                fromName={buyerName.trim()}
+                giftValue={giftValue}
+                siteIcon={siteIcon}
+                siteTitle={siteTitle}
+                tierName={activeProduct.name}
+              />
+            </div>
+          </div>
+          <div
+            aria-hidden={!showEmailPreview}
+            className="gh-portal-gift-checkout-stage-item email"
+            data-active={showEmailPreview}
+          >
+            <div className="gh-portal-gift-checkout-email-stack">
+              <TypedGiftEmailPreview
+                {...emailDuration}
+                benefits={activeProduct.benefits || []}
+                buyerName={buyerName}
+                deliveryDate={effectiveDeliveryDate}
+                giftMessage={giftMessage}
+                isScheduled={effectiveDeliveryDate > minDeliveryDate}
+                recipientEmail={recipientEmail}
+                recipientName={recipientName}
+                siteIcon={siteIcon}
+                siteTitle={siteTitle}
+                tierName={activeProduct.name}
+              />
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export default GiftPreviewPanel;
diff --git a/apps/portal/src/components/pages/beta-gift/types.ts b/apps/portal/src/components/pages/beta-gift/types.ts
new file mode 100644
index 00000000000..051d2425165
--- /dev/null
+++ b/apps/portal/src/components/pages/beta-gift/types.ts
@@ -0,0 +1,27 @@
+import type { GiftDuration, GiftProduct } from '../../../utils/gift-subscriptions';
+
+export type GiftStep = 'plan' | 'delivery';
+export type GiftDeliveryMethod = 'email' | 'link';
+export type GiftCadenceDuration =
+  | { cadence: 'month'; duration: Exclude<GiftDuration, 12> }
+  | { cadence: 'year'; duration: 1 };
+
+export interface GiftFormErrors {
+  buyerName?: string | null;
+  deliveryDate?: string | null;
+  email?: string | null;
+  recipientEmail?: string | null;
+}
+
+export interface GiftInputField {
+  errorMessage: string;
+  label: string;
+  maxLength: number;
+  name: string;
+  placeholder: string;
+  required: boolean;
+  type: 'email' | 'text';
+  value: string;
+}
+
+export type { GiftDuration, GiftProduct };
diff --git a/apps/portal/src/utils/gift-subscriptions.ts b/apps/portal/src/utils/gift-subscriptions.ts
index a7e9266446e..1f1529db541 100644
--- a/apps/portal/src/utils/gift-subscriptions.ts
+++ b/apps/portal/src/utils/gift-subscriptions.ts
@@ -8,7 +8,7 @@ export type GiftDuration = (typeof GIFT_DURATION_CATALOGUE)[number];
 type PortalPlan = 'free' | 'monthly' | 'yearly';
 
 // portal_default_plan is server-validated to the paid plans only
-type PortalDefaultPlan = Exclude<PortalPlan, 'free'>;
+export type PortalDefaultPlan = Exclude<PortalPlan, 'free'>;
 
 interface Price {
   amount?: unknown;
@@ -21,8 +21,16 @@ interface ValidPrice extends Price {
   currency: string;
 }
 
-interface Product {
+export interface GiftBenefit {
+  id?: string;
+  name: string;
+}
+
+export interface GiftProduct {
   id: string;
+  name: string;
+  description?: string | null;
+  benefits?: GiftBenefit[];
   type?: string;
   monthlyPrice?: Price | null;
   yearlyPrice?: Price | null;
@@ -30,10 +38,14 @@ interface Product {
 
 // the slice of Portal's site data that gift purchasing reads
 export interface Site {
+  title?: string;
+  icon?: string;
+  timezone?: string;
   paid_members_enabled?: boolean;
   portal_plans?: PortalPlan[];
+  portal_default_plan?: PortalDefaultPlan;
   portal_products?: string[];
-  products?: Product[];
+  products?: GiftProduct[];
   labs?: {
     giftSubCustomization?: boolean;
   };
@@ -41,7 +53,7 @@ export interface Site {
   portal_account_gift_promotion?: boolean;
 }
 
-function getPriceForDuration(product: Product, duration: GiftDuration): Price | null {
+function getPriceForDuration(product: GiftProduct, duration: GiftDuration): Price | null {
   if (duration === 12) {
     return product.yearlyPrice ?? null;
   }
@@ -70,7 +82,7 @@ function isDurationEnabled({
   return duration === 12 ? portalPlans.includes('yearly') : portalPlans.includes('monthly');
 }
 
-export function getGiftPrice(product: Product, duration: GiftDuration): ValidPrice | null {
+export function getGiftPrice(product: GiftProduct, duration: GiftDuration): ValidPrice | null {
   const price = getPriceForDuration(product, duration);
 
   if (!hasValidPrice(price)) {
@@ -89,7 +101,7 @@ export function getGiftProducts({
 }: {
   site: Site | null;
   duration: GiftDuration;
-}): Product[] {
+}): GiftProduct[] {
   const {
     paid_members_enabled: paidMembersEnabled,
     portal_plans: portalPlans = [],
diff --git a/apps/portal/test/unit/components/pages/beta-gift-page.test.tsx b/apps/portal/test/unit/components/pages/beta-gift-page.test.tsx
index 85358055817..939b3f5ea60 100644
--- a/apps/portal/test/unit/components/pages/beta-gift-page.test.tsx
+++ b/apps/portal/test/unit/components/pages/beta-gift-page.test.tsx
@@ -38,6 +38,19 @@ function setup(site: SiteData, overrideContext: Record<string, unknown> = {}) {
 }
 
 describe('BetaGiftPage', () => {
+  test('preserves focus on the checkout action when moving to delivery', () => {
+    const site = buildSite({ labs: { giftSubCustomization: true } });
+    const { getByRole } = setup(site);
+    const continueButton = getByRole('button', { name: 'Continue to delivery details' });
+
+    continueButton.focus();
+    fireEvent.click(continueButton);
+
+    const paymentButton = getByRole('button', { name: 'Continue to payment' });
+    expect(paymentButton).toBe(continueButton);
+    expect(paymentButton).toHaveFocus();
+  });
+
   test.each([
     { pickerLabel: '1 month', durationLabel: '1-month' },
     { pickerLabel: '3 months', durationLabel: '3-month' },
diff --git a/compose.dev.yaml b/compose.dev.yaml
index d075982c2f9..9749999ab95 100644
--- a/compose.dev.yaml
+++ b/compose.dev.yaml
@@ -107,6 +107,8 @@ services:
       database__connection__database: ${MYSQL_DATABASE:-ghost_dev}
       server__host: 0.0.0.0
       server__port: 2368
+      # Apply Ghost(Pro)'s public query parameter allowlist in local development
+      queryParameterFiltering__enabled: '${QUERY_PARAMETER_FILTERING_ENABLED:-true}'
       mail__transport: SMTP
       mail__options__host: mailpit
       mail__options__port: 1025
diff --git a/e2e/helpers/environment/constants.ts b/e2e/helpers/environment/constants.ts
index 5914ccd14cb..26c3cfaaa62 100644
--- a/e2e/helpers/environment/constants.ts
+++ b/e2e/helpers/environment/constants.ts
@@ -68,6 +68,7 @@ export const BASE_GHOST_ENV = [
   'NODE_ENV=development',
   'server__host=0.0.0.0',
   'server__port=2368',
+  'queryParameterFiltering__enabled=true',
 
   // Database configuration (database name is set per container)
   'database__client=mysql2',
diff --git a/e2e/helpers/services/stripe/builders.ts b/e2e/helpers/services/stripe/builders.ts
index aef19bbbf55..73ba4b10cbe 100644
--- a/e2e/helpers/services/stripe/builders.ts
+++ b/e2e/helpers/services/stripe/builders.ts
@@ -205,6 +205,12 @@ export interface StripeCheckoutSessionRequest {
     };
   };
   submit_type?: 'auto' | 'book' | 'donate' | 'pay' | 'send';
+  // What the page collects for itself, as opposed to the questions above. Recorded so a
+  // test can assert what a publisher's configuration actually asked Stripe for, and so a
+  // completion can only carry data the checkout collected.
+  shipping_address_collection?: { allowed_countries: string[] };
+  tax_id_collection?: { enabled: boolean };
+  phone_number_collection?: { enabled: boolean };
 }
 
 export interface RecordedStripeCheckoutSession {
diff --git a/e2e/helpers/services/stripe/completed-checkout.ts b/e2e/helpers/services/stripe/completed-checkout.ts
new file mode 100644
index 00000000000..2aa2547b667
--- /dev/null
+++ b/e2e/helpers/services/stripe/completed-checkout.ts
@@ -0,0 +1,210 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import type { RecordedStripeCheckoutSession, StripeEvent } from './builders';
+
+/**
+ * Completing a checkout the way Stripe completes one.
+ *
+ * ## Why this reads a fixture instead of building an object
+ *
+ * The completed session is the only Stripe payload Ghost reads publisher data out of,
+ * and its shape is version-dependent in a way nothing in the payload would warn us
+ * about — at our pinned API version the address is `shipping`, and later versions move
+ * it to `collected_information.shipping_details`. A hand-built event would let a test
+ * pass against a shape Stripe stopped sending, which is the failure this whole fixture
+ * suite exists to prevent. So the event is a real captured session with the parts a
+ * test cares about substituted in, and `drift.test.ts` keeps the capture honest.
+ *
+ * ## Why it reads the request too
+ *
+ * A member can only answer a question the checkout page asked. Building the completion
+ * from the session Ghost actually created means a test cannot answer a question that
+ * was never rendered, or supply an address for a checkout that never asked for one —
+ * both of which would otherwise pass while proving nothing. Those are errors here,
+ * named, rather than silently accepted.
+ */
+
+const fixtureDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), 'fixtures');
+
+function capturedSession(): Record<string, unknown> {
+  return JSON.parse(
+    fs.readFileSync(path.resolve(fixtureDir, 'checkout_session.completed.json'), 'utf8'),
+  );
+}
+
+/** An address as a member would type it on the checkout page. */
+export interface CheckoutShippingInput {
+  name?: string;
+  line1?: string;
+  line2?: string;
+  city?: string;
+  state?: string;
+  postal_code?: string;
+  country?: string;
+}
+
+/** What a member filled in on the checkout page. Everything is optional; nothing is invented. */
+export interface CollectedCheckoutInput {
+  /** Answers to the publisher's questions, keyed by the custom field key Ghost asked under. */
+  answers?: Record<string, string>;
+  /**
+   * The delivery address. Omitted, a checkout that asked for one gets the captured
+   * fixture's address, so a test that does not care about the values stays short.
+   * `null` is a checkout that asked and collected nothing.
+   */
+  shipping?: CheckoutShippingInput | null;
+  taxId?: string | null;
+  phone?: string | null;
+}
+
+function askedQuestions(session: RecordedStripeCheckoutSession): string[] {
+  const asked = (session.request as { custom_fields?: Array<{ key: string }> }).custom_fields ?? [];
+  return asked.map((field) => field.key);
+}
+
+/**
+ * Whether the checkout asked for something. Shipping says so by carrying a list of
+ * countries it will deliver to; tax and phone carry an `enabled` flag instead, and a flag
+ * turned off is a question the page never rendered.
+ */
+function asks(session: RecordedStripeCheckoutSession, parameter: string): boolean {
+  const asked = (session.request as Record<string, unknown>)[parameter];
+
+  if (asked === undefined || asked === null) {
+    return false;
+  }
+  if (typeof asked === 'object' && 'enabled' in asked) {
+    return (asked as { enabled?: unknown }).enabled === true;
+  }
+  return true;
+}
+
+/**
+ * The `custom_fields` a completed session carries: every question the page asked, each
+ * holding the answer a test says the member gave, or none.
+ *
+ * Built from the request rather than from the answers, because that is the direction the
+ * real thing works in — Stripe returns every field it rendered, answered or not.
+ */
+function answeredQuestions(
+  session: RecordedStripeCheckoutSession,
+  answers: Record<string, string>,
+) {
+  const asked = askedQuestions(session);
+
+  for (const key of Object.keys(answers)) {
+    if (!asked.includes(key)) {
+      throw new Error(
+        `The checkout never asked for "${key}", so a member could not have answered it. ` +
+          `It asked for: ${asked.length > 0 ? asked.join(', ') : 'nothing'}.`,
+      );
+    }
+  }
+
+  const requested =
+    (
+      session.request as {
+        custom_fields?: Array<{ key: string; label?: { custom?: string }; optional?: boolean }>;
+      }
+    ).custom_fields ?? [];
+  return requested.map((field) => ({
+    key: field.key,
+    type: 'text',
+    optional: field.optional ?? true,
+    label: { type: 'custom', custom: field.label?.custom ?? field.key },
+    // Stripe returns the whole `text` object whether or not it was filled in.
+    text: {
+      value: answers[field.key] ?? null,
+      default_value: null,
+      maximum_length: null,
+      minimum_length: null,
+    },
+  }));
+}
+
+function shippingBlock(
+  session: RecordedStripeCheckoutSession,
+  given: CollectedCheckoutInput['shipping'],
+  captured: Record<string, unknown>,
+) {
+  const collecting = asks(session, 'shipping_address_collection');
+
+  if (given !== undefined && given !== null && !collecting) {
+    throw new Error(
+      'The checkout never asked for a shipping address, so a member could not have given one.',
+    );
+  }
+  if (!collecting || given === null) {
+    return null;
+  }
+  if (given === undefined) {
+    return captured.shipping;
+  }
+
+  const { name, ...address } = given;
+  const capturedShipping = captured.shipping as { address: Record<string, unknown> };
+  return {
+    name: name ?? null,
+    // Every part Stripe returns is present, and one the test left out comes back null
+    // rather than absent — which is what makes "an address with holes in it" testable.
+    address: Object.fromEntries(
+      Object.keys(capturedShipping.address).map((part) => [
+        part,
+        address[part as keyof typeof address] ?? null,
+      ]),
+    ),
+    carrier: null,
+    phone: null,
+    tracking_number: null,
+  };
+}
+
+/**
+ * A `checkout.session.completed` event for a session Ghost created, carrying what a
+ * member filled in on the page.
+ */
+export function buildCollectedCheckoutCompletedEvent(opts: {
+  session: RecordedStripeCheckoutSession;
+  customerId: string;
+  collected?: CollectedCheckoutInput;
+}): StripeEvent {
+  const { session, customerId, collected = {} } = opts;
+  const captured = capturedSession();
+
+  if (collected.taxId && !asks(session, 'tax_id_collection')) {
+    throw new Error(
+      'The checkout never asked for a tax number, so a member could not have given one.',
+    );
+  }
+  if (collected.phone && !asks(session, 'phone_number_collection')) {
+    throw new Error(
+      'The checkout never asked for a phone number, so a member could not have given one.',
+    );
+  }
+
+  const customerDetails = captured.customer_details as Record<string, unknown>;
+
+  return {
+    id: `evt_${session.response.id}`,
+    object: 'event',
+    type: 'checkout.session.completed',
+    data: {
+      object: {
+        ...captured,
+        id: session.response.id,
+        mode: 'subscription',
+        customer: customerId,
+        metadata: { checkoutType: 'signup', ...session.response.metadata },
+        custom_fields: answeredQuestions(session, collected.answers ?? {}),
+        shipping: shippingBlock(session, collected.shipping, captured),
+        customer_details: {
+          ...customerDetails,
+          phone: collected.phone ?? null,
+          // A typed pair, of which only the value ever crosses into a field.
+          tax_ids: collected.taxId ? [{ type: 'gb_vat', value: collected.taxId }] : [],
+        },
+      },
+    },
+  };
+}
diff --git a/e2e/helpers/services/stripe/fake-stripe-server.ts b/e2e/helpers/services/stripe/fake-stripe-server.ts
index bede0a9cde8..090c04f0b21 100644
--- a/e2e/helpers/services/stripe/fake-stripe-server.ts
+++ b/e2e/helpers/services/stripe/fake-stripe-server.ts
@@ -507,6 +507,9 @@ export class FakeStripeServer extends FakeServer {
           submit_type: body.submit_type,
           subscription_data: body.subscription_data,
           line_items: body.line_items,
+          shipping_address_collection: body.shipping_address_collection,
+          tax_id_collection: body.tax_id_collection,
+          phone_number_collection: body.phone_number_collection,
         },
         response: {
           mode,
@@ -729,6 +732,22 @@ export class FakeStripeServer extends FakeServer {
       }
     }
 
+    // Stripe will not collect a tax id for a customer it may not rename. Measured, like
+    // everything else here: shipping and phone collection carry no such requirement, so
+    // this is specific to tax rather than a rule about collecting from a customer at all.
+    // Read against `true` rather than for truthiness: form decoding delivers the flag as
+    // the string `"false"`, which is truthy, and refusing on that would refuse a checkout
+    // that had switched tax collection off.
+    const taxIdFlag = (body.tax_id_collection as { enabled?: unknown })?.enabled;
+    const collectsTaxId = taxIdFlag === true || taxIdFlag === 'true';
+    const mayRename = (body.customer_update as { name?: unknown })?.name === 'auto';
+    if (collectsTaxId && body.customer && !mayRename) {
+      return (
+        'Tax ID collection requires updating business name on the customer. To enable tax ID ' +
+        'collection for an existing customer, please set `customer_update[name]` to `auto`.'
+      );
+    }
+
     return null;
   }
 
diff --git a/e2e/helpers/services/stripe/fixtures/checkout_session.collection.json b/e2e/helpers/services/stripe/fixtures/checkout_session.collection.json
new file mode 100644
index 00000000000..a8ee043fdce
--- /dev/null
+++ b/e2e/helpers/services/stripe/fixtures/checkout_session.collection.json
@@ -0,0 +1,124 @@
+{
+  "id": "cs_test_a1x0bgEIkVCwnGDl3sbDcHplHRhK4DGw3GtdMBiUkeqoMBQ1GFkFPKTgtV",
+  "object": "checkout.session",
+  "adaptive_pricing": {
+    "enabled": true
+  },
+  "after_expiration": null,
+  "allow_promotion_codes": null,
+  "amount_subtotal": 500,
+  "amount_total": 500,
+  "automatic_tax": {
+    "enabled": false,
+    "liability": null,
+    "provider": null,
+    "status": null
+  },
+  "billing_address_collection": null,
+  "branding_settings": {
+    "background_color": "#ffffff",
+    "border_style": "rounded",
+    "button_color": "#0074d4",
+    "display_name": "Counterproof Collective",
+    "font_family": "default",
+    "icon": null,
+    "logo": null
+  },
+  "cancel_url": "https://example.com/cancel",
+  "client_reference_id": null,
+  "client_secret": null,
+  "collected_information": null,
+  "consent": null,
+  "consent_collection": null,
+  "created": 1787267115,
+  "currency": "usd",
+  "currency_conversion": null,
+  "custom_fields": [
+    {
+      "key": "delivery_notes",
+      "label": {
+        "custom": "Delivery notes",
+        "type": "custom"
+      },
+      "optional": true,
+      "text": {
+        "default_value": null,
+        "maximum_length": null,
+        "minimum_length": null,
+        "value": null
+      },
+      "type": "text"
+    }
+  ],
+  "custom_text": {
+    "after_submit": null,
+    "shipping_address": null,
+    "submit": null,
+    "terms_of_service_acceptance": null
+  },
+  "customer": null,
+  "customer_account": null,
+  "customer_creation": "always",
+  "customer_details": null,
+  "customer_email": null,
+  "discounts": [],
+  "expires_at": 1787353515,
+  "integration_identifier": null,
+  "invoice": null,
+  "invoice_creation": null,
+  "livemode": false,
+  "locale": null,
+  "managed_payments": {
+    "enabled": false
+  },
+  "metadata": {},
+  "mode": "subscription",
+  "origin_context": null,
+  "payment_intent": null,
+  "payment_link": null,
+  "payment_method_collection": "always",
+  "payment_method_configuration_details": {
+    "id": "pmc_1SAoFrCvhsRvBqJ0uYiAIPaH",
+    "parent": null
+  },
+  "payment_method_options": {
+    "card": {
+      "request_three_d_secure": "automatic"
+    }
+  },
+  "payment_method_types": ["card", "link", "amazon_pay"],
+  "payment_status": "unpaid",
+  "permissions": null,
+  "phone_number_collection": {
+    "enabled": false
+  },
+  "recovered_from": null,
+  "saved_payment_method_options": {
+    "allow_redisplay_filters": ["always"],
+    "payment_method_remove": "disabled",
+    "payment_method_save": null
+  },
+  "setup_intent": null,
+  "shipping": null,
+  "shipping_address_collection": {
+    "allowed_countries": ["GB", "US"]
+  },
+  "shipping_options": [],
+  "shipping_rate": null,
+  "status": "open",
+  "submit_type": null,
+  "subscription": null,
+  "success_url": "https://example.com/success",
+  "tax_id_collection": {
+    "enabled": true,
+    "required": "never"
+  },
+  "total_details": {
+    "amount_discount": 0,
+    "amount_shipping": 0,
+    "amount_tax": 0
+  },
+  "ui_mode": "hosted",
+  "url": "https://checkout.stripe.com/c/pay/cs_test_redacted",
+  "wallet_options": null
+}
diff --git a/e2e/helpers/services/stripe/fixtures/checkout_session.completed.json b/e2e/helpers/services/stripe/fixtures/checkout_session.completed.json
index f175b16316c..82e89d18f37 100644
--- a/e2e/helpers/services/stripe/fixtures/checkout_session.completed.json
+++ b/e2e/helpers/services/stripe/fixtures/checkout_session.completed.json
@@ -1,5 +1,5 @@
 {
-  "id": "cs_test_a1YnnBBjnCdOg0U3Vsen6LEWYp9JkPdeTqBnP0ZriFhZsoNpAufR9uaUmZ",
+  "id": "cs_test_a1BZS9tua8DNQPNiyWU0vOOHJgrC3CteT1RkZlNO1knK0Ez7KiZ2phprgY",
   "object": "checkout.session",
   "adaptive_pricing": {
     "enabled": true
@@ -19,7 +19,7 @@
     "background_color": "#ffffff",
     "border_style": "rounded",
     "button_color": "#0074d4",
-    "display_name": "Example Publication",
+    "display_name": "Counterproof Collective",
     "font_family": "default",
     "icon": null,
     "logo": null
@@ -28,7 +28,7 @@
   "client_reference_id": null,
   "client_secret": null,
   "collected_information": {
-    "business_name": "Example Company Ltd",
+    "business_name": "Testing Co",
     "individual_name": null,
     "shipping_details": {
       "address": {
@@ -39,12 +39,12 @@
         "postal_code": "EC1A 1AA",
         "state": null
       },
-      "name": "Jamie Example"
+      "name": "Test Tester"
     }
   },
   "consent": null,
   "consent_collection": null,
-  "created": 1787091163,
+  "created": 1787267225,
   "currency": "usd",
   "currency_conversion": null,
   "custom_fields": [
@@ -59,7 +59,7 @@
         "default_value": null,
         "maximum_length": null,
         "minimum_length": null,
-        "value": "These are delivery notes"
+        "value": "Some example delivery notes."
       },
       "type": "text"
     }
@@ -70,7 +70,7 @@
     "submit": null,
     "terms_of_service_acceptance": null
   },
-  "customer": "cus_V67VaSsCShqIuI",
+  "customer": "cus_V6spNElFR59wgr",
   "customer_account": null,
   "customer_creation": "always",
   "customer_details": {
@@ -82,10 +82,10 @@
       "postal_code": "EC1A 1AA",
       "state": null
     },
-    "business_name": "Example Company Ltd",
-    "email": "member@example.com",
+    "business_name": "Testing Co",
+    "email": "test@example.com",
     "individual_name": null,
-    "name": "Example Company Ltd",
+    "name": "Testing Co",
     "phone": null,
     "tax_exempt": "none",
     "tax_ids": [
@@ -97,9 +97,9 @@
   },
   "customer_email": null,
   "discounts": [],
-  "expires_at": 1787177562,
+  "expires_at": 1787353625,
   "integration_identifier": null,
-  "invoice": "in_1U5vGmCvhsRvBqJ0YdYrEKnB",
+  "invoice": "in_1U6f47CvhsRvBqJ0cSDraiS4",
   "invoice_creation": null,
   "livemode": false,
   "locale": null,
@@ -113,7 +113,7 @@
   "payment_link": null,
   "payment_method_collection": "always",
   "payment_method_configuration_details": {
-    "id": "pmc_000000000000000000000000",
+    "id": "pmc_1SAoFrCvhsRvBqJ0uYiAIPaH",
     "parent": null
   },
   "payment_method_options": {
@@ -144,7 +144,7 @@
       "state": null
     },
     "carrier": null,
-    "name": "Jamie Example",
+    "name": "Test Tester",
     "phone": null,
     "tracking_number": null
   },
@@ -155,7 +155,7 @@
   "shipping_rate": null,
   "status": "complete",
   "submit_type": null,
-  "subscription": "sub_1U5vGmCvhsRvBqJ0Asiwj5Es",
+  "subscription": "sub_1U6f47CvhsRvBqJ0RXvtkYnc",
   "success_url": "https://example.com/success",
   "tax_id_collection": {
     "enabled": true,
diff --git a/e2e/helpers/services/stripe/fixtures/checkout_session.donation.json b/e2e/helpers/services/stripe/fixtures/checkout_session.donation.json
index c90a1499f0a..af042b606c2 100644
--- a/e2e/helpers/services/stripe/fixtures/checkout_session.donation.json
+++ b/e2e/helpers/services/stripe/fixtures/checkout_session.donation.json
@@ -1,5 +1,5 @@
 {
-  "id": "cs_test_a1JFU1pkfvMURRP8L50qzu83Xp0qpKB2QZid0dEoVANrxtQaorTTmNcHG3",
+  "id": "cs_test_a1l3zDI0UWbKmRw4oGRm0NuyhQzkGwv6gvOT20lZTdKFUHNxpOEgGzg5Yf",
   "object": "checkout.session",
   "adaptive_pricing": {
     "enabled": true
@@ -30,7 +30,7 @@
   "collected_information": null,
   "consent": null,
   "consent_collection": null,
-  "created": 1787146483,
+  "created": 1787267116,
   "currency": "usd",
   "currency_conversion": null,
   "custom_fields": [
@@ -62,7 +62,7 @@
   "customer_details": null,
   "customer_email": null,
   "discounts": [],
-  "expires_at": 1787232882,
+  "expires_at": 1787353516,
   "integration_identifier": null,
   "invoice": null,
   "invoice_creation": {
@@ -85,7 +85,7 @@
   "metadata": {},
   "mode": "payment",
   "origin_context": null,
-  "payment_intent": "pi_3U69dfCvhsRvBqJ01yIXNFSb",
+  "payment_intent": "pi_3U6f1MCvhsRvBqJ01a44znVT",
   "payment_link": null,
   "payment_method_collection": "always",
   "payment_method_configuration_details": {
diff --git a/e2e/helpers/services/stripe/fixtures/checkout_session.subscription.json b/e2e/helpers/services/stripe/fixtures/checkout_session.subscription.json
index 405fd5d6f24..024dcb7bb86 100644
--- a/e2e/helpers/services/stripe/fixtures/checkout_session.subscription.json
+++ b/e2e/helpers/services/stripe/fixtures/checkout_session.subscription.json
@@ -1,5 +1,5 @@
 {
-  "id": "cs_test_a1Idpdr8cvKb63vogqazoFD99ykbrxo3gH084qaMmGngOeWAka9zNaKbzw",
+  "id": "cs_test_a12XfPsq3yC6xEIbQiHiGDdhiObvgsOi9fomZrYakQ7TFiWEpsmdXoqy51",
   "object": "checkout.session",
   "adaptive_pricing": {
     "enabled": true
@@ -30,7 +30,7 @@
   "collected_information": null,
   "consent": null,
   "consent_collection": null,
-  "created": 1787146482,
+  "created": 1787267115,
   "currency": "usd",
   "currency_conversion": null,
   "custom_fields": [],
@@ -46,7 +46,7 @@
   "customer_details": null,
   "customer_email": null,
   "discounts": [],
-  "expires_at": 1787232882,
+  "expires_at": 1787353515,
   "integration_identifier": null,
   "invoice": null,
   "invoice_creation": null,
diff --git a/e2e/helpers/services/stripe/fixtures/customer.json b/e2e/helpers/services/stripe/fixtures/customer.json
index df319feb581..ea07031c547 100644
--- a/e2e/helpers/services/stripe/fixtures/customer.json
+++ b/e2e/helpers/services/stripe/fixtures/customer.json
@@ -1,9 +1,9 @@
 {
-  "id": "cus_V6MM2ouqpuTHrR",
+  "id": "cus_V6smdPRjHxGUCZ",
   "object": "customer",
   "address": null,
   "balance": 0,
-  "created": 1787146476,
+  "created": 1787267109,
   "currency": null,
   "customer_account": null,
   "default_currency": null,
@@ -11,8 +11,8 @@
   "delinquent": false,
   "description": null,
   "discount": null,
-  "email": "fixture-1787146475935@example.com",
-  "invoice_prefix": "IMQPIQTM",
+  "email": "fixture-1787267109071@example.com",
+  "invoice_prefix": "6YHAPGHM",
   "invoice_settings": {
     "custom_fields": null,
     "default_payment_method": null,
diff --git a/e2e/helpers/services/stripe/fixtures/manifest.json b/e2e/helpers/services/stripe/fixtures/manifest.json
index ed54752311a..ecb6cb2ac83 100644
--- a/e2e/helpers/services/stripe/fixtures/manifest.json
+++ b/e2e/helpers/services/stripe/fixtures/manifest.json
@@ -1,5 +1,5 @@
 {
-  "captured_at": "2026-08-19T13:34:43.264Z",
+  "captured_at": "2026-08-20T23:05:16.663Z",
   "api_version": "2020-08-27",
   "stripe_node": "see e2e/package.json",
   "note": "Regenerate with `pnpm stripe:fixtures`. Completed checkout is captured separately by hand."
diff --git a/e2e/helpers/services/stripe/fixtures/payment_method.json b/e2e/helpers/services/stripe/fixtures/payment_method.json
index bcc580783df..22da4d1b757 100644
--- a/e2e/helpers/services/stripe/fixtures/payment_method.json
+++ b/e2e/helpers/services/stripe/fixtures/payment_method.json
@@ -1,5 +1,5 @@
 {
-  "id": "pm_1U69dYCvhsRvBqJ0aW3bUj9N",
+  "id": "pm_1U6f1FCvhsRvBqJ0Tn5Goz44",
   "object": "payment_method",
   "allow_redisplay": "unspecified",
   "billing_details": {
@@ -41,8 +41,8 @@
     },
     "wallet": null
   },
-  "created": 1787146476,
-  "customer": "cus_V6MM2ouqpuTHrR",
+  "created": 1787267109,
+  "customer": "cus_V6smdPRjHxGUCZ",
   "customer_account": null,
   "livemode": false,
   "metadata": {},
diff --git a/e2e/helpers/services/stripe/fixtures/subscription.complimentary.json b/e2e/helpers/services/stripe/fixtures/subscription.complimentary.json
index feb2841ba7b..de7569b9f0b 100644
--- a/e2e/helpers/services/stripe/fixtures/subscription.complimentary.json
+++ b/e2e/helpers/services/stripe/fixtures/subscription.complimentary.json
@@ -1,5 +1,5 @@
 {
-  "id": "sub_1U69dcCvhsRvBqJ0IolEWGOg",
+  "id": "sub_1U6f1KCvhsRvBqJ0wp8NMiMG",
   "object": "subscription",
   "application": null,
   "application_fee_percent": null,
@@ -8,7 +8,7 @@
     "enabled": false,
     "liability": null
   },
-  "billing_cycle_anchor": 1787146480,
+  "billing_cycle_anchor": 1787267114,
   "billing_cycle_anchor_config": null,
   "billing_mode": {
     "flexible": null,
@@ -25,11 +25,11 @@
     "reason": null
   },
   "collection_method": "charge_automatically",
-  "created": 1787146480,
+  "created": 1787267114,
   "currency": "usd",
-  "current_period_end": 1818682480,
-  "current_period_start": 1787146480,
-  "customer": "cus_V6MM2ouqpuTHrR",
+  "current_period_end": 1818803114,
+  "current_period_start": 1787267114,
+  "customer": "cus_V6smdPRjHxGUCZ",
   "customer_account": null,
   "days_until_due": null,
   "default_payment_method": null,
@@ -52,12 +52,12 @@
     "object": "list",
     "data": [
       {
-        "id": "si_V6MM1T6OLQ9rq3",
+        "id": "si_V6smCDciyDMUfh",
         "object": "subscription_item",
         "billing_thresholds": null,
-        "created": 1787146481,
-        "current_period_end": 1818682480,
-        "current_period_start": 1787146480,
+        "created": 1787267114,
+        "current_period_end": 1818803114,
+        "current_period_start": 1787267114,
         "discounts": [],
         "metadata": {},
         "plan": {
@@ -111,15 +111,15 @@
           "unit_amount_decimal": "0"
         },
         "quantity": 1,
-        "subscription": "sub_1U69dcCvhsRvBqJ0IolEWGOg",
+        "subscription": "sub_1U6f1KCvhsRvBqJ0wp8NMiMG",
         "tax_rates": []
       }
     ],
     "has_more": false,
     "total_count": 1,
-    "url": "/v1/subscription_items?subscription=sub_1U69dcCvhsRvBqJ0IolEWGOg"
+    "url": "/v1/subscription_items?subscription=sub_1U6f1KCvhsRvBqJ0wp8NMiMG"
   },
-  "latest_invoice": "in_1U69dcCvhsRvBqJ08yHXCeax",
+  "latest_invoice": "in_1U6f1KCvhsRvBqJ0XciUTJZX",
   "livemode": false,
   "managed_payments": {
     "enabled": false
@@ -160,7 +160,7 @@
   },
   "quantity": 1,
   "schedule": null,
-  "start_date": 1787146480,
+  "start_date": 1787267114,
   "status": "active",
   "test_clock": null,
   "transfer_data": null,
diff --git a/e2e/helpers/services/stripe/fixtures/subscription.paid.json b/e2e/helpers/services/stripe/fixtures/subscription.paid.json
index 78c563dcad2..de6241c2d26 100644
--- a/e2e/helpers/services/stripe/fixtures/subscription.paid.json
+++ b/e2e/helpers/services/stripe/fixtures/subscription.paid.json
@@ -1,5 +1,5 @@
 {
-  "id": "sub_1U69dZCvhsRvBqJ0U6OTSuAi",
+  "id": "sub_1U6f1GCvhsRvBqJ0tLIMH2xZ",
   "object": "subscription",
   "application": null,
   "application_fee_percent": null,
@@ -8,7 +8,7 @@
     "enabled": false,
     "liability": null
   },
-  "billing_cycle_anchor": 1787146477,
+  "billing_cycle_anchor": 1787267110,
   "billing_cycle_anchor_config": null,
   "billing_mode": {
     "flexible": null,
@@ -25,14 +25,14 @@
     "reason": null
   },
   "collection_method": "charge_automatically",
-  "created": 1787146477,
+  "created": 1787267110,
   "currency": "usd",
-  "current_period_end": 1789824877,
-  "current_period_start": 1787146477,
-  "customer": "cus_V6MM2ouqpuTHrR",
+  "current_period_end": 1789945510,
+  "current_period_start": 1787267110,
+  "customer": "cus_V6smdPRjHxGUCZ",
   "customer_account": null,
   "days_until_due": null,
-  "default_payment_method": "pm_1U69dYCvhsRvBqJ0aW3bUj9N",
+  "default_payment_method": "pm_1U6f1FCvhsRvBqJ0Tn5Goz44",
   "default_source": null,
   "default_tax_rates": [],
   "description": null,
@@ -52,12 +52,12 @@
     "object": "list",
     "data": [
       {
-        "id": "si_V6MMm5uCeFqpp0",
+        "id": "si_V6smIOddNd0TTs",
         "object": "subscription_item",
         "billing_thresholds": null,
-        "created": 1787146477,
-        "current_period_end": 1789824877,
-        "current_period_start": 1787146477,
+        "created": 1787267111,
+        "current_period_end": 1789945510,
+        "current_period_start": 1787267110,
         "discounts": [],
         "metadata": {},
         "plan": {
@@ -111,15 +111,15 @@
           "unit_amount_decimal": "500"
         },
         "quantity": 1,
-        "subscription": "sub_1U69dZCvhsRvBqJ0U6OTSuAi",
+        "subscription": "sub_1U6f1GCvhsRvBqJ0tLIMH2xZ",
         "tax_rates": []
       }
     ],
     "has_more": false,
     "total_count": 1,
-    "url": "/v1/subscription_items?subscription=sub_1U69dZCvhsRvBqJ0U6OTSuAi"
+    "url": "/v1/subscription_items?subscription=sub_1U6f1GCvhsRvBqJ0tLIMH2xZ"
   },
-  "latest_invoice": "in_1U69dZCvhsRvBqJ0hbWczbvu",
+  "latest_invoice": "in_1U6f1GCvhsRvBqJ07l7xs13W",
   "livemode": false,
   "managed_payments": {
     "enabled": false
@@ -160,7 +160,7 @@
   },
   "quantity": 1,
   "schedule": null,
-  "start_date": 1787146477,
+  "start_date": 1787267110,
   "status": "active",
   "test_clock": null,
   "transfer_data": null,
diff --git a/e2e/helpers/services/stripe/request-schemas.ts b/e2e/helpers/services/stripe/request-schemas.ts
index 9f901eb05ea..f827ad2ca8e 100644
--- a/e2e/helpers/services/stripe/request-schemas.ts
+++ b/e2e/helpers/services/stripe/request-schemas.ts
@@ -205,8 +205,22 @@ export const CreateCheckoutSessionSchema = z.object({
     .optional()
     .catch(undefined),
   customer_update: z.unknown().optional(),
-  shipping_address_collection: z.unknown().optional(),
-  tax_id_collection: z.unknown().optional(),
+  // Read rather than passed through, so a test can assert which countries a publisher's
+  // checkout offers. The list is what makes this parameter exist at all: an empty
+  // collection object form-encodes to nothing, so a request built that way carries no
+  // parameter and Stripe accepts it having been asked to collect nothing.
+  shipping_address_collection: z
+    .object({ allowed_countries: list(z.string()) })
+    .optional()
+    .catch(undefined),
+  tax_id_collection: z
+    .object({ enabled: bool(false) })
+    .optional()
+    .catch(undefined),
+  phone_number_collection: z
+    .object({ enabled: bool(false) })
+    .optional()
+    .catch(undefined),
 });
 
 export const UpdateSubscriptionSchema = z.object({
diff --git a/e2e/helpers/services/stripe/stripe-service.ts b/e2e/helpers/services/stripe/stripe-service.ts
index a17b786e361..3fa2505a5cd 100644
--- a/e2e/helpers/services/stripe/stripe-service.ts
+++ b/e2e/helpers/services/stripe/stripe-service.ts
@@ -1,4 +1,8 @@
 import baseDebug from '@tryghost/debug';
+import {
+  type CollectedCheckoutInput,
+  buildCollectedCheckoutCompletedEvent,
+} from './completed-checkout';
 import { FakeStripeServer } from './fake-stripe-server';
 import { WebhookClient } from './webhook-client';
 import {
@@ -68,8 +72,15 @@ export class StripeTestService {
     return this.server.getCheckoutSessions();
   }
 
+  /**
+   * Complete the checkout Ghost most recently created, as a member would.
+   *
+   * `collected` is what the member filled in on the page — answers to the publisher's
+   * questions, a delivery address, a tax number. It is checked against the session Ghost
+   * actually created, so a test cannot answer a question the checkout never asked.
+   */
   async completeLatestSubscriptionCheckout(
-    opts: { name?: string } = {},
+    opts: { name?: string; collected?: CollectedCheckoutInput } = {},
   ): Promise<CreatedPaidMember> {
     const session = this.getCheckoutSessions().at(-1);
 
@@ -80,6 +91,7 @@ export class StripeTestService {
     return await this.completeSubscriptionCheckout({
       sessionId: session.response.id,
       name: opts.name,
+      collected: opts.collected,
     });
   }
 
@@ -249,6 +261,7 @@ export class StripeTestService {
   private async completeSubscriptionCheckout(opts: {
     sessionId: string;
     name?: string;
+    collected?: CollectedCheckoutInput;
   }): Promise<CreatedPaidMember> {
     const session = this.getCheckoutSessions().find((item) => item.response.id === opts.sessionId);
 
@@ -286,7 +299,7 @@ export class StripeTestService {
     this.server.upsertSubscription(subscription);
     this.server.upsertCheckoutSession(session);
 
-    await this.sendCheckoutSessionCompletedWebhook(customer.id, session.response.metadata);
+    await this.sendCollectedCheckoutCompletedWebhook(session, customer.id, opts.collected);
     await this.sendSubscriptionCreatedWebhook(subscription);
 
     return { customer, subscription, price, paymentMethod };
@@ -386,6 +399,24 @@ export class StripeTestService {
     return customer;
   }
 
+  /**
+   * The completion for a subscription checkout, built from a real captured session so a
+   * test cannot pass against a payload shape Stripe has stopped sending.
+   */
+  private async sendCollectedCheckoutCompletedWebhook(
+    session: RecordedStripeCheckoutSession,
+    customerId: string,
+    collected?: CollectedCheckoutInput,
+  ): Promise<void> {
+    const event = buildCollectedCheckoutCompletedEvent({ session, customerId, collected });
+    const response = await this.webhookClient.sendWebhook(event);
+    debug('checkout.session.completed webhook response: %d', response.status);
+    if (!response.ok) {
+      const body = await response.text();
+      throw new Error(`checkout.session.completed webhook failed (${response.status}): ${body}`);
+    }
+  }
+
   private async sendCheckoutSessionCompletedWebhook(
     customerId: string,
     metadata?: Record<string, string>,
diff --git a/e2e/tests/stripe-fixtures/constraints.test.ts b/e2e/tests/stripe-fixtures/constraints.test.ts
index 7140bdc1b7e..f451d716e1b 100644
--- a/e2e/tests/stripe-fixtures/constraints.test.ts
+++ b/e2e/tests/stripe-fixtures/constraints.test.ts
@@ -97,4 +97,46 @@ test.describe('Fake Stripe - rejects what Stripe rejects', () => {
 
     expect(status).toBe(200);
   });
+
+  // Every signed-in checkout carries a customer, so a tier collecting a tax number could
+  // not be bought by an existing member until Ghost sent the pair. Shipping and phone
+  // collection were probed alongside it and need nothing, so this is a rule about tax
+  // rather than about collecting from a customer.
+  test('tax_id_collection for an existing customer needs customer_update[name]', async () => {
+    const { status, body } = await createSession({
+      customer: 'cus_probe',
+      tax_id_collection: { enabled: true },
+    });
+
+    expect(status).toBe(400);
+    expect(body.error.message).toContain('please set `customer_update[name]`');
+  });
+
+  test('tax_id_collection for an existing customer is accepted with it', async () => {
+    const { status } = await createSession({
+      customer: 'cus_probe',
+      tax_id_collection: { enabled: true },
+      customer_update: { name: 'auto' },
+    });
+
+    expect(status).toBe(200);
+  });
+
+  test('tax_id_collection without a customer needs nothing', async () => {
+    const { status } = await createSession({ tax_id_collection: { enabled: true } });
+
+    expect(status).toBe(200);
+  });
+
+  // Form encoding delivers the flag as a string, and `"false"` is truthy. Reading it for
+  // truthiness would refuse a checkout that asks for no tax number at all, which is the
+  // fake being stricter than Stripe rather than matching it.
+  test('tax_id_collection switched off needs nothing', async () => {
+    const { status } = await createSession({
+      customer: 'cus_probe',
+      tax_id_collection: { enabled: 'false' },
+    });
+
+    expect(status).toBe(200);
+  });
 });
diff --git a/ghost/core/content/themes/casper b/ghost/core/content/themes/casper
index f968f19dc9b..bb3d0de3c70 160000
--- a/ghost/core/content/themes/casper
+++ b/ghost/core/content/themes/casper
@@ -1 +1 @@
-Subproject commit f968f19dc9b2fa8cda4508c40d82d86c03bb6c2f
+Subproject commit bb3d0de3c7065677bb18b38d8185a8a980b163bd
diff --git a/ghost/core/content/themes/source b/ghost/core/content/themes/source
index fb629deb392..3a5643b42a4 160000
--- a/ghost/core/content/themes/source
+++ b/ghost/core/content/themes/source
@@ -1 +1 @@
-Subproject commit fb629deb3922e24bc27ab8aea566ddc76db93ceb
+Subproject commit 3a5643b42a4700e961e65ebda92f6a6c56bf8c86
diff --git a/ghost/core/core/server/api/endpoints/member-custom-fields.ts b/ghost/core/core/server/api/endpoints/member-custom-fields.ts
index 73f1eb109e4..25cd4eee2bb 100644
--- a/ghost/core/core/server/api/endpoints/member-custom-fields.ts
+++ b/ghost/core/core/server/api/endpoints/member-custom-fields.ts
@@ -1,4 +1,4 @@
-import { definitions, type RequestContext } from '../../services/members-custom-fields';
+import { actingContext, definitions } from '../../services/members-custom-fields';
 
 const permissionsService = require('../../services/permissions');
 
@@ -17,17 +17,6 @@ function canThis(frame: Frame) {
   return permissionsService.canThis(frame.options.context);
 }
 
-function requestContextFromFrame(frame: Frame): RequestContext {
-  const context = (frame.options.context ?? {}) as { user?: string; integration?: { id: string } };
-  if (context.integration) {
-    return { actor: { id: context.integration.id, type: 'integration' } };
-  }
-  if (context.user) {
-    return { actor: { id: context.user, type: 'user' } };
-  }
-  return { actor: null };
-}
-
 const noCacheInvalidation = { cacheInvalidate: false };
 
 const controller = {
@@ -71,7 +60,10 @@ const controller = {
     // all-or-nothing. A client sending a single definition (as Admin does)
     // is just the one-item case and sees no change.
     query(frame: Frame) {
-      return definitions!.add(requestContextFromFrame(frame), frame.data.members_custom_fields);
+      return definitions!.add(
+        actingContext(frame.options.context),
+        frame.data.members_custom_fields,
+      );
     },
   },
 
@@ -83,7 +75,10 @@ const controller = {
       return canThis(frame).edit.member_custom_field();
     },
     query(frame: Frame) {
-      return definitions!.reorder(requestContextFromFrame(frame), frame.data.members_custom_fields);
+      return definitions!.reorder(
+        actingContext(frame.options.context),
+        frame.data.members_custom_fields,
+      );
     },
   },
 
@@ -96,7 +91,7 @@ const controller = {
     },
     query(frame: Frame) {
       return definitions!.edit(
-        requestContextFromFrame(frame),
+        actingContext(frame.options.context),
         frame.options.key,
         frame.data.members_custom_fields[0],
       );
@@ -112,7 +107,7 @@ const controller = {
       return canThis(frame).destroy.member_custom_field(frame.options.key);
     },
     async query(frame: Frame) {
-      await definitions!.destroy(requestContextFromFrame(frame), frame.options.key);
+      await definitions!.destroy(actingContext(frame.options.context), frame.options.key);
       return null;
     },
   },
diff --git a/ghost/core/core/server/data/migrations/versions/6.61/2026-08-19-14-30-20-add-written-by-to-members-custom-field-values.js b/ghost/core/core/server/data/migrations/versions/6.61/2026-08-19-14-30-20-add-written-by-to-members-custom-field-values.js
new file mode 100644
index 00000000000..25fd9a72651
--- /dev/null
+++ b/ghost/core/core/server/data/migrations/versions/6.61/2026-08-19-14-30-20-add-written-by-to-members-custom-field-values.js
@@ -0,0 +1,42 @@
+const logging = require('@tryghost/logging');
+const {
+  combineNonTransactionalMigrations,
+  createAddColumnMigration,
+  createNonTransactionalMigration,
+} = require('../../utils');
+
+const TABLE = 'members_custom_field_values';
+
+// Who wrote the value that is here now: a type and an id, the way `actions` records an
+// actor. The type is required because it is the namespace the id resolves in, and a value
+// nobody can be traced to is not a record of provenance. The id is nullable for the one
+// writer that resolves in no table — an import, until runs are tracked.
+//
+// Existing rows have a writer nobody can recover, so they go rather than get backfilled:
+// the feature is behind the `membersCustomFields` flag with no released data, and adding
+// a required column over them ends either in an error, as SQLite refuses one with no
+// default, or in an invented writer wherever the engine supplies its own empty string.
+module.exports = combineNonTransactionalMigrations(
+  createNonTransactionalMigration(
+    async function up(knex) {
+      if (!(await knex.schema.hasColumn(TABLE, 'written_by_type'))) {
+        logging.info(`Clearing ${TABLE} of values with no recorded writer`);
+        await knex(TABLE).del();
+      }
+    },
+    async function down() {
+      // Nothing to undo: the rows are gone, and dropping the columns below is what a
+      // rollback is for.
+    },
+  ),
+  createAddColumnMigration(TABLE, 'written_by_type', {
+    type: 'string',
+    maxlength: 50,
+    nullable: false,
+  }),
+  createAddColumnMigration(TABLE, 'written_by_id', {
+    type: 'string',
+    maxlength: 24,
+    nullable: true,
+  }),
+);
diff --git a/ghost/core/core/server/data/schema/schema.js b/ghost/core/core/server/data/schema/schema.js
index 75079092425..ade08d0f8e9 100644
--- a/ghost/core/core/server/data/schema/schema.js
+++ b/ghost/core/core/server/data/schema/schema.js
@@ -1096,6 +1096,23 @@ module.exports = {
     // column a fresh install bounds at 65,535 bytes. The bound matching long_text's
     // exactly is worth more than the schema restating what the write path enforces.
     value_text: { type: 'text', maxlength: 65535, nullable: true },
+    // Who wrote the value that is here now.
+    //
+    // Shaped like `actions`: a type and an id, no foreign key. A type because not every
+    // write comes through a binding — a person edits a member's fields, an import reads a
+    // file — and an id so the writer can be resolved back rather than merely named. A
+    // binding id resolves to the tier, the port and the field it routed into, which is
+    // everything worth knowing about how a value got here.
+    //
+    // No foreign key, because provenance has to outlive its cause: that a value arrived
+    // through a tier's shipping port stays true after someone deletes that binding, even
+    // though it stops being joinable.
+    //
+    // The type is the namespace the id resolves in, so every row carries one. The id is
+    // nullable for the one writer that resolves in no table: an import has none to give
+    // until runs are tracked.
+    written_by_type: { type: 'string', maxlength: 50, nullable: false },
+    written_by_id: { type: 'string', maxlength: 24, nullable: true },
     created_at: { type: 'dateTime', nullable: false },
     updated_at: { type: 'dateTime', nullable: true },
     // Named, because the name knex derives from the table and all three columns
diff --git a/ghost/core/core/server/data/seeders/importers/automation-action-revisions-importer.ts b/ghost/core/core/server/data/seeders/importers/automation-action-revisions-importer.ts
index fa6674e3f41..8e64429c5f0 100644
--- a/ghost/core/core/server/data/seeders/importers/automation-action-revisions-importer.ts
+++ b/ghost/core/core/server/data/seeders/importers/automation-action-revisions-importer.ts
@@ -2,7 +2,7 @@ import { faker } from '@faker-js/faker';
 import errors from '@tryghost/errors';
 import type { Knex } from 'knex';
 import { TableImporter } from './table-importer';
-import { fromDatabaseDate, toDatabaseDate } from '../../../lib/db-date';
+import { fromDatabaseDate, toDatabaseDate } from '../../../lib/db-types/date';
 import { DEFAULT_EMAIL_DESIGN_SETTING_SLUG } from '../../../services/member-welcome-emails/constants';
 
 type AutomationAction = {
diff --git a/ghost/core/core/server/data/seeders/importers/automation-actions-importer.ts b/ghost/core/core/server/data/seeders/importers/automation-actions-importer.ts
index 9fe4265ee79..18f95159d77 100644
--- a/ghost/core/core/server/data/seeders/importers/automation-actions-importer.ts
+++ b/ghost/core/core/server/data/seeders/importers/automation-actions-importer.ts
@@ -1,7 +1,7 @@
 import errors from '@tryghost/errors';
 import type { Knex } from 'knex';
 import { TableImporter } from './table-importer';
-import { toDatabaseDate } from '../../../lib/db-date';
+import { toDatabaseDate } from '../../../lib/db-types/date';
 import { randomDateBetween } from '../utils/random';
 
 type Automation = {
diff --git a/ghost/core/core/server/data/seeders/importers/automation-run-steps-importer.ts b/ghost/core/core/server/data/seeders/importers/automation-run-steps-importer.ts
index a4734e06e18..620fb4a623b 100644
--- a/ghost/core/core/server/data/seeders/importers/automation-run-steps-importer.ts
+++ b/ghost/core/core/server/data/seeders/importers/automation-run-steps-importer.ts
@@ -3,7 +3,7 @@ import errors from '@tryghost/errors';
 import { clamp } from 'lodash';
 import type { Knex } from 'knex';
 import { TableImporter } from './table-importer';
-import { fromDatabaseDate, toDatabaseDate } from '../../../lib/db-date';
+import { fromDatabaseDate, toDatabaseDate } from '../../../lib/db-types/date';
 
 type AutomationRun = {
   id: string;
diff --git a/ghost/core/core/server/data/seeders/importers/automation-runs-importer.ts b/ghost/core/core/server/data/seeders/importers/automation-runs-importer.ts
index 64663b389f8..3e871938543 100644
--- a/ghost/core/core/server/data/seeders/importers/automation-runs-importer.ts
+++ b/ghost/core/core/server/data/seeders/importers/automation-runs-importer.ts
@@ -4,7 +4,7 @@ import assert from 'node:assert/strict';
 import type { Knex } from 'knex';
 import { TableImporter } from './table-importer';
 import { parseEmailAddress } from '@tryghost/parse-email-address';
-import { fromDatabaseDate, toDatabaseDate } from '../../../lib/db-date';
+import { fromDatabaseDate, toDatabaseDate } from '../../../lib/db-types/date';
 import { randomDateBetween } from '../utils/random';
 
 type Automation = {
diff --git a/ghost/core/core/server/data/seeders/importers/automations-importer.ts b/ghost/core/core/server/data/seeders/importers/automations-importer.ts
index 3799647d290..925db92a5ac 100644
--- a/ghost/core/core/server/data/seeders/importers/automations-importer.ts
+++ b/ghost/core/core/server/data/seeders/importers/automations-importer.ts
@@ -5,7 +5,7 @@ import type { Knex } from 'knex';
 import { TableImporter } from './table-importer';
 // @ts-expect-error This module currently lacks type definitions.
 import { blogStartDate } from '../utils/blog-info';
-import { toDatabaseDate } from '../../../lib/db-date';
+import { toDatabaseDate } from '../../../lib/db-types/date';
 import { MEMBER_WELCOME_EMAIL_SLUGS } from '../../../services/member-welcome-emails/constants';
 
 type Automation = {
diff --git a/ghost/core/core/server/data/seeders/importers/comment-reports-importer.js b/ghost/core/core/server/data/seeders/importers/comment-reports-importer.js
index 1924b8fa176..57e6d3fa7c6 100644
--- a/ghost/core/core/server/data/seeders/importers/comment-reports-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/comment-reports-importer.js
@@ -1,7 +1,7 @@
 const { TableImporter } = require('./table-importer');
 const { faker } = require('@faker-js/faker');
 const { luck, randomDateBetween } = require('../utils/random');
-const { toDatabaseDate } = require('../../../lib/db-date');
+const { toDatabaseDate } = require('../../../lib/db-types/date');
 
 class CommentReportsImporter extends TableImporter {
   static table = 'comment_reports';
diff --git a/ghost/core/core/server/data/seeders/importers/comments-importer.js b/ghost/core/core/server/data/seeders/importers/comments-importer.js
index 533ab3eee29..3b71fbe62df 100644
--- a/ghost/core/core/server/data/seeders/importers/comments-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/comments-importer.js
@@ -2,7 +2,7 @@ const { faker } = require('@faker-js/faker');
 const { TableImporter } = require('./table-importer');
 const { luck } = require('../utils/random');
 const generateEvents = require('../utils/event-generator');
-const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-date');
+const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-types/date');
 
 class CommentsImporter extends TableImporter {
   static table = 'comments';
diff --git a/ghost/core/core/server/data/seeders/importers/email-batches-importer.js b/ghost/core/core/server/data/seeders/importers/email-batches-importer.js
index 76e2c7e8137..5c4e09b8d26 100644
--- a/ghost/core/core/server/data/seeders/importers/email-batches-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/email-batches-importer.js
@@ -1,7 +1,7 @@
 const { TableImporter } = require('./table-importer');
 const { faker } = require('@faker-js/faker');
 const { randomDateBetween } = require('../utils/random');
-const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-date');
+const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-types/date');
 
 class EmailBatchesImporter extends TableImporter {
   static table = 'email_batches';
diff --git a/ghost/core/core/server/data/seeders/importers/email-recipients-importer.js b/ghost/core/core/server/data/seeders/importers/email-recipients-importer.js
index 89c51d7c9ac..6ec8e3dc745 100644
--- a/ghost/core/core/server/data/seeders/importers/email-recipients-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/email-recipients-importer.js
@@ -2,7 +2,7 @@ const { TableImporter } = require('./table-importer');
 const { faker } = require('@faker-js/faker');
 const generateEvents = require('../utils/event-generator');
 const { randomDateBetween } = require('../utils/random');
-const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-date');
+const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-types/date');
 const debug = require('@tryghost/debug')('EmailRecipientsImporter');
 
 const emailStatus = {
diff --git a/ghost/core/core/server/data/seeders/importers/emails-importer.js b/ghost/core/core/server/data/seeders/importers/emails-importer.js
index 03689c80bef..043bd904ecf 100644
--- a/ghost/core/core/server/data/seeders/importers/emails-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/emails-importer.js
@@ -2,7 +2,7 @@ const { TableImporter } = require('./table-importer');
 const { faker } = require('@faker-js/faker');
 const generateEvents = require('../utils/event-generator');
 const { luck } = require('../utils/random');
-const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-date');
+const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-types/date');
 
 class EmailsImporter extends TableImporter {
   static table = 'emails';
diff --git a/ghost/core/core/server/data/seeders/importers/labels-importer.js b/ghost/core/core/server/data/seeders/importers/labels-importer.js
index 185dc96fe22..f2e028afab5 100644
--- a/ghost/core/core/server/data/seeders/importers/labels-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/labels-importer.js
@@ -2,7 +2,7 @@ const { TableImporter } = require('./table-importer');
 const { faker } = require('@faker-js/faker');
 const { slugify } = require('@tryghost/string');
 const { blogStartDate } = require('../utils/blog-info');
-const { toDatabaseDate } = require('../../../lib/db-date');
+const { toDatabaseDate } = require('../../../lib/db-types/date');
 
 class LabelsImporter extends TableImporter {
   static table = 'labels';
diff --git a/ghost/core/core/server/data/seeders/importers/members-click-events-importer.js b/ghost/core/core/server/data/seeders/importers/members-click-events-importer.js
index da3a60f0713..8e31f781990 100644
--- a/ghost/core/core/server/data/seeders/importers/members-click-events-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/members-click-events-importer.js
@@ -1,7 +1,7 @@
 const { TableImporter } = require('./table-importer');
 const { faker } = require('@faker-js/faker');
 const { luck, randomDateBetween } = require('../utils/random');
-const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-date');
+const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-types/date');
 
 class MembersClickEventsImporter extends TableImporter {
   static table = 'members_click_events';
diff --git a/ghost/core/core/server/data/seeders/importers/members-created-events-importer.js b/ghost/core/core/server/data/seeders/importers/members-created-events-importer.js
index 548ee0c0612..75a86f53a62 100644
--- a/ghost/core/core/server/data/seeders/importers/members-created-events-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/members-created-events-importer.js
@@ -1,7 +1,7 @@
 const { TableImporter } = require('./table-importer');
 const { faker } = require('@faker-js/faker');
 const { luck } = require('../utils/random');
-const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-date');
+const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-types/date');
 
 class MembersCreatedEventsImporter extends TableImporter {
   static table = 'members_created_events';
diff --git a/ghost/core/core/server/data/seeders/importers/members-feedback-importer.js b/ghost/core/core/server/data/seeders/importers/members-feedback-importer.js
index f5b533228e8..ce861a20e17 100644
--- a/ghost/core/core/server/data/seeders/importers/members-feedback-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/members-feedback-importer.js
@@ -1,6 +1,6 @@
 const { TableImporter } = require('./table-importer');
 const { luck, randomDateBetween } = require('../utils/random');
-const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-date');
+const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-types/date');
 
 class MembersFeedbackImporter extends TableImporter {
   static table = 'members_feedback';
diff --git a/ghost/core/core/server/data/seeders/importers/members-importer.js b/ghost/core/core/server/data/seeders/importers/members-importer.js
index b2b5942b33a..c00e6e8d56d 100644
--- a/ghost/core/core/server/data/seeders/importers/members-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/members-importer.js
@@ -4,7 +4,7 @@ const { faker: americanFaker } = require('@faker-js/faker/locale/en_US');
 const { blogStartDate: startTime } = require('../utils/blog-info');
 const generateEvents = require('../utils/event-generator');
 const { luck } = require('../utils/random');
-const { toDatabaseDate } = require('../../../lib/db-date');
+const { toDatabaseDate } = require('../../../lib/db-types/date');
 const debug = require('@tryghost/debug')('MembersImporter');
 
 class MembersImporter extends TableImporter {
diff --git a/ghost/core/core/server/data/seeders/importers/members-login-events-importer.js b/ghost/core/core/server/data/seeders/importers/members-login-events-importer.js
index 394be31bf88..2e0c7403af2 100644
--- a/ghost/core/core/server/data/seeders/importers/members-login-events-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/members-login-events-importer.js
@@ -1,7 +1,7 @@
 const { TableImporter } = require('./table-importer');
 const { luck } = require('../utils/random');
 const generateEvents = require('../utils/event-generator');
-const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-date');
+const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-types/date');
 
 class MembersLoginEventsImporter extends TableImporter {
   static table = 'members_login_events';
diff --git a/ghost/core/core/server/data/seeders/importers/members-products-importer.js b/ghost/core/core/server/data/seeders/importers/members-products-importer.js
index 13ea81080fa..48dadd82a03 100644
--- a/ghost/core/core/server/data/seeders/importers/members-products-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/members-products-importer.js
@@ -1,7 +1,7 @@
 const { faker } = require('@faker-js/faker');
 const { TableImporter } = require('./table-importer');
 const { luck } = require('../utils/random');
-const { toDatabaseDate } = require('../../../lib/db-date');
+const { toDatabaseDate } = require('../../../lib/db-types/date');
 
 class MembersProductsImporter extends TableImporter {
   static table = 'members_products';
diff --git a/ghost/core/core/server/data/seeders/importers/members-status-events-importer.js b/ghost/core/core/server/data/seeders/importers/members-status-events-importer.js
index 91abda2acd3..fa94b04bd8a 100644
--- a/ghost/core/core/server/data/seeders/importers/members-status-events-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/members-status-events-importer.js
@@ -1,6 +1,6 @@
 const { TableImporter } = require('./table-importer');
 const { randomDateBetween } = require('../utils/random');
-const { toDatabaseDate } = require('../../../lib/db-date');
+const { toDatabaseDate } = require('../../../lib/db-types/date');
 
 class MembersStatusEventsImporter extends TableImporter {
   static table = 'members_status_events';
diff --git a/ghost/core/core/server/data/seeders/importers/members-stripe-customers-importer.js b/ghost/core/core/server/data/seeders/importers/members-stripe-customers-importer.js
index 746c519f99b..132caa85d5e 100644
--- a/ghost/core/core/server/data/seeders/importers/members-stripe-customers-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/members-stripe-customers-importer.js
@@ -1,6 +1,6 @@
 const { faker } = require('@faker-js/faker');
 const { TableImporter } = require('./table-importer');
-const { fromDatabaseDate } = require('../../../lib/db-date');
+const { fromDatabaseDate } = require('../../../lib/db-types/date');
 
 class MembersStripeCustomersImporter extends TableImporter {
   static table = 'members_stripe_customers';
diff --git a/ghost/core/core/server/data/seeders/importers/members-stripe-customers-subscriptions-importer.js b/ghost/core/core/server/data/seeders/importers/members-stripe-customers-subscriptions-importer.js
index ad6943c891f..d898d9067fd 100644
--- a/ghost/core/core/server/data/seeders/importers/members-stripe-customers-subscriptions-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/members-stripe-customers-subscriptions-importer.js
@@ -2,7 +2,7 @@ const { faker } = require('@faker-js/faker');
 const { TableImporter } = require('./table-importer');
 const generateEvents = require('../utils/event-generator');
 const { luck } = require('../utils/random');
-const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-date');
+const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-types/date');
 
 class MembersStripeCustomersSubscriptionsImporter extends TableImporter {
   static table = 'members_stripe_customers_subscriptions';
diff --git a/ghost/core/core/server/data/seeders/importers/members-subscribe-events-importer.js b/ghost/core/core/server/data/seeders/importers/members-subscribe-events-importer.js
index 807679b80ed..58ee7f187c2 100644
--- a/ghost/core/core/server/data/seeders/importers/members-subscribe-events-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/members-subscribe-events-importer.js
@@ -1,6 +1,6 @@
 const { TableImporter } = require('./table-importer');
 const { luck, randomDateBetween } = require('../utils/random');
-const { toDatabaseDate } = require('../../../lib/db-date');
+const { toDatabaseDate } = require('../../../lib/db-types/date');
 
 class MembersSubscribeEventsImporter extends TableImporter {
   static table = 'members_subscribe_events';
diff --git a/ghost/core/core/server/data/seeders/importers/members-subscription-created-events-importer.js b/ghost/core/core/server/data/seeders/importers/members-subscription-created-events-importer.js
index c9cab3d714b..a422a14e2be 100644
--- a/ghost/core/core/server/data/seeders/importers/members-subscription-created-events-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/members-subscription-created-events-importer.js
@@ -1,7 +1,7 @@
 const { TableImporter } = require('./table-importer');
 const { faker } = require('@faker-js/faker');
 const { luck } = require('../utils/random');
-const { fromDatabaseDate } = require('../../../lib/db-date');
+const { fromDatabaseDate } = require('../../../lib/db-types/date');
 
 class MembersSubscriptionCreatedEventsImporter extends TableImporter {
   static table = 'members_subscription_created_events';
diff --git a/ghost/core/core/server/data/seeders/importers/offer-redemptions-importer.js b/ghost/core/core/server/data/seeders/importers/offer-redemptions-importer.js
index 2fdf72b4f73..4b9b88aad26 100644
--- a/ghost/core/core/server/data/seeders/importers/offer-redemptions-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/offer-redemptions-importer.js
@@ -2,7 +2,7 @@ const { faker } = require('@faker-js/faker');
 const errors = require('@tryghost/errors');
 const { TableImporter } = require('./table-importer');
 const { randomDateBetween } = require('../utils/random');
-const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-date');
+const { fromDatabaseDate, toDatabaseDate } = require('../../../lib/db-types/date');
 
 class OfferRedemptionsImporter extends TableImporter {
   static table = 'offer_redemptions';
diff --git a/ghost/core/core/server/data/seeders/importers/offers-importer.js b/ghost/core/core/server/data/seeders/importers/offers-importer.js
index bd3740569e2..99c655d6f77 100644
--- a/ghost/core/core/server/data/seeders/importers/offers-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/offers-importer.js
@@ -1,7 +1,7 @@
 const { TableImporter } = require('./table-importer');
 const { slugify } = require('@tryghost/string');
 const { blogStartDate } = require('../utils/blog-info');
-const { toDatabaseDate } = require('../../../lib/db-date');
+const { toDatabaseDate } = require('../../../lib/db-types/date');
 
 const offerTemplates = [
   {
diff --git a/ghost/core/core/server/data/seeders/importers/posts-importer.js b/ghost/core/core/server/data/seeders/importers/posts-importer.js
index 89c6859f4b0..031f0c9aa62 100644
--- a/ghost/core/core/server/data/seeders/importers/posts-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/posts-importer.js
@@ -2,7 +2,7 @@ const { faker } = require('@faker-js/faker');
 const { slugify } = require('@tryghost/string');
 const { luck } = require('../utils/random');
 const { TableImporter } = require('./table-importer');
-const { toDatabaseDate } = require('../../../lib/db-date');
+const { toDatabaseDate } = require('../../../lib/db-types/date');
 
 class PostsImporter extends TableImporter {
   static table = 'posts';
diff --git a/ghost/core/core/server/data/seeders/importers/table-importer.ts b/ghost/core/core/server/data/seeders/importers/table-importer.ts
index dab966a6f86..c336f02aab6 100644
--- a/ghost/core/core/server/data/seeders/importers/table-importer.ts
+++ b/ghost/core/core/server/data/seeders/importers/table-importer.ts
@@ -1,5 +1,5 @@
 import debugFactory from '@tryghost/debug';
-import { toDatabaseDate } from '../../../lib/db-date';
+import { toDatabaseDate } from '../../../lib/db-types/date';
 import path from 'node:path';
 import fs from 'node:fs';
 import papaparse from 'papaparse';
diff --git a/ghost/core/core/server/data/seeders/importers/tags-importer.js b/ghost/core/core/server/data/seeders/importers/tags-importer.js
index 78fb2152cb2..b223e43cbec 100644
--- a/ghost/core/core/server/data/seeders/importers/tags-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/tags-importer.js
@@ -1,7 +1,7 @@
 const { faker } = require('@faker-js/faker');
 const { slugify } = require('@tryghost/string');
 const { TableImporter } = require('./table-importer');
-const { toDatabaseDate } = require('../../../lib/db-date');
+const { toDatabaseDate } = require('../../../lib/db-types/date');
 
 class TagsImporter extends TableImporter {
   static table = 'tags';
diff --git a/ghost/core/core/server/data/seeders/importers/users-importer.js b/ghost/core/core/server/data/seeders/importers/users-importer.js
index b7e2392623d..d65e063a29a 100644
--- a/ghost/core/core/server/data/seeders/importers/users-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/users-importer.js
@@ -2,7 +2,7 @@ const { TableImporter } = require('./table-importer');
 const { faker } = require('@faker-js/faker');
 const { slugify } = require('@tryghost/string');
 const security = require('@tryghost/security');
-const { toDatabaseDate } = require('../../../lib/db-date');
+const { toDatabaseDate } = require('../../../lib/db-types/date');
 
 class UsersImporter extends TableImporter {
   static table = 'users';
diff --git a/ghost/core/core/server/data/seeders/importers/web-mentions-importer.js b/ghost/core/core/server/data/seeders/importers/web-mentions-importer.js
index e8dfbc297bd..d9f7404fca2 100644
--- a/ghost/core/core/server/data/seeders/importers/web-mentions-importer.js
+++ b/ghost/core/core/server/data/seeders/importers/web-mentions-importer.js
@@ -1,6 +1,6 @@
 const { TableImporter } = require('./table-importer');
 const { faker } = require('@faker-js/faker');
-const { toDatabaseDate } = require('../../../lib/db-date');
+const { toDatabaseDate } = require('../../../lib/db-types/date');
 
 class WebMentionsImporter extends TableImporter {
   static table = 'mentions';
diff --git a/ghost/core/core/server/data/seeders/utils/random.ts b/ghost/core/core/server/data/seeders/utils/random.ts
index 3a92cefd353..e73fc361c74 100644
--- a/ghost/core/core/server/data/seeders/utils/random.ts
+++ b/ghost/core/core/server/data/seeders/utils/random.ts
@@ -1,5 +1,5 @@
 import { faker } from '@faker-js/faker';
-import { fromDatabaseDate, type DatabaseDate } from '../../../lib/db-date';
+import { fromDatabaseDate, type DatabaseDate } from '../../../lib/db-types/date';
 
 /**
  * Adds another degree of randomness into some decisions
diff --git a/ghost/core/core/server/lib/db-types/boolean.ts b/ghost/core/core/server/lib/db-types/boolean.ts
new file mode 100644
index 00000000000..4845ac72b4a
--- /dev/null
+++ b/ghost/core/core/server/lib/db-types/boolean.ts
@@ -0,0 +1,16 @@
+import { z } from 'zod';
+
+/**
+ * A boolean column, whichever engine handed it back.
+ *
+ * SQLite has no boolean type and answers with 0 or 1; MySQL answers with a boolean. Every
+ * read normalises so nothing downstream has to know which database it is talking to, and
+ * so a falsy check never has to reason about the number zero.
+ *
+ * Encoding leaves the value alone: a boolean column takes a boolean, and takes the 0 or 1
+ * it gave us just as happily.
+ */
+export const DbBoolean = z.codec(z.union([z.boolean(), z.number()]), z.boolean(), {
+  decode: (stored) => Boolean(stored),
+  encode: (value) => value,
+});
diff --git a/ghost/core/core/server/lib/db-date.ts b/ghost/core/core/server/lib/db-types/date.ts
similarity index 100%
rename from ghost/core/core/server/lib/db-date.ts
rename to ghost/core/core/server/lib/db-types/date.ts
diff --git a/ghost/core/core/server/services/automations/database-automations-repository.ts b/ghost/core/core/server/services/automations/database-automations-repository.ts
index f40021c8c28..04ac4c7fb79 100644
--- a/ghost/core/core/server/services/automations/database-automations-repository.ts
+++ b/ghost/core/core/server/services/automations/database-automations-repository.ts
@@ -25,7 +25,7 @@ import type {
   EditAutomationData,
   Page,
 } from './automations-repository';
-import { fromDatabaseDate, toDatabaseDate, type DatabaseDate } from '../../lib/db-date';
+import { fromDatabaseDate, toDatabaseDate, type DatabaseDate } from '../../lib/db-types/date';
 import { getStaleLockCutoff } from './stale-lock-cutoff';
 import type { ExclusifyUnion, ReadonlyDeep } from 'type-fest';
 
diff --git a/ghost/core/core/server/services/content-import/import/importer.ts b/ghost/core/core/server/services/content-import/import/importer.ts
index 51827daaa9f..d870b854123 100644
--- a/ghost/core/core/server/services/content-import/import/importer.ts
+++ b/ghost/core/core/server/services/content-import/import/importer.ts
@@ -7,6 +7,7 @@ import buildPostData, {
   type PostData,
 } from './post-data';
 import type { PostImportRow } from './row';
+import type { PostsRepository, WrittenPost } from './post-repository';
 import type { ImportRequest } from './schema';
 import type { Clock, ImportRunStore, RowOutcome } from './store';
 import type { PreparedImportSource } from './source';
@@ -27,15 +28,6 @@ export interface ImportAccepted {
   total: number;
 }
 
-export interface CreatedPost {
-  id: string;
-  toJSON(): Record<string, unknown>;
-}
-
-export interface PostsRepository {
-  create(data: PostData, options: object): Promise<CreatedPost>;
-}
-
 // Must not throw: it is called from catch blocks that exist to stop an error escaping.
 export type FailureReporter = (error: unknown) => void;
 
@@ -47,7 +39,7 @@ const messages = {
   tooManyPosts:
     'This file contains more than {max} posts. Imports are temporarily limited to {max} posts at a time — please split the file into smaller files and try again.',
   allWritesFailed: 'Content import failed to write all {count} attempted {postNoun}.',
-  urlResolutionFailed: 'Content import could not resolve a URL for {count} created {postNoun}.',
+  urlResolutionFailed: 'Content import could not resolve a URL for {count} imported {postNoun}.',
 };
 
 function logLifecycle(message: string): void {
@@ -71,7 +63,7 @@ interface ImporterDeps {
   addJob: (job: { job: () => Promise<void>; offloaded: boolean; name: string }) => void;
   report: FailureReporter;
   store: ImportRunStore;
-  urlForPost: (post: CreatedPost) => string;
+  urlForPost: (post: WrittenPost) => string;
   newRunId: () => string;
   getTimezone: () => string;
   now?: Clock;
@@ -94,7 +86,7 @@ class ContentCSVImporter {
   private _addJob: ImporterDeps['addJob'];
   private _report: FailureReporter;
   private _store: ImportRunStore;
-  private _urlForPost: (post: CreatedPost) => string;
+  private _urlForPost: (post: WrittenPost) => string;
   private _newRunId: () => string;
   private _getTimezone: () => string;
   private _now: Clock;
@@ -194,7 +186,6 @@ class ContentCSVImporter {
       const htmlToLexical = this._getHtmlToLexical();
       const markdownToHtml = this._getMarkdownToHtml();
       const cleanHTML = this._getCleanHTML();
-      let attemptedWrites = 0;
       let successfulWrites = 0;
       let failedWrites = 0;
       let firstWriteFailure: unknown;
@@ -221,8 +212,9 @@ class ContentCSVImporter {
           throw error;
         }
 
-        attemptedWrites += 1;
-        let post: CreatedPost;
+        let post: WrittenPost;
+        let writeStatus: 'created' | 'updated';
+        let warnings: string[];
         try {
           // options.importing preserves the supplied timestamps and keeps the import silent:
           // the webhook, Slack, IndexNow and mention consumers all stand down on it, and a
@@ -230,10 +222,33 @@ class ContentCSVImporter {
           // it, one reason status is never 'scheduled'). Pinned by
           // test/e2e-webhooks/posts-importer.test.js. A fresh options object per row: the
           // model layer mutates it.
-          post = await this._posts.create(data, {
-            importing: true,
-            context: { internal: true },
-          });
+          const result = await this._posts.write(
+            data,
+            {
+              importing: true,
+              context: { internal: true },
+            },
+            {
+              sourceUpdatedAt: row.updated_at,
+              authorNames: row.authors,
+              authorEmails: row.author_emails,
+              tagNames: row.tags,
+            },
+          );
+
+          if (result.status === 'skipped') {
+            this._store.record(runId, {
+              line,
+              title: row.title,
+              status: 'skipped',
+              reason: result.reason,
+            });
+            continue;
+          }
+
+          post = result.post;
+          writeStatus = result.status;
+          warnings = result.warnings;
           successfulWrites += 1;
         } catch (error) {
           if (failedWrites === 0) {
@@ -252,8 +267,9 @@ class ContentCSVImporter {
         const outcome: RowOutcome = {
           line,
           title: row.title,
-          status: 'created',
+          status: writeStatus,
           postId: post.id,
+          ...(warnings.length > 0 ? { warnings } : {}),
         };
         try {
           outcome.url = this._urlForPost(post);
@@ -266,7 +282,7 @@ class ContentCSVImporter {
         this._store.record(runId, outcome);
       }
 
-      if (attemptedWrites > 0 && successfulWrites === 0 && failedWrites === attemptedWrites) {
+      if (failedWrites > 0 && successfulWrites === 0) {
         this._report(
           new errors.InternalServerError({
             message: tpl(messages.allWritesFailed, {
diff --git a/ghost/core/core/server/services/content-import/import/post-data.ts b/ghost/core/core/server/services/content-import/import/post-data.ts
index 4792f0db7c7..4265676185d 100644
--- a/ghost/core/core/server/services/content-import/import/post-data.ts
+++ b/ghost/core/core/server/services/content-import/import/post-data.ts
@@ -36,6 +36,7 @@ export interface PostsMetaData {
 export interface PostData {
   title: string;
   slug: string;
+  comment_id?: string;
   lexical?: string;
   custom_excerpt?: string;
   feature_image?: string;
@@ -51,11 +52,13 @@ export interface PostData {
   status: 'draft' | 'published';
   type: 'post' | 'page';
   visibility: 'public' | 'members' | 'paid';
-  tags: Array<{ name: string }>;
+  authors?: Array<{ id: string }>;
+  tags: Array<{ id: string } | { name: string }>;
   posts_meta?: PostsMetaData;
 }
 
 const DIRECT_OPTIONAL_FIELDS = [
+  'comment_id',
   'custom_excerpt',
   'feature_image',
   'canonical_url',
diff --git a/ghost/core/core/server/services/content-import/import/post-repository.ts b/ghost/core/core/server/services/content-import/import/post-repository.ts
new file mode 100644
index 00000000000..4e2d46ef47d
--- /dev/null
+++ b/ghost/core/core/server/services/content-import/import/post-repository.ts
@@ -0,0 +1,138 @@
+import type { PostData } from './post-data';
+import {
+  BookshelfPostRelationsResolver,
+  type PostRelationSource,
+  type PostRelationsResolver,
+  type RelationModels,
+} from './relations';
+
+export interface WrittenPost {
+  id: string;
+  toJSON(): Record<string, unknown>;
+}
+
+export type PostWriteResult =
+  | { status: 'created'; post: WrittenPost; warnings: string[] }
+  | { status: 'updated'; post: WrittenPost; warnings: string[] }
+  | { status: 'skipped'; reason: string };
+
+export interface PostWriteMetadata extends PostRelationSource {
+  sourceUpdatedAt?: string;
+}
+
+export interface PostsRepository {
+  write(data: PostData, options: object, metadata?: PostWriteMetadata): Promise<PostWriteResult>;
+}
+
+interface Models extends RelationModels {
+  Base: {
+    transaction<T>(callback: (transacting: object) => Promise<T>): Promise<T>;
+  };
+  Post: {
+    findOne(data: object, options: object): Promise<WrittenPost | null>;
+    add(data: PostData, options: object): Promise<WrittenPost>;
+    edit(data: object, options: object): Promise<WrittenPost>;
+  };
+}
+
+export class BookshelfPostsRepository implements PostsRepository {
+  private _models: Models;
+  private _relations: PostRelationsResolver;
+
+  constructor(
+    models: Models,
+    relations: PostRelationsResolver = new BookshelfPostRelationsResolver(models),
+  ) {
+    this._models = models;
+    this._relations = relations;
+  }
+
+  write(
+    data: PostData,
+    options: object,
+    metadata: PostWriteMetadata = {},
+  ): Promise<PostWriteResult> {
+    return this._models.Base.transaction(async (transacting) => {
+      const writeOptions = { ...options, transacting };
+      const lookupOptions = { ...writeOptions, forUpdate: true };
+      let existingMatch: { post: WrittenPost; duplicateReason: string } | undefined;
+
+      if (data.comment_id) {
+        const existing = await this._models.Post.findOne(
+          { comment_id: data.comment_id, status: 'all' },
+          lookupOptions,
+        );
+
+        if (existing) {
+          existingMatch = {
+            post: existing,
+            duplicateReason: `A post with the source ID "${data.comment_id}" already exists.`,
+          };
+        }
+      }
+
+      if (!existingMatch) {
+        const existing = await this._models.Post.findOne(
+          { slug: data.slug, status: 'all' },
+          lookupOptions,
+        );
+
+        if (existing) {
+          existingMatch = {
+            post: existing,
+            duplicateReason: `A post with the slug "${data.slug}" already exists.`,
+          };
+        }
+      }
+
+      if (existingMatch) {
+        const { post: existing, duplicateReason } = existingMatch;
+        if (!metadata.sourceUpdatedAt) {
+          return { status: 'skipped', reason: duplicateReason };
+        }
+
+        const incomingInstant = new Date(metadata.sourceUpdatedAt).getTime();
+        const storedUpdatedAt = existing.toJSON().updated_at;
+        const storedInstant = storedUpdatedAt
+          ? new Date(storedUpdatedAt as string | number | Date).getTime()
+          : undefined;
+
+        if (
+          Number.isNaN(incomingInstant) ||
+          (storedInstant !== undefined && incomingInstant <= storedInstant)
+        ) {
+          return {
+            status: 'skipped',
+            reason: 'The existing post is newer than or as recent as the imported row.',
+          };
+        }
+
+        // Ghost's collision plugin treats updated_at as the client's version token.
+        // First update the content against the locked server version, then persist
+        // the incoming source timestamp on its own. The second edit is safe because
+        // timestamp-only importing edits are excluded from collision detection.
+        const resolved = await this._relations.resolve(data, metadata, writeOptions);
+        const collisionSafeData: Record<string, unknown> = { ...resolved.data };
+        if (storedUpdatedAt) {
+          collisionSafeData.updated_at = storedUpdatedAt;
+        } else {
+          delete collisionSafeData.updated_at;
+        }
+        const editOptions = {
+          ...writeOptions,
+          id: existing.id,
+        };
+        await this._models.Post.edit(collisionSafeData, { ...editOptions });
+        const post = await this._models.Post.edit(
+          { updated_at: metadata.sourceUpdatedAt },
+          { ...editOptions },
+        );
+        return { status: 'updated', post, warnings: resolved.warnings };
+      }
+
+      const resolved = await this._relations.resolve(data, metadata, writeOptions);
+      const post = await this._models.Post.add(resolved.data, writeOptions);
+      return { status: 'created', post, warnings: resolved.warnings };
+    });
+  }
+}
diff --git a/ghost/core/core/server/services/content-import/import/relations.ts b/ghost/core/core/server/services/content-import/import/relations.ts
new file mode 100644
index 00000000000..b37d5674804
--- /dev/null
+++ b/ghost/core/core/server/services/content-import/import/relations.ts
@@ -0,0 +1,224 @@
+import type { PostData } from './post-data';
+
+const { slugify } = require('@tryghost/string');
+const validator = require('@tryghost/validator');
+
+interface RelationModel {
+  id: string;
+}
+
+export interface RelationModels {
+  User: {
+    findOne(data: object, options: object): Promise<RelationModel | null>;
+    getByEmail(email: string, options: object): Promise<RelationModel | undefined>;
+    add(data: object, options: object): Promise<RelationModel>;
+    getOwnerUser(options: object): Promise<RelationModel>;
+  };
+  Tag: {
+    findOne(data: object, options: object): Promise<RelationModel | null>;
+    add(data: object, options: object): Promise<RelationModel>;
+  };
+}
+
+export interface PostRelationSource {
+  authorNames?: string;
+  authorEmails?: string;
+  tagNames?: string;
+}
+
+export interface AuthorReference {
+  name?: string;
+  email?: string;
+}
+
+export interface PostRelationsResolver {
+  resolve(data: PostData, source: PostRelationSource, options: object): Promise<ResolvedRelations>;
+}
+
+export interface ResolvedRelations {
+  data: PostData;
+  warnings: string[];
+}
+
+export function parseAuthorReferences(
+  authorNames?: string,
+  authorEmails?: string,
+): AuthorReference[] {
+  const names = splitList(authorNames);
+  const emails = splitList(authorEmails);
+  return Array.from({ length: Math.max(names.length, emails.length) }, (_, index) => ({
+    ...(names[index] ? { name: names[index] } : {}),
+    ...(emails[index] ? { email: emails[index] } : {}),
+  }));
+}
+
+export function parseTagReferences(tagNames?: string): string[] {
+  return splitList(tagNames).filter((tag): tag is string => Boolean(tag));
+}
+
+export class BookshelfPostRelationsResolver implements PostRelationsResolver {
+  private _models: RelationModels;
+
+  constructor(models: RelationModels) {
+    this._models = models;
+  }
+
+  async resolve(
+    data: PostData,
+    source: PostRelationSource,
+    options: object,
+  ): Promise<ResolvedRelations> {
+    const { authors, warnings } = await this.resolveAuthors(source, options);
+    const tags = await this.resolveTags(source, options);
+    const resolved: PostData = {
+      ...data,
+      tags: [...tags, ...data.tags],
+    };
+
+    if (authors.length > 0) {
+      resolved.authors = authors;
+    }
+
+    return { data: resolved, warnings };
+  }
+
+  private async resolveAuthors(
+    source: PostRelationSource,
+    options: object,
+  ): Promise<{ authors: Array<{ id: string }>; warnings: string[] }> {
+    const authors: Array<{ id: string }> = [];
+    const warnings: string[] = [];
+    const seen = new Set<string>();
+    const authorsByEmail = new Map<string, RelationModel>();
+    let owner: RelationModel | undefined;
+
+    const useOwner = async (warning: string) => {
+      owner ??= await this._models.User.getOwnerUser({ ...options });
+      warnings.push(warning);
+      if (!seen.has(owner.id)) {
+        seen.add(owner.id);
+        authors.push({ id: owner.id });
+      }
+    };
+
+    for (const reference of parseAuthorReferences(source.authorNames, source.authorEmails)) {
+      let author: RelationModel | null = null;
+      if (reference.email) {
+        if (!validator.isEmail(reference.email)) {
+          await useOwner(`Author email "${reference.email}" is invalid; assigned Owner instead.`);
+          continue;
+        }
+
+        const emailKey = reference.email.toLowerCase();
+        author = authorsByEmail.get(emailKey) ?? null;
+        if (!author) {
+          author = (await this._models.User.getByEmail(emailKey, { ...options })) ?? null;
+        }
+
+        if (!author && reference.name) {
+          author = await this._models.User.add(
+            {
+              name: reference.name,
+              email: emailKey,
+              roles: ['Contributor'],
+            },
+            { ...options },
+          );
+        }
+
+        if (!author) {
+          await useOwner(`Author email "${reference.email}" has no name; assigned Owner instead.`);
+          continue;
+        }
+
+        authorsByEmail.set(emailKey, author);
+      } else if (reference.name) {
+        author = await this._models.User.findOne({ slug: slugify(reference.name) }, { ...options });
+
+        if (!author) {
+          await useOwner(`Author "${reference.name}" has no email; assigned Owner instead.`);
+          continue;
+        }
+      } else {
+        await useOwner('An empty author entry was assigned to Owner instead.');
+        continue;
+      }
+
+      if (author && !seen.has(author.id)) {
+        seen.add(author.id);
+        authors.push({ id: author.id });
+      }
+    }
+
+    return { authors, warnings };
+  }
+
+  private async resolveTags(
+    source: PostRelationSource,
+    options: object,
+  ): Promise<Array<{ id: string }>> {
+    const tags: Array<{ id: string }> = [];
+    const seen = new Set<string>();
+
+    for (const reference of parseTagReferences(source.tagNames)) {
+      const normalizedSlug = slugify(reference);
+      const lookups = [{ name: reference }, { slug: reference }];
+      if (normalizedSlug && normalizedSlug !== reference) {
+        lookups.push({ slug: normalizedSlug });
+      }
+
+      const findTag = async (lookupOptions: object = {}) => {
+        for (const lookup of lookups) {
+          const tag = await this._models.Tag.findOne(lookup, {
+            ...options,
+            ...lookupOptions,
+          });
+          if (tag) {
+            return tag;
+          }
+        }
+        return null;
+      };
+
+      let tag = await findTag();
+      if (!tag) {
+        try {
+          tag = await this._models.Tag.add({ name: reference }, { ...options });
+        } catch (error) {
+          if (!isUniqueConstraintError(error)) {
+            throw error;
+          }
+
+          // A concurrent row or import may have created the same slug after our
+          // lookup. A locking read sees that committed row under MySQL's default
+          // repeatable-read isolation, where another ordinary select may not.
+          tag = await findTag({ forUpdate: true });
+          if (!tag) {
+            throw error;
+          }
+        }
+      }
+
+      if (!seen.has(tag.id)) {
+        seen.add(tag.id);
+        tags.push({ id: tag.id });
+      }
+    }
+
+    return tags;
+  }
+}
+
+function splitList(value?: string): Array<string | undefined> {
+  return value?.split(',').map((part) => part.trim() || undefined) ?? [];
+}
+
+function isUniqueConstraintError(error: unknown): boolean {
+  const code =
+    typeof error === 'object' && error !== null && 'code' in error
+      ? (error as { code?: unknown }).code
+      : undefined;
+  return (
+    code === 'ER_DUP_ENTRY' || (typeof code === 'string' && code.startsWith('SQLITE_CONSTRAINT'))
+  );
+}
diff --git a/ghost/core/core/server/services/content-import/import/row.ts b/ghost/core/core/server/services/content-import/import/row.ts
index d5dbe4f8ea7..6eabd975872 100644
--- a/ghost/core/core/server/services/content-import/import/row.ts
+++ b/ghost/core/core/server/services/content-import/import/row.ts
@@ -14,6 +14,9 @@ export const EDITORIAL_POST_FIELDS = [
   'created_at',
   'updated_at',
   'published_at',
+  'authors',
+  'author_emails',
+  'tags',
   'feature_image',
   'feature_image_alt',
   'feature_image_caption',
@@ -27,6 +30,7 @@ export const EDITORIAL_POST_FIELDS = [
   'twitter_image',
   'twitter_title',
   'twitter_description',
+  'comment_id',
   'custom_template',
   'codeinjection_head',
   'codeinjection_foot',
@@ -58,6 +62,9 @@ export const postImportRowSchema = z
     created_at: optionalCell,
     updated_at: optionalCell,
     published_at: optionalCell,
+    authors: optionalCell,
+    author_emails: optionalCell,
+    tags: optionalCell,
     feature_image: optionalCell,
     feature_image_alt: optionalCell,
     feature_image_caption: optionalCell,
@@ -71,6 +78,7 @@ export const postImportRowSchema = z
     twitter_image: optionalCell,
     twitter_title: optionalCell,
     twitter_description: optionalCell,
+    comment_id: optionalCell,
     custom_template: optionalCell,
     codeinjection_head: optionalCell,
     codeinjection_foot: optionalCell,
@@ -99,6 +107,10 @@ export const importableRowSchema = postImportRowSchema.superRefine((row, ctx) =>
     ctx.addIssue({ code: 'custom', message: 'title must be 255 characters or fewer' });
   }
 
+  if (row.comment_id && row.comment_id.length > 50) {
+    ctx.addIssue({ code: 'custom', message: 'comment_id must be 50 characters or fewer' });
+  }
+
   for (const field of DATE_FIELDS) {
     const value = row[field];
     if (value && !isValidDate(value)) {
diff --git a/ghost/core/core/server/services/content-import/import/store.ts b/ghost/core/core/server/services/content-import/import/store.ts
index bdceece620b..a3c5c8a4318 100644
--- a/ghost/core/core/server/services/content-import/import/store.ts
+++ b/ghost/core/core/server/services/content-import/import/store.ts
@@ -6,7 +6,7 @@
 // failed = the write was attempted and lost.
 export type Clock = () => Date;
 
-export type RowStatus = 'created' | 'skipped' | 'failed';
+export type RowStatus = 'created' | 'updated' | 'skipped' | 'failed';
 
 export interface RowOutcome {
   // Source line number as a publisher sees it in a spreadsheet: the header is
@@ -15,6 +15,7 @@ export interface RowOutcome {
   title: string | null;
   status: RowStatus;
   reason?: string;
+  warnings?: string[];
   postId?: string;
   url?: string;
 }
diff --git a/ghost/core/core/server/services/content-import/index.ts b/ghost/core/core/server/services/content-import/index.ts
index 313597aea69..5ef2ed4ce6a 100644
--- a/ghost/core/core/server/services/content-import/index.ts
+++ b/ghost/core/core/server/services/content-import/index.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import ContentCSVImporter, { type ImportAccepted, type FailureReporter } from './import/importer';
+import { BookshelfPostsRepository } from './import/post-repository';
 import readPostRows from './import/reader';
 import { importRequestSchema, type ImportRequest } from './import/schema';
 import { ImportRunStore } from './import/store';
@@ -43,9 +44,7 @@ function makeImporter(): ContentCSVImporter {
   return new ContentCSVImporter({
     readRows: readPostRows,
     prepareSource: prepareImportSource,
-    posts: {
-      create: (data, options) => models.Post.add(data, options),
-    },
+    posts: new BookshelfPostsRepository(models),
     getHtmlToLexical: () => lexicalLib.htmlToLexicalConverter,
     getMarkdownToHtml: () => require('@tryghost/kg-markdown-html-renderer').render,
     getCleanHTML: () => require('@tryghost/mg-clean-html').cleanHTML,
diff --git a/ghost/core/core/server/services/gift-links/schema.ts b/ghost/core/core/server/services/gift-links/schema.ts
index ee43a292ca4..7db3f08bf59 100644
--- a/ghost/core/core/server/services/gift-links/schema.ts
+++ b/ghost/core/core/server/services/gift-links/schema.ts
@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import type { Knex } from 'knex';
-import { DbDate } from '../../lib/db-date';
+import { DbDate } from '../../lib/db-types/date';
 
 export const DbGiftLink = z.object({
   token: z.string(),
diff --git a/ghost/core/core/server/services/gifts/constants.ts b/ghost/core/core/server/services/gifts/constants.ts
index 2029b6c7c66..4ed76520f54 100644
--- a/ghost/core/core/server/services/gifts/constants.ts
+++ b/ghost/core/core/server/services/gifts/constants.ts
@@ -1,6 +1,6 @@
 export const GIFT_EXPIRY_DAYS = 365;
 // How far ahead a delivery may be scheduled. Portal's picker carries its own
-// copy (GIFT_MAX_SCHEDULE_DAYS in beta-gift-page.jsx) since Portal ships
+// copy (GIFT_MAX_SCHEDULE_DAYS in beta-gift-page.tsx) since Portal ships
 // separately — change them together.
 export const GIFT_MAX_SCHEDULE_DAYS = 365;
 // Site-local hour a scheduled delivery is sent at. Portal never derives
diff --git a/ghost/core/core/server/services/gifts/gift-bookshelf-repository.ts b/ghost/core/core/server/services/gifts/gift-bookshelf-repository.ts
index a843e34ef6c..d37f7e11819 100644
--- a/ghost/core/core/server/services/gifts/gift-bookshelf-repository.ts
+++ b/ghost/core/core/server/services/gifts/gift-bookshelf-repository.ts
@@ -4,7 +4,7 @@ import type { Knex } from 'knex';
 import { Gift } from './gift';
 import { decodeGiftRow, encodeGift } from './gift-codec';
 import type { GiftCadence, GiftRow } from './gift-schema';
-import { toDatabaseDate } from '../../lib/db-date';
+import { toDatabaseDate } from '../../lib/db-types/date';
 
 type ParsedNqlFilter = unknown;
 
diff --git a/ghost/core/core/server/services/gifts/gift-delivery-bookshelf-repository.ts b/ghost/core/core/server/services/gifts/gift-delivery-bookshelf-repository.ts
index 0b569901d42..331e2ea2ae2 100644
--- a/ghost/core/core/server/services/gifts/gift-delivery-bookshelf-repository.ts
+++ b/ghost/core/core/server/services/gifts/gift-delivery-bookshelf-repository.ts
@@ -1,6 +1,6 @@
 import errors from '@tryghost/errors';
 import type { Knex } from 'knex';
-import { fromDatabaseDate, toDatabaseDate } from '../../lib/db-date';
+import { fromDatabaseDate, toDatabaseDate } from '../../lib/db-types/date';
 import { decodeGiftRow } from './gift-codec';
 import { decodeGiftDeliveryRow, encodeGiftDelivery } from './gift-delivery-codec';
 import type { Gift } from './gift';
diff --git a/ghost/core/core/server/services/gifts/gift-delivery-schema.ts b/ghost/core/core/server/services/gifts/gift-delivery-schema.ts
index abe3d034f08..26b1785f914 100644
--- a/ghost/core/core/server/services/gifts/gift-delivery-schema.ts
+++ b/ghost/core/core/server/services/gifts/gift-delivery-schema.ts
@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { DbDate } from '../../lib/db-date';
+import { DbDate } from '../../lib/db-types/date';
 import type { CamelKeys } from '../../lib/case-keys';
 
 export const GiftDeliveryStatusSchema = z.enum([
diff --git a/ghost/core/core/server/services/gifts/gift-schema.ts b/ghost/core/core/server/services/gifts/gift-schema.ts
index 95fb483ceef..5fb65f2b642 100644
--- a/ghost/core/core/server/services/gifts/gift-schema.ts
+++ b/ghost/core/core/server/services/gifts/gift-schema.ts
@@ -1,6 +1,6 @@
 import type { OptionalKeysOf, SetOptional } from 'type-fest';
 import { z } from 'zod';
-import { DbDate } from '../../lib/db-date';
+import { DbDate } from '../../lib/db-types/date';
 import type { CamelKeys } from '../../lib/case-keys';
 
 export const GiftCadenceSchema = z.enum(['month', 'year']);
diff --git a/ghost/core/core/server/services/members-custom-fields/actions.ts b/ghost/core/core/server/services/members-custom-fields/actions.ts
index 9ae11d1b4ee..46bae821599 100644
--- a/ghost/core/core/server/services/members-custom-fields/actions.ts
+++ b/ghost/core/core/server/services/members-custom-fields/actions.ts
@@ -9,6 +9,25 @@ export interface RequestContext {
   actor: Actor | null;
 }
 
+/**
+ * Who is acting, read off an API frame's context.
+ *
+ * Here rather than in each endpoint, because two resources now record custom field history
+ * and a second reading of the same shape is a second chance to disagree about it. An
+ * integration and a user are both actors; a request that is neither — a webhook, a job —
+ * has none, and the history says so rather than guessing.
+ */
+export function actingContext(context: unknown): RequestContext {
+  const frame = (context ?? {}) as { user?: string; integration?: { id: string } };
+  if (frame.integration) {
+    return { actor: { id: frame.integration.id, type: 'integration' } };
+  }
+  if (frame.user) {
+    return { actor: { id: frame.user, type: 'user' } };
+  }
+  return { actor: null };
+}
+
 export interface ActionRecorder {
   add(data: Record<string, unknown>, options: { autoRefresh: boolean }): Promise<unknown>;
 }
diff --git a/ghost/core/core/server/services/members-custom-fields/index.ts b/ghost/core/core/server/services/members-custom-fields/index.ts
index 62b0b097240..546cd4d3d25 100644
--- a/ghost/core/core/server/services/members-custom-fields/index.ts
+++ b/ghost/core/core/server/services/members-custom-fields/index.ts
@@ -5,6 +5,8 @@ import { resolveMaxDefinitions } from './config';
 
 export type { CustomField } from './models';
 export type { RequestContext } from './actions';
+export { actingContext } from './actions';
+export type { WrittenBy } from './schema';
 
 // Two services from one module, split along an aggregate boundary rather than a
 // technical layer: `definitions` owns the field definitions, which belong to the
diff --git a/ghost/core/core/server/services/members-custom-fields/schema.ts b/ghost/core/core/server/services/members-custom-fields/schema.ts
index 8f29cef620e..1e401b3308c 100644
--- a/ghost/core/core/server/services/members-custom-fields/schema.ts
+++ b/ghost/core/core/server/services/members-custom-fields/schema.ts
@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import type { Knex } from 'knex';
 import { FieldTypeSchema } from '@tryghost/custom-field-types';
-import { DbDate } from '../../lib/db-date';
+import { DbDate } from '../../lib/db-types/date';
 
 // `archived` is soft: the field drops out of the values path but stays in the definition
 // list so it can be renamed, restored or deleted. Mirrors schema.js's `isIn` on the
@@ -27,6 +27,20 @@ type CustomFieldRank = { sort_order: number };
 
 type CustomFieldRow = z.infer<typeof DbCustomField> & CustomFieldRank;
 
+/**
+ * How a value arrived, not who caused it: who edited a member's fields is already an
+ * action, and Stripe is not a person. `type` is the namespace that makes `id` resolvable —
+ * `users`, `integrations`, `members_custom_field_bindings` — so the one writer that
+ * resolves in no table is the one with no id to give.
+ */
+export const WrittenBy = z.discriminatedUnion('type', [
+  z.object({ type: z.literal('user'), id: z.string() }),
+  z.object({ type: z.literal('integration'), id: z.string() }),
+  z.object({ type: z.literal('binding'), id: z.string() }),
+  z.object({ type: z.literal('import'), id: z.null() }),
+]);
+export type WrittenBy = z.infer<typeof WrittenBy>;
+
 // One part of a member's value. What a `path` means is storage.ts's business, so the row
 // carries it as a plain string.
 export const DbCustomFieldValue = z.object({
@@ -37,6 +51,11 @@ export const DbCustomFieldValue = z.object({
   // Nullable like the column, though nothing here writes a null: a part with no value
   // has no row.
   value_text: z.string().nullable(),
+  // Plain columns rather than the `WrittenBy` union: the rule holds at the write
+  // boundary, so one malformed row cannot throw away a member's whole profile on read.
+  written_by_type: z.string(),
+  // Null for the one writer that resolves nowhere: an import, until runs are tracked.
+  written_by_id: z.string().nullable(),
   created_at: DbDate,
   updated_at: DbDate.nullable(),
 });
diff --git a/ghost/core/core/server/services/members-custom-fields/values-service.ts b/ghost/core/core/server/services/members-custom-fields/values-service.ts
index c908399a856..c7721bab412 100644
--- a/ghost/core/core/server/services/members-custom-fields/values-service.ts
+++ b/ghost/core/core/server/services/members-custom-fields/values-service.ts
@@ -4,7 +4,7 @@ import logging from '@tryghost/logging';
 import type { Knex } from 'knex';
 import { z } from 'zod';
 import { FIELD_TYPES, subFieldsOf, type FieldType } from '@tryghost/custom-field-types';
-import { DbCustomFieldLeaf, DbCustomFieldValue, FIELD_STATUS } from './schema';
+import { DbCustomFieldLeaf, DbCustomFieldValue, FIELD_STATUS, type WrittenBy } from './schema';
 import { activeFields } from './queries';
 import { leavesToWrite, valuesFromLeaves, type StoredLeaf } from './storage';
 
@@ -43,7 +43,7 @@ interface ActiveField {
 }
 
 /** An absent `value` means clear the field. */
-interface PlannedWrite {
+export interface PlannedWrite {
   field: ActiveField;
   value?: unknown;
 }
@@ -208,13 +208,16 @@ export class CustomFieldValuesService {
    * them, and saying nothing about a path leaves it alone. There is no whole-value
    * replace, so a caller that does not know about a field cannot erase it.
    *
+   * `writtenBy` is required and has no default: every writer has to name itself, so a new
+   * one cannot quietly inherit the identity of whichever was written first.
+   *
    * Always transactional. Given an executor it joins that transaction, so the importer's
    * failed value write takes its member with it; given none it opens its own.
    */
   async applyWrite(
     memberId: string,
     writes: PlannedWrite[],
-    { executor = this.knex }: { executor?: Knex } = {},
+    { writtenBy, executor = this.knex }: { writtenBy: WrittenBy; executor?: Knex },
   ): Promise<void> {
     if (writes.length === 0) {
       return;
@@ -247,6 +250,8 @@ export class CustomFieldValuesService {
             custom_field_key: field.key,
             path: leaf.path,
             value_text: leaf.value_text,
+            written_by_type: writtenBy.type,
+            written_by_id: writtenBy.id,
             created_at: now,
             updated_at: now,
           })),
@@ -283,7 +288,9 @@ export class CustomFieldValuesService {
           // Naming the columns rather than giving values takes each from the row
           // that lost the conflict, so every part updates to its own value.
           .onConflict(['member_id', 'custom_field_key', 'path'])
-          .merge(['value_text', 'updated_at']);
+          // The writer is merged with the value, so a leaf names who wrote what
+          // it currently holds rather than who wrote its first value.
+          .merge(['value_text', 'written_by_type', 'written_by_id', 'updated_at']);
       }
     };
 
diff --git a/ghost/core/core/server/services/members/import-export/index.ts b/ghost/core/core/server/services/members/import-export/index.ts
index e9bed1a5827..ccfe673b4e6 100644
--- a/ghost/core/core/server/services/members/import-export/index.ts
+++ b/ghost/core/core/server/services/members/import-export/index.ts
@@ -1,5 +1,6 @@
 import type { Knex } from 'knex';
 import type { CsvField } from '@tryghost/custom-field-types/csv';
+import type { WrittenBy } from '../../members-custom-fields';
 import MembersCSVImporter, {
   type MembersRepository,
   type GiftService,
@@ -49,7 +50,11 @@ interface ImporterServices {
     definitions: { browse(): Promise<CsvField[]> };
     values: {
       planWrite(values: Record<string, unknown>): Promise<unknown[]>;
-      applyWrite(memberId: string, plan: unknown[], options?: { executor?: Knex }): Promise<void>;
+      applyWrite(
+        memberId: string,
+        plan: unknown[],
+        options: { writtenBy: WrittenBy; executor?: Knex },
+      ): Promise<void>;
     };
   };
 }
@@ -118,8 +123,13 @@ export function makeImporter(deps: ImporterServices) {
     activeFields: async () =>
       labs.isSet('membersCustomFields') ? deps.customFields.definitions.browse() : [],
     planWrite: (values) => deps.customFields.values.planWrite(values),
+    // Every value the import writes came out of the file, whichever column carried it.
+    // An import has no id to give until runs are tracked, so it names its kind only.
     applyWrite: (memberId, plan, executor) =>
-      deps.customFields.values.applyWrite(memberId, plan, { executor }),
+      deps.customFields.values.applyWrite(memberId, plan, {
+        writtenBy: { type: 'import', id: null },
+        executor,
+      }),
   };
 
   // Inline jobs never reach the job manager's Sentry handler, which is wired to the
diff --git a/ghost/core/core/server/services/members/members-api/services/member-bread-service.js b/ghost/core/core/server/services/members/members-api/services/member-bread-service.js
index 449b5d0bd7b..2bb4ce161c6 100644
--- a/ghost/core/core/server/services/members/members-api/services/member-bread-service.js
+++ b/ghost/core/core/server/services/members/members-api/services/member-bread-service.js
@@ -9,6 +9,8 @@ const messages = {
   memberNotFound: 'Member not found.',
   customFieldsOnAdd:
     'Custom field values cannot be set while creating a member. Create the member, then set values with an edit.',
+  customFieldsWithoutWriter:
+    'Custom field values cannot be set by a request with no authenticated user or integration.',
 };
 
 // Stored in the action's `context.action_name`; Admin maps it to a display label.
@@ -654,7 +656,23 @@ module.exports = class MemberBREADService {
     }
 
     if (plannedCustomFields) {
-      await this.customFieldValues.applyWrite(model.id, plannedCustomFields);
+      // Every value reaching here was typed into the Admin API, so the writer is
+      // whoever made the request — the same pair the action log records, so the two
+      // agree about who did it rather than one saying only that it was "admin".
+      //
+      // The only route to this branch is the authenticated Admin API, so an anonymous
+      // request is a mistake somewhere upstream rather than a writer to invent a name
+      // for. Refusing keeps every stored writer resolvable.
+      const context = options.context || {};
+      if (!context.integration && !context.user) {
+        throw new errors.IncorrectUsageError({
+          message: tpl(messages.customFieldsWithoutWriter),
+        });
+      }
+      const writtenBy = context.integration
+        ? { type: 'integration', id: context.integration.id }
+        : { type: 'user', id: context.user };
+      await this.customFieldValues.applyWrite(model.id, plannedCustomFields, { writtenBy });
 
       // Custom fields aren't a member column or relation, so an edit touching
       // only them leaves `model._changed` empty and the save fires nothing.
diff --git a/ghost/core/core/server/web/parent/app.js b/ghost/core/core/server/web/parent/app.js
index 94c724b0bb3..20b3a8498ba 100644
--- a/ghost/core/core/server/web/parent/app.js
+++ b/ghost/core/core/server/web/parent/app.js
@@ -12,6 +12,11 @@ module.exports = function setupParentApp() {
   const parentApp = express('parent');
 
   parentApp.use(mw.requestId);
+
+  if (config.get('queryParameterFiltering:enabled')) {
+    parentApp.use(mw.filterQueryParameters);
+  }
+
   parentApp.use(mw.logRequest);
 
   // Register event emitter on req/res to trigger cache invalidation webhook event
diff --git a/ghost/core/core/server/web/parent/middleware/filter-query-parameters.ts b/ghost/core/core/server/web/parent/middleware/filter-query-parameters.ts
new file mode 100644
index 00000000000..8a46007f4f9
--- /dev/null
+++ b/ghost/core/core/server/web/parent/middleware/filter-query-parameters.ts
@@ -0,0 +1,124 @@
+import logging from '@tryghost/logging';
+import type { NextFunction, Request, Response } from 'express';
+
+import { queryParameterPolicy } from '../../query-parameter-policy';
+
+const allowedQueryParameters: ReadonlySet<string> = new Set(
+  queryParameterPolicy.public.map((entry) => entry.name),
+);
+const allowedContentApiQueryParameters: ReadonlySet<string> = new Set(
+  queryParameterPolicy.contentApi.map((entry) => entry.name),
+);
+
+const CONTENT_API_PATH_PATTERN = /\/ghost\/api\/(?:(?:v[0-9]+|canary)\/content|content)(?:\/|$)/;
+
+const EXEMPT_PATH_PATTERNS = [
+  /\/ghost\/api(?:\/|$)/,
+  /\/\.ghost(?:\/|$)/,
+  /\/\.well-known(?:\/|$)/,
+  /\/socket\.io(?:\/|$)/,
+];
+const MAX_LOGGED_PARAMETERS = 10;
+const REQUEST_URL_BASE = 'http://ignored.example';
+
+type FilterResult = {
+  requestTarget: string;
+  removedUnknownParameters: string[];
+};
+
+const replaceQueryString = (requestTarget: string, filteredRequestTarget: string) => {
+  const requestUrl = new URL(requestTarget, REQUEST_URL_BASE);
+  const filteredUrl = new URL(filteredRequestTarget, REQUEST_URL_BASE);
+
+  return `${requestUrl.pathname}${filteredUrl.search}`;
+};
+
+const replaceParsedQuery = (query: Request['query'], requestTarget: string) => {
+  for (const parameter of Object.keys(query)) {
+    delete query[parameter];
+  }
+
+  const { searchParams } = new URL(requestTarget, REQUEST_URL_BASE);
+
+  for (const parameter of new Set(searchParams.keys())) {
+    const values = searchParams.getAll(parameter);
+    query[parameter] = values.length === 1 ? values[0] : values;
+  }
+};
+
+const removeUnknownParameters = (searchParams: URLSearchParams, allowlist: ReadonlySet<string>) => {
+  const removed = new Set<string>();
+
+  for (const parameter of [...searchParams.keys()]) {
+    if (!allowlist.has(parameter)) {
+      searchParams.delete(parameter);
+      removed.add(parameter);
+    }
+  }
+
+  return removed;
+};
+
+const filterRequestTarget = (requestTarget: string): FilterResult => {
+  const { pathname, searchParams } = new URL(requestTarget, REQUEST_URL_BASE);
+  const contentApiRequest = CONTENT_API_PATH_PATTERN.test(pathname);
+  const exemptPath = EXEMPT_PATH_PATTERNS.some((pattern) => pattern.test(pathname));
+
+  if (!contentApiRequest && exemptPath) {
+    return {
+      requestTarget,
+      removedUnknownParameters: [],
+    };
+  }
+
+  const allowlist = contentApiRequest ? allowedContentApiQueryParameters : allowedQueryParameters;
+  const removedUnknownParameters = removeUnknownParameters(searchParams, allowlist);
+
+  if (removedUnknownParameters.size === 0) {
+    return {
+      requestTarget,
+      removedUnknownParameters: [],
+    };
+  }
+
+  const query = searchParams.toString();
+
+  return {
+    requestTarget: query ? `${pathname}?${query}` : pathname,
+    removedUnknownParameters: [...removedUnknownParameters].sort(),
+  };
+};
+
+/**
+ * Applies Ghost(Pro)'s public query parameter allowlist in local development.
+ *
+ * Update the production policy and this manifest together when adding a parameter.
+ * This middleware is enabled by the root pnpm dev Docker Compose configuration.
+ */
+export function filterQueryParameters(req: Request, _res: Response, next: NextFunction) {
+  const requestTarget = req.originalUrl;
+  const result = filterRequestTarget(requestTarget);
+
+  if (result.requestTarget !== requestTarget) {
+    const query = req.query;
+
+    req.originalUrl = result.requestTarget;
+    req.url = replaceQueryString(req.url, result.requestTarget);
+    replaceParsedQuery(query, result.requestTarget);
+  }
+
+  if (result.removedUnknownParameters.length > 0) {
+    const strippedParameters = result.removedUnknownParameters
+      .slice(0, MAX_LOGGED_PARAMETERS)
+      .map(encodeURIComponent)
+      .join(', ');
+    const omittedParameterCount = result.removedUnknownParameters.length - MAX_LOGGED_PARAMETERS;
+    const omittedParameters =
+      omittedParameterCount > 0 ? `, and ${omittedParameterCount} more` : '';
+    logging.warn(
+      `[query-parameter-filter] Stripped undeclared query parameter(s) from ${req.path}: ${strippedParameters}${omittedParameters}`,
+    );
+  }
+
+  next();
+}
diff --git a/ghost/core/core/server/web/parent/middleware/index.js b/ghost/core/core/server/web/parent/middleware/index.js
index c6dcd684a76..bae4c27c691 100644
--- a/ghost/core/core/server/web/parent/middleware/index.js
+++ b/ghost/core/core/server/web/parent/middleware/index.js
@@ -1,5 +1,6 @@
 module.exports = {
   emitEvents: require('./emit-events'),
+  filterQueryParameters: require('./filter-query-parameters').filterQueryParameters,
   ghostLocals: require('./ghost-locals').ghostLocals,
   logRequest: require('./log-request'),
   queueRequest: require('./queue-request'),
diff --git a/ghost/core/core/server/web/query-parameter-policy/index.ts b/ghost/core/core/server/web/query-parameter-policy/index.ts
new file mode 100644
index 00000000000..87c6fccb15b
--- /dev/null
+++ b/ghost/core/core/server/web/query-parameter-policy/index.ts
@@ -0,0 +1,4 @@
+import manifest from './policy.json';
+import { parseQueryParameterPolicy } from './schema';
+
+export const queryParameterPolicy = parseQueryParameterPolicy(manifest);
diff --git a/ghost/core/core/server/web/query-parameter-policy/policy.json b/ghost/core/core/server/web/query-parameter-policy/policy.json
new file mode 100644
index 00000000000..f88fcbbc41c
--- /dev/null
+++ b/ghost/core/core/server/web/query-parameter-policy/policy.json
@@ -0,0 +1,58 @@
+{
+  "schemaVersion": 1,
+  "public": [
+    { "name": "m", "reason": "Link tracking" },
+    { "name": "v", "reason": "Asset invalidation" },
+    { "name": "r", "reason": "Password-protected site redirects" },
+    { "name": "token", "reason": "Members API authentication" },
+    { "name": "action", "reason": "Unsubscribe links" },
+    { "name": "ssml", "reason": "Ghost SSO" },
+    { "name": "ssts", "reason": "Ghost SSO" },
+    { "name": "uuid", "reason": "Member UUID used for unsubscribing" },
+    { "name": "key", "reason": "Members key used to sign unsubscribe paths" },
+    { "name": "portal-action", "reason": "Members Portal actions" },
+    { "name": "newsletter", "reason": "Multiple newsletters, including unsubscribe links" },
+    { "name": "comments", "reason": "Unsubscribing from comment notifications" },
+    { "name": "updatesandannouncements", "reason": "Unsubscribing from automations emails" },
+    { "name": "firstStart", "reason": "Opening the getting-started modal" },
+    { "name": "include", "reason": "Frontend comments API includes" },
+    { "name": "fields", "reason": "Frontend comments API field selection" },
+    { "name": "limit", "reason": "Frontend comments API pagination" },
+    { "name": "order", "reason": "Frontend comments API sorting" },
+    { "name": "filter", "reason": "Frontend comments API filtering" },
+    { "name": "page", "reason": "Frontend comments API pagination" },
+    { "name": "ids", "reason": "Frontend comments counts API" },
+    { "name": "via", "reason": "FirstPromoter referral tracking" },
+    { "name": "ref", "reason": "Attribution tracking" },
+    { "name": "source", "reason": "Attribution tracking" },
+    { "name": "utm_source", "reason": "Attribution tracking" },
+    { "name": "utm_medium", "reason": "Attribution tracking" },
+    { "name": "attribution_id", "reason": "Attribution tracking" },
+    { "name": "attribution_type", "reason": "Attribution tracking" },
+    { "name": "resource", "reason": "WebFinger resource lookup" },
+    { "name": "sr_id", "reason": "Signup redirect tracking" },
+    { "name": "member_status", "reason": "Testing card and paywall content visibility" },
+    {
+      "name": "member_tier",
+      "reason": "Previewing card and paywall visibility for a specific tier"
+    },
+    { "name": "otc_verification", "reason": "One-time codes in member sign-ins" },
+    { "name": "admin", "reason": "Admin toolbar activation" },
+    { "name": "admin_toolbar", "reason": "Admin toolbar suppression" },
+    { "name": "gift", "reason": "Gift-link unlock token on canonical post URLs" },
+    { "name": "step", "reason": "Automations analytics" }
+  ],
+  "contentApi": [
+    { "name": "absolute_urls", "reason": "Converts relative URLs to absolute URLs" },
+    { "name": "collection", "reason": "Filters resources by collection" },
+    { "name": "debug", "reason": "Enables debug mode where available" },
+    { "name": "fields", "reason": "Limits returned fields" },
+    { "name": "filter", "reason": "Filters resources using NQL" },
+    { "name": "formats", "reason": "Selects content formats" },
+    { "name": "include", "reason": "Includes related resources" },
+    { "name": "key", "reason": "Content API authentication key" },
+    { "name": "limit", "reason": "Number of resources per page" },
+    { "name": "order", "reason": "Sort order" },
+    { "name": "page", "reason": "Page number for paginated results" }
+  ]
+}
diff --git a/ghost/core/core/server/web/query-parameter-policy/schema.ts b/ghost/core/core/server/web/query-parameter-policy/schema.ts
new file mode 100644
index 00000000000..c9b11e12701
--- /dev/null
+++ b/ghost/core/core/server/web/query-parameter-policy/schema.ts
@@ -0,0 +1,44 @@
+import { z } from 'zod';
+
+const ALLOWED_NAME_CHARACTERS = /^[A-Za-z_-]+$/;
+
+const QueryParameterPolicyEntrySchema = z.object({
+  name: z
+    .string()
+    .min(1, { error: 'Parameter names must be nonempty.' })
+    .regex(ALLOWED_NAME_CHARACTERS, {
+      error: 'Parameter names must only contain letters, underscores, and hyphens.',
+    }),
+  reason: z
+    .string()
+    .refine((reason) => reason.trim().length > 0, { error: 'Parameter reasons must be nonempty.' }),
+});
+
+const QueryParameterListSchema = z
+  .array(QueryParameterPolicyEntrySchema)
+  .superRefine((entries, context) => {
+    const names = new Set<string>();
+
+    for (const entry of entries) {
+      if (names.has(entry.name)) {
+        context.addIssue({
+          code: 'custom',
+          message: `Duplicate parameter name "${entry.name}".`,
+        });
+      }
+
+      names.add(entry.name);
+    }
+  });
+
+const QueryParameterPolicySchema = z.object({
+  schemaVersion: z.literal(1, { error: 'Unsupported schema version; expected 1.' }),
+  public: QueryParameterListSchema,
+  contentApi: QueryParameterListSchema,
+});
+
+type QueryParameterPolicy = z.infer<typeof QueryParameterPolicySchema>;
+
+export function parseQueryParameterPolicy(value: unknown): QueryParameterPolicy {
+  return QueryParameterPolicySchema.parse(value);
+}
diff --git a/ghost/core/core/shared/config/defaults.json b/ghost/core/core/shared/config/defaults.json
index 4f6c01b9c4f..d8eb3990947 100644
--- a/ghost/core/core/shared/config/defaults.json
+++ b/ghost/core/core/shared/config/defaults.json
@@ -31,6 +31,9 @@
   },
   "useMinFiles": true,
   "verifyRequestIntegrity": true,
+  "queryParameterFiltering": {
+    "enabled": false
+  },
   "paths": {
     "contentPath": "content/",
     "fixtures": "core/server/data/schema/fixtures/fixtures",
diff --git a/ghost/core/core/shared/config/env/config.testing-mysql.json b/ghost/core/core/shared/config/env/config.testing-mysql.json
index f53e7a840a9..f94fe1f16a5 100644
--- a/ghost/core/core/shared/config/env/config.testing-mysql.json
+++ b/ghost/core/core/shared/config/env/config.testing-mysql.json
@@ -19,6 +19,9 @@
     "level": "error",
     "logClientErrorsAsError": false
   },
+  "queryParameterFiltering": {
+    "enabled": true
+  },
   "adapters": {
     "Redis": {
       "host": "127.0.0.1",
diff --git a/ghost/core/core/shared/config/env/config.testing.json b/ghost/core/core/shared/config/env/config.testing.json
index eda91e585e4..4b4208930ba 100644
--- a/ghost/core/core/shared/config/env/config.testing.json
+++ b/ghost/core/core/shared/config/env/config.testing.json
@@ -15,6 +15,9 @@
     "level": "error",
     "logClientErrorsAsError": false
   },
+  "queryParameterFiltering": {
+    "enabled": true
+  },
   "adapters": {
     "Redis": {
       "host": "127.0.0.1",
diff --git a/ghost/core/core/shared/labs.js b/ghost/core/core/shared/labs.js
index c55fe718fd8..4e8f3bb15ba 100644
--- a/ghost/core/core/shared/labs.js
+++ b/ghost/core/core/shared/labs.js
@@ -107,13 +107,9 @@ module.exports.isSet = function isSet(flag) {
  * @param {string} options.flagKey the internal lookup key of the flag e.g. labs.isSet(matchHelper)
  * @param {string} options.flagName the user-facing name of the flag e.g. Match helper
  * @param {string} options.helperName Name of the helper to be enabled/disabled
- * @param {string} [options.errorMessage] Optional replacement error message
- * @param {string} [options.errorContext] Optional replacement context message
- * @param {string} [options.errorHelp] Optional replacement help message
  * @param {string} [options.helpUrl] Url to show in the help message
- * @param {string} [options.async] is the helper async?
  * @param {function} callback
- * @returns {Promise<Handlebars.SafeString>|Handlebars.SafeString}
+ * @returns {Handlebars.SafeString}
  */
 module.exports.enabledHelper = function enabledHelper(options, callback) {
   const errDetails = {};
@@ -125,14 +121,14 @@ module.exports.enabledHelper = function enabledHelper(options, callback) {
   }
 
   // Else, the helper is not active and we need to handle this as an error
-  errDetails.message = tpl(options.errorMessage || messages.errorMessage, {
+  errDetails.message = tpl(messages.errorMessage, {
     helperName: options.helperName,
   });
-  errDetails.context = tpl(options.errorContext || messages.errorContext, {
+  errDetails.context = tpl(messages.errorContext, {
     helperName: options.helperName,
     flagName: options.flagName,
   });
-  errDetails.help = tpl(options.errorHelp || messages.errorHelp, { url: options.helpUrl });
+  errDetails.help = tpl(messages.errorHelp, { url: options.helpUrl });
 
   logging.error(
     new errors.DisabledFeatureError({
@@ -147,10 +143,6 @@ module.exports.enabledHelper = function enabledHelper(options, callback) {
     `<script>console.error("${_.values(errDetails).join(' ')}");</script>`,
   );
 
-  if (options.async) {
-    return Promise.resolve(errString);
-  }
-
   return errString;
 };
 
diff --git a/ghost/core/package.json b/ghost/core/package.json
index 0ad42da837b..2ebf7832eb4 100644
--- a/ghost/core/package.json
+++ b/ghost/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.60.1-rc.0",
+  "version": "6.61.0-rc.0",
   "description": "The professional publishing platform",
   "keywords": [
     "blog",
@@ -49,6 +49,7 @@
     "build:assets:js": "node scripts/minify-assets.mjs",
     "build:assets:cards": "node scripts/build-card-assets.mjs",
     "generate-golden-email": "node bin/generate-golden-email.js",
+    "query-parameter-policy:export": "node --import=tsx scripts/export-query-parameter-policy.ts",
     "migrate:create": "node bin/create-migration.js",
     "build:assets:css": "postcss core/frontend/public/ghost.css --no-map --use cssnano -o core/frontend/public/ghost.min.css",
     "build:tsc": "tsc",
diff --git a/ghost/core/scripts/export-query-parameter-policy.ts b/ghost/core/scripts/export-query-parameter-policy.ts
new file mode 100644
index 00000000000..4b2bf80fddd
--- /dev/null
+++ b/ghost/core/scripts/export-query-parameter-policy.ts
@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { parseArgs } from 'node:util';
+
+import { parseQueryParameterPolicy } from '../core/server/web/query-parameter-policy/schema';
+
+const POLICY_PATH = path.resolve(
+  __dirname,
+  '../core/server/web/query-parameter-policy/policy.json',
+);
+const USAGE = 'Usage: pnpm query-parameter-policy:export --output <file-path>';
+
+async function main() {
+  const { values } = parseArgs({
+    options: {
+      output: { type: 'string', short: 'o' },
+    },
+  });
+
+  if (!values.output) {
+    throw new Error(`Missing required --output option.\n${USAGE}`);
+  }
+
+  const manifest = JSON.parse(await readFile(POLICY_PATH, 'utf8'));
+  const policy = parseQueryParameterPolicy(manifest);
+  const outputPath = path.resolve(values.output);
+
+  await mkdir(path.dirname(outputPath), { recursive: true });
+  await writeFile(outputPath, `${JSON.stringify(policy, null, 4)}\n`, 'utf8');
+}
+
+void main();
diff --git a/ghost/core/test/e2e-api/admin/member-custom-fields.test.ts b/ghost/core/test/e2e-api/admin/member-custom-fields.test.ts
index 99dd022e164..b3e71216d5c 100644
--- a/ghost/core/test/e2e-api/admin/member-custom-fields.test.ts
+++ b/ghost/core/test/e2e-api/admin/member-custom-fields.test.ts
@@ -17,6 +17,7 @@ describe('Member Custom Fields Admin API', function () {
     delete: (_url: string) => any;
     loginAsOwner: () => Promise<void>;
     loginAsEditor: () => Promise<void>;
+    useZapierAdminAPIKey: () => Promise<void>;
   };
 
   // The key is minted server-side from the name, so callers pass just a name
@@ -1436,6 +1437,66 @@ describe('Member Custom Fields Admin API', function () {
       assert.equal(rows.length, 1);
     });
 
+    // The record has to be made at the moment of the write; nothing can reconstruct it
+    // later. What reads it is a separate question — this pins only that it is written,
+    // and that it names where the value currently held came from rather than the first.
+    // Provenance is observable nowhere else yet, so this reads the columns directly.
+    //
+    // The second write comes from an integration rather than the owner, because a
+    // re-write by the same writer cannot tell "the writer follows the value" apart from
+    // "the writer is whoever wrote first" — the two agree on every row.
+    it('records who wrote each value, and re-records it on every write', async function () {
+      const field = await createField({ name: 'Postal address', type: 'address' });
+      const memberId = await createMember();
+      await setValues(memberId, { [field.key]: { line1: '1 High Street', city: 'London' } });
+
+      type WrittenRow = { path: string; written_by_type: string; written_by_id: string | null };
+      const writersOf = async (): Promise<WrittenRow[]> =>
+        models.Base.knex('members_custom_field_values')
+          .where('member_id', memberId)
+          .orderBy('path')
+          .select('path', 'written_by_type', 'written_by_id');
+
+      const firstWrite = await writersOf();
+      assert.deepEqual(
+        firstWrite.map(({ path, written_by_type: type }) => ({ path, type })),
+        [
+          { path: 'city', type: 'user' },
+          { path: 'line1', type: 'user' },
+        ],
+      );
+
+      // The owner made the write, so every part names them rather than only the
+      // first, and the id resolves back to the actual person.
+      const owner = firstWrite[0].written_by_id;
+      assert.ok(owner, 'the writer is identified, not merely named');
+      assert.deepEqual(
+        firstWrite.map(({ written_by_id: id }) => id),
+        [owner, owner],
+      );
+
+      await agent.useZapierAdminAPIKey();
+      try {
+        await setValues(memberId, { [field.key]: { city: 'Bristol' } });
+      } finally {
+        await agent.loginAsOwner();
+      }
+
+      // Only the part the second write touched changes hands, and it names the writer
+      // of the value there now rather than the one who put the first value there.
+      const secondWrite = await writersOf();
+      assert.deepEqual(
+        secondWrite.map(({ path, written_by_type: type }) => ({ path, type })),
+        [
+          { path: 'city', type: 'integration' },
+          { path: 'line1', type: 'user' },
+        ],
+      );
+      assert.notEqual(secondWrite[0].written_by_id, owner, 'the integration is identified too');
+      assert.ok(secondWrite[0].written_by_id);
+      assert.equal(secondWrite[1].written_by_id, owner);
+    });
+
     it("drops a field's values when the field is permanently deleted", async function () {
       const field = await createField({ name: 'Favourite topic' });
       const memberId = await createMember();
diff --git a/ghost/core/test/e2e-api/admin/members-import-custom-fields.test.ts b/ghost/core/test/e2e-api/admin/members-import-custom-fields.test.ts
index 90c10a654d9..71f3ba5f938 100644
--- a/ghost/core/test/e2e-api/admin/members-import-custom-fields.test.ts
+++ b/ghost/core/test/e2e-api/admin/members-import-custom-fields.test.ts
@@ -445,4 +445,30 @@ describe('Members import — custom fields', function () {
     const member = await findMember(email);
     assert.equal(member.custom_fields?.[key], '=SUM(A1:A9)');
   });
+
+  // Recorded at the moment of the write because it cannot be reconstructed afterwards.
+  // Asserted per row, since that is the granularity a write touches.
+  it('records that the import wrote each value', async function () {
+    const key = await createField('Shipping Address', 'address');
+    const email = 'cf-import-source@example.com';
+    const columns = ['line1', 'city'].map((sub) => `custom_fields.${key}.${sub}`).join(',');
+
+    await importCSV(`email,${columns}\n${email},1 High Street,London\n`);
+
+    const member = await findMember(email);
+    const writers: Array<{ written_by_type: string; written_by_id: string | null }> =
+      await models.Base.knex('members_custom_field_values')
+        .where('member_id', member.id)
+        .orderBy('path')
+        .select('written_by_type', 'written_by_id');
+
+    // An import has no id to give until runs are tracked, so it names its kind only.
+    assert.deepEqual(
+      writers.map(({ written_by_type: type, written_by_id: id }) => ({ type, id })),
+      [
+        { type: 'import', id: null },
+        { type: 'import', id: null },
+      ],
+    );
+  });
 });
diff --git a/ghost/core/test/e2e-api/admin/posts-importer.test.js b/ghost/core/test/e2e-api/admin/posts-importer.test.js
index 4a7f0657bc3..bb6a8c95ac0 100644
--- a/ghost/core/test/e2e-api/admin/posts-importer.test.js
+++ b/ghost/core/test/e2e-api/admin/posts-importer.test.js
@@ -96,6 +96,34 @@ describe('Posts Importer API', function () {
       .expect(cacheInvalidateHeaderNotSet());
   });
 
+  it('Keeps content import initialization idempotent and rejects invalid service requests', async function () {
+    const contentImportService =
+      await import('../../../core/server/services/content-import/index.ts?coverage-lifecycle');
+
+    assert.throws(
+      () => contentImportService.importCSV({ filePath: '/tmp/posts.csv', fileName: 'posts.csv' }),
+      /Content import service used before init/,
+    );
+    contentImportService.init();
+    contentImportService.init();
+
+    assert.throws(
+      () => contentImportService.importCSV({ filePath: '', fileName: '' }),
+      (error) => {
+        assert.equal(error.errorType, 'ValidationError');
+        assert.match(error.message, /Too small/);
+        return true;
+      },
+    );
+    await assert.rejects(
+      contentImportService.importCSV({
+        filePath: path.join(tmpDir, 'missing.csv'),
+        fileName: 'missing.csv',
+      }),
+      /The file could not be parsed as a CSV file/,
+    );
+  });
+
   it('Can upload a posts CSV as Administrator', async function () {
     await agent.loginAsAdmin();
 
@@ -506,8 +534,8 @@ describe('Posts Importer API', function () {
         reason: /Invalid CSV header mapping: "constructor"/,
       },
       {
-        mapping: { First: 'title', Second: 'authors' },
-        reason: /Unknown post field mapping: "authors"/,
+        mapping: { First: 'title', Second: 'newsletter_id' },
+        reason: /Unknown post field mapping: "newsletter_id"/,
       },
       {
         mapping: { First: 'title', Second: 'title' },
@@ -613,6 +641,130 @@ describe('Posts Importer API', function () {
     assert.equal(two.get('updated_at').toISOString(), '2024-06-15T18:45:00.000Z');
   });
 
+  it('Skips existing post slugs when the same CSV is imported again', async function () {
+    await agent.loginAsOwner();
+
+    const duplicateCsvPath = await csvFile(
+      'posts-import-deduplication.csv',
+      'title,slug,html\n' +
+        'CSV deduplication check,csv-deduplication-check,<p>Only one copy</p>\n',
+    );
+
+    await agent.post('posts/upload/').attach('postsfile', duplicateCsvPath).expectStatus(202);
+    await jobsService.allSettled();
+    await agent.post('posts/upload/').attach('postsfile', duplicateCsvPath).expectStatus(202);
+    await jobsService.allSettled();
+
+    const { data: posts } = await models.Post.findPage({
+      filter: "slug:'csv-deduplication-check'",
+      status: 'all',
+      limit: 'all',
+    });
+
+    assert.equal(posts.length, 1);
+    assert.equal(posts[0].get('title'), 'CSV deduplication check');
+    assert.match(posts[0].get('html'), /Only one copy/);
+  });
+
+  it('Matches explicit CSV source IDs before falling back to slugs', async function () {
+    await agent.loginAsOwner();
+
+    const originalCsvPath = await csvFile(
+      'posts-import-source-id-original.csv',
+      'title,slug,comment_id\n' +
+        'CSV source ID original,csv-source-id-original,m5-source-id-primary\n',
+    );
+    await agent.post('posts/upload/').attach('postsfile', originalCsvPath).expectStatus(202);
+    await jobsService.allSettled();
+
+    const comparisonCsvPath = await csvFile(
+      'posts-import-source-id-comparisons.csv',
+      'Headline,Address,Source\n' +
+        'CSV source ID duplicate,csv-source-id-different,m5-source-id-primary\n' +
+        'CSV source ID slug fallback,csv-source-id-original,m5-source-id-unmatched\n' +
+        `CSV source ID too long,csv-source-id-too-long,${'x'.repeat(51)}\n` +
+        'CSV source ID distinct,csv-source-id-distinct,m5-source-id-distinct\n',
+    );
+    const form = new FormData();
+    form.append('mapping[Headline]', 'title');
+    form.append('mapping[Address]', 'slug');
+    form.append('mapping[Source]', 'comment_id');
+    form.append('postsfile', await fs.readFile(comparisonCsvPath), {
+      filename: path.basename(comparisonCsvPath),
+      contentType: 'text/csv',
+    });
+    await agent.post('posts/upload/').body(form).expectStatus(202);
+    await jobsService.allSettled();
+
+    const original = await models.Post.findOne({ slug: 'csv-source-id-original', status: 'all' });
+    const sourceDuplicate = await models.Post.findOne({
+      slug: 'csv-source-id-different',
+      status: 'all',
+    });
+    const tooLong = await models.Post.findOne({
+      slug: 'csv-source-id-too-long',
+      status: 'all',
+    });
+    const distinct = await models.Post.findOne({ slug: 'csv-source-id-distinct', status: 'all' });
+
+    assert.ok(original);
+    assert.equal(original.get('title'), 'CSV source ID original');
+    assert.equal(original.get('comment_id'), 'm5-source-id-primary');
+    assert.equal(sourceDuplicate, null, 'the source ID match takes precedence over its new slug');
+    assert.equal(tooLong, null, 'an invalid source ID skips only its row');
+    assert.ok(distinct, 'a valid row after the invalid source ID is still imported');
+    assert.equal(distinct.get('comment_id'), 'm5-source-id-distinct');
+  });
+
+  it('Updates matching posts only when the CSV has a newer explicit updated_at', async function () {
+    await agent.loginAsOwner();
+
+    const originalCsvPath = await csvFile(
+      'posts-import-update-originals.csv',
+      'title,slug,comment_id,updated_at\n' +
+        'CSV update original,csv-update-original,m5-update-source,2025-01-01T00:00:00.000Z\n' +
+        'CSV update slug original,csv-update-by-slug,,2025-01-01T00:00:00.000Z\n',
+    );
+    await agent.post('posts/upload/').attach('postsfile', originalCsvPath).expectStatus(202);
+    await jobsService.allSettled();
+
+    const updatesCsvPath = await csvFile(
+      'posts-import-update-comparisons.csv',
+      'title,slug,comment_id,updated_at\n' +
+        'CSV update newer,csv-update-newer,m5-update-source,2025-02-01T00:00:00.000Z\n' +
+        'CSV update equal,csv-update-equal,m5-update-source,2025-02-01T01:00:00.000+01:00\n' +
+        'CSV update older,csv-update-older,m5-update-source,2025-01-31T23:59:59.999Z\n' +
+        'CSV update by slug,csv-update-by-slug,,2025-03-01T00:00:00.000Z\n' +
+        'CSV update invalid date,csv-update-invalid-date,,not-a-date\n' +
+        'CSV update after invalid,csv-update-after-invalid,,2025-04-01T00:00:00.000Z\n',
+    );
+    await agent.post('posts/upload/').attach('postsfile', updatesCsvPath).expectStatus(202);
+    await jobsService.allSettled();
+
+    const newer = await models.Post.findOne({
+      comment_id: 'm5-update-source',
+      status: 'all',
+    });
+    const updatedBySlug = await models.Post.findOne({
+      slug: 'csv-update-by-slug',
+      status: 'all',
+    });
+    const invalid = await models.Post.findOne({ slug: 'csv-update-invalid-date', status: 'all' });
+    const afterInvalid = await models.Post.findOne({
+      slug: 'csv-update-after-invalid',
+      status: 'all',
+    });
+
+    assert.ok(newer);
+    assert.equal(newer.get('updated_at').toISOString(), '2025-02-01T00:00:00.000Z');
+    assert.equal(newer.get('title'), 'CSV update newer');
+    assert.ok(updatedBySlug);
+    assert.equal(updatedBySlug.get('title'), 'CSV update by slug');
+    assert.equal(updatedBySlug.get('updated_at').toISOString(), '2025-03-01T00:00:00.000Z');
+    assert.equal(invalid, null, 'an invalid updated_at skips only its row');
+    assert.ok(afterInvalid, 'a valid row after the invalid date is still imported');
+  });
+
   it('Imports public posts even when the site default visibility is paid', async function () {
     mockManager.mockSetting('default_content_visibility', 'paid');
     await agent.loginAsOwner();
@@ -689,6 +841,223 @@ describe('Posts Importer API', function () {
     assert.match(post.get('html'), /Mapped body/);
   });
 
+  it('Reconciles mapped CSV authors and tags with existing records', async function () {
+    await agent.loginAsOwner();
+
+    const emailAuthor = fixtureManager.get('users', 1);
+    const nameAuthor = fixtureManager.get('users', 3);
+    const tagOptions = { context: { internal: true } };
+    const exactTag = await models.Tag.add(
+      { name: 'CSV exact relation', slug: 'csv-exact-relation-stored' },
+      tagOptions,
+    );
+    const explicitSlugTag = await models.Tag.add(
+      { name: 'Stored explicit relation', slug: 'csv-explicit-relation' },
+      tagOptions,
+    );
+    const normalizedSlugTag = await models.Tag.add(
+      { name: 'Stored normalized relation', slug: 'csv-normalized-relation' },
+      tagOptions,
+    );
+    const relationsCsvPath = await csvFile(
+      'posts-import-existing-relations.csv',
+      'Headline,Bylines,Emails,Topics\n' +
+        `CSV existing relations,"${emailAuthor.name}, ${nameAuthor.name}, ${emailAuthor.name}","${emailAuthor.email.toUpperCase()}, , ${emailAuthor.email}","CSV exact relation,csv-explicit-relation,CSV normalized relation,CSV exact relation"\n`,
+    );
+    const form = new FormData();
+    for (const [header, field] of Object.entries({
+      Headline: 'title',
+      Bylines: 'authors',
+      Emails: 'author_emails',
+      Topics: 'tags',
+    })) {
+      form.append(`mapping[${header}]`, field);
+    }
+    form.append('postsfile', await fs.readFile(relationsCsvPath), {
+      filename: path.basename(relationsCsvPath),
+      contentType: 'text/csv',
+    });
+
+    await agent.post('posts/upload/').body(form).expectStatus(202);
+    await jobsService.allSettled();
+
+    const post = await models.Post.findOne(
+      { title: 'CSV existing relations', status: 'all' },
+      { withRelated: ['authors', 'tags'] },
+    );
+    assert.ok(post);
+    assert.deepEqual(
+      post.related('authors').map((author) => author.id),
+      [emailAuthor.id, nameAuthor.id],
+      'email and name-only matches retain source order and remove duplicates',
+    );
+    const importedTags = post.related('tags').models;
+    assert.deepEqual(
+      importedTags.slice(0, 3).map((tag) => tag.id),
+      [exactTag.id, explicitSlugTag.id, normalizedSlugTag.id],
+      'exact names, explicit slugs, and normalized slugs retain source order',
+    );
+    assert.equal(importedTags.length, 5);
+    assert.match(importedTags[3].get('name'), /^#Import /);
+    assert.match(importedTags[4].get('name'), /^#Import Run /);
+  });
+
+  it('Creates missing CSV authors as locked Contributors and falls back to Owner', async function () {
+    await agent.loginAsOwner();
+
+    const authorsCsvPath = await csvFile(
+      'posts-import-new-authors.csv',
+      'title,authors,author_emails\n' +
+        'CSV created contributor,"New CSV Contributor, New CSV Contributor","new-csv-contributor@example.com, new-csv-contributor@example.com"\n' +
+        'CSV missing author email,Missing CSV Email,\n' +
+        'CSV invalid author email,Invalid CSV Email,not-an-email\n',
+    );
+
+    await agent.post('posts/upload/').attach('postsfile', authorsCsvPath).expectStatus(202);
+    await jobsService.allSettled();
+
+    const contributor = await models.User.findOne(
+      { email: 'new-csv-contributor@example.com', status: 'all' },
+      { withRelated: ['roles'] },
+    );
+    assert.ok(contributor);
+    assert.equal(contributor.get('status'), 'locked');
+    assert.deepEqual(
+      contributor.related('roles').map((role) => role.get('name')),
+      ['Contributor'],
+    );
+
+    const owner = await models.User.getOwnerUser();
+    const createdPost = await models.Post.findOne(
+      { title: 'CSV created contributor', status: 'all' },
+      { withRelated: ['authors'] },
+    );
+    const missingEmailPost = await models.Post.findOne(
+      { title: 'CSV missing author email', status: 'all' },
+      { withRelated: ['authors'] },
+    );
+    const invalidEmailPost = await models.Post.findOne(
+      { title: 'CSV invalid author email', status: 'all' },
+      { withRelated: ['authors'] },
+    );
+    assert.deepEqual(
+      createdPost.related('authors').map((author) => author.id),
+      [contributor.id],
+      'duplicate author inputs create and attach one Contributor',
+    );
+    for (const post of [missingEmailPost, invalidEmailPost]) {
+      assert.deepEqual(
+        post.related('authors').map((author) => author.id),
+        [owner.id],
+      );
+    }
+    assert.equal(await models.User.findOne({ slug: 'missing-csv-email', status: 'all' }), null);
+    assert.equal(await models.User.findOne({ slug: 'invalid-csv-email', status: 'all' }), null);
+  });
+
+  it('Rolls back a newly created Contributor when the post model fails', async function () {
+    await agent.loginAsOwner();
+    sinon.stub(models.Post, 'add').rejects(new Error('post model failed'));
+    const authorsCsvPath = await csvFile(
+      'posts-import-author-rollback.csv',
+      'title,authors,author_emails\n' +
+        'CSV contributor rollback,Rollback Contributor,csv-rollback-contributor@example.com\n',
+    );
+
+    await agent.post('posts/upload/').attach('postsfile', authorsCsvPath).expectStatus(202);
+    await jobsService.allSettled();
+
+    assert.equal(
+      await models.User.findOne({ email: 'csv-rollback-contributor@example.com', status: 'all' }),
+      null,
+    );
+    assert.equal(
+      await models.Post.findOne({ title: 'CSV contributor rollback', status: 'all' }),
+      null,
+    );
+  });
+
+  it('Creates missing CSV tags once and preserves their order and visibility', async function () {
+    await agent.loginAsOwner();
+
+    const firstCsvPath = await csvFile(
+      'posts-import-new-tags.csv',
+      'title,tags\n' +
+        'CSV created tags one,"New CSV Tag,#CSV Internal Tag,New CSV Tag"\n' +
+        'CSV created tags two,"#CSV Internal Tag,New CSV Tag"\n',
+    );
+    await agent.post('posts/upload/').attach('postsfile', firstCsvPath).expectStatus(202);
+    await jobsService.allSettled();
+
+    const secondCsvPath = await csvFile(
+      'posts-import-reused-tags.csv',
+      'title,tags\nCSV reused tags,New CSV Tag\n',
+    );
+    await agent.post('posts/upload/').attach('postsfile', secondCsvPath).expectStatus(202);
+    await jobsService.allSettled();
+
+    const publicTags = await models.Tag.findAll({ filter: "name:'New CSV Tag'" });
+    const internalTags = await models.Tag.findAll({ filter: "name:'#CSV Internal Tag'" });
+    assert.equal(publicTags.length, 1, 'later rows and imports reuse the created public tag');
+    assert.equal(internalTags.length, 1, 'duplicate inputs create one internal tag');
+    const publicTag = publicTags.at(0);
+    const internalTag = internalTags.at(0);
+    assert.equal(publicTag.get('visibility'), 'public');
+    assert.equal(internalTag.get('visibility'), 'internal');
+
+    const firstPost = await models.Post.findOne(
+      { title: 'CSV created tags one', status: 'all' },
+      { withRelated: ['tags'] },
+    );
+    const secondPost = await models.Post.findOne(
+      { title: 'CSV created tags two', status: 'all' },
+      { withRelated: ['tags'] },
+    );
+    const reusedPost = await models.Post.findOne(
+      { title: 'CSV reused tags', status: 'all' },
+      { withRelated: ['tags'] },
+    );
+    assert.deepEqual(
+      firstPost
+        .related('tags')
+        .models.slice(0, 2)
+        .map((tag) => tag.id),
+      [publicTag.id, internalTag.id],
+    );
+    assert.deepEqual(
+      secondPost
+        .related('tags')
+        .models.slice(0, 2)
+        .map((tag) => tag.id),
+      [internalTag.id, publicTag.id],
+    );
+    assert.equal(firstPost.related('tags').length, 4, 'the two batch tags remain attached');
+    assert.equal(secondPost.related('tags').length, 4, 'the two batch tags remain attached');
+    assert.deepEqual(
+      reusedPost
+        .related('tags')
+        .models.slice(0, 1)
+        .map((tag) => tag.id),
+      [publicTag.id],
+    );
+    assert.equal(reusedPost.related('tags').length, 3, 'a later import gets its own batch tags');
+  });
+
+  it('Rolls back a newly created tag when the post model fails', async function () {
+    await agent.loginAsOwner();
+    sinon.stub(models.Post, 'add').rejects(new Error('post model failed'));
+    const tagsCsvPath = await csvFile(
+      'posts-import-tag-rollback.csv',
+      'title,tags\nCSV tag rollback,CSV Rollback Tag\n',
+    );
+
+    await agent.post('posts/upload/').attach('postsfile', tagsCsvPath).expectStatus(202);
+    await jobsService.allSettled();
+
+    assert.equal(await models.Tag.findOne({ name: 'CSV Rollback Tag' }), null);
+    assert.equal(await models.Post.findOne({ title: 'CSV tag rollback', status: 'all' }), null);
+  });
+
   it('Renders a mapped Markdown column through the post content converter', async function () {
     await agent.loginAsOwner();
 
diff --git a/ghost/core/test/e2e-frontend/default-routes.test.js b/ghost/core/test/e2e-frontend/default-routes.test.js
index c1644acfeb9..c797e96e182 100644
--- a/ghost/core/test/e2e-frontend/default-routes.test.js
+++ b/ghost/core/test/e2e-frontend/default-routes.test.js
@@ -324,8 +324,8 @@ describe('Default Frontend routing', function () {
     describe('AMP Disabled', function () {
       it('/amp/ should redirect to regular post, including any query params', async function () {
         await request
-          .get('/welcome/amp/?q=a')
-          .expect('Location', '/welcome/?q=a')
+          .get('/welcome/amp/?ref=a')
+          .expect('Location', '/welcome/?ref=a')
           .expect(301)
           .expect(assertCorrectFrontendHeaders);
       });
diff --git a/ghost/core/test/e2e-frontend/gift-links.test.ts b/ghost/core/test/e2e-frontend/gift-links.test.ts
index d0a85ff78a4..8b8ee35604f 100644
--- a/ghost/core/test/e2e-frontend/gift-links.test.ts
+++ b/ghost/core/test/e2e-frontend/gift-links.test.ts
@@ -260,9 +260,9 @@ describe('Front-end gift links', function () {
   });
 
   it('strips a malformed (non-string) ?gift param without looping', async function () {
-    // `?gift[]=x` parses to an array, not a token. It must canonicalise to
-    // the clean URL — not redirect to itself and loop.
-    const res = await request.get(`/${slug}/?gift[]=x`).redirects(0).expect(301);
+    // Repeated `gift` parameters parse to an array, not a token. They must
+    // canonicalise to the clean URL — not redirect to themselves and loop.
+    const res = await request.get(`/${slug}/?gift=x&gift=y`).redirects(0).expect(301);
 
     assert.match(res.headers.location, new RegExp(`^/${slug}/?$`));
     assert.doesNotMatch(
diff --git a/ghost/core/test/e2e-webhooks/posts-importer.test.ts b/ghost/core/test/e2e-webhooks/posts-importer.test.ts
index b196365a917..32cb70aca79 100644
--- a/ghost/core/test/e2e-webhooks/posts-importer.test.ts
+++ b/ghost/core/test/e2e-webhooks/posts-importer.test.ts
@@ -82,20 +82,32 @@ describe('CSV content import side-effects', function () {
     // published, so both events are armed.
     const publishedURL = 'https://test-webhook-receiver.com/post-published-import/';
     const addedURL = 'https://test-webhook-receiver.com/post-added-import/';
+    const editedURL = 'https://test-webhook-receiver.com/post-edited-import/';
     await webhookMockReceiver.mock(publishedURL);
     await webhookMockReceiver.mock(addedURL);
+    await webhookMockReceiver.mock(editedURL);
     await fixtureManager.insertWebhook({ event: 'post.published', url: publishedURL });
     await fixtureManager.insertWebhook({ event: 'post.added', url: addedURL });
+    await fixtureManager.insertWebhook({ event: 'post.edited', url: editedURL });
 
     const csvPath = path.join(tmpDir, 'posts-import-side-effects.csv');
     await fs.writeFile(
       csvPath,
-      'title,html,published_at\n' +
-        'Side effect check one,<p>First</p>,2024-07-01T00:00:00.000Z\n' +
-        'Side effect check two,<p>Second</p>,2024-07-02T00:00:00.000Z\n',
+      'title,html,published_at,updated_at,comment_id\n' +
+        'Side effect check one,<p>First</p>,2024-07-01T00:00:00.000Z,2024-07-01T00:00:00.000Z,side-effect-one\n' +
+        'Side effect check two,<p>Second</p>,2024-07-02T00:00:00.000Z,2024-07-02T00:00:00.000Z,side-effect-two\n',
     );
 
     await adminAPIAgent.post('posts/upload/').attach('postsfile', csvPath).expectStatus(202);
+    await jobsService.allSettled();
+
+    const updateCsvPath = path.join(tmpDir, 'posts-import-update-side-effects.csv');
+    await fs.writeFile(
+      updateCsvPath,
+      'title,slug,html,updated_at,comment_id\n' +
+        'Side effect check one updated,side-effect-check-one-updated,<p>Updated</p>,2024-08-01T00:00:00.000Z,side-effect-one\n',
+    );
+    await adminAPIAgent.post('posts/upload/').attach('postsfile', updateCsvPath).expectStatus(202);
 
     await jobsService.allSettled();
     await DomainEvents.allSettled();
@@ -113,6 +125,10 @@ describe('CSV content import side-effects', function () {
     });
     assert.equal(posts.length, 2, 'both rows imported');
     assert.equal(posts[0].get('status'), 'published');
+    assert.ok(
+      posts.some((post: any) => post.get('title') === 'Side effect check one updated'),
+      'the newer row updated its matching post',
+    );
 
     // Zero webhooks: the receiver never recorded a request
     assert.equal(webhookMockReceiver.body, undefined, 'no webhook fired for the imported posts');
diff --git a/ghost/core/test/unit/scripts/export-query-parameter-policy.test.ts b/ghost/core/test/unit/scripts/export-query-parameter-policy.test.ts
new file mode 100644
index 00000000000..4fae984ed26
--- /dev/null
+++ b/ghost/core/test/unit/scripts/export-query-parameter-policy.test.ts
@@ -0,0 +1,30 @@
+import assert from 'node:assert/strict';
+import { execFile } from 'node:child_process';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+const GHOST_ROOT = path.resolve(__dirname, '../../..');
+const MANIFEST_PATH = path.join(GHOST_ROOT, 'core/server/web/query-parameter-policy/policy.json');
+
+describe('Script: export-query-parameter-policy', function () {
+  it('exports the validated canonical policy deterministically', async function () {
+    const outputDirectory = await mkdtemp(path.join(tmpdir(), 'ghost-query-parameter-policy-'));
+    const outputPath = path.join(outputDirectory, 'query-parameter-policy.json');
+
+    try {
+      await execFileAsync('pnpm', ['query-parameter-policy:export', '--output', outputPath], {
+        cwd: GHOST_ROOT,
+      });
+
+      assert.deepEqual(
+        JSON.parse(await readFile(outputPath, 'utf8')),
+        JSON.parse(await readFile(MANIFEST_PATH, 'utf8')),
+      );
+    } finally {
+      await rm(outputDirectory, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/ghost/core/test/unit/server/data/schema/integrity.test.js b/ghost/core/test/unit/server/data/schema/integrity.test.js
index a91691b86f0..9acbc4aa6dc 100644
--- a/ghost/core/test/unit/server/data/schema/integrity.test.js
+++ b/ghost/core/test/unit/server/data/schema/integrity.test.js
@@ -37,7 +37,7 @@ const parseYaml = require('../../../../../core/server/services/route-settings/ya
  */
 describe('DB version integrity', function () {
   // Only these variables should need updating
-  const currentSchemaHash = 'c4c1ef4ab373e100452e6e478a0a5758';
+  const currentSchemaHash = 'dff334a3ab0ee69919d330d3c46752a2';
   const currentFixturesHash = '1727a789194847da33d68dd95301b416';
   const currentSettingsHash = '6ea42a00cca61a1ba87f66eb6e25a78a';
   const currentRoutesHash = 'd8c25fa01bf6d22a2bcb05ba0de70dc1';
diff --git a/ghost/core/test/unit/server/lib/db-types/boolean.test.ts b/ghost/core/test/unit/server/lib/db-types/boolean.test.ts
new file mode 100644
index 00000000000..d1639105512
--- /dev/null
+++ b/ghost/core/test/unit/server/lib/db-types/boolean.test.ts
@@ -0,0 +1,38 @@
+import assert from 'node:assert/strict';
+import { DbBoolean } from '../../../../../core/server/lib/db-types/boolean';
+
+describe('DbBoolean', function () {
+  describe('decode', function () {
+    it('reads the 0 and 1 SQLite stores', function () {
+      assert.strictEqual(DbBoolean.decode(0), false);
+      assert.strictEqual(DbBoolean.decode(1), true);
+    });
+
+    it('reads the booleans MySQL returns', function () {
+      assert.strictEqual(DbBoolean.decode(false), false);
+      assert.strictEqual(DbBoolean.decode(true), true);
+    });
+
+    // A boolean column is a tinyint underneath, so it can hold a number neither
+    // engine considers out of range. Both of them treat every non-zero value as
+    // true, and so do we: a read is a worse place to discover the surprise than
+    // wherever the value came from.
+    it('reads any other number the column can hold as true', function () {
+      assert.strictEqual(DbBoolean.decode(2), true);
+      assert.strictEqual(DbBoolean.decode(-1), true);
+    });
+
+    it('rejects anything a boolean column cannot hold', function () {
+      for (const stored of ['1', null, undefined, Number.NaN, {}]) {
+        assert.throws(() => DbBoolean.decode(stored as never));
+      }
+    });
+  });
+
+  describe('encode', function () {
+    it('writes booleans unchanged', function () {
+      assert.strictEqual(DbBoolean.encode(false), false);
+      assert.strictEqual(DbBoolean.encode(true), true);
+    });
+  });
+});
diff --git a/ghost/core/test/unit/server/lib/db-date.test.ts b/ghost/core/test/unit/server/lib/db-types/date.test.ts
similarity index 96%
rename from ghost/core/test/unit/server/lib/db-date.test.ts
rename to ghost/core/test/unit/server/lib/db-types/date.test.ts
index 80cdd401461..2047d430c36 100644
--- a/ghost/core/test/unit/server/lib/db-date.test.ts
+++ b/ghost/core/test/unit/server/lib/db-types/date.test.ts
@@ -2,7 +2,11 @@ import assert from 'node:assert/strict';
 import { spawn } from 'node:child_process';
 import { once } from 'node:events';
 import * as errors from '@tryghost/errors';
-import { DbDate, fromDatabaseDate, toDatabaseDate } from '../../../../core/server/lib/db-date';
+import {
+  DbDate,
+  fromDatabaseDate,
+  toDatabaseDate,
+} from '../../../../../core/server/lib/db-types/date';
 
 describe('database date utilities', function () {
   const timezones = [
@@ -20,7 +24,7 @@ describe('database date utilities', function () {
   const runInOtherTimezones = async (toRun: string) => {
     // JSON.stringify does a good job wrapping strings in quotes and escaping.
     const s = JSON.stringify;
-    const modulePath = require.resolve('../../../../core/server/lib/db-date');
+    const modulePath = require.resolve('../../../../../core/server/lib/db-types/date');
 
     await Promise.all(
       timezones.map(async ({ tz, expectedNaive }) => {
diff --git a/ghost/core/test/unit/server/models/api-key.test.js b/ghost/core/test/unit/server/models/api-key.test.ts
similarity index 85%
rename from ghost/core/test/unit/server/models/api-key.test.js
rename to ghost/core/test/unit/server/models/api-key.test.ts
index f3a5b879d8b..9de6dda84c1 100644
--- a/ghost/core/test/unit/server/models/api-key.test.js
+++ b/ghost/core/test/unit/server/models/api-key.test.ts
@@ -1,6 +1,9 @@
-const assert = require('node:assert/strict');
-const { ApiKey } = require('../../../../core/server/models/api-key');
-const sinon = require('sinon');
+import assert from 'node:assert/strict';
+import sinon from 'sinon';
+// @ts-expect-error This module lacks type definitions.
+import models from '../../../../core/server/models';
+
+const { ApiKey } = models;
 
 describe('Unit: models/api_key', function () {
   describe('fn: refreshSecret', function () {
diff --git a/ghost/core/test/unit/server/models/email-spam-complaint-event.test.js b/ghost/core/test/unit/server/models/email-spam-complaint-event.test.ts
similarity index 77%
rename from ghost/core/test/unit/server/models/email-spam-complaint-event.test.js
rename to ghost/core/test/unit/server/models/email-spam-complaint-event.test.ts
index 0754bfb0df3..18146de702a 100644
--- a/ghost/core/test/unit/server/models/email-spam-complaint-event.test.js
+++ b/ghost/core/test/unit/server/models/email-spam-complaint-event.test.ts
@@ -1,5 +1,8 @@
-const EmailSpamComplaintEvent = require('../../../../core/server/models/email-spam-complaint-event');
-const assert = require('node:assert/strict');
+import assert from 'node:assert/strict';
+// @ts-expect-error This module lacks type definitions.
+import models from '../../../../core/server/models';
+
+const { EmailSpamComplaintEvent } = models;
 
 describe('EmailSpamComplaintEvent', function () {
   describe('destroy', function () {
diff --git a/ghost/core/test/unit/server/models/member-click-event.test.js b/ghost/core/test/unit/server/models/member-click-event.test.ts
similarity index 69%
rename from ghost/core/test/unit/server/models/member-click-event.test.js
rename to ghost/core/test/unit/server/models/member-click-event.test.ts
index 653d1ecfd56..8c9aed863eb 100644
--- a/ghost/core/test/unit/server/models/member-click-event.test.js
+++ b/ghost/core/test/unit/server/models/member-click-event.test.ts
@@ -1,5 +1,8 @@
-const sinon = require('sinon');
-const { MemberClickEvent } = require('../../../../core/server/models/member-click-event');
+import sinon from 'sinon';
+// @ts-expect-error This module lacks type definitions.
+import models from '../../../../core/server/models';
+
+const { MemberClickEvent } = models;
 
 describe('Unit: models/MemberClickEvent', function () {
   afterEach(function () {
diff --git a/ghost/core/test/unit/server/models/member-feedback.test.js b/ghost/core/test/unit/server/models/member-feedback.test.ts
similarity index 75%
rename from ghost/core/test/unit/server/models/member-feedback.test.js
rename to ghost/core/test/unit/server/models/member-feedback.test.ts
index a92b608fef0..04983e3f7d8 100644
--- a/ghost/core/test/unit/server/models/member-feedback.test.js
+++ b/ghost/core/test/unit/server/models/member-feedback.test.ts
@@ -1,7 +1,10 @@
-const assert = require('node:assert/strict');
-const sinon = require('sinon');
-const errors = require('@tryghost/errors');
-const { MemberFeedback } = require('../../../../core/server/models/member-feedback');
+import assert from 'node:assert/strict';
+import sinon from 'sinon';
+import errors from '@tryghost/errors';
+// @ts-expect-error This module lacks type definitions.
+import models from '../../../../core/server/models';
+
+const { MemberFeedback } = models;
 
 describe('Unit: models/MemberFeedback', function () {
   afterEach(function () {
@@ -14,7 +17,8 @@ describe('Unit: models/MemberFeedback', function () {
         .then(function () {
           throw new Error('expected ValidationError');
         })
-        .catch(function (err) {
+        .catch(function (err: unknown) {
+          assert(Array.isArray(err));
           assert.equal(err.length, 1);
           assert.equal(err[0] instanceof errors.ValidationError, true);
           assert.match(err[0].context, /members_feedback\.member_id/);
@@ -26,7 +30,8 @@ describe('Unit: models/MemberFeedback', function () {
         .then(function () {
           throw new Error('expected ValidationError');
         })
-        .catch(function (err) {
+        .catch(function (err: unknown) {
+          assert(Array.isArray(err));
           assert.equal(err.length, 1);
           assert.equal(err[0] instanceof errors.ValidationError, true);
           assert.match(err[0].context, /members_feedback\.post_id/);
@@ -39,7 +44,7 @@ describe('Unit: models/MemberFeedback', function () {
       .then(function () {
         throw new Error('expected IncorrectUsageError');
       })
-      .catch(function (err) {
+      .catch(function (err: unknown) {
         assert.equal(err instanceof errors.IncorrectUsageError, true);
       });
   });
diff --git a/ghost/core/test/unit/server/models/member-paid-subscription-event.test.js b/ghost/core/test/unit/server/models/member-paid-subscription-event.test.ts
similarity index 72%
rename from ghost/core/test/unit/server/models/member-paid-subscription-event.test.js
rename to ghost/core/test/unit/server/models/member-paid-subscription-event.test.ts
index cd01d9632e2..848383e53e9 100644
--- a/ghost/core/test/unit/server/models/member-paid-subscription-event.test.js
+++ b/ghost/core/test/unit/server/models/member-paid-subscription-event.test.ts
@@ -1,7 +1,8 @@
-const sinon = require('sinon');
-const {
-  MemberPaidSubscriptionEvent,
-} = require('../../../../core/server/models/member-paid-subscription-event');
+import sinon from 'sinon';
+// @ts-expect-error This module lacks type definitions.
+import models from '../../../../core/server/models';
+
+const { MemberPaidSubscriptionEvent } = models;
 
 describe('Unit: models/MemberPaidSubscriptionEvent', function () {
   afterEach(function () {
diff --git a/ghost/core/test/unit/server/models/member-subscribe-event.test.js b/ghost/core/test/unit/server/models/member-subscribe-event.test.ts
similarity index 63%
rename from ghost/core/test/unit/server/models/member-subscribe-event.test.js
rename to ghost/core/test/unit/server/models/member-subscribe-event.test.ts
index 9ca1d3a5a5d..a825f7a1f62 100644
--- a/ghost/core/test/unit/server/models/member-subscribe-event.test.js
+++ b/ghost/core/test/unit/server/models/member-subscribe-event.test.ts
@@ -1,7 +1,10 @@
-const assert = require('node:assert/strict');
-const sinon = require('sinon');
-const errors = require('@tryghost/errors');
-const { MemberSubscribeEvent } = require('../../../../core/server/models/member-subscribe-event');
+import assert from 'node:assert/strict';
+import sinon from 'sinon';
+import errors from '@tryghost/errors';
+// @ts-expect-error This module lacks type definitions.
+import models from '../../../../core/server/models';
+
+const { MemberSubscribeEvent } = models;
 
 describe('Unit: models/MemberSubscribeEvent', function () {
   afterEach(function () {
@@ -14,7 +17,8 @@ describe('Unit: models/MemberSubscribeEvent', function () {
         .then(function () {
           throw new Error('expected ValidationError');
         })
-        .catch(function (err) {
+        .catch(function (err: unknown) {
+          assert(Array.isArray(err));
           assert.equal(err.length, 1);
           assert.equal(err[0] instanceof errors.ValidationError, true);
           assert.match(err[0].context, /members_subscribe_events\.source/);
diff --git a/ghost/core/test/unit/server/models/milestone.test.js b/ghost/core/test/unit/server/models/milestone.test.ts
similarity index 69%
rename from ghost/core/test/unit/server/models/milestone.test.js
rename to ghost/core/test/unit/server/models/milestone.test.ts
index cf2903057f9..b4421c42353 100644
--- a/ghost/core/test/unit/server/models/milestone.test.js
+++ b/ghost/core/test/unit/server/models/milestone.test.ts
@@ -1,6 +1,9 @@
-const { Milestone } = require('../../../../core/server/models/milestone');
-const assert = require('node:assert/strict');
-const errors = require('@tryghost/errors');
+import assert from 'node:assert/strict';
+import errors from '@tryghost/errors';
+// @ts-expect-error This module lacks type definitions.
+import models from '../../../../core/server/models';
+
+const { Milestone } = models;
 
 describe('Unit: models/milestone', function () {
   describe('validation', function () {
@@ -10,7 +13,8 @@ describe('Unit: models/milestone', function () {
           .then(function () {
             throw new Error('expected ValidationError');
           })
-          .catch(function (err) {
+          .catch(function (err: unknown) {
+            assert(Array.isArray(err));
             assert.equal(err.length, 2);
             assert.equal(err[0] instanceof errors.ValidationError, true);
             assert.equal(err[1] instanceof errors.ValidationError, true);
diff --git a/ghost/core/test/unit/server/models/newsletter.test.js b/ghost/core/test/unit/server/models/newsletter.test.ts
similarity index 69%
rename from ghost/core/test/unit/server/models/newsletter.test.js
rename to ghost/core/test/unit/server/models/newsletter.test.ts
index 8bba9488422..ac1646826a2 100644
--- a/ghost/core/test/unit/server/models/newsletter.test.js
+++ b/ghost/core/test/unit/server/models/newsletter.test.ts
@@ -1,8 +1,11 @@
 /* eslint no-invalid-this:0 */
-const assert = require('node:assert/strict');
-const errors = require('@tryghost/errors');
-const sinon = require('sinon');
-const { Newsletter } = require('../../../../core/server/models/newsletter');
+import assert from 'node:assert/strict';
+import errors from '@tryghost/errors';
+import sinon from 'sinon';
+// @ts-expect-error This module lacks type definitions.
+import models from '../../../../core/server/models';
+
+const { Newsletter } = models;
 
 describe('Unit: models/newsletter', function () {
   afterAll(function () {
@@ -16,7 +19,8 @@ describe('Unit: models/newsletter', function () {
           .then(function () {
             throw new Error('expected ValidationError');
           })
-          .catch(function (err) {
+          .catch(function (err: unknown) {
+            assert(Array.isArray(err));
             assert.equal(err.length, 2);
             assert.equal(err[0] instanceof errors.ValidationError, true);
             assert.equal(err[1] instanceof errors.ValidationError, true);
diff --git a/ghost/core/test/unit/server/models/permission.test.js b/ghost/core/test/unit/server/models/permission.test.ts
similarity index 50%
rename from ghost/core/test/unit/server/models/permission.test.js
rename to ghost/core/test/unit/server/models/permission.test.ts
index 0982c87e5b5..2b2bbb356d8 100644
--- a/ghost/core/test/unit/server/models/permission.test.js
+++ b/ghost/core/test/unit/server/models/permission.test.ts
@@ -1,7 +1,11 @@
-const assert = require('node:assert/strict');
-const sinon = require('sinon');
-const { Permission } = require('../../../../core/server/models/permission');
-const configUtils = require('../../../utils/config-utils');
+import assert from 'node:assert/strict';
+import sinon from 'sinon';
+// @ts-expect-error This module lacks type definitions.
+import models from '../../../../core/server/models';
+
+const { Permission } = models;
+// @ts-expect-error This module lacks type definitions.
+import configUtils from '../../../utils/config-utils';
 
 describe('Unit: models/permission', function () {
   afterAll(async function () {
@@ -15,7 +19,8 @@ describe('Unit: models/permission', function () {
         .then(function () {
           assert.equal('Should fail', true);
         })
-        .catch(function (err) {
+        .catch(function (err: unknown) {
+          assert(Array.isArray(err));
           assert.equal(err.length, 3);
         });
     });
diff --git a/ghost/core/test/unit/server/models/subscription-created-event.test.js b/ghost/core/test/unit/server/models/subscription-created-event.test.ts
similarity index 76%
rename from ghost/core/test/unit/server/models/subscription-created-event.test.js
rename to ghost/core/test/unit/server/models/subscription-created-event.test.ts
index 5e77340db47..406afe738dc 100644
--- a/ghost/core/test/unit/server/models/subscription-created-event.test.js
+++ b/ghost/core/test/unit/server/models/subscription-created-event.test.ts
@@ -1,9 +1,10 @@
-const assert = require('node:assert/strict');
-const sinon = require('sinon');
-const errors = require('@tryghost/errors');
-const {
-  SubscriptionCreatedEvent,
-} = require('../../../../core/server/models/subscription-created-event');
+import assert from 'node:assert/strict';
+import sinon from 'sinon';
+import errors from '@tryghost/errors';
+// @ts-expect-error This module lacks type definitions.
+import models from '../../../../core/server/models';
+
+const { SubscriptionCreatedEvent } = models;
 
 describe('Unit: models/SubscriptionCreatedEvent', function () {
   afterEach(function () {
@@ -20,7 +21,8 @@ describe('Unit: models/SubscriptionCreatedEvent', function () {
         .then(function () {
           throw new Error('expected ValidationError');
         })
-        .catch(function (err) {
+        .catch(function (err: unknown) {
+          assert(Array.isArray(err));
           assert.equal(err.length, 1);
           assert.equal(err[0] instanceof errors.ValidationError, true);
           assert.match(err[0].context, /members_subscription_created_events\.attribution_type/);
@@ -32,7 +34,8 @@ describe('Unit: models/SubscriptionCreatedEvent', function () {
         .then(function () {
           throw new Error('expected ValidationError');
         })
-        .catch(function (err) {
+        .catch(function (err: unknown) {
+          assert(Array.isArray(err));
           assert.equal(err.length, 1);
           assert.equal(err[0] instanceof errors.ValidationError, true);
           assert.match(err[0].context, /members_subscription_created_events\.member_id/);
@@ -44,7 +47,8 @@ describe('Unit: models/SubscriptionCreatedEvent', function () {
         .then(function () {
           throw new Error('expected ValidationError');
         })
-        .catch(function (err) {
+        .catch(function (err: unknown) {
+          assert(Array.isArray(err));
           assert.equal(err.length, 1);
           assert.equal(err[0] instanceof errors.ValidationError, true);
           assert.match(err[0].context, /members_subscription_created_events\.subscription_id/);
diff --git a/ghost/core/test/unit/server/models/suppression.test.js b/ghost/core/test/unit/server/models/suppression.test.js
deleted file mode 100644
index 1ed6e90447b..00000000000
--- a/ghost/core/test/unit/server/models/suppression.test.js
+++ /dev/null
@@ -1,8 +0,0 @@
-const assert = require('node:assert/strict');
-const Suppression = require('../../../../core/server/models/suppression');
-
-describe('Suppression', function () {
-  it('exists', function () {
-    assert(Suppression);
-  });
-});
diff --git a/ghost/core/test/unit/server/models/suppression.test.ts b/ghost/core/test/unit/server/models/suppression.test.ts
new file mode 100644
index 00000000000..120bfe504b7
--- /dev/null
+++ b/ghost/core/test/unit/server/models/suppression.test.ts
@@ -0,0 +1,11 @@
+import assert from 'node:assert/strict';
+// @ts-expect-error This module lacks type definitions.
+import models from '../../../../core/server/models';
+
+const { Suppression } = models;
+
+describe('Suppression', function () {
+  it('exists', function () {
+    assert(Suppression);
+  });
+});
diff --git a/ghost/core/test/unit/server/models/welcome-email-automation-run.test.js b/ghost/core/test/unit/server/models/welcome-email-automation-run.test.ts
similarity index 87%
rename from ghost/core/test/unit/server/models/welcome-email-automation-run.test.js
rename to ghost/core/test/unit/server/models/welcome-email-automation-run.test.ts
index baed77b1a3a..ff06f6cd068 100644
--- a/ghost/core/test/unit/server/models/welcome-email-automation-run.test.js
+++ b/ghost/core/test/unit/server/models/welcome-email-automation-run.test.ts
@@ -1,7 +1,8 @@
-const assert = require('node:assert/strict');
-const {
-  WelcomeEmailAutomationRun,
-} = require('../../../../core/server/models/welcome-email-automation-run');
+import assert from 'node:assert/strict';
+// @ts-expect-error This module lacks type definitions.
+import models from '../../../../core/server/models';
+
+const { WelcomeEmailAutomationRun } = models;
 
 describe('Unit: models/welcome-email-automation-run', function () {
   describe('tableName', function () {
diff --git a/ghost/core/test/unit/server/services/automations/automations-repository.test.ts b/ghost/core/test/unit/server/services/automations/automations-repository.test.ts
index 575d0cc823f..e18153d0e71 100644
--- a/ghost/core/test/unit/server/services/automations/automations-repository.test.ts
+++ b/ghost/core/test/unit/server/services/automations/automations-repository.test.ts
@@ -13,7 +13,7 @@ import type {
   AutomationsRepository,
   AutomationStepToRun,
 } from '../../../../../core/server/services/automations/automations-repository';
-import { fromDatabaseDate, toDatabaseDate } from '../../../../../core/server/lib/db-date';
+import { fromDatabaseDate, toDatabaseDate } from '../../../../../core/server/lib/db-types/date';
 
 const HOUR_MS = 60 * 60 * 1000;
 const FAKE_WAIT_HOURS_MULTIPLIER = 2500;
diff --git a/ghost/core/test/unit/server/services/content-import/import/importer.test.ts b/ghost/core/test/unit/server/services/content-import/import/importer.test.ts
index d08124bf46d..15b1eb73cec 100644
--- a/ghost/core/test/unit/server/services/content-import/import/importer.test.ts
+++ b/ghost/core/test/unit/server/services/content-import/import/importer.test.ts
@@ -5,6 +5,7 @@ import ContentCSVImporter from '../../../../../../core/server/services/content-i
 import { ImportRunStore } from '../../../../../../core/server/services/content-import/import/store';
 import type { PostImportRow } from '../../../../../../core/server/services/content-import/import/row';
 import type { PostData } from '../../../../../../core/server/services/content-import/import/post-data';
+import type { PostWriteMetadata } from '../../../../../../core/server/services/content-import/import/post-repository';
 
 const row = (title: string, html = `<p>${title}</p>`): PostImportRow => ({
   title,
@@ -15,10 +16,13 @@ const row = (title: string, html = `<p>${title}</p>`): PostImportRow => ({
 
 // Collaborators are handed back as `deps` so a test can repoint the seam it is breaking.
 function harness(rows: PostImportRow[] = [row('First'), row('Second')]) {
-  const created: Array<{ data: PostData; options: object }> = [];
+  const created: Array<{ data: PostData; options: object; metadata?: PostWriteMetadata }> = [];
   const reported: unknown[] = [];
   const jobs: Array<{ name: string; offloaded: boolean; job: () => Promise<void> }> = [];
   const createFailures = new Map<string, unknown>();
+  const duplicateSlugs = new Set<string>();
+  const updatedTitles = new Set<string>();
+  const warningsByTitle = new Map<string, string[]>();
   const urlFailures = new Map<string, unknown>();
   const store = new ImportRunStore();
   let converterResolutions = 0;
@@ -41,14 +45,24 @@ function harness(rows: PostImportRow[] = [row('First'), row('Second')]) {
   const deps = {
     readRows: async () => rows,
     posts: {
-      create: async (data: PostData, options: object) => {
+      write: async (data: PostData, options: object, metadata?: PostWriteMetadata) => {
         const failure = createFailures.get(data.title);
         if (failure) {
           throw failure;
         }
-        created.push({ data, options });
+        if (duplicateSlugs.has(data.slug)) {
+          return {
+            status: 'skipped' as const,
+            reason: `A post with the slug "${data.slug}" already exists.`,
+          };
+        }
+        created.push({ data, options, metadata });
         const id = `post_${created.length}`;
-        return { id, toJSON: () => ({ id, slug: `slug-${created.length}` }) };
+        return {
+          status: updatedTitles.has(data.title) ? ('updated' as const) : ('created' as const),
+          post: { id, toJSON: () => ({ id, slug: `slug-${created.length}` }) },
+          warnings: warningsByTitle.get(data.title) ?? [],
+        };
       },
     },
     getHtmlToLexical: () => htmlToLexicalFactory(),
@@ -107,6 +121,9 @@ function harness(rows: PostImportRow[] = [row('First'), row('Second')]) {
     reported,
     jobs,
     createFailures,
+    duplicateSlugs,
+    updatedTitles,
+    warningsByTitle,
     urlFailures,
     store,
     setHtmlToLexicalFactory,
@@ -306,9 +323,35 @@ describe('ContentCSVImporter', function () {
     );
     for (const call of h.created) {
       assert.deepEqual(call.options, { importing: true, context: { internal: true } });
+      assert.deepEqual(call.metadata, {
+        sourceUpdatedAt: undefined,
+        authorNames: undefined,
+        authorEmails: undefined,
+        tagNames: undefined,
+      });
     }
   });
 
+  it('forwards author and tag cells to the transactional write seam', async function () {
+    const h = harness([
+      {
+        ...row('Related post'),
+        authors: 'Alice, Bob',
+        author_emails: 'alice@example.com, bob@example.com',
+        tags: 'News, Features',
+      },
+    ]);
+
+    await h.run();
+
+    assert.deepEqual(h.created[0].metadata, {
+      sourceUpdatedAt: undefined,
+      authorNames: 'Alice, Bob',
+      authorEmails: 'alice@example.com, bob@example.com',
+      tagNames: 'News, Features',
+    });
+  });
+
   it('files every row of a run under a date-stamped tag and a unique run tag', async function () {
     const h = harness();
 
@@ -481,6 +524,93 @@ describe('ContentCSVImporter', function () {
     });
   });
 
+  it('records an existing slug as skipped without treating it as a failed write', async function () {
+    const h = harness([row('Duplicate'), row('Created')]);
+    h.duplicateSlugs.add('duplicate');
+
+    await h.run();
+
+    assert.deepEqual(
+      h.created.map((call) => call.data.title),
+      ['Created'],
+    );
+    assert.deepEqual(h.reported, []);
+    assert.deepEqual(h.store.get('run_test')?.rows, [
+      {
+        line: 2,
+        title: 'Duplicate',
+        status: 'skipped',
+        reason: 'A post with the slug "duplicate" already exists.',
+      },
+      {
+        line: 3,
+        title: 'Created',
+        status: 'created',
+        postId: 'post_1',
+        url: 'https://example.com/post_1/',
+      },
+    ]);
+  });
+
+  it('records an updated post and forwards only its explicit source timestamp', async function () {
+    const updatedRow = { ...row('Updated'), updated_at: '2025-02-01T00:00:00.000Z' };
+    const h = harness([updatedRow]);
+    h.updatedTitles.add('Updated');
+
+    await h.run();
+
+    assert.deepEqual(h.created[0].metadata, {
+      sourceUpdatedAt: '2025-02-01T00:00:00.000Z',
+      authorNames: undefined,
+      authorEmails: undefined,
+      tagNames: undefined,
+    });
+    assert.deepEqual(h.store.get('run_test')?.rows, [
+      {
+        line: 2,
+        title: 'Updated',
+        status: 'updated',
+        postId: 'post_1',
+        url: 'https://example.com/post_1/',
+      },
+    ]);
+  });
+
+  it('records a failed update against its row and continues importing', async function () {
+    const h = harness([row('Update failure'), row('Created')]);
+    h.updatedTitles.add('Update failure');
+    h.createFailures.set('Update failure', new Error('update failed'));
+
+    await h.run();
+
+    assert.deepEqual(h.store.get('run_test')?.rows[0], {
+      line: 2,
+      title: 'Update failure',
+      status: 'failed',
+      reason: 'update failed',
+    });
+    assert.deepEqual(
+      h.created.map((call) => call.data.title),
+      ['Created'],
+    );
+    assert.deepEqual(h.reported, []);
+  });
+
+  it('completes without reporting when every row is an existing slug', async function () {
+    const h = harness([row('First'), row('Second')]);
+    h.duplicateSlugs.add('first');
+    h.duplicateSlugs.add('second');
+
+    await h.run();
+
+    assert.equal(h.created.length, 0);
+    assert.deepEqual(h.reported, []);
+    assert.deepEqual(
+      h.store.get('run_test')?.rows.map((outcome) => outcome.status),
+      ['skipped', 'skipped'],
+    );
+  });
+
   it('reports once when every attempted write fails', async function () {
     const h = harness([row('First'), row('Second')]);
     h.createFailures.set('First', new Error('first insert failed'));
@@ -507,6 +637,19 @@ describe('ContentCSVImporter', function () {
     );
   });
 
+  it('uses the singular post noun when the only attempted write fails', async function () {
+    const h = harness([row('Only')]);
+    h.createFailures.set('Only', new Error('only insert failed'));
+
+    await h.run();
+
+    assert.equal(h.reported.length, 1);
+    assert.equal(
+      (h.reported[0] as Error).message,
+      'Content import failed to write all 1 attempted post.',
+    );
+  });
+
   it('skips a malformed row on its own and imports the rest', async function () {
     const h = harness([
       row('First'),
@@ -645,15 +788,34 @@ describe('ContentCSVImporter', function () {
     assert.equal(h.store.get('run_test')?.failureReason, 'Unknown error');
   });
 
-  it('keeps a successfully written post created when its URL cannot be resolved', async function () {
+  it('records relation warnings on successful row outcomes', async function () {
+    const h = harness([row('Owner fallback')]);
+    h.warningsByTitle.set('Owner fallback', [
+      'Author "Missing Author" has no email; assigned Owner instead.',
+    ]);
+
+    await h.run();
+
+    assert.deepEqual(h.store.get('run_test')?.rows[0], {
+      line: 2,
+      title: 'Owner fallback',
+      status: 'created',
+      postId: 'post_1',
+      url: 'https://example.com/post_1/',
+      warnings: ['Author "Missing Author" has no email; assigned Owner instead.'],
+    });
+  });
+
+  it('keeps a successfully written post when its URL cannot be resolved', async function () {
     const h = harness();
+    h.updatedTitles.add('First');
     h.urlFailures.set('post_1', new Error('URL service unavailable'));
 
     await h.run();
 
     assert.equal(h.created.length, 2);
     assert.deepEqual(h.store.get('run_test')?.rows, [
-      { line: 2, title: 'First', status: 'created', postId: 'post_1' },
+      { line: 2, title: 'First', status: 'updated', postId: 'post_1' },
       {
         line: 3,
         title: 'Second',
@@ -665,7 +827,7 @@ describe('ContentCSVImporter', function () {
     assert.equal(h.reported.length, 1);
     assert.equal(
       (h.reported[0] as Error).message,
-      'Content import could not resolve a URL for 1 created post.',
+      'Content import could not resolve a URL for 1 imported post.',
     );
     assert.match((h.reported[0] as Error).stack ?? '', /URL service unavailable/);
   });
@@ -684,7 +846,7 @@ describe('ContentCSVImporter', function () {
     assert.equal(h.reported.length, 1);
     assert.equal(
       (h.reported[0] as Error).message,
-      'Content import could not resolve a URL for 2 created posts.',
+      'Content import could not resolve a URL for 2 imported posts.',
     );
     assert.match(
       (h.reported[0] as Error).stack ?? '',
diff --git a/ghost/core/test/unit/server/services/content-import/import/post-data.test.ts b/ghost/core/test/unit/server/services/content-import/import/post-data.test.ts
index a47f7b18a88..c6272df68cb 100644
--- a/ghost/core/test/unit/server/services/content-import/import/post-data.test.ts
+++ b/ghost/core/test/unit/server/services/content-import/import/post-data.test.ts
@@ -88,6 +88,17 @@ describe('buildPostData', function () {
     assert.equal(data.lexical, JSON.stringify({ converted: '<h1>Hello</h1>' }));
   });
 
+  it('skips markdown when no renderer is available', function () {
+    assert.throws(
+      () => buildPostData(row({ title: 'T', markdown: '# Hello' }), htmlToLexical, TAGS),
+      (error: unknown) => {
+        assert.ok(error instanceof RowSkipped);
+        assert.equal(error.message, 'markdown could not be converted');
+        return true;
+      },
+    );
+  });
+
   it('cleans markdown-rendered HTML before converting it to lexical', function () {
     const styledMarkdownRenderer = () => '<p style="text-align: right; color: red">Hello</p>';
     const data = buildPostData(
@@ -160,6 +171,7 @@ describe('buildPostData', function () {
       data.tags,
       TAGS.map((name) => ({ name })),
     );
+    assert.equal('comment_id' in data, false);
     assert.equal('authors' in data, false);
   });
 
@@ -178,6 +190,7 @@ describe('buildPostData', function () {
         custom_template: 'wide',
         codeinjection_head: '<style>body{color:red}</style>',
         codeinjection_foot: '<script>window.test=true</script>',
+        comment_id: 'legacy-source-123',
       }),
       htmlToLexical,
       TAGS,
@@ -194,6 +207,7 @@ describe('buildPostData', function () {
     assert.equal(data.custom_template, 'wide');
     assert.equal(data.codeinjection_head, '<style>body{color:red}</style>');
     assert.equal(data.codeinjection_foot, '<script>window.test=true</script>');
+    assert.equal(data.comment_id, 'legacy-source-123');
   });
 
   it('puts feature metadata, SEO, social fields, and frontmatter in posts_meta', function () {
@@ -289,6 +303,23 @@ describe('buildPostData', function () {
     assert.equal(data.title.length, 255);
   });
 
+  it('accepts a source ID of exactly 50 characters', function () {
+    const data = buildPostData(
+      row({ title: 'T', comment_id: 'x'.repeat(50) }),
+      htmlToLexical,
+      TAGS,
+    );
+
+    assert.equal(data.comment_id, 'x'.repeat(50));
+  });
+
+  it('skips a row whose source ID is longer than 50 characters', function () {
+    skipsWith(
+      { title: 'T', comment_id: 'x'.repeat(51) },
+      'comment_id must be 50 characters or fewer',
+    );
+  });
+
   it('skips a row whose published_at is not a date, quoting the cell', function () {
     skipsWith(
       { title: 'T', published_at: 'not-a-date' },
@@ -296,6 +327,13 @@ describe('buildPostData', function () {
     );
   });
 
+  it('skips a row whose explicit updated_at is not a date', function () {
+    skipsWith(
+      { title: 'T', updated_at: 'not-an-update-date' },
+      'updated_at is not a valid date: "not-an-update-date"',
+    );
+  });
+
   it('skips a row whose published_at is a rolled-over calendar date', function () {
     // new Date() would normalize this to March 2 and quietly mis-date the post
     skipsWith(
diff --git a/ghost/core/test/unit/server/services/content-import/import/post-repository.test.ts b/ghost/core/test/unit/server/services/content-import/import/post-repository.test.ts
new file mode 100644
index 00000000000..298781866a6
--- /dev/null
+++ b/ghost/core/test/unit/server/services/content-import/import/post-repository.test.ts
@@ -0,0 +1,562 @@
+import assert from 'node:assert/strict';
+import sinon from 'sinon';
+import { BookshelfPostsRepository } from '../../../../../../core/server/services/content-import/import/post-repository';
+import type { PostData } from '../../../../../../core/server/services/content-import/import/post-data';
+
+const data: PostData = {
+  title: 'Imported post',
+  slug: 'imported-post',
+  status: 'published',
+  type: 'post',
+  visibility: 'public',
+  tags: [],
+};
+
+function harness() {
+  const transacting = { transaction: true };
+  const existing = {
+    id: 'existing',
+    toJSON: sinon.stub().returns({ id: 'existing', updated_at: new Date('2025-01-01T00:00:00Z') }),
+  };
+  const created = { id: 'created', toJSON: () => ({ id: 'created' }) };
+  const updated = { id: 'existing', toJSON: () => ({ id: 'existing' }) };
+  const findOne = sinon.stub().resolves(null);
+  const findUser = sinon.stub().resolves(null);
+  const getUserByEmail = sinon.stub().resolves(undefined);
+  const addUser = sinon.stub().resolves({ id: 'author-created' });
+  const getOwnerUser = sinon.stub().resolves({ id: 'owner' });
+  const findTag = sinon.stub().resolves(null);
+  const addTag = sinon.stub().resolves({ id: 'tag-created' });
+  const add = sinon.stub().resolves(created);
+  const edit = sinon.stub().resolves(updated);
+  const transaction = sinon.stub().callsFake(async (callback) => callback(transacting));
+  const repository = new BookshelfPostsRepository({
+    Base: { transaction },
+    Post: { findOne, add, edit },
+    User: { findOne: findUser, getByEmail: getUserByEmail, add: addUser, getOwnerUser },
+    Tag: { findOne: findTag, add: addTag },
+  });
+
+  return {
+    repository,
+    transaction,
+    transacting,
+    findOne,
+    findUser,
+    getUserByEmail,
+    addUser,
+    getOwnerUser,
+    findTag,
+    addTag,
+    add,
+    edit,
+    existing,
+    created,
+    updated,
+  };
+}
+
+describe('BookshelfPostsRepository', function () {
+  afterEach(function () {
+    sinon.restore();
+  });
+
+  it('locks the matching slug and creates the post in one transaction', async function () {
+    const h = harness();
+    const options = { importing: true, context: { internal: true } };
+
+    const result = await h.repository.write(data, options);
+
+    assert.deepEqual(result, { status: 'created', post: h.created, warnings: [] });
+    sinon.assert.calledOnce(h.transaction);
+    sinon.assert.calledWithExactly(
+      h.findOne,
+      { slug: 'imported-post', status: 'all' },
+      { ...options, transacting: h.transacting, forUpdate: true },
+    );
+    sinon.assert.calledWithExactly(h.add, data, { ...options, transacting: h.transacting });
+    assert.equal('transacting' in options, false, 'caller options are not mutated');
+  });
+
+  it('skips an existing slug without creating another post', async function () {
+    const h = harness();
+    h.findOne.resolves(h.existing);
+
+    const result = await h.repository.write(data, {
+      importing: true,
+      context: { internal: true },
+    });
+
+    assert.deepEqual(result, {
+      status: 'skipped',
+      reason: 'A post with the slug "imported-post" already exists.',
+    });
+    sinon.assert.notCalled(h.add);
+    sinon.assert.notCalled(h.edit);
+  });
+
+  it('matches an explicit source ID before considering the slug', async function () {
+    const h = harness();
+    h.findOne.resolves(h.existing);
+
+    const result = await h.repository.write(
+      { ...data, comment_id: 'source-123', slug: 'a-different-slug' },
+      { importing: true, context: { internal: true } },
+    );
+
+    assert.deepEqual(result, {
+      status: 'skipped',
+      reason: 'A post with the source ID "source-123" already exists.',
+    });
+    sinon.assert.calledOnce(h.findOne);
+    sinon.assert.calledWithMatch(h.findOne, {
+      comment_id: 'source-123',
+      status: 'all',
+    });
+    sinon.assert.notCalled(h.add);
+    sinon.assert.notCalled(h.edit);
+  });
+
+  it('falls back to the slug when an explicit source ID does not match', async function () {
+    const h = harness();
+    h.findOne.onFirstCall().resolves(null);
+    h.findOne.onSecondCall().resolves(h.existing);
+
+    const result = await h.repository.write(
+      { ...data, comment_id: 'new-source' },
+      { importing: true, context: { internal: true } },
+    );
+
+    assert.deepEqual(result, {
+      status: 'skipped',
+      reason: 'A post with the slug "imported-post" already exists.',
+    });
+    assert.deepEqual(h.findOne.firstCall.args[0], {
+      comment_id: 'new-source',
+      status: 'all',
+    });
+    assert.deepEqual(h.findOne.secondCall.args[0], {
+      slug: 'imported-post',
+      status: 'all',
+    });
+    sinon.assert.notCalled(h.add);
+    sinon.assert.notCalled(h.edit);
+  });
+
+  it('creates with an explicit source ID when neither source ID nor slug matches', async function () {
+    const h = harness();
+    const sourceData = { ...data, comment_id: 'new-source' };
+
+    const result = await h.repository.write(sourceData, {
+      importing: true,
+      context: { internal: true },
+    });
+
+    assert.deepEqual(result, { status: 'created', post: h.created, warnings: [] });
+    sinon.assert.calledTwice(h.findOne);
+    sinon.assert.calledWithExactly(
+      h.add,
+      sourceData,
+      sinon.match({ importing: true, transacting: h.transacting }),
+    );
+    sinon.assert.notCalled(h.edit);
+  });
+
+  it('reconciles existing authors and tags before creating the post', async function () {
+    const h = harness();
+    h.getUserByEmail.resolves({ id: 'author-existing' });
+    h.findTag.resolves({ id: 'tag-existing' });
+    const options = { importing: true, context: { internal: true } };
+
+    await h.repository.write(data, options, {
+      authorNames: 'Existing Author',
+      authorEmails: 'author@example.com',
+      tagNames: 'Existing Tag',
+    });
+
+    sinon.assert.calledWithExactly(
+      h.add,
+      {
+        ...data,
+        authors: [{ id: 'author-existing' }],
+        tags: [{ id: 'tag-existing' }, ...data.tags],
+      },
+      { ...options, transacting: h.transacting },
+    );
+    sinon.assert.calledWithExactly(h.getUserByEmail, 'author@example.com', {
+      ...options,
+      transacting: h.transacting,
+    });
+    sinon.assert.calledWithExactly(
+      h.findTag,
+      { name: 'Existing Tag' },
+      { ...options, transacting: h.transacting },
+    );
+  });
+
+  it('creates missing tags inside the post transaction and attaches their IDs', async function () {
+    const h = harness();
+    const options = { importing: true, context: { internal: true } };
+
+    await h.repository.write(data, options, { tagNames: 'New Tag' });
+
+    sinon.assert.calledWithExactly(
+      h.addTag,
+      { name: 'New Tag' },
+      { ...options, transacting: h.transacting },
+    );
+    sinon.assert.calledWithExactly(
+      h.add,
+      { ...data, tags: [{ id: 'tag-created' }, ...data.tags] },
+      { ...options, transacting: h.transacting },
+    );
+  });
+
+  it('creates missing contributors and returns Owner fallback warnings with the post', async function () {
+    const h = harness();
+    const options = { importing: true, context: { internal: true } };
+
+    const result = await h.repository.write(data, options, {
+      authorNames: 'New Contributor,Missing Email',
+      authorEmails: 'new@example.com,',
+    });
+
+    assert.deepEqual(result, {
+      status: 'created',
+      post: h.created,
+      warnings: ['Author "Missing Email" has no email; assigned Owner instead.'],
+    });
+    sinon.assert.calledWithExactly(
+      h.addUser,
+      {
+        name: 'New Contributor',
+        email: 'new@example.com',
+        roles: ['Contributor'],
+      },
+      { ...options, transacting: h.transacting },
+    );
+    sinon.assert.calledWithExactly(h.getOwnerUser, { ...options, transacting: h.transacting });
+    assert.deepEqual(h.add.firstCall.args[0].authors, [{ id: 'author-created' }, { id: 'owner' }]);
+  });
+
+  it('does not reconcile relations for a skipped duplicate', async function () {
+    const h = harness();
+    h.findOne.resolves(h.existing);
+
+    await h.repository.write(
+      data,
+      {},
+      {
+        authorEmails: 'author@example.com',
+        tagNames: 'Existing Tag',
+      },
+    );
+
+    sinon.assert.notCalled(h.findUser);
+    sinon.assert.notCalled(h.getUserByEmail);
+    sinon.assert.notCalled(h.findTag);
+    sinon.assert.notCalled(h.add);
+    sinon.assert.notCalled(h.edit);
+  });
+
+  it('updates a matching post when the explicit incoming timestamp is newer', async function () {
+    const h = harness();
+    const options = { importing: true, context: { internal: true } };
+    const updatedData = { ...data, updated_at: '2025-02-01T00:00:00.000Z' };
+    h.findOne.resolves(h.existing);
+
+    const result = await h.repository.write(updatedData, options, {
+      sourceUpdatedAt: '2025-02-01T00:00:00.000Z',
+    });
+
+    assert.deepEqual(result, { status: 'updated', post: h.updated, warnings: [] });
+    sinon.assert.calledTwice(h.edit);
+    sinon.assert.calledWithExactly(
+      h.edit.firstCall,
+      { ...updatedData, updated_at: new Date('2025-01-01T00:00:00Z') },
+      {
+        ...options,
+        transacting: h.transacting,
+        id: 'existing',
+      },
+    );
+    sinon.assert.calledWithExactly(
+      h.edit.secondCall,
+      { updated_at: '2025-02-01T00:00:00.000Z' },
+      {
+        ...options,
+        transacting: h.transacting,
+        id: 'existing',
+      },
+    );
+    sinon.assert.notCalled(h.add);
+  });
+
+  it('compares equal timestamps as instants and skips the update', async function () {
+    const h = harness();
+    h.findOne.resolves(h.existing);
+
+    const result = await h.repository.write(
+      data,
+      {},
+      {
+        sourceUpdatedAt: '2025-01-01T01:00:00+01:00',
+      },
+    );
+
+    assert.deepEqual(result, {
+      status: 'skipped',
+      reason: 'The existing post is newer than or as recent as the imported row.',
+    });
+    sinon.assert.notCalled(h.edit);
+  });
+
+  it('skips an older incoming timestamp', async function () {
+    const h = harness();
+    h.findOne.resolves(h.existing);
+
+    const result = await h.repository.write(
+      data,
+      {},
+      {
+        sourceUpdatedAt: '2024-12-31T23:59:59.999Z',
+      },
+    );
+
+    assert.deepEqual(result.status, 'skipped');
+    sinon.assert.notCalled(h.edit);
+  });
+
+  it('treats a missing stored timestamp as older', async function () {
+    const h = harness();
+    h.existing.toJSON.returns({ id: 'existing', updated_at: null });
+    h.findOne.resolves(h.existing);
+
+    const result = await h.repository.write(
+      { ...data, updated_at: '2025-01-01T00:00:00.000Z' },
+      { importing: true },
+      { sourceUpdatedAt: '2025-01-01T00:00:00.000Z' },
+    );
+
+    assert.deepEqual(result, { status: 'updated', post: h.updated, warnings: [] });
+    sinon.assert.calledTwice(h.edit);
+    assert.equal('updated_at' in h.edit.firstCall.args[0], false);
+  });
+
+  it('reconciles relations before updating a newer post', async function () {
+    const h = harness();
+    h.findOne.resolves(h.existing);
+    h.findUser.resolves({ id: 'author-existing' });
+    h.findTag.resolves({ id: 'tag-existing' });
+
+    await h.repository.write(
+      { ...data, updated_at: '2025-02-01T00:00:00.000Z' },
+      { importing: true },
+      {
+        sourceUpdatedAt: '2025-02-01T00:00:00.000Z',
+        authorNames: 'Existing Author',
+        tagNames: 'Existing Tag',
+      },
+    );
+
+    assert.deepEqual(h.edit.firstCall.args[0].authors, [{ id: 'author-existing' }]);
+    assert.deepEqual(h.edit.firstCall.args[0].tags, [{ id: 'tag-existing' }]);
+  });
+
+  it('does not update for an invalid incoming timestamp', async function () {
+    const h = harness();
+    h.findOne.resolves(h.existing);
+
+    const result = await h.repository.write(data, {}, { sourceUpdatedAt: 'not-a-date' });
+
+    assert.deepEqual(result.status, 'skipped');
+    sinon.assert.notCalled(h.edit);
+  });
+
+  it('propagates lookup failures and never attempts the insert', async function () {
+    const h = harness();
+    const failure = new Error('lookup failed');
+    h.findOne.rejects(failure);
+
+    await assert.rejects(
+      h.repository.write(data, { importing: true, context: { internal: true } }),
+      failure,
+    );
+
+    sinon.assert.notCalled(h.add);
+  });
+
+  it('propagates source ID lookup failures without falling back to the slug', async function () {
+    const h = harness();
+    const failure = new Error('source lookup failed');
+    h.findOne.rejects(failure);
+
+    await assert.rejects(
+      h.repository.write(
+        { ...data, comment_id: 'source-123' },
+        { importing: true, context: { internal: true } },
+      ),
+      failure,
+    );
+
+    sinon.assert.calledOnce(h.findOne);
+    sinon.assert.notCalled(h.add);
+  });
+
+  it('propagates insert failures through the transaction', async function () {
+    const h = harness();
+    const failure = new Error('insert failed');
+    h.add.rejects(failure);
+
+    await assert.rejects(
+      h.repository.write(data, { importing: true, context: { internal: true } }),
+      failure,
+    );
+  });
+
+  it('keeps contributor creation in the post transaction so insert failures roll it back', async function () {
+    const h = harness();
+    const failure = new Error('post insert failed');
+    h.add.rejects(failure);
+    const options = { importing: true, context: { internal: true } };
+
+    await assert.rejects(
+      h.repository.write(data, options, {
+        authorNames: 'New Contributor',
+        authorEmails: 'new@example.com',
+      }),
+      failure,
+    );
+
+    sinon.assert.calledWithExactly(
+      h.addUser,
+      {
+        name: 'New Contributor',
+        email: 'new@example.com',
+        roles: ['Contributor'],
+      },
+      { ...options, transacting: h.transacting },
+    );
+    sinon.assert.calledWithExactly(h.add, sinon.match.object, {
+      ...options,
+      transacting: h.transacting,
+    });
+  });
+
+  it('keeps tag creation in the post transaction so insert failures roll it back', async function () {
+    const h = harness();
+    const failure = new Error('post insert failed');
+    h.add.rejects(failure);
+    const options = { importing: true, context: { internal: true } };
+
+    await assert.rejects(h.repository.write(data, options, { tagNames: 'New Tag' }), failure);
+
+    sinon.assert.calledWithExactly(
+      h.addTag,
+      { name: 'New Tag' },
+      { ...options, transacting: h.transacting },
+    );
+    sinon.assert.calledWithExactly(h.add, sinon.match.object, {
+      ...options,
+      transacting: h.transacting,
+    });
+  });
+
+  it('propagates tag model failures without writing the post', async function () {
+    const h = harness();
+    const failure = new Error('tag insert failed');
+    h.addTag.rejects(failure);
+
+    await assert.rejects(
+      h.repository.write(data, { importing: true }, { tagNames: 'New Tag' }),
+      failure,
+    );
+
+    sinon.assert.notCalled(h.add);
+    sinon.assert.notCalled(h.edit);
+  });
+
+  it('propagates contributor model failures without writing the post', async function () {
+    const h = harness();
+    const failure = new Error('contributor insert failed');
+    h.addUser.rejects(failure);
+
+    await assert.rejects(
+      h.repository.write(
+        data,
+        { importing: true },
+        { authorNames: 'New Contributor', authorEmails: 'new@example.com' },
+      ),
+      failure,
+    );
+
+    sinon.assert.notCalled(h.add);
+    sinon.assert.notCalled(h.edit);
+  });
+
+  it('propagates relation lookup failures without writing the post', async function () {
+    const h = harness();
+    const failure = new Error('relation lookup failed');
+    h.getUserByEmail.rejects(failure);
+
+    await assert.rejects(
+      h.repository.write(data, { importing: true }, { authorEmails: 'author@example.com' }),
+      failure,
+    );
+
+    sinon.assert.notCalled(h.add);
+    sinon.assert.notCalled(h.edit);
+  });
+
+  it('propagates update failures through the transaction', async function () {
+    const h = harness();
+    const failure = new Error('update failed');
+    h.findOne.resolves(h.existing);
+    h.edit.rejects(failure);
+
+    await assert.rejects(
+      h.repository.write(
+        { ...data, updated_at: '2025-02-01T00:00:00.000Z' },
+        { importing: true },
+        { sourceUpdatedAt: '2025-02-01T00:00:00.000Z' },
+      ),
+      failure,
+    );
+
+    sinon.assert.notCalled(h.add);
+  });
+
+  it('rolls back when persisting the incoming update timestamp fails', async function () {
+    const h = harness();
+    const failure = new Error('timestamp update failed');
+    h.findOne.resolves(h.existing);
+    h.edit.onFirstCall().resolves(h.updated);
+    h.edit.onSecondCall().rejects(failure);
+
+    await assert.rejects(
+      h.repository.write(
+        { ...data, updated_at: '2025-02-01T00:00:00.000Z' },
+        { importing: true },
+        { sourceUpdatedAt: '2025-02-01T00:00:00.000Z' },
+      ),
+      failure,
+    );
+
+    sinon.assert.calledTwice(h.edit);
+    sinon.assert.notCalled(h.add);
+  });
+
+  it('propagates a failure to open the transaction without querying posts', async function () {
+    const h = harness();
+    const failure = new Error('transaction failed');
+    h.transaction.rejects(failure);
+
+    await assert.rejects(
+      h.repository.write(data, { importing: true, context: { internal: true } }),
+      failure,
+    );
+
+    sinon.assert.notCalled(h.findOne);
+    sinon.assert.notCalled(h.add);
+  });
+});
diff --git a/ghost/core/test/unit/server/services/content-import/import/reader.test.ts b/ghost/core/test/unit/server/services/content-import/import/reader.test.ts
index bd481ae7edc..b2ebc649271 100644
--- a/ghost/core/test/unit/server/services/content-import/import/reader.test.ts
+++ b/ghost/core/test/unit/server/services/content-import/import/reader.test.ts
@@ -41,7 +41,10 @@ describe('content import reader', function () {
 
   it('keeps full editorial identity headers for direct API clients', async function () {
     const file = path.join(directory, 'full-post.csv');
-    await fs.writeFile(file, 'title,slug,featured,meta_title\nHello,custom,1,Search title\n');
+    await fs.writeFile(
+      file,
+      'title,slug,featured,meta_title,comment_id,authors,author_emails,tags\nHello,custom,1,Search title,source-123,"Alice, Bob","alice@example.com, bob@example.com","News, Features"\n',
+    );
 
     const rows = await readPostRows(file);
 
@@ -51,6 +54,10 @@ describe('content import reader', function () {
         slug: 'custom',
         featured: '1',
         meta_title: 'Search title',
+        comment_id: 'source-123',
+        authors: 'Alice, Bob',
+        author_emails: 'alice@example.com, bob@example.com',
+        tags: 'News, Features',
         html: '',
         markdown: '',
       },
diff --git a/ghost/core/test/unit/server/services/content-import/import/relations.test.ts b/ghost/core/test/unit/server/services/content-import/import/relations.test.ts
new file mode 100644
index 00000000000..7755fe318ab
--- /dev/null
+++ b/ghost/core/test/unit/server/services/content-import/import/relations.test.ts
@@ -0,0 +1,483 @@
+import assert from 'node:assert/strict';
+import sinon from 'sinon';
+import {
+  BookshelfPostRelationsResolver,
+  parseAuthorReferences,
+  parseTagReferences,
+} from '../../../../../../core/server/services/content-import/import/relations';
+import type { PostData } from '../../../../../../core/server/services/content-import/import/post-data';
+
+const data: PostData = {
+  title: 'Imported post',
+  slug: 'imported-post',
+  status: 'published',
+  type: 'post',
+  visibility: 'public',
+  tags: [{ name: '#Import batch' }],
+};
+
+const relation = (id: string) => ({ id });
+const userModels = (
+  findOne: sinon.SinonStub = sinon.stub().resolves(null),
+  add: sinon.SinonStub = sinon.stub().resolves(relation('author-created')),
+  getOwnerUser: sinon.SinonStub = sinon.stub().resolves(relation('owner')),
+  getByEmail: sinon.SinonStub = sinon.stub().resolves(undefined),
+) => ({ findOne, getByEmail, add, getOwnerUser });
+const tagModels = (
+  findOne: sinon.SinonStub = sinon.stub().resolves(null),
+  add: sinon.SinonStub = sinon.stub().resolves(relation('tag-created')),
+) => ({ findOne, add });
+
+describe('CSV post relation parsing', function () {
+  it('pairs author names and emails positionally to the longest list', function () {
+    assert.deepEqual(
+      parseAuthorReferences(
+        ' Alice Example, , Charlie Example ',
+        'alice@example.com,bob@example.com,,fourth@example.com',
+      ),
+      [
+        { name: 'Alice Example', email: 'alice@example.com' },
+        { email: 'bob@example.com' },
+        { name: 'Charlie Example' },
+        { email: 'fourth@example.com' },
+      ],
+    );
+    assert.deepEqual(parseAuthorReferences(',', ','), [{}, {}]);
+  });
+
+  it('preserves tag order while trimming and dropping empty positions', function () {
+    assert.deepEqual(parseTagReferences(' First, ,Second,First '), ['First', 'Second', 'First']);
+    assert.deepEqual(parseTagReferences(), []);
+  });
+});
+
+describe('BookshelfPostRelationsResolver', function () {
+  afterEach(function () {
+    sinon.restore();
+  });
+
+  it('matches authors by email or a name-only slug, preserving order and uniqueness', async function () {
+    const getUserByEmail = sinon.stub().callsFake(async (email: string) => {
+      if (email === 'alice@example.com') {
+        return relation('author-alice');
+      }
+      return undefined;
+    });
+    const findUser = sinon.stub().callsFake(async (lookup: { slug?: string }) => {
+      if (lookup.slug === 'charlie-example') {
+        return relation('author-charlie');
+      }
+      return null;
+    });
+    const findTag = sinon.stub().resolves(null);
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(findUser, undefined, undefined, getUserByEmail),
+      Tag: tagModels(findTag),
+    });
+    const transacting = { transaction: true };
+
+    const resolved = await resolver.resolve(
+      data,
+      {
+        authorNames: 'Alice Example,No name fallback,Charlie Example,Alice again',
+        authorEmails: 'alice@example.com,missing@example.com,,alice@example.com',
+      },
+      { importing: true, transacting },
+    );
+
+    assert.deepEqual(resolved.data.authors, [
+      { id: 'author-alice' },
+      { id: 'author-created' },
+      { id: 'author-charlie' },
+    ]);
+    assert.deepEqual(resolved.warnings, []);
+    assert.deepEqual(
+      getUserByEmail.getCalls().map((call) => call.args[0]),
+      ['alice@example.com', 'missing@example.com'],
+      'duplicate emails reuse the first match',
+    );
+    sinon.assert.calledOnceWithExactly(
+      findUser,
+      { slug: 'charlie-example' },
+      {
+        importing: true,
+        transacting,
+      },
+    );
+    for (const call of getUserByEmail.getCalls()) {
+      assert.deepEqual(call.args[1], { importing: true, transacting });
+    }
+    sinon.assert.notCalled(findTag);
+  });
+
+  it('falls back to Owner with a warning when a name-only author does not match', async function () {
+    const findUser = sinon.stub().resolves(null);
+    const getOwnerUser = sinon.stub().resolves(relation('owner'));
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(findUser, undefined, getOwnerUser),
+      Tag: tagModels(),
+    });
+
+    const resolved = await resolver.resolve(
+      data,
+      { authorNames: 'Missing Author' },
+      { importing: true },
+    );
+
+    assert.deepEqual(resolved.data.authors, [{ id: 'owner' }]);
+    assert.deepEqual(resolved.warnings, [
+      'Author "Missing Author" has no email; assigned Owner instead.',
+    ]);
+    sinon.assert.calledWithMatch(findUser, { slug: 'missing-author' });
+    sinon.assert.calledOnce(getOwnerUser);
+  });
+
+  it('creates an unmatched named author as a locked Contributor through the importing path', async function () {
+    const findUser = sinon.stub().resolves(null);
+    const addUser = sinon.stub().resolves(relation('author-created'));
+    const getOwnerUser = sinon.stub().resolves(relation('owner'));
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(findUser, addUser, getOwnerUser, sinon.stub().resolves(undefined)),
+      Tag: tagModels(),
+    });
+    const options = { importing: true, context: { internal: true }, transacting: {} };
+
+    const resolved = await resolver.resolve(
+      data,
+      { authorNames: 'New Contributor', authorEmails: 'new@example.com' },
+      options,
+    );
+
+    assert.deepEqual(resolved.data.authors, [{ id: 'author-created' }]);
+    assert.deepEqual(resolved.warnings, []);
+    sinon.assert.notCalled(findUser);
+    sinon.assert.calledWithExactly(
+      addUser,
+      {
+        name: 'New Contributor',
+        email: 'new@example.com',
+        roles: ['Contributor'],
+      },
+      options,
+    );
+    sinon.assert.notCalled(getOwnerUser);
+  });
+
+  it('matches an existing author by email without requiring a supplied name', async function () {
+    const findUser = sinon.stub().resolves(null);
+    const getUserByEmail = sinon.stub().resolves(relation('author-existing'));
+    const addUser = sinon.stub().resolves(relation('author-created'));
+    const getOwnerUser = sinon.stub().resolves(relation('owner'));
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(findUser, addUser, getOwnerUser, getUserByEmail),
+      Tag: tagModels(),
+    });
+
+    const resolved = await resolver.resolve(
+      data,
+      { authorEmails: 'existing@example.com' },
+      { importing: true },
+    );
+
+    assert.deepEqual(resolved.data.authors, [{ id: 'author-existing' }]);
+    assert.deepEqual(resolved.warnings, []);
+    sinon.assert.calledOnceWithExactly(getUserByEmail, 'existing@example.com', {
+      importing: true,
+    });
+    sinon.assert.notCalled(findUser);
+    sinon.assert.notCalled(addUser);
+    sinon.assert.notCalled(getOwnerUser);
+  });
+
+  it('reuses a contributor created for a duplicate email in the same row', async function () {
+    const findUser = sinon.stub().resolves(null);
+    const getUserByEmail = sinon.stub().resolves(undefined);
+    const addUser = sinon.stub().resolves(relation('author-created'));
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(findUser, addUser, undefined, getUserByEmail),
+      Tag: tagModels(),
+    });
+
+    const resolved = await resolver.resolve(
+      data,
+      {
+        authorNames: 'New Contributor,Duplicate Name',
+        authorEmails: 'NEW@example.com,new@example.com',
+      },
+      { importing: true },
+    );
+
+    assert.deepEqual(resolved.data.authors, [{ id: 'author-created' }]);
+    sinon.assert.calledOnceWithExactly(getUserByEmail, 'new@example.com', { importing: true });
+    sinon.assert.notCalled(findUser);
+    sinon.assert.calledOnce(addUser);
+    sinon.assert.calledWithMatch(addUser, { email: 'new@example.com' });
+  });
+
+  it('falls back to Owner for email-only, invalid, and empty entries with clear warnings', async function () {
+    const findUser = sinon.stub().resolves(null);
+    const getUserByEmail = sinon.stub().resolves(undefined);
+    const addUser = sinon.stub().resolves(relation('author-created'));
+    const getOwnerUser = sinon.stub().resolves(relation('owner'));
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(findUser, addUser, getOwnerUser, getUserByEmail),
+      Tag: tagModels(),
+    });
+
+    const resolved = await resolver.resolve(
+      data,
+      {
+        authorNames: ',Invalid Author,',
+        authorEmails: 'missing@example.com,not-an-email,',
+      },
+      { importing: true },
+    );
+
+    assert.deepEqual(resolved.data.authors, [{ id: 'owner' }]);
+    assert.deepEqual(resolved.warnings, [
+      'Author email "missing@example.com" has no name; assigned Owner instead.',
+      'Author email "not-an-email" is invalid; assigned Owner instead.',
+      'An empty author entry was assigned to Owner instead.',
+    ]);
+    sinon.assert.calledOnceWithExactly(getUserByEmail, 'missing@example.com', {
+      importing: true,
+    });
+    sinon.assert.notCalled(findUser);
+    sinon.assert.notCalled(addUser);
+    sinon.assert.calledOnce(getOwnerUser);
+  });
+
+  it('does not duplicate Owner when an existing match is followed by an Owner fallback', async function () {
+    const owner = relation('owner');
+    const getUserByEmail = sinon.stub().callsFake(async (email: string) => {
+      return email === 'owner@example.com' ? owner : undefined;
+    });
+    const getOwnerUser = sinon.stub().resolves(owner);
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(undefined, undefined, getOwnerUser, getUserByEmail),
+      Tag: tagModels(),
+    });
+
+    const resolved = await resolver.resolve(
+      data,
+      {
+        authorNames: 'Site Owner,Missing Author',
+        authorEmails: 'owner@example.com,',
+      },
+      { importing: true },
+    );
+
+    assert.deepEqual(resolved.data.authors, [{ id: 'owner' }]);
+    assert.deepEqual(resolved.warnings, [
+      'Author "Missing Author" has no email; assigned Owner instead.',
+    ]);
+    sinon.assert.calledOnce(getOwnerUser);
+  });
+
+  it('propagates author creation failures so the row transaction can roll back', async function () {
+    const failure = new Error('user creation failed');
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(sinon.stub().resolves(null), sinon.stub().rejects(failure)),
+      Tag: tagModels(),
+    });
+
+    await assert.rejects(
+      resolver.resolve(
+        data,
+        { authorNames: 'New Contributor', authorEmails: 'new@example.com' },
+        { importing: true },
+      ),
+      failure,
+    );
+  });
+
+  it('propagates Owner lookup failures so the row transaction can roll back', async function () {
+    const failure = new Error('owner lookup failed');
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(sinon.stub().resolves(null), undefined, sinon.stub().rejects(failure)),
+      Tag: tagModels(),
+    });
+
+    await assert.rejects(
+      resolver.resolve(data, { authorNames: 'Missing Author' }, { importing: true }),
+      failure,
+    );
+  });
+
+  it('matches tags by exact name, explicit slug, and normalized slug before creating the rest', async function () {
+    const findTag = sinon.stub().callsFake(async (lookup: { name?: string; slug?: string }) => {
+      if (lookup.name === 'Exact Name') {
+        return relation('tag-exact');
+      }
+      if (lookup.slug === 'explicit-slug') {
+        return relation('tag-explicit-slug');
+      }
+      if (lookup.slug === 'needs-normalizing') {
+        return relation('tag-normalized');
+      }
+      return null;
+    });
+    const addTag = sinon.stub().resolves(relation('tag-created'));
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(),
+      Tag: tagModels(findTag, addTag),
+    });
+
+    const resolved = await resolver.resolve(
+      data,
+      {
+        tagNames: 'Exact Name,explicit-slug,Needs Normalizing,Missing Tag,Exact Name',
+      },
+      { importing: true },
+    );
+
+    assert.deepEqual(resolved.data.tags, [
+      { id: 'tag-exact' },
+      { id: 'tag-explicit-slug' },
+      { id: 'tag-normalized' },
+      { id: 'tag-created' },
+      { name: '#Import batch' },
+    ]);
+    assert.deepEqual(
+      findTag.getCalls().map((call) => call.args[0]),
+      [
+        { name: 'Exact Name' },
+        { name: 'explicit-slug' },
+        { slug: 'explicit-slug' },
+        { name: 'Needs Normalizing' },
+        { slug: 'Needs Normalizing' },
+        { slug: 'needs-normalizing' },
+        { name: 'Missing Tag' },
+        { slug: 'Missing Tag' },
+        { slug: 'missing-tag' },
+        { name: 'Exact Name' },
+      ],
+    );
+    sinon.assert.calledOnceWithExactly(addTag, { name: 'Missing Tag' }, { importing: true });
+  });
+
+  it('reuses a tag created for duplicate inputs while preserving source order', async function () {
+    let created: { id: string } | null = null;
+    const findTag = sinon.stub().callsFake(async (lookup: { name?: string }) => {
+      return lookup.name === 'New Tag' ? created : null;
+    });
+    const addTag = sinon.stub().callsFake(async () => {
+      created = relation('tag-created');
+      return created;
+    });
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(),
+      Tag: tagModels(findTag, addTag),
+    });
+    const options = { importing: true, transacting: {} };
+
+    const resolved = await resolver.resolve(data, { tagNames: 'New Tag,New Tag' }, options);
+
+    assert.deepEqual(resolved.data.tags, [{ id: 'tag-created' }, { name: '#Import batch' }]);
+    sinon.assert.calledOnceWithExactly(addTag, { name: 'New Tag' }, options);
+  });
+
+  for (const code of ['ER_DUP_ENTRY', 'SQLITE_CONSTRAINT_UNIQUE']) {
+    it(`refetches a concurrently created tag after ${code}`, async function () {
+      const duplicate = Object.assign(new Error('duplicate tag'), { code });
+      const findTag = sinon.stub().callsFake(async (_lookup: object, options: object) => {
+        return 'forUpdate' in options ? relation('tag-concurrent') : null;
+      });
+      const addTag = sinon.stub().rejects(duplicate);
+      const resolver = new BookshelfPostRelationsResolver({
+        User: userModels(),
+        Tag: tagModels(findTag, addTag),
+      });
+      const options = { importing: true, transacting: {} };
+
+      const resolved = await resolver.resolve(data, { tagNames: 'Concurrent Tag' }, options);
+
+      assert.deepEqual(resolved.data.tags, [{ id: 'tag-concurrent' }, { name: '#Import batch' }]);
+      sinon.assert.calledOnceWithExactly(addTag, { name: 'Concurrent Tag' }, options);
+      sinon.assert.calledWithExactly(
+        findTag.lastCall,
+        { name: 'Concurrent Tag' },
+        {
+          ...options,
+          forUpdate: true,
+        },
+      );
+    });
+  }
+
+  it('rethrows a duplicate error when the concurrent tag cannot be refetched', async function () {
+    const duplicate = Object.assign(new Error('duplicate tag'), { code: 'ER_DUP_ENTRY' });
+    const findTag = sinon.stub().resolves(null);
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(),
+      Tag: tagModels(findTag, sinon.stub().rejects(duplicate)),
+    });
+
+    await assert.rejects(
+      resolver.resolve(data, { tagNames: 'Missing Concurrent Tag' }, { importing: true }),
+      duplicate,
+    );
+    assert.equal(
+      findTag.getCalls().filter((call) => call.args[1].forUpdate).length,
+      3,
+      'every supported lookup is retried with a locking read',
+    );
+  });
+
+  it('propagates non-duplicate tag creation failures without refetching', async function () {
+    const failure = Object.assign(new Error('tag creation failed'), { code: 'ECONNRESET' });
+    const findTag = sinon.stub().resolves(null);
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(),
+      Tag: tagModels(findTag, sinon.stub().rejects(failure)),
+    });
+
+    await assert.rejects(
+      resolver.resolve(data, { tagNames: 'Broken Tag' }, { importing: true }),
+      failure,
+    );
+    assert.equal(findTag.getCalls().filter((call) => call.args[1].forUpdate).length, 0);
+  });
+
+  it('propagates tag creation failures without an error code', async function () {
+    const failure = new Error('tag creation failed');
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(),
+      Tag: tagModels(sinon.stub().resolves(null), sinon.stub().rejects(failure)),
+    });
+
+    await assert.rejects(
+      resolver.resolve(data, { tagNames: 'Broken Tag' }, { importing: true }),
+      failure,
+    );
+  });
+
+  it('does no lookups when relation cells are absent', async function () {
+    const findUser = sinon.stub().resolves(null);
+    const findTag = sinon.stub().resolves(null);
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(findUser),
+      Tag: tagModels(findTag),
+    });
+
+    const resolved = await resolver.resolve(data, {}, { importing: true });
+
+    assert.deepEqual(resolved, { data, warnings: [] });
+    assert.notEqual(resolved.data, data, 'callers receive data they can safely change');
+    sinon.assert.notCalled(findUser);
+    sinon.assert.notCalled(findTag);
+  });
+
+  it('propagates lookup failures to roll back the row transaction', async function () {
+    const failure = new Error('author lookup failed');
+    const resolver = new BookshelfPostRelationsResolver({
+      User: userModels(undefined, undefined, undefined, sinon.stub().rejects(failure)),
+      Tag: tagModels(),
+    });
+
+    await assert.rejects(
+      resolver.resolve(data, { authorEmails: 'author@example.com' }, { importing: true }),
+      failure,
+    );
+  });
+});
diff --git a/ghost/core/test/unit/server/services/content-import/import/row.test.ts b/ghost/core/test/unit/server/services/content-import/import/row.test.ts
index 9c9f9b367b6..a89c0db46c5 100644
--- a/ghost/core/test/unit/server/services/content-import/import/row.test.ts
+++ b/ghost/core/test/unit/server/services/content-import/import/row.test.ts
@@ -39,12 +39,21 @@ describe('post import row schema', function () {
       feature_image: 'undefined',
       meta_title: '',
       frontmatter: '',
+      comment_id: '',
+      authors: '',
+      author_emails: 'undefined',
+      tags: '',
     });
 
     assert.equal(parsed.slug, undefined);
     assert.equal(parsed.feature_image, undefined);
     assert.equal(parsed.meta_title, undefined);
     assert.equal(parsed.frontmatter, undefined);
+    assert.equal(parsed.comment_id, undefined);
+    assert.equal(parsed.authors, undefined);
+    assert.equal(parsed.author_emails, undefined);
+    assert.equal(parsed.tags, undefined);
+    assert.equal(postImportRowSchema.parse({ comment_id: 'undefined' }).comment_id, undefined);
   });
 
   it('passes unknown columns through for later milestones to consume', function () {
diff --git a/ghost/core/test/unit/server/services/content-import/import/schema.test.ts b/ghost/core/test/unit/server/services/content-import/import/schema.test.ts
index d08044a7def..6d869c88436 100644
--- a/ghost/core/test/unit/server/services/content-import/import/schema.test.ts
+++ b/ghost/core/test/unit/server/services/content-import/import/schema.test.ts
@@ -21,6 +21,10 @@ describe('content import schema', function () {
         mapping: {
           Headline: 'title',
           Body: 'html',
+          Source: 'comment_id',
+          Bylines: 'authors',
+          Emails: 'author_emails',
+          Topics: 'tags',
           Notes: '',
         },
       }),
@@ -30,6 +34,10 @@ describe('content import schema', function () {
         mapping: {
           Headline: 'title',
           Body: 'html',
+          Source: 'comment_id',
+          Bylines: 'authors',
+          Emails: 'author_emails',
+          Topics: 'tags',
           Notes: '',
         },
       },
diff --git a/ghost/core/test/unit/server/services/content-import/import/store.test.ts b/ghost/core/test/unit/server/services/content-import/import/store.test.ts
index c5654dfb0c6..411176115ef 100644
--- a/ghost/core/test/unit/server/services/content-import/import/store.test.ts
+++ b/ghost/core/test/unit/server/services/content-import/import/store.test.ts
@@ -36,6 +36,20 @@ describe('ImportRunStore', function () {
     assert.ok(finished?.finishedAt instanceof Date);
   });
 
+  it('records updated rows as successful outcomes', function () {
+    const store = new ImportRunStore();
+    store.create('run_updated', 1);
+
+    store.record('run_updated', {
+      line: 2,
+      title: 'Updated post',
+      status: 'updated',
+      postId: 'post_updated',
+    });
+
+    assert.equal(store.get('run_updated')?.rows[0].status, 'updated');
+  });
+
   it('ignores writes against an unknown run rather than throwing', function () {
     const store = new ImportRunStore();
 
diff --git a/ghost/core/test/unit/server/services/email-suppression-list/email-suppression-list.test.js b/ghost/core/test/unit/server/services/email-suppression-list/email-suppression-list.test.ts
similarity index 76%
rename from ghost/core/test/unit/server/services/email-suppression-list/email-suppression-list.test.js
rename to ghost/core/test/unit/server/services/email-suppression-list/email-suppression-list.test.ts
index 1e05b06ad15..253ace100a8 100644
--- a/ghost/core/test/unit/server/services/email-suppression-list/email-suppression-list.test.js
+++ b/ghost/core/test/unit/server/services/email-suppression-list/email-suppression-list.test.ts
@@ -1,8 +1,7 @@
-const assert = require('node:assert/strict');
-const {
-  EmailSuppressionData,
-  EmailSuppressedEvent,
-} = require('../../../../../core/server/services/email-suppression-list/email-suppression-list');
+import assert from 'node:assert/strict';
+// @ts-expect-error This module lacks type definitions.
+import emailSuppressionList from '../../../../../core/server/services/email-suppression-list/email-suppression-list';
+const { EmailSuppressionData, EmailSuppressedEvent } = emailSuppressionList;
 
 describe('EmailSuppressionData', function () {
   it('Has null info when not suppressed', function () {
diff --git a/ghost/core/test/unit/server/services/machine-payments/eligibility.test.js b/ghost/core/test/unit/server/services/machine-payments/eligibility.test.ts
similarity index 84%
rename from ghost/core/test/unit/server/services/machine-payments/eligibility.test.js
rename to ghost/core/test/unit/server/services/machine-payments/eligibility.test.ts
index f8fefc367af..f0585c3e145 100644
--- a/ghost/core/test/unit/server/services/machine-payments/eligibility.test.js
+++ b/ghost/core/test/unit/server/services/machine-payments/eligibility.test.ts
@@ -1,7 +1,5 @@
-const assert = require('node:assert/strict');
-const {
-  isPurchasableEntry,
-} = require('../../../../../core/server/services/machine-payments/eligibility');
+import assert from 'node:assert/strict';
+import { isPurchasableEntry } from '../../../../../core/server/services/machine-payments/eligibility';
 
 describe('Unit: server/services/machine-payments/eligibility', function () {
   it('treats visibility paid as purchasable', function () {
diff --git a/ghost/core/test/unit/server/services/milestones/index.test.js b/ghost/core/test/unit/server/services/milestones/index.test.js
deleted file mode 100644
index fb876f000de..00000000000
--- a/ghost/core/test/unit/server/services/milestones/index.test.js
+++ /dev/null
@@ -1,11 +0,0 @@
-const assert = require('node:assert/strict');
-
-describe('Milestones Service', function () {
-  let milestonesService;
-
-  it('Provides expected public API', async function () {
-    milestonesService = require('../../../../../core/server/services/milestones');
-
-    assert.ok(milestonesService.initAndRun);
-  });
-});
diff --git a/ghost/core/test/unit/server/services/milestones/index.test.ts b/ghost/core/test/unit/server/services/milestones/index.test.ts
new file mode 100644
index 00000000000..8f8b4ce472e
--- /dev/null
+++ b/ghost/core/test/unit/server/services/milestones/index.test.ts
@@ -0,0 +1,9 @@
+import assert from 'node:assert/strict';
+// @ts-expect-error This module lacks type definitions.
+import milestonesService from '../../../../../core/server/services/milestones';
+
+describe('Milestones Service', function () {
+  it('Provides expected public API', function () {
+    assert.ok(milestonesService.initAndRun);
+  });
+});
diff --git a/ghost/core/test/unit/server/services/themes/storage.test.js b/ghost/core/test/unit/server/services/themes/storage.test.ts
similarity index 63%
rename from ghost/core/test/unit/server/services/themes/storage.test.js
rename to ghost/core/test/unit/server/services/themes/storage.test.ts
index 68423304189..49ef055db05 100644
--- a/ghost/core/test/unit/server/services/themes/storage.test.js
+++ b/ghost/core/test/unit/server/services/themes/storage.test.ts
@@ -1,5 +1,6 @@
-const assert = require('node:assert/strict');
-const storage = require('../../../../../core/server/services/themes/storage');
+import assert from 'node:assert/strict';
+// @ts-expect-error This module lacks type definitions.
+import storage from '../../../../../core/server/services/themes/storage';
 
 describe('Themes storage', function () {
   describe('zipToFile', function () {
diff --git a/ghost/core/test/unit/server/web/parent/middleware/filter-query-parameters.test.ts b/ghost/core/test/unit/server/web/parent/middleware/filter-query-parameters.test.ts
new file mode 100644
index 00000000000..28e527f6921
--- /dev/null
+++ b/ghost/core/test/unit/server/web/parent/middleware/filter-query-parameters.test.ts
@@ -0,0 +1,251 @@
+import assert from 'node:assert/strict';
+import logging from '@tryghost/logging';
+import express from 'express';
+import sinon from 'sinon';
+import request from 'supertest';
+
+import { filterQueryParameters } from '../../../../../../core/server/web/parent/middleware/filter-query-parameters';
+
+describe('Middleware: filterQueryParameters', function () {
+  function createApp() {
+    const app = express();
+
+    app.use(filterQueryParameters);
+    app.use((req, res) => {
+      res.json({
+        originalUrl: req.originalUrl,
+        url: req.url,
+        path: req.path,
+        query: req.query,
+      });
+    });
+
+    return app;
+  }
+
+  afterEach(function () {
+    sinon.restore();
+  });
+
+  async function getRequestState(requestTarget: string) {
+    const response = await request(createApp()).get(requestTarget).expect(200);
+    return response.body;
+  }
+
+  describe('request filtering', function () {
+    beforeEach(function () {
+      sinon.stub(logging, 'warn');
+    });
+
+    it('allows arbitrary parameters on exempt paths', async function () {
+      const requestTarget = '/.ghost/activitypub/inbox?utm_source=newsletter&unknown=value';
+      const state = await getRequestState(requestTarget);
+
+      assert.equal(state.originalUrl, requestTarget);
+      assert.deepEqual(state.query, {
+        utm_source: 'newsletter',
+        unknown: 'value',
+      });
+    });
+
+    it('applies the Content API allowlist', async function () {
+      const state = await getRequestState(
+        '/ghost/api/content/posts/?key=content-key&include=authors&unknown=value&m=member-id',
+      );
+
+      assert.equal(state.originalUrl, '/ghost/api/content/posts/?key=content-key&include=authors');
+      assert.deepEqual(state.query, {
+        key: 'content-key',
+        include: 'authors',
+      });
+    });
+
+    it('preserves repeated allowed parameters', async function () {
+      const state = await getRequestState('/members/?ids=one&ids=two&unknown=value');
+
+      assert.equal(state.originalUrl, '/members/?ids=one&ids=two');
+      assert.deepEqual(state.query, {
+        ids: ['one', 'two'],
+      });
+    });
+
+    it('preserves admin toolbar, gift link, and automation parameters', async function () {
+      const requestTarget = '/post/?admin=true&admin_toolbar=0&gift=unlock-token&step=run-step-id';
+      const state = await getRequestState(requestTarget);
+
+      assert.equal(state.originalUrl, requestTarget);
+      assert.deepEqual(state.query, {
+        admin: 'true',
+        admin_toolbar: '0',
+        gift: 'unlock-token',
+        step: 'run-step-id',
+      });
+    });
+
+    it('preserves notification unsubscribe and tier preview parameters', async function () {
+      const requestTarget = '/unsubscribe/?comments=1&updatesandannouncements=1&member_tier=silver';
+      const state = await getRequestState(requestTarget);
+
+      assert.equal(state.originalUrl, requestTarget);
+      assert.deepEqual(state.query, {
+        comments: '1',
+        updatesandannouncements: '1',
+        member_tier: 'silver',
+      });
+    });
+
+    it('preserves fields for the frontend comments API', async function () {
+      const requestTarget = '/members/api/comments/post/post-id/?fields=id%2Cpinned';
+      const state = await getRequestState(requestTarget);
+
+      assert.equal(state.originalUrl, requestTarget);
+      assert.deepEqual(state.query, {
+        fields: 'id,pinned',
+      });
+    });
+
+    it('removes nested undeclared parameters from the Express query state', async function () {
+      const state = await getRequestState('/post/?step=run-step-id&unknown[nested]=value');
+
+      assert.equal(state.originalUrl, '/post/?step=run-step-id');
+      assert.deepEqual(state.query, {
+        step: 'run-step-id',
+      });
+    });
+  });
+
+  it('updates the Express request and logs stripped undeclared parameters', async function () {
+    const warn = sinon.stub(logging, 'warn');
+
+    await request(createApp())
+      .get('/r/example?step=run-step-id&m=member-id&unknown=value')
+      .expect(200)
+      .expect({
+        originalUrl: '/r/example?step=run-step-id&m=member-id',
+        url: '/r/example?step=run-step-id&m=member-id',
+        path: '/r/example',
+        query: {
+          step: 'run-step-id',
+          m: 'member-id',
+        },
+      });
+
+    sinon.assert.calledOnceWithExactly(
+      warn,
+      '[query-parameter-filter] Stripped undeclared query parameter(s) from /r/example: unknown',
+    );
+  });
+
+  it('limits the number of stripped parameter names in warning logs', async function () {
+    const warn = sinon.stub(logging, 'warn');
+    const query = Array.from(
+      { length: 12 },
+      (_, index) => `unknown_${String.fromCharCode(97 + index)}=value`,
+    ).join('&');
+
+    await request(createApp()).get(`/example?${query}`).expect(200);
+
+    sinon.assert.calledOnceWithExactly(
+      warn,
+      '[query-parameter-filter] Stripped undeclared query parameter(s) from /example: unknown_a, unknown_b, unknown_c, unknown_d, unknown_e, unknown_f, unknown_g, unknown_h, unknown_i, unknown_j, and 2 more',
+    );
+  });
+
+  it('does not warn when all parameters are allowed', async function () {
+    const warn = sinon.stub(logging, 'warn');
+
+    await request(createApp())
+      .get('/welcome/?utm_source=newsletter&ref=weekly&m=member-id')
+      .expect(200)
+      .expect({
+        originalUrl: '/welcome/?utm_source=newsletter&ref=weekly&m=member-id',
+        url: '/welcome/?utm_source=newsletter&ref=weekly&m=member-id',
+        path: '/welcome/',
+        query: {
+          utm_source: 'newsletter',
+          ref: 'weekly',
+          m: 'member-id',
+        },
+      });
+
+    sinon.assert.notCalled(warn);
+  });
+
+  it('preserves query parameters on exempt paths', async function () {
+    await request(createApp())
+      .get('/ghost/api/admin/session/?include=roles')
+      .expect(200)
+      .expect({
+        originalUrl: '/ghost/api/admin/session/?include=roles',
+        url: '/ghost/api/admin/session/?include=roles',
+        path: '/ghost/api/admin/session/',
+        query: {
+          include: 'roles',
+        },
+      });
+  });
+
+  it('works when mounted below the application root', async function () {
+    const app = express();
+    sinon.stub(logging, 'warn');
+
+    app.use('/nested', filterQueryParameters, (req, res) => {
+      res.json({
+        originalUrl: req.originalUrl,
+        url: req.url,
+        path: req.path,
+        query: req.query,
+      });
+    });
+
+    await request(app)
+      .get('/nested/r/example?step=run-step-id&unknown=value')
+      .expect(200)
+      .expect({
+        originalUrl: '/nested/r/example?step=run-step-id',
+        url: '/r/example?step=run-step-id',
+        path: '/r/example',
+        query: {
+          step: 'run-step-id',
+        },
+      });
+  });
+
+  // We can remove this test once we upgrade to Express 5.
+  it('supports a getter-only query property, which is the case in Express 5', async function () {
+    const app = express();
+    sinon.stub(logging, 'warn');
+
+    // Simulates [Express 5's `req.query`][0].
+    // [0]: https://github.com/expressjs/express/blob/a3714473feb3d2908add734d340e7755fd85e0a3/lib/request.js#L230
+    app.use((req, _res, next) => {
+      const originalQuery = req.query;
+      Object.defineProperty(req, 'query', {
+        get: () => originalQuery,
+      });
+      next();
+    });
+    app.use(filterQueryParameters);
+    app.use((req, res) => {
+      res.json({
+        originalUrl: req.originalUrl,
+        url: req.url,
+        path: req.path,
+        query: req.query,
+      });
+    });
+
+    await request(app)
+      .get('/r/example?step=run-step-id&m=member-id&unknown=value')
+      .expect(200)
+      .expect({
+        originalUrl: '/r/example?step=run-step-id&m=member-id',
+        url: '/r/example?step=run-step-id&m=member-id',
+        path: '/r/example',
+        query: {
+          step: 'run-step-id',
+          m: 'member-id',
+        },
+      });
+  });
+});
diff --git a/ghost/core/test/unit/server/web/query-parameter-policy.test.ts b/ghost/core/test/unit/server/web/query-parameter-policy.test.ts
new file mode 100644
index 00000000000..75336b1d419
--- /dev/null
+++ b/ghost/core/test/unit/server/web/query-parameter-policy.test.ts
@@ -0,0 +1,78 @@
+import assert from 'node:assert/strict';
+
+import { queryParameterPolicy } from '../../../../core/server/web/query-parameter-policy';
+import { parseQueryParameterPolicy } from '../../../../core/server/web/query-parameter-policy/schema';
+
+const validPolicy = () => ({
+  schemaVersion: 1,
+  public: [{ name: 'gift', reason: 'Gift-link unlock token' }],
+  contentApi: [{ name: 'filter', reason: 'Filters resources using NQL' }],
+});
+
+describe('Query parameter policy', function () {
+  it('loads the canonical policy', function () {
+    assert.equal(queryParameterPolicy.schemaVersion, 1);
+    assert.ok(queryParameterPolicy.public.length > 0);
+    assert.ok(queryParameterPolicy.contentApi.length > 0);
+  });
+
+  it('returns a normalized policy', function () {
+    const policy = parseQueryParameterPolicy({
+      ...validPolicy(),
+      ignored: true,
+      public: [{ name: 'gift', reason: 'Gift-link unlock token', ignored: true }],
+    });
+
+    assert.deepEqual(policy, validPolicy());
+  });
+
+  it.each([
+    ['a non-object policy', null, /expected object/],
+    [
+      'an unsupported schema version',
+      { ...validPolicy(), schemaVersion: 2 },
+      /Unsupported schema version/,
+    ],
+    ['a non-array public list', { ...validPolicy(), public: {} }, /expected array/],
+    ['a non-array Content API list', { ...validPolicy(), contentApi: {} }, /expected array/],
+    [
+      'an empty parameter name',
+      { ...validPolicy(), public: [{ name: '', reason: 'Empty' }] },
+      /Parameter names must be nonempty/,
+    ],
+    [
+      'an invalid parameter name',
+      { ...validPolicy(), public: [{ name: 'not valid&', reason: 'Invalid' }] },
+      /must only contain letters, underscores, and hyphens/,
+    ],
+    [
+      'an empty reason',
+      { ...validPolicy(), public: [{ name: 'gift', reason: '   ' }] },
+      /Parameter reasons must be nonempty/,
+    ],
+    [
+      'a duplicate public name',
+      { ...validPolicy(), public: Array(2).fill({ name: 'gift', reason: 'Gift link' }) },
+      /Duplicate parameter name.*gift/,
+    ],
+    [
+      'a duplicate Content API name',
+      { ...validPolicy(), contentApi: Array(2).fill({ name: 'filter', reason: 'Filtering' }) },
+      /Duplicate parameter name.*filter/,
+    ],
+  ])('rejects %s', function (_description, policy, error) {
+    assert.throws(() => parseQueryParameterPolicy(policy), error);
+  });
+
+  it('allows the same name in both lists', function () {
+    const sharedEntry = { name: 'filter', reason: 'Filters resources' };
+    const policy = parseQueryParameterPolicy({
+      schemaVersion: 1,
+      public: [sharedEntry],
+      contentApi: [sharedEntry],
+    });
+
+    assert.equal(policy.public[0].name, 'filter');
+    assert.equal(policy.contentApi[0].name, 'filter');
+  });
+});
diff --git a/package.json b/package.json
index 290657252d1..2993c7c281f 100644
--- a/package.json
+++ b/package.json
@@ -65,6 +65,7 @@
     "main:submodules": "git submodule sync && git submodule update && git submodule foreach \"git checkout main && git pull ${GHOST_UPSTREAM:-origin} main\"",
     "preinstall": "node ./scripts/enforce-package-manager.js",
     "prepare": "husky .github/hooks",
+    "query-parameter-policy:export": "pnpm --filter ghost query-parameter-policy:export",
     "tb": "tb local start && cd ghost/core/core/server/data/tinybird && tb dev",
     "tb:install": "curl https://tinybird.co | sh",
     "data:analytics:generate": "node ghost/core/core/server/data/tinybird/scripts/docker-analytics-manager.js generate",
diff --git a/packages/custom-field-types/src/index.ts b/packages/custom-field-types/src/index.ts
index ab6faa5e17a..54efe50c3fc 100644
--- a/packages/custom-field-types/src/index.ts
+++ b/packages/custom-field-types/src/index.ts
@@ -187,6 +187,12 @@ export const FIELD_TYPES = defineFieldTypes({
   long_text: longText(),
   // An address is a delivery address, so its bounds are what a courier will accept
   // rather than what the column could hold. Modelled on Stripe's Address object.
+  //
+  // Who the parcel is addressed to is not here. A parcel needs a name as well as an
+  // address, but that is a fact about posting parcels rather than about either type,
+  // and the name is often not the account name — gift subscriptions, workplace
+  // deliveries, c/o. A site that needs one keeps it in a field of its own, which is
+  // also how Stripe hands it back: beside the address rather than inside it.
   address: record(
     {
       line1: shortText(),
diff --git a/packages/custom-field-types/test/csv.test.ts b/packages/custom-field-types/test/csv.test.ts
index 4f6654c8e1f..1dafbb998a1 100644
--- a/packages/custom-field-types/test/csv.test.ts
+++ b/packages/custom-field-types/test/csv.test.ts
@@ -197,6 +197,20 @@ describe('reading custom field values from a CSV row', function () {
     );
   });
 
+  // The sub-cells a composite occupies are the parts its value schema declares, so a
+  // column naming anything else is dropped the way a column naming no field is. A
+  // recipient's name is the one that gets written by hand: a parcel needs one, but it
+  // belongs to a field of its own rather than to the address.
+  it('drops a sub-cell that names no part of the composite', function () {
+    assert.deepEqual(
+      fieldValuesFromCsvRow([address], {
+        'custom_fields.shipping_address.name': 'Bex Jones',
+        'custom_fields.shipping_address.city': 'London',
+      }),
+      { shipping_address: { city: 'London' } },
+    );
+  });
+
   // A partial composite is read as a value (validation, run by the caller, is what
   // rejects it) rather than silently dropped like an all-blank one.
   it('reads a partial composite so its validation can fail the row', function () {
diff --git a/packages/custom-field-types/test/index.test.ts b/packages/custom-field-types/test/index.test.ts
index 0c409e09617..9530c38fc0b 100644
--- a/packages/custom-field-types/test/index.test.ts
+++ b/packages/custom-field-types/test/index.test.ts
@@ -97,6 +97,13 @@ describe('custom-field-types catalog', function () {
       assert.equal(parse({ line1: 'Cloonlara', state: 'Co. Clare', country: 'IE' }), true);
     });
 
+    // A recipient's name is not part of an address. A parcel needs both, which is a
+    // fact about posting parcels rather than about either type, so a site that collects
+    // a name keeps it in a field of its own.
+    it('is not where a recipient name lives', function () {
+      assert.equal(parse({ name: 'Bex Jones' }), false);
+    });
+
     it('rejects an address that names nothing', function () {
       assert.equal(parse({}), false);
       // A key present but explicitly undefined names nothing either: undefined is