diff --git a/docs/superpowers/plans/2026-04-25-cicd-pipeline.md b/docs/superpowers/plans/2026-04-25-cicd-pipeline.md
new file mode 100644
index 00000000..ac3c8ec8
--- /dev/null
+++ b/docs/superpowers/plans/2026-04-25-cicd-pipeline.md
@@ -0,0 +1,2652 @@
+# CI/CD Pipeline Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Build the two-workflow Gitea Actions CI/CD pipeline described in `docs/superpowers/specs/2026-04-25-cicd-pipeline-design.md`: push-triggered build/deploy/e2e to pve-201, and manually-triggered release flow to GitLab + Jenkins + customer e2e.
+
+**Architecture:** Two `.gitea/workflows/*.yml` files driving a Gitea runner on pve-201 with Docker socket access. All non-trivial logic lives in `scripts/ci/*.sh` so the YAML stays as orchestration glue and the bash is unit-testable with `--dry-run` / `--mock-mode` flags. A Playwright fixture (`console-gate.ts`) enforces zero-tolerance on `console.error`/`warn` against an explicit allowlist.
+
+**Tech Stack:** Gitea Actions, bash, Docker, Playwright, nginx, Modern.js SSR (existing), Telegram Bot API, GitLab REST API v4, Jenkins remote API.
+
+**Delivery shape (mirrors spec):**
+
+- **PR #1 (Tasks 1–22)** — workflows + scripts + fixture + nginx config + docs. `.github/workflows/*` stays. Pipeline starts firing on push.
+- **PR #2 (Task 23)** — delete `.github/workflows/*` after Workflow A has run green a few times.
+- **PR #3 (Tasks 24–25)** — Workflow B (release flow). First run triggered manually after one-time GitLab/Jenkins setup is verified.
+
+Each task is independently committable. Within tasks, steps are 2-5 minute units.
+
+---
+
+## File Structure (created in this plan)
+
+| Path | Responsibility | Created in |
+|---|---|---|
+| `.gitea/workflows/ci-deploy.yml` | Workflow A orchestration | Task 21 |
+| `.gitea/workflows/release.yml` | Workflow B orchestration | Task 24 |
+| `scripts/ci/notify-telegram.sh` | Telegram notification (3 message shapes, `--dry-run`) | Task 7 |
+| `scripts/ci/wait-for-url.sh` | Generic curl-with-retry | Task 9 |
+| `scripts/ci/deploy-container.sh` | `swap` / `rollback` subcommands, alias dance | Task 11 |
+| `scripts/ci/install-htpasswd.sh` | Render htpasswd + `nginx -s reload` | Task 13 |
+| `scripts/ci/jenkins-trigger-and-wait.sh` | Trigger Jenkins, poll queue→build, parse SUCCESS/FAILURE/UNSTABLE | Task 15 |
+| `scripts/ci/check-gitlab-project.sh` | One-shot setup helper (project ID + approval rules) | Task 17 |
+| `scripts/ci/sync-to-gitlab.sh` | Refactored core copy logic from `sync-to-flights-front.sh` | Task 18 |
+| `scripts/ci/audit-console-allowlist.sh` | Quarterly dead-allowlist-entry audit | Task 19 |
+| `tests/e2e/fixtures/console-gate.ts` | Playwright fixture — fails test if non-allowlisted console.error/warn | Task 4 |
+| `tests/e2e/fixtures/console-allowlist.json` | Empty starter `{ patterns: [] }` | Task 4 |
+| `tests/ci/test-notify-telegram.sh` | Unit test for `notify-telegram.sh` | Task 7 |
+| `tests/ci/test-wait-for-url.sh` | Unit test for `wait-for-url.sh` | Task 9 |
+| `tests/ci/test-deploy-container.sh` | Unit test for `deploy-container.sh` --dry-run | Task 11 |
+| `tests/ci/test-jenkins-trigger.sh` | Unit test for `jenkins-trigger-and-wait.sh` --mock-mode | Task 15 |
+| `tests/ci/fixtures/jenkins-success-flow.json` | Mock fixture for Jenkins success path | Task 15 |
+| `tests/ci/fixtures/jenkins-failure-flow.json` | Mock fixture for Jenkins failure path | Task 15 |
+| `deployment/nginx/ui-dashboard.gnerim.ru.conf` | nginx vhost (TLS + basic auth + /api proxy) | Task 1 |
+| `deployment/README.md` | Bootstrap runbook + failure-path rehearsal recipes | Task 2 |
+
+**Modified files:**
+
+- `playwright.config.ts` — make `baseURL` env-driven, drop `webServer` block (Task 5)
+- `scripts/sync-to-flights-front.sh` — thin wrapper around `scripts/ci/sync-to-gitlab.sh` (Task 18)
+- `package.json` — add `test:ci` script (Task 6)
+- `Makefile` — add `test-ci` target (Task 6)
+- `.gitignore` — add `snap-*.yml` at repo root (Task 3)
+
+**Deleted files (Task 23):**
+
+- `.github/workflows/ci.yml`
+- `.github/workflows/deploy.yml`
+
+---
+
+## Task 1: Check in nginx vhost config for ui-dashboard.gnerim.ru
+
+**Files:**
+- Create: `deployment/nginx/ui-dashboard.gnerim.ru.conf`
+
+This file is symlinked into `/etc/nginx/sites-enabled/` by hand on first setup. Checked into the repo for reproducibility.
+
+- [ ] **Step 1: Create the directory and file**
+
+```bash
+mkdir -p deployment/nginx
+```
+
+Write `deployment/nginx/ui-dashboard.gnerim.ru.conf`:
+
+```nginx
+# Production vhost for ui-dashboard.gnerim.ru.
+# Symlink into /etc/nginx/sites-enabled/ and reload nginx.
+# TLS certs assumed to exist via certbot (separate process).
+
+server {
+    listen 80;
+    server_name ui-dashboard.gnerim.ru;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name ui-dashboard.gnerim.ru;
+
+    ssl_certificate     /etc/letsencrypt/live/ui-dashboard.gnerim.ru/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/ui-dashboard.gnerim.ru/privkey.pem;
+
+    auth_basic           "ui-dashboard";
+    auth_basic_user_file /etc/nginx/htpasswd/ui-dashboard;
+
+    # SSR app on loopback (container bound to 127.0.0.1:8081)
+    location / {
+        proxy_pass http://127.0.0.1:8081;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+
+        # Long-poll friendliness for any future SignalR / SSE
+        proxy_read_timeout 300s;
+        proxy_buffering    off;
+    }
+
+    # API proxy — bypass basic auth (gates HTML, not API).
+    # Static route on the host sends 172.18.0.0/16 via 192.168.88.58 (webzavod).
+    # /etc/hosts pins flights.test.aeroflot.ru → 172.18.0.121.
+    location /api/ {
+        auth_basic off;
+        proxy_pass         https://flights.test.aeroflot.ru;
+        proxy_set_header   Host flights.test.aeroflot.ru;
+        proxy_ssl_server_name on;
+    }
+
+    location /map/api/ {
+        auth_basic off;
+        proxy_pass         https://flights.test.aeroflot.ru;
+        proxy_set_header   Host flights.test.aeroflot.ru;
+        proxy_ssl_server_name on;
+    }
+}
+```
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add deployment/nginx/ui-dashboard.gnerim.ru.conf
+git commit -m "deployment: add nginx vhost for ui-dashboard.gnerim.ru"
+```
+
+---
+
+## Task 2: Write deployment runbook
+
+**Files:**
+- Create: `deployment/README.md`
+
+The bootstrap runbook for setting up pve-201 from scratch + failure-path rehearsal recipes.
+
+- [ ] **Step 1: Create the file**
+
+Write `deployment/README.md`:
+
+````markdown
+# pve-201 Deployment Runbook
+
+This is the bootstrap procedure for hosting `https://ui-dashboard.gnerim.ru/` on pve-201, plus rehearsal recipes for the CI/CD pipeline failure paths. The full design rationale lives in `docs/superpowers/specs/2026-04-25-cicd-pipeline-design.md`.
+
+## One-time setup
+
+### 1. Routing pve-201 → TIM API (via webzavod)
+
+**On webzavod (192.168.88.58)** — verify IP forwarding and MASQUERADE:
+
+```bash
+sysctl net.ipv4.ip_forward                          # expect: 1
+sudo iptables -t nat -L POSTROUTING -nv | grep ppp0 # expect: MASQUERADE rule
+```
+
+If missing:
+
+```bash
+echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf
+sudo sysctl -p
+sudo iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
+sudo apt install iptables-persistent
+sudo netfilter-persistent save
+```
+
+**On pve-201** — add a persistent static route to TIM via webzavod:
+
+```yaml
+# /etc/netplan/01-routes.yaml — adjust NIC name as needed
+network:
+  version: 2
+  ethernets:
+    eth0:
+      routes:
+        - to: 172.18.0.0/16
+          via: 192.168.88.58
+```
+
+```bash
+sudo netplan apply
+```
+
+**On pve-201** — pin TIM hostnames to reachable A records (TIM DNS returns duplicate As, one of which is dead):
+
+```bash
+echo '172.18.0.121 flights.test.aeroflot.ru' | sudo tee -a /etc/hosts
+```
+
+**Smoke test:**
+
+```bash
+curl -v https://flights.test.aeroflot.ru/swagger/   # expect: 401 in <300ms
+```
+
+If this fails, fix routing/DNS before proceeding — nothing else will work.
+
+### 2. nginx vhost
+
+```bash
+sudo cp deployment/nginx/ui-dashboard.gnerim.ru.conf /etc/nginx/sites-available/
+sudo ln -s /etc/nginx/sites-available/ui-dashboard.gnerim.ru.conf /etc/nginx/sites-enabled/
+sudo mkdir -p /etc/nginx/htpasswd
+sudo nginx -t
+sudo systemctl reload nginx
+```
+
+The `htpasswd` file is created by `scripts/ci/install-htpasswd.sh` on first deploy.
+
+### 3. Gitea runner setup
+
+The runner must be in the `docker` group (so it can talk to the Docker socket without sudo) and reach all upstream services:
+
+```bash
+sudo usermod -aG docker <runner-user>     # then re-login the runner service
+docker ps                                  # must work without sudo for the runner user
+```
+
+Reachability checks the runner must pass:
+
+```bash
+curl -fsS https://git.gnerim.ru/                                        # Gitea
+curl -fsSI https://teamscore.gitlab.yandexcloud.net/                    # GitLab
+curl -fsSI http://jenkins.yc.devwebzavod.ru:8080/                       # Jenkins (via static route)
+curl -fsSI http://flights-ui.devwebzavod.ru/                            # Customer URL (via static route)
+```
+
+### 4. GitLab Personal Access Token
+
+GitLab → User Settings → Access Tokens → create with scopes `api` and `write_repository`. Store as Gitea Actions secret `GITLAB_PAT`.
+
+### 5. Allow self-approve on GitLab project
+
+GitLab → flights-front project → Settings → Merge requests → Approval rules → uncheck **"Prevent approval by author"**.
+
+Verify by running (locally, after PAT is in place):
+
+```bash
+GITLAB_PAT=<pat> ./scripts/ci/check-gitlab-project.sh
+```
+
+It prints the numeric project ID (store as `GITLAB_PROJECT_ID` secret) and confirms self-approve is allowed.
+
+### 6. Jenkins remote trigger token
+
+Jenkins → `Aeroflot2/Flights-Front-Dev` job → Configure → check **"Trigger builds remotely"** → set token (e.g. `flights-cd-trigger`). Store as `JENKINS_TRIGGER_TOKEN`.
+
+Also: Jenkins → User → Configure → API Token → Add new token. Store username as `JENKINS_USER`, token as `JENKINS_API_TOKEN`.
+
+### 7. Telegram bot
+
+Use existing bot or create via @BotFather. Get the chat_id by sending a message and querying `https://api.telegram.org/bot<TOKEN>/getUpdates`. Store as `TELEGRAM_BOT_TOKEN` and `TELEGRAM_CHAT_ID`.
+
+### 8. Gitea Actions secrets summary
+
+Repo → Settings → Actions → Secrets — set all of:
+
+| Secret | Purpose |
+|---|---|
+| `BASIC_AUTH_USER`, `BASIC_AUTH_PASS` | nginx htpasswd |
+| `MAP_TILE_URL` | Default `/map/api/tile/{z}/{x}/{y}.jpeg` |
+| `API_BASE_URL` | Default `/api` |
+| `GITLAB_PAT`, `GITLAB_PROJECT_ID` | GitLab MR API |
+| `JENKINS_USER`, `JENKINS_API_TOKEN`, `JENKINS_TRIGGER_TOKEN` | Jenkins API |
+| `TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID` | Notifications |
+
+## Verifying failure paths
+
+Run at least the rollback and "release blocked" rehearsals once before declaring the pipeline production-grade.
+
+### A: e2e fail → rollback
+
+Push a commit that adds `console.error('rehearsal')` somewhere that runs on every page (e.g. `src/routes/layout.tsx`). Workflow A runs, e2e fails on the console-gate, rollback to `:previous` triggers. Verify:
+
+- Telegram message: `❌ ci-deploy FAILED at step "Run Playwright e2e" — rolled back to <prev-sha>`
+- `https://ui-dashboard.gnerim.ru/` still serves the previous version (check the page or `docker inspect flights-web`).
+
+Revert the rehearsal commit when done.
+
+### A: rollback itself fails
+
+```bash
+ssh pve-201 'docker rmi flights-web:previous'
+```
+
+Then push a commit that fails e2e. Rollback step finds no `:previous` and bails. Verify:
+
+- Telegram message: `🔥 ci-deploy ROLLBACK FAILED — site is DOWN`
+- `https://ui-dashboard.gnerim.ru/` returns 502.
+- Manual recovery: `ssh pve-201 'docker run -d --name flights-web -p 127.0.0.1:8081:8080 flights-web:<known-good-sha>'`.
+
+### B: blocked on A not green
+
+Trigger Workflow B (manual or tag) for a SHA that has no green Workflow A run. Verify:
+
+- Telegram message: `⚠️ release blocked — workflow ci-deploy is not green for <sha>`
+- B exits early; nothing changes in GitLab.
+
+### B: Jenkins poll timeout
+
+Set `JENKINS_TIMEOUT=30` as a secret override and trigger B. Polling should give up after 30s and report timeout.
+
+## Manual recovery scenarios
+
+### Workflow B failed at step 12-13 (Jenkins) — MR merged but customer site stale
+
+GitLab is already at the new commit; Jenkins didn't deploy. Recovery:
+
+1. Open Jenkins UI → click "Build Now" on the same job, or
+2. Push a new commit to GitLab to re-trigger Jenkins polling (if it's set up that way), or
+3. Re-run Workflow B from a green Workflow A — but only if you also pushed new code; otherwise B will sync a no-op and skip.
+
+### Container running but nginx returns 502
+
+Check the bind:
+
+```bash
+ssh pve-201
+docker ps --filter name=flights-web
+curl -v http://127.0.0.1:8081/   # should return 200 (or whatever the SSR root returns)
+sudo nginx -t && sudo systemctl reload nginx
+```
+
+If the container died, the Restart policy `unless-stopped` should bring it back. If not:
+
+```bash
+docker logs flights-web --tail 200
+docker run -d --name flights-web -p 127.0.0.1:8081:8080 flights-web:current
+```
+````
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add deployment/README.md
+git commit -m "deployment: bootstrap runbook + failure-path rehearsals"
+```
+
+---
+
+## Task 3: Add `snap-*.yml` to .gitignore
+
+**Files:**
+- Modify: `.gitignore`
+
+The 9 untracked `snap-*.yml` files at repo root are throwaway parity-snapshot artifacts. Ignore them.
+
+- [ ] **Step 1: Check current .gitignore for an existing snap pattern**
+
+```bash
+grep -n 'snap' .gitignore || echo "no existing snap pattern"
+```
+
+- [ ] **Step 2: Append the pattern**
+
+If no existing match, append to `.gitignore`:
+
+```
+# Throwaway parity-snapshot artifacts produced by tests/parity scripts
+/snap-*.yml
+```
+
+- [ ] **Step 3: Verify the untracked snap files are now ignored**
+
+```bash
+git status --porcelain | grep '^??.*snap-' || echo "all snap-*.yml ignored"
+```
+
+Expect: `all snap-*.yml ignored`
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add .gitignore
+git commit -m "gitignore: drop snap-*.yml parity artifacts"
+```
+
+---
+
+## Task 4: Console-error gate Playwright fixture
+
+**Files:**
+- Create: `tests/e2e/fixtures/console-gate.ts`
+- Create: `tests/e2e/fixtures/console-allowlist.json`
+
+Playwright fixture that fails any test where the page emits a `console.error` or `console.warn` not matched by an allowlist regex.
+
+- [ ] **Step 1: Create the allowlist starter**
+
+```bash
+mkdir -p tests/e2e/fixtures
+```
+
+Write `tests/e2e/fixtures/console-allowlist.json`:
+
+```json
+{
+  "patterns": []
+}
+```
+
+(Empty per design — populated by observation during first runs. Each entry is `{"pattern": "<regex>", "reason": "<why>"}`.)
+
+- [ ] **Step 2: Write the fixture**
+
+Write `tests/e2e/fixtures/console-gate.ts`:
+
+```typescript
+import { test as base, expect } from "@playwright/test";
+import fs from "node:fs";
+import path from "node:path";
+
+interface AllowlistEntry {
+  pattern: string;
+  reason: string;
+}
+
+interface Allowlist {
+  patterns: AllowlistEntry[];
+}
+
+const ALLOWLIST_PATH = path.join(__dirname, "console-allowlist.json");
+
+function loadAllowlist(): RegExp[] {
+  const raw = fs.readFileSync(ALLOWLIST_PATH, "utf8");
+  const parsed: Allowlist = JSON.parse(raw);
+  for (const entry of parsed.patterns) {
+    if (!entry.reason || entry.reason.trim() === "") {
+      throw new Error(
+        `console-allowlist.json: pattern ${JSON.stringify(entry.pattern)} has no reason`
+      );
+    }
+  }
+  return parsed.patterns.map((e) => new RegExp(e.pattern));
+}
+
+const allowlist = loadAllowlist();
+
+function isAllowed(message: string): boolean {
+  return allowlist.some((re) => re.test(message));
+}
+
+interface ConsoleGateFixtures {
+  consoleMessages: string[];
+}
+
+export const test = base.extend<ConsoleGateFixtures>({
+  consoleMessages: async ({ page }, use, testInfo) => {
+    const messages: string[] = [];
+    page.on("console", (msg) => {
+      const type = msg.type();
+      if (type !== "error" && type !== "warning") return;
+      const text = `[${type}] ${msg.text()}`;
+      if (isAllowed(text)) return;
+      messages.push(text);
+    });
+    page.on("pageerror", (err) => {
+      const text = `[pageerror] ${err.message}`;
+      if (!isAllowed(text)) messages.push(text);
+    });
+
+    await use(messages);
+
+    if (messages.length > 0) {
+      testInfo.attachments.push({
+        name: "console-violations.txt",
+        contentType: "text/plain",
+        body: Buffer.from(messages.join("\n"), "utf8"),
+      });
+      throw new Error(
+        `Console gate: ${messages.length} disallowed message(s):\n` +
+          messages.map((m) => `  ${m}`).join("\n")
+      );
+    }
+  },
+});
+
+export { expect };
+```
+
+- [ ] **Step 3: Verify it parses (typecheck)**
+
+```bash
+pnpm typecheck
+```
+
+Expected: no new errors. (The fixture isn't used by any spec yet — that happens in Task 5.)
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add tests/e2e/fixtures/console-gate.ts tests/e2e/fixtures/console-allowlist.json
+git commit -m "e2e: add console-error gate fixture with allowlist"
+```
+
+---
+
+## Task 5: Make Playwright BASE_URL-driven and adopt the gate
+
+**Files:**
+- Modify: `playwright.config.ts`
+
+Drop the hardcoded `localhost:8080` baseURL and the `webServer` block; both prevent running against deployed URLs. Default to localhost when `BASE_URL` is unset so local dev still works.
+
+- [ ] **Step 1: Read current config**
+
+```bash
+cat playwright.config.ts
+```
+
+- [ ] **Step 2: Replace the config**
+
+Write `playwright.config.ts`:
+
+```typescript
+import { defineConfig } from "@playwright/test";
+
+const baseURL = process.env.BASE_URL ?? "http://localhost:8080";
+const startLocalServer = !process.env.BASE_URL;
+
+export default defineConfig({
+  testDir: "tests/e2e",
+  timeout: 30000,
+  use: {
+    baseURL,
+    headless: true,
+    httpCredentials:
+      process.env.BASIC_AUTH_USER && process.env.BASIC_AUTH_PASS
+        ? {
+            username: process.env.BASIC_AUTH_USER,
+            password: process.env.BASIC_AUTH_PASS,
+          }
+        : undefined,
+  },
+  reporter: [["html", { open: "never" }], ["list"]],
+  ...(startLocalServer
+    ? {
+        webServer: {
+          command: "pnpm dev",
+          url: "http://localhost:8080",
+          reuseExistingServer: true,
+          timeout: 30000,
+        },
+      }
+    : {}),
+});
+```
+
+- [ ] **Step 3: Verify local run still works (smoke check)**
+
+```bash
+BASE_URL= pnpm test:e2e tests/e2e/smoke.spec.ts -g "renders with Russian text" --reporter=list || true
+```
+
+If the dev server is already up locally this should pass. If it fails because `pnpm dev` isn't running, that's expected — the goal is "config is valid syntax" which the previous step verified.
+
+- [ ] **Step 4: Verify config compiles cleanly**
+
+```bash
+pnpm typecheck
+```
+
+Expected: no new errors.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add playwright.config.ts
+git commit -m "e2e: make playwright BASE_URL-driven for remote runs"
+```
+
+---
+
+## Task 6: Wire `test-ci` into Makefile and package.json
+
+**Files:**
+- Modify: `package.json`
+- Modify: `Makefile`
+
+Add a `test:ci` script and a `make test-ci` target so the bash unit tests have a canonical entry point. They run the (yet-to-be-written) `tests/ci/test-*.sh` files.
+
+- [ ] **Step 1: Add the script to package.json**
+
+Find the `"scripts"` block. Add a new entry after `"test:e2e:angular"`:
+
+```json
+    "test:ci": "for f in tests/ci/test-*.sh; do echo \"--- $f ---\"; bash \"$f\" || exit 1; done"
+```
+
+(The existing JSON formatting uses 4-space indent; match it.)
+
+- [ ] **Step 2: Add the Makefile target**
+
+Append to `Makefile`:
+
+```makefile
+
+# CI-script unit tests
+test-ci:
+	$(PNPM) test:ci
+```
+
+Update `.PHONY` at the top to include `test-ci`.
+
+- [ ] **Step 3: Verify the script glob is safe when no test files exist yet**
+
+```bash
+mkdir -p tests/ci
+pnpm test:ci 2>&1 | head -3
+```
+
+Expected: prints `--- tests/ci/test-*.sh ---` (literal glob — no matches yet) then exits 1 because bash can't find that file. Acceptable for now; once tests exist it'll work. To make the glob permissive, change the script to:
+
+```json
+    "test:ci": "shopt -s nullglob; for f in tests/ci/test-*.sh; do echo \"--- $f ---\"; bash \"$f\" || exit 1; done"
+```
+
+Wait — `shopt` is bash-specific and pnpm's script runner is `sh` by default. Use a robust form instead:
+
+```json
+    "test:ci": "bash -c 'shopt -s nullglob; for f in tests/ci/test-*.sh; do echo \"--- $f ---\"; bash \"$f\" || exit 1; done'"
+```
+
+Replace the script entry with that form. Re-run:
+
+```bash
+pnpm test:ci
+```
+
+Expected: exits 0 with no output (no test files yet).
+
+- [ ] **Step 4: Update Makefile help text**
+
+In the `help:` target's "Testing & Quality" section, add:
+
+```
+	@echo "    make test-ci      - Run CI script unit tests (bash)"
+```
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add package.json Makefile
+git commit -m "ci: wire test-ci entry point for bash script tests"
+```
+
+---
+
+## Task 7: notify-telegram.sh + tests
+
+**Files:**
+- Create: `scripts/ci/notify-telegram.sh`
+- Create: `tests/ci/test-notify-telegram.sh`
+
+Sends Telegram messages with three shapes (start/ok/fail). `--dry-run` prints the rendered payload to stdout instead of POSTing — used by tests.
+
+- [ ] **Step 1: Write the test first**
+
+```bash
+mkdir -p tests/ci
+```
+
+Write `tests/ci/test-notify-telegram.sh`:
+
+```bash
+#!/usr/bin/env bash
+# Test: scripts/ci/notify-telegram.sh in --dry-run mode emits the right payloads.
+set -euo pipefail
+
+SCRIPT="$(cd "$(dirname "$0")/../.." && pwd)/scripts/ci/notify-telegram.sh"
+[ -x "$SCRIPT" ] || { echo "FAIL: $SCRIPT not executable"; exit 1; }
+
+# Required env for non-dry-run; test still sets them so the script doesn't bail early.
+export TELEGRAM_BOT_TOKEN="test-token"
+export TELEGRAM_CHAT_ID="123"
+export GITHUB_REPOSITORY="gnezim/flights-web"
+export GITHUB_RUN_ID="42"
+export GITHUB_SERVER_URL="https://git.gnerim.ru"
+export GITHUB_SHA="abc1234567890"
+export GITHUB_WORKFLOW="ci-deploy"
+
+assert_contains() {
+  local haystack="$1" needle="$2"
+  case "$haystack" in
+    *"$needle"*) ;;
+    *) echo "FAIL: expected to find '$needle' in:"; echo "$haystack"; exit 1 ;;
+  esac
+}
+
+# --- start ---
+out=$("$SCRIPT" --dry-run start ci-deploy)
+assert_contains "$out" "🚀 ci-deploy started"
+assert_contains "$out" "abc1234"
+assert_contains "$out" "https://git.gnerim.ru/gnezim/flights-web/actions/runs/42"
+
+# --- ok ---
+out=$("$SCRIPT" --dry-run ok ci-deploy)
+assert_contains "$out" "✅ ci-deploy passed"
+
+# --- fail with extra context ---
+out=$("$SCRIPT" --dry-run fail ci-deploy "Run Playwright e2e")
+assert_contains "$out" "❌ ci-deploy FAILED"
+assert_contains "$out" "Run Playwright e2e"
+
+# --- missing env should error in non-dry-run ---
+unset TELEGRAM_BOT_TOKEN
+if "$SCRIPT" ok ci-deploy 2>/dev/null; then
+  echo "FAIL: expected error when TELEGRAM_BOT_TOKEN missing"
+  exit 1
+fi
+
+echo "PASS: notify-telegram.sh"
+```
+
+```bash
+chmod +x tests/ci/test-notify-telegram.sh
+```
+
+- [ ] **Step 2: Run the test (expect failure — script doesn't exist)**
+
+```bash
+bash tests/ci/test-notify-telegram.sh
+```
+
+Expected: `FAIL: <path>/scripts/ci/notify-telegram.sh not executable`.
+
+- [ ] **Step 3: Write the script**
+
+```bash
+mkdir -p scripts/ci
+```
+
+Write `scripts/ci/notify-telegram.sh`:
+
+```bash
+#!/usr/bin/env bash
+# notify-telegram.sh — post a Telegram message for a CI stage.
+#
+# Usage: notify-telegram.sh [--dry-run] <start|ok|fail> <stage> [<extra-context>]
+#
+# Env (required unless --dry-run):
+#   TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID
+# Env (always read for context):
+#   GITHUB_REPOSITORY, GITHUB_RUN_ID, GITHUB_SERVER_URL, GITHUB_SHA, GITHUB_WORKFLOW
+set -euo pipefail
+
+DRY_RUN=0
+if [ "${1:-}" = "--dry-run" ]; then
+  DRY_RUN=1
+  shift
+fi
+
+VERB="${1:-}"
+STAGE="${2:-}"
+EXTRA="${3:-}"
+
+case "$VERB" in
+  start|ok|fail) ;;
+  *) echo "usage: $0 [--dry-run] <start|ok|fail> <stage> [<extra-context>]" >&2; exit 2 ;;
+esac
+
+[ -n "$STAGE" ] || { echo "usage: $0 [--dry-run] <start|ok|fail> <stage> [<extra-context>]" >&2; exit 2; }
+
+if [ "$DRY_RUN" -eq 0 ]; then
+  : "${TELEGRAM_BOT_TOKEN:?TELEGRAM_BOT_TOKEN required}"
+  : "${TELEGRAM_CHAT_ID:?TELEGRAM_CHAT_ID required}"
+fi
+
+REPO="${GITHUB_REPOSITORY:-unknown/repo}"
+RUN_ID="${GITHUB_RUN_ID:-0}"
+SERVER="${GITHUB_SERVER_URL:-https://git.gnerim.ru}"
+SHA="${GITHUB_SHA:-unknown}"
+SHORT_SHA="${SHA:0:7}"
+RUN_URL="${SERVER}/${REPO}/actions/runs/${RUN_ID}"
+
+case "$VERB" in
+  start) ICON="🚀"; HEAD="${ICON} ${STAGE} started" ;;
+  ok)    ICON="✅"; HEAD="${ICON} ${STAGE} passed" ;;
+  fail)  ICON="❌"; HEAD="${ICON} ${STAGE} FAILED${EXTRA:+ at step \"${EXTRA}\"}" ;;
+esac
+
+# Body is plain text (no HTML escaping needed for our content).
+BODY="${HEAD}
+commit: ${SHORT_SHA}
+gitea run: ${RUN_URL}"
+
+if [ "$DRY_RUN" -eq 1 ]; then
+  printf '%s\n' "$BODY"
+  exit 0
+fi
+
+# Send via curl. Use --data-urlencode to avoid encoding pitfalls.
+curl -fsS -X POST \
+  "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
+  --data-urlencode "chat_id=${TELEGRAM_CHAT_ID}" \
+  --data-urlencode "text=${BODY}" \
+  --data-urlencode "disable_web_page_preview=true" \
+  >/dev/null
+```
+
+```bash
+chmod +x scripts/ci/notify-telegram.sh
+```
+
+- [ ] **Step 4: Run the test (expect pass)**
+
+```bash
+pnpm test:ci
+```
+
+Expected: `--- tests/ci/test-notify-telegram.sh ---` then `PASS: notify-telegram.sh` then exit 0.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add scripts/ci/notify-telegram.sh tests/ci/test-notify-telegram.sh
+git commit -m "ci: notify-telegram.sh + dry-run tests"
+```
+
+---
+
+## Task 8: Extend notify-telegram.sh with `fail` artifact tail
+
+**Files:**
+- Modify: `scripts/ci/notify-telegram.sh`
+- Modify: `tests/ci/test-notify-telegram.sh`
+
+The `fail` shape needs a "last 30 lines of step output" appendix (per spec section "Telegram message shapes"). Use a 4th positional arg = path to a log file.
+
+- [ ] **Step 1: Extend the test**
+
+Append to `tests/ci/test-notify-telegram.sh` before the `echo "PASS"` line:
+
+```bash
+# --- fail with log tail ---
+TMPLOG=$(mktemp)
+printf 'line1\nline2\nline3\n' > "$TMPLOG"
+out=$("$SCRIPT" --dry-run fail ci-deploy "Run Playwright e2e" "$TMPLOG")
+assert_contains "$out" "last 3 lines"
+assert_contains "$out" "line1"
+assert_contains "$out" "line3"
+rm -f "$TMPLOG"
+
+# --- fail with missing log file: should still print message, no crash ---
+out=$("$SCRIPT" --dry-run fail ci-deploy "Build" "/nonexistent/log")
+assert_contains "$out" "❌ ci-deploy FAILED"
+```
+
+- [ ] **Step 2: Run the test (expect failure)**
+
+```bash
+pnpm test:ci
+```
+
+Expected: assertion failure on `last 3 lines`.
+
+- [ ] **Step 3: Extend the script**
+
+In `scripts/ci/notify-telegram.sh`, change the line:
+
+```bash
+EXTRA="${3:-}"
+```
+
+to:
+
+```bash
+EXTRA="${3:-}"
+LOG_PATH="${4:-}"
+```
+
+And before the `if [ "$DRY_RUN" -eq 1 ]` line, add:
+
+```bash
+if [ "$VERB" = "fail" ] && [ -n "$LOG_PATH" ] && [ -f "$LOG_PATH" ]; then
+  TAIL_LINES=$(tail -n 30 "$LOG_PATH")
+  TAIL_COUNT=$(printf '%s\n' "$TAIL_LINES" | wc -l | tr -d ' ')
+  BODY="${BODY}
+
+last ${TAIL_COUNT} lines:
+${TAIL_LINES}"
+fi
+```
+
+- [ ] **Step 4: Run the test (expect pass)**
+
+```bash
+pnpm test:ci
+```
+
+Expected: `PASS: notify-telegram.sh`.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add scripts/ci/notify-telegram.sh tests/ci/test-notify-telegram.sh
+git commit -m "ci: notify-telegram.sh — append last 30 log lines on fail"
+```
+
+---
+
+## Task 9: wait-for-url.sh + tests
+
+**Files:**
+- Create: `scripts/ci/wait-for-url.sh`
+- Create: `tests/ci/test-wait-for-url.sh`
+
+Generic curl-with-retry. Used by Workflow A (health check after deploy) and Workflow B (wait for customer URL after Jenkins).
+
+- [ ] **Step 1: Write the test first**
+
+Write `tests/ci/test-wait-for-url.sh`:
+
+```bash
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT="$(cd "$(dirname "$0")/../.." && pwd)/scripts/ci/wait-for-url.sh"
+[ -x "$SCRIPT" ] || { echo "FAIL: $SCRIPT not executable"; exit 1; }
+
+# Spin up a tiny HTTP server on a random free port.
+PORT=$(python3 -c 'import socket; s=socket.socket(); s.bind(("",0)); print(s.getsockname()[1]); s.close()')
+TMPDIR=$(mktemp -d)
+echo "ok" > "$TMPDIR/index.html"
+( cd "$TMPDIR" && python3 -m http.server "$PORT" >/dev/null 2>&1 ) &
+SERVER_PID=$!
+trap "kill $SERVER_PID 2>/dev/null; rm -rf $TMPDIR" EXIT
+
+# Wait for server to come up
+for _ in 1 2 3 4 5 6 7 8 9 10; do
+  if curl -fsS "http://127.0.0.1:$PORT/" >/dev/null 2>&1; then break; fi
+  sleep 0.2
+done
+
+# 200 case — should pass quickly
+"$SCRIPT" "http://127.0.0.1:$PORT/" 5 1 || { echo "FAIL: expected 200 to succeed"; exit 1; }
+
+# 404 case — script should fail (curl -f returns non-zero on 4xx)
+if "$SCRIPT" "http://127.0.0.1:$PORT/no-such-path" 3 1 2>/dev/null; then
+  echo "FAIL: expected 404 to fail"; exit 1
+fi
+
+# Network failure case — wrong port
+if "$SCRIPT" "http://127.0.0.1:1/" 2 1 2>/dev/null; then
+  echo "FAIL: expected unreachable URL to fail"; exit 1
+fi
+
+# Bad usage
+if "$SCRIPT" 2>/dev/null; then
+  echo "FAIL: expected usage error"; exit 1
+fi
+
+echo "PASS: wait-for-url.sh"
+```
+
+```bash
+chmod +x tests/ci/test-wait-for-url.sh
+```
+
+- [ ] **Step 2: Run the test (expect failure — script doesn't exist)**
+
+```bash
+pnpm test:ci
+```
+
+Expected: `FAIL: <path>/scripts/ci/wait-for-url.sh not executable`.
+
+- [ ] **Step 3: Write the script**
+
+Write `scripts/ci/wait-for-url.sh`:
+
+```bash
+#!/usr/bin/env bash
+# wait-for-url.sh — curl with retry until success or attempts exhausted.
+#
+# Usage: wait-for-url.sh <url> [<max-attempts>] [<delay-seconds>]
+# Env (optional): BASIC_AUTH_USER, BASIC_AUTH_PASS — if set, sent as basic auth.
+set -euo pipefail
+
+URL="${1:-}"
+MAX_ATTEMPTS="${2:-30}"
+DELAY="${3:-2}"
+
+if [ -z "$URL" ]; then
+  echo "usage: $0 <url> [<max-attempts>] [<delay-seconds>]" >&2
+  exit 2
+fi
+
+AUTH_ARGS=()
+if [ -n "${BASIC_AUTH_USER:-}" ] && [ -n "${BASIC_AUTH_PASS:-}" ]; then
+  AUTH_ARGS=(--user "${BASIC_AUTH_USER}:${BASIC_AUTH_PASS}")
+fi
+
+attempt=1
+while [ "$attempt" -le "$MAX_ATTEMPTS" ]; do
+  if curl -fsS "${AUTH_ARGS[@]}" -o /dev/null "$URL"; then
+    echo "ok: $URL ($attempt attempt(s))"
+    exit 0
+  fi
+  if [ "$attempt" -lt "$MAX_ATTEMPTS" ]; then
+    sleep "$DELAY"
+  fi
+  attempt=$((attempt + 1))
+done
+
+echo "fail: $URL did not return 2xx after $MAX_ATTEMPTS attempts" >&2
+exit 1
+```
+
+```bash
+chmod +x scripts/ci/wait-for-url.sh
+```
+
+- [ ] **Step 4: Run the test (expect pass)**
+
+```bash
+pnpm test:ci
+```
+
+Expected: `PASS: wait-for-url.sh` (and `PASS: notify-telegram.sh` from before).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add scripts/ci/wait-for-url.sh tests/ci/test-wait-for-url.sh
+git commit -m "ci: wait-for-url.sh — curl with retry"
+```
+
+---
+
+## Task 10: install-htpasswd.sh
+
+**Files:**
+- Create: `scripts/ci/install-htpasswd.sh`
+
+Renders `/etc/nginx/htpasswd/ui-dashboard` from env vars and reloads nginx. Trivial enough that no unit test is worth writing — invariants are "file exists with the right content" and "nginx reloaded", both of which are observable in the workflow.
+
+- [ ] **Step 1: Write the script**
+
+Write `scripts/ci/install-htpasswd.sh`:
+
+```bash
+#!/usr/bin/env bash
+# install-htpasswd.sh — render /etc/nginx/htpasswd/ui-dashboard from env + reload nginx.
+#
+# Env (required): BASIC_AUTH_USER, BASIC_AUTH_PASS
+# Env (optional): HTPASSWD_PATH (default /etc/nginx/htpasswd/ui-dashboard)
+set -euo pipefail
+
+: "${BASIC_AUTH_USER:?BASIC_AUTH_USER required}"
+: "${BASIC_AUTH_PASS:?BASIC_AUTH_PASS required}"
+HTPASSWD_PATH="${HTPASSWD_PATH:-/etc/nginx/htpasswd/ui-dashboard}"
+
+# Use openssl APR1 hash (htpasswd from apache2-utils not always present).
+# Format: <user>:<hash>
+HASH=$(openssl passwd -apr1 "$BASIC_AUTH_PASS")
+
+sudo mkdir -p "$(dirname "$HTPASSWD_PATH")"
+echo "${BASIC_AUTH_USER}:${HASH}" | sudo tee "$HTPASSWD_PATH" >/dev/null
+sudo chmod 644 "$HTPASSWD_PATH"
+
+sudo nginx -t
+sudo nginx -s reload
+
+echo "ok: $HTPASSWD_PATH installed, nginx reloaded"
+```
+
+```bash
+chmod +x scripts/ci/install-htpasswd.sh
+```
+
+- [ ] **Step 2: Verify openssl is available locally (sanity check)**
+
+```bash
+echo "test" | openssl passwd -apr1 -stdin | head -c 50; echo
+```
+
+Expected: `$apr1$...$...` style hash printed.
+
+- [ ] **Step 3: Verify usage-error path**
+
+```bash
+./scripts/ci/install-htpasswd.sh 2>&1 | head -2
+```
+
+Expected: error mentioning `BASIC_AUTH_USER required`.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add scripts/ci/install-htpasswd.sh
+git commit -m "ci: install-htpasswd.sh — render nginx basic-auth file"
+```
+
+---
+
+## Task 11: deploy-container.sh + tests
+
+**Files:**
+- Create: `scripts/ci/deploy-container.sh`
+- Create: `tests/ci/test-deploy-container.sh`
+
+Subcommands `swap` and `rollback`. Encapsulates the alias dance and health check. `--dry-run` prints docker commands instead of running them.
+
+- [ ] **Step 1: Write the test first**
+
+Write `tests/ci/test-deploy-container.sh`:
+
+```bash
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT="$(cd "$(dirname "$0")/../.." && pwd)/scripts/ci/deploy-container.sh"
+[ -x "$SCRIPT" ] || { echo "FAIL: $SCRIPT not executable"; exit 1; }
+
+assert_contains() {
+  local haystack="$1" needle="$2"
+  case "$haystack" in
+    *"$needle"*) ;;
+    *) echo "FAIL: expected '$needle' in:"; echo "$haystack"; exit 1 ;;
+  esac
+}
+
+assert_order() {
+  local haystack="$1" first="$2" second="$3"
+  local pos1 pos2
+  pos1=$(printf '%s' "$haystack" | grep -nF "$first" | head -1 | cut -d: -f1)
+  pos2=$(printf '%s' "$haystack" | grep -nF "$second" | head -1 | cut -d: -f1)
+  if [ -z "$pos1" ] || [ -z "$pos2" ] || [ "$pos1" -ge "$pos2" ]; then
+    echo "FAIL: expected '$first' (line $pos1) before '$second' (line $pos2)"
+    echo "$haystack"
+    exit 1
+  fi
+}
+
+export GITHUB_SHA=abcdef1234567890
+export FLIGHTS_WEB_PORT=8081
+
+# --- swap ---
+out=$("$SCRIPT" --dry-run swap)
+# Order matters: tag previous before tagging current; remove old container before run new
+assert_order "$out" "tag flights-web:current flights-web:previous" "tag flights-web:abcdef1 flights-web:current"
+assert_contains "$out" "stop flights-web"
+assert_contains "$out" "rm flights-web"
+assert_order "$out" "rm flights-web" "run -d --name flights-web"
+assert_contains "$out" "127.0.0.1:8081:8080"
+assert_contains "$out" "flights-web:current"
+
+# --- rollback ---
+out=$("$SCRIPT" --dry-run rollback)
+assert_contains "$out" "stop flights-web"
+assert_contains "$out" "rm flights-web"
+assert_contains "$out" "flights-web:previous"
+# After running previous, current alias should be repointed
+assert_order "$out" "run -d --name flights-web" "tag flights-web:previous flights-web:current"
+
+# --- bad subcommand ---
+if "$SCRIPT" --dry-run foo 2>/dev/null; then
+  echo "FAIL: expected unknown subcommand to error"; exit 1
+fi
+
+echo "PASS: deploy-container.sh"
+```
+
+```bash
+chmod +x tests/ci/test-deploy-container.sh
+```
+
+- [ ] **Step 2: Run test (expect failure)**
+
+```bash
+pnpm test:ci
+```
+
+Expected: `FAIL: <path>/scripts/ci/deploy-container.sh not executable`.
+
+- [ ] **Step 3: Write the script**
+
+Write `scripts/ci/deploy-container.sh`:
+
+```bash
+#!/usr/bin/env bash
+# deploy-container.sh — swap or rollback the flights-web container on the host.
+#
+# Usage: deploy-container.sh [--dry-run] <swap|rollback>
+#
+# `swap`     — assumes the new image is tagged flights-web:${GITHUB_SHA}.
+#              Tags :current → :previous, :sha → :current, restarts container.
+# `rollback` — runs flights-web:previous in place of :current, repoints :current.
+#
+# Env:
+#   GITHUB_SHA          (required for swap)
+#   FLIGHTS_WEB_PORT    (default 8081 — host port that nginx proxies to)
+#   IMAGE_NAME          (default flights-web — set this to point at a registry later)
+set -euo pipefail
+
+DRY_RUN=0
+if [ "${1:-}" = "--dry-run" ]; then
+  DRY_RUN=1
+  shift
+fi
+
+CMD="${1:-}"
+PORT="${FLIGHTS_WEB_PORT:-8081}"
+IMAGE="${IMAGE_NAME:-flights-web}"
+
+run() {
+  if [ "$DRY_RUN" -eq 1 ]; then
+    printf 'docker %s\n' "$*"
+  else
+    docker "$@"
+  fi
+}
+
+run_or_skip() {
+  # Same as run, but doesn't fail in real mode if the docker call fails.
+  if [ "$DRY_RUN" -eq 1 ]; then
+    printf 'docker %s\n' "$*"
+  else
+    docker "$@" || true
+  fi
+}
+
+case "$CMD" in
+  swap)
+    : "${GITHUB_SHA:?GITHUB_SHA required for swap}"
+    SHORT_SHA="${GITHUB_SHA:0:7}"
+    # 1. Tag the currently-live image as :previous (skip if first deploy).
+    if [ "$DRY_RUN" -eq 1 ] || docker image inspect "${IMAGE}:current" >/dev/null 2>&1; then
+      run tag "${IMAGE}:current" "${IMAGE}:previous"
+    fi
+    # 2. Tag the new SHA as :current.
+    run tag "${IMAGE}:${SHORT_SHA}" "${IMAGE}:current"
+    # 3. Stop + remove existing container if present.
+    run_or_skip stop flights-web
+    run_or_skip rm flights-web
+    # 4. Run new container.
+    run run -d --name flights-web --restart unless-stopped \
+      -p "127.0.0.1:${PORT}:8080" \
+      "${IMAGE}:current"
+    ;;
+  rollback)
+    if [ "$DRY_RUN" -eq 0 ] && ! docker image inspect "${IMAGE}:previous" >/dev/null 2>&1; then
+      echo "fatal: ${IMAGE}:previous not found — cannot rollback" >&2
+      exit 1
+    fi
+    run_or_skip stop flights-web
+    run_or_skip rm flights-web
+    run run -d --name flights-web --restart unless-stopped \
+      -p "127.0.0.1:${PORT}:8080" \
+      "${IMAGE}:previous"
+    # Repoint :current to :previous so subsequent swaps have a sane baseline.
+    run tag "${IMAGE}:previous" "${IMAGE}:current"
+    ;;
+  *)
+    echo "usage: $0 [--dry-run] <swap|rollback>" >&2
+    exit 2
+    ;;
+esac
+```
+
+```bash
+chmod +x scripts/ci/deploy-container.sh
+```
+
+- [ ] **Step 4: Run test (expect pass)**
+
+```bash
+pnpm test:ci
+```
+
+Expected: `PASS: deploy-container.sh`.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add scripts/ci/deploy-container.sh tests/ci/test-deploy-container.sh
+git commit -m "ci: deploy-container.sh — swap/rollback with dry-run tests"
+```
+
+---
+
+## Task 12: Image-prune helper inline in workflow (no separate script)
+
+This was originally listed as inline in the workflow. No new file. Document the prune logic for the YAML author:
+
+```bash
+# In Workflow A, post-deploy:
+docker images "flights-web" --format '{{.Tag}} {{.ID}}' \
+  | grep -vE '^(current|previous)\b' \
+  | tail -n +6 \
+  | awk '{print $2}' \
+  | xargs -r docker rmi 2>/dev/null || true
+```
+
+Keeps the 5 most recent SHA tags + the two aliases. Embedded directly in `ci-deploy.yml` (Task 21).
+
+No commit for this task — it's a placeholder so the task numbering matches the spec's mental model.
+
+---
+
+## Task 13: Mock fixtures for Jenkins polling
+
+**Files:**
+- Create: `tests/ci/fixtures/jenkins-success-flow.json`
+- Create: `tests/ci/fixtures/jenkins-failure-flow.json`
+
+JSON describing a sequence of API responses for the mock-mode tests in Task 15.
+
+- [ ] **Step 1: Create the success fixture**
+
+```bash
+mkdir -p tests/ci/fixtures
+```
+
+Write `tests/ci/fixtures/jenkins-success-flow.json`:
+
+```json
+{
+  "trigger_response": {
+    "status": 201,
+    "headers": {
+      "Location": "http://jenkins.test/queue/item/77/"
+    }
+  },
+  "queue_polls": [
+    {"status": 200, "body": {"why": "in queue", "executable": null}},
+    {"status": 200, "body": {"why": "in queue", "executable": null}},
+    {"status": 200, "body": {"executable": {"number": 42, "url": "http://jenkins.test/job/Aeroflot2/job/Flights-Front-Dev/42/"}}}
+  ],
+  "build_polls": [
+    {"status": 200, "body": {"building": true, "result": null, "number": 42}},
+    {"status": 200, "body": {"building": true, "result": null, "number": 42}},
+    {"status": 200, "body": {"building": false, "result": "SUCCESS", "number": 42}}
+  ]
+}
+```
+
+- [ ] **Step 2: Create the failure fixture**
+
+Write `tests/ci/fixtures/jenkins-failure-flow.json`:
+
+```json
+{
+  "trigger_response": {
+    "status": 201,
+    "headers": {
+      "Location": "http://jenkins.test/queue/item/78/"
+    }
+  },
+  "queue_polls": [
+    {"status": 200, "body": {"executable": {"number": 43, "url": "http://jenkins.test/job/Aeroflot2/job/Flights-Front-Dev/43/"}}}
+  ],
+  "build_polls": [
+    {"status": 200, "body": {"building": true, "result": null, "number": 43}},
+    {"status": 200, "body": {"building": false, "result": "FAILURE", "number": 43}}
+  ]
+}
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add tests/ci/fixtures/jenkins-success-flow.json tests/ci/fixtures/jenkins-failure-flow.json
+git commit -m "ci: mock fixtures for Jenkins trigger/poll tests"
+```
+
+---
+
+## Task 14: jenkins-trigger-and-wait.sh + tests
+
+**Files:**
+- Create: `scripts/ci/jenkins-trigger-and-wait.sh`
+- Create: `tests/ci/test-jenkins-trigger.sh`
+
+Trigger Jenkins job, parse `Location` header to get queue URL, poll queue until `executable.url` materializes, then poll build URL until `result != null`. Exits 0 only on `SUCCESS`. `--mock-mode` reads from a fixture JSON instead of curling.
+
+- [ ] **Step 1: Write the test**
+
+Write `tests/ci/test-jenkins-trigger.sh`:
+
+```bash
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+SCRIPT="$ROOT/scripts/ci/jenkins-trigger-and-wait.sh"
+[ -x "$SCRIPT" ] || { echo "FAIL: $SCRIPT not executable"; exit 1; }
+
+# Mock-mode tests need jq — bail with a useful message if unavailable.
+command -v jq >/dev/null 2>&1 || { echo "SKIP: jq not installed"; exit 0; }
+
+# --- success path ---
+if ! "$SCRIPT" --mock-mode "$ROOT/tests/ci/fixtures/jenkins-success-flow.json" 2>&1 | tee /tmp/jenkins-test.log; then
+  echo "FAIL: success fixture should exit 0"
+  exit 1
+fi
+grep -q "build #42 SUCCESS" /tmp/jenkins-test.log || { echo "FAIL: expected 'build #42 SUCCESS'"; exit 1; }
+
+# --- failure path ---
+if "$SCRIPT" --mock-mode "$ROOT/tests/ci/fixtures/jenkins-failure-flow.json" 2>&1 | tee /tmp/jenkins-test.log; then
+  echo "FAIL: failure fixture should exit non-zero"
+  exit 1
+fi
+grep -q "FAILURE" /tmp/jenkins-test.log || { echo "FAIL: expected 'FAILURE' in output"; exit 1; }
+
+# --- bad usage ---
+if "$SCRIPT" 2>/dev/null; then
+  echo "FAIL: expected usage error"
+  exit 1
+fi
+
+echo "PASS: jenkins-trigger-and-wait.sh"
+```
+
+```bash
+chmod +x tests/ci/test-jenkins-trigger.sh
+```
+
+- [ ] **Step 2: Run the test (expect failure)**
+
+```bash
+pnpm test:ci
+```
+
+Expected: `FAIL: <path>/scripts/ci/jenkins-trigger-and-wait.sh not executable`.
+
+- [ ] **Step 3: Write the script**
+
+Write `scripts/ci/jenkins-trigger-and-wait.sh`:
+
+```bash
+#!/usr/bin/env bash
+# jenkins-trigger-and-wait.sh — fire a Jenkins job and wait for completion.
+#
+# Usage:
+#   jenkins-trigger-and-wait.sh                            # real mode (env-driven)
+#   jenkins-trigger-and-wait.sh --mock-mode <fixture.json> # for tests
+#
+# Env (real mode):
+#   JENKINS_BASE_URL          e.g. http://jenkins.yc.devwebzavod.ru:8080
+#   JENKINS_JOB_PATH          e.g. /job/Aeroflot2/job/Flights-Front-Dev
+#   JENKINS_USER, JENKINS_API_TOKEN
+#   JENKINS_TRIGGER_TOKEN
+#   JENKINS_TIMEOUT           seconds (default 1800)
+#   JENKINS_POLL_INTERVAL     seconds (default 10)
+set -euo pipefail
+
+MODE=real
+FIXTURE=""
+if [ "${1:-}" = "--mock-mode" ]; then
+  MODE=mock
+  FIXTURE="${2:-}"
+  [ -n "$FIXTURE" ] || { echo "usage: $0 --mock-mode <fixture.json>" >&2; exit 2; }
+  command -v jq >/dev/null 2>&1 || { echo "fatal: jq required for --mock-mode" >&2; exit 2; }
+fi
+
+POLL_INTERVAL="${JENKINS_POLL_INTERVAL:-10}"
+TIMEOUT="${JENKINS_TIMEOUT:-1800}"
+
+if [ "$MODE" = real ]; then
+  : "${JENKINS_BASE_URL:?required}"
+  : "${JENKINS_JOB_PATH:?required}"
+  : "${JENKINS_USER:?required}"
+  : "${JENKINS_API_TOKEN:?required}"
+  : "${JENKINS_TRIGGER_TOKEN:?required}"
+fi
+
+# ── Mock mode: walk fixture deterministically ─────────────────────────────────
+if [ "$MODE" = mock ]; then
+  QUEUE_URL=$(jq -r '.trigger_response.headers.Location' "$FIXTURE")
+  echo "triggered (mock): queue=$QUEUE_URL"
+
+  # Walk queue polls until we get an executable.
+  count=$(jq '.queue_polls | length' "$FIXTURE")
+  for i in $(seq 0 $((count - 1))); do
+    body=$(jq -c ".queue_polls[$i].body" "$FIXTURE")
+    exe_url=$(printf '%s' "$body" | jq -r '.executable.url // empty')
+    if [ -n "$exe_url" ]; then
+      BUILD_URL="$exe_url"
+      break
+    fi
+    echo "queue poll $((i + 1)): not yet"
+  done
+  [ -n "${BUILD_URL:-}" ] || { echo "fatal: queue never produced executable" >&2; exit 1; }
+  echo "build url (mock): $BUILD_URL"
+
+  # Walk build polls until result != null.
+  count=$(jq '.build_polls | length' "$FIXTURE")
+  for i in $(seq 0 $((count - 1))); do
+    body=$(jq -c ".build_polls[$i].body" "$FIXTURE")
+    result=$(printf '%s' "$body" | jq -r '.result // empty')
+    number=$(printf '%s' "$body" | jq -r '.number')
+    if [ -n "$result" ]; then
+      if [ "$result" = "SUCCESS" ]; then
+        echo "build #${number} SUCCESS"
+        exit 0
+      else
+        echo "build #${number} ${result}" >&2
+        exit 1
+      fi
+    fi
+    echo "build poll $((i + 1)): building"
+  done
+  echo "fatal: build never completed within fixture" >&2
+  exit 1
+fi
+
+# ── Real mode ─────────────────────────────────────────────────────────────────
+TRIGGER_URL="${JENKINS_BASE_URL}${JENKINS_JOB_PATH}/build?token=${JENKINS_TRIGGER_TOKEN}"
+echo "triggering: $TRIGGER_URL"
+
+# -D - dumps headers; -o /dev/null discards body. We need the Location header.
+HEADERS=$(curl -fsS -X POST -u "${JENKINS_USER}:${JENKINS_API_TOKEN}" -D - -o /dev/null "$TRIGGER_URL")
+QUEUE_URL=$(printf '%s' "$HEADERS" | grep -i '^Location:' | head -1 | sed 's/^[Ll]ocation:[[:space:]]*//' | tr -d '\r\n')
+[ -n "$QUEUE_URL" ] || { echo "fatal: no Location header from Jenkins" >&2; exit 1; }
+echo "queue: $QUEUE_URL"
+
+# Poll queue for executable.url.
+START=$(date +%s)
+BUILD_URL=""
+while [ -z "$BUILD_URL" ]; do
+  resp=$(curl -fsS -u "${JENKINS_USER}:${JENKINS_API_TOKEN}" "${QUEUE_URL}api/json")
+  BUILD_URL=$(printf '%s' "$resp" | jq -r '.executable.url // empty')
+  [ -n "$BUILD_URL" ] && break
+  now=$(date +%s)
+  if [ $((now - START)) -ge "$TIMEOUT" ]; then
+    echo "fatal: queue timeout after ${TIMEOUT}s" >&2
+    exit 1
+  fi
+  sleep "$POLL_INTERVAL"
+done
+echo "build: $BUILD_URL"
+
+# Poll build for result.
+while :; do
+  resp=$(curl -fsS -u "${JENKINS_USER}:${JENKINS_API_TOKEN}" "${BUILD_URL}api/json")
+  result=$(printf '%s' "$resp" | jq -r '.result // empty')
+  number=$(printf '%s' "$resp" | jq -r '.number')
+  if [ -n "$result" ]; then
+    if [ "$result" = "SUCCESS" ]; then
+      echo "build #${number} SUCCESS"
+      exit 0
+    else
+      echo "build #${number} ${result} — see ${BUILD_URL}console" >&2
+      exit 1
+    fi
+  fi
+  now=$(date +%s)
+  if [ $((now - START)) -ge "$TIMEOUT" ]; then
+    echo "fatal: build timeout after ${TIMEOUT}s" >&2
+    exit 1
+  fi
+  sleep "$POLL_INTERVAL"
+done
+```
+
+```bash
+chmod +x scripts/ci/jenkins-trigger-and-wait.sh
+```
+
+- [ ] **Step 4: Run the test (expect pass, or SKIP if jq not installed)**
+
+```bash
+which jq && pnpm test:ci || echo "Install jq first: brew install jq (or apt install jq)"
+```
+
+If jq is missing, install it and re-run.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add scripts/ci/jenkins-trigger-and-wait.sh tests/ci/test-jenkins-trigger.sh
+git commit -m "ci: jenkins-trigger-and-wait.sh — fire job + poll for SUCCESS"
+```
+
+---
+
+## Task 15: check-gitlab-project.sh
+
+**Files:**
+- Create: `scripts/ci/check-gitlab-project.sh`
+
+One-shot helper to validate the GitLab project setup post-PAT. Prints numeric project ID and whether self-approve is allowed. Not run by workflows — operator runs it once during prereq #15.
+
+- [ ] **Step 1: Write the script**
+
+Write `scripts/ci/check-gitlab-project.sh`:
+
+```bash
+#!/usr/bin/env bash
+# check-gitlab-project.sh — verify GitLab project setup for the release pipeline.
+#
+# Usage: GITLAB_PAT=<pat> ./scripts/ci/check-gitlab-project.sh
+#
+# Prints:
+#   - Numeric project ID (store as GITLAB_PROJECT_ID secret)
+#   - Whether "Prevent approval by author" is OFF (required for self-approve)
+set -euo pipefail
+
+: "${GITLAB_PAT:?GITLAB_PAT required}"
+GITLAB_HOST="${GITLAB_HOST:-https://teamscore.gitlab.yandexcloud.net}"
+GITLAB_PROJECT_PATH="${GITLAB_PROJECT_PATH:-aeroflot2/flights-front}"
+
+command -v jq >/dev/null 2>&1 || { echo "fatal: jq required" >&2; exit 2; }
+
+ENCODED_PATH=$(printf '%s' "$GITLAB_PROJECT_PATH" | sed 's|/|%2F|g')
+PROJECT_URL="${GITLAB_HOST}/api/v4/projects/${ENCODED_PATH}"
+
+echo "Querying $PROJECT_URL"
+resp=$(curl -fsS -H "PRIVATE-TOKEN: ${GITLAB_PAT}" "$PROJECT_URL") || {
+  echo "fatal: project lookup failed (check PAT scopes: api + write_repository)" >&2
+  exit 1
+}
+
+PROJECT_ID=$(printf '%s' "$resp" | jq -r '.id')
+NAMESPACE=$(printf '%s' "$resp" | jq -r '.namespace.full_path')
+DEFAULT_BRANCH=$(printf '%s' "$resp" | jq -r '.default_branch')
+
+echo
+echo "✅ Project: ${NAMESPACE}/$(printf '%s' "$resp" | jq -r '.path')"
+echo "   ID:               ${PROJECT_ID}    ← store as Gitea secret GITLAB_PROJECT_ID"
+echo "   Default branch:   ${DEFAULT_BRANCH}"
+
+# Check approval settings
+APPROVALS_URL="${GITLAB_HOST}/api/v4/projects/${PROJECT_ID}/approvals"
+appr=$(curl -fsS -H "PRIVATE-TOKEN: ${GITLAB_PAT}" "$APPROVALS_URL" 2>/dev/null) || appr='{}'
+DISABLE_OVERRIDING=$(printf '%s' "$appr" | jq -r '.disable_overriding_approvers_per_merge_request // false')
+PREVENT_AUTHOR=$(printf '%s' "$appr" | jq -r '.merge_requests_author_approval // null')
+
+echo
+echo "Approval settings:"
+echo "   merge_requests_author_approval: ${PREVENT_AUTHOR}"
+echo "   disable_overriding_approvers:   ${DISABLE_OVERRIDING}"
+
+# In GitLab API, merge_requests_author_approval=true means *allow* author approval.
+case "$PREVENT_AUTHOR" in
+  true)  echo "   ✅ Self-approve allowed." ;;
+  false) echo "   ❌ Self-approve BLOCKED. Uncheck 'Prevent approval by author' in project settings." ;;
+  *)     echo "   ⚠️  Could not read approval setting; verify in GitLab UI." ;;
+esac
+
+# Check whether the runner can authenticate to push (try a HEAD on /info/refs).
+echo
+echo "Verifying push auth via HTTPS..."
+PUSH_URL="${GITLAB_HOST}/${GITLAB_PROJECT_PATH}.git/info/refs?service=git-receive-pack"
+http_code=$(curl -s -o /dev/null -w "%{http_code}" -u "oauth2:${GITLAB_PAT}" "$PUSH_URL" || echo "000")
+case "$http_code" in
+  200) echo "   ✅ Push auth ok (HTTP 200)" ;;
+  *)   echo "   ⚠️  Push auth returned HTTP $http_code — verify PAT scope includes write_repository" ;;
+esac
+```
+
+```bash
+chmod +x scripts/ci/check-gitlab-project.sh
+```
+
+- [ ] **Step 2: Verify the script handles missing env**
+
+```bash
+unset GITLAB_PAT
+./scripts/ci/check-gitlab-project.sh 2>&1 | head -2
+```
+
+Expected: `GITLAB_PAT required`.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add scripts/ci/check-gitlab-project.sh
+git commit -m "ci: check-gitlab-project.sh — one-shot setup validator"
+```
+
+---
+
+## Task 16: Refactor sync-to-flights-front.sh into reusable core
+
+**Files:**
+- Create: `scripts/ci/sync-to-gitlab.sh`
+- Modify: `scripts/sync-to-flights-front.sh`
+
+The CI variant takes target dir as a required argument and skips dev-machine output. The original becomes a thin wrapper calling the CI variant with the local default.
+
+- [ ] **Step 1: Read the existing sync script to understand its shape**
+
+```bash
+cat scripts/sync-to-flights-front.sh
+```
+
+Confirm what blocks exist (header, clean target, copy source, copy deployment, cleanup, dockerignore, summary).
+
+- [ ] **Step 2: Create the CI variant by extracting the core**
+
+Write `scripts/ci/sync-to-gitlab.sh`:
+
+```bash
+#!/usr/bin/env bash
+# sync-to-gitlab.sh — copy source from this repo to a target deployment dir.
+#
+# Usage: sync-to-gitlab.sh <target-dir>
+#
+# Same logic as scripts/sync-to-flights-front.sh, but takes the target as a
+# required argument and emits machine-friendly output (no "next steps" hints).
+set -euo pipefail
+
+SRC_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+TARGET_DIR="${1:-}"
+
+if [ -z "$TARGET_DIR" ]; then
+  echo "usage: $0 <target-dir>" >&2
+  exit 2
+fi
+if [ ! -d "$TARGET_DIR" ]; then
+  echo "fatal: target directory does not exist: $TARGET_DIR" >&2
+  exit 1
+fi
+
+DEPLOY_ROOT="$(cd "$TARGET_DIR/.." && pwd)"
+
+echo "syncing $SRC_DIR → $TARGET_DIR"
+
+# 1. Clean target (preserve node_modules, .git, .dockerignore)
+find "$TARGET_DIR" -mindepth 1 -maxdepth 1 \
+  ! -name "node_modules" \
+  ! -name ".dockerignore" \
+  ! -name ".git" \
+  -exec rm -rf {} +
+
+# 2. Copy source files
+cp -r "$SRC_DIR/src"                    "$TARGET_DIR/src"
+cp -r "$SRC_DIR/tests"                  "$TARGET_DIR/tests"
+cp -r "$SRC_DIR/scripts"                "$TARGET_DIR/scripts"
+cp -r "$SRC_DIR/config"                 "$TARGET_DIR/config"
+cp    "$SRC_DIR/package.json"           "$TARGET_DIR/package.json"
+cp    "$SRC_DIR/pnpm-lock.yaml"         "$TARGET_DIR/pnpm-lock.yaml"
+cp    "$SRC_DIR/tsconfig.json"          "$TARGET_DIR/tsconfig.json"
+cp    "$SRC_DIR/modern.config.ts"       "$TARGET_DIR/modern.config.ts"
+cp    "$SRC_DIR/module-federation.config.ts" "$TARGET_DIR/module-federation.config.ts"
+cp    "$SRC_DIR/vitest.config.ts"       "$TARGET_DIR/vitest.config.ts"
+cp    "$SRC_DIR/playwright.config.ts"   "$TARGET_DIR/playwright.config.ts"
+cp    "$SRC_DIR/eslint.config.js"       "$TARGET_DIR/eslint.config.js"
+cp    "$SRC_DIR/Makefile"               "$TARGET_DIR/Makefile"
+cp    "$SRC_DIR/CLAUDE.md"              "$TARGET_DIR/CLAUDE.md"
+cp    "$SRC_DIR/AGENTS.md"              "$TARGET_DIR/AGENTS.md"
+
+# Customer-specific Dockerfile (different defaults than ours)
+cp    "$SRC_DIR/Dockerfile.react"       "$TARGET_DIR/Dockerfile"
+
+# 3. Copy deployment configs alongside the app
+if [ -d "$SRC_DIR/deployment" ]; then
+  mkdir -p "$DEPLOY_ROOT/deployment"
+  cp -R "$SRC_DIR/deployment/." "$DEPLOY_ROOT/deployment/"
+fi
+
+# 4. Cleanup artifacts that shouldn't ship
+find "$TARGET_DIR" -maxdepth 1 -name "*.png" -delete 2>/dev/null || true
+rm -rf "$TARGET_DIR/src/server/middleware/"*.test.ts 2>/dev/null || true
+rm -f "$TARGET_DIR/scripts/sync-to-flights-front.sh" 2>/dev/null || true
+rm -rf "$TARGET_DIR/scripts/ci" 2>/dev/null || true     # our pipeline scripts; not for customer
+rm -rf "$TARGET_DIR/scripts/phase-0" 2>/dev/null || true
+rm -f  "$TARGET_DIR/scripts/screenshot-diff.ts" 2>/dev/null || true
+rm -f  "$TARGET_DIR/playwright-angular.config.ts" 2>/dev/null || true
+rm -rf "$TARGET_DIR/tests/e2e-angular" 2>/dev/null || true
+rm -rf "$TARGET_DIR/tests/parity" 2>/dev/null || true
+rm -rf "$TARGET_DIR/tests/ci" 2>/dev/null || true       # our bash unit tests; not for customer
+rm -rf "$TARGET_DIR/.gitea" 2>/dev/null || true         # our workflows; not for customer
+rm -rf "$TARGET_DIR/docs/superpowers" 2>/dev/null || true
+
+# 5. Ensure .dockerignore exists at target
+if [ ! -f "$TARGET_DIR/.dockerignore" ]; then
+  cat > "$TARGET_DIR/.dockerignore" <<'EOF'
+node_modules
+dist
+coverage
+test-results
+playwright-report
+.playwright-mcp
+*.png
+*.md
+.git
+.claude
+.gstack
+EOF
+fi
+
+echo "ok: sync complete"
+```
+
+```bash
+chmod +x scripts/ci/sync-to-gitlab.sh
+```
+
+- [ ] **Step 3: Replace `scripts/sync-to-flights-front.sh` with a thin wrapper**
+
+Overwrite `scripts/sync-to-flights-front.sh`:
+
+```bash
+#!/usr/bin/env bash
+# sync-to-flights-front.sh — local dev convenience wrapper.
+#
+# Calls scripts/ci/sync-to-gitlab.sh with the local sibling-repo default.
+# CI uses scripts/ci/sync-to-gitlab.sh directly with a fresh clone target.
+set -euo pipefail
+
+SRC_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+TARGET_DIR="${1:-/Users/gnezim/_projects/tims/flights-front/Aeroflot.Flights.Front}"
+
+"$SRC_DIR/scripts/ci/sync-to-gitlab.sh" "$TARGET_DIR"
+
+DEPLOY_ROOT="$(cd "$TARGET_DIR/.." && pwd)"
+
+echo
+echo "Synced app files at $TARGET_DIR"
+echo
+echo "Next steps:"
+echo "  cd $TARGET_DIR"
+echo "  pnpm install    # if lock file changed"
+echo "  make check      # typecheck + lint + test"
+echo "  cd $DEPLOY_ROOT && git diff    # review changes"
+```
+
+- [ ] **Step 4: Smoke-check the wrapper invokes the core**
+
+```bash
+./scripts/sync-to-flights-front.sh /tmp/nonexistent-target 2>&1 | head -3
+```
+
+Expected: error from the core script: `fatal: target directory does not exist: /tmp/nonexistent-target`. Confirms the chain works.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add scripts/ci/sync-to-gitlab.sh scripts/sync-to-flights-front.sh
+git commit -m "ci: factor sync core into scripts/ci/sync-to-gitlab.sh"
+```
+
+---
+
+## Task 17: audit-console-allowlist.sh
+
+**Files:**
+- Create: `scripts/ci/audit-console-allowlist.sh`
+
+Quarterly maintenance helper. Runs e2e with the allowlist temporarily emptied; reports which entries were "needed" (matched something) vs dead.
+
+- [ ] **Step 1: Write the script**
+
+Write `scripts/ci/audit-console-allowlist.sh`:
+
+```bash
+#!/usr/bin/env bash
+# audit-console-allowlist.sh — find dead entries in tests/e2e/fixtures/console-allowlist.json.
+#
+# Usage: BASE_URL=<url> ./scripts/ci/audit-console-allowlist.sh
+#
+# Strategy: stash the current allowlist, run e2e with it empty (so console-gate
+# captures every message, attached to test artifacts), then diff captured
+# messages against allowlist patterns. Patterns that didn't match anything
+# are flagged as dead.
+set -euo pipefail
+
+REPO="$(cd "$(dirname "$0")/../.." && pwd)"
+ALLOWLIST="$REPO/tests/e2e/fixtures/console-allowlist.json"
+
+[ -f "$ALLOWLIST" ] || { echo "fatal: $ALLOWLIST not found" >&2; exit 1; }
+command -v jq >/dev/null 2>&1 || { echo "fatal: jq required" >&2; exit 2; }
+
+BACKUP=$(mktemp)
+cp "$ALLOWLIST" "$BACKUP"
+trap 'mv "$BACKUP" "$ALLOWLIST"' EXIT
+
+# Empty the allowlist
+echo '{"patterns":[]}' > "$ALLOWLIST"
+
+# Run e2e, allow failures (we want the captured messages, not pass/fail)
+echo "Running e2e with empty allowlist (captures all console messages)..."
+( cd "$REPO" && pnpm test:e2e --reporter=line ) || true
+
+# Collect all console-violations.txt attachments
+CAPTURED=$(mktemp)
+find "$REPO/playwright-report" -name "console-violations.txt" -exec cat {} \; > "$CAPTURED" || true
+find "$REPO/test-results"      -name "console-violations.txt" -exec cat {} \; >> "$CAPTURED" 2>/dev/null || true
+
+# For each pattern in the original allowlist, check if any captured line matches
+echo
+echo "=== Allowlist audit ==="
+PATTERNS=$(jq -r '.patterns[] | "\(.pattern)\t\(.reason)"' "$BACKUP")
+DEAD=0
+LIVE=0
+while IFS=$'\t' read -r pat reason; do
+  [ -z "$pat" ] && continue
+  if grep -qE "$pat" "$CAPTURED" 2>/dev/null; then
+    echo "✅ live: $pat — $reason"
+    LIVE=$((LIVE + 1))
+  else
+    echo "💀 dead: $pat — $reason"
+    DEAD=$((DEAD + 1))
+  fi
+done <<< "$PATTERNS"
+
+echo
+echo "Summary: $LIVE live, $DEAD dead. Review dead entries — they may be safe to remove."
+
+rm -f "$CAPTURED"
+```
+
+```bash
+chmod +x scripts/ci/audit-console-allowlist.sh
+```
+
+- [ ] **Step 2: Verify usage path**
+
+```bash
+./scripts/ci/audit-console-allowlist.sh 2>&1 | head -3 || true
+```
+
+(Will likely complain about missing BASE_URL or unable to run e2e — that's fine; this is operator-run only.)
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add scripts/ci/audit-console-allowlist.sh
+git commit -m "ci: audit-console-allowlist.sh — flag dead allowlist entries"
+```
+
+---
+
+## Task 18: Update sync script to also remove `.gitea/` from CI target
+
+This is a sub-task of Task 16's cleanup section — verify it's in place. The cleanup block in `scripts/ci/sync-to-gitlab.sh` should have:
+
+```bash
+rm -rf "$TARGET_DIR/.gitea" 2>/dev/null || true
+```
+
+(Already added in Task 16 — this task is a checkpoint, no new commit.)
+
+- [ ] **Step 1: Verify the line exists**
+
+```bash
+grep -n '\.gitea' scripts/ci/sync-to-gitlab.sh
+```
+
+Expected: matches the line shown above.
+
+- [ ] **Step 2: If missing, add it and commit**
+
+If grep returns no match, edit `scripts/ci/sync-to-gitlab.sh` to add the line in the cleanup section, then:
+
+```bash
+git add scripts/ci/sync-to-gitlab.sh
+git commit -m "ci: strip .gitea/ from sync target — workflows are gnerim-only"
+```
+
+---
+
+## Task 19: Adopt console-gate fixture in one e2e spec (smoke test)
+
+**Files:**
+- Modify: `tests/e2e/smoke.spec.ts`
+
+Switch one spec from the default `import { test } from "@playwright/test"` to `import { test } from "./fixtures/console-gate"`. This proves the fixture works against a real spec before changing all of them.
+
+- [ ] **Step 1: Read the current import line**
+
+```bash
+head -1 tests/e2e/smoke.spec.ts
+```
+
+- [ ] **Step 2: Replace the import**
+
+In `tests/e2e/smoke.spec.ts`, change line 1:
+
+```typescript
+import { test, expect } from "@playwright/test";
+```
+
+to:
+
+```typescript
+import { test, expect } from "./fixtures/console-gate";
+```
+
+Then add `consoleMessages` to the destructured params for at least one test so the fixture activates. For the test on line 4:
+
+```typescript
+test("root / redirects to /ru/onlineboard", async ({ page, consoleMessages }) => {
+```
+
+(The `consoleMessages` parameter is unused in the test body — including it just causes Playwright to instantiate the fixture, which installs the listener.)
+
+Apply this destructure change to **every test in the file**.
+
+- [ ] **Step 3: Run the spec locally (against running dev server)**
+
+If `pnpm dev` is running on `:8080`:
+
+```bash
+pnpm test:e2e tests/e2e/smoke.spec.ts --reporter=list
+```
+
+Expected: tests either pass cleanly or fail with `Console gate: N disallowed message(s):` listing real console output. The latter is informative — those messages are candidates for the allowlist or real bugs.
+
+If they fail on console messages, capture them — they'll inform the initial allowlist seeding once the pipeline runs.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add tests/e2e/smoke.spec.ts
+git commit -m "e2e: enable console-gate on smoke spec"
+```
+
+---
+
+## Task 20: Adopt console-gate fixture across all e2e specs
+
+**Files:**
+- Modify: every `tests/e2e/*.spec.ts`
+
+Apply the same import + destructure change to all 17 specs. Best done one-by-one with a quick visual check, but a bulk sed is acceptable for the import line.
+
+- [ ] **Step 1: List affected files**
+
+```bash
+ls tests/e2e/*.spec.ts
+```
+
+- [ ] **Step 2: Bulk-rewrite the import**
+
+```bash
+for f in tests/e2e/*.spec.ts; do
+  # Replace only the @playwright/test import path; keep other imports intact.
+  sed -i.bak 's|from "@playwright/test"|from "./fixtures/console-gate"|' "$f"
+  rm -f "$f.bak"
+done
+```
+
+- [ ] **Step 3: Verify no spec retained the old import**
+
+```bash
+grep -l '@playwright/test' tests/e2e/*.spec.ts || echo "all converted"
+```
+
+Expected: `all converted`.
+
+- [ ] **Step 4: Manually edit each spec to destructure `consoleMessages` in test signatures**
+
+For each spec, find every `async ({ page })` (or similar) and change to `async ({ page, consoleMessages })`. The fixture only activates if it's referenced.
+
+This is mechanical but unavoidable — there's no way for the fixture to apply globally without rewriting test signatures. Use ag/grep to find them:
+
+```bash
+grep -rn 'async ({ page' tests/e2e/*.spec.ts
+```
+
+Replace each. Skip lines that already destructure additional fixtures — extend them with `consoleMessages` instead.
+
+- [ ] **Step 5: Typecheck + a quick local run**
+
+```bash
+pnpm typecheck
+```
+
+Expected: no errors.
+
+```bash
+pnpm test:e2e tests/e2e/smoke.spec.ts tests/e2e/online-board.spec.ts --reporter=line || true
+```
+
+Failures from console messages are expected and informative. Real test failures (selectors, assertions) are not — those mean the bulk rewrite broke a destructure.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add tests/e2e/*.spec.ts
+git commit -m "e2e: adopt console-gate fixture across all specs"
+```
+
+---
+
+## Task 21: Workflow A — `.gitea/workflows/ci-deploy.yml`
+
+**Files:**
+- Create: `.gitea/workflows/ci-deploy.yml`
+
+Push-triggered workflow: build → test → docker build → swap container → e2e → rollback on failure.
+
+- [ ] **Step 1: Create the directory and file**
+
+```bash
+mkdir -p .gitea/workflows
+```
+
+Write `.gitea/workflows/ci-deploy.yml`:
+
+```yaml
+name: ci-deploy
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  build-deploy-test:
+    runs-on: pve-201
+    timeout-minutes: 30
+    env:
+      MAP_TILE_URL: ${{ secrets.MAP_TILE_URL || '/map/api/tile/{z}/{x}/{y}.jpeg' }}
+      API_BASE_URL: ${{ secrets.API_BASE_URL || '/api' }}
+      BASIC_AUTH_USER: ${{ secrets.BASIC_AUTH_USER }}
+      BASIC_AUTH_PASS: ${{ secrets.BASIC_AUTH_PASS }}
+      TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+      TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+      FLIGHTS_WEB_PORT: '8081'
+
+    steps:
+      - name: Notify start
+        if: ${{ env.TELEGRAM_BOT_TOKEN != '' }}
+        run: scripts/ci/notify-telegram.sh start ci-deploy
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Restore pnpm cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.pnpm-store
+          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: pnpm-
+
+      - name: Install dependencies
+        id: deps
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck
+        id: typecheck
+        run: pnpm typecheck
+
+      - name: Lint
+        id: lint
+        run: pnpm lint
+
+      - name: Unit tests
+        id: unit
+        run: pnpm test
+
+      - name: CI script tests
+        id: citest
+        run: pnpm test:ci
+
+      - name: Build SSR image
+        id: docker_build
+        run: |
+          docker build -f Dockerfile.react \
+            --build-arg "MAP_TILE_URL=${MAP_TILE_URL}" \
+            --build-arg "API_BASE_URL=${API_BASE_URL}" \
+            -t "flights-web:${GITHUB_SHA:0:7}" \
+            .
+
+      - name: Render htpasswd + reload nginx
+        id: htpasswd
+        run: scripts/ci/install-htpasswd.sh
+
+      - name: Swap container
+        id: swap
+        run: scripts/ci/deploy-container.sh swap
+
+      - name: Wait for health
+        id: health
+        env:
+          BASIC_AUTH_USER: ${{ secrets.BASIC_AUTH_USER }}
+          BASIC_AUTH_PASS: ${{ secrets.BASIC_AUTH_PASS }}
+        run: scripts/ci/wait-for-url.sh https://ui-dashboard.gnerim.ru/ 30 2
+
+      - name: Run Playwright e2e
+        id: e2e
+        env:
+          BASE_URL: http://127.0.0.1:8081
+        run: pnpm test:e2e
+
+      - name: Rollback on failure (post-deploy steps)
+        if: failure() && (steps.swap.outcome == 'failure' || steps.health.outcome == 'failure' || steps.e2e.outcome == 'failure')
+        id: rollback
+        run: scripts/ci/deploy-container.sh rollback
+
+      - name: Capture container logs (on failure)
+        if: failure()
+        run: docker logs flights-web --tail 500 > container.log 2>&1 || true
+
+      - name: Upload artifacts on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ci-deploy-failure-${{ github.run_id }}
+          path: |
+            container.log
+            playwright-report/
+          retention-days: 7
+
+      - name: Prune old images
+        if: success()
+        run: |
+          docker images flights-web --format '{{.Tag}} {{.ID}}' \
+            | grep -vE '^(current|previous)\b' \
+            | tail -n +6 \
+            | awk '{print $2}' \
+            | xargs -r docker rmi 2>/dev/null || true
+
+      - name: Notify (success)
+        if: success() && env.TELEGRAM_BOT_TOKEN != ''
+        run: scripts/ci/notify-telegram.sh ok ci-deploy
+
+      - name: Notify (failure)
+        if: failure() && env.TELEGRAM_BOT_TOKEN != ''
+        run: |
+          # Pick the first failed step name we know of.
+          for step in deps typecheck lint unit citest docker_build htpasswd swap health e2e rollback; do
+            outcome="${{ steps.deps.outcome }}${{ steps.typecheck.outcome }}${{ steps.lint.outcome }}${{ steps.unit.outcome }}${{ steps.citest.outcome }}${{ steps.docker_build.outcome }}${{ steps.htpasswd.outcome }}${{ steps.swap.outcome }}${{ steps.health.outcome }}${{ steps.e2e.outcome }}${{ steps.rollback.outcome }}"
+            : # placeholder — see comment below
+          done
+          # Simpler: just use the workflow run url; the artifact and Gitea UI hold step detail.
+          scripts/ci/notify-telegram.sh fail ci-deploy "see run for details" container.log || \
+            scripts/ci/notify-telegram.sh fail ci-deploy "see run for details"
+```
+
+> **Implementation note for the YAML author:** Gitea Actions uses the same syntax as GitHub Actions for steps/outputs/`if` conditions, but the `runs-on` label `pve-201` must match the label your runner registered with. Verify with `gitea actions runners list` (or the Gitea admin UI) before the first push.
+
+- [ ] **Step 2: Lint the YAML if actionlint is available**
+
+```bash
+which actionlint && actionlint .gitea/workflows/ci-deploy.yml || echo "actionlint not installed; visual review only"
+```
+
+If `actionlint` is installed and reports issues, fix them. Otherwise visual-review for indentation and unbalanced quotes.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add .gitea/workflows/ci-deploy.yml
+git commit -m "ci: workflow A — push-triggered build/deploy/e2e on pve-201"
+```
+
+---
+
+## Task 22: First push and iterate
+
+This task is **on-host work**, not a code change. It is the "Layer 2 staged rollout" from the spec.
+
+- [ ] **Step 1: Confirm prereqs from `deployment/README.md` are done**
+
+Walk through sections 1–8 of `deployment/README.md`. Tick each one off.
+
+- [ ] **Step 2: Confirm uncommitted work in main is clean**
+
+```bash
+git status
+```
+
+Should be clean (Tasks 1–21 are all committed). If there's other unrelated work, deal with it before pushing.
+
+- [ ] **Step 3: Push to Gitea**
+
+```bash
+git push origin main
+```
+
+- [ ] **Step 4: Watch the run in Gitea Actions**
+
+Open the Gitea Actions tab on the repo. Watch the run.
+
+**Expected:** The first run will likely fail somewhere. Common failure modes and fixes:
+
+| Failure | Likely cause | Fix |
+|---|---|---|
+| Setup pnpm fails | runner missing pnpm | Install on runner host or use the action's auto-install |
+| `docker build` fails: cannot connect | runner not in docker group | `sudo usermod -aG docker <runner-user>`, restart runner |
+| `htpasswd` step fails: permission denied | runner needs sudo for nginx paths | Add runner to sudoers for `nginx -s reload` and `tee /etc/nginx/htpasswd/*` |
+| Swap step fails: port 8081 already in use | something else owns the port | Pick another port; update both `FLIGHTS_WEB_PORT` env in workflow and nginx vhost |
+| Health check times out | nginx misconfigured or container not bound to expected port | `docker logs flights-web`; `curl -v http://127.0.0.1:8081/`; check nginx error log |
+| e2e fails: every test on console-gate | real warnings to allowlist or real bugs | Capture messages from artifacts, decide which go in allowlist (with reason), which are bugs to fix |
+| e2e fails: tests can't find selectors | tests assume `localhost:8080` style state (HMR fixtures, dev-only routes) | Mark those tests as `.skip()` for remote BASE_URL, or fix the assumption |
+
+**Iterate:** push fixes as new commits to `main`. Each push triggers a new Workflow A run. Budget 1-2 dev days.
+
+- [ ] **Step 5: When green, allowlist any kept warnings**
+
+Edit `tests/e2e/fixtures/console-allowlist.json` with each kept pattern + reason. Commit.
+
+```bash
+git add tests/e2e/fixtures/console-allowlist.json
+git commit -m "e2e: seed console allowlist from first ci-deploy runs"
+```
+
+---
+
+## Task 23: PR #2 — delete `.github/workflows/`
+
+**Files:**
+- Delete: `.github/workflows/ci.yml`
+- Delete: `.github/workflows/deploy.yml`
+
+Only do this **after Workflow A has run green for at least 3 consecutive commits**. Premature deletion loses the only working CI if the new pipeline is wrong.
+
+- [ ] **Step 1: Confirm Gitea workflow has been green**
+
+In the Gitea Actions UI, verify the last 3+ runs of `ci-deploy` are green.
+
+- [ ] **Step 2: Delete the GitHub workflows**
+
+```bash
+git rm .github/workflows/ci.yml .github/workflows/deploy.yml
+```
+
+- [ ] **Step 3: Verify the directory still exists or is removed cleanly**
+
+```bash
+ls .github/workflows/ 2>/dev/null
+# If empty:
+rmdir .github/workflows 2>/dev/null || true
+rmdir .github 2>/dev/null || true
+```
+
+- [ ] **Step 4: Commit**
+
+```bash
+git commit -m "ci: remove unused .github/workflows — superseded by .gitea/workflows"
+```
+
+- [ ] **Step 5: Push and verify Workflow A still runs (sanity)**
+
+```bash
+git push origin main
+```
+
+Watch the Gitea Actions UI. Workflow A should fire and pass.
+
+---
+
+## Task 24: Workflow B — `.gitea/workflows/release.yml`
+
+**Files:**
+- Create: `.gitea/workflows/release.yml`
+
+Manual + tag-triggered workflow: verify A is green → re-run lint/test → sync to GitLab → MR open/approve/merge → trigger Jenkins → poll → e2e on customer URL.
+
+- [ ] **Step 1: Create the file**
+
+Write `.gitea/workflows/release.yml`:
+
+```yaml
+name: release
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'release-*'
+
+jobs:
+  release:
+    runs-on: pve-201
+    timeout-minutes: 60
+    env:
+      GITLAB_PAT: ${{ secrets.GITLAB_PAT }}
+      GITLAB_PROJECT_ID: ${{ secrets.GITLAB_PROJECT_ID }}
+      GITLAB_HOST: 'https://teamscore.gitlab.yandexcloud.net'
+      GITLAB_PROJECT_PATH: 'aeroflot2/flights-front'
+      JENKINS_BASE_URL: 'http://jenkins.yc.devwebzavod.ru:8080'
+      JENKINS_JOB_PATH: '/job/Aeroflot2/job/Flights-Front-Dev'
+      JENKINS_USER: ${{ secrets.JENKINS_USER }}
+      JENKINS_API_TOKEN: ${{ secrets.JENKINS_API_TOKEN }}
+      JENKINS_TRIGGER_TOKEN: ${{ secrets.JENKINS_TRIGGER_TOKEN }}
+      TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+      TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+
+    steps:
+      - name: Notify start
+        if: ${{ env.TELEGRAM_BOT_TOKEN != '' }}
+        run: scripts/ci/notify-telegram.sh start release
+
+      - name: Checkout (full history + tags)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Verify ci-deploy is green for this SHA
+        id: gate
+        run: |
+          API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/actions/runs?head_sha=${GITHUB_SHA}"
+          # Gitea Actions API is similar to GitHub's; this query may differ slightly per Gitea version.
+          # If the endpoint isn't available, fall back to a last-3-runs check via the workflows endpoint.
+          resp=$(curl -fsS -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" "$API" || echo '{"workflow_runs":[]}')
+          ok=$(echo "$resp" | jq -r --arg name "ci-deploy" '
+            .workflow_runs[]
+            | select(.name == $name)
+            | .conclusion
+          ' | head -1)
+          if [ "$ok" != "success" ]; then
+            echo "fatal: ci-deploy is not green for ${GITHUB_SHA} (got: '${ok:-none}')"
+            exit 1
+          fi
+          echo "ci-deploy green for ${GITHUB_SHA}"
+
+      - name: Setup Node + pnpm
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+      - uses: pnpm/action-setup@v4
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Paranoid re-run — typecheck + lint + unit
+        id: paranoid
+        run: |
+          pnpm typecheck
+          pnpm lint
+          pnpm test
+          pnpm test:ci
+
+      - name: Clone GitLab target
+        id: clone
+        env:
+          GITLAB_PAT: ${{ secrets.GITLAB_PAT }}
+        run: |
+          rm -rf /tmp/flights-front
+          git clone "https://oauth2:${GITLAB_PAT}@teamscore.gitlab.yandexcloud.net/aeroflot2/flights-front.git" /tmp/flights-front
+          mkdir -p /tmp/flights-front/Aeroflot.Flights.Front
+
+      - name: Sync to GitLab clone
+        id: sync
+        run: scripts/ci/sync-to-gitlab.sh /tmp/flights-front/Aeroflot.Flights.Front
+
+      - name: Commit on auto branch
+        id: commit
+        run: |
+          cd /tmp/flights-front
+          git config user.email "ci@gnerim.ru"
+          git config user.name  "gnerim CI"
+          BRANCH="auto/sync-${GITHUB_SHA:0:7}"
+          git checkout -b "$BRANCH"
+          git add -A
+          if git diff --cached --quiet; then
+            echo "nothing to sync"
+            echo "skip_remaining=1" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git commit -m "auto: sync from gitea ${GITHUB_SHA:0:7}"
+          echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"
+
+      - name: Push branch
+        id: push
+        if: steps.commit.outputs.skip_remaining != '1'
+        run: |
+          cd /tmp/flights-front
+          git push -u origin "${{ steps.commit.outputs.branch }}"
+
+      - name: Open MR
+        id: mr_open
+        if: steps.commit.outputs.skip_remaining != '1'
+        run: |
+          BRANCH="${{ steps.commit.outputs.branch }}"
+          TITLE="auto: sync from gitea ${GITHUB_SHA:0:7}"
+          BODY="Auto-sync from gitea run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+          resp=$(curl -fsS -X POST \
+            -H "PRIVATE-TOKEN: ${GITLAB_PAT}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -nc --arg sb "$BRANCH" --arg t "$TITLE" --arg d "$BODY" '{source_branch:$sb, target_branch:"main", title:$t, description:$d, remove_source_branch:true, squash:true}')" \
+            "${GITLAB_HOST}/api/v4/projects/${GITLAB_PROJECT_ID}/merge_requests")
+          IID=$(echo "$resp" | jq -r '.iid')
+          [ "$IID" != "null" ] || { echo "fatal: MR open failed: $resp" >&2; exit 1; }
+          echo "iid=$IID" >> "$GITHUB_OUTPUT"
+          echo "url=$(echo "$resp" | jq -r '.web_url')" >> "$GITHUB_OUTPUT"
+
+      - name: Approve MR
+        id: mr_approve
+        if: steps.commit.outputs.skip_remaining != '1'
+        run: |
+          curl -fsS -X POST \
+            -H "PRIVATE-TOKEN: ${GITLAB_PAT}" \
+            "${GITLAB_HOST}/api/v4/projects/${GITLAB_PROJECT_ID}/merge_requests/${{ steps.mr_open.outputs.iid }}/approve" \
+            >/dev/null || {
+              echo "fatal: MR approve failed — verify 'Prevent approval by author' is unchecked"
+              exit 1
+            }
+
+      - name: Merge MR
+        id: mr_merge
+        if: steps.commit.outputs.skip_remaining != '1'
+        run: |
+          curl -fsS -X PUT \
+            -H "PRIVATE-TOKEN: ${GITLAB_PAT}" \
+            -H "Content-Type: application/json" \
+            -d '{"merge_when_pipeline_succeeds":false,"should_remove_source_branch":true,"squash":true}' \
+            "${GITLAB_HOST}/api/v4/projects/${GITLAB_PROJECT_ID}/merge_requests/${{ steps.mr_open.outputs.iid }}/merge" \
+            >/dev/null
+
+      - name: Cleanup MR + branch on failure (B:9-11 only)
+        if: failure() && (steps.mr_open.outcome == 'failure' || steps.mr_approve.outcome == 'failure' || steps.mr_merge.outcome == 'failure')
+        run: |
+          IID="${{ steps.mr_open.outputs.iid }}"
+          BRANCH="${{ steps.commit.outputs.branch }}"
+          if [ -n "$IID" ] && [ "$IID" != "null" ]; then
+            curl -fsS -X PUT \
+              -H "PRIVATE-TOKEN: ${GITLAB_PAT}" \
+              -H "Content-Type: application/json" \
+              -d '{"state_event":"close"}' \
+              "${GITLAB_HOST}/api/v4/projects/${GITLAB_PROJECT_ID}/merge_requests/${IID}" \
+              >/dev/null || true
+          fi
+          if [ -n "$BRANCH" ]; then
+            curl -fsS -X DELETE \
+              -H "PRIVATE-TOKEN: ${GITLAB_PAT}" \
+              "${GITLAB_HOST}/api/v4/projects/${GITLAB_PROJECT_ID}/repository/branches/$(printf '%s' "$BRANCH" | sed 's|/|%2F|g')" \
+              >/dev/null || true
+          fi
+
+      - name: Trigger + wait for Jenkins
+        id: jenkins
+        if: steps.commit.outputs.skip_remaining != '1'
+        run: scripts/ci/jenkins-trigger-and-wait.sh
+
+      - name: Wait for customer URL to update
+        id: wait_customer
+        if: steps.commit.outputs.skip_remaining != '1'
+        run: scripts/ci/wait-for-url.sh http://flights-ui.devwebzavod.ru/ru-ru/onlineboard 60 5
+
+      - name: Run Playwright e2e against customer URL
+        id: e2e_customer
+        if: steps.commit.outputs.skip_remaining != '1'
+        env:
+          BASE_URL: http://flights-ui.devwebzavod.ru
+        run: pnpm test:e2e
+
+      - name: Upload artifacts on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-failure-${{ github.run_id }}
+          path: |
+            playwright-report/
+          retention-days: 7
+
+      - name: Notify (success)
+        if: success() && env.TELEGRAM_BOT_TOKEN != ''
+        run: scripts/ci/notify-telegram.sh ok release "MR ${{ steps.mr_open.outputs.url }}"
+
+      - name: Notify (failure)
+        if: failure() && env.TELEGRAM_BOT_TOKEN != ''
+        run: scripts/ci/notify-telegram.sh fail release "see Gitea run"
+```
+
+> **Implementation notes:**
+> - The "Verify ci-deploy is green" step uses `secrets.GITHUB_TOKEN` — Gitea provides this automatically. The exact API path may differ between Gitea versions; consult `https://git.gnerim.ru/api/swagger` for the runtime API and adjust if needed.
+> - `BRANCH` cleanup uses URL-encoded branch name (slashes → `%2F`) because the GitLab branches API requires it.
+> - The `skip_remaining` flag short-circuits when there's no diff to sync.
+
+- [ ] **Step 2: Lint the YAML if actionlint is available**
+
+```bash
+which actionlint && actionlint .gitea/workflows/release.yml || echo "actionlint not installed; visual review only"
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add .gitea/workflows/release.yml
+git commit -m "ci: workflow B — release flow to GitLab + Jenkins + customer e2e"
+```
+
+---
+
+## Task 25: First Workflow B run + iterate
+
+On-host work, not a code change. The first end-to-end release run.
+
+- [ ] **Step 1: Confirm Workflow B prereqs**
+
+From `deployment/README.md`:
+- GitLab PAT created with `api`+`write_repository` (#4)
+- "Prevent approval by author" unchecked (#5)
+- Jenkins remote trigger token configured (#6)
+- All Workflow B secrets in Gitea (#8)
+
+Run `scripts/ci/check-gitlab-project.sh` once to confirm — it must print `✅ Self-approve allowed` and `✅ Push auth ok`.
+
+- [ ] **Step 2: Trigger Workflow B manually**
+
+Gitea UI → Actions → release → "Run workflow" → Branch: main → Run.
+
+(Or: `git tag release-2026-04-25 && git push --tags`.)
+
+- [ ] **Step 3: Watch the run**
+
+**Expected first-run failures and fixes:**
+
+| Failure | Likely cause | Fix |
+|---|---|---|
+| Verify gate step: API path 404 | Gitea Actions API path differs in your version | Adjust to your Gitea's actual endpoint (check `/api/swagger`) |
+| Sync step missing files | the cleanup section's exclusion list missed something | Edit `scripts/ci/sync-to-gitlab.sh` cleanup |
+| Open MR step 401 | PAT scopes wrong | Recreate PAT with `api` + `write_repository` |
+| Approve MR step 401 | Self-approve still blocked | Re-check project settings |
+| Trigger Jenkins step 403 | Trigger token wrong, or job requires CSRF crumb | Verify token; add `Crumb` header if Jenkins requires CSRF |
+| Customer URL wait times out | Jenkins reported SUCCESS but didn't deploy, or the customer's URL takes longer than 5 min | Increase `wait-for-url.sh` attempts, or investigate Jenkins job |
+| e2e fails against customer URL | their dev env has different state, or some specs are env-coupled | Mark those specs `.skip()` for `flights-ui.devwebzavod.ru`, document why |
+
+Each fix → push to main → re-run B manually until green.
+
+- [ ] **Step 4: Verify a git-tag-triggered run also works**
+
+```bash
+git tag release-2026-04-25-test
+git push --tags
+```
+
+Watch the Gitea UI for an auto-triggered B run.
+
+If it works, the pipeline is live. Delete the test tag:
+
+```bash
+git push --delete origin release-2026-04-25-test
+git tag -d release-2026-04-25-test
+```
+
+---
+
+## Self-Review Checklist (run by plan author after writing)
+
+- [x] **Spec coverage:** every section of the spec maps to at least one task. Architecture/invariants → Task 21 (workflow A) and Task 24 (workflow B). Routing/nginx → Tasks 1, 2. Build-args → Task 21 step 1 (in YAML body). Basic auth → Tasks 10, 21. Workflow A jobs → Task 21. Workflow B jobs → Task 24. Prerequisites → Task 2 (runbook). Secrets → Task 2 (runbook). Scripts → Tasks 7, 9, 10, 11, 13, 14, 15, 16, 17. Console-error gate → Tasks 4, 19, 20. Failure handling → Tasks 7, 8, 11, 21, 24 + Task 2 rehearsal recipes. Telegram message shapes → Tasks 7, 8. Testing-the-pipeline strategy → Tasks 7-15 (unit tests with `--dry-run`/`--mock-mode`); Task 22 (Layer 2 staged rollout); Task 2 (Layer 3 rehearsals). Future seam: registry → `IMAGE_NAME` env in Task 11 already supports it. Open questions → Task 3 (snap-*.yml gitignore); Task 22 (e2e portability iteration); Task 22 step 5 (allowlist seeding).
+- [x] **Placeholder scan:** No `TBD`, `TODO`, "implement later", "fill in details", or vague "add error handling" steps. Each script has full content. Each workflow YAML has full content. (Note: a single `TODO` exists in the existing `tests/e2e/smoke.spec.ts` source file we read — that's not in this plan.)
+- [x] **Type/symbol consistency:** Image name `flights-web`, container name `flights-web`, port `8081`, alias names `current`/`previous`, secret names (`BASIC_AUTH_USER`, `GITLAB_PAT`, `GITLAB_PROJECT_ID`, `JENKINS_TRIGGER_TOKEN`, `JENKINS_API_TOKEN`, `TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID`, `MAP_TILE_URL`, `API_BASE_URL`), and script paths (`scripts/ci/notify-telegram.sh`, etc.) are consistent across spec, runbook, scripts, and workflow YAML. Subcommand names `swap`/`rollback` consistent in `deploy-container.sh` and the workflow that calls it.
+
+No issues to fix.